# Flog Txt Version 1 # Analyzer Version: 4.6.0 # Analyzer Build Date: Jul 8 2022 06:26:21 # Log Creation Date: 01.09.2022 22:05:19.687 Process: id = "1" image_name = "006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe" page_root = "0x3ae27000" os_pid = "0x1344" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7b4" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 117 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 118 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 119 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 120 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 121 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 122 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 123 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 124 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 125 start_va = 0x1320000 end_va = 0x134ffff monitored = 1 entry_point = 0x1337ea3 region_type = mapped_file name = "006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe") Region: id = 126 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 127 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 129 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 130 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 131 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 270 start_va = 0x400000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 271 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 272 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 273 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0x570000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 276 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 279 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 280 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 282 start_va = 0x73e50000 end_va = 0x73ee1fff monitored = 0 entry_point = 0x73e90380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 283 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 284 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 285 start_va = 0x570000 end_va = 0x678fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 286 start_va = 0x710000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 287 start_va = 0x71560000 end_va = 0x7157afff monitored = 0 entry_point = 0x71569050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 288 start_va = 0x6f8a0000 end_va = 0x6f8a9fff monitored = 0 entry_point = 0x6f8a28d0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 289 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 290 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 291 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 292 start_va = 0x810000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 293 start_va = 0x6f880000 end_va = 0x6f89bfff monitored = 0 entry_point = 0x6f884720 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 294 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 295 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 296 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 297 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 298 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 299 start_va = 0x71510000 end_va = 0x7153efff monitored = 0 entry_point = 0x7151bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 300 start_va = 0x73f30000 end_va = 0x73f8efff monitored = 0 entry_point = 0x73f34af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 301 start_va = 0x74eb0000 end_va = 0x762aefff monitored = 0 entry_point = 0x7506b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 302 start_va = 0x76800000 end_va = 0x76836fff monitored = 0 entry_point = 0x76803b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 303 start_va = 0x745b0000 end_va = 0x74aa8fff monitored = 0 entry_point = 0x747b7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 304 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 305 start_va = 0x76600000 end_va = 0x7667afff monitored = 0 entry_point = 0x7661e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 306 start_va = 0x76d00000 end_va = 0x76d44fff monitored = 0 entry_point = 0x76d1de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 307 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 308 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 309 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 310 start_va = 0x74520000 end_va = 0x745acfff monitored = 0 entry_point = 0x74569b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 311 start_va = 0x76470000 end_va = 0x764b3fff monitored = 0 entry_point = 0x76477410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 312 start_va = 0x73f20000 end_va = 0x73f2efff monitored = 0 entry_point = 0x73f22e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 313 start_va = 0x4c0000 end_va = 0x4e9fff monitored = 0 entry_point = 0x4c5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 314 start_va = 0x940000 end_va = 0xac7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 315 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 316 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 317 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 318 start_va = 0xad0000 end_va = 0xc50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 319 start_va = 0x1350000 end_va = 0x274ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001350000" filename = "" Region: id = 320 start_va = 0x6f860000 end_va = 0x6f875fff monitored = 0 entry_point = 0x6f8621d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 321 start_va = 0x4d0000 end_va = 0x4e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 322 start_va = 0x4f0000 end_va = 0x505fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 323 start_va = 0x510000 end_va = 0x53bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 324 start_va = 0xc60000 end_va = 0xdd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 325 start_va = 0x670000 end_va = 0x707fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 326 start_va = 0xc60000 end_va = 0xddcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 327 start_va = 0x670000 end_va = 0x6fdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 328 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 329 start_va = 0x540000 end_va = 0x548fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 330 start_va = 0x810000 end_va = 0x8ccfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 331 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 332 start_va = 0x540000 end_va = 0x552fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 333 start_va = 0x810000 end_va = 0x8bcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 334 start_va = 0x540000 end_va = 0x55cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 335 start_va = 0x540000 end_va = 0x547fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 336 start_va = 0x670000 end_va = 0x6c8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 337 start_va = 0x670000 end_va = 0x6b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 338 start_va = 0x670000 end_va = 0x69dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 339 start_va = 0x670000 end_va = 0x6cefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 340 start_va = 0x2750000 end_va = 0x3b75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 341 start_va = 0x670000 end_va = 0x6a5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 342 start_va = 0xc60000 end_va = 0x115efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 343 start_va = 0xc60000 end_va = 0xe1dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 344 start_va = 0x670000 end_va = 0x6e9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 345 start_va = 0x712e0000 end_va = 0x712f2fff monitored = 0 entry_point = 0x712e9950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 346 start_va = 0x670000 end_va = 0x6b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 347 start_va = 0x6f850000 end_va = 0x6f858fff monitored = 0 entry_point = 0x6f853dc0 region_type = mapped_file name = "shunimpl.dll" filename = "\\Windows\\SysWOW64\\shunimpl.dll" (normalized: "c:\\windows\\syswow64\\shunimpl.dll") Region: id = 348 start_va = 0x6f850000 end_va = 0x6f858fff monitored = 0 entry_point = 0x6f853dc0 region_type = mapped_file name = "shunimpl.dll" filename = "\\Windows\\SysWOW64\\shunimpl.dll" (normalized: "c:\\windows\\syswow64\\shunimpl.dll") Region: id = 349 start_va = 0x6f850000 end_va = 0x6f858fff monitored = 0 entry_point = 0x6f853dc0 region_type = mapped_file name = "shunimpl.dll" filename = "\\Windows\\SysWOW64\\shunimpl.dll" (normalized: "c:\\windows\\syswow64\\shunimpl.dll") Region: id = 350 start_va = 0xc60000 end_va = 0xdaefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 351 start_va = 0xc60000 end_va = 0xda6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 352 start_va = 0x540000 end_va = 0x549fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 353 start_va = 0x670000 end_va = 0x6fbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 354 start_va = 0x670000 end_va = 0x6b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 355 start_va = 0x540000 end_va = 0x54dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 356 start_va = 0x670000 end_va = 0x699fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 357 start_va = 0x540000 end_va = 0x554fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 358 start_va = 0x4d0000 end_va = 0x4d2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 359 start_va = 0x2750000 end_va = 0xa74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 360 start_va = 0xa750000 end_va = 0xaf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a750000" filename = "" Region: id = 361 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 362 start_va = 0x670000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 363 start_va = 0x810000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 364 start_va = 0x76900000 end_va = 0x76906fff monitored = 0 entry_point = 0x76901e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 365 start_va = 0x6f840000 end_va = 0x6f853fff monitored = 0 entry_point = 0x6f843c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 366 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 367 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 368 start_va = 0x6b0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 369 start_va = 0xc60000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 370 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 371 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 372 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 373 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 374 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 375 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 376 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 377 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 378 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 379 start_va = 0x12a0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 380 start_va = 0x12e0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 381 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 382 start_va = 0xb050000 end_va = 0xb14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 383 start_va = 0xb150000 end_va = 0xb24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 384 start_va = 0xb250000 end_va = 0xb28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 385 start_va = 0xb290000 end_va = 0xb38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 386 start_va = 0xb390000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 387 start_va = 0xb3d0000 end_va = 0xb4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 388 start_va = 0xb4d0000 end_va = 0xb50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 389 start_va = 0xb510000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 390 start_va = 0xb610000 end_va = 0xb64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b610000" filename = "" Region: id = 391 start_va = 0xb650000 end_va = 0xb74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b650000" filename = "" Region: id = 392 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 393 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 394 start_va = 0xb890000 end_va = 0xb8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b890000" filename = "" Region: id = 395 start_va = 0xb8d0000 end_va = 0xb9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b8d0000" filename = "" Region: id = 396 start_va = 0xb9d0000 end_va = 0xba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b9d0000" filename = "" Region: id = 397 start_va = 0xba10000 end_va = 0xbb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ba10000" filename = "" Region: id = 398 start_va = 0xbb10000 end_va = 0xbb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb10000" filename = "" Region: id = 399 start_va = 0xbb50000 end_va = 0xbc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb50000" filename = "" Region: id = 400 start_va = 0xbc50000 end_va = 0xbc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc50000" filename = "" Region: id = 401 start_va = 0xbc90000 end_va = 0xbd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc90000" filename = "" Region: id = 402 start_va = 0xbd90000 end_va = 0xbdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd90000" filename = "" Region: id = 403 start_va = 0xbdd0000 end_va = 0xbecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bdd0000" filename = "" Region: id = 404 start_va = 0xbed0000 end_va = 0xbf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bed0000" filename = "" Region: id = 405 start_va = 0xbf10000 end_va = 0xc00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bf10000" filename = "" Region: id = 406 start_va = 0xc010000 end_va = 0xc04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c010000" filename = "" Region: id = 407 start_va = 0xc050000 end_va = 0xc14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c050000" filename = "" Region: id = 408 start_va = 0xc150000 end_va = 0xc18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 409 start_va = 0xc190000 end_va = 0xc28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c190000" filename = "" Region: id = 410 start_va = 0xc290000 end_va = 0xc2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c290000" filename = "" Region: id = 411 start_va = 0xc2d0000 end_va = 0xc3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c2d0000" filename = "" Region: id = 412 start_va = 0xc3d0000 end_va = 0xc40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 413 start_va = 0xc410000 end_va = 0xc50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 414 start_va = 0xc510000 end_va = 0xc54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 415 start_va = 0xc550000 end_va = 0xc64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c550000" filename = "" Region: id = 416 start_va = 0xc650000 end_va = 0xc68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 417 start_va = 0xc690000 end_va = 0xc78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 418 start_va = 0xc790000 end_va = 0xc7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c790000" filename = "" Region: id = 419 start_va = 0xc7d0000 end_va = 0xc8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c7d0000" filename = "" Region: id = 420 start_va = 0xc8d0000 end_va = 0xc90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c8d0000" filename = "" Region: id = 421 start_va = 0xc910000 end_va = 0xca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c910000" filename = "" Region: id = 422 start_va = 0xca10000 end_va = 0xca4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca10000" filename = "" Region: id = 423 start_va = 0xca50000 end_va = 0xcb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 424 start_va = 0xcb50000 end_va = 0xcb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 425 start_va = 0xcb90000 end_va = 0xcc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 426 start_va = 0xcc90000 end_va = 0xcccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cc90000" filename = "" Region: id = 427 start_va = 0xccd0000 end_va = 0xcdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ccd0000" filename = "" Region: id = 428 start_va = 0xcdd0000 end_va = 0xce0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 429 start_va = 0xce10000 end_va = 0xcf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 430 start_va = 0xcf10000 end_va = 0xcf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 431 start_va = 0xcf50000 end_va = 0xd04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 432 start_va = 0xd050000 end_va = 0xd08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 433 start_va = 0xd090000 end_va = 0xd18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 434 start_va = 0xd190000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 435 start_va = 0xd1d0000 end_va = 0xd2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 436 start_va = 0xd2d0000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 437 start_va = 0xd310000 end_va = 0xd40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 438 start_va = 0xd410000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 439 start_va = 0xd450000 end_va = 0xd54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 440 start_va = 0xd550000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 441 start_va = 0xd590000 end_va = 0xd68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 442 start_va = 0xd690000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 443 start_va = 0xd6d0000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 444 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 445 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 446 start_va = 0xd910000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 447 start_va = 0xd950000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 448 start_va = 0xda50000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 449 start_va = 0xda90000 end_va = 0xdb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 450 start_va = 0xdb90000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 451 start_va = 0xdbd0000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 452 start_va = 0xdcd0000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dcd0000" filename = "" Region: id = 453 start_va = 0xdd10000 end_va = 0xde0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 454 start_va = 0xde10000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 455 start_va = 0xde50000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 456 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 457 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 458 start_va = 0x71400000 end_va = 0x71407fff monitored = 0 entry_point = 0x71401fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 459 start_va = 0x540000 end_va = 0x540fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mpr.dll.mui") Region: id = 460 start_va = 0xe090000 end_va = 0xe0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 461 start_va = 0xe0d0000 end_va = 0xe1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 462 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 463 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 464 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 465 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 466 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 467 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 468 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 469 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 470 start_va = 0xe6d0000 end_va = 0xe70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e6d0000" filename = "" Region: id = 471 start_va = 0xe710000 end_va = 0xe80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 472 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 473 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 474 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 475 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 476 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 477 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 478 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 479 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 480 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 481 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 482 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 483 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 484 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 485 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 486 start_va = 0xf0d0000 end_va = 0xf10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f0d0000" filename = "" Region: id = 487 start_va = 0xf110000 end_va = 0xf20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f110000" filename = "" Region: id = 488 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 489 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 490 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 491 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 492 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 493 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 494 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 495 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 496 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 497 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 498 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 499 start_va = 0xf890000 end_va = 0xf98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 500 start_va = 0x550000 end_va = 0x553fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 501 start_va = 0x6f7c0000 end_va = 0x6f7c8fff monitored = 0 entry_point = 0x6f7c1db0 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 502 start_va = 0x6f770000 end_va = 0x6f7b3fff monitored = 0 entry_point = 0x6f78aaf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 503 start_va = 0xf990000 end_va = 0xf9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f990000" filename = "" Region: id = 504 start_va = 0xf9d0000 end_va = 0xfacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f9d0000" filename = "" Region: id = 505 start_va = 0x6f750000 end_va = 0x6f761fff monitored = 0 entry_point = 0x6f753d40 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 506 start_va = 0xfad0000 end_va = 0xfbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fad0000" filename = "" Region: id = 507 start_va = 0x6f730000 end_va = 0x6f749fff monitored = 0 entry_point = 0x6f733270 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 508 start_va = 0x72d60000 end_va = 0x72d6afff monitored = 0 entry_point = 0x72d61d20 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 509 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 510 start_va = 0xfbd0000 end_va = 0xfc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fbd0000" filename = "" Region: id = 511 start_va = 0xfc10000 end_va = 0xfd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fc10000" filename = "" Region: id = 512 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 513 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 514 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 515 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 516 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 517 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 518 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 519 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 520 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 521 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 522 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 523 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 524 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 525 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 526 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 527 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 528 start_va = 0x10490000 end_va = 0x104cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010490000" filename = "" Region: id = 529 start_va = 0x104d0000 end_va = 0x105cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000104d0000" filename = "" Region: id = 530 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 531 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 532 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 533 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 534 start_va = 0x10850000 end_va = 0x1088ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010850000" filename = "" Region: id = 535 start_va = 0x10890000 end_va = 0x1098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010890000" filename = "" Region: id = 536 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 537 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 538 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 539 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 540 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 541 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 542 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 543 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 544 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 545 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 546 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 547 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 548 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 549 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 550 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 551 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 552 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 553 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 554 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 555 start_va = 0x114d0000 end_va = 0x1150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000114d0000" filename = "" Region: id = 556 start_va = 0x11510000 end_va = 0x1160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011510000" filename = "" Region: id = 557 start_va = 0x11610000 end_va = 0x1164ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011610000" filename = "" Region: id = 558 start_va = 0x11650000 end_va = 0x1174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011650000" filename = "" Region: id = 559 start_va = 0x11750000 end_va = 0x1178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011750000" filename = "" Region: id = 560 start_va = 0x11790000 end_va = 0x1188ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011790000" filename = "" Region: id = 561 start_va = 0x11890000 end_va = 0x118cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011890000" filename = "" Region: id = 562 start_va = 0x118d0000 end_va = 0x119cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000118d0000" filename = "" Region: id = 563 start_va = 0x119d0000 end_va = 0x11a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000119d0000" filename = "" Region: id = 564 start_va = 0x11a10000 end_va = 0x11b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011a10000" filename = "" Region: id = 565 start_va = 0x11b10000 end_va = 0x11b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b10000" filename = "" Region: id = 566 start_va = 0x11b50000 end_va = 0x11c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b50000" filename = "" Region: id = 567 start_va = 0x11c50000 end_va = 0x11c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 568 start_va = 0x11c90000 end_va = 0x11d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c90000" filename = "" Region: id = 569 start_va = 0x11d90000 end_va = 0x11dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011d90000" filename = "" Region: id = 570 start_va = 0x11dd0000 end_va = 0x11ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011dd0000" filename = "" Region: id = 571 start_va = 0x11ed0000 end_va = 0x11f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ed0000" filename = "" Region: id = 572 start_va = 0x11f10000 end_va = 0x1200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f10000" filename = "" Region: id = 573 start_va = 0x12010000 end_va = 0x1204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012010000" filename = "" Region: id = 574 start_va = 0x12050000 end_va = 0x1214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012050000" filename = "" Region: id = 575 start_va = 0x12150000 end_va = 0x1218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012150000" filename = "" Region: id = 576 start_va = 0x12190000 end_va = 0x1228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012190000" filename = "" Region: id = 577 start_va = 0x12290000 end_va = 0x122cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012290000" filename = "" Region: id = 578 start_va = 0x122d0000 end_va = 0x123cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000122d0000" filename = "" Region: id = 579 start_va = 0x123d0000 end_va = 0x1240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000123d0000" filename = "" Region: id = 580 start_va = 0x12410000 end_va = 0x1250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012410000" filename = "" Region: id = 581 start_va = 0x12510000 end_va = 0x1254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012510000" filename = "" Region: id = 582 start_va = 0x12550000 end_va = 0x1264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012550000" filename = "" Region: id = 583 start_va = 0x12650000 end_va = 0x1268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012650000" filename = "" Region: id = 584 start_va = 0x12690000 end_va = 0x1278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012690000" filename = "" Region: id = 585 start_va = 0x12790000 end_va = 0x127cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012790000" filename = "" Region: id = 586 start_va = 0x127d0000 end_va = 0x128cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000127d0000" filename = "" Region: id = 587 start_va = 0x128d0000 end_va = 0x1290ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000128d0000" filename = "" Region: id = 588 start_va = 0x12910000 end_va = 0x12a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012910000" filename = "" Region: id = 589 start_va = 0x12a10000 end_va = 0x12a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a10000" filename = "" Region: id = 590 start_va = 0x12a50000 end_va = 0x12b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a50000" filename = "" Region: id = 591 start_va = 0x12b50000 end_va = 0x12b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b50000" filename = "" Region: id = 592 start_va = 0x12b90000 end_va = 0x12c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b90000" filename = "" Region: id = 593 start_va = 0x12c90000 end_va = 0x12ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012c90000" filename = "" Region: id = 594 start_va = 0x12cd0000 end_va = 0x12dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012cd0000" filename = "" Region: id = 595 start_va = 0x12dd0000 end_va = 0x12e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012dd0000" filename = "" Region: id = 596 start_va = 0x12e10000 end_va = 0x12f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012e10000" filename = "" Region: id = 597 start_va = 0x12f10000 end_va = 0x12f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f10000" filename = "" Region: id = 598 start_va = 0x12f50000 end_va = 0x1304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f50000" filename = "" Region: id = 599 start_va = 0x13050000 end_va = 0x1308ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013050000" filename = "" Region: id = 600 start_va = 0x13090000 end_va = 0x1318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013090000" filename = "" Region: id = 601 start_va = 0x13190000 end_va = 0x131cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013190000" filename = "" Region: id = 602 start_va = 0x131d0000 end_va = 0x132cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000131d0000" filename = "" Region: id = 603 start_va = 0x132d0000 end_va = 0x1330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000132d0000" filename = "" Region: id = 604 start_va = 0x13310000 end_va = 0x1340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013310000" filename = "" Region: id = 605 start_va = 0x13410000 end_va = 0x1344ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013410000" filename = "" Region: id = 606 start_va = 0x13450000 end_va = 0x1354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013450000" filename = "" Region: id = 607 start_va = 0x13550000 end_va = 0x1358ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013550000" filename = "" Region: id = 608 start_va = 0x13590000 end_va = 0x1368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013590000" filename = "" Region: id = 609 start_va = 0x13690000 end_va = 0x136cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013690000" filename = "" Region: id = 610 start_va = 0x136d0000 end_va = 0x137cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000136d0000" filename = "" Region: id = 611 start_va = 0x137d0000 end_va = 0x1380ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000137d0000" filename = "" Region: id = 612 start_va = 0x13810000 end_va = 0x1390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013810000" filename = "" Region: id = 613 start_va = 0x13910000 end_va = 0x1394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013910000" filename = "" Region: id = 614 start_va = 0x13950000 end_va = 0x13a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013950000" filename = "" Region: id = 615 start_va = 0x13a50000 end_va = 0x13a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a50000" filename = "" Region: id = 616 start_va = 0x13a90000 end_va = 0x13b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a90000" filename = "" Region: id = 617 start_va = 0x13b90000 end_va = 0x13bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013b90000" filename = "" Region: id = 618 start_va = 0x13bd0000 end_va = 0x13ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013bd0000" filename = "" Region: id = 619 start_va = 0x13cd0000 end_va = 0x13d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013cd0000" filename = "" Region: id = 620 start_va = 0x13d10000 end_va = 0x13e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013d10000" filename = "" Region: id = 621 start_va = 0x13e10000 end_va = 0x13e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e10000" filename = "" Region: id = 622 start_va = 0x13e50000 end_va = 0x13f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e50000" filename = "" Region: id = 623 start_va = 0x13f50000 end_va = 0x13f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013f50000" filename = "" Region: id = 624 start_va = 0x13f90000 end_va = 0x1408ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013f90000" filename = "" Region: id = 625 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 626 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 627 start_va = 0x141d0000 end_va = 0x1420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000141d0000" filename = "" Region: id = 628 start_va = 0x14210000 end_va = 0x1430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014210000" filename = "" Region: id = 629 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 630 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 631 start_va = 0x14450000 end_va = 0x1448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014450000" filename = "" Region: id = 632 start_va = 0x14490000 end_va = 0x1458ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014490000" filename = "" Region: id = 633 start_va = 0x14590000 end_va = 0x145cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014590000" filename = "" Region: id = 634 start_va = 0x145d0000 end_va = 0x146cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145d0000" filename = "" Region: id = 635 start_va = 0x146d0000 end_va = 0x1470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000146d0000" filename = "" Region: id = 636 start_va = 0x14710000 end_va = 0x1480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 637 start_va = 0x14810000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014810000" filename = "" Region: id = 638 start_va = 0x14850000 end_va = 0x1494ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014850000" filename = "" Region: id = 639 start_va = 0x14950000 end_va = 0x1498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014950000" filename = "" Region: id = 640 start_va = 0x14990000 end_va = 0x14a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014990000" filename = "" Region: id = 641 start_va = 0x14a90000 end_va = 0x14acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014a90000" filename = "" Region: id = 642 start_va = 0x14ad0000 end_va = 0x14bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014ad0000" filename = "" Region: id = 643 start_va = 0x14bd0000 end_va = 0x14c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014bd0000" filename = "" Region: id = 644 start_va = 0x14c10000 end_va = 0x14d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c10000" filename = "" Region: id = 645 start_va = 0x14d10000 end_va = 0x14d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d10000" filename = "" Region: id = 646 start_va = 0x14d50000 end_va = 0x14e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d50000" filename = "" Region: id = 647 start_va = 0x14e50000 end_va = 0x14e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e50000" filename = "" Region: id = 648 start_va = 0x14e90000 end_va = 0x14f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e90000" filename = "" Region: id = 649 start_va = 0x14f90000 end_va = 0x14fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f90000" filename = "" Region: id = 650 start_va = 0x14fd0000 end_va = 0x150cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014fd0000" filename = "" Region: id = 651 start_va = 0x150d0000 end_va = 0x1510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000150d0000" filename = "" Region: id = 652 start_va = 0x15110000 end_va = 0x1520ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015110000" filename = "" Region: id = 653 start_va = 0x15210000 end_va = 0x1524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015210000" filename = "" Region: id = 654 start_va = 0x15250000 end_va = 0x1534ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015250000" filename = "" Region: id = 655 start_va = 0x15350000 end_va = 0x1538ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015350000" filename = "" Region: id = 656 start_va = 0x15390000 end_va = 0x1548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015390000" filename = "" Region: id = 657 start_va = 0x15490000 end_va = 0x154cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015490000" filename = "" Region: id = 658 start_va = 0x154d0000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000154d0000" filename = "" Region: id = 659 start_va = 0x155d0000 end_va = 0x1560ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000155d0000" filename = "" Region: id = 660 start_va = 0x15610000 end_va = 0x1570ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015610000" filename = "" Region: id = 661 start_va = 0x15710000 end_va = 0x1574ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 662 start_va = 0x15750000 end_va = 0x1584ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015750000" filename = "" Region: id = 663 start_va = 0x15850000 end_va = 0x1588ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015850000" filename = "" Region: id = 664 start_va = 0x15890000 end_va = 0x1598ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015890000" filename = "" Region: id = 665 start_va = 0x15990000 end_va = 0x159cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015990000" filename = "" Region: id = 666 start_va = 0x159d0000 end_va = 0x15acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000159d0000" filename = "" Region: id = 667 start_va = 0x15ad0000 end_va = 0x15b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ad0000" filename = "" Region: id = 668 start_va = 0x15b10000 end_va = 0x15c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b10000" filename = "" Region: id = 669 start_va = 0x15c10000 end_va = 0x15c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c10000" filename = "" Region: id = 670 start_va = 0x15c50000 end_va = 0x15d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c50000" filename = "" Region: id = 671 start_va = 0x15d50000 end_va = 0x15d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d50000" filename = "" Region: id = 672 start_va = 0x15d90000 end_va = 0x15e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d90000" filename = "" Region: id = 673 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 674 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 675 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 676 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 677 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 678 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 679 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 680 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 681 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 682 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 683 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 684 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 685 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 686 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 687 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 688 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 689 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 690 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 691 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 692 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 693 start_va = 0xfe50000 end_va = 0xfe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 694 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 695 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 696 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 697 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 698 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 699 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 700 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 701 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 702 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 703 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 704 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 705 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 706 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 707 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 708 start_va = 0x15e90000 end_va = 0x15ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e90000" filename = "" Region: id = 709 start_va = 0x15ed0000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ed0000" filename = "" Region: id = 710 start_va = 0x15fd0000 end_va = 0x1600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015fd0000" filename = "" Region: id = 711 start_va = 0x16010000 end_va = 0x1610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016010000" filename = "" Region: id = 712 start_va = 0x16110000 end_va = 0x1614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 713 start_va = 0x16150000 end_va = 0x1624ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016150000" filename = "" Region: id = 714 start_va = 0x16250000 end_va = 0x1628ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016250000" filename = "" Region: id = 715 start_va = 0x16290000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016290000" filename = "" Region: id = 716 start_va = 0x16390000 end_va = 0x163cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016390000" filename = "" Region: id = 717 start_va = 0x163d0000 end_va = 0x164cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000163d0000" filename = "" Region: id = 718 start_va = 0x164d0000 end_va = 0x1650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 719 start_va = 0x16510000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016510000" filename = "" Region: id = 720 start_va = 0x16610000 end_va = 0x1664ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016610000" filename = "" Region: id = 721 start_va = 0x16650000 end_va = 0x1674ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016650000" filename = "" Region: id = 722 start_va = 0x16750000 end_va = 0x1678ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016750000" filename = "" Region: id = 723 start_va = 0x16790000 end_va = 0x1688ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016790000" filename = "" Region: id = 724 start_va = 0x16890000 end_va = 0x168cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016890000" filename = "" Region: id = 725 start_va = 0x168d0000 end_va = 0x169cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000168d0000" filename = "" Region: id = 726 start_va = 0x169d0000 end_va = 0x16a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000169d0000" filename = "" Region: id = 727 start_va = 0x16a10000 end_va = 0x16b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016a10000" filename = "" Region: id = 728 start_va = 0x16b10000 end_va = 0x16b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b10000" filename = "" Region: id = 729 start_va = 0x16b50000 end_va = 0x16c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b50000" filename = "" Region: id = 730 start_va = 0x16c50000 end_va = 0x16c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c50000" filename = "" Region: id = 731 start_va = 0x16c90000 end_va = 0x16d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c90000" filename = "" Region: id = 732 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 733 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 734 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 735 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 736 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 737 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 738 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 739 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 740 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 741 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 742 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 743 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 744 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 745 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 746 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 747 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 748 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 749 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 750 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 751 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 752 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 753 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 754 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 755 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 756 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 757 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 758 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 759 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 760 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 761 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 762 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 763 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 764 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 765 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 766 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 767 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 768 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 769 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 770 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 771 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 772 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 773 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 774 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 775 start_va = 0x15e90000 end_va = 0x15ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e90000" filename = "" Region: id = 776 start_va = 0x15ed0000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ed0000" filename = "" Region: id = 777 start_va = 0x15fd0000 end_va = 0x1600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015fd0000" filename = "" Region: id = 778 start_va = 0x16010000 end_va = 0x1610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016010000" filename = "" Region: id = 779 start_va = 0x16250000 end_va = 0x1628ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016250000" filename = "" Region: id = 780 start_va = 0x16290000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016290000" filename = "" Region: id = 781 start_va = 0x164d0000 end_va = 0x1650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 782 start_va = 0x16510000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016510000" filename = "" Region: id = 783 start_va = 0x16750000 end_va = 0x1678ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016750000" filename = "" Region: id = 784 start_va = 0x16790000 end_va = 0x1688ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016790000" filename = "" Region: id = 785 start_va = 0x169d0000 end_va = 0x16a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000169d0000" filename = "" Region: id = 786 start_va = 0x16a10000 end_va = 0x16b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016a10000" filename = "" Region: id = 787 start_va = 0x16b10000 end_va = 0x16b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b10000" filename = "" Region: id = 788 start_va = 0x16b50000 end_va = 0x16c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b50000" filename = "" Region: id = 789 start_va = 0x16d90000 end_va = 0x16dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016d90000" filename = "" Region: id = 790 start_va = 0x16dd0000 end_va = 0x16ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016dd0000" filename = "" Region: id = 791 start_va = 0x16ed0000 end_va = 0x16f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016ed0000" filename = "" Region: id = 792 start_va = 0x16f10000 end_va = 0x1700ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016f10000" filename = "" Region: id = 793 start_va = 0x17010000 end_va = 0x1704ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017010000" filename = "" Region: id = 794 start_va = 0x17050000 end_va = 0x1714ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017050000" filename = "" Region: id = 795 start_va = 0x17150000 end_va = 0x1718ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017150000" filename = "" Region: id = 796 start_va = 0x17190000 end_va = 0x1728ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017190000" filename = "" Region: id = 797 start_va = 0x17290000 end_va = 0x172cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017290000" filename = "" Region: id = 798 start_va = 0x172d0000 end_va = 0x173cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000172d0000" filename = "" Region: id = 799 start_va = 0x173d0000 end_va = 0x1740ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000173d0000" filename = "" Region: id = 800 start_va = 0x17410000 end_va = 0x1750ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017410000" filename = "" Region: id = 801 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 802 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 803 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 804 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 805 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 806 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 807 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 808 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 809 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 810 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 811 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 812 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 813 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 814 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 815 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 816 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 817 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 818 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 819 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 820 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 821 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 822 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 823 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 824 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 825 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 826 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 827 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 828 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 829 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 830 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 831 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 832 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 833 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 834 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 835 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 836 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 837 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 838 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 839 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 840 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 841 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 842 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 843 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 844 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 845 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 846 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 847 start_va = 0x15e90000 end_va = 0x15ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e90000" filename = "" Region: id = 848 start_va = 0x15ed0000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ed0000" filename = "" Region: id = 849 start_va = 0x15fd0000 end_va = 0x1600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015fd0000" filename = "" Region: id = 850 start_va = 0x16010000 end_va = 0x1610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016010000" filename = "" Region: id = 851 start_va = 0x164d0000 end_va = 0x1650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 852 start_va = 0x16510000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016510000" filename = "" Region: id = 853 start_va = 0x16750000 end_va = 0x1678ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016750000" filename = "" Region: id = 854 start_va = 0x16790000 end_va = 0x1688ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016790000" filename = "" Region: id = 855 start_va = 0x169d0000 end_va = 0x16a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000169d0000" filename = "" Region: id = 856 start_va = 0x16a10000 end_va = 0x16b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016a10000" filename = "" Region: id = 857 start_va = 0x16b10000 end_va = 0x16b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b10000" filename = "" Region: id = 858 start_va = 0x16b50000 end_va = 0x16c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b50000" filename = "" Region: id = 859 start_va = 0x16c50000 end_va = 0x16c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c50000" filename = "" Region: id = 860 start_va = 0x16c90000 end_va = 0x16d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c90000" filename = "" Region: id = 861 start_va = 0x16d90000 end_va = 0x16dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016d90000" filename = "" Region: id = 862 start_va = 0x16dd0000 end_va = 0x16ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016dd0000" filename = "" Region: id = 863 start_va = 0x16ed0000 end_va = 0x16f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016ed0000" filename = "" Region: id = 864 start_va = 0x16f10000 end_va = 0x1700ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016f10000" filename = "" Region: id = 865 start_va = 0x17150000 end_va = 0x1718ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017150000" filename = "" Region: id = 866 start_va = 0x17190000 end_va = 0x1728ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017190000" filename = "" Region: id = 867 start_va = 0x17510000 end_va = 0x1754ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017510000" filename = "" Region: id = 868 start_va = 0x17550000 end_va = 0x1764ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017550000" filename = "" Region: id = 869 start_va = 0x17650000 end_va = 0x1768ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017650000" filename = "" Region: id = 870 start_va = 0x17690000 end_va = 0x1778ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017690000" filename = "" Region: id = 871 start_va = 0x17790000 end_va = 0x177cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017790000" filename = "" Region: id = 872 start_va = 0x177d0000 end_va = 0x178cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000177d0000" filename = "" Region: id = 873 start_va = 0x178d0000 end_va = 0x1790ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000178d0000" filename = "" Region: id = 874 start_va = 0x17910000 end_va = 0x17a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017910000" filename = "" Region: id = 875 start_va = 0x17a10000 end_va = 0x17a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017a10000" filename = "" Region: id = 876 start_va = 0x17a50000 end_va = 0x17b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017a50000" filename = "" Region: id = 877 start_va = 0x17b50000 end_va = 0x17b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b50000" filename = "" Region: id = 878 start_va = 0x17b90000 end_va = 0x17bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b90000" filename = "" Region: id = 879 start_va = 0x17c00000 end_va = 0x17dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017c00000" filename = "" Region: id = 880 start_va = 0x17e00000 end_va = 0x17efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017e00000" filename = "" Region: id = 881 start_va = 0x17f00000 end_va = 0x17ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017f00000" filename = "" Region: id = 882 start_va = 0x18000000 end_va = 0x1803ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018000000" filename = "" Region: id = 883 start_va = 0x18040000 end_va = 0x1813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018040000" filename = "" Region: id = 884 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 885 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 886 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 887 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 888 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 889 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 890 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 891 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 892 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 893 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 894 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 895 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 896 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 897 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 898 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 899 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 900 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 901 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 902 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 903 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 904 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 905 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 906 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 907 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 908 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 909 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 910 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 911 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 912 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 913 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 914 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 915 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 916 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 917 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 918 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 919 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 920 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 921 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 922 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 923 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 924 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 925 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 926 start_va = 0xf850000 end_va = 0xf850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 927 start_va = 0xf860000 end_va = 0xf89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 928 start_va = 0xf8a0000 end_va = 0xf8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8a0000" filename = "" Region: id = 929 start_va = 0xf8e0000 end_va = 0xf91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8e0000" filename = "" Region: id = 930 start_va = 0xf920000 end_va = 0xf95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f920000" filename = "" Region: id = 931 start_va = 0x100d0000 end_va = 0x101cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 932 start_va = 0x101d0000 end_va = 0x102cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000101d0000" filename = "" Region: id = 933 start_va = 0x102d0000 end_va = 0x1030ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000102d0000" filename = "" Region: id = 934 start_va = 0x10310000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010310000" filename = "" Region: id = 935 start_va = 0x10990000 end_va = 0x10a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 936 start_va = 0x10a90000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010a90000" filename = "" Region: id = 937 start_va = 0x10d50000 end_va = 0x10e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 938 start_va = 0x10e50000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e50000" filename = "" Region: id = 939 start_va = 0x15e90000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e90000" filename = "" Region: id = 940 start_va = 0x15f90000 end_va = 0x1608ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f90000" filename = "" Region: id = 941 start_va = 0x16090000 end_va = 0x160cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016090000" filename = "" Region: id = 942 start_va = 0x160d0000 end_va = 0x1610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000160d0000" filename = "" Region: id = 943 start_va = 0x164d0000 end_va = 0x165cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 944 start_va = 0x165d0000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000165d0000" filename = "" Region: id = 945 start_va = 0x16750000 end_va = 0x1684ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016750000" filename = "" Region: id = 946 start_va = 0x16850000 end_va = 0x1688ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016850000" filename = "" Region: id = 947 start_va = 0x169d0000 end_va = 0x16acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000169d0000" filename = "" Region: id = 948 start_va = 0x16ad0000 end_va = 0x16b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016ad0000" filename = "" Region: id = 949 start_va = 0x16c50000 end_va = 0x16d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c50000" filename = "" Region: id = 950 start_va = 0x16d50000 end_va = 0x16e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016d50000" filename = "" Region: id = 951 start_va = 0x16e50000 end_va = 0x16e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016e50000" filename = "" Region: id = 952 start_va = 0x16e90000 end_va = 0x16ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016e90000" filename = "" Region: id = 953 start_va = 0x17150000 end_va = 0x1724ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017150000" filename = "" Region: id = 954 start_va = 0x17250000 end_va = 0x1734ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017250000" filename = "" Region: id = 955 start_va = 0x17350000 end_va = 0x1738ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017350000" filename = "" Region: id = 956 start_va = 0x17390000 end_va = 0x173cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017390000" filename = "" Region: id = 957 start_va = 0x17510000 end_va = 0x1760ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017510000" filename = "" Region: id = 958 start_va = 0x17610000 end_va = 0x1764ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017610000" filename = "" Region: id = 959 start_va = 0x17790000 end_va = 0x1788ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017790000" filename = "" Region: id = 960 start_va = 0x17890000 end_va = 0x1798ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017890000" filename = "" Region: id = 961 start_va = 0x17990000 end_va = 0x17a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017990000" filename = "" Region: id = 962 start_va = 0x17a90000 end_va = 0x17b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017a90000" filename = "" Region: id = 963 start_va = 0x17e00000 end_va = 0x17e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017e00000" filename = "" Region: id = 964 start_va = 0x17e40000 end_va = 0x17e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017e40000" filename = "" Region: id = 965 start_va = 0x17e80000 end_va = 0x17ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017e80000" filename = "" Region: id = 966 start_va = 0x17ec0000 end_va = 0x17efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017ec0000" filename = "" Region: id = 967 start_va = 0x18140000 end_va = 0x1823ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018140000" filename = "" Region: id = 968 start_va = 0x18240000 end_va = 0x1833ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018240000" filename = "" Region: id = 969 start_va = 0x18340000 end_va = 0x1843ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018340000" filename = "" Region: id = 970 start_va = 0x18440000 end_va = 0x1853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018440000" filename = "" Region: id = 971 start_va = 0x18540000 end_va = 0x1857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018540000" filename = "" Region: id = 972 start_va = 0x18580000 end_va = 0x1867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018580000" filename = "" Region: id = 973 start_va = 0x18680000 end_va = 0x186bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018680000" filename = "" Region: id = 974 start_va = 0x186c0000 end_va = 0x187bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000186c0000" filename = "" Region: id = 975 start_va = 0x187c0000 end_va = 0x187fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000187c0000" filename = "" Region: id = 976 start_va = 0x18800000 end_va = 0x188fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018800000" filename = "" Region: id = 977 start_va = 0x18900000 end_va = 0x1893ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018900000" filename = "" Region: id = 978 start_va = 0x18940000 end_va = 0x18a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018940000" filename = "" Region: id = 979 start_va = 0x18a40000 end_va = 0x18a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a40000" filename = "" Region: id = 980 start_va = 0x18a80000 end_va = 0x18b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a80000" filename = "" Region: id = 981 start_va = 0x18b80000 end_va = 0x18bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018b80000" filename = "" Region: id = 982 start_va = 0x18bc0000 end_va = 0x18cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018bc0000" filename = "" Region: id = 983 start_va = 0x18cc0000 end_va = 0x18cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018cc0000" filename = "" Region: id = 984 start_va = 0x18d00000 end_va = 0x18dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018d00000" filename = "" Region: id = 985 start_va = 0x18e00000 end_va = 0x18e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018e00000" filename = "" Region: id = 986 start_va = 0x18e40000 end_va = 0x18f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018e40000" filename = "" Region: id = 987 start_va = 0x18f40000 end_va = 0x18f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018f40000" filename = "" Region: id = 988 start_va = 0x18f80000 end_va = 0x1907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018f80000" filename = "" Region: id = 989 start_va = 0x19080000 end_va = 0x190bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019080000" filename = "" Region: id = 990 start_va = 0x190c0000 end_va = 0x191bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000190c0000" filename = "" Region: id = 991 start_va = 0x191c0000 end_va = 0x191fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000191c0000" filename = "" Region: id = 992 start_va = 0x19200000 end_va = 0x192fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019200000" filename = "" Region: id = 993 start_va = 0x19300000 end_va = 0x1933ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019300000" filename = "" Region: id = 994 start_va = 0x19340000 end_va = 0x1943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019340000" filename = "" Region: id = 995 start_va = 0x19440000 end_va = 0x1947ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019440000" filename = "" Region: id = 996 start_va = 0x19480000 end_va = 0x1957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019480000" filename = "" Region: id = 997 start_va = 0x19580000 end_va = 0x195bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019580000" filename = "" Region: id = 998 start_va = 0x195c0000 end_va = 0x196bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000195c0000" filename = "" Region: id = 999 start_va = 0x196c0000 end_va = 0x196fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000196c0000" filename = "" Region: id = 1000 start_va = 0x19700000 end_va = 0x197fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019700000" filename = "" Region: id = 1001 start_va = 0x19800000 end_va = 0x1983ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019800000" filename = "" Region: id = 1002 start_va = 0x19840000 end_va = 0x1993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019840000" filename = "" Region: id = 1003 start_va = 0x19940000 end_va = 0x1997ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019940000" filename = "" Region: id = 1004 start_va = 0x19980000 end_va = 0x19a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019980000" filename = "" Region: id = 1005 start_va = 0x19a80000 end_va = 0x19abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019a80000" filename = "" Region: id = 1006 start_va = 0x19ac0000 end_va = 0x19bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019ac0000" filename = "" Region: id = 1007 start_va = 0x19bc0000 end_va = 0x19bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019bc0000" filename = "" Region: id = 1008 start_va = 0x19c00000 end_va = 0x19cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019c00000" filename = "" Region: id = 1009 start_va = 0x19d00000 end_va = 0x19d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019d00000" filename = "" Region: id = 1010 start_va = 0x19d40000 end_va = 0x19e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019d40000" filename = "" Region: id = 1011 start_va = 0x19e40000 end_va = 0x19e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019e40000" filename = "" Region: id = 1012 start_va = 0x19e80000 end_va = 0x19f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019e80000" filename = "" Region: id = 1013 start_va = 0x19f80000 end_va = 0x19fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019f80000" filename = "" Region: id = 1014 start_va = 0x19fc0000 end_va = 0x1a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019fc0000" filename = "" Region: id = 1015 start_va = 0x1a0c0000 end_va = 0x1a0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a0c0000" filename = "" Region: id = 1016 start_va = 0x1a100000 end_va = 0x1a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a100000" filename = "" Region: id = 1017 start_va = 0x1a200000 end_va = 0x1a23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a200000" filename = "" Region: id = 1018 start_va = 0x1a240000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a240000" filename = "" Region: id = 1019 start_va = 0x1a340000 end_va = 0x1a37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 1020 start_va = 0x1a380000 end_va = 0x1a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a380000" filename = "" Region: id = 1021 start_va = 0x1a480000 end_va = 0x1a4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a480000" filename = "" Region: id = 1022 start_va = 0x1a4c0000 end_va = 0x1a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a4c0000" filename = "" Region: id = 1023 start_va = 0x1a5c0000 end_va = 0x1a5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5c0000" filename = "" Region: id = 1024 start_va = 0x1a600000 end_va = 0x1a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a600000" filename = "" Region: id = 1025 start_va = 0x1a700000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 1026 start_va = 0x1a740000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 1027 start_va = 0x1a840000 end_va = 0x1a87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a840000" filename = "" Region: id = 1028 start_va = 0x1a880000 end_va = 0x1a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a880000" filename = "" Region: id = 1029 start_va = 0x1a980000 end_va = 0x1a9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a980000" filename = "" Region: id = 1030 start_va = 0x1a9c0000 end_va = 0x1aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9c0000" filename = "" Region: id = 1031 start_va = 0x1aac0000 end_va = 0x1aafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aac0000" filename = "" Region: id = 1032 start_va = 0x1ab00000 end_va = 0x1abfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab00000" filename = "" Region: id = 1033 start_va = 0x1ac00000 end_va = 0x1ac3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac00000" filename = "" Region: id = 1034 start_va = 0x1ac40000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac40000" filename = "" Region: id = 1035 start_va = 0x1ad40000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 1036 start_va = 0x1ad80000 end_va = 0x1ae7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 1037 start_va = 0x1ae80000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae80000" filename = "" Region: id = 1038 start_va = 0x1aec0000 end_va = 0x1afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aec0000" filename = "" Region: id = 1039 start_va = 0x1afc0000 end_va = 0x1affffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afc0000" filename = "" Region: id = 1040 start_va = 0x1b000000 end_va = 0x1b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b000000" filename = "" Region: id = 1041 start_va = 0x1b100000 end_va = 0x1b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b100000" filename = "" Region: id = 1042 start_va = 0x1b140000 end_va = 0x1b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b140000" filename = "" Region: id = 1043 start_va = 0x1b240000 end_va = 0x1b27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b240000" filename = "" Region: id = 1044 start_va = 0x1b280000 end_va = 0x1b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b280000" filename = "" Region: id = 1045 start_va = 0x1b380000 end_va = 0x1b3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b380000" filename = "" Region: id = 1046 start_va = 0x1b3c0000 end_va = 0x1b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 1047 start_va = 0x1b4c0000 end_va = 0x1b4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4c0000" filename = "" Region: id = 1048 start_va = 0x1b500000 end_va = 0x1b5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b500000" filename = "" Region: id = 1049 start_va = 0x1b600000 end_va = 0x1b63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b600000" filename = "" Region: id = 1050 start_va = 0x1b640000 end_va = 0x1b73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b640000" filename = "" Region: id = 1051 start_va = 0x1b740000 end_va = 0x1b77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b740000" filename = "" Region: id = 1052 start_va = 0x1b780000 end_va = 0x1b87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b780000" filename = "" Region: id = 1053 start_va = 0x1b880000 end_va = 0x1b8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b880000" filename = "" Region: id = 1054 start_va = 0x1b8c0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 1055 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1056 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1057 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1058 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1059 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1060 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1061 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 1062 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 1063 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 1064 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 1065 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 1066 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 1067 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 1068 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 1069 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 1070 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 1071 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1072 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1073 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1074 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 1075 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 1076 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 1077 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 1078 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 1079 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 1080 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 1081 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 1082 start_va = 0x16b10000 end_va = 0x16b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b10000" filename = "" Region: id = 1083 start_va = 0x16b50000 end_va = 0x16c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b50000" filename = "" Region: id = 1084 start_va = 0x17650000 end_va = 0x1768ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017650000" filename = "" Region: id = 1085 start_va = 0x17690000 end_va = 0x1778ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017690000" filename = "" Region: id = 1086 start_va = 0x18000000 end_va = 0x1803ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018000000" filename = "" Region: id = 1087 start_va = 0x18040000 end_va = 0x1813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018040000" filename = "" Region: id = 1088 start_va = 0x1b9c0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 1089 start_va = 0x1ba00000 end_va = 0x1bafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 1090 start_va = 0x1bb00000 end_va = 0x1bb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb00000" filename = "" Region: id = 1091 start_va = 0x1bb40000 end_va = 0x1bc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 1092 start_va = 0x1bc40000 end_va = 0x1bc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc40000" filename = "" Region: id = 1093 start_va = 0x1bc80000 end_va = 0x1bd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc80000" filename = "" Region: id = 1094 start_va = 0x1bd80000 end_va = 0x1bdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd80000" filename = "" Region: id = 1095 start_va = 0x1bdc0000 end_va = 0x1bebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bdc0000" filename = "" Region: id = 1096 start_va = 0x1bec0000 end_va = 0x1befffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bec0000" filename = "" Region: id = 1097 start_va = 0x1bf00000 end_va = 0x1bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bf00000" filename = "" Region: id = 1098 start_va = 0x1c000000 end_va = 0x1c03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c000000" filename = "" Region: id = 1099 start_va = 0x1c040000 end_va = 0x1c13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c040000" filename = "" Region: id = 1100 start_va = 0x1c140000 end_va = 0x1c17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c140000" filename = "" Region: id = 1101 start_va = 0x1c180000 end_va = 0x1c27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c180000" filename = "" Region: id = 1102 start_va = 0x1c280000 end_va = 0x1c2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c280000" filename = "" Region: id = 1103 start_va = 0x1c2c0000 end_va = 0x1c3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c2c0000" filename = "" Region: id = 1104 start_va = 0x1c3c0000 end_va = 0x1c3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c3c0000" filename = "" Region: id = 1105 start_va = 0x1c400000 end_va = 0x1c4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c400000" filename = "" Region: id = 1106 start_va = 0x1c500000 end_va = 0x1c53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c500000" filename = "" Region: id = 1107 start_va = 0x1c540000 end_va = 0x1c63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c540000" filename = "" Region: id = 1108 start_va = 0x1c640000 end_va = 0x1c67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c640000" filename = "" Region: id = 1109 start_va = 0x1c680000 end_va = 0x1c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c680000" filename = "" Region: id = 1110 start_va = 0x1c780000 end_va = 0x1c7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c780000" filename = "" Region: id = 1111 start_va = 0x1c7c0000 end_va = 0x1c8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c7c0000" filename = "" Region: id = 1112 start_va = 0x1c8c0000 end_va = 0x1c8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c8c0000" filename = "" Region: id = 1113 start_va = 0x1c900000 end_va = 0x1c9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c900000" filename = "" Region: id = 1114 start_va = 0x1ca00000 end_va = 0x1ca3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ca00000" filename = "" Region: id = 1115 start_va = 0x1ca40000 end_va = 0x1cb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ca40000" filename = "" Region: id = 1116 start_va = 0x1cb40000 end_va = 0x1cb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cb40000" filename = "" Region: id = 1117 start_va = 0x1cb80000 end_va = 0x1cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cb80000" filename = "" Region: id = 1118 start_va = 0x1cc80000 end_va = 0x1ccbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cc80000" filename = "" Region: id = 1119 start_va = 0x1ccc0000 end_va = 0x1cdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ccc0000" filename = "" Region: id = 1120 start_va = 0x1cdc0000 end_va = 0x1cdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cdc0000" filename = "" Region: id = 1121 start_va = 0x1ce00000 end_va = 0x1cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ce00000" filename = "" Region: id = 1122 start_va = 0x1cf00000 end_va = 0x1cf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cf00000" filename = "" Region: id = 1123 start_va = 0x1cf40000 end_va = 0x1d03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cf40000" filename = "" Region: id = 1124 start_va = 0x1d040000 end_va = 0x1d07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d040000" filename = "" Region: id = 1125 start_va = 0x1d080000 end_va = 0x1d17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d080000" filename = "" Region: id = 1126 start_va = 0x1d180000 end_va = 0x1d1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d180000" filename = "" Region: id = 1127 start_va = 0x1d1c0000 end_va = 0x1d2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d1c0000" filename = "" Region: id = 1128 start_va = 0x1d2c0000 end_va = 0x1d2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d2c0000" filename = "" Region: id = 1129 start_va = 0x1d300000 end_va = 0x1d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d300000" filename = "" Region: id = 1130 start_va = 0x1d400000 end_va = 0x1d43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d400000" filename = "" Region: id = 1131 start_va = 0x1d440000 end_va = 0x1d53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d440000" filename = "" Region: id = 1132 start_va = 0x1d540000 end_va = 0x1d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d540000" filename = "" Region: id = 1133 start_va = 0x1d580000 end_va = 0x1d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d580000" filename = "" Region: id = 1134 start_va = 0x1d680000 end_va = 0x1d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d680000" filename = "" Region: id = 1135 start_va = 0x1d6c0000 end_va = 0x1d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6c0000" filename = "" Region: id = 1136 start_va = 0x1d7c0000 end_va = 0x1d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7c0000" filename = "" Region: id = 1137 start_va = 0x1d800000 end_va = 0x1d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 1138 start_va = 0x1d900000 end_va = 0x1d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d900000" filename = "" Region: id = 1139 start_va = 0x1d940000 end_va = 0x1da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d940000" filename = "" Region: id = 1140 start_va = 0x1da40000 end_va = 0x1da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001da40000" filename = "" Region: id = 1141 start_va = 0x1da80000 end_va = 0x1db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001da80000" filename = "" Region: id = 1142 start_va = 0x1db80000 end_va = 0x1dbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db80000" filename = "" Region: id = 1143 start_va = 0x1dbc0000 end_va = 0x1dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbc0000" filename = "" Region: id = 1144 start_va = 0x1dcc0000 end_va = 0x1dcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dcc0000" filename = "" Region: id = 1145 start_va = 0x1dd00000 end_va = 0x1ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dd00000" filename = "" Region: id = 1146 start_va = 0x1de00000 end_va = 0x1de3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001de00000" filename = "" Region: id = 1147 start_va = 0x1de40000 end_va = 0x1df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001de40000" filename = "" Region: id = 1148 start_va = 0x1df40000 end_va = 0x1df7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001df40000" filename = "" Region: id = 1149 start_va = 0x1df80000 end_va = 0x1e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001df80000" filename = "" Region: id = 1150 start_va = 0x1e080000 end_va = 0x1e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e080000" filename = "" Region: id = 1151 start_va = 0x1e0c0000 end_va = 0x1e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e0c0000" filename = "" Region: id = 1152 start_va = 0x1e1c0000 end_va = 0x1e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e1c0000" filename = "" Region: id = 1153 start_va = 0x1e200000 end_va = 0x1e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e200000" filename = "" Region: id = 1154 start_va = 0x1e300000 end_va = 0x1e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e300000" filename = "" Region: id = 1155 start_va = 0x1e340000 end_va = 0x1e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e340000" filename = "" Region: id = 1156 start_va = 0x1e440000 end_va = 0x1e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e440000" filename = "" Region: id = 1157 start_va = 0x1e480000 end_va = 0x1e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e480000" filename = "" Region: id = 1158 start_va = 0x1e580000 end_va = 0x1e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e580000" filename = "" Region: id = 1159 start_va = 0x1e5c0000 end_va = 0x1e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e5c0000" filename = "" Region: id = 1160 start_va = 0x1e6c0000 end_va = 0x1e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e6c0000" filename = "" Region: id = 1161 start_va = 0x1e700000 end_va = 0x1e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e700000" filename = "" Region: id = 1162 start_va = 0x1e800000 end_va = 0x1e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e800000" filename = "" Region: id = 1163 start_va = 0x1e840000 end_va = 0x1e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e840000" filename = "" Region: id = 1164 start_va = 0x1e940000 end_va = 0x1e97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e940000" filename = "" Region: id = 1165 start_va = 0x1e980000 end_va = 0x1ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e980000" filename = "" Region: id = 1166 start_va = 0x1ea80000 end_va = 0x1eabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ea80000" filename = "" Region: id = 1167 start_va = 0x1eac0000 end_va = 0x1ebbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eac0000" filename = "" Region: id = 1168 start_va = 0x1ebc0000 end_va = 0x1ebfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ebc0000" filename = "" Region: id = 1169 start_va = 0x1ec00000 end_va = 0x1ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ec00000" filename = "" Region: id = 1170 start_va = 0x1ed00000 end_va = 0x1ed3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ed00000" filename = "" Region: id = 1171 start_va = 0x1ed40000 end_va = 0x1ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ed40000" filename = "" Region: id = 1172 start_va = 0x1ee40000 end_va = 0x1ee7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ee40000" filename = "" Region: id = 1173 start_va = 0x1ee80000 end_va = 0x1ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ee80000" filename = "" Region: id = 1174 start_va = 0x1ef80000 end_va = 0x1efbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ef80000" filename = "" Region: id = 1175 start_va = 0x1efc0000 end_va = 0x1f0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001efc0000" filename = "" Region: id = 1176 start_va = 0x1f0c0000 end_va = 0x1f0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f0c0000" filename = "" Region: id = 1177 start_va = 0x1f100000 end_va = 0x1f1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f100000" filename = "" Region: id = 1178 start_va = 0x1f200000 end_va = 0x1f23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f200000" filename = "" Region: id = 1179 start_va = 0x1f240000 end_va = 0x1f33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f240000" filename = "" Region: id = 1180 start_va = 0x1f340000 end_va = 0x1f37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f340000" filename = "" Region: id = 1181 start_va = 0x1f380000 end_va = 0x1f47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f380000" filename = "" Region: id = 1182 start_va = 0x1f480000 end_va = 0x1f4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f480000" filename = "" Region: id = 1183 start_va = 0x1f4c0000 end_va = 0x1f5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f4c0000" filename = "" Region: id = 1184 start_va = 0x1f5c0000 end_va = 0x1f5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f5c0000" filename = "" Region: id = 1185 start_va = 0x1f600000 end_va = 0x1f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f600000" filename = "" Region: id = 1186 start_va = 0x1f700000 end_va = 0x1f73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f700000" filename = "" Region: id = 1187 start_va = 0x1f740000 end_va = 0x1f83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f740000" filename = "" Region: id = 1188 start_va = 0x1f840000 end_va = 0x1f87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f840000" filename = "" Region: id = 1189 start_va = 0x1f880000 end_va = 0x1f97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f880000" filename = "" Region: id = 1190 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1191 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1192 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1193 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 1194 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 1195 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1196 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1197 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1198 start_va = 0xf850000 end_va = 0xf850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 1199 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1200 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 1201 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 1202 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 1203 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 1204 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1205 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1206 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1207 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1208 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1209 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 1210 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 1211 start_va = 0x10850000 end_va = 0x1088ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010850000" filename = "" Region: id = 1212 start_va = 0x10890000 end_va = 0x1098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010890000" filename = "" Region: id = 1213 start_va = 0x16ed0000 end_va = 0x16f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016ed0000" filename = "" Region: id = 1214 start_va = 0x16f10000 end_va = 0x1700ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016f10000" filename = "" Region: id = 1215 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1216 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1217 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1218 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1219 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1220 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1221 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1222 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 1223 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 1224 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 1225 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 1226 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 1227 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 1228 start_va = 0x16890000 end_va = 0x168cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016890000" filename = "" Region: id = 1229 start_va = 0x168d0000 end_va = 0x169cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000168d0000" filename = "" Region: id = 1230 start_va = 0x17010000 end_va = 0x1704ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017010000" filename = "" Region: id = 1231 start_va = 0x17050000 end_va = 0x1714ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017050000" filename = "" Region: id = 1232 start_va = 0x17b90000 end_va = 0x17bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b90000" filename = "" Region: id = 1233 start_va = 0x17f00000 end_va = 0x17ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017f00000" filename = "" Region: id = 1234 start_va = 0x1f980000 end_va = 0x1f9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f980000" filename = "" Region: id = 1235 start_va = 0x1f9c0000 end_va = 0x1fabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f9c0000" filename = "" Region: id = 1236 start_va = 0x1fac0000 end_va = 0x1fafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fac0000" filename = "" Region: id = 1237 start_va = 0x1fb00000 end_va = 0x1fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fb00000" filename = "" Region: id = 1238 start_va = 0x1fc00000 end_va = 0x1fc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fc00000" filename = "" Region: id = 1239 start_va = 0x1fc40000 end_va = 0x1fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fc40000" filename = "" Region: id = 1240 start_va = 0x1fd40000 end_va = 0x1fd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fd40000" filename = "" Region: id = 1241 start_va = 0x1fd80000 end_va = 0x1fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fd80000" filename = "" Region: id = 1242 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1243 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1244 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1245 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1246 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1247 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1248 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1249 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1250 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1251 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1252 start_va = 0xf350000 end_va = 0xf350fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 1253 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1254 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1255 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 1256 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 1257 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 1258 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 1259 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 1260 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 1261 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 1262 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 1263 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 1264 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 1265 start_va = 0x16110000 end_va = 0x1614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 1266 start_va = 0x16150000 end_va = 0x1624ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016150000" filename = "" Region: id = 1267 start_va = 0x16610000 end_va = 0x1664ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016610000" filename = "" Region: id = 1268 start_va = 0x16650000 end_va = 0x1674ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016650000" filename = "" Region: id = 1269 start_va = 0x1fe80000 end_va = 0x1febffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fe80000" filename = "" Region: id = 1270 start_va = 0x1fec0000 end_va = 0x1ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fec0000" filename = "" Region: id = 1271 start_va = 0x1ffc0000 end_va = 0x1fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ffc0000" filename = "" Region: id = 1272 start_va = 0x20000000 end_va = 0x200fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020000000" filename = "" Region: id = 1273 start_va = 0x20100000 end_va = 0x2013ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020100000" filename = "" Region: id = 1274 start_va = 0x20140000 end_va = 0x2023ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020140000" filename = "" Region: id = 1275 start_va = 0x20240000 end_va = 0x2027ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020240000" filename = "" Region: id = 1276 start_va = 0x20280000 end_va = 0x2037ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020280000" filename = "" Region: id = 1277 start_va = 0x20380000 end_va = 0x203bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020380000" filename = "" Region: id = 1278 start_va = 0x203c0000 end_va = 0x204bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000203c0000" filename = "" Region: id = 1279 start_va = 0x204c0000 end_va = 0x204fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000204c0000" filename = "" Region: id = 1280 start_va = 0x20500000 end_va = 0x205fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020500000" filename = "" Region: id = 1281 start_va = 0x20600000 end_va = 0x2063ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020600000" filename = "" Region: id = 1282 start_va = 0x20640000 end_va = 0x2073ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020640000" filename = "" Region: id = 1283 start_va = 0x20740000 end_va = 0x2077ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020740000" filename = "" Region: id = 1284 start_va = 0x20780000 end_va = 0x2087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020780000" filename = "" Region: id = 1285 start_va = 0x20880000 end_va = 0x208bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 1286 start_va = 0x208c0000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000208c0000" filename = "" Region: id = 1287 start_va = 0x209c0000 end_va = 0x209fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000209c0000" filename = "" Region: id = 1288 start_va = 0x20a00000 end_va = 0x20afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 1289 start_va = 0x20b00000 end_va = 0x20b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020b00000" filename = "" Region: id = 1290 start_va = 0x20b40000 end_va = 0x20c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020b40000" filename = "" Region: id = 1291 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1292 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1293 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1294 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1295 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1296 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1297 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1298 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1299 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1300 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1301 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1302 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1303 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1304 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1305 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1306 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1307 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1308 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1309 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1310 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1311 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1312 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1313 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1314 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1315 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1316 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1317 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1318 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1319 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1320 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1321 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1322 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1323 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1324 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1325 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1326 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1327 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1328 start_va = 0xef90000 end_va = 0xef90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 1329 start_va = 0xefa0000 end_va = 0xefa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efa0000" filename = "" Region: id = 1330 start_va = 0xefb0000 end_va = 0xefb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efb0000" filename = "" Region: id = 1331 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1332 start_va = 0xdf50000 end_va = 0xdf50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 1333 start_va = 0xdf60000 end_va = 0xdf60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df60000" filename = "" Region: id = 1334 start_va = 0xdf70000 end_va = 0xdf70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df70000" filename = "" Region: id = 1335 start_va = 0xdf80000 end_va = 0xdf80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df80000" filename = "" Region: id = 1336 start_va = 0xdf90000 end_va = 0xdf90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 1337 start_va = 0xdfa0000 end_va = 0xdfa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dfa0000" filename = "" Region: id = 1338 start_va = 0xdfb0000 end_va = 0xdfb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dfb0000" filename = "" Region: id = 1339 start_va = 0xdfc0000 end_va = 0xdfc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dfc0000" filename = "" Region: id = 1340 start_va = 0xdfd0000 end_va = 0xdfd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dfd0000" filename = "" Region: id = 1341 start_va = 0xdfe0000 end_va = 0xdfe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dfe0000" filename = "" Region: id = 1342 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1343 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1344 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1345 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 1346 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 1347 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1348 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 1349 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 1350 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 1351 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 1352 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 1353 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 1354 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 1355 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 1356 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 1357 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 1358 start_va = 0xf0d0000 end_va = 0xf10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f0d0000" filename = "" Region: id = 1359 start_va = 0xf110000 end_va = 0xf20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f110000" filename = "" Region: id = 1360 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 1361 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 1362 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 1363 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 1364 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 1365 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 1366 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 1367 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 1368 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 1369 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 1370 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 1371 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 1372 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 1373 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 1374 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 1375 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 1376 start_va = 0x16110000 end_va = 0x1614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 1377 start_va = 0x16150000 end_va = 0x1624ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016150000" filename = "" Region: id = 1378 start_va = 0x16250000 end_va = 0x1628ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016250000" filename = "" Region: id = 1379 start_va = 0x16290000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016290000" filename = "" Region: id = 1380 start_va = 0x16390000 end_va = 0x163cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016390000" filename = "" Region: id = 1381 start_va = 0x163d0000 end_va = 0x164cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000163d0000" filename = "" Region: id = 1382 start_va = 0x16610000 end_va = 0x1664ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016610000" filename = "" Region: id = 1383 start_va = 0x16650000 end_va = 0x1674ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016650000" filename = "" Region: id = 1384 start_va = 0x16890000 end_va = 0x168cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016890000" filename = "" Region: id = 1385 start_va = 0x168d0000 end_va = 0x169cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000168d0000" filename = "" Region: id = 1386 start_va = 0x17010000 end_va = 0x1704ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017010000" filename = "" Region: id = 1387 start_va = 0x17050000 end_va = 0x1714ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017050000" filename = "" Region: id = 1388 start_va = 0x17b90000 end_va = 0x17bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b90000" filename = "" Region: id = 1389 start_va = 0x17f00000 end_va = 0x17ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017f00000" filename = "" Region: id = 1390 start_va = 0x1f980000 end_va = 0x1f9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f980000" filename = "" Region: id = 1391 start_va = 0x1f9c0000 end_va = 0x1fabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f9c0000" filename = "" Region: id = 1392 start_va = 0x1fac0000 end_va = 0x1fafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fac0000" filename = "" Region: id = 1393 start_va = 0x1fb00000 end_va = 0x1fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fb00000" filename = "" Region: id = 1394 start_va = 0x1fc00000 end_va = 0x1fc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fc00000" filename = "" Region: id = 1395 start_va = 0x1fc40000 end_va = 0x1fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fc40000" filename = "" Region: id = 1396 start_va = 0x1fd40000 end_va = 0x1fd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fd40000" filename = "" Region: id = 1397 start_va = 0x1fd80000 end_va = 0x1fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fd80000" filename = "" Region: id = 1398 start_va = 0x1fe80000 end_va = 0x1febffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fe80000" filename = "" Region: id = 1399 start_va = 0x1fec0000 end_va = 0x1ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fec0000" filename = "" Region: id = 1400 start_va = 0x1ffc0000 end_va = 0x1fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ffc0000" filename = "" Region: id = 1401 start_va = 0x20000000 end_va = 0x200fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020000000" filename = "" Region: id = 1402 start_va = 0x20100000 end_va = 0x2013ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020100000" filename = "" Region: id = 1403 start_va = 0x20140000 end_va = 0x2023ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020140000" filename = "" Region: id = 1404 start_va = 0x20240000 end_va = 0x2027ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020240000" filename = "" Region: id = 1405 start_va = 0x20280000 end_va = 0x2037ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020280000" filename = "" Region: id = 1406 start_va = 0x20380000 end_va = 0x203bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020380000" filename = "" Region: id = 1407 start_va = 0x203c0000 end_va = 0x204bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000203c0000" filename = "" Region: id = 1408 start_va = 0x204c0000 end_va = 0x204fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000204c0000" filename = "" Region: id = 1409 start_va = 0x20500000 end_va = 0x205fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020500000" filename = "" Region: id = 1410 start_va = 0x20600000 end_va = 0x2063ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020600000" filename = "" Region: id = 1411 start_va = 0x20640000 end_va = 0x2073ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020640000" filename = "" Region: id = 1412 start_va = 0x20740000 end_va = 0x2077ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020740000" filename = "" Region: id = 1413 start_va = 0x20780000 end_va = 0x2087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020780000" filename = "" Region: id = 1414 start_va = 0x20880000 end_va = 0x208bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 1415 start_va = 0x208c0000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000208c0000" filename = "" Region: id = 1416 start_va = 0x209c0000 end_va = 0x209fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000209c0000" filename = "" Region: id = 1417 start_va = 0x20a00000 end_va = 0x20afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 1418 start_va = 0x20b00000 end_va = 0x20b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020b00000" filename = "" Region: id = 1419 start_va = 0x20b40000 end_va = 0x20c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020b40000" filename = "" Region: id = 1420 start_va = 0x20c40000 end_va = 0x20c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020c40000" filename = "" Region: id = 1421 start_va = 0x20c80000 end_va = 0x20d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020c80000" filename = "" Region: id = 1422 start_va = 0x20d80000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020d80000" filename = "" Region: id = 1423 start_va = 0x20dc0000 end_va = 0x20ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020dc0000" filename = "" Region: id = 1424 start_va = 0x20ec0000 end_va = 0x20efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 1425 start_va = 0x20f00000 end_va = 0x20ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020f00000" filename = "" Region: id = 1426 start_va = 0x21000000 end_va = 0x2103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021000000" filename = "" Region: id = 1427 start_va = 0x21040000 end_va = 0x2113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021040000" filename = "" Region: id = 1428 start_va = 0x21140000 end_va = 0x2117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021140000" filename = "" Region: id = 1429 start_va = 0x21180000 end_va = 0x2127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021180000" filename = "" Region: id = 1430 start_va = 0x21280000 end_va = 0x212bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021280000" filename = "" Region: id = 1431 start_va = 0x212c0000 end_va = 0x213bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000212c0000" filename = "" Region: id = 1432 start_va = 0x213c0000 end_va = 0x213fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000213c0000" filename = "" Region: id = 1433 start_va = 0x21400000 end_va = 0x214fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021400000" filename = "" Region: id = 1434 start_va = 0x21500000 end_va = 0x2153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021500000" filename = "" Region: id = 1435 start_va = 0x21540000 end_va = 0x2163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021540000" filename = "" Region: id = 1436 start_va = 0x21640000 end_va = 0x2167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021640000" filename = "" Region: id = 1437 start_va = 0x21680000 end_va = 0x2177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021680000" filename = "" Region: id = 1438 start_va = 0x21780000 end_va = 0x217bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021780000" filename = "" Region: id = 1439 start_va = 0x217c0000 end_va = 0x218bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000217c0000" filename = "" Region: id = 1440 start_va = 0x218c0000 end_va = 0x218fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000218c0000" filename = "" Region: id = 1441 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 1442 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 1443 start_va = 0x21a40000 end_va = 0x21b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a40000" filename = "" Region: id = 1444 start_va = 0x21b40000 end_va = 0x21b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b40000" filename = "" Region: id = 1445 start_va = 0x21b80000 end_va = 0x21c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b80000" filename = "" Region: id = 1446 start_va = 0x21c80000 end_va = 0x21cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c80000" filename = "" Region: id = 1447 start_va = 0x21cc0000 end_va = 0x21dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021cc0000" filename = "" Region: id = 1448 start_va = 0x21dc0000 end_va = 0x21dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021dc0000" filename = "" Region: id = 1449 start_va = 0x21e00000 end_va = 0x21efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e00000" filename = "" Region: id = 1450 start_va = 0x21f00000 end_va = 0x21f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f00000" filename = "" Region: id = 1451 start_va = 0x21f40000 end_va = 0x2203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f40000" filename = "" Region: id = 1452 start_va = 0x22040000 end_va = 0x2207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022040000" filename = "" Region: id = 1453 start_va = 0x22080000 end_va = 0x2217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022080000" filename = "" Region: id = 1454 start_va = 0x22180000 end_va = 0x221bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022180000" filename = "" Region: id = 1455 start_va = 0x221c0000 end_va = 0x222bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000221c0000" filename = "" Region: id = 1456 start_va = 0x222c0000 end_va = 0x222fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000222c0000" filename = "" Region: id = 1457 start_va = 0x22300000 end_va = 0x223fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022300000" filename = "" Region: id = 1458 start_va = 0x22400000 end_va = 0x2243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022400000" filename = "" Region: id = 1459 start_va = 0x22440000 end_va = 0x2253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022440000" filename = "" Region: id = 1460 start_va = 0x22540000 end_va = 0x2257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022540000" filename = "" Region: id = 1461 start_va = 0x22580000 end_va = 0x2267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022580000" filename = "" Region: id = 1462 start_va = 0x22680000 end_va = 0x226bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022680000" filename = "" Region: id = 1463 start_va = 0x226c0000 end_va = 0x227bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000226c0000" filename = "" Region: id = 1464 start_va = 0x227c0000 end_va = 0x227fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000227c0000" filename = "" Region: id = 1465 start_va = 0x22800000 end_va = 0x228fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022800000" filename = "" Region: id = 1466 start_va = 0x22900000 end_va = 0x2293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022900000" filename = "" Region: id = 1467 start_va = 0x22940000 end_va = 0x22a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022940000" filename = "" Region: id = 1468 start_va = 0x22a40000 end_va = 0x22a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022a40000" filename = "" Region: id = 1469 start_va = 0x22a80000 end_va = 0x22b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022a80000" filename = "" Region: id = 1470 start_va = 0x22b80000 end_va = 0x22bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022b80000" filename = "" Region: id = 1471 start_va = 0x22bc0000 end_va = 0x22cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022bc0000" filename = "" Region: id = 1472 start_va = 0x22cc0000 end_va = 0x22cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022cc0000" filename = "" Region: id = 1473 start_va = 0x22d00000 end_va = 0x22dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022d00000" filename = "" Region: id = 1474 start_va = 0x22e00000 end_va = 0x22e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022e00000" filename = "" Region: id = 1475 start_va = 0x22e40000 end_va = 0x22f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022e40000" filename = "" Region: id = 1476 start_va = 0x22f40000 end_va = 0x22f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022f40000" filename = "" Region: id = 1477 start_va = 0x22f80000 end_va = 0x2307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022f80000" filename = "" Region: id = 1478 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1479 start_va = 0xb250000 end_va = 0xb28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 1480 start_va = 0xb290000 end_va = 0xb38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 1481 start_va = 0xb390000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 1482 start_va = 0xb3d0000 end_va = 0xb4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 1483 start_va = 0xb4d0000 end_va = 0xb50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 1484 start_va = 0xb510000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 1485 start_va = 0xb610000 end_va = 0xb64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b610000" filename = "" Region: id = 1486 start_va = 0xb650000 end_va = 0xb74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b650000" filename = "" Region: id = 1487 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 1488 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 1489 start_va = 0xb890000 end_va = 0xb8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b890000" filename = "" Region: id = 1490 start_va = 0xb8d0000 end_va = 0xb9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b8d0000" filename = "" Region: id = 1491 start_va = 0xb9d0000 end_va = 0xba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b9d0000" filename = "" Region: id = 1492 start_va = 0xba10000 end_va = 0xbb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ba10000" filename = "" Region: id = 1493 start_va = 0xbb10000 end_va = 0xbb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb10000" filename = "" Region: id = 1494 start_va = 0xbb50000 end_va = 0xbc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb50000" filename = "" Region: id = 1495 start_va = 0xbc50000 end_va = 0xbc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc50000" filename = "" Region: id = 1496 start_va = 0xbc90000 end_va = 0xbd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc90000" filename = "" Region: id = 1497 start_va = 0xbd90000 end_va = 0xbdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd90000" filename = "" Region: id = 1498 start_va = 0xbdd0000 end_va = 0xbecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bdd0000" filename = "" Region: id = 1499 start_va = 0xbed0000 end_va = 0xbf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bed0000" filename = "" Region: id = 1500 start_va = 0xbf10000 end_va = 0xc00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bf10000" filename = "" Region: id = 1501 start_va = 0xc010000 end_va = 0xc04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c010000" filename = "" Region: id = 1502 start_va = 0xc050000 end_va = 0xc14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c050000" filename = "" Region: id = 1503 start_va = 0xc150000 end_va = 0xc18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 1504 start_va = 0xc190000 end_va = 0xc28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c190000" filename = "" Region: id = 1505 start_va = 0xc290000 end_va = 0xc2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c290000" filename = "" Region: id = 1506 start_va = 0xc2d0000 end_va = 0xc3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c2d0000" filename = "" Region: id = 1507 start_va = 0xc3d0000 end_va = 0xc40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 1508 start_va = 0xc410000 end_va = 0xc50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 1509 start_va = 0xc510000 end_va = 0xc54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 1510 start_va = 0xc550000 end_va = 0xc64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c550000" filename = "" Region: id = 1511 start_va = 0xc650000 end_va = 0xc68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 1512 start_va = 0xc690000 end_va = 0xc78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 1513 start_va = 0xc790000 end_va = 0xc7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c790000" filename = "" Region: id = 1514 start_va = 0xc7d0000 end_va = 0xc8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c7d0000" filename = "" Region: id = 1515 start_va = 0xc8d0000 end_va = 0xc90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c8d0000" filename = "" Region: id = 1516 start_va = 0xc910000 end_va = 0xca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c910000" filename = "" Region: id = 1517 start_va = 0xca10000 end_va = 0xca4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca10000" filename = "" Region: id = 1518 start_va = 0xca50000 end_va = 0xcb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 1519 start_va = 0xcb50000 end_va = 0xcb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 1520 start_va = 0xcb90000 end_va = 0xcc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 1521 start_va = 0xcc90000 end_va = 0xcccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cc90000" filename = "" Region: id = 1522 start_va = 0xccd0000 end_va = 0xcdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ccd0000" filename = "" Region: id = 1523 start_va = 0xcdd0000 end_va = 0xce0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 1524 start_va = 0xce10000 end_va = 0xcf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 1525 start_va = 0xcf10000 end_va = 0xcf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 1526 start_va = 0xcf50000 end_va = 0xd04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 1527 start_va = 0xd050000 end_va = 0xd08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 1528 start_va = 0xd090000 end_va = 0xd18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 1529 start_va = 0xd190000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 1530 start_va = 0xd1d0000 end_va = 0xd2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 1531 start_va = 0xd2d0000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 1532 start_va = 0xd310000 end_va = 0xd40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 1533 start_va = 0xd410000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 1534 start_va = 0xd450000 end_va = 0xd54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 1535 start_va = 0xd550000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 1536 start_va = 0xd590000 end_va = 0xd68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 1537 start_va = 0xd690000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 1538 start_va = 0xd6d0000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 1539 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 1540 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 1541 start_va = 0xd910000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 1542 start_va = 0xd950000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 1543 start_va = 0xda50000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 1544 start_va = 0xda90000 end_va = 0xdb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 1545 start_va = 0xdb90000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 1546 start_va = 0xdbd0000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 1547 start_va = 0xdcd0000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dcd0000" filename = "" Region: id = 1548 start_va = 0xdd10000 end_va = 0xde0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 1549 start_va = 0xde10000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 1550 start_va = 0xde50000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 1551 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 1552 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 1553 start_va = 0xe090000 end_va = 0xe0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 1554 start_va = 0xe0d0000 end_va = 0xe1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 1555 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 1556 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 1557 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 1558 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 1559 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 1560 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 1561 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 1562 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 1563 start_va = 0xe6d0000 end_va = 0xe70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e6d0000" filename = "" Region: id = 1564 start_va = 0xe710000 end_va = 0xe80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 1565 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 1566 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 1567 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 1568 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 1569 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 1570 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 1571 start_va = 0x23080000 end_va = 0x230bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023080000" filename = "" Region: id = 1572 start_va = 0x230c0000 end_va = 0x231bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000230c0000" filename = "" Region: id = 1573 start_va = 0x231c0000 end_va = 0x231fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000231c0000" filename = "" Region: id = 1574 start_va = 0x23200000 end_va = 0x232fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023200000" filename = "" Region: id = 1575 start_va = 0x23300000 end_va = 0x2333ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023300000" filename = "" Region: id = 1576 start_va = 0x23340000 end_va = 0x2343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023340000" filename = "" Region: id = 1577 start_va = 0x23440000 end_va = 0x2347ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023440000" filename = "" Region: id = 1578 start_va = 0x23480000 end_va = 0x2357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023480000" filename = "" Region: id = 1579 start_va = 0x12a0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 1580 start_va = 0xb050000 end_va = 0xb14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 1581 start_va = 0x23580000 end_va = 0x235bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023580000" filename = "" Region: id = 1582 start_va = 0x235c0000 end_va = 0x236bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000235c0000" filename = "" Region: id = 1583 start_va = 0x236c0000 end_va = 0x236fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000236c0000" filename = "" Region: id = 1584 start_va = 0x23700000 end_va = 0x237fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023700000" filename = "" Region: id = 1585 start_va = 0x23800000 end_va = 0x2383ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023800000" filename = "" Region: id = 1586 start_va = 0x23840000 end_va = 0x2393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023840000" filename = "" Region: id = 1587 start_va = 0x23940000 end_va = 0x2397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023940000" filename = "" Region: id = 1588 start_va = 0x23980000 end_va = 0x23a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023980000" filename = "" Region: id = 1589 start_va = 0x23a80000 end_va = 0x23abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a80000" filename = "" Region: id = 1590 start_va = 0x23ac0000 end_va = 0x23bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023ac0000" filename = "" Region: id = 1591 start_va = 0x23bc0000 end_va = 0x23bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023bc0000" filename = "" Region: id = 1592 start_va = 0x23c00000 end_va = 0x23cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023c00000" filename = "" Region: id = 1593 start_va = 0x23d00000 end_va = 0x23d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023d00000" filename = "" Region: id = 1594 start_va = 0x23d40000 end_va = 0x23e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023d40000" filename = "" Region: id = 1595 start_va = 0x23e40000 end_va = 0x23e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e40000" filename = "" Region: id = 1596 start_va = 0x23e80000 end_va = 0x23f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e80000" filename = "" Region: id = 1597 start_va = 0x23f80000 end_va = 0x23fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023f80000" filename = "" Region: id = 1598 start_va = 0x23fc0000 end_va = 0x240bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023fc0000" filename = "" Region: id = 1599 start_va = 0x240c0000 end_va = 0x240fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000240c0000" filename = "" Region: id = 1600 start_va = 0x24100000 end_va = 0x241fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024100000" filename = "" Region: id = 1601 start_va = 0x24200000 end_va = 0x2423ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024200000" filename = "" Region: id = 1602 start_va = 0x24240000 end_va = 0x2433ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024240000" filename = "" Region: id = 1603 start_va = 0x24340000 end_va = 0x2437ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024340000" filename = "" Region: id = 1604 start_va = 0x24380000 end_va = 0x2447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024380000" filename = "" Region: id = 1605 start_va = 0x24480000 end_va = 0x244bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024480000" filename = "" Region: id = 1606 start_va = 0x244c0000 end_va = 0x245bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000244c0000" filename = "" Region: id = 1607 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1608 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 1609 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 1610 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 1611 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 1612 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1613 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1614 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 1615 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 1616 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 1617 start_va = 0x12e0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 1618 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 1619 start_va = 0xb150000 end_va = 0xb24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 1620 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 1621 start_va = 0xf890000 end_va = 0xf98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 1622 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 1623 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 1624 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 1625 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 1626 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 1627 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 1628 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 1629 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 1630 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 1631 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 1632 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 1633 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 1634 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 1635 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 1636 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 1637 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 1638 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 1639 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 1640 start_va = 0x114d0000 end_va = 0x1150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000114d0000" filename = "" Region: id = 1641 start_va = 0x11510000 end_va = 0x1160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011510000" filename = "" Region: id = 1642 start_va = 0x11610000 end_va = 0x1164ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011610000" filename = "" Region: id = 1643 start_va = 0x11650000 end_va = 0x1174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011650000" filename = "" Region: id = 1644 start_va = 0x11750000 end_va = 0x1178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011750000" filename = "" Region: id = 1645 start_va = 0x11790000 end_va = 0x1188ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011790000" filename = "" Region: id = 1646 start_va = 0x11890000 end_va = 0x118cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011890000" filename = "" Region: id = 1647 start_va = 0x118d0000 end_va = 0x119cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000118d0000" filename = "" Region: id = 1648 start_va = 0x119d0000 end_va = 0x11a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000119d0000" filename = "" Region: id = 1649 start_va = 0x11a10000 end_va = 0x11b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011a10000" filename = "" Region: id = 1650 start_va = 0x11b10000 end_va = 0x11b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b10000" filename = "" Region: id = 1651 start_va = 0x11b50000 end_va = 0x11c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b50000" filename = "" Region: id = 1652 start_va = 0x11c50000 end_va = 0x11c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 1653 start_va = 0x11c90000 end_va = 0x11d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c90000" filename = "" Region: id = 1654 start_va = 0x11d90000 end_va = 0x11dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011d90000" filename = "" Region: id = 1655 start_va = 0x11dd0000 end_va = 0x11ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011dd0000" filename = "" Region: id = 1656 start_va = 0x11ed0000 end_va = 0x11f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ed0000" filename = "" Region: id = 1657 start_va = 0x11f10000 end_va = 0x1200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f10000" filename = "" Region: id = 1658 start_va = 0x12010000 end_va = 0x1204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012010000" filename = "" Region: id = 1659 start_va = 0x12050000 end_va = 0x1214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012050000" filename = "" Region: id = 1660 start_va = 0x12150000 end_va = 0x1218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012150000" filename = "" Region: id = 1661 start_va = 0x12190000 end_va = 0x1228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012190000" filename = "" Region: id = 1662 start_va = 0x12290000 end_va = 0x122cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012290000" filename = "" Region: id = 1663 start_va = 0x122d0000 end_va = 0x123cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000122d0000" filename = "" Region: id = 1664 start_va = 0x123d0000 end_va = 0x1240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000123d0000" filename = "" Region: id = 1665 start_va = 0x12410000 end_va = 0x1250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012410000" filename = "" Region: id = 1666 start_va = 0x12510000 end_va = 0x1254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012510000" filename = "" Region: id = 1667 start_va = 0x12550000 end_va = 0x1264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012550000" filename = "" Region: id = 1668 start_va = 0x12650000 end_va = 0x1268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012650000" filename = "" Region: id = 1669 start_va = 0x12690000 end_va = 0x1278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012690000" filename = "" Region: id = 1670 start_va = 0x12790000 end_va = 0x127cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012790000" filename = "" Region: id = 1671 start_va = 0x127d0000 end_va = 0x128cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000127d0000" filename = "" Region: id = 1672 start_va = 0x128d0000 end_va = 0x1290ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000128d0000" filename = "" Region: id = 1673 start_va = 0x12910000 end_va = 0x12a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012910000" filename = "" Region: id = 1674 start_va = 0x12a10000 end_va = 0x12a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a10000" filename = "" Region: id = 1675 start_va = 0x12a50000 end_va = 0x12b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a50000" filename = "" Region: id = 1676 start_va = 0x12b50000 end_va = 0x12b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b50000" filename = "" Region: id = 1677 start_va = 0x12b90000 end_va = 0x12c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b90000" filename = "" Region: id = 1678 start_va = 0x12c90000 end_va = 0x12ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012c90000" filename = "" Region: id = 1679 start_va = 0x12cd0000 end_va = 0x12dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012cd0000" filename = "" Region: id = 1680 start_va = 0x12dd0000 end_va = 0x12e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012dd0000" filename = "" Region: id = 1681 start_va = 0x12e10000 end_va = 0x12f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012e10000" filename = "" Region: id = 1682 start_va = 0x12f10000 end_va = 0x12f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f10000" filename = "" Region: id = 1683 start_va = 0x12f50000 end_va = 0x1304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f50000" filename = "" Region: id = 1684 start_va = 0x13050000 end_va = 0x1308ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013050000" filename = "" Region: id = 1685 start_va = 0x13090000 end_va = 0x1318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013090000" filename = "" Region: id = 1686 start_va = 0x13190000 end_va = 0x131cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013190000" filename = "" Region: id = 1687 start_va = 0x131d0000 end_va = 0x132cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000131d0000" filename = "" Region: id = 1688 start_va = 0x132d0000 end_va = 0x1330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000132d0000" filename = "" Region: id = 1689 start_va = 0x13310000 end_va = 0x1340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013310000" filename = "" Region: id = 1690 start_va = 0x13410000 end_va = 0x1344ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013410000" filename = "" Region: id = 1691 start_va = 0x13450000 end_va = 0x1354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013450000" filename = "" Region: id = 1692 start_va = 0x13550000 end_va = 0x1358ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013550000" filename = "" Region: id = 1693 start_va = 0x13590000 end_va = 0x1368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013590000" filename = "" Region: id = 1694 start_va = 0x13690000 end_va = 0x136cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013690000" filename = "" Region: id = 1695 start_va = 0x136d0000 end_va = 0x137cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000136d0000" filename = "" Region: id = 1696 start_va = 0x137d0000 end_va = 0x1380ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000137d0000" filename = "" Region: id = 1697 start_va = 0x13810000 end_va = 0x1390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013810000" filename = "" Region: id = 1698 start_va = 0x13910000 end_va = 0x1394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013910000" filename = "" Region: id = 1699 start_va = 0x13950000 end_va = 0x13a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013950000" filename = "" Region: id = 1700 start_va = 0x13a50000 end_va = 0x13a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a50000" filename = "" Region: id = 1701 start_va = 0x13a90000 end_va = 0x13b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a90000" filename = "" Region: id = 1702 start_va = 0x13b90000 end_va = 0x13bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013b90000" filename = "" Region: id = 1703 start_va = 0x13bd0000 end_va = 0x13ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013bd0000" filename = "" Region: id = 1704 start_va = 0x13cd0000 end_va = 0x13d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013cd0000" filename = "" Region: id = 1705 start_va = 0x13d10000 end_va = 0x13e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013d10000" filename = "" Region: id = 1706 start_va = 0x13e10000 end_va = 0x13e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e10000" filename = "" Region: id = 1707 start_va = 0x13e50000 end_va = 0x13f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e50000" filename = "" Region: id = 1708 start_va = 0x13f50000 end_va = 0x13f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013f50000" filename = "" Region: id = 1709 start_va = 0x13f90000 end_va = 0x1408ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013f90000" filename = "" Region: id = 1710 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 1711 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 1712 start_va = 0x141d0000 end_va = 0x1420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000141d0000" filename = "" Region: id = 1713 start_va = 0x14210000 end_va = 0x1430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014210000" filename = "" Region: id = 1714 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 1715 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 1716 start_va = 0x14450000 end_va = 0x1448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014450000" filename = "" Region: id = 1717 start_va = 0x14490000 end_va = 0x1458ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014490000" filename = "" Region: id = 1718 start_va = 0x14590000 end_va = 0x145cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014590000" filename = "" Region: id = 1719 start_va = 0x145d0000 end_va = 0x146cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145d0000" filename = "" Region: id = 1720 start_va = 0x146d0000 end_va = 0x1470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000146d0000" filename = "" Region: id = 1721 start_va = 0x14710000 end_va = 0x1480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 1722 start_va = 0x14810000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014810000" filename = "" Region: id = 1723 start_va = 0x14850000 end_va = 0x1494ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014850000" filename = "" Region: id = 1724 start_va = 0x14950000 end_va = 0x1498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014950000" filename = "" Region: id = 1725 start_va = 0x14990000 end_va = 0x14a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014990000" filename = "" Region: id = 1726 start_va = 0x14a90000 end_va = 0x14acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014a90000" filename = "" Region: id = 1727 start_va = 0x14ad0000 end_va = 0x14bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014ad0000" filename = "" Region: id = 1728 start_va = 0x14bd0000 end_va = 0x14c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014bd0000" filename = "" Region: id = 1729 start_va = 0x14c10000 end_va = 0x14d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c10000" filename = "" Region: id = 1730 start_va = 0x14d10000 end_va = 0x14d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d10000" filename = "" Region: id = 1731 start_va = 0x14d50000 end_va = 0x14e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d50000" filename = "" Region: id = 1732 start_va = 0x14e50000 end_va = 0x14e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e50000" filename = "" Region: id = 1733 start_va = 0x14e90000 end_va = 0x14f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e90000" filename = "" Region: id = 1734 start_va = 0x14f90000 end_va = 0x14fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f90000" filename = "" Region: id = 1735 start_va = 0x14fd0000 end_va = 0x150cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014fd0000" filename = "" Region: id = 1736 start_va = 0x150d0000 end_va = 0x1510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000150d0000" filename = "" Region: id = 1737 start_va = 0x15110000 end_va = 0x1520ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015110000" filename = "" Region: id = 1738 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1739 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 1740 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 1741 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 1742 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 1743 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 1744 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 1745 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 1746 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 1747 start_va = 0x15210000 end_va = 0x1524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015210000" filename = "" Region: id = 1748 start_va = 0x15250000 end_va = 0x1534ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015250000" filename = "" Region: id = 1749 start_va = 0x15350000 end_va = 0x1538ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015350000" filename = "" Region: id = 1750 start_va = 0x15390000 end_va = 0x1548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015390000" filename = "" Region: id = 1751 start_va = 0x15490000 end_va = 0x154cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015490000" filename = "" Region: id = 1752 start_va = 0x154d0000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000154d0000" filename = "" Region: id = 1753 start_va = 0x155d0000 end_va = 0x1560ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000155d0000" filename = "" Region: id = 1754 start_va = 0x15610000 end_va = 0x1570ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015610000" filename = "" Region: id = 1755 start_va = 0x15710000 end_va = 0x1574ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 1756 start_va = 0x15750000 end_va = 0x1584ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015750000" filename = "" Region: id = 1757 start_va = 0x15850000 end_va = 0x1588ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015850000" filename = "" Region: id = 1758 start_va = 0x15890000 end_va = 0x1598ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015890000" filename = "" Region: id = 1759 start_va = 0x15990000 end_va = 0x159cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015990000" filename = "" Region: id = 1760 start_va = 0x159d0000 end_va = 0x15acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000159d0000" filename = "" Region: id = 1761 start_va = 0x15ad0000 end_va = 0x15b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ad0000" filename = "" Region: id = 1762 start_va = 0x15b10000 end_va = 0x15c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b10000" filename = "" Region: id = 1763 start_va = 0x15c10000 end_va = 0x15c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c10000" filename = "" Region: id = 1764 start_va = 0x15c50000 end_va = 0x15d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c50000" filename = "" Region: id = 1765 start_va = 0x15d50000 end_va = 0x15d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d50000" filename = "" Region: id = 1766 start_va = 0x15d90000 end_va = 0x15e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d90000" filename = "" Region: id = 1767 start_va = 0x15e90000 end_va = 0x15ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e90000" filename = "" Region: id = 1768 start_va = 0x15ed0000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ed0000" filename = "" Region: id = 1769 start_va = 0x15fd0000 end_va = 0x1600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015fd0000" filename = "" Region: id = 1770 start_va = 0x16010000 end_va = 0x1610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016010000" filename = "" Region: id = 1771 start_va = 0x164d0000 end_va = 0x1650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 1772 start_va = 0x16510000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016510000" filename = "" Region: id = 1773 start_va = 0x16750000 end_va = 0x1678ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016750000" filename = "" Region: id = 1774 start_va = 0x16790000 end_va = 0x1688ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016790000" filename = "" Region: id = 1775 start_va = 0x169d0000 end_va = 0x16a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000169d0000" filename = "" Region: id = 1776 start_va = 0x16a10000 end_va = 0x16b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016a10000" filename = "" Region: id = 1777 start_va = 0x16b10000 end_va = 0x16b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b10000" filename = "" Region: id = 1778 start_va = 0x16b50000 end_va = 0x16c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b50000" filename = "" Region: id = 1779 start_va = 0x16c50000 end_va = 0x16c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c50000" filename = "" Region: id = 1780 start_va = 0x16c90000 end_va = 0x16d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c90000" filename = "" Region: id = 1781 start_va = 0x16d90000 end_va = 0x16dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016d90000" filename = "" Region: id = 1782 start_va = 0x16dd0000 end_va = 0x16ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016dd0000" filename = "" Region: id = 1783 start_va = 0x17150000 end_va = 0x1718ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017150000" filename = "" Region: id = 1784 start_va = 0x17190000 end_va = 0x1728ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017190000" filename = "" Region: id = 1785 start_va = 0x17290000 end_va = 0x172cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017290000" filename = "" Region: id = 1786 start_va = 0x172d0000 end_va = 0x173cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000172d0000" filename = "" Region: id = 1787 start_va = 0x17510000 end_va = 0x1754ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017510000" filename = "" Region: id = 1788 start_va = 0x17550000 end_va = 0x1764ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017550000" filename = "" Region: id = 1789 start_va = 0x17650000 end_va = 0x1768ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017650000" filename = "" Region: id = 1790 start_va = 0x17690000 end_va = 0x1778ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017690000" filename = "" Region: id = 1791 start_va = 0x17790000 end_va = 0x177cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017790000" filename = "" Region: id = 1792 start_va = 0x177d0000 end_va = 0x178cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000177d0000" filename = "" Region: id = 1793 start_va = 0x178d0000 end_va = 0x1790ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000178d0000" filename = "" Region: id = 1794 start_va = 0x17910000 end_va = 0x17a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017910000" filename = "" Region: id = 1795 start_va = 0x17a10000 end_va = 0x17a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017a10000" filename = "" Region: id = 1796 start_va = 0x17a50000 end_va = 0x17b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017a50000" filename = "" Region: id = 1797 start_va = 0x17b50000 end_va = 0x17b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b50000" filename = "" Region: id = 1798 start_va = 0x17e00000 end_va = 0x17efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017e00000" filename = "" Region: id = 1799 start_va = 0x18000000 end_va = 0x1803ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018000000" filename = "" Region: id = 1800 start_va = 0x18040000 end_va = 0x1813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018040000" filename = "" Region: id = 1801 start_va = 0x18140000 end_va = 0x1817ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018140000" filename = "" Region: id = 1802 start_va = 0x18180000 end_va = 0x1827ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018180000" filename = "" Region: id = 1803 start_va = 0x18280000 end_va = 0x182bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018280000" filename = "" Region: id = 1804 start_va = 0x182c0000 end_va = 0x183bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000182c0000" filename = "" Region: id = 1805 start_va = 0x183c0000 end_va = 0x183fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000183c0000" filename = "" Region: id = 1806 start_va = 0x18400000 end_va = 0x184fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018400000" filename = "" Region: id = 1807 start_va = 0x18500000 end_va = 0x1853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018500000" filename = "" Region: id = 1808 start_va = 0x18540000 end_va = 0x1863ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018540000" filename = "" Region: id = 1809 start_va = 0x18640000 end_va = 0x1867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018640000" filename = "" Region: id = 1810 start_va = 0x18680000 end_va = 0x1877ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018680000" filename = "" Region: id = 1811 start_va = 0x18780000 end_va = 0x187bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018780000" filename = "" Region: id = 1812 start_va = 0x187c0000 end_va = 0x188bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000187c0000" filename = "" Region: id = 1813 start_va = 0x188c0000 end_va = 0x188fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000188c0000" filename = "" Region: id = 1814 start_va = 0x18900000 end_va = 0x189fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018900000" filename = "" Region: id = 1815 start_va = 0x18a00000 end_va = 0x18a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a00000" filename = "" Region: id = 1816 start_va = 0x18a40000 end_va = 0x18b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a40000" filename = "" Region: id = 1817 start_va = 0x18b40000 end_va = 0x18b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018b40000" filename = "" Region: id = 1818 start_va = 0x18b80000 end_va = 0x18c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018b80000" filename = "" Region: id = 1819 start_va = 0x18c80000 end_va = 0x18cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018c80000" filename = "" Region: id = 1820 start_va = 0x18cc0000 end_va = 0x18dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018cc0000" filename = "" Region: id = 1821 start_va = 0x18dc0000 end_va = 0x18dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018dc0000" filename = "" Region: id = 1822 start_va = 0x18e00000 end_va = 0x18efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018e00000" filename = "" Region: id = 1823 start_va = 0x18f00000 end_va = 0x18f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018f00000" filename = "" Region: id = 1824 start_va = 0x18f40000 end_va = 0x1903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018f40000" filename = "" Region: id = 1825 start_va = 0x19040000 end_va = 0x1907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019040000" filename = "" Region: id = 1826 start_va = 0x19080000 end_va = 0x1917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019080000" filename = "" Region: id = 1827 start_va = 0x19180000 end_va = 0x191bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019180000" filename = "" Region: id = 1828 start_va = 0x191c0000 end_va = 0x192bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000191c0000" filename = "" Region: id = 1829 start_va = 0x192c0000 end_va = 0x192fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000192c0000" filename = "" Region: id = 1830 start_va = 0x19300000 end_va = 0x193fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019300000" filename = "" Region: id = 1831 start_va = 0x19400000 end_va = 0x1943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019400000" filename = "" Region: id = 1832 start_va = 0x19440000 end_va = 0x1953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019440000" filename = "" Region: id = 1833 start_va = 0x19540000 end_va = 0x1957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019540000" filename = "" Region: id = 1834 start_va = 0x19580000 end_va = 0x1967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019580000" filename = "" Region: id = 1835 start_va = 0x19680000 end_va = 0x196bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019680000" filename = "" Region: id = 1836 start_va = 0x196c0000 end_va = 0x197bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000196c0000" filename = "" Region: id = 1837 start_va = 0x197c0000 end_va = 0x197fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000197c0000" filename = "" Region: id = 1838 start_va = 0x19800000 end_va = 0x198fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019800000" filename = "" Region: id = 1839 start_va = 0x19900000 end_va = 0x1993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019900000" filename = "" Region: id = 1840 start_va = 0x19940000 end_va = 0x19a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019940000" filename = "" Region: id = 1841 start_va = 0x19a40000 end_va = 0x19a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019a40000" filename = "" Region: id = 1842 start_va = 0x19a80000 end_va = 0x19b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019a80000" filename = "" Region: id = 1843 start_va = 0x19b80000 end_va = 0x19bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019b80000" filename = "" Region: id = 1844 start_va = 0x19bc0000 end_va = 0x19cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019bc0000" filename = "" Region: id = 1845 start_va = 0x19cc0000 end_va = 0x19cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019cc0000" filename = "" Region: id = 1846 start_va = 0x19d00000 end_va = 0x19dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019d00000" filename = "" Region: id = 1847 start_va = 0x19e00000 end_va = 0x19e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019e00000" filename = "" Region: id = 1848 start_va = 0x19e40000 end_va = 0x19f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019e40000" filename = "" Region: id = 1849 start_va = 0x19f40000 end_va = 0x19f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019f40000" filename = "" Region: id = 1850 start_va = 0x19f80000 end_va = 0x1a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019f80000" filename = "" Region: id = 1851 start_va = 0x1a080000 end_va = 0x1a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a080000" filename = "" Region: id = 1852 start_va = 0x1a0c0000 end_va = 0x1a1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a0c0000" filename = "" Region: id = 1853 start_va = 0x1a1c0000 end_va = 0x1a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a1c0000" filename = "" Region: id = 1854 start_va = 0x1a200000 end_va = 0x1a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a200000" filename = "" Region: id = 1855 start_va = 0x1a300000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a300000" filename = "" Region: id = 1856 start_va = 0x1a340000 end_va = 0x1a43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 1857 start_va = 0x1a440000 end_va = 0x1a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a440000" filename = "" Region: id = 1858 start_va = 0x1a480000 end_va = 0x1a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a480000" filename = "" Region: id = 1859 start_va = 0x1a580000 end_va = 0x1a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a580000" filename = "" Region: id = 1860 start_va = 0x1a5c0000 end_va = 0x1a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5c0000" filename = "" Region: id = 1861 start_va = 0x1a6c0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6c0000" filename = "" Region: id = 1862 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 1863 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 1864 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1865 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 1866 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 1867 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 1868 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 1869 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 1870 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 1871 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 1872 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 1873 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 1874 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 1875 start_va = 0xf0d0000 end_va = 0xf10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f0d0000" filename = "" Region: id = 1876 start_va = 0xf110000 end_va = 0xf20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f110000" filename = "" Region: id = 1877 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 1878 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 1879 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 1880 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 1881 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 1882 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 1883 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 1884 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 1885 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 1886 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 1887 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 1888 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 1889 start_va = 0x10850000 end_va = 0x1088ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010850000" filename = "" Region: id = 1890 start_va = 0x10890000 end_va = 0x1098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010890000" filename = "" Region: id = 1891 start_va = 0x16ed0000 end_va = 0x16f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016ed0000" filename = "" Region: id = 1892 start_va = 0x16f10000 end_va = 0x1700ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016f10000" filename = "" Region: id = 1893 start_va = 0x1a7c0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 1894 start_va = 0x1a800000 end_va = 0x1a8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 1895 start_va = 0x1a900000 end_va = 0x1a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a900000" filename = "" Region: id = 1896 start_va = 0x1a940000 end_va = 0x1aa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a940000" filename = "" Region: id = 1897 start_va = 0x1aa40000 end_va = 0x1aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa40000" filename = "" Region: id = 1898 start_va = 0x1aa80000 end_va = 0x1ab7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa80000" filename = "" Region: id = 1899 start_va = 0x1ab80000 end_va = 0x1abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab80000" filename = "" Region: id = 1900 start_va = 0x1abc0000 end_va = 0x1acbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abc0000" filename = "" Region: id = 1901 start_va = 0x1acc0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acc0000" filename = "" Region: id = 1902 start_va = 0x1ad00000 end_va = 0x1adfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 1903 start_va = 0x1ae00000 end_va = 0x1ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae00000" filename = "" Region: id = 1904 start_va = 0x1ae40000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae40000" filename = "" Region: id = 1905 start_va = 0x1af40000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 1906 start_va = 0x1af80000 end_va = 0x1b07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 1907 start_va = 0x1b080000 end_va = 0x1b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b080000" filename = "" Region: id = 1908 start_va = 0x1b0c0000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0c0000" filename = "" Region: id = 1909 start_va = 0x1b1c0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 1910 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 1911 start_va = 0x1b300000 end_va = 0x1b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 1912 start_va = 0x1b340000 end_va = 0x1b43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b340000" filename = "" Region: id = 1913 start_va = 0x1b440000 end_va = 0x1b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b440000" filename = "" Region: id = 1914 start_va = 0x1b480000 end_va = 0x1b57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b480000" filename = "" Region: id = 1915 start_va = 0x1b580000 end_va = 0x1b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b580000" filename = "" Region: id = 1916 start_va = 0x1b5c0000 end_va = 0x1b6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5c0000" filename = "" Region: id = 1917 start_va = 0x1b6c0000 end_va = 0x1b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6c0000" filename = "" Region: id = 1918 start_va = 0x1b700000 end_va = 0x1b7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b700000" filename = "" Region: id = 1919 start_va = 0x1b800000 end_va = 0x1b83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b800000" filename = "" Region: id = 1920 start_va = 0x1b840000 end_va = 0x1b93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b840000" filename = "" Region: id = 1921 start_va = 0x1b940000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 1922 start_va = 0x1b980000 end_va = 0x1ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b980000" filename = "" Region: id = 1923 start_va = 0x1ba80000 end_va = 0x1babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 1924 start_va = 0x1bac0000 end_va = 0x1bbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bac0000" filename = "" Region: id = 1925 start_va = 0x1bbc0000 end_va = 0x1bbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bbc0000" filename = "" Region: id = 1926 start_va = 0x1bc00000 end_va = 0x1bcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc00000" filename = "" Region: id = 1927 start_va = 0x1bd00000 end_va = 0x1bd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd00000" filename = "" Region: id = 1928 start_va = 0x1bd40000 end_va = 0x1be3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd40000" filename = "" Region: id = 1929 start_va = 0x1be40000 end_va = 0x1be7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be40000" filename = "" Region: id = 1930 start_va = 0x1be80000 end_va = 0x1bf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be80000" filename = "" Region: id = 1931 start_va = 0x1bf80000 end_va = 0x1bfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bf80000" filename = "" Region: id = 1932 start_va = 0x1bfc0000 end_va = 0x1c0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bfc0000" filename = "" Region: id = 1933 start_va = 0x1c0c0000 end_va = 0x1c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c0c0000" filename = "" Region: id = 1934 start_va = 0x1c100000 end_va = 0x1c1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c100000" filename = "" Region: id = 1935 start_va = 0x1c200000 end_va = 0x1c23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c200000" filename = "" Region: id = 1936 start_va = 0x1c240000 end_va = 0x1c33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c240000" filename = "" Region: id = 1937 start_va = 0x1c340000 end_va = 0x1c37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c340000" filename = "" Region: id = 1938 start_va = 0x1c380000 end_va = 0x1c47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c380000" filename = "" Region: id = 1939 start_va = 0x1c480000 end_va = 0x1c4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c480000" filename = "" Region: id = 1940 start_va = 0x1c4c0000 end_va = 0x1c5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c4c0000" filename = "" Region: id = 1941 start_va = 0x1c5c0000 end_va = 0x1c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c5c0000" filename = "" Region: id = 1942 start_va = 0x1c600000 end_va = 0x1c6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c600000" filename = "" Region: id = 1943 start_va = 0x1c700000 end_va = 0x1c73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c700000" filename = "" Region: id = 1944 start_va = 0x1c740000 end_va = 0x1c83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c740000" filename = "" Region: id = 1945 start_va = 0x1c840000 end_va = 0x1c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c840000" filename = "" Region: id = 1946 start_va = 0x1c880000 end_va = 0x1c97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c880000" filename = "" Region: id = 1947 start_va = 0x1c980000 end_va = 0x1c9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c980000" filename = "" Region: id = 1948 start_va = 0x1c9c0000 end_va = 0x1cabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c9c0000" filename = "" Region: id = 1949 start_va = 0x1cac0000 end_va = 0x1cafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cac0000" filename = "" Region: id = 1950 start_va = 0x1cb00000 end_va = 0x1cbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cb00000" filename = "" Region: id = 1951 start_va = 0x1cc00000 end_va = 0x1cc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cc00000" filename = "" Region: id = 1952 start_va = 0x1cc40000 end_va = 0x1cd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cc40000" filename = "" Region: id = 1953 start_va = 0x1cd40000 end_va = 0x1cd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cd40000" filename = "" Region: id = 1954 start_va = 0x1cd80000 end_va = 0x1ce7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cd80000" filename = "" Region: id = 1955 start_va = 0x1ce80000 end_va = 0x1cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ce80000" filename = "" Region: id = 1956 start_va = 0x1cec0000 end_va = 0x1cfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cec0000" filename = "" Region: id = 1957 start_va = 0x1cfc0000 end_va = 0x1cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cfc0000" filename = "" Region: id = 1958 start_va = 0x1d000000 end_va = 0x1d0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d000000" filename = "" Region: id = 1959 start_va = 0x1d100000 end_va = 0x1d13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d100000" filename = "" Region: id = 1960 start_va = 0x1d140000 end_va = 0x1d23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d140000" filename = "" Region: id = 1961 start_va = 0x1d240000 end_va = 0x1d27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d240000" filename = "" Region: id = 1962 start_va = 0x1d280000 end_va = 0x1d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d280000" filename = "" Region: id = 1963 start_va = 0x1d380000 end_va = 0x1d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d380000" filename = "" Region: id = 1964 start_va = 0x1d3c0000 end_va = 0x1d4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d3c0000" filename = "" Region: id = 1965 start_va = 0x1d4c0000 end_va = 0x1d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d4c0000" filename = "" Region: id = 1966 start_va = 0x1d500000 end_va = 0x1d5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d500000" filename = "" Region: id = 1967 start_va = 0x1d600000 end_va = 0x1d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d600000" filename = "" Region: id = 1968 start_va = 0x1d640000 end_va = 0x1d73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d640000" filename = "" Region: id = 1969 start_va = 0x1d740000 end_va = 0x1d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d740000" filename = "" Region: id = 1970 start_va = 0x1d780000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d780000" filename = "" Region: id = 1971 start_va = 0x1d880000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d880000" filename = "" Region: id = 1972 start_va = 0x1d8c0000 end_va = 0x1d9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 1973 start_va = 0x1d9c0000 end_va = 0x1d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d9c0000" filename = "" Region: id = 1974 start_va = 0x1da00000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001da00000" filename = "" Region: id = 1975 start_va = 0x1db00000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 1976 start_va = 0x1db40000 end_va = 0x1dc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db40000" filename = "" Region: id = 1977 start_va = 0x1dc40000 end_va = 0x1dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc40000" filename = "" Region: id = 1978 start_va = 0x1dc80000 end_va = 0x1dd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc80000" filename = "" Region: id = 1979 start_va = 0x1dd80000 end_va = 0x1ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dd80000" filename = "" Region: id = 1980 start_va = 0x1ddc0000 end_va = 0x1debffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ddc0000" filename = "" Region: id = 1981 start_va = 0x1dec0000 end_va = 0x1defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dec0000" filename = "" Region: id = 1982 start_va = 0x1df00000 end_va = 0x1dffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001df00000" filename = "" Region: id = 1983 start_va = 0x1e000000 end_va = 0x1e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e000000" filename = "" Region: id = 1984 start_va = 0x1e040000 end_va = 0x1e13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e040000" filename = "" Region: id = 1985 start_va = 0x1e140000 end_va = 0x1e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e140000" filename = "" Region: id = 1986 start_va = 0x1e180000 end_va = 0x1e27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e180000" filename = "" Region: id = 1987 start_va = 0x1e280000 end_va = 0x1e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e280000" filename = "" Region: id = 1988 start_va = 0x1e2c0000 end_va = 0x1e3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e2c0000" filename = "" Region: id = 1989 start_va = 0x1e3c0000 end_va = 0x1e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e3c0000" filename = "" Region: id = 1990 start_va = 0x1e400000 end_va = 0x1e4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e400000" filename = "" Region: id = 1991 start_va = 0x1e500000 end_va = 0x1e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e500000" filename = "" Region: id = 1992 start_va = 0x1e540000 end_va = 0x1e63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e540000" filename = "" Region: id = 1993 start_va = 0x1e640000 end_va = 0x1e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e640000" filename = "" Region: id = 1994 start_va = 0x1e680000 end_va = 0x1e77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e680000" filename = "" Region: id = 1995 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1996 start_va = 0xb250000 end_va = 0xb28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 1997 start_va = 0xb290000 end_va = 0xb38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 1998 start_va = 0xb390000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 1999 start_va = 0xb3d0000 end_va = 0xb4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 2000 start_va = 0xb4d0000 end_va = 0xb50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 2001 start_va = 0xb510000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 2002 start_va = 0xb610000 end_va = 0xb64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b610000" filename = "" Region: id = 2003 start_va = 0xb650000 end_va = 0xb74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b650000" filename = "" Region: id = 2004 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 2005 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 2006 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 2007 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 2008 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 2009 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 2010 start_va = 0x16110000 end_va = 0x1614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 2011 start_va = 0x16150000 end_va = 0x1624ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016150000" filename = "" Region: id = 2012 start_va = 0x16250000 end_va = 0x1628ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016250000" filename = "" Region: id = 2013 start_va = 0x16290000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016290000" filename = "" Region: id = 2014 start_va = 0x16390000 end_va = 0x163cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016390000" filename = "" Region: id = 2015 start_va = 0x163d0000 end_va = 0x164cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000163d0000" filename = "" Region: id = 2016 start_va = 0x16610000 end_va = 0x1664ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016610000" filename = "" Region: id = 2017 start_va = 0x16650000 end_va = 0x1674ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016650000" filename = "" Region: id = 2018 start_va = 0x16890000 end_va = 0x168cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016890000" filename = "" Region: id = 2019 start_va = 0x168d0000 end_va = 0x169cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000168d0000" filename = "" Region: id = 2020 start_va = 0x17010000 end_va = 0x1704ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017010000" filename = "" Region: id = 2021 start_va = 0x17050000 end_va = 0x1714ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017050000" filename = "" Region: id = 2022 start_va = 0x17b90000 end_va = 0x17bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b90000" filename = "" Region: id = 2023 start_va = 0x17f00000 end_va = 0x17ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017f00000" filename = "" Region: id = 2024 start_va = 0x1e780000 end_va = 0x1e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e780000" filename = "" Region: id = 2025 start_va = 0x1e7c0000 end_va = 0x1e8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e7c0000" filename = "" Region: id = 2026 start_va = 0x1e8c0000 end_va = 0x1e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e8c0000" filename = "" Region: id = 2027 start_va = 0x1e900000 end_va = 0x1e9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e900000" filename = "" Region: id = 2028 start_va = 0x1ea00000 end_va = 0x1ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ea00000" filename = "" Region: id = 2029 start_va = 0x1ea40000 end_va = 0x1eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ea40000" filename = "" Region: id = 2030 start_va = 0x1eb40000 end_va = 0x1eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eb40000" filename = "" Region: id = 2031 start_va = 0x1eb80000 end_va = 0x1ec7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eb80000" filename = "" Region: id = 2032 start_va = 0x1ec80000 end_va = 0x1ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ec80000" filename = "" Region: id = 2033 start_va = 0x1ecc0000 end_va = 0x1edbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ecc0000" filename = "" Region: id = 2034 start_va = 0x1edc0000 end_va = 0x1edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001edc0000" filename = "" Region: id = 2035 start_va = 0x1ee00000 end_va = 0x1eefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ee00000" filename = "" Region: id = 2036 start_va = 0x1ef00000 end_va = 0x1ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ef00000" filename = "" Region: id = 2037 start_va = 0x1ef40000 end_va = 0x1f03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ef40000" filename = "" Region: id = 2038 start_va = 0x1f040000 end_va = 0x1f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f040000" filename = "" Region: id = 2039 start_va = 0x1f080000 end_va = 0x1f17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f080000" filename = "" Region: id = 2040 start_va = 0x1f180000 end_va = 0x1f1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f180000" filename = "" Region: id = 2041 start_va = 0x1f1c0000 end_va = 0x1f2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f1c0000" filename = "" Region: id = 2042 start_va = 0x1f2c0000 end_va = 0x1f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f2c0000" filename = "" Region: id = 2043 start_va = 0x1f300000 end_va = 0x1f3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f300000" filename = "" Region: id = 2044 start_va = 0x1f400000 end_va = 0x1f43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f400000" filename = "" Region: id = 2045 start_va = 0x1f440000 end_va = 0x1f53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f440000" filename = "" Region: id = 2046 start_va = 0x1f540000 end_va = 0x1f57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f540000" filename = "" Region: id = 2047 start_va = 0x1f580000 end_va = 0x1f67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f580000" filename = "" Region: id = 2048 start_va = 0x1f680000 end_va = 0x1f6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f680000" filename = "" Region: id = 2049 start_va = 0x1f6c0000 end_va = 0x1f7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f6c0000" filename = "" Region: id = 2050 start_va = 0x1f7c0000 end_va = 0x1f7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f7c0000" filename = "" Region: id = 2051 start_va = 0x1f800000 end_va = 0x1f8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f800000" filename = "" Region: id = 2052 start_va = 0x1f900000 end_va = 0x1f93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f900000" filename = "" Region: id = 2053 start_va = 0x1f940000 end_va = 0x1fa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f940000" filename = "" Region: id = 2054 start_va = 0x1fa40000 end_va = 0x1fa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fa40000" filename = "" Region: id = 2055 start_va = 0x1fa80000 end_va = 0x1fb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fa80000" filename = "" Region: id = 2056 start_va = 0x1fb80000 end_va = 0x1fbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fb80000" filename = "" Region: id = 2057 start_va = 0x1fbc0000 end_va = 0x1fcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fbc0000" filename = "" Region: id = 2058 start_va = 0x1fcc0000 end_va = 0x1fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fcc0000" filename = "" Region: id = 2059 start_va = 0x1fd00000 end_va = 0x1fdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fd00000" filename = "" Region: id = 2060 start_va = 0x1fe00000 end_va = 0x1fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fe00000" filename = "" Region: id = 2061 start_va = 0x1fe40000 end_va = 0x1ff3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fe40000" filename = "" Region: id = 2062 start_va = 0x1ff40000 end_va = 0x1ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ff40000" filename = "" Region: id = 2063 start_va = 0x1ff80000 end_va = 0x2007ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ff80000" filename = "" Region: id = 2064 start_va = 0x20080000 end_va = 0x200bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020080000" filename = "" Region: id = 2065 start_va = 0x200c0000 end_va = 0x201bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000200c0000" filename = "" Region: id = 2066 start_va = 0x201c0000 end_va = 0x201fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000201c0000" filename = "" Region: id = 2067 start_va = 0x20200000 end_va = 0x202fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020200000" filename = "" Region: id = 2068 start_va = 0x20300000 end_va = 0x2033ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020300000" filename = "" Region: id = 2069 start_va = 0x20340000 end_va = 0x2043ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020340000" filename = "" Region: id = 2070 start_va = 0x20440000 end_va = 0x2047ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020440000" filename = "" Region: id = 2071 start_va = 0x20480000 end_va = 0x2057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020480000" filename = "" Region: id = 2072 start_va = 0x20580000 end_va = 0x205bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020580000" filename = "" Region: id = 2073 start_va = 0x205c0000 end_va = 0x206bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000205c0000" filename = "" Region: id = 2074 start_va = 0x206c0000 end_va = 0x206fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000206c0000" filename = "" Region: id = 2075 start_va = 0x20700000 end_va = 0x207fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020700000" filename = "" Region: id = 2076 start_va = 0x20800000 end_va = 0x2083ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020800000" filename = "" Region: id = 2077 start_va = 0x20840000 end_va = 0x2093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020840000" filename = "" Region: id = 2078 start_va = 0x20940000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020940000" filename = "" Region: id = 2079 start_va = 0x20980000 end_va = 0x20a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020980000" filename = "" Region: id = 2080 start_va = 0x20a80000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a80000" filename = "" Region: id = 2081 start_va = 0x20ac0000 end_va = 0x20bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ac0000" filename = "" Region: id = 2082 start_va = 0x20bc0000 end_va = 0x20bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020bc0000" filename = "" Region: id = 2083 start_va = 0x20c00000 end_va = 0x20cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020c00000" filename = "" Region: id = 2084 start_va = 0x20d00000 end_va = 0x20d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020d00000" filename = "" Region: id = 2085 start_va = 0x20d40000 end_va = 0x20e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020d40000" filename = "" Region: id = 2086 start_va = 0x20e40000 end_va = 0x20e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020e40000" filename = "" Region: id = 2087 start_va = 0x20e80000 end_va = 0x20f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020e80000" filename = "" Region: id = 2088 start_va = 0x20f80000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020f80000" filename = "" Region: id = 2089 start_va = 0x20fc0000 end_va = 0x210bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 2090 start_va = 0x210c0000 end_va = 0x210fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000210c0000" filename = "" Region: id = 2091 start_va = 0x21100000 end_va = 0x211fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021100000" filename = "" Region: id = 2092 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 2093 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 2094 start_va = 0x21200000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021200000" filename = "" Region: id = 2095 start_va = 0x21240000 end_va = 0x2133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021240000" filename = "" Region: id = 2096 start_va = 0x21340000 end_va = 0x2137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021340000" filename = "" Region: id = 2097 start_va = 0x21380000 end_va = 0x2147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 2098 start_va = 0x21480000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021480000" filename = "" Region: id = 2099 start_va = 0x214c0000 end_va = 0x215bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000214c0000" filename = "" Region: id = 2100 start_va = 0x215c0000 end_va = 0x215fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000215c0000" filename = "" Region: id = 2101 start_va = 0x21600000 end_va = 0x216fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021600000" filename = "" Region: id = 2102 start_va = 0x21700000 end_va = 0x2173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021700000" filename = "" Region: id = 2103 start_va = 0x21740000 end_va = 0x2183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021740000" filename = "" Region: id = 2104 start_va = 0x21840000 end_va = 0x2187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021840000" filename = "" Region: id = 2105 start_va = 0x21880000 end_va = 0x2197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021880000" filename = "" Region: id = 2106 start_va = 0x21980000 end_va = 0x219bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021980000" filename = "" Region: id = 2107 start_va = 0x219c0000 end_va = 0x21abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000219c0000" filename = "" Region: id = 2108 start_va = 0x21ac0000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ac0000" filename = "" Region: id = 2109 start_va = 0x21b00000 end_va = 0x21bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b00000" filename = "" Region: id = 2110 start_va = 0x21c00000 end_va = 0x21c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c00000" filename = "" Region: id = 2111 start_va = 0x21c40000 end_va = 0x21d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 2112 start_va = 0x21d40000 end_va = 0x21d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d40000" filename = "" Region: id = 2113 start_va = 0x21d80000 end_va = 0x21e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d80000" filename = "" Region: id = 2114 start_va = 0x21e80000 end_va = 0x21ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e80000" filename = "" Region: id = 2115 start_va = 0x21ec0000 end_va = 0x21fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ec0000" filename = "" Region: id = 2116 start_va = 0x21fc0000 end_va = 0x21ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021fc0000" filename = "" Region: id = 2117 start_va = 0x22000000 end_va = 0x220fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022000000" filename = "" Region: id = 2118 start_va = 0x22100000 end_va = 0x2213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022100000" filename = "" Region: id = 2119 start_va = 0x22140000 end_va = 0x2223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022140000" filename = "" Region: id = 2120 start_va = 0x22240000 end_va = 0x2227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022240000" filename = "" Region: id = 2121 start_va = 0x22280000 end_va = 0x2237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022280000" filename = "" Region: id = 2122 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2123 start_va = 0xb890000 end_va = 0xb8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b890000" filename = "" Region: id = 2124 start_va = 0xb8d0000 end_va = 0xb9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b8d0000" filename = "" Region: id = 2125 start_va = 0xb9d0000 end_va = 0xba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b9d0000" filename = "" Region: id = 2126 start_va = 0xba10000 end_va = 0xbb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ba10000" filename = "" Region: id = 2127 start_va = 0xbb10000 end_va = 0xbb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb10000" filename = "" Region: id = 2128 start_va = 0xbb50000 end_va = 0xbc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb50000" filename = "" Region: id = 2129 start_va = 0xbc50000 end_va = 0xbc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc50000" filename = "" Region: id = 2130 start_va = 0xbc90000 end_va = 0xbd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc90000" filename = "" Region: id = 2131 start_va = 0xbd90000 end_va = 0xbdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd90000" filename = "" Region: id = 2132 start_va = 0xbdd0000 end_va = 0xbecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bdd0000" filename = "" Region: id = 2133 start_va = 0xbed0000 end_va = 0xbf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bed0000" filename = "" Region: id = 2134 start_va = 0xbf10000 end_va = 0xc00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bf10000" filename = "" Region: id = 2135 start_va = 0xc010000 end_va = 0xc04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c010000" filename = "" Region: id = 2136 start_va = 0xc050000 end_va = 0xc14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c050000" filename = "" Region: id = 2137 start_va = 0xc150000 end_va = 0xc18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 2138 start_va = 0xc190000 end_va = 0xc28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c190000" filename = "" Region: id = 2139 start_va = 0xc290000 end_va = 0xc2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c290000" filename = "" Region: id = 2140 start_va = 0xc2d0000 end_va = 0xc3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c2d0000" filename = "" Region: id = 2141 start_va = 0xc3d0000 end_va = 0xc40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 2142 start_va = 0xc410000 end_va = 0xc50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 2143 start_va = 0xc510000 end_va = 0xc54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 2144 start_va = 0xc550000 end_va = 0xc64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c550000" filename = "" Region: id = 2145 start_va = 0xc650000 end_va = 0xc68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 2146 start_va = 0xc690000 end_va = 0xc78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 2147 start_va = 0xc790000 end_va = 0xc7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c790000" filename = "" Region: id = 2148 start_va = 0xc7d0000 end_va = 0xc8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c7d0000" filename = "" Region: id = 2149 start_va = 0xc8d0000 end_va = 0xc90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c8d0000" filename = "" Region: id = 2150 start_va = 0xc910000 end_va = 0xca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c910000" filename = "" Region: id = 2151 start_va = 0xca10000 end_va = 0xca4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca10000" filename = "" Region: id = 2152 start_va = 0xca50000 end_va = 0xcb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 2153 start_va = 0xcb50000 end_va = 0xcb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 2154 start_va = 0xcb90000 end_va = 0xcc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 2155 start_va = 0xcc90000 end_va = 0xcccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cc90000" filename = "" Region: id = 2156 start_va = 0xccd0000 end_va = 0xcdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ccd0000" filename = "" Region: id = 2157 start_va = 0xcdd0000 end_va = 0xce0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 2158 start_va = 0xce10000 end_va = 0xcf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 2159 start_va = 0xcf10000 end_va = 0xcf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 2160 start_va = 0xcf50000 end_va = 0xd04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 2161 start_va = 0xd050000 end_va = 0xd08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 2162 start_va = 0xd090000 end_va = 0xd18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 2163 start_va = 0xd190000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 2164 start_va = 0xd1d0000 end_va = 0xd2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 2165 start_va = 0xd2d0000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 2166 start_va = 0xd310000 end_va = 0xd40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 2167 start_va = 0xd410000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 2168 start_va = 0xd450000 end_va = 0xd54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 2169 start_va = 0xd550000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 2170 start_va = 0xd590000 end_va = 0xd68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 2171 start_va = 0xd690000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 2172 start_va = 0xd6d0000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 2173 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 2174 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 2175 start_va = 0xd910000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 2176 start_va = 0xd950000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 2177 start_va = 0xda50000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 2178 start_va = 0xda90000 end_va = 0xdb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 2179 start_va = 0xdb90000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 2180 start_va = 0xdbd0000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 2181 start_va = 0xdcd0000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dcd0000" filename = "" Region: id = 2182 start_va = 0xdd10000 end_va = 0xde0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 2183 start_va = 0xde10000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 2184 start_va = 0xde50000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 2185 start_va = 0x22380000 end_va = 0x223bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022380000" filename = "" Region: id = 2186 start_va = 0x223c0000 end_va = 0x224bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000223c0000" filename = "" Region: id = 2187 start_va = 0x224c0000 end_va = 0x224fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000224c0000" filename = "" Region: id = 2188 start_va = 0x22500000 end_va = 0x225fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022500000" filename = "" Region: id = 2189 start_va = 0x22600000 end_va = 0x2263ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022600000" filename = "" Region: id = 2190 start_va = 0x22640000 end_va = 0x2273ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022640000" filename = "" Region: id = 2191 start_va = 0x22740000 end_va = 0x2277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022740000" filename = "" Region: id = 2192 start_va = 0x22780000 end_va = 0x2287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022780000" filename = "" Region: id = 2193 start_va = 0x22880000 end_va = 0x228bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022880000" filename = "" Region: id = 2194 start_va = 0x228c0000 end_va = 0x229bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000228c0000" filename = "" Region: id = 2195 start_va = 0x229c0000 end_va = 0x229fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000229c0000" filename = "" Region: id = 2196 start_va = 0x22a00000 end_va = 0x22afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022a00000" filename = "" Region: id = 2197 start_va = 0x22b00000 end_va = 0x22b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022b00000" filename = "" Region: id = 2198 start_va = 0x22b40000 end_va = 0x22c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022b40000" filename = "" Region: id = 2199 start_va = 0x22c40000 end_va = 0x22c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022c40000" filename = "" Region: id = 2200 start_va = 0x22c80000 end_va = 0x22d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022c80000" filename = "" Region: id = 2201 start_va = 0x22d80000 end_va = 0x22dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022d80000" filename = "" Region: id = 2202 start_va = 0x22dc0000 end_va = 0x22ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022dc0000" filename = "" Region: id = 2203 start_va = 0x22ec0000 end_va = 0x22efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022ec0000" filename = "" Region: id = 2204 start_va = 0x22f00000 end_va = 0x22ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022f00000" filename = "" Region: id = 2205 start_va = 0x23000000 end_va = 0x2303ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023000000" filename = "" Region: id = 2206 start_va = 0x23040000 end_va = 0x2307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023040000" filename = "" Region: id = 2207 start_va = 0x245c0000 end_va = 0x246bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000245c0000" filename = "" Region: id = 2208 start_va = 0x246c0000 end_va = 0x247bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000246c0000" filename = "" Region: id = 2209 start_va = 0x247c0000 end_va = 0x247fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000247c0000" filename = "" Region: id = 2210 start_va = 0x24800000 end_va = 0x248fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024800000" filename = "" Region: id = 2211 start_va = 0x24900000 end_va = 0x2493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024900000" filename = "" Region: id = 2212 start_va = 0x24940000 end_va = 0x24a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024940000" filename = "" Region: id = 2213 start_va = 0x24a40000 end_va = 0x24a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024a40000" filename = "" Region: id = 2214 start_va = 0x24a80000 end_va = 0x24b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024a80000" filename = "" Region: id = 2215 start_va = 0x24b80000 end_va = 0x24bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024b80000" filename = "" Region: id = 2216 start_va = 0x24bc0000 end_va = 0x24cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024bc0000" filename = "" Region: id = 2217 start_va = 0x24cc0000 end_va = 0x24cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024cc0000" filename = "" Region: id = 2218 start_va = 0x24d00000 end_va = 0x24dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024d00000" filename = "" Region: id = 2219 start_va = 0x24e00000 end_va = 0x24e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024e00000" filename = "" Region: id = 2220 start_va = 0x24e40000 end_va = 0x24f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024e40000" filename = "" Region: id = 2221 start_va = 0x24f40000 end_va = 0x24f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024f40000" filename = "" Region: id = 2222 start_va = 0x24f80000 end_va = 0x2507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024f80000" filename = "" Region: id = 2223 start_va = 0x25080000 end_va = 0x250bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025080000" filename = "" Region: id = 2224 start_va = 0x250c0000 end_va = 0x251bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000250c0000" filename = "" Region: id = 2225 start_va = 0x251c0000 end_va = 0x251fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000251c0000" filename = "" Region: id = 2226 start_va = 0x25200000 end_va = 0x253fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025200000" filename = "" Region: id = 2227 start_va = 0x25400000 end_va = 0x254fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025400000" filename = "" Region: id = 2228 start_va = 0x25500000 end_va = 0x2553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025500000" filename = "" Region: id = 2229 start_va = 0x25540000 end_va = 0x2563ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025540000" filename = "" Region: id = 2230 start_va = 0x25640000 end_va = 0x2567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025640000" filename = "" Region: id = 2231 start_va = 0x25680000 end_va = 0x2577ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025680000" filename = "" Region: id = 2232 start_va = 0x25780000 end_va = 0x257bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025780000" filename = "" Region: id = 2233 start_va = 0x257c0000 end_va = 0x258bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000257c0000" filename = "" Region: id = 2234 start_va = 0x258c0000 end_va = 0x258fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000258c0000" filename = "" Region: id = 2235 start_va = 0x25900000 end_va = 0x259fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025900000" filename = "" Region: id = 2236 start_va = 0x25a00000 end_va = 0x25a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025a00000" filename = "" Region: id = 2237 start_va = 0x25a40000 end_va = 0x25b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025a40000" filename = "" Region: id = 2238 start_va = 0x25b40000 end_va = 0x25b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025b40000" filename = "" Region: id = 2239 start_va = 0x25b80000 end_va = 0x25c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025b80000" filename = "" Region: id = 2240 start_va = 0x25c80000 end_va = 0x25cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025c80000" filename = "" Region: id = 2241 start_va = 0x25cc0000 end_va = 0x25dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025cc0000" filename = "" Region: id = 2242 start_va = 0x25dc0000 end_va = 0x25dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025dc0000" filename = "" Region: id = 2243 start_va = 0x25e00000 end_va = 0x25efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025e00000" filename = "" Region: id = 2244 start_va = 0x25f00000 end_va = 0x25f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025f00000" filename = "" Region: id = 2245 start_va = 0x25f40000 end_va = 0x2603ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025f40000" filename = "" Region: id = 2246 start_va = 0x26040000 end_va = 0x2607ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026040000" filename = "" Region: id = 2247 start_va = 0x26080000 end_va = 0x2617ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026080000" filename = "" Region: id = 2248 start_va = 0x26180000 end_va = 0x261bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026180000" filename = "" Region: id = 2249 start_va = 0x261c0000 end_va = 0x262bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000261c0000" filename = "" Region: id = 2250 start_va = 0x262c0000 end_va = 0x262fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000262c0000" filename = "" Region: id = 2251 start_va = 0x26300000 end_va = 0x263fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026300000" filename = "" Region: id = 2252 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2253 start_va = 0x12a0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 2254 start_va = 0xb050000 end_va = 0xb14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 2255 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 2256 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 2257 start_va = 0xe090000 end_va = 0xe0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 2258 start_va = 0xe0d0000 end_va = 0xe1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 2259 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 2260 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 2261 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 2262 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 2263 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 2264 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 2265 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 2266 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 2267 start_va = 0xe6d0000 end_va = 0xe70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e6d0000" filename = "" Region: id = 2268 start_va = 0xe710000 end_va = 0xe80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 2269 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 2270 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 2271 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 2272 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 2273 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 2274 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 2275 start_va = 0x23080000 end_va = 0x230bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023080000" filename = "" Region: id = 2276 start_va = 0x230c0000 end_va = 0x231bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000230c0000" filename = "" Region: id = 2277 start_va = 0x231c0000 end_va = 0x231fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000231c0000" filename = "" Region: id = 2278 start_va = 0x23200000 end_va = 0x232fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023200000" filename = "" Region: id = 2279 start_va = 0x23300000 end_va = 0x2333ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023300000" filename = "" Region: id = 2280 start_va = 0x23340000 end_va = 0x2343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023340000" filename = "" Region: id = 2281 start_va = 0x23440000 end_va = 0x2347ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023440000" filename = "" Region: id = 2282 start_va = 0x23480000 end_va = 0x2357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023480000" filename = "" Region: id = 2283 start_va = 0x23580000 end_va = 0x235bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023580000" filename = "" Region: id = 2284 start_va = 0x235c0000 end_va = 0x236bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000235c0000" filename = "" Region: id = 2285 start_va = 0x236c0000 end_va = 0x236fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000236c0000" filename = "" Region: id = 2286 start_va = 0x23700000 end_va = 0x237fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023700000" filename = "" Region: id = 2287 start_va = 0x23800000 end_va = 0x2383ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023800000" filename = "" Region: id = 2288 start_va = 0x23840000 end_va = 0x2393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023840000" filename = "" Region: id = 2289 start_va = 0x23940000 end_va = 0x2397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023940000" filename = "" Region: id = 2290 start_va = 0x23980000 end_va = 0x23a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023980000" filename = "" Region: id = 2291 start_va = 0x23a80000 end_va = 0x23abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a80000" filename = "" Region: id = 2292 start_va = 0x23ac0000 end_va = 0x23bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023ac0000" filename = "" Region: id = 2293 start_va = 0x23bc0000 end_va = 0x23bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023bc0000" filename = "" Region: id = 2294 start_va = 0x23c00000 end_va = 0x23cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023c00000" filename = "" Region: id = 2295 start_va = 0x23d00000 end_va = 0x23d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023d00000" filename = "" Region: id = 2296 start_va = 0x23d40000 end_va = 0x23e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023d40000" filename = "" Region: id = 2297 start_va = 0x23e40000 end_va = 0x23e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e40000" filename = "" Region: id = 2298 start_va = 0x23e80000 end_va = 0x23f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e80000" filename = "" Region: id = 2299 start_va = 0x26400000 end_va = 0x2643ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026400000" filename = "" Region: id = 2300 start_va = 0x26440000 end_va = 0x2653ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026440000" filename = "" Region: id = 2301 start_va = 0x26540000 end_va = 0x2657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026540000" filename = "" Region: id = 2302 start_va = 0x26580000 end_va = 0x2667ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026580000" filename = "" Region: id = 2303 start_va = 0x26680000 end_va = 0x266bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026680000" filename = "" Region: id = 2304 start_va = 0x266c0000 end_va = 0x267bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000266c0000" filename = "" Region: id = 2305 start_va = 0x267c0000 end_va = 0x267fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000267c0000" filename = "" Region: id = 2306 start_va = 0x26800000 end_va = 0x268fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026800000" filename = "" Region: id = 2307 start_va = 0x26900000 end_va = 0x2693ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026900000" filename = "" Region: id = 2308 start_va = 0x26940000 end_va = 0x26a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026940000" filename = "" Region: id = 2309 start_va = 0x26a40000 end_va = 0x26a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026a40000" filename = "" Region: id = 2310 start_va = 0x26a80000 end_va = 0x26b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026a80000" filename = "" Region: id = 2311 start_va = 0x26b80000 end_va = 0x26bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026b80000" filename = "" Region: id = 2312 start_va = 0x26bc0000 end_va = 0x26cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026bc0000" filename = "" Region: id = 2313 start_va = 0x26cc0000 end_va = 0x26cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026cc0000" filename = "" Region: id = 2314 start_va = 0x26d00000 end_va = 0x26dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026d00000" filename = "" Region: id = 2315 start_va = 0x26e00000 end_va = 0x26e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026e00000" filename = "" Region: id = 2316 start_va = 0x26e40000 end_va = 0x26f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026e40000" filename = "" Region: id = 2317 start_va = 0x26f40000 end_va = 0x26f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026f40000" filename = "" Region: id = 2318 start_va = 0x26f80000 end_va = 0x2707ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026f80000" filename = "" Region: id = 2319 start_va = 0x27080000 end_va = 0x270bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027080000" filename = "" Region: id = 2320 start_va = 0x270c0000 end_va = 0x271bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000270c0000" filename = "" Region: id = 2321 start_va = 0x271c0000 end_va = 0x271fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000271c0000" filename = "" Region: id = 2322 start_va = 0x27200000 end_va = 0x272fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027200000" filename = "" Region: id = 2323 start_va = 0x27300000 end_va = 0x2733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027300000" filename = "" Region: id = 2324 start_va = 0x27340000 end_va = 0x2743ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027340000" filename = "" Region: id = 2325 start_va = 0x27440000 end_va = 0x2747ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027440000" filename = "" Region: id = 2326 start_va = 0x27480000 end_va = 0x2757ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027480000" filename = "" Region: id = 2327 start_va = 0x27580000 end_va = 0x275bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027580000" filename = "" Region: id = 2328 start_va = 0x275c0000 end_va = 0x276bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000275c0000" filename = "" Region: id = 2329 start_va = 0x276c0000 end_va = 0x276fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000276c0000" filename = "" Region: id = 2330 start_va = 0x27700000 end_va = 0x277fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027700000" filename = "" Region: id = 2331 start_va = 0x27800000 end_va = 0x2783ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027800000" filename = "" Region: id = 2332 start_va = 0x27840000 end_va = 0x2793ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027840000" filename = "" Region: id = 2333 start_va = 0x27940000 end_va = 0x2797ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027940000" filename = "" Region: id = 2334 start_va = 0x27980000 end_va = 0x27a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027980000" filename = "" Region: id = 2335 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2336 start_va = 0x27a80000 end_va = 0x27abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027a80000" filename = "" Region: id = 2337 start_va = 0x27ac0000 end_va = 0x27bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027ac0000" filename = "" Region: id = 2338 start_va = 0x27bc0000 end_va = 0x27bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027bc0000" filename = "" Region: id = 2339 start_va = 0x27c00000 end_va = 0x27cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027c00000" filename = "" Region: id = 2340 start_va = 0x27d00000 end_va = 0x27d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027d00000" filename = "" Region: id = 2341 start_va = 0x27d40000 end_va = 0x27e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027d40000" filename = "" Region: id = 2342 start_va = 0x27e40000 end_va = 0x27e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027e40000" filename = "" Region: id = 2343 start_va = 0x27e80000 end_va = 0x27f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027e80000" filename = "" Region: id = 2344 start_va = 0x27f80000 end_va = 0x27fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027f80000" filename = "" Region: id = 2345 start_va = 0x27fc0000 end_va = 0x280bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027fc0000" filename = "" Region: id = 2346 start_va = 0x280c0000 end_va = 0x280fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000280c0000" filename = "" Region: id = 2347 start_va = 0x28100000 end_va = 0x281fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028100000" filename = "" Region: id = 2348 start_va = 0x28200000 end_va = 0x2823ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028200000" filename = "" Region: id = 2349 start_va = 0x28240000 end_va = 0x2833ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028240000" filename = "" Region: id = 2350 start_va = 0x28340000 end_va = 0x2837ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028340000" filename = "" Region: id = 2351 start_va = 0x28380000 end_va = 0x2847ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028380000" filename = "" Region: id = 2352 start_va = 0x28480000 end_va = 0x284bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028480000" filename = "" Region: id = 2353 start_va = 0x284c0000 end_va = 0x285bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000284c0000" filename = "" Region: id = 2354 start_va = 0x285c0000 end_va = 0x285fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000285c0000" filename = "" Region: id = 2355 start_va = 0x28600000 end_va = 0x286fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028600000" filename = "" Region: id = 2356 start_va = 0x28700000 end_va = 0x2873ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028700000" filename = "" Region: id = 2357 start_va = 0x28740000 end_va = 0x2883ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028740000" filename = "" Region: id = 2358 start_va = 0x28840000 end_va = 0x2887ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028840000" filename = "" Region: id = 2359 start_va = 0x28880000 end_va = 0x2897ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028880000" filename = "" Region: id = 2360 start_va = 0x28980000 end_va = 0x289bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028980000" filename = "" Region: id = 2361 start_va = 0x289c0000 end_va = 0x28abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000289c0000" filename = "" Region: id = 2362 start_va = 0x28ac0000 end_va = 0x28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028ac0000" filename = "" Region: id = 2363 start_va = 0x28b00000 end_va = 0x28bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028b00000" filename = "" Region: id = 2364 start_va = 0x28c00000 end_va = 0x28c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c00000" filename = "" Region: id = 2365 start_va = 0x28c40000 end_va = 0x28d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c40000" filename = "" Region: id = 2366 start_va = 0x28d40000 end_va = 0x28d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028d40000" filename = "" Region: id = 2367 start_va = 0x28d80000 end_va = 0x28e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028d80000" filename = "" Region: id = 2368 start_va = 0x28e80000 end_va = 0x28ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e80000" filename = "" Region: id = 2369 start_va = 0x28ec0000 end_va = 0x28fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028ec0000" filename = "" Region: id = 2370 start_va = 0x28fc0000 end_va = 0x28ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028fc0000" filename = "" Region: id = 2371 start_va = 0x29000000 end_va = 0x290fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029000000" filename = "" Region: id = 2372 start_va = 0x29100000 end_va = 0x2913ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029100000" filename = "" Region: id = 2373 start_va = 0x29140000 end_va = 0x2923ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029140000" filename = "" Region: id = 2374 start_va = 0x29240000 end_va = 0x2927ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029240000" filename = "" Region: id = 2375 start_va = 0x29280000 end_va = 0x2937ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029280000" filename = "" Region: id = 2376 start_va = 0x29380000 end_va = 0x293bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029380000" filename = "" Region: id = 2377 start_va = 0x293c0000 end_va = 0x294bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000293c0000" filename = "" Region: id = 2378 start_va = 0x294c0000 end_va = 0x294fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000294c0000" filename = "" Region: id = 2379 start_va = 0x29500000 end_va = 0x295fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029500000" filename = "" Region: id = 2380 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2381 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2382 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2383 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2384 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2385 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2386 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2387 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2388 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 2389 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2390 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 2391 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 2392 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2393 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2394 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 2395 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 2396 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 2397 start_va = 0x12a0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 2398 start_va = 0x12e0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 2399 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 2400 start_va = 0xb050000 end_va = 0xb14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 2401 start_va = 0xb150000 end_va = 0xb24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 2402 start_va = 0xb250000 end_va = 0xb28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 2403 start_va = 0xb290000 end_va = 0xb38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 2404 start_va = 0xb390000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 2405 start_va = 0xb3d0000 end_va = 0xb4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 2406 start_va = 0xb4d0000 end_va = 0xb50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 2407 start_va = 0xb510000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 2408 start_va = 0xb610000 end_va = 0xb64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b610000" filename = "" Region: id = 2409 start_va = 0xb650000 end_va = 0xb74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b650000" filename = "" Region: id = 2410 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 2411 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 2412 start_va = 0xb890000 end_va = 0xb8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b890000" filename = "" Region: id = 2413 start_va = 0xb8d0000 end_va = 0xb9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b8d0000" filename = "" Region: id = 2414 start_va = 0xb9d0000 end_va = 0xba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b9d0000" filename = "" Region: id = 2415 start_va = 0xba10000 end_va = 0xbb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ba10000" filename = "" Region: id = 2416 start_va = 0xbb10000 end_va = 0xbb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb10000" filename = "" Region: id = 2417 start_va = 0xbb50000 end_va = 0xbc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb50000" filename = "" Region: id = 2418 start_va = 0xbc50000 end_va = 0xbc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc50000" filename = "" Region: id = 2419 start_va = 0xbc90000 end_va = 0xbd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc90000" filename = "" Region: id = 2420 start_va = 0xbd90000 end_va = 0xbdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd90000" filename = "" Region: id = 2421 start_va = 0xbdd0000 end_va = 0xbecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bdd0000" filename = "" Region: id = 2422 start_va = 0xbed0000 end_va = 0xbf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bed0000" filename = "" Region: id = 2423 start_va = 0xbf10000 end_va = 0xc00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bf10000" filename = "" Region: id = 2424 start_va = 0xc010000 end_va = 0xc04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c010000" filename = "" Region: id = 2425 start_va = 0xc050000 end_va = 0xc14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c050000" filename = "" Region: id = 2426 start_va = 0xc150000 end_va = 0xc18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 2427 start_va = 0xc190000 end_va = 0xc28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c190000" filename = "" Region: id = 2428 start_va = 0xc290000 end_va = 0xc2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c290000" filename = "" Region: id = 2429 start_va = 0xc2d0000 end_va = 0xc3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c2d0000" filename = "" Region: id = 2430 start_va = 0xc3d0000 end_va = 0xc40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 2431 start_va = 0xc410000 end_va = 0xc50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 2432 start_va = 0xc510000 end_va = 0xc54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 2433 start_va = 0xc550000 end_va = 0xc64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c550000" filename = "" Region: id = 2434 start_va = 0xc650000 end_va = 0xc68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 2435 start_va = 0xc690000 end_va = 0xc78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 2436 start_va = 0xc790000 end_va = 0xc7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c790000" filename = "" Region: id = 2437 start_va = 0xc7d0000 end_va = 0xc8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c7d0000" filename = "" Region: id = 2438 start_va = 0xc8d0000 end_va = 0xc90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c8d0000" filename = "" Region: id = 2439 start_va = 0xc910000 end_va = 0xca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c910000" filename = "" Region: id = 2440 start_va = 0xca10000 end_va = 0xca4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca10000" filename = "" Region: id = 2441 start_va = 0xca50000 end_va = 0xcb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 2442 start_va = 0xcb50000 end_va = 0xcb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 2443 start_va = 0xcb90000 end_va = 0xcc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 2444 start_va = 0xcc90000 end_va = 0xcccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cc90000" filename = "" Region: id = 2445 start_va = 0xccd0000 end_va = 0xcdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ccd0000" filename = "" Region: id = 2446 start_va = 0xcdd0000 end_va = 0xce0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 2447 start_va = 0xce10000 end_va = 0xcf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 2448 start_va = 0xcf10000 end_va = 0xcf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 2449 start_va = 0xcf50000 end_va = 0xd04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 2450 start_va = 0xd050000 end_va = 0xd08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 2451 start_va = 0xd090000 end_va = 0xd18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 2452 start_va = 0xd190000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 2453 start_va = 0xd1d0000 end_va = 0xd2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 2454 start_va = 0xd2d0000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 2455 start_va = 0xd310000 end_va = 0xd40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 2456 start_va = 0xd410000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 2457 start_va = 0xd450000 end_va = 0xd54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 2458 start_va = 0xd550000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 2459 start_va = 0xd590000 end_va = 0xd68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 2460 start_va = 0xd690000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 2461 start_va = 0xd6d0000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 2462 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 2463 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 2464 start_va = 0xd910000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 2465 start_va = 0xd950000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 2466 start_va = 0xda50000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 2467 start_va = 0xda90000 end_va = 0xdb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 2468 start_va = 0xdb90000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 2469 start_va = 0xdbd0000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 2470 start_va = 0xdcd0000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dcd0000" filename = "" Region: id = 2471 start_va = 0xdd10000 end_va = 0xde0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 2472 start_va = 0xde10000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 2473 start_va = 0xde50000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 2474 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 2475 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 2476 start_va = 0xe090000 end_va = 0xe0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 2477 start_va = 0xe0d0000 end_va = 0xe1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 2478 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 2479 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 2480 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 2481 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 2482 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 2483 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 2484 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 2485 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 2486 start_va = 0xe6d0000 end_va = 0xe70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e6d0000" filename = "" Region: id = 2487 start_va = 0xe710000 end_va = 0xe80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 2488 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 2489 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 2490 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 2491 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 2492 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 2493 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 2494 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 2495 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 2496 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 2497 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 2498 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 2499 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 2500 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 2501 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 2502 start_va = 0xf0d0000 end_va = 0xf10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f0d0000" filename = "" Region: id = 2503 start_va = 0xf110000 end_va = 0xf20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f110000" filename = "" Region: id = 2504 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 2505 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 2506 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 2507 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 2508 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 2509 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 2510 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 2511 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 2512 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 2513 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 2514 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 2515 start_va = 0xf890000 end_va = 0xf98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 2516 start_va = 0xfbd0000 end_va = 0xfc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fbd0000" filename = "" Region: id = 2517 start_va = 0xfc10000 end_va = 0xfd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fc10000" filename = "" Region: id = 2518 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2519 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2520 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2521 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 2522 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 2523 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2524 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2525 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 2526 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 2527 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 2528 start_va = 0x12a0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 2529 start_va = 0x12e0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 2530 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 2531 start_va = 0xb050000 end_va = 0xb14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 2532 start_va = 0xb150000 end_va = 0xb24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 2533 start_va = 0xb250000 end_va = 0xb28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 2534 start_va = 0xb290000 end_va = 0xb38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 2535 start_va = 0xb390000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 2536 start_va = 0xb3d0000 end_va = 0xb4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 2537 start_va = 0xb4d0000 end_va = 0xb50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 2538 start_va = 0xb510000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 2539 start_va = 0xb610000 end_va = 0xb64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b610000" filename = "" Region: id = 2540 start_va = 0xb650000 end_va = 0xb74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b650000" filename = "" Region: id = 2541 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 2542 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 2543 start_va = 0xb890000 end_va = 0xb8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b890000" filename = "" Region: id = 2544 start_va = 0xb8d0000 end_va = 0xb9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b8d0000" filename = "" Region: id = 2545 start_va = 0xb9d0000 end_va = 0xba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b9d0000" filename = "" Region: id = 2546 start_va = 0xba10000 end_va = 0xbb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ba10000" filename = "" Region: id = 2547 start_va = 0xbb10000 end_va = 0xbb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb10000" filename = "" Region: id = 2548 start_va = 0xbb50000 end_va = 0xbc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb50000" filename = "" Region: id = 2549 start_va = 0xbc50000 end_va = 0xbc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc50000" filename = "" Region: id = 2550 start_va = 0xbc90000 end_va = 0xbd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc90000" filename = "" Region: id = 2551 start_va = 0xbd90000 end_va = 0xbdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd90000" filename = "" Region: id = 2552 start_va = 0xbdd0000 end_va = 0xbecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bdd0000" filename = "" Region: id = 2553 start_va = 0xbed0000 end_va = 0xbf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bed0000" filename = "" Region: id = 2554 start_va = 0xbf10000 end_va = 0xc00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bf10000" filename = "" Region: id = 2555 start_va = 0xc010000 end_va = 0xc04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c010000" filename = "" Region: id = 2556 start_va = 0xc050000 end_va = 0xc14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c050000" filename = "" Region: id = 2557 start_va = 0xc150000 end_va = 0xc18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 2558 start_va = 0xc190000 end_va = 0xc28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c190000" filename = "" Region: id = 2559 start_va = 0xc290000 end_va = 0xc2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c290000" filename = "" Region: id = 2560 start_va = 0xc2d0000 end_va = 0xc3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c2d0000" filename = "" Region: id = 2561 start_va = 0xc3d0000 end_va = 0xc40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 2562 start_va = 0xc410000 end_va = 0xc50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 2563 start_va = 0xc510000 end_va = 0xc54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 2564 start_va = 0xc550000 end_va = 0xc64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c550000" filename = "" Region: id = 2565 start_va = 0xc650000 end_va = 0xc68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 2566 start_va = 0xc690000 end_va = 0xc78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 2567 start_va = 0xc790000 end_va = 0xc7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c790000" filename = "" Region: id = 2568 start_va = 0xc7d0000 end_va = 0xc8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c7d0000" filename = "" Region: id = 2569 start_va = 0xc8d0000 end_va = 0xc90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c8d0000" filename = "" Region: id = 2570 start_va = 0xc910000 end_va = 0xca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c910000" filename = "" Region: id = 2571 start_va = 0xca10000 end_va = 0xca4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca10000" filename = "" Region: id = 2572 start_va = 0xca50000 end_va = 0xcb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 2573 start_va = 0xcb50000 end_va = 0xcb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 2574 start_va = 0xcb90000 end_va = 0xcc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 2575 start_va = 0xcc90000 end_va = 0xcccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cc90000" filename = "" Region: id = 2576 start_va = 0xccd0000 end_va = 0xcdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ccd0000" filename = "" Region: id = 2577 start_va = 0xcdd0000 end_va = 0xce0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 2578 start_va = 0xce10000 end_va = 0xcf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 2579 start_va = 0xcf10000 end_va = 0xcf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 2580 start_va = 0xcf50000 end_va = 0xd04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 2581 start_va = 0xd050000 end_va = 0xd08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 2582 start_va = 0xd090000 end_va = 0xd18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 2583 start_va = 0xd190000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 2584 start_va = 0xd1d0000 end_va = 0xd2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 2585 start_va = 0xd2d0000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 2586 start_va = 0xd310000 end_va = 0xd40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 2587 start_va = 0xd410000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 2588 start_va = 0xd450000 end_va = 0xd54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 2589 start_va = 0xd550000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 2590 start_va = 0xd590000 end_va = 0xd68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 2591 start_va = 0xd690000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 2592 start_va = 0xd6d0000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 2593 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 2594 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 2595 start_va = 0xd910000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 2596 start_va = 0xd950000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 2597 start_va = 0xda50000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 2598 start_va = 0xda90000 end_va = 0xdb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 2599 start_va = 0xdb90000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 2600 start_va = 0xdbd0000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 2601 start_va = 0xdcd0000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dcd0000" filename = "" Region: id = 2602 start_va = 0xdd10000 end_va = 0xde0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 2603 start_va = 0xde10000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 2604 start_va = 0xde50000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 2605 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 2606 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 2607 start_va = 0xe090000 end_va = 0xe0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 2608 start_va = 0xe0d0000 end_va = 0xe1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 2609 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 2610 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 2611 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 2612 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 2613 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 2614 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 2615 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 2616 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 2617 start_va = 0xe6d0000 end_va = 0xe70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e6d0000" filename = "" Region: id = 2618 start_va = 0xe710000 end_va = 0xe80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 2619 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 2620 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 2621 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 2622 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 2623 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 2624 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 2625 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 2626 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 2627 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 2628 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 2629 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 2630 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 2631 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 2632 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 2633 start_va = 0xf0d0000 end_va = 0xf10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f0d0000" filename = "" Region: id = 2634 start_va = 0xf110000 end_va = 0xf20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f110000" filename = "" Region: id = 2635 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 2636 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 2637 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 2638 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 2639 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 2640 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 2641 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 2642 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 2643 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 2644 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 2645 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 2646 start_va = 0xf890000 end_va = 0xf98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 2647 start_va = 0xfbd0000 end_va = 0xfc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fbd0000" filename = "" Region: id = 2648 start_va = 0xfc10000 end_va = 0xfd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fc10000" filename = "" Region: id = 2649 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 2650 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 2651 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 2652 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 2653 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 2654 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 2655 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 2656 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 2657 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 2658 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 2659 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 2660 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 2661 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 2662 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 2663 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2664 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2665 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2666 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2667 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2668 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2669 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2670 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2671 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2672 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2673 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2674 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2675 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2676 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2677 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2678 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2679 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2680 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2681 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 2682 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 2683 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 2684 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 2685 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 2686 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 2687 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 2688 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 2689 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 2690 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 2691 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 2692 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 2693 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 2694 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 2695 start_va = 0x10850000 end_va = 0x1088ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010850000" filename = "" Region: id = 2696 start_va = 0x10890000 end_va = 0x1098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010890000" filename = "" Region: id = 2697 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 2698 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 2699 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 2700 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 2701 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 2702 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 2703 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 2704 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 2705 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 2706 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 2707 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 2708 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 2709 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 2710 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 2711 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2712 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2713 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2714 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2715 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2716 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2717 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2718 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2719 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2720 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2721 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2722 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2723 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2724 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2725 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2726 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2727 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2728 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2729 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 2730 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 2731 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 2732 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 2733 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 2734 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 2735 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 2736 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 2737 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 2738 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 2739 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 2740 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 2741 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 2742 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 2743 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 2744 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 2745 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2746 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2747 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2748 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2749 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2750 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2751 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2752 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2753 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2754 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2755 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2756 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2757 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2758 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2759 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2760 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2761 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2762 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2763 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2764 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2765 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2766 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2767 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2768 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2769 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2770 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2771 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2772 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2773 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2774 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2775 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2776 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2777 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2778 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2779 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 2780 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 2781 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 2782 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 2783 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 2784 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 2785 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 2786 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 2787 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 2788 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 2789 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 2790 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 2791 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 2792 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 2793 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 2794 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 2795 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 2796 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 2797 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 2798 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 2799 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 2800 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 2801 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 2802 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 2803 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 2804 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 2805 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 2806 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 2807 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 2808 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 2809 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 2810 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 2811 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 2812 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 2813 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 2814 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 2815 start_va = 0x114d0000 end_va = 0x1150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000114d0000" filename = "" Region: id = 2816 start_va = 0x11510000 end_va = 0x1160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011510000" filename = "" Region: id = 2817 start_va = 0x11610000 end_va = 0x1164ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011610000" filename = "" Region: id = 2818 start_va = 0x11650000 end_va = 0x1174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011650000" filename = "" Region: id = 2819 start_va = 0x11750000 end_va = 0x1178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011750000" filename = "" Region: id = 2820 start_va = 0x11790000 end_va = 0x1188ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011790000" filename = "" Region: id = 2821 start_va = 0x11890000 end_va = 0x118cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011890000" filename = "" Region: id = 2822 start_va = 0x118d0000 end_va = 0x119cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000118d0000" filename = "" Region: id = 2823 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2824 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2825 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2826 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2827 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2828 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2829 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 2830 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2831 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2832 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2833 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 2834 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 2835 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 2836 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 2837 start_va = 0x119d0000 end_va = 0x11a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000119d0000" filename = "" Region: id = 2838 start_va = 0x11a10000 end_va = 0x11b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011a10000" filename = "" Region: id = 2839 start_va = 0x11b10000 end_va = 0x11b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b10000" filename = "" Region: id = 2840 start_va = 0x11b50000 end_va = 0x11c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b50000" filename = "" Region: id = 2841 start_va = 0x11c50000 end_va = 0x11c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 2842 start_va = 0x11c90000 end_va = 0x11d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c90000" filename = "" Region: id = 2843 start_va = 0x11d90000 end_va = 0x11dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011d90000" filename = "" Region: id = 2844 start_va = 0x11dd0000 end_va = 0x11ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011dd0000" filename = "" Region: id = 2845 start_va = 0x11ed0000 end_va = 0x11f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ed0000" filename = "" Region: id = 2846 start_va = 0x11f10000 end_va = 0x1200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f10000" filename = "" Region: id = 2847 start_va = 0x12010000 end_va = 0x1204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012010000" filename = "" Region: id = 2848 start_va = 0x12050000 end_va = 0x1214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012050000" filename = "" Region: id = 2849 start_va = 0x12150000 end_va = 0x1218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012150000" filename = "" Region: id = 2850 start_va = 0x12190000 end_va = 0x1228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012190000" filename = "" Region: id = 2851 start_va = 0x12290000 end_va = 0x122cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012290000" filename = "" Region: id = 2852 start_va = 0x122d0000 end_va = 0x123cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000122d0000" filename = "" Region: id = 2853 start_va = 0x123d0000 end_va = 0x1240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000123d0000" filename = "" Region: id = 2854 start_va = 0x12410000 end_va = 0x1250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012410000" filename = "" Region: id = 2855 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2856 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2857 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2858 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2859 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2860 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2861 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2862 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2863 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2864 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2865 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2866 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2867 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2868 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2869 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2870 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2871 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2872 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2873 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2874 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2875 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2876 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2877 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2878 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2879 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2880 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2881 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2882 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2883 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2884 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2885 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2886 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2887 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2888 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2889 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2890 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2891 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2892 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2893 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 2894 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 2895 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2896 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2897 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2898 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2899 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2900 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2901 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2902 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2903 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2904 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2905 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2906 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 2907 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2908 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2909 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2910 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 2911 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 2912 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 2913 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 2914 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 2915 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 2916 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 2917 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 2918 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 2919 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 2920 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 2921 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 2922 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 2923 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 2924 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 2925 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 2926 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 2927 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 2928 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 2929 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 2930 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 2931 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 2932 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 2933 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 2934 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 2935 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 2936 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 2937 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 2938 start_va = 0x114d0000 end_va = 0x1150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000114d0000" filename = "" Region: id = 2939 start_va = 0x11510000 end_va = 0x1160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011510000" filename = "" Region: id = 2940 start_va = 0x11750000 end_va = 0x1178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011750000" filename = "" Region: id = 2941 start_va = 0x11790000 end_va = 0x1188ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011790000" filename = "" Region: id = 2942 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2943 start_va = 0x11890000 end_va = 0x118cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011890000" filename = "" Region: id = 2944 start_va = 0x118d0000 end_va = 0x119cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000118d0000" filename = "" Region: id = 2945 start_va = 0x12510000 end_va = 0x1254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012510000" filename = "" Region: id = 2946 start_va = 0x12550000 end_va = 0x1264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012550000" filename = "" Region: id = 2947 start_va = 0x12650000 end_va = 0x1268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012650000" filename = "" Region: id = 2948 start_va = 0x12690000 end_va = 0x1278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012690000" filename = "" Region: id = 2949 start_va = 0x12790000 end_va = 0x127cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012790000" filename = "" Region: id = 2950 start_va = 0x127d0000 end_va = 0x128cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000127d0000" filename = "" Region: id = 2951 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2952 start_va = 0x128d0000 end_va = 0x1290ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000128d0000" filename = "" Region: id = 2953 start_va = 0x12910000 end_va = 0x12a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012910000" filename = "" Region: id = 2954 start_va = 0x12a10000 end_va = 0x12a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a10000" filename = "" Region: id = 2955 start_va = 0x12a50000 end_va = 0x12b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a50000" filename = "" Region: id = 2956 start_va = 0x12b50000 end_va = 0x12b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b50000" filename = "" Region: id = 2957 start_va = 0x12b90000 end_va = 0x12c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b90000" filename = "" Region: id = 2958 start_va = 0x12c90000 end_va = 0x12ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012c90000" filename = "" Region: id = 2959 start_va = 0x12cd0000 end_va = 0x12dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012cd0000" filename = "" Region: id = 2960 start_va = 0x12dd0000 end_va = 0x12e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012dd0000" filename = "" Region: id = 2961 start_va = 0x12e10000 end_va = 0x12f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012e10000" filename = "" Region: id = 2962 start_va = 0x12f10000 end_va = 0x12f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f10000" filename = "" Region: id = 2963 start_va = 0x12f50000 end_va = 0x1304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f50000" filename = "" Region: id = 2964 start_va = 0x13050000 end_va = 0x1308ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013050000" filename = "" Region: id = 2965 start_va = 0x13090000 end_va = 0x1318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013090000" filename = "" Region: id = 2966 start_va = 0x13190000 end_va = 0x131cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013190000" filename = "" Region: id = 2967 start_va = 0x131d0000 end_va = 0x132cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000131d0000" filename = "" Region: id = 2968 start_va = 0x132d0000 end_va = 0x1330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000132d0000" filename = "" Region: id = 2969 start_va = 0x13310000 end_va = 0x1340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013310000" filename = "" Region: id = 2970 start_va = 0x13410000 end_va = 0x1344ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013410000" filename = "" Region: id = 2971 start_va = 0x13450000 end_va = 0x1354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013450000" filename = "" Region: id = 2972 start_va = 0x13550000 end_va = 0x1358ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013550000" filename = "" Region: id = 2973 start_va = 0x13590000 end_va = 0x1368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013590000" filename = "" Region: id = 2974 start_va = 0x13690000 end_va = 0x136cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013690000" filename = "" Region: id = 2975 start_va = 0x136d0000 end_va = 0x137cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000136d0000" filename = "" Region: id = 2976 start_va = 0x137d0000 end_va = 0x1380ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000137d0000" filename = "" Region: id = 2977 start_va = 0x13810000 end_va = 0x1390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013810000" filename = "" Region: id = 2978 start_va = 0x13910000 end_va = 0x1394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013910000" filename = "" Region: id = 2979 start_va = 0x13950000 end_va = 0x13a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013950000" filename = "" Region: id = 2980 start_va = 0x13a50000 end_va = 0x13a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a50000" filename = "" Region: id = 2981 start_va = 0x13a90000 end_va = 0x13b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a90000" filename = "" Region: id = 2982 start_va = 0x13b90000 end_va = 0x13bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013b90000" filename = "" Region: id = 2983 start_va = 0x13bd0000 end_va = 0x13ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013bd0000" filename = "" Region: id = 2984 start_va = 0x13cd0000 end_va = 0x13d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013cd0000" filename = "" Region: id = 2985 start_va = 0x13d10000 end_va = 0x13e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013d10000" filename = "" Region: id = 2986 start_va = 0x13e10000 end_va = 0x13e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e10000" filename = "" Region: id = 2987 start_va = 0x13e50000 end_va = 0x13f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e50000" filename = "" Region: id = 2988 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2989 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2990 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2991 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2992 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2993 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2994 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2995 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2996 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2997 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2998 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2999 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3000 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3001 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3002 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3003 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3004 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3005 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3006 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3007 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3008 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 3009 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 3010 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 3011 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 3012 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 3013 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 3014 start_va = 0x10850000 end_va = 0x1088ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010850000" filename = "" Region: id = 3015 start_va = 0x10890000 end_va = 0x1098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010890000" filename = "" Region: id = 3016 start_va = 0x11b10000 end_va = 0x11b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b10000" filename = "" Region: id = 3017 start_va = 0x11b50000 end_va = 0x11c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b50000" filename = "" Region: id = 3018 start_va = 0x11c50000 end_va = 0x11c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 3019 start_va = 0x11c90000 end_va = 0x11d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c90000" filename = "" Region: id = 3020 start_va = 0x11d90000 end_va = 0x11dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011d90000" filename = "" Region: id = 3021 start_va = 0x11dd0000 end_va = 0x11ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011dd0000" filename = "" Region: id = 3022 start_va = 0x11ed0000 end_va = 0x11f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ed0000" filename = "" Region: id = 3023 start_va = 0x11f10000 end_va = 0x1200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f10000" filename = "" Region: id = 3024 start_va = 0x12010000 end_va = 0x1204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012010000" filename = "" Region: id = 3025 start_va = 0x12050000 end_va = 0x1214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012050000" filename = "" Region: id = 3026 start_va = 0x12150000 end_va = 0x1218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012150000" filename = "" Region: id = 3027 start_va = 0x12190000 end_va = 0x1228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012190000" filename = "" Region: id = 3028 start_va = 0x12290000 end_va = 0x122cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012290000" filename = "" Region: id = 3029 start_va = 0x122d0000 end_va = 0x123cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000122d0000" filename = "" Region: id = 3030 start_va = 0x123d0000 end_va = 0x1240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000123d0000" filename = "" Region: id = 3031 start_va = 0x12410000 end_va = 0x1250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012410000" filename = "" Region: id = 3032 start_va = 0x13f50000 end_va = 0x13f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013f50000" filename = "" Region: id = 3033 start_va = 0x13f90000 end_va = 0x1408ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013f90000" filename = "" Region: id = 3034 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 3035 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 3036 start_va = 0x141d0000 end_va = 0x1420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000141d0000" filename = "" Region: id = 3037 start_va = 0x14210000 end_va = 0x1430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014210000" filename = "" Region: id = 3038 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 3039 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 3040 start_va = 0x14450000 end_va = 0x1448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014450000" filename = "" Region: id = 3041 start_va = 0x14490000 end_va = 0x1458ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014490000" filename = "" Region: id = 3042 start_va = 0x14590000 end_va = 0x145cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014590000" filename = "" Region: id = 3043 start_va = 0x145d0000 end_va = 0x146cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145d0000" filename = "" Region: id = 3044 start_va = 0x146d0000 end_va = 0x1470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000146d0000" filename = "" Region: id = 3045 start_va = 0x14710000 end_va = 0x1480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 3046 start_va = 0x14810000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014810000" filename = "" Region: id = 3047 start_va = 0x14850000 end_va = 0x1494ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014850000" filename = "" Region: id = 3048 start_va = 0x14950000 end_va = 0x1498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014950000" filename = "" Region: id = 3049 start_va = 0x14990000 end_va = 0x14a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014990000" filename = "" Region: id = 3050 start_va = 0x14a90000 end_va = 0x14acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014a90000" filename = "" Region: id = 3051 start_va = 0x14ad0000 end_va = 0x14bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014ad0000" filename = "" Region: id = 3052 start_va = 0x14bd0000 end_va = 0x14c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014bd0000" filename = "" Region: id = 3053 start_va = 0x14c10000 end_va = 0x14d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c10000" filename = "" Region: id = 3054 start_va = 0x14d10000 end_va = 0x14d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d10000" filename = "" Region: id = 3055 start_va = 0x14d50000 end_va = 0x14e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d50000" filename = "" Region: id = 3056 start_va = 0x14e50000 end_va = 0x14e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e50000" filename = "" Region: id = 3057 start_va = 0x14e90000 end_va = 0x14f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e90000" filename = "" Region: id = 3058 start_va = 0x14f90000 end_va = 0x14fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f90000" filename = "" Region: id = 3059 start_va = 0x14fd0000 end_va = 0x150cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014fd0000" filename = "" Region: id = 3060 start_va = 0x150d0000 end_va = 0x1510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000150d0000" filename = "" Region: id = 3061 start_va = 0x15110000 end_va = 0x1520ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015110000" filename = "" Region: id = 3062 start_va = 0x15210000 end_va = 0x1524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015210000" filename = "" Region: id = 3063 start_va = 0x15250000 end_va = 0x1534ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015250000" filename = "" Region: id = 3064 start_va = 0x15350000 end_va = 0x1538ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015350000" filename = "" Region: id = 3065 start_va = 0x15390000 end_va = 0x1548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015390000" filename = "" Region: id = 3066 start_va = 0x15490000 end_va = 0x154cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015490000" filename = "" Region: id = 3067 start_va = 0x154d0000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000154d0000" filename = "" Region: id = 3068 start_va = 0x155d0000 end_va = 0x1560ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000155d0000" filename = "" Region: id = 3069 start_va = 0x15610000 end_va = 0x1570ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015610000" filename = "" Region: id = 3070 start_va = 0x15710000 end_va = 0x1574ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 3071 start_va = 0x15750000 end_va = 0x1584ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015750000" filename = "" Region: id = 3072 start_va = 0x15850000 end_va = 0x1588ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015850000" filename = "" Region: id = 3073 start_va = 0x15890000 end_va = 0x1598ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015890000" filename = "" Region: id = 3074 start_va = 0x15990000 end_va = 0x159cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015990000" filename = "" Region: id = 3075 start_va = 0x159d0000 end_va = 0x15acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000159d0000" filename = "" Region: id = 3076 start_va = 0x15ad0000 end_va = 0x15b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ad0000" filename = "" Region: id = 3077 start_va = 0x15b10000 end_va = 0x15c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b10000" filename = "" Region: id = 3078 start_va = 0x15c10000 end_va = 0x15c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c10000" filename = "" Region: id = 3079 start_va = 0x15c50000 end_va = 0x15d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c50000" filename = "" Region: id = 3080 start_va = 0x15d50000 end_va = 0x15d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d50000" filename = "" Region: id = 3081 start_va = 0x15d90000 end_va = 0x15e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d90000" filename = "" Region: id = 3082 start_va = 0x15e90000 end_va = 0x15ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e90000" filename = "" Region: id = 3083 start_va = 0x15ed0000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015ed0000" filename = "" Region: id = 3084 start_va = 0x15fd0000 end_va = 0x1600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015fd0000" filename = "" Region: id = 3085 start_va = 0x16010000 end_va = 0x1610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016010000" filename = "" Region: id = 3086 start_va = 0x16110000 end_va = 0x1614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 3087 start_va = 0x16150000 end_va = 0x1624ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016150000" filename = "" Region: id = 3088 start_va = 0x16250000 end_va = 0x1628ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016250000" filename = "" Region: id = 3089 start_va = 0x16290000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016290000" filename = "" Region: id = 3090 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3091 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3092 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3093 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3094 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3095 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3096 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3097 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3098 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3099 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3100 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3101 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3102 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3103 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3104 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3105 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3106 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3107 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3108 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3109 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3110 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3111 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3112 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3113 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3114 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3115 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3116 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3117 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3118 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3119 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3120 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3121 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3122 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3123 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3124 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3125 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3126 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3127 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3128 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3129 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3130 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3131 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3132 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3133 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3134 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3135 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3136 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3137 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3138 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3139 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3140 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3141 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3142 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3143 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3144 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3145 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3146 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3147 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3148 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3149 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3150 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3151 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3152 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3153 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3154 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3155 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3156 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3157 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3158 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3159 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3160 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3161 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3162 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3163 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3164 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3165 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3166 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3167 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3168 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 3169 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3170 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 3171 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 3172 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 3173 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 3174 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 3175 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 3176 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 3177 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 3178 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 3179 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 3180 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 3181 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 3182 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 3183 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 3184 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 3185 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 3186 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 3187 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 3188 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 3189 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 3190 start_va = 0x11750000 end_va = 0x1178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011750000" filename = "" Region: id = 3191 start_va = 0x11790000 end_va = 0x1188ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011790000" filename = "" Region: id = 3192 start_va = 0x11890000 end_va = 0x118cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011890000" filename = "" Region: id = 3193 start_va = 0x118d0000 end_va = 0x119cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000118d0000" filename = "" Region: id = 3194 start_va = 0x119d0000 end_va = 0x11a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000119d0000" filename = "" Region: id = 3195 start_va = 0x11a10000 end_va = 0x11b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011a10000" filename = "" Region: id = 3196 start_va = 0x12510000 end_va = 0x1254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012510000" filename = "" Region: id = 3197 start_va = 0x12550000 end_va = 0x1264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012550000" filename = "" Region: id = 3198 start_va = 0x12650000 end_va = 0x1268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012650000" filename = "" Region: id = 3199 start_va = 0x12690000 end_va = 0x1278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012690000" filename = "" Region: id = 3200 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3201 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3202 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3203 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3204 start_va = 0x12790000 end_va = 0x127cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012790000" filename = "" Region: id = 3205 start_va = 0x127d0000 end_va = 0x128cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000127d0000" filename = "" Region: id = 3206 start_va = 0x128d0000 end_va = 0x1290ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000128d0000" filename = "" Region: id = 3207 start_va = 0x12910000 end_va = 0x12a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012910000" filename = "" Region: id = 3208 start_va = 0x12a10000 end_va = 0x12a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a10000" filename = "" Region: id = 3209 start_va = 0x12a50000 end_va = 0x12b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a50000" filename = "" Region: id = 3210 start_va = 0x12b50000 end_va = 0x12b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b50000" filename = "" Region: id = 3211 start_va = 0x12b90000 end_va = 0x12c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b90000" filename = "" Region: id = 3212 start_va = 0x12c90000 end_va = 0x12ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012c90000" filename = "" Region: id = 3213 start_va = 0x12cd0000 end_va = 0x12dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012cd0000" filename = "" Region: id = 3214 start_va = 0x12dd0000 end_va = 0x12e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012dd0000" filename = "" Region: id = 3215 start_va = 0x12e10000 end_va = 0x12f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012e10000" filename = "" Region: id = 3216 start_va = 0x12f10000 end_va = 0x12f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f10000" filename = "" Region: id = 3217 start_va = 0x12f50000 end_va = 0x1304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f50000" filename = "" Region: id = 3218 start_va = 0x13050000 end_va = 0x1308ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013050000" filename = "" Region: id = 3219 start_va = 0x13090000 end_va = 0x1318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013090000" filename = "" Region: id = 3220 start_va = 0x13190000 end_va = 0x131cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013190000" filename = "" Region: id = 3221 start_va = 0x131d0000 end_va = 0x132cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000131d0000" filename = "" Region: id = 3222 start_va = 0x132d0000 end_va = 0x1330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000132d0000" filename = "" Region: id = 3223 start_va = 0x13310000 end_va = 0x1340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013310000" filename = "" Region: id = 3224 start_va = 0x13410000 end_va = 0x1344ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013410000" filename = "" Region: id = 3225 start_va = 0x13450000 end_va = 0x1354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013450000" filename = "" Region: id = 3226 start_va = 0x13550000 end_va = 0x1358ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013550000" filename = "" Region: id = 3227 start_va = 0x13590000 end_va = 0x1368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013590000" filename = "" Region: id = 3228 start_va = 0x13690000 end_va = 0x136cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013690000" filename = "" Region: id = 3229 start_va = 0x136d0000 end_va = 0x137cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000136d0000" filename = "" Region: id = 3230 start_va = 0x137d0000 end_va = 0x1380ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000137d0000" filename = "" Region: id = 3231 start_va = 0x13810000 end_va = 0x1390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013810000" filename = "" Region: id = 3232 start_va = 0x13910000 end_va = 0x1394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013910000" filename = "" Region: id = 3233 start_va = 0x13950000 end_va = 0x13a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013950000" filename = "" Region: id = 3234 start_va = 0x13a50000 end_va = 0x13a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a50000" filename = "" Region: id = 3235 start_va = 0x13a90000 end_va = 0x13b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a90000" filename = "" Region: id = 3236 start_va = 0x13b90000 end_va = 0x13bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013b90000" filename = "" Region: id = 3237 start_va = 0x13bd0000 end_va = 0x13ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013bd0000" filename = "" Region: id = 3238 start_va = 0x13e10000 end_va = 0x13e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e10000" filename = "" Region: id = 3239 start_va = 0x13e50000 end_va = 0x13f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e50000" filename = "" Region: id = 3240 start_va = 0x16390000 end_va = 0x163cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016390000" filename = "" Region: id = 3241 start_va = 0x163d0000 end_va = 0x164cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000163d0000" filename = "" Region: id = 3242 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3243 start_va = 0x164d0000 end_va = 0x1650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 3244 start_va = 0x16510000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016510000" filename = "" Region: id = 3245 start_va = 0x16610000 end_va = 0x1664ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016610000" filename = "" Region: id = 3246 start_va = 0x16650000 end_va = 0x1674ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016650000" filename = "" Region: id = 3247 start_va = 0x16750000 end_va = 0x1678ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016750000" filename = "" Region: id = 3248 start_va = 0x16790000 end_va = 0x1688ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016790000" filename = "" Region: id = 3249 start_va = 0x16890000 end_va = 0x168cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016890000" filename = "" Region: id = 3250 start_va = 0x168d0000 end_va = 0x169cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000168d0000" filename = "" Region: id = 3251 start_va = 0x169d0000 end_va = 0x16a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000169d0000" filename = "" Region: id = 3252 start_va = 0x16a10000 end_va = 0x16b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016a10000" filename = "" Region: id = 3253 start_va = 0x16b10000 end_va = 0x16b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b10000" filename = "" Region: id = 3254 start_va = 0x16b50000 end_va = 0x16c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016b50000" filename = "" Region: id = 3255 start_va = 0x16c50000 end_va = 0x16c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c50000" filename = "" Region: id = 3256 start_va = 0x16c90000 end_va = 0x16d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016c90000" filename = "" Region: id = 3257 start_va = 0x16d90000 end_va = 0x16dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016d90000" filename = "" Region: id = 3258 start_va = 0x16dd0000 end_va = 0x16ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016dd0000" filename = "" Region: id = 3259 start_va = 0x16ed0000 end_va = 0x16f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016ed0000" filename = "" Region: id = 3260 start_va = 0x16f10000 end_va = 0x1700ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016f10000" filename = "" Region: id = 3261 start_va = 0x17010000 end_va = 0x1704ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017010000" filename = "" Region: id = 3262 start_va = 0x17050000 end_va = 0x1714ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017050000" filename = "" Region: id = 3263 start_va = 0x17150000 end_va = 0x1718ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017150000" filename = "" Region: id = 3264 start_va = 0x17190000 end_va = 0x1728ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017190000" filename = "" Region: id = 3265 start_va = 0x17290000 end_va = 0x172cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017290000" filename = "" Region: id = 3266 start_va = 0x172d0000 end_va = 0x173cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000172d0000" filename = "" Region: id = 3267 start_va = 0x17510000 end_va = 0x1754ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017510000" filename = "" Region: id = 3268 start_va = 0x17550000 end_va = 0x1764ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017550000" filename = "" Region: id = 3269 start_va = 0x17650000 end_va = 0x1768ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017650000" filename = "" Region: id = 3270 start_va = 0x17690000 end_va = 0x1778ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017690000" filename = "" Region: id = 3271 start_va = 0x17790000 end_va = 0x177cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017790000" filename = "" Region: id = 3272 start_va = 0x177d0000 end_va = 0x178cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000177d0000" filename = "" Region: id = 3273 start_va = 0x178d0000 end_va = 0x1790ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000178d0000" filename = "" Region: id = 3274 start_va = 0x17910000 end_va = 0x17a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017910000" filename = "" Region: id = 3275 start_va = 0x17a10000 end_va = 0x17a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017a10000" filename = "" Region: id = 3276 start_va = 0x17a50000 end_va = 0x17b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017a50000" filename = "" Region: id = 3277 start_va = 0x17b50000 end_va = 0x17b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b50000" filename = "" Region: id = 3278 start_va = 0x17b90000 end_va = 0x17bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017b90000" filename = "" Region: id = 3279 start_va = 0x17c00000 end_va = 0x17dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017c00000" filename = "" Region: id = 3280 start_va = 0x17e00000 end_va = 0x17efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017e00000" filename = "" Region: id = 3281 start_va = 0x17f00000 end_va = 0x17ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017f00000" filename = "" Region: id = 3282 start_va = 0x18000000 end_va = 0x1803ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018000000" filename = "" Region: id = 3283 start_va = 0x18040000 end_va = 0x1813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018040000" filename = "" Region: id = 3284 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3285 start_va = 0xee50000 end_va = 0xee50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 3286 start_va = 0xee60000 end_va = 0xee60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee60000" filename = "" Region: id = 3287 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3288 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3289 start_va = 0xee60000 end_va = 0xee9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee60000" filename = "" Region: id = 3290 start_va = 0xeea0000 end_va = 0xeedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000eea0000" filename = "" Region: id = 3291 start_va = 0xeee0000 end_va = 0xef1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000eee0000" filename = "" Region: id = 3292 start_va = 0xef20000 end_va = 0xef5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef20000" filename = "" Region: id = 3293 start_va = 0xf210000 end_va = 0xf30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 3294 start_va = 0xf310000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f310000" filename = "" Region: id = 3295 start_va = 0x10fd0000 end_va = 0x110cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 3296 start_va = 0x11390000 end_va = 0x1148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 3297 start_va = 0x11490000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011490000" filename = "" Region: id = 3298 start_va = 0x18140000 end_va = 0x1823ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018140000" filename = "" Region: id = 3299 start_va = 0x18240000 end_va = 0x1833ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018240000" filename = "" Region: id = 3300 start_va = 0x18340000 end_va = 0x1843ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018340000" filename = "" Region: id = 3301 start_va = 0x18440000 end_va = 0x1853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018440000" filename = "" Region: id = 3302 start_va = 0x18540000 end_va = 0x1857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018540000" filename = "" Region: id = 3303 start_va = 0x18580000 end_va = 0x1867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018580000" filename = "" Region: id = 3304 start_va = 0x18680000 end_va = 0x186bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018680000" filename = "" Region: id = 3305 start_va = 0x186c0000 end_va = 0x187bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000186c0000" filename = "" Region: id = 3306 start_va = 0x187c0000 end_va = 0x187fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000187c0000" filename = "" Region: id = 3307 start_va = 0x18800000 end_va = 0x188fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018800000" filename = "" Region: id = 3308 start_va = 0x18900000 end_va = 0x1893ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018900000" filename = "" Region: id = 3309 start_va = 0x18940000 end_va = 0x18a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018940000" filename = "" Region: id = 3310 start_va = 0x18a40000 end_va = 0x18a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a40000" filename = "" Region: id = 3311 start_va = 0x18a80000 end_va = 0x18b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a80000" filename = "" Region: id = 3312 start_va = 0x18b80000 end_va = 0x18bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018b80000" filename = "" Region: id = 3313 start_va = 0x18bc0000 end_va = 0x18cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018bc0000" filename = "" Region: id = 3314 start_va = 0x18cc0000 end_va = 0x18cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018cc0000" filename = "" Region: id = 3315 start_va = 0x18d00000 end_va = 0x18dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018d00000" filename = "" Region: id = 3316 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3317 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3318 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3319 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3320 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3321 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3322 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3323 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3324 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3325 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3326 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3327 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3328 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3329 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3330 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3331 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3332 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3333 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3334 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3335 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3336 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3337 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3338 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3339 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3340 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3341 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3342 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3343 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3344 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3345 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3346 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3347 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3348 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3349 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3350 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3351 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3352 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3353 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3354 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3355 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3356 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3357 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3358 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3359 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3360 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3361 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3362 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3363 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3364 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3365 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3366 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3367 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3368 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3369 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3370 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3371 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3372 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3373 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3374 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3375 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3376 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3377 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3378 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3379 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3380 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3381 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3382 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3383 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3384 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3385 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3386 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3387 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3388 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3389 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3390 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3391 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3392 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3393 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3394 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3395 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3396 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3397 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3398 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3399 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3400 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3401 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3402 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3403 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3404 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3405 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3406 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3407 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3408 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3409 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3410 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3411 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3412 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3413 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3414 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3415 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3416 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3417 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3418 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3419 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3420 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3421 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3422 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3423 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 3424 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3425 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 3426 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 3427 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 3428 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 3429 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 3430 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 3431 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 3432 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 3433 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 3434 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 3435 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 3436 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 3437 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 3438 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 3439 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 3440 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 3441 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 3442 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 3443 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 3444 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 3445 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 3446 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 3447 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 3448 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 3449 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3450 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3451 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3452 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3453 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3454 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3455 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3456 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3457 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3458 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3459 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3460 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3461 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3462 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3463 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3464 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3465 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3466 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3467 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3468 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3469 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3470 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3471 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3472 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3473 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3474 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3475 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3476 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3477 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3478 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3479 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3480 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3481 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3482 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 3483 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3484 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 3485 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 3486 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 3487 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 3488 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 3489 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 3490 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 3491 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 3492 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 3493 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 3494 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 3495 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 3496 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 3497 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 3498 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 3499 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 3500 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 3501 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 3502 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 3503 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 3504 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 3505 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 3506 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 3507 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 3508 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 3509 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 3510 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 3511 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 3512 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 3513 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 3514 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 3515 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 3516 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 3517 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 3518 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 3519 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 3520 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 3521 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 3522 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 3523 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 3524 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3525 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3526 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3527 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3528 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3529 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3530 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3531 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3532 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3533 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3534 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3535 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3536 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3537 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3538 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3539 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3540 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3541 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3542 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3543 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3544 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3545 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3546 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3547 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3548 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3549 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3550 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3551 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3552 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3553 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3554 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3555 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3556 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3557 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3558 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3559 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3560 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3561 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3562 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3563 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3564 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3565 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3566 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3567 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3568 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 3569 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3570 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 3571 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 3572 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 3573 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 3574 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 3575 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 3576 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 3577 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 3578 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 3579 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 3580 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 3581 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 3582 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 3583 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 3584 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 3585 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 3586 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 3587 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 3588 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 3589 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 3590 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 3591 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 3592 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 3593 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 3594 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 3595 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 3596 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 3597 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 3598 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 3599 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 3600 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 3601 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 3602 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 3603 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 3604 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 3605 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 3606 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 3607 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 3608 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 3609 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 3610 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3611 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3612 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3613 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 3614 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 3615 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3616 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 3617 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 3618 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3619 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3620 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3621 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3622 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3623 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3624 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3625 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3626 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3627 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3628 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3629 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3630 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3631 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3632 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3633 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3634 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3635 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3636 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3637 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3638 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3639 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3640 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3641 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3642 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3643 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3644 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3645 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3646 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3647 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3648 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3649 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3650 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3651 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3652 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3653 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3654 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3655 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3656 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3657 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3658 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3659 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3660 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3661 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3662 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3663 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3664 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 3665 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3666 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 3667 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 3668 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 3669 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 3670 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 3671 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 3672 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 3673 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 3674 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 3675 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 3676 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 3677 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 3678 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 3679 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 3680 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 3681 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 3682 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 3683 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 3684 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 3685 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 3686 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 3687 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 3688 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 3689 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 3690 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 3691 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 3692 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 3693 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 3694 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 3695 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 3696 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 3697 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 3698 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 3699 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 3700 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 3701 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 3702 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 3703 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 3704 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 3705 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 3706 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 3707 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 3708 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 3709 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 3710 start_va = 0x114d0000 end_va = 0x1150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000114d0000" filename = "" Region: id = 3711 start_va = 0x11510000 end_va = 0x1160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011510000" filename = "" Region: id = 3712 start_va = 0x11610000 end_va = 0x1164ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011610000" filename = "" Region: id = 3713 start_va = 0x11650000 end_va = 0x1174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011650000" filename = "" Region: id = 3714 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3715 start_va = 0xe6d0000 end_va = 0xe70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e6d0000" filename = "" Region: id = 3716 start_va = 0xe710000 end_va = 0xe80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 3717 start_va = 0x11750000 end_va = 0x1178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011750000" filename = "" Region: id = 3718 start_va = 0x11790000 end_va = 0x1188ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011790000" filename = "" Region: id = 3719 start_va = 0x11890000 end_va = 0x118cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011890000" filename = "" Region: id = 3720 start_va = 0x118d0000 end_va = 0x119cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000118d0000" filename = "" Region: id = 3721 start_va = 0x119d0000 end_va = 0x11a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000119d0000" filename = "" Region: id = 3722 start_va = 0x11a10000 end_va = 0x11b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011a10000" filename = "" Region: id = 3723 start_va = 0x12510000 end_va = 0x1254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012510000" filename = "" Region: id = 3724 start_va = 0x12550000 end_va = 0x1264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012550000" filename = "" Region: id = 3725 start_va = 0x12650000 end_va = 0x1268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012650000" filename = "" Region: id = 3726 start_va = 0x12690000 end_va = 0x1278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012690000" filename = "" Region: id = 3727 start_va = 0x12790000 end_va = 0x127cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012790000" filename = "" Region: id = 3728 start_va = 0x127d0000 end_va = 0x128cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000127d0000" filename = "" Region: id = 3729 start_va = 0x128d0000 end_va = 0x1290ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000128d0000" filename = "" Region: id = 3730 start_va = 0x12910000 end_va = 0x12a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012910000" filename = "" Region: id = 3731 start_va = 0x12a10000 end_va = 0x12a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a10000" filename = "" Region: id = 3732 start_va = 0x12a50000 end_va = 0x12b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012a50000" filename = "" Region: id = 3733 start_va = 0x12b50000 end_va = 0x12b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b50000" filename = "" Region: id = 3734 start_va = 0x12b90000 end_va = 0x12c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012b90000" filename = "" Region: id = 3735 start_va = 0x12c90000 end_va = 0x12ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012c90000" filename = "" Region: id = 3736 start_va = 0x12cd0000 end_va = 0x12dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012cd0000" filename = "" Region: id = 3737 start_va = 0x12dd0000 end_va = 0x12e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012dd0000" filename = "" Region: id = 3738 start_va = 0x12e10000 end_va = 0x12f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012e10000" filename = "" Region: id = 3739 start_va = 0x12f10000 end_va = 0x12f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f10000" filename = "" Region: id = 3740 start_va = 0x12f50000 end_va = 0x1304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012f50000" filename = "" Region: id = 3741 start_va = 0x13050000 end_va = 0x1308ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013050000" filename = "" Region: id = 3742 start_va = 0x13090000 end_va = 0x1318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013090000" filename = "" Region: id = 3743 start_va = 0x13190000 end_va = 0x131cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013190000" filename = "" Region: id = 3744 start_va = 0x131d0000 end_va = 0x132cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000131d0000" filename = "" Region: id = 3745 start_va = 0x132d0000 end_va = 0x1330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000132d0000" filename = "" Region: id = 3746 start_va = 0x13310000 end_va = 0x1340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013310000" filename = "" Region: id = 3747 start_va = 0x13410000 end_va = 0x1344ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013410000" filename = "" Region: id = 3748 start_va = 0x13450000 end_va = 0x1354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013450000" filename = "" Region: id = 3749 start_va = 0x13550000 end_va = 0x1358ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013550000" filename = "" Region: id = 3750 start_va = 0x13590000 end_va = 0x1368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013590000" filename = "" Region: id = 3751 start_va = 0x13690000 end_va = 0x136cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013690000" filename = "" Region: id = 3752 start_va = 0x136d0000 end_va = 0x137cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000136d0000" filename = "" Region: id = 3753 start_va = 0x137d0000 end_va = 0x1380ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000137d0000" filename = "" Region: id = 3754 start_va = 0x13810000 end_va = 0x1390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013810000" filename = "" Region: id = 3755 start_va = 0x13910000 end_va = 0x1394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013910000" filename = "" Region: id = 3756 start_va = 0x13950000 end_va = 0x13a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013950000" filename = "" Region: id = 3757 start_va = 0x13a50000 end_va = 0x13a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a50000" filename = "" Region: id = 3758 start_va = 0x13a90000 end_va = 0x13b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013a90000" filename = "" Region: id = 3759 start_va = 0x13b90000 end_va = 0x13bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013b90000" filename = "" Region: id = 3760 start_va = 0x13bd0000 end_va = 0x13ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013bd0000" filename = "" Region: id = 3761 start_va = 0x13cd0000 end_va = 0x13d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013cd0000" filename = "" Region: id = 3762 start_va = 0x13d10000 end_va = 0x13e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013d10000" filename = "" Region: id = 3763 start_va = 0x13e10000 end_va = 0x13e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e10000" filename = "" Region: id = 3764 start_va = 0x13e50000 end_va = 0x13f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013e50000" filename = "" Region: id = 3765 start_va = 0x16390000 end_va = 0x163cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016390000" filename = "" Region: id = 3766 start_va = 0x163d0000 end_va = 0x164cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000163d0000" filename = "" Region: id = 3767 start_va = 0x18140000 end_va = 0x1817ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018140000" filename = "" Region: id = 3768 start_va = 0x18180000 end_va = 0x1827ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018180000" filename = "" Region: id = 3769 start_va = 0x18280000 end_va = 0x182bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018280000" filename = "" Region: id = 3770 start_va = 0x182c0000 end_va = 0x183bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000182c0000" filename = "" Region: id = 3771 start_va = 0x183c0000 end_va = 0x183fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000183c0000" filename = "" Region: id = 3772 start_va = 0x18400000 end_va = 0x184fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018400000" filename = "" Region: id = 3773 start_va = 0x18500000 end_va = 0x1853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018500000" filename = "" Region: id = 3774 start_va = 0x18540000 end_va = 0x1863ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018540000" filename = "" Region: id = 3775 start_va = 0x18640000 end_va = 0x1867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018640000" filename = "" Region: id = 3776 start_va = 0x18680000 end_va = 0x1877ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018680000" filename = "" Region: id = 3777 start_va = 0x18780000 end_va = 0x187bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018780000" filename = "" Region: id = 3778 start_va = 0x187c0000 end_va = 0x188bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000187c0000" filename = "" Region: id = 3779 start_va = 0x188c0000 end_va = 0x188fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000188c0000" filename = "" Region: id = 3780 start_va = 0x18900000 end_va = 0x189fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018900000" filename = "" Region: id = 3781 start_va = 0x18a00000 end_va = 0x18a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a00000" filename = "" Region: id = 3782 start_va = 0x18a40000 end_va = 0x18b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018a40000" filename = "" Region: id = 3783 start_va = 0x18b40000 end_va = 0x18b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018b40000" filename = "" Region: id = 3784 start_va = 0x18b80000 end_va = 0x18c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018b80000" filename = "" Region: id = 3785 start_va = 0x18c80000 end_va = 0x18cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018c80000" filename = "" Region: id = 3786 start_va = 0x18cc0000 end_va = 0x18dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018cc0000" filename = "" Region: id = 3787 start_va = 0x18dc0000 end_va = 0x18dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018dc0000" filename = "" Region: id = 3788 start_va = 0x18e00000 end_va = 0x18efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018e00000" filename = "" Region: id = 3789 start_va = 0x18f00000 end_va = 0x18f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018f00000" filename = "" Region: id = 3790 start_va = 0x18f40000 end_va = 0x1903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000018f40000" filename = "" Region: id = 3791 start_va = 0x19040000 end_va = 0x1907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019040000" filename = "" Region: id = 3792 start_va = 0x19080000 end_va = 0x1917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019080000" filename = "" Region: id = 3793 start_va = 0x19180000 end_va = 0x191bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019180000" filename = "" Region: id = 3794 start_va = 0x191c0000 end_va = 0x192bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000191c0000" filename = "" Region: id = 3795 start_va = 0x192c0000 end_va = 0x192fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000192c0000" filename = "" Region: id = 3796 start_va = 0x19300000 end_va = 0x193fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019300000" filename = "" Region: id = 3797 start_va = 0x19400000 end_va = 0x1943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019400000" filename = "" Region: id = 3798 start_va = 0x19440000 end_va = 0x1953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019440000" filename = "" Region: id = 3799 start_va = 0x19540000 end_va = 0x1957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019540000" filename = "" Region: id = 3800 start_va = 0x19580000 end_va = 0x1967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019580000" filename = "" Region: id = 3801 start_va = 0x19680000 end_va = 0x196bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019680000" filename = "" Region: id = 3802 start_va = 0x196c0000 end_va = 0x197bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000196c0000" filename = "" Region: id = 3803 start_va = 0x197c0000 end_va = 0x197fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000197c0000" filename = "" Region: id = 3804 start_va = 0x19800000 end_va = 0x198fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019800000" filename = "" Region: id = 3805 start_va = 0x19900000 end_va = 0x1993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019900000" filename = "" Region: id = 3806 start_va = 0x19940000 end_va = 0x19a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019940000" filename = "" Region: id = 3807 start_va = 0x19a40000 end_va = 0x19a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019a40000" filename = "" Region: id = 3808 start_va = 0x19a80000 end_va = 0x19b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019a80000" filename = "" Region: id = 3809 start_va = 0x19b80000 end_va = 0x19bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019b80000" filename = "" Region: id = 3810 start_va = 0x19bc0000 end_va = 0x19cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019bc0000" filename = "" Region: id = 3811 start_va = 0x19cc0000 end_va = 0x19cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019cc0000" filename = "" Region: id = 3812 start_va = 0x19d00000 end_va = 0x19dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019d00000" filename = "" Region: id = 3813 start_va = 0x19e00000 end_va = 0x19e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019e00000" filename = "" Region: id = 3814 start_va = 0x19e40000 end_va = 0x19f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019e40000" filename = "" Region: id = 3815 start_va = 0x19f40000 end_va = 0x19f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019f40000" filename = "" Region: id = 3816 start_va = 0x19f80000 end_va = 0x1a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000019f80000" filename = "" Region: id = 3817 start_va = 0x1a080000 end_va = 0x1a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a080000" filename = "" Region: id = 3818 start_va = 0x1a0c0000 end_va = 0x1a1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a0c0000" filename = "" Region: id = 3819 start_va = 0x1a1c0000 end_va = 0x1a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a1c0000" filename = "" Region: id = 3820 start_va = 0x1a200000 end_va = 0x1a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a200000" filename = "" Region: id = 3821 start_va = 0x1a300000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a300000" filename = "" Region: id = 3822 start_va = 0x1a340000 end_va = 0x1a43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 3823 start_va = 0x1a440000 end_va = 0x1a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a440000" filename = "" Region: id = 3824 start_va = 0x1a480000 end_va = 0x1a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a480000" filename = "" Region: id = 3825 start_va = 0x1a580000 end_va = 0x1a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a580000" filename = "" Region: id = 3826 start_va = 0x1a5c0000 end_va = 0x1a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5c0000" filename = "" Region: id = 3827 start_va = 0x1a7c0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 3828 start_va = 0x1a800000 end_va = 0x1a8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 3829 start_va = 0x1a900000 end_va = 0x1a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a900000" filename = "" Region: id = 3830 start_va = 0x1a940000 end_va = 0x1aa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a940000" filename = "" Region: id = 3831 start_va = 0x1aa40000 end_va = 0x1aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa40000" filename = "" Region: id = 3832 start_va = 0x1aa80000 end_va = 0x1ab7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa80000" filename = "" Region: id = 3833 start_va = 0x1ab80000 end_va = 0x1abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab80000" filename = "" Region: id = 3834 start_va = 0x1abc0000 end_va = 0x1acbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abc0000" filename = "" Region: id = 3835 start_va = 0x1acc0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acc0000" filename = "" Region: id = 3836 start_va = 0x1ad00000 end_va = 0x1adfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 3837 start_va = 0x1ae00000 end_va = 0x1ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae00000" filename = "" Region: id = 3838 start_va = 0x1ae40000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae40000" filename = "" Region: id = 3839 start_va = 0x1af40000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 3840 start_va = 0x1af80000 end_va = 0x1b07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af80000" filename = "" Region: id = 3841 start_va = 0x1b080000 end_va = 0x1b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b080000" filename = "" Region: id = 3842 start_va = 0x1b0c0000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0c0000" filename = "" Region: id = 3843 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3844 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3845 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3846 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3847 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3848 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3849 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 3850 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 3851 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 3852 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3853 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 3854 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 3855 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 3856 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 3857 start_va = 0x1b1c0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 3858 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 3859 start_va = 0x1b300000 end_va = 0x1b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 3860 start_va = 0x1b340000 end_va = 0x1b43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b340000" filename = "" Region: id = 3861 start_va = 0x1b440000 end_va = 0x1b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b440000" filename = "" Region: id = 3862 start_va = 0x1b480000 end_va = 0x1b57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b480000" filename = "" Region: id = 3863 start_va = 0x1b580000 end_va = 0x1b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b580000" filename = "" Region: id = 3864 start_va = 0x1b5c0000 end_va = 0x1b6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5c0000" filename = "" Region: id = 3865 start_va = 0x1b6c0000 end_va = 0x1b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6c0000" filename = "" Region: id = 3866 start_va = 0x1b700000 end_va = 0x1b7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b700000" filename = "" Region: id = 3867 start_va = 0x1b800000 end_va = 0x1b83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b800000" filename = "" Region: id = 3868 start_va = 0x1b840000 end_va = 0x1b93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b840000" filename = "" Region: id = 3869 start_va = 0x1b940000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 3870 start_va = 0x1b980000 end_va = 0x1ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b980000" filename = "" Region: id = 3871 start_va = 0x1ba80000 end_va = 0x1babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 3872 start_va = 0x1bac0000 end_va = 0x1bbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bac0000" filename = "" Region: id = 3873 start_va = 0x1bbc0000 end_va = 0x1bbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bbc0000" filename = "" Region: id = 3874 start_va = 0x1bc00000 end_va = 0x1bcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc00000" filename = "" Region: id = 3875 start_va = 0x1bd00000 end_va = 0x1bd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd00000" filename = "" Region: id = 3876 start_va = 0x1bd40000 end_va = 0x1be3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd40000" filename = "" Region: id = 3877 start_va = 0x1be40000 end_va = 0x1be7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be40000" filename = "" Region: id = 3878 start_va = 0x1be80000 end_va = 0x1bf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be80000" filename = "" Region: id = 3879 start_va = 0x1bf80000 end_va = 0x1bfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bf80000" filename = "" Region: id = 3880 start_va = 0x1bfc0000 end_va = 0x1c0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bfc0000" filename = "" Region: id = 3881 start_va = 0x1c0c0000 end_va = 0x1c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c0c0000" filename = "" Region: id = 3882 start_va = 0x1c100000 end_va = 0x1c1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c100000" filename = "" Region: id = 3883 start_va = 0x1c200000 end_va = 0x1c23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c200000" filename = "" Region: id = 3884 start_va = 0x1c240000 end_va = 0x1c33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c240000" filename = "" Region: id = 3885 start_va = 0x1c340000 end_va = 0x1c37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c340000" filename = "" Region: id = 3886 start_va = 0x1c380000 end_va = 0x1c47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c380000" filename = "" Region: id = 3887 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3888 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3889 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3890 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3891 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3892 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3893 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3894 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3895 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3896 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3897 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3898 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3899 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3900 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3901 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3902 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3903 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3904 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3905 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3906 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3907 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3908 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3909 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3910 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3911 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3912 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3913 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3914 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3915 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3916 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3917 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3918 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3919 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3920 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3921 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3922 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3923 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3924 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3925 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3926 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3927 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3928 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3929 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3930 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3931 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3932 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3933 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3934 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3935 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3936 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3937 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3938 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3939 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3940 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3941 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3942 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3943 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3944 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3945 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3946 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3947 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3948 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3949 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3950 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3951 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3952 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3953 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3954 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3955 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3956 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3957 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3958 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3959 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3960 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3961 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3962 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3963 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3964 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3965 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3966 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3967 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3968 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3969 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 3970 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3971 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3972 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3973 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3974 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 3975 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 3976 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3977 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3978 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3979 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3980 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3981 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 3982 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 3983 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 3984 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 3985 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 3986 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 3987 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 3988 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 3989 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 3990 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 3991 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 3992 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 3993 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 3994 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 3995 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 3996 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 3997 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 3998 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 3999 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 4000 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 4001 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 4002 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 4003 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 4004 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 4005 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 4006 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 4007 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 4008 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 4009 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 4010 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 4011 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 4012 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 4013 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 4014 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 4015 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 4016 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 4017 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 4018 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 4019 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 4020 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 4021 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 4022 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 4023 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 4024 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 4025 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4026 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4027 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4028 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4029 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4030 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4031 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4032 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4033 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4034 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4035 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4036 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4037 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4038 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4039 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4040 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4041 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4042 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4043 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4044 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4045 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4046 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4047 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4048 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4049 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4050 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4051 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4052 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4053 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4054 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4055 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4056 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4057 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4058 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4059 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4060 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4061 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4062 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4063 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4064 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4065 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4066 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4067 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4068 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4069 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4070 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4071 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4072 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4073 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4074 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 4075 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 4076 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 4077 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 4078 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 4079 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 4080 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 4081 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 4082 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 4083 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 4084 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 4085 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 4086 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 4087 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 4088 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 4089 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 4090 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 4091 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 4092 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 4093 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 4094 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 4095 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 4096 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 4097 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 4098 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 4099 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 4100 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 4101 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 4102 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 4103 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 4104 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 4105 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 4106 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 4107 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 4108 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 4109 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 4110 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 4111 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 4112 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 4113 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 4114 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 4115 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 4116 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 4117 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 4118 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 4119 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 4120 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 4121 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 4122 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 4123 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 4124 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 4125 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 4126 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 4127 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 4128 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4129 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4130 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4131 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4132 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4133 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4134 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4135 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4136 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4137 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4138 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4139 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4140 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4141 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4142 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4143 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4144 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4145 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4146 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4147 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4148 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4149 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4150 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4151 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4152 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4153 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4154 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4155 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4156 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4157 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4158 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4159 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4160 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4161 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4162 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4163 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4164 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4165 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4166 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4167 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4168 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4169 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4170 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4171 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4172 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4173 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4174 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4175 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4176 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4177 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4178 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4179 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4180 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4181 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4182 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4183 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4184 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4185 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 4186 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 4187 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 4188 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 4189 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 4190 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 4191 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 4192 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 4193 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 4194 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 4195 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 4196 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 4197 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 4198 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 4199 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 4200 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 4201 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 4202 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 4203 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 4204 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 4205 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 4206 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 4207 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 4208 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 4209 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 4210 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 4211 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 4212 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 4213 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 4214 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 4215 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 4216 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 4217 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 4218 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 4219 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 4220 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 4221 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 4222 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 4223 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 4224 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 4225 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 4226 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 4227 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 4228 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 4229 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 4230 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 4231 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 4232 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 4233 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 4234 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 4235 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 4236 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 4237 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 4238 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 4239 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 4240 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 4241 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 4242 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 4243 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4244 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4245 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4246 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4247 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4248 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4249 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4250 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4251 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4252 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4253 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4254 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4255 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4256 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4257 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4258 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4259 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4260 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4261 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4262 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4263 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4264 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4265 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4266 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4267 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4268 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4269 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4270 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4271 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4272 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4273 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4274 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4275 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4276 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4277 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4278 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4279 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4280 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4281 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4282 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4283 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4284 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4285 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4286 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4287 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4288 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4289 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4290 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4291 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4292 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4293 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4294 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4295 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4296 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4297 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4298 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4299 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4300 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 4301 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 4302 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 4303 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 4304 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 4305 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 4306 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 4307 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 4308 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 4309 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 4310 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 4311 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 4312 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 4313 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 4314 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 4315 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 4316 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 4317 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 4318 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 4319 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 4320 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 4321 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 4322 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 4323 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 4324 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 4325 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 4326 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 4327 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 4328 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4329 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4330 start_va = 0xdf50000 end_va = 0xdf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 4331 start_va = 0xdf90000 end_va = 0xe08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 4332 start_va = 0xf350000 end_va = 0xf38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f350000" filename = "" Region: id = 4333 start_va = 0xf390000 end_va = 0xf48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f390000" filename = "" Region: id = 4334 start_va = 0xfd10000 end_va = 0xfd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd10000" filename = "" Region: id = 4335 start_va = 0xfd50000 end_va = 0xfe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 4336 start_va = 0xff90000 end_va = 0xffcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ff90000" filename = "" Region: id = 4337 start_va = 0xffd0000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ffd0000" filename = "" Region: id = 4338 start_va = 0x10210000 end_va = 0x1024ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010210000" filename = "" Region: id = 4339 start_va = 0x10250000 end_va = 0x1034ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010250000" filename = "" Region: id = 4340 start_va = 0x10350000 end_va = 0x1038ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010350000" filename = "" Region: id = 4341 start_va = 0x10390000 end_va = 0x1048ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010390000" filename = "" Region: id = 4342 start_va = 0x105d0000 end_va = 0x1060ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105d0000" filename = "" Region: id = 4343 start_va = 0x10610000 end_va = 0x1070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010610000" filename = "" Region: id = 4344 start_va = 0x10710000 end_va = 0x1074ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010710000" filename = "" Region: id = 4345 start_va = 0x10750000 end_va = 0x1084ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010750000" filename = "" Region: id = 4346 start_va = 0x10ad0000 end_va = 0x10b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ad0000" filename = "" Region: id = 4347 start_va = 0x10b10000 end_va = 0x10c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010b10000" filename = "" Region: id = 4348 start_va = 0x10c10000 end_va = 0x10c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c10000" filename = "" Region: id = 4349 start_va = 0x10c50000 end_va = 0x10d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010c50000" filename = "" Region: id = 4350 start_va = 0x10d50000 end_va = 0x10d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d50000" filename = "" Region: id = 4351 start_va = 0x10d90000 end_va = 0x10e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010d90000" filename = "" Region: id = 4352 start_va = 0x10e90000 end_va = 0x10ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010e90000" filename = "" Region: id = 4353 start_va = 0x10ed0000 end_va = 0x10fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010ed0000" filename = "" Region: id = 4354 start_va = 0x10fd0000 end_va = 0x1100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010fd0000" filename = "" Region: id = 4355 start_va = 0x11010000 end_va = 0x1110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011010000" filename = "" Region: id = 4356 start_va = 0x11110000 end_va = 0x1114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011110000" filename = "" Region: id = 4357 start_va = 0x11150000 end_va = 0x1124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011150000" filename = "" Region: id = 4358 start_va = 0x11250000 end_va = 0x1128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011250000" filename = "" Region: id = 4359 start_va = 0x11290000 end_va = 0x1138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011290000" filename = "" Region: id = 4360 start_va = 0x11390000 end_va = 0x113cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011390000" filename = "" Region: id = 4361 start_va = 0x113d0000 end_va = 0x114cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000113d0000" filename = "" Region: id = 4362 start_va = 0x114d0000 end_va = 0x1150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000114d0000" filename = "" Region: id = 4363 start_va = 0x11510000 end_va = 0x1160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011510000" filename = "" Region: id = 4364 start_va = 0x11610000 end_va = 0x1164ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011610000" filename = "" Region: id = 4365 start_va = 0x11650000 end_va = 0x1174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011650000" filename = "" Region: id = 4366 start_va = 0x1b1c0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 4367 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 4368 start_va = 0x1b300000 end_va = 0x1b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 4369 start_va = 0x1b340000 end_va = 0x1b43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b340000" filename = "" Region: id = 4370 start_va = 0x1b440000 end_va = 0x1b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b440000" filename = "" Region: id = 4371 start_va = 0x1b480000 end_va = 0x1b57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b480000" filename = "" Region: id = 4372 start_va = 0x1b580000 end_va = 0x1b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b580000" filename = "" Region: id = 4373 start_va = 0x1b5c0000 end_va = 0x1b6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5c0000" filename = "" Region: id = 4374 start_va = 0x1b6c0000 end_va = 0x1b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6c0000" filename = "" Region: id = 4375 start_va = 0x1b700000 end_va = 0x1b7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b700000" filename = "" Region: id = 4376 start_va = 0x1b800000 end_va = 0x1b83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b800000" filename = "" Region: id = 4377 start_va = 0x1b840000 end_va = 0x1b93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b840000" filename = "" Region: id = 4378 start_va = 0x1b940000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 4379 start_va = 0x1b980000 end_va = 0x1ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b980000" filename = "" Region: id = 4380 start_va = 0x1ba80000 end_va = 0x1babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 4381 start_va = 0x1bac0000 end_va = 0x1bbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bac0000" filename = "" Region: id = 4382 start_va = 0x1bbc0000 end_va = 0x1bbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bbc0000" filename = "" Region: id = 4383 start_va = 0x1bc00000 end_va = 0x1bcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc00000" filename = "" Region: id = 4384 start_va = 0x1bd00000 end_va = 0x1bd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd00000" filename = "" Region: id = 4385 start_va = 0x1bd40000 end_va = 0x1be3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd40000" filename = "" Region: id = 4386 start_va = 0x1be40000 end_va = 0x1be7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be40000" filename = "" Region: id = 4387 start_va = 0x1be80000 end_va = 0x1bf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be80000" filename = "" Region: id = 4388 start_va = 0x1bf80000 end_va = 0x1bfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bf80000" filename = "" Region: id = 4389 start_va = 0x1bfc0000 end_va = 0x1c0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bfc0000" filename = "" Region: id = 4390 start_va = 0x1c0c0000 end_va = 0x1c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c0c0000" filename = "" Region: id = 4391 start_va = 0x1c100000 end_va = 0x1c1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c100000" filename = "" Region: id = 4392 start_va = 0x1c200000 end_va = 0x1c23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c200000" filename = "" Region: id = 4393 start_va = 0x1c240000 end_va = 0x1c33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c240000" filename = "" Region: id = 4394 start_va = 0x1c340000 end_va = 0x1c37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c340000" filename = "" Region: id = 4395 start_va = 0x1c380000 end_va = 0x1c47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c380000" filename = "" Region: id = 4396 start_va = 0x1c480000 end_va = 0x1c4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c480000" filename = "" Region: id = 4397 start_va = 0x1c4c0000 end_va = 0x1c5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c4c0000" filename = "" Region: id = 4398 start_va = 0x1c5c0000 end_va = 0x1c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c5c0000" filename = "" Region: id = 4399 start_va = 0x1c600000 end_va = 0x1c6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c600000" filename = "" Region: id = 4400 start_va = 0x1c700000 end_va = 0x1c73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c700000" filename = "" Region: id = 4401 start_va = 0x1c740000 end_va = 0x1c83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c740000" filename = "" Region: id = 4402 start_va = 0x1c840000 end_va = 0x1c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c840000" filename = "" Region: id = 4403 start_va = 0x1c880000 end_va = 0x1c97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c880000" filename = "" Region: id = 4404 start_va = 0x1c980000 end_va = 0x1c9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c980000" filename = "" Region: id = 4405 start_va = 0x1c9c0000 end_va = 0x1cabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c9c0000" filename = "" Region: id = 4406 start_va = 0x1cac0000 end_va = 0x1cafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cac0000" filename = "" Region: id = 4407 start_va = 0x1cb00000 end_va = 0x1cbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cb00000" filename = "" Region: id = 4408 start_va = 0x1cc00000 end_va = 0x1cc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cc00000" filename = "" Region: id = 4409 start_va = 0x1cc40000 end_va = 0x1cd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cc40000" filename = "" Region: id = 4410 start_va = 0x1cd40000 end_va = 0x1cd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cd40000" filename = "" Region: id = 4411 start_va = 0x1cd80000 end_va = 0x1ce7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cd80000" filename = "" Region: id = 4412 start_va = 0x1ce80000 end_va = 0x1cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ce80000" filename = "" Region: id = 4413 start_va = 0x1cec0000 end_va = 0x1cfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cec0000" filename = "" Region: id = 4414 start_va = 0x1cfc0000 end_va = 0x1cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001cfc0000" filename = "" Region: id = 4415 start_va = 0x1d000000 end_va = 0x1d0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d000000" filename = "" Region: id = 4416 start_va = 0x1d100000 end_va = 0x1d13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d100000" filename = "" Region: id = 4417 start_va = 0x1d140000 end_va = 0x1d23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d140000" filename = "" Region: id = 4418 start_va = 0x1d240000 end_va = 0x1d27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d240000" filename = "" Region: id = 4419 start_va = 0x1d280000 end_va = 0x1d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d280000" filename = "" Region: id = 4420 start_va = 0x1d380000 end_va = 0x1d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d380000" filename = "" Region: id = 4421 start_va = 0x1d3c0000 end_va = 0x1d4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d3c0000" filename = "" Region: id = 4422 start_va = 0x1d4c0000 end_va = 0x1d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d4c0000" filename = "" Region: id = 4423 start_va = 0x1d500000 end_va = 0x1d5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d500000" filename = "" Region: id = 4424 start_va = 0x1d600000 end_va = 0x1d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d600000" filename = "" Region: id = 4425 start_va = 0x1d640000 end_va = 0x1d73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d640000" filename = "" Region: id = 4426 start_va = 0x1d740000 end_va = 0x1d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d740000" filename = "" Region: id = 4427 start_va = 0x1d780000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d780000" filename = "" Region: id = 4428 start_va = 0x1d880000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d880000" filename = "" Region: id = 4429 start_va = 0x1d8c0000 end_va = 0x1d9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 4430 start_va = 0x1d9c0000 end_va = 0x1d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d9c0000" filename = "" Region: id = 4431 start_va = 0x1da00000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001da00000" filename = "" Region: id = 4432 start_va = 0x1db00000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 4433 start_va = 0x1db40000 end_va = 0x1dc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db40000" filename = "" Region: id = 4434 start_va = 0x1dc40000 end_va = 0x1dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc40000" filename = "" Region: id = 4435 start_va = 0x1dc80000 end_va = 0x1dd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc80000" filename = "" Region: id = 4436 start_va = 0x1dd80000 end_va = 0x1ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dd80000" filename = "" Region: id = 4437 start_va = 0x1ddc0000 end_va = 0x1debffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ddc0000" filename = "" Region: id = 4438 start_va = 0x1dec0000 end_va = 0x1defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dec0000" filename = "" Region: id = 4439 start_va = 0x1df00000 end_va = 0x1dffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001df00000" filename = "" Region: id = 4440 start_va = 0x1e000000 end_va = 0x1e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e000000" filename = "" Region: id = 4441 start_va = 0x1e040000 end_va = 0x1e13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e040000" filename = "" Region: id = 4442 start_va = 0x1e140000 end_va = 0x1e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e140000" filename = "" Region: id = 4443 start_va = 0x1e180000 end_va = 0x1e27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e180000" filename = "" Region: id = 4444 start_va = 0x1e280000 end_va = 0x1e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e280000" filename = "" Region: id = 4445 start_va = 0x1e2c0000 end_va = 0x1e3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e2c0000" filename = "" Region: id = 4446 start_va = 0x1e3c0000 end_va = 0x1e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e3c0000" filename = "" Region: id = 4447 start_va = 0x1e400000 end_va = 0x1e4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e400000" filename = "" Region: id = 4448 start_va = 0x1e500000 end_va = 0x1e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e500000" filename = "" Region: id = 4449 start_va = 0x1e540000 end_va = 0x1e63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e540000" filename = "" Region: id = 4450 start_va = 0x1e640000 end_va = 0x1e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e640000" filename = "" Region: id = 4451 start_va = 0x1e680000 end_va = 0x1e77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e680000" filename = "" Region: id = 4452 start_va = 0x1e780000 end_va = 0x1e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e780000" filename = "" Region: id = 4453 start_va = 0x1e7c0000 end_va = 0x1e8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e7c0000" filename = "" Region: id = 4454 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4455 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4456 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4457 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4458 start_va = 0x1e8c0000 end_va = 0x1e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e8c0000" filename = "" Region: id = 4459 start_va = 0x1e900000 end_va = 0x1e9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e900000" filename = "" Region: id = 4460 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4461 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4462 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4463 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4464 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 4465 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 4466 start_va = 0x1ea00000 end_va = 0x1ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ea00000" filename = "" Region: id = 4467 start_va = 0x1ea40000 end_va = 0x1eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ea40000" filename = "" Region: id = 4468 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 4469 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 4470 start_va = 0xebd0000 end_va = 0xebd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 4471 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4472 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4473 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4474 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4475 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4476 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4477 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4478 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4479 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4480 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4481 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4482 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 4483 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 4484 start_va = 0xde10000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 4485 start_va = 0xde50000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 4486 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 4487 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 4488 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 4489 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 4490 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 4491 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 4492 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 4493 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 4494 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 4495 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 4496 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 4497 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 4498 start_va = 0x1eb40000 end_va = 0x1eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eb40000" filename = "" Region: id = 4499 start_va = 0x1eb80000 end_va = 0x1ec7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eb80000" filename = "" Region: id = 4500 start_va = 0x1ec80000 end_va = 0x1ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ec80000" filename = "" Region: id = 4501 start_va = 0x1ecc0000 end_va = 0x1edbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ecc0000" filename = "" Region: id = 4502 start_va = 0x1edc0000 end_va = 0x1edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001edc0000" filename = "" Region: id = 4503 start_va = 0x1ee00000 end_va = 0x1eefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ee00000" filename = "" Region: id = 4504 start_va = 0x1ef00000 end_va = 0x1ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ef00000" filename = "" Region: id = 4505 start_va = 0x1ef40000 end_va = 0x1f03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ef40000" filename = "" Region: id = 4506 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4507 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4508 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4509 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4510 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4511 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 4512 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 4513 start_va = 0xee50000 end_va = 0xee8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee50000" filename = "" Region: id = 4514 start_va = 0xee90000 end_va = 0xef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ee90000" filename = "" Region: id = 4515 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4516 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4517 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4518 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4519 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4520 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4521 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4522 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4523 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4524 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4525 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4526 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4527 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4528 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4529 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4530 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4531 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4532 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4533 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4534 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4535 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4536 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4537 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4538 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4539 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4540 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4541 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4542 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4543 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4544 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4545 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4546 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4547 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4548 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 4549 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 4550 start_va = 0xd2d0000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 4551 start_va = 0xd310000 end_va = 0xd40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 4552 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4553 start_va = 0xd410000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 4554 start_va = 0xd450000 end_va = 0xd54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 4555 start_va = 0xd550000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 4556 start_va = 0xd590000 end_va = 0xd68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 4557 start_va = 0xd690000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 4558 start_va = 0xd6d0000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 4559 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 4560 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 4561 start_va = 0xd910000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 4562 start_va = 0xd950000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 4563 start_va = 0xda50000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 4564 start_va = 0xda90000 end_va = 0xdb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 4565 start_va = 0xdb90000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 4566 start_va = 0xdbd0000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 4567 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4568 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4569 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4570 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4571 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4572 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4573 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4574 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4575 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4576 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4577 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4578 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4579 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4580 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4581 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4582 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4583 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 4584 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 4585 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4586 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4587 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4588 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4589 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4590 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4591 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4592 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4593 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 4594 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 4595 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4596 start_va = 0xb9d0000 end_va = 0xba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b9d0000" filename = "" Region: id = 4597 start_va = 0xba10000 end_va = 0xbb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ba10000" filename = "" Region: id = 4598 start_va = 0xbb10000 end_va = 0xbb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb10000" filename = "" Region: id = 4599 start_va = 0xbb50000 end_va = 0xbc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bb50000" filename = "" Region: id = 4600 start_va = 0xbc50000 end_va = 0xbc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc50000" filename = "" Region: id = 4601 start_va = 0xbc90000 end_va = 0xbd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bc90000" filename = "" Region: id = 4602 start_va = 0xbd90000 end_va = 0xbdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd90000" filename = "" Region: id = 4603 start_va = 0xbdd0000 end_va = 0xbecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bdd0000" filename = "" Region: id = 4604 start_va = 0xbed0000 end_va = 0xbf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bed0000" filename = "" Region: id = 4605 start_va = 0xbf10000 end_va = 0xc00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bf10000" filename = "" Region: id = 4606 start_va = 0xc010000 end_va = 0xc04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c010000" filename = "" Region: id = 4607 start_va = 0xc050000 end_va = 0xc14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c050000" filename = "" Region: id = 4608 start_va = 0xc150000 end_va = 0xc18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 4609 start_va = 0xc190000 end_va = 0xc28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c190000" filename = "" Region: id = 4610 start_va = 0xc290000 end_va = 0xc2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c290000" filename = "" Region: id = 4611 start_va = 0xc2d0000 end_va = 0xc3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c2d0000" filename = "" Region: id = 4612 start_va = 0xc3d0000 end_va = 0xc40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 4613 start_va = 0xc410000 end_va = 0xc50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 4614 start_va = 0xc510000 end_va = 0xc54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 4615 start_va = 0xc550000 end_va = 0xc64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c550000" filename = "" Region: id = 4616 start_va = 0xc650000 end_va = 0xc68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 4617 start_va = 0xc690000 end_va = 0xc78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 4618 start_va = 0xc790000 end_va = 0xc7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c790000" filename = "" Region: id = 4619 start_va = 0xc7d0000 end_va = 0xc8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c7d0000" filename = "" Region: id = 4620 start_va = 0xc8d0000 end_va = 0xc90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c8d0000" filename = "" Region: id = 4621 start_va = 0xc910000 end_va = 0xca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c910000" filename = "" Region: id = 4622 start_va = 0xca10000 end_va = 0xca4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca10000" filename = "" Region: id = 4623 start_va = 0xca50000 end_va = 0xcb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 4624 start_va = 0xcb50000 end_va = 0xcb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 4625 start_va = 0xcb90000 end_va = 0xcc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 4626 start_va = 0xcc90000 end_va = 0xcccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cc90000" filename = "" Region: id = 4627 start_va = 0xccd0000 end_va = 0xcdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ccd0000" filename = "" Region: id = 4628 start_va = 0xcdd0000 end_va = 0xce0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 4629 start_va = 0xce10000 end_va = 0xcf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 4630 start_va = 0xcf10000 end_va = 0xcf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 4631 start_va = 0xcf50000 end_va = 0xd04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 4632 start_va = 0xd050000 end_va = 0xd08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 4633 start_va = 0xd090000 end_va = 0xd18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 4634 start_va = 0xd190000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 4635 start_va = 0xd1d0000 end_va = 0xd2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 4636 start_va = 0xd2d0000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 4637 start_va = 0xd310000 end_va = 0xd40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 4638 start_va = 0xd410000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 4639 start_va = 0xd450000 end_va = 0xd54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 4640 start_va = 0xd550000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 4641 start_va = 0xd590000 end_va = 0xd68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 4642 start_va = 0xd690000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 4643 start_va = 0xd6d0000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 4644 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 4645 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 4646 start_va = 0xd910000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 4647 start_va = 0xd950000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 4648 start_va = 0xdb90000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 4649 start_va = 0xdbd0000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 4650 start_va = 0xdcd0000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dcd0000" filename = "" Region: id = 4651 start_va = 0xdd10000 end_va = 0xde0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 4652 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4653 start_va = 0xde10000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 4654 start_va = 0xde50000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 4655 start_va = 0xe090000 end_va = 0xe0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 4656 start_va = 0xe0d0000 end_va = 0xe1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 4657 start_va = 0xe1d0000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e1d0000" filename = "" Region: id = 4658 start_va = 0xe210000 end_va = 0xe30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 4659 start_va = 0xe310000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e310000" filename = "" Region: id = 4660 start_va = 0xe350000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 4661 start_va = 0xe450000 end_va = 0xe48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e450000" filename = "" Region: id = 4662 start_va = 0xe490000 end_va = 0xe58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e490000" filename = "" Region: id = 4663 start_va = 0xe590000 end_va = 0xe5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e590000" filename = "" Region: id = 4664 start_va = 0xe5d0000 end_va = 0xe6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e5d0000" filename = "" Region: id = 4665 start_va = 0xe810000 end_va = 0xe84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e810000" filename = "" Region: id = 4666 start_va = 0xe850000 end_va = 0xe94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e850000" filename = "" Region: id = 4667 start_va = 0xe950000 end_va = 0xe98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e950000" filename = "" Region: id = 4668 start_va = 0xe990000 end_va = 0xea8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e990000" filename = "" Region: id = 4669 start_va = 0xea90000 end_va = 0xeacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ea90000" filename = "" Region: id = 4670 start_va = 0xead0000 end_va = 0xebcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ead0000" filename = "" Region: id = 4671 start_va = 0xebd0000 end_va = 0xec0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ebd0000" filename = "" Region: id = 4672 start_va = 0xec10000 end_va = 0xed0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ec10000" filename = "" Region: id = 4673 start_va = 0xed10000 end_va = 0xed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed10000" filename = "" Region: id = 4674 start_va = 0xed50000 end_va = 0xee4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ed50000" filename = "" Region: id = 4675 start_va = 0xef90000 end_va = 0xefcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ef90000" filename = "" Region: id = 4676 start_va = 0xefd0000 end_va = 0xf0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000efd0000" filename = "" Region: id = 4677 start_va = 0xf210000 end_va = 0xf24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f210000" filename = "" Region: id = 4678 start_va = 0xf250000 end_va = 0xf34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f250000" filename = "" Region: id = 4679 start_va = 0x10990000 end_va = 0x109cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010990000" filename = "" Region: id = 4680 start_va = 0x109d0000 end_va = 0x10acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000109d0000" filename = "" Region: id = 4681 start_va = 0x1e8c0000 end_va = 0x1e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e8c0000" filename = "" Region: id = 4682 start_va = 0x1e900000 end_va = 0x1e9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e900000" filename = "" Region: id = 4683 start_va = 0x1ea00000 end_va = 0x1ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ea00000" filename = "" Region: id = 4684 start_va = 0x1ea40000 end_va = 0x1eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ea40000" filename = "" Region: id = 4685 start_va = 0x1eb40000 end_va = 0x1eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eb40000" filename = "" Region: id = 4686 start_va = 0x1eb80000 end_va = 0x1ec7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eb80000" filename = "" Region: id = 4687 start_va = 0x1ec80000 end_va = 0x1ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ec80000" filename = "" Region: id = 4688 start_va = 0x1ecc0000 end_va = 0x1edbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ecc0000" filename = "" Region: id = 4689 start_va = 0x1edc0000 end_va = 0x1edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001edc0000" filename = "" Region: id = 4690 start_va = 0x1ee00000 end_va = 0x1eefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ee00000" filename = "" Region: id = 4691 start_va = 0x1ef00000 end_va = 0x1ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ef00000" filename = "" Region: id = 4692 start_va = 0x1ef40000 end_va = 0x1f03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ef40000" filename = "" Region: id = 4693 start_va = 0x1f040000 end_va = 0x1f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f040000" filename = "" Region: id = 4694 start_va = 0x1f080000 end_va = 0x1f17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f080000" filename = "" Region: id = 4695 start_va = 0x1f180000 end_va = 0x1f1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f180000" filename = "" Region: id = 4696 start_va = 0x1f1c0000 end_va = 0x1f2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f1c0000" filename = "" Region: id = 4697 start_va = 0x1f2c0000 end_va = 0x1f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f2c0000" filename = "" Region: id = 4698 start_va = 0x1f300000 end_va = 0x1f3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f300000" filename = "" Region: id = 4699 start_va = 0x1f400000 end_va = 0x1f43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f400000" filename = "" Region: id = 4700 start_va = 0x1f440000 end_va = 0x1f53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f440000" filename = "" Region: id = 4701 start_va = 0x1f540000 end_va = 0x1f57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f540000" filename = "" Region: id = 4702 start_va = 0x1f580000 end_va = 0x1f67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f580000" filename = "" Region: id = 4703 start_va = 0x1f680000 end_va = 0x1f6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f680000" filename = "" Region: id = 4704 start_va = 0x1f6c0000 end_va = 0x1f7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f6c0000" filename = "" Region: id = 4705 start_va = 0x1f7c0000 end_va = 0x1f7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f7c0000" filename = "" Region: id = 4706 start_va = 0x1f800000 end_va = 0x1f8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f800000" filename = "" Region: id = 4707 start_va = 0x1f900000 end_va = 0x1f93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f900000" filename = "" Region: id = 4708 start_va = 0x1f940000 end_va = 0x1fa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f940000" filename = "" Region: id = 4709 start_va = 0x1fa40000 end_va = 0x1fa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fa40000" filename = "" Region: id = 4710 start_va = 0x1fa80000 end_va = 0x1fb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fa80000" filename = "" Region: id = 4711 start_va = 0x1fb80000 end_va = 0x1fbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fb80000" filename = "" Region: id = 4712 start_va = 0x1fbc0000 end_va = 0x1fcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fbc0000" filename = "" Region: id = 4713 start_va = 0x1fcc0000 end_va = 0x1fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fcc0000" filename = "" Region: id = 4714 start_va = 0x1fd00000 end_va = 0x1fdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fd00000" filename = "" Region: id = 4715 start_va = 0x1fe00000 end_va = 0x1fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fe00000" filename = "" Region: id = 4716 start_va = 0x1fe40000 end_va = 0x1ff3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001fe40000" filename = "" Region: id = 4717 start_va = 0x1ff40000 end_va = 0x1ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ff40000" filename = "" Region: id = 4718 start_va = 0x1ff80000 end_va = 0x2007ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ff80000" filename = "" Region: id = 4719 start_va = 0x20080000 end_va = 0x200bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020080000" filename = "" Region: id = 4720 start_va = 0x200c0000 end_va = 0x201bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000200c0000" filename = "" Region: id = 4721 start_va = 0x201c0000 end_va = 0x201fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000201c0000" filename = "" Region: id = 4722 start_va = 0x20200000 end_va = 0x202fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020200000" filename = "" Region: id = 4723 start_va = 0x20300000 end_va = 0x2033ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020300000" filename = "" Region: id = 4724 start_va = 0x20340000 end_va = 0x2043ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020340000" filename = "" Region: id = 4725 start_va = 0x20440000 end_va = 0x2047ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020440000" filename = "" Region: id = 4726 start_va = 0x20480000 end_va = 0x204bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020480000" filename = "" Region: id = 4727 start_va = 0x204c0000 end_va = 0x205bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000204c0000" filename = "" Region: id = 4728 start_va = 0x205c0000 end_va = 0x205fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000205c0000" filename = "" Region: id = 4729 start_va = 0x20600000 end_va = 0x206fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020600000" filename = "" Region: id = 4730 start_va = 0x20700000 end_va = 0x2073ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020700000" filename = "" Region: id = 4731 start_va = 0x20740000 end_va = 0x2083ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020740000" filename = "" Region: id = 4732 start_va = 0x20840000 end_va = 0x2087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020840000" filename = "" Region: id = 4733 start_va = 0x20880000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 4734 start_va = 0x20980000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020980000" filename = "" Region: id = 4735 start_va = 0x209c0000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000209c0000" filename = "" Region: id = 4736 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4737 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4738 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4739 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4740 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4741 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4742 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4743 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4744 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4745 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4746 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4747 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4748 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4749 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4750 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4751 start_va = 0xcf10000 end_va = 0xcf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 4752 start_va = 0xcf50000 end_va = 0xd04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 4753 start_va = 0xd050000 end_va = 0xd08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 4754 start_va = 0x20ac0000 end_va = 0x20bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ac0000" filename = "" Region: id = 4755 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4756 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4757 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4758 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4759 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4760 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4761 start_va = 0xd090000 end_va = 0xd0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 4762 start_va = 0xd0d0000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 4763 start_va = 0xd1d0000 end_va = 0xd20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 4764 start_va = 0xd210000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 4765 start_va = 0xd310000 end_va = 0xd34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 4766 start_va = 0xd350000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d350000" filename = "" Region: id = 4767 start_va = 0xd450000 end_va = 0xd48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 4768 start_va = 0xd490000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 4769 start_va = 0xd590000 end_va = 0xd5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 4770 start_va = 0xd5d0000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d5d0000" filename = "" Region: id = 4771 start_va = 0xd6d0000 end_va = 0xd70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 4772 start_va = 0xd710000 end_va = 0xd74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d710000" filename = "" Region: id = 4773 start_va = 0xd750000 end_va = 0xd78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d750000" filename = "" Region: id = 4774 start_va = 0xd910000 end_va = 0xda0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 4775 start_va = 0xdb90000 end_va = 0xdc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 4776 start_va = 0x20840000 end_va = 0x2093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020840000" filename = "" Region: id = 4777 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4778 start_va = 0xd790000 end_va = 0xd7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d790000" filename = "" Region: id = 4779 start_va = 0xda10000 end_va = 0xda4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da10000" filename = "" Region: id = 4780 start_va = 0xdc90000 end_va = 0xdccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dc90000" filename = "" Region: id = 4781 start_va = 0x20940000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020940000" filename = "" Region: id = 4782 start_va = 0x20bc0000 end_va = 0x20cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020bc0000" filename = "" Region: id = 4783 start_va = 0x20cc0000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020cc0000" filename = "" Region: id = 4784 start_va = 0x20dc0000 end_va = 0x20ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020dc0000" filename = "" Region: id = 4785 start_va = 0x20ec0000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 4786 start_va = 0x20fc0000 end_va = 0x20ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 4787 start_va = 0x21000000 end_va = 0x210fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021000000" filename = "" Region: id = 4788 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4789 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4790 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4791 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4792 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4793 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4794 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4795 start_va = 0xd7d0000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 4796 start_va = 0xd810000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 4797 start_va = 0x21100000 end_va = 0x2113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021100000" filename = "" Region: id = 4798 start_va = 0x21140000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021140000" filename = "" Region: id = 4799 start_va = 0x21240000 end_va = 0x2127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021240000" filename = "" Region: id = 4800 start_va = 0x21280000 end_va = 0x2137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021280000" filename = "" Region: id = 4801 start_va = 0x21380000 end_va = 0x213bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 4802 start_va = 0x213c0000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000213c0000" filename = "" Region: id = 4803 start_va = 0x214c0000 end_va = 0x214fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000214c0000" filename = "" Region: id = 4804 start_va = 0x21500000 end_va = 0x215fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021500000" filename = "" Region: id = 4805 start_va = 0x21600000 end_va = 0x2163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021600000" filename = "" Region: id = 4806 start_va = 0x21640000 end_va = 0x2173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021640000" filename = "" Region: id = 4807 start_va = 0x21740000 end_va = 0x2177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021740000" filename = "" Region: id = 4808 start_va = 0x21780000 end_va = 0x2187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021780000" filename = "" Region: id = 4809 start_va = 0x21880000 end_va = 0x218bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021880000" filename = "" Region: id = 4810 start_va = 0x218c0000 end_va = 0x219bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000218c0000" filename = "" Region: id = 4811 start_va = 0x219c0000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000219c0000" filename = "" Region: id = 4812 start_va = 0x21a00000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 4813 start_va = 0x21b00000 end_va = 0x21b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b00000" filename = "" Region: id = 4814 start_va = 0x21b40000 end_va = 0x21c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b40000" filename = "" Region: id = 4815 start_va = 0x21c40000 end_va = 0x21c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 4816 start_va = 0x21c80000 end_va = 0x21d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c80000" filename = "" Region: id = 4817 start_va = 0x21d80000 end_va = 0x21dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d80000" filename = "" Region: id = 4818 start_va = 0x21dc0000 end_va = 0x21ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021dc0000" filename = "" Region: id = 4819 start_va = 0x21ec0000 end_va = 0x21efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ec0000" filename = "" Region: id = 4820 start_va = 0x21f00000 end_va = 0x21ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f00000" filename = "" Region: id = 4821 start_va = 0x22000000 end_va = 0x2203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022000000" filename = "" Region: id = 4822 start_va = 0x22040000 end_va = 0x2213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022040000" filename = "" Region: id = 4823 start_va = 0x22140000 end_va = 0x2223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022140000" filename = "" Region: id = 4824 start_va = 0x22240000 end_va = 0x2227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022240000" filename = "" Region: id = 4825 start_va = 0x22280000 end_va = 0x2237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022280000" filename = "" Region: id = 4826 start_va = 0x22380000 end_va = 0x223bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022380000" filename = "" Region: id = 4827 start_va = 0x223c0000 end_va = 0x224bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000223c0000" filename = "" Region: id = 4828 start_va = 0x224c0000 end_va = 0x224fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000224c0000" filename = "" Region: id = 4829 start_va = 0x22500000 end_va = 0x225fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022500000" filename = "" Region: id = 4830 start_va = 0x22600000 end_va = 0x2263ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022600000" filename = "" Region: id = 4831 start_va = 0x22640000 end_va = 0x2273ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022640000" filename = "" Region: id = 4832 start_va = 0x22740000 end_va = 0x2277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022740000" filename = "" Region: id = 4833 start_va = 0x22780000 end_va = 0x2287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022780000" filename = "" Region: id = 4834 start_va = 0x22880000 end_va = 0x228bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022880000" filename = "" Region: id = 4835 start_va = 0x228c0000 end_va = 0x229bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000228c0000" filename = "" Region: id = 4836 start_va = 0x229c0000 end_va = 0x229fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000229c0000" filename = "" Region: id = 4837 start_va = 0x22a00000 end_va = 0x22afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022a00000" filename = "" Region: id = 4838 start_va = 0x22b00000 end_va = 0x22b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022b00000" filename = "" Region: id = 4839 start_va = 0x22b40000 end_va = 0x22c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022b40000" filename = "" Region: id = 4840 start_va = 0x22c40000 end_va = 0x22c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022c40000" filename = "" Region: id = 4841 start_va = 0x22c80000 end_va = 0x22d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022c80000" filename = "" Region: id = 4842 start_va = 0x22d80000 end_va = 0x22dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022d80000" filename = "" Region: id = 4843 start_va = 0x22dc0000 end_va = 0x22ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022dc0000" filename = "" Region: id = 4844 start_va = 0x22ec0000 end_va = 0x22efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022ec0000" filename = "" Region: id = 4845 start_va = 0x22f00000 end_va = 0x22ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022f00000" filename = "" Region: id = 4846 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4847 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4848 start_va = 0x23000000 end_va = 0x2303ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023000000" filename = "" Region: id = 4849 start_va = 0x23040000 end_va = 0x2313ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023040000" filename = "" Region: id = 4850 start_va = 0x23140000 end_va = 0x2317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023140000" filename = "" Region: id = 4851 start_va = 0x23180000 end_va = 0x2327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023180000" filename = "" Region: id = 4852 start_va = 0x23280000 end_va = 0x232bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023280000" filename = "" Region: id = 4853 start_va = 0x232c0000 end_va = 0x233bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000232c0000" filename = "" Region: id = 4854 start_va = 0x233c0000 end_va = 0x233fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000233c0000" filename = "" Region: id = 4855 start_va = 0x23400000 end_va = 0x234fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023400000" filename = "" Region: id = 4856 start_va = 0x23500000 end_va = 0x2353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023500000" filename = "" Region: id = 4857 start_va = 0x23540000 end_va = 0x2363ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023540000" filename = "" Region: id = 4858 start_va = 0x23640000 end_va = 0x2367ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023640000" filename = "" Region: id = 4859 start_va = 0x23680000 end_va = 0x2377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023680000" filename = "" Region: id = 4860 start_va = 0x23780000 end_va = 0x237bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023780000" filename = "" Region: id = 4861 start_va = 0x237c0000 end_va = 0x238bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000237c0000" filename = "" Region: id = 4862 start_va = 0x238c0000 end_va = 0x238fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000238c0000" filename = "" Region: id = 4863 start_va = 0x23900000 end_va = 0x239fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023900000" filename = "" Region: id = 4864 start_va = 0x23a00000 end_va = 0x23a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a00000" filename = "" Region: id = 4865 start_va = 0x23a40000 end_va = 0x23b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a40000" filename = "" Region: id = 4866 start_va = 0x23b40000 end_va = 0x23b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023b40000" filename = "" Region: id = 4867 start_va = 0x23b80000 end_va = 0x23c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023b80000" filename = "" Region: id = 4868 start_va = 0x23c80000 end_va = 0x23cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023c80000" filename = "" Region: id = 4869 start_va = 0x23cc0000 end_va = 0x23dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023cc0000" filename = "" Region: id = 4870 start_va = 0x23dc0000 end_va = 0x23dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023dc0000" filename = "" Region: id = 4871 start_va = 0x23e00000 end_va = 0x23efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e00000" filename = "" Region: id = 4872 start_va = 0x23f00000 end_va = 0x23f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023f00000" filename = "" Region: id = 4873 start_va = 0x23f40000 end_va = 0x2403ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023f40000" filename = "" Region: id = 4874 start_va = 0x24040000 end_va = 0x2407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024040000" filename = "" Region: id = 4875 start_va = 0x24080000 end_va = 0x2417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024080000" filename = "" Region: id = 4876 start_va = 0x24180000 end_va = 0x241bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024180000" filename = "" Region: id = 4877 start_va = 0x241c0000 end_va = 0x242bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000241c0000" filename = "" Region: id = 4878 start_va = 0x242c0000 end_va = 0x242fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000242c0000" filename = "" Region: id = 4879 start_va = 0x24300000 end_va = 0x243fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024300000" filename = "" Region: id = 4880 start_va = 0x24400000 end_va = 0x2443ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024400000" filename = "" Region: id = 4881 start_va = 0x24440000 end_va = 0x2453ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024440000" filename = "" Region: id = 4882 start_va = 0x24540000 end_va = 0x2457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024540000" filename = "" Region: id = 4883 start_va = 0x24580000 end_va = 0x2467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024580000" filename = "" Region: id = 4884 start_va = 0x24680000 end_va = 0x246bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024680000" filename = "" Region: id = 4885 start_va = 0x246c0000 end_va = 0x247bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000246c0000" filename = "" Region: id = 4886 start_va = 0x247c0000 end_va = 0x247fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000247c0000" filename = "" Region: id = 4887 start_va = 0x24800000 end_va = 0x248fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024800000" filename = "" Region: id = 4888 start_va = 0x24900000 end_va = 0x2493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024900000" filename = "" Region: id = 4889 start_va = 0x24940000 end_va = 0x24a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024940000" filename = "" Region: id = 4890 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4891 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4892 start_va = 0x24a40000 end_va = 0x24a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024a40000" filename = "" Region: id = 4893 start_va = 0x24a80000 end_va = 0x24b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024a80000" filename = "" Region: id = 4894 start_va = 0x24b80000 end_va = 0x24bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024b80000" filename = "" Region: id = 4895 start_va = 0x24bc0000 end_va = 0x24cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024bc0000" filename = "" Region: id = 4896 start_va = 0x24cc0000 end_va = 0x24cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024cc0000" filename = "" Region: id = 4897 start_va = 0x24d00000 end_va = 0x24dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024d00000" filename = "" Region: id = 4898 start_va = 0x24e00000 end_va = 0x24e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024e00000" filename = "" Region: id = 4899 start_va = 0x24e40000 end_va = 0x24f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024e40000" filename = "" Region: id = 4900 start_va = 0x24f40000 end_va = 0x24f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024f40000" filename = "" Region: id = 4901 start_va = 0x24f80000 end_va = 0x2507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024f80000" filename = "" Region: id = 4902 start_va = 0x25080000 end_va = 0x250bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025080000" filename = "" Region: id = 4903 start_va = 0x250c0000 end_va = 0x251bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000250c0000" filename = "" Region: id = 4904 start_va = 0x251c0000 end_va = 0x251fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000251c0000" filename = "" Region: id = 4905 start_va = 0x25200000 end_va = 0x253fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025200000" filename = "" Region: id = 4906 start_va = 0x25400000 end_va = 0x254fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025400000" filename = "" Region: id = 4907 start_va = 0x25500000 end_va = 0x2553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025500000" filename = "" Region: id = 4908 start_va = 0x25540000 end_va = 0x2563ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025540000" filename = "" Region: id = 4909 start_va = 0x25640000 end_va = 0x2567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025640000" filename = "" Region: id = 4910 start_va = 0x25680000 end_va = 0x2577ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025680000" filename = "" Region: id = 4911 start_va = 0x25780000 end_va = 0x257bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025780000" filename = "" Region: id = 4912 start_va = 0x257c0000 end_va = 0x258bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000257c0000" filename = "" Region: id = 4913 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4914 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4915 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4916 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4917 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4918 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4919 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4920 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4921 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4922 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4923 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4924 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4925 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4926 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4927 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4928 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4929 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4930 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4931 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4932 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4933 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4934 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4935 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4936 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4937 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4938 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4939 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4940 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4941 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4942 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4943 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4944 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4945 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4946 start_va = 0xda50000 end_va = 0xda50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 4947 start_va = 0xda60000 end_va = 0xda60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da60000" filename = "" Region: id = 4948 start_va = 0xda70000 end_va = 0xda70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da70000" filename = "" Region: id = 4949 start_va = 0xda80000 end_va = 0xda80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da80000" filename = "" Region: id = 4950 start_va = 0xda90000 end_va = 0xda90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 4951 start_va = 0xdaa0000 end_va = 0xdaa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000daa0000" filename = "" Region: id = 4952 start_va = 0xdab0000 end_va = 0xdab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dab0000" filename = "" Region: id = 4953 start_va = 0xdac0000 end_va = 0xdac0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dac0000" filename = "" Region: id = 4954 start_va = 0xdad0000 end_va = 0xdad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 4955 start_va = 0xdad0000 end_va = 0xdad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 4956 start_va = 0xdad0000 end_va = 0xdad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 4957 start_va = 0xdad0000 end_va = 0xdad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 4958 start_va = 0xdae0000 end_va = 0xdae0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dae0000" filename = "" Region: id = 4959 start_va = 0xdaf0000 end_va = 0xdaf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000daf0000" filename = "" Region: id = 4960 start_va = 0xdb00000 end_va = 0xdb00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db00000" filename = "" Region: id = 4961 start_va = 0xdb10000 end_va = 0xdb10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db10000" filename = "" Region: id = 4962 start_va = 0xdb20000 end_va = 0xdb20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db20000" filename = "" Region: id = 4963 start_va = 0xdb30000 end_va = 0xdb30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db30000" filename = "" Region: id = 4964 start_va = 0xdb40000 end_va = 0xdb40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db40000" filename = "" Region: id = 4965 start_va = 0xdb50000 end_va = 0xdb50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db50000" filename = "" Region: id = 4966 start_va = 0xdb60000 end_va = 0xdb60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db60000" filename = "" Region: id = 4967 start_va = 0xdb70000 end_va = 0xdb70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db70000" filename = "" Region: id = 4968 start_va = 0xdb80000 end_va = 0xdb80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db80000" filename = "" Region: id = 4969 start_va = 0xe090000 end_va = 0xe090fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 4970 start_va = 0xe0a0000 end_va = 0xe0a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0a0000" filename = "" Region: id = 4971 start_va = 0xe0b0000 end_va = 0xe0b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0b0000" filename = "" Region: id = 4972 start_va = 0xe0c0000 end_va = 0xe0c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0c0000" filename = "" Region: id = 4973 start_va = 0xe0d0000 end_va = 0xe0d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 4974 start_va = 0xd6d0000 end_va = 0xd6d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 4975 start_va = 0xd6d0000 end_va = 0xd70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 4976 start_va = 0xd910000 end_va = 0xda0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 4977 start_va = 0xdad0000 end_va = 0xdad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 4978 start_va = 0xe0d0000 end_va = 0xe10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 4979 start_va = 0xe110000 end_va = 0xe20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 4980 start_va = 0xe210000 end_va = 0xe24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e210000" filename = "" Region: id = 4981 start_va = 0xe250000 end_va = 0xe34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e250000" filename = "" Region: id = 4982 start_va = 0xe350000 end_va = 0xe38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e350000" filename = "" Region: id = 4983 start_va = 0xe390000 end_va = 0xe3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e390000" filename = "" Region: id = 4984 start_va = 0xe3d0000 end_va = 0xe40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e3d0000" filename = "" Region: id = 4985 start_va = 0xe410000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e410000" filename = "" Region: id = 4986 start_va = 0x21240000 end_va = 0x2133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021240000" filename = "" Region: id = 4987 start_va = 0x21340000 end_va = 0x2137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021340000" filename = "" Region: id = 4988 start_va = 0x258c0000 end_va = 0x259bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000258c0000" filename = "" Region: id = 4989 start_va = 0x259c0000 end_va = 0x25abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000259c0000" filename = "" Region: id = 4990 start_va = 0x25ac0000 end_va = 0x25bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025ac0000" filename = "" Region: id = 4991 start_va = 0x25bc0000 end_va = 0x25cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025bc0000" filename = "" Region: id = 4992 start_va = 0x25cc0000 end_va = 0x25cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025cc0000" filename = "" Region: id = 4993 start_va = 0x25d00000 end_va = 0x25dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025d00000" filename = "" Region: id = 4994 start_va = 0x25e00000 end_va = 0x25e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025e00000" filename = "" Region: id = 4995 start_va = 0x25e40000 end_va = 0x25f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025e40000" filename = "" Region: id = 4996 start_va = 0x25f40000 end_va = 0x25f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025f40000" filename = "" Region: id = 4997 start_va = 0x25f80000 end_va = 0x2607ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025f80000" filename = "" Region: id = 4998 start_va = 0x26080000 end_va = 0x260bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026080000" filename = "" Region: id = 4999 start_va = 0x260c0000 end_va = 0x261bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000260c0000" filename = "" Region: id = 5000 start_va = 0x261c0000 end_va = 0x261fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000261c0000" filename = "" Region: id = 5001 start_va = 0x26200000 end_va = 0x262fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026200000" filename = "" Region: id = 5002 start_va = 0x26300000 end_va = 0x2633ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026300000" filename = "" Region: id = 5003 start_va = 0x26340000 end_va = 0x2643ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026340000" filename = "" Region: id = 5004 start_va = 0x26440000 end_va = 0x2647ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026440000" filename = "" Region: id = 5005 start_va = 0x26480000 end_va = 0x2657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026480000" filename = "" Region: id = 5006 start_va = 0x26580000 end_va = 0x265bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026580000" filename = "" Region: id = 5007 start_va = 0x265c0000 end_va = 0x266bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000265c0000" filename = "" Region: id = 5008 start_va = 0x266c0000 end_va = 0x266fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000266c0000" filename = "" Region: id = 5009 start_va = 0x26700000 end_va = 0x267fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026700000" filename = "" Region: id = 5010 start_va = 0x26800000 end_va = 0x2683ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026800000" filename = "" Region: id = 5011 start_va = 0x26840000 end_va = 0x2693ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026840000" filename = "" Region: id = 5012 start_va = 0x26940000 end_va = 0x2697ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026940000" filename = "" Region: id = 5013 start_va = 0x26980000 end_va = 0x26a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026980000" filename = "" Region: id = 5014 start_va = 0x26a80000 end_va = 0x26abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026a80000" filename = "" Region: id = 5015 start_va = 0x26ac0000 end_va = 0x26bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026ac0000" filename = "" Region: id = 5016 start_va = 0x26bc0000 end_va = 0x26bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026bc0000" filename = "" Region: id = 5017 start_va = 0x26c00000 end_va = 0x26cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026c00000" filename = "" Region: id = 5018 start_va = 0x26d00000 end_va = 0x26d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026d00000" filename = "" Region: id = 5019 start_va = 0x26d40000 end_va = 0x26e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026d40000" filename = "" Region: id = 5020 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5021 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5022 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5023 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5024 start_va = 0xd090000 end_va = 0xd0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 5025 start_va = 0xd0d0000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 5026 start_va = 0xd310000 end_va = 0xd34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 5027 start_va = 0xd350000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d350000" filename = "" Region: id = 5028 start_va = 0xd450000 end_va = 0xd48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 5029 start_va = 0xd490000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 5030 start_va = 0xd590000 end_va = 0xd5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 5031 start_va = 0xd5d0000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d5d0000" filename = "" Region: id = 5032 start_va = 0xd710000 end_va = 0xd74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d710000" filename = "" Region: id = 5033 start_va = 0xd750000 end_va = 0xd84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d750000" filename = "" Region: id = 5034 start_va = 0xd850000 end_va = 0xd88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d850000" filename = "" Region: id = 5035 start_va = 0xd890000 end_va = 0xd8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d890000" filename = "" Region: id = 5036 start_va = 0xd8d0000 end_va = 0xd90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d8d0000" filename = "" Region: id = 5037 start_va = 0xda10000 end_va = 0xdb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da10000" filename = "" Region: id = 5038 start_va = 0xdb10000 end_va = 0xdc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000db10000" filename = "" Region: id = 5039 start_va = 0xdc10000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 5040 start_va = 0xdd10000 end_va = 0xdd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 5041 start_va = 0xdd50000 end_va = 0xdd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd50000" filename = "" Region: id = 5042 start_va = 0xdd90000 end_va = 0xddcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 5043 start_va = 0xddd0000 end_va = 0xde0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ddd0000" filename = "" Region: id = 5044 start_va = 0xe090000 end_va = 0xe0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 5045 start_va = 0x20480000 end_va = 0x2057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020480000" filename = "" Region: id = 5046 start_va = 0x20580000 end_va = 0x2067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020580000" filename = "" Region: id = 5047 start_va = 0x20680000 end_va = 0x2077ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020680000" filename = "" Region: id = 5048 start_va = 0x20780000 end_va = 0x2087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020780000" filename = "" Region: id = 5049 start_va = 0x20880000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 5050 start_va = 0x20980000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020980000" filename = "" Region: id = 5051 start_va = 0x209c0000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000209c0000" filename = "" Region: id = 5052 start_va = 0x20bc0000 end_va = 0x20bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020bc0000" filename = "" Region: id = 5053 start_va = 0x20c00000 end_va = 0x20cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020c00000" filename = "" Region: id = 5054 start_va = 0x20d00000 end_va = 0x20d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020d00000" filename = "" Region: id = 5055 start_va = 0x20d40000 end_va = 0x20e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020d40000" filename = "" Region: id = 5056 start_va = 0x20e40000 end_va = 0x20e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020e40000" filename = "" Region: id = 5057 start_va = 0x20e80000 end_va = 0x20f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020e80000" filename = "" Region: id = 5058 start_va = 0x20f80000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020f80000" filename = "" Region: id = 5059 start_va = 0x20fc0000 end_va = 0x210bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 5060 start_va = 0x210c0000 end_va = 0x210fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000210c0000" filename = "" Region: id = 5061 start_va = 0x21100000 end_va = 0x211fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021100000" filename = "" Region: id = 5062 start_va = 0x21200000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021200000" filename = "" Region: id = 5063 start_va = 0x21380000 end_va = 0x2147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 5064 start_va = 0x21480000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021480000" filename = "" Region: id = 5065 start_va = 0x214c0000 end_va = 0x215bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000214c0000" filename = "" Region: id = 5066 start_va = 0x215c0000 end_va = 0x215fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000215c0000" filename = "" Region: id = 5067 start_va = 0x21600000 end_va = 0x216fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021600000" filename = "" Region: id = 5068 start_va = 0x21700000 end_va = 0x2173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021700000" filename = "" Region: id = 5069 start_va = 0x21740000 end_va = 0x2183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021740000" filename = "" Region: id = 5070 start_va = 0x21840000 end_va = 0x2187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021840000" filename = "" Region: id = 5071 start_va = 0x21880000 end_va = 0x2197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021880000" filename = "" Region: id = 5072 start_va = 0x21980000 end_va = 0x219bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021980000" filename = "" Region: id = 5073 start_va = 0x219c0000 end_va = 0x21abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000219c0000" filename = "" Region: id = 5074 start_va = 0x21ac0000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ac0000" filename = "" Region: id = 5075 start_va = 0x21b00000 end_va = 0x21bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b00000" filename = "" Region: id = 5076 start_va = 0x21c00000 end_va = 0x21c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c00000" filename = "" Region: id = 5077 start_va = 0x21c40000 end_va = 0x21d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 5078 start_va = 0x21d40000 end_va = 0x21d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d40000" filename = "" Region: id = 5079 start_va = 0x21d80000 end_va = 0x21e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d80000" filename = "" Region: id = 5080 start_va = 0x21e80000 end_va = 0x21ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e80000" filename = "" Region: id = 5081 start_va = 0x21ec0000 end_va = 0x21fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ec0000" filename = "" Region: id = 5082 start_va = 0x21fc0000 end_va = 0x21ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021fc0000" filename = "" Region: id = 5083 start_va = 0x22000000 end_va = 0x220fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022000000" filename = "" Region: id = 5084 start_va = 0x22100000 end_va = 0x2213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022100000" filename = "" Region: id = 5085 start_va = 0x26e40000 end_va = 0x26f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026e40000" filename = "" Region: id = 5086 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5087 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5088 start_va = 0x26f40000 end_va = 0x26f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026f40000" filename = "" Region: id = 5089 start_va = 0x26f80000 end_va = 0x2707ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026f80000" filename = "" Region: id = 5090 start_va = 0x27080000 end_va = 0x270bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027080000" filename = "" Region: id = 5091 start_va = 0x270c0000 end_va = 0x271bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000270c0000" filename = "" Region: id = 5092 start_va = 0x271c0000 end_va = 0x271fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000271c0000" filename = "" Region: id = 5093 start_va = 0x27200000 end_va = 0x272fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027200000" filename = "" Region: id = 5094 start_va = 0x27300000 end_va = 0x2733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027300000" filename = "" Region: id = 5095 start_va = 0x27340000 end_va = 0x2743ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027340000" filename = "" Region: id = 5096 start_va = 0x27440000 end_va = 0x2747ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027440000" filename = "" Region: id = 5097 start_va = 0x27480000 end_va = 0x2757ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027480000" filename = "" Region: id = 5098 start_va = 0x27580000 end_va = 0x275bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027580000" filename = "" Region: id = 5099 start_va = 0x275c0000 end_va = 0x276bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000275c0000" filename = "" Region: id = 5100 start_va = 0x276c0000 end_va = 0x276fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000276c0000" filename = "" Region: id = 5101 start_va = 0x27700000 end_va = 0x277fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027700000" filename = "" Region: id = 5102 start_va = 0x27800000 end_va = 0x2783ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027800000" filename = "" Region: id = 5103 start_va = 0x27840000 end_va = 0x2793ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027840000" filename = "" Region: id = 5104 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5105 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5106 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5107 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5108 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5109 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5110 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5111 start_va = 0x27940000 end_va = 0x2797ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027940000" filename = "" Region: id = 5112 start_va = 0x27980000 end_va = 0x27a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027980000" filename = "" Region: id = 5113 start_va = 0x27a80000 end_va = 0x27abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027a80000" filename = "" Region: id = 5114 start_va = 0x27ac0000 end_va = 0x27bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027ac0000" filename = "" Region: id = 5115 start_va = 0x27bc0000 end_va = 0x27bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027bc0000" filename = "" Region: id = 5116 start_va = 0x27c00000 end_va = 0x27cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027c00000" filename = "" Region: id = 5117 start_va = 0x27d00000 end_va = 0x27d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027d00000" filename = "" Region: id = 5118 start_va = 0x27d40000 end_va = 0x27e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027d40000" filename = "" Region: id = 5119 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5120 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5121 start_va = 0x27e40000 end_va = 0x27e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027e40000" filename = "" Region: id = 5122 start_va = 0x27e80000 end_va = 0x27f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027e80000" filename = "" Region: id = 5123 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5124 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5125 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5126 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5127 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5128 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5129 start_va = 0x17bf0000 end_va = 0x17bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bf0000" filename = "" Region: id = 5130 start_va = 0x27f80000 end_va = 0x27f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027f80000" filename = "" Region: id = 5131 start_va = 0x27f90000 end_va = 0x27f90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027f90000" filename = "" Region: id = 5132 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5133 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5134 start_va = 0x23280000 end_va = 0x232bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023280000" filename = "" Region: id = 5135 start_va = 0x232c0000 end_va = 0x233bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000232c0000" filename = "" Region: id = 5136 start_va = 0x233c0000 end_va = 0x233fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000233c0000" filename = "" Region: id = 5137 start_va = 0x23400000 end_va = 0x234fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023400000" filename = "" Region: id = 5138 start_va = 0x238c0000 end_va = 0x238fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000238c0000" filename = "" Region: id = 5139 start_va = 0x23900000 end_va = 0x239fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023900000" filename = "" Region: id = 5140 start_va = 0x23a00000 end_va = 0x23a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a00000" filename = "" Region: id = 5141 start_va = 0x23a40000 end_va = 0x23b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a40000" filename = "" Region: id = 5142 start_va = 0x23dc0000 end_va = 0x23dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023dc0000" filename = "" Region: id = 5143 start_va = 0x23e00000 end_va = 0x23efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e00000" filename = "" Region: id = 5144 start_va = 0x27f80000 end_va = 0x27fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027f80000" filename = "" Region: id = 5145 start_va = 0x27fc0000 end_va = 0x280bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027fc0000" filename = "" Region: id = 5146 start_va = 0x280c0000 end_va = 0x280fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000280c0000" filename = "" Region: id = 5147 start_va = 0x28100000 end_va = 0x281fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028100000" filename = "" Region: id = 5148 start_va = 0x28200000 end_va = 0x2823ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028200000" filename = "" Region: id = 5149 start_va = 0x28240000 end_va = 0x2833ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028240000" filename = "" Region: id = 5150 start_va = 0x28340000 end_va = 0x2837ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028340000" filename = "" Region: id = 5151 start_va = 0x28380000 end_va = 0x2847ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028380000" filename = "" Region: id = 5152 start_va = 0x28480000 end_va = 0x284bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028480000" filename = "" Region: id = 5153 start_va = 0x284c0000 end_va = 0x285bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000284c0000" filename = "" Region: id = 5154 start_va = 0x285c0000 end_va = 0x285fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000285c0000" filename = "" Region: id = 5155 start_va = 0x28600000 end_va = 0x286fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028600000" filename = "" Region: id = 5156 start_va = 0x28700000 end_va = 0x2873ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028700000" filename = "" Region: id = 5157 start_va = 0x28740000 end_va = 0x2883ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028740000" filename = "" Region: id = 5158 start_va = 0x28840000 end_va = 0x2887ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028840000" filename = "" Region: id = 5159 start_va = 0x28880000 end_va = 0x2897ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028880000" filename = "" Region: id = 5160 start_va = 0x28980000 end_va = 0x289bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028980000" filename = "" Region: id = 5161 start_va = 0x289c0000 end_va = 0x28abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000289c0000" filename = "" Region: id = 5162 start_va = 0x28ac0000 end_va = 0x28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028ac0000" filename = "" Region: id = 5163 start_va = 0x28b00000 end_va = 0x28bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028b00000" filename = "" Region: id = 5164 start_va = 0x28c00000 end_va = 0x28c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c00000" filename = "" Region: id = 5165 start_va = 0x28c40000 end_va = 0x28d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c40000" filename = "" Region: id = 5166 start_va = 0x28d40000 end_va = 0x28d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028d40000" filename = "" Region: id = 5167 start_va = 0x28d80000 end_va = 0x28e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028d80000" filename = "" Region: id = 5168 start_va = 0x28e80000 end_va = 0x28ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e80000" filename = "" Region: id = 5169 start_va = 0x28ec0000 end_va = 0x28fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028ec0000" filename = "" Region: id = 5170 start_va = 0x28fc0000 end_va = 0x28ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028fc0000" filename = "" Region: id = 5171 start_va = 0x29000000 end_va = 0x290fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029000000" filename = "" Region: id = 5172 start_va = 0x29100000 end_va = 0x2913ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029100000" filename = "" Region: id = 5173 start_va = 0x29140000 end_va = 0x2923ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029140000" filename = "" Region: id = 5174 start_va = 0x29240000 end_va = 0x2927ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029240000" filename = "" Region: id = 5175 start_va = 0x29280000 end_va = 0x2937ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029280000" filename = "" Region: id = 5176 start_va = 0x29380000 end_va = 0x293bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029380000" filename = "" Region: id = 5177 start_va = 0x293c0000 end_va = 0x294bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000293c0000" filename = "" Region: id = 5178 start_va = 0x294c0000 end_va = 0x294fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000294c0000" filename = "" Region: id = 5179 start_va = 0x29500000 end_va = 0x295fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029500000" filename = "" Region: id = 5180 start_va = 0x29600000 end_va = 0x2963ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029600000" filename = "" Region: id = 5181 start_va = 0x29640000 end_va = 0x2973ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029640000" filename = "" Region: id = 5182 start_va = 0x29740000 end_va = 0x2977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029740000" filename = "" Region: id = 5183 start_va = 0x29780000 end_va = 0x2987ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029780000" filename = "" Region: id = 5184 start_va = 0x29880000 end_va = 0x298bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029880000" filename = "" Region: id = 5185 start_va = 0x298c0000 end_va = 0x299bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000298c0000" filename = "" Region: id = 5186 start_va = 0x299c0000 end_va = 0x299fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000299c0000" filename = "" Region: id = 5187 start_va = 0x29a00000 end_va = 0x29afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a00000" filename = "" Region: id = 5188 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5189 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5190 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5191 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5192 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5193 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5194 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5195 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5196 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5197 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5198 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5199 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5200 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5201 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5202 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5203 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5204 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5205 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5206 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5207 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5208 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5209 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5210 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5211 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5212 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5213 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5214 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5215 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5216 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5217 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5218 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5219 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5220 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5221 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5222 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5223 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5224 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5225 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5226 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5227 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5228 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5229 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5230 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5231 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5232 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5233 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5234 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5235 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5236 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5237 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5238 start_va = 0xb750000 end_va = 0xb750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 5239 start_va = 0xb760000 end_va = 0xb760fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b760000" filename = "" Region: id = 5240 start_va = 0xb770000 end_va = 0xb770fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b770000" filename = "" Region: id = 5241 start_va = 0xb780000 end_va = 0xb780fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b780000" filename = "" Region: id = 5242 start_va = 0xb790000 end_va = 0xb790fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 5243 start_va = 0xb7a0000 end_va = 0xb7a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b7a0000" filename = "" Region: id = 5244 start_va = 0xb7b0000 end_va = 0xb7b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b7b0000" filename = "" Region: id = 5245 start_va = 0xb7c0000 end_va = 0xb7c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b7c0000" filename = "" Region: id = 5246 start_va = 0xb7d0000 end_va = 0xb7d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b7d0000" filename = "" Region: id = 5247 start_va = 0xb7e0000 end_va = 0xb7e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b7e0000" filename = "" Region: id = 5248 start_va = 0xb7f0000 end_va = 0xb7f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b7f0000" filename = "" Region: id = 5249 start_va = 0xb800000 end_va = 0xb800fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b800000" filename = "" Region: id = 5250 start_va = 0xb810000 end_va = 0xb810fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b810000" filename = "" Region: id = 5251 start_va = 0xb820000 end_va = 0xb820fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b820000" filename = "" Region: id = 5252 start_va = 0xb830000 end_va = 0xb830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b830000" filename = "" Region: id = 5253 start_va = 0xb840000 end_va = 0xb840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b840000" filename = "" Region: id = 5254 start_va = 0xb850000 end_va = 0xb850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b850000" filename = "" Region: id = 5255 start_va = 0xb860000 end_va = 0xb860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b860000" filename = "" Region: id = 5256 start_va = 0xb870000 end_va = 0xb870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b870000" filename = "" Region: id = 5257 start_va = 0xb880000 end_va = 0xb880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b880000" filename = "" Region: id = 5258 start_va = 0xd1d0000 end_va = 0xd1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 5259 start_va = 0xd1e0000 end_va = 0xd1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 5260 start_va = 0xd1f0000 end_va = 0xd1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1f0000" filename = "" Region: id = 5261 start_va = 0xd200000 end_va = 0xd200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d200000" filename = "" Region: id = 5262 start_va = 0xd210000 end_va = 0xd210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 5263 start_va = 0xd220000 end_va = 0xd220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d220000" filename = "" Region: id = 5264 start_va = 0xd230000 end_va = 0xd230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d230000" filename = "" Region: id = 5265 start_va = 0xd240000 end_va = 0xd240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d240000" filename = "" Region: id = 5266 start_va = 0xd250000 end_va = 0xd250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 5267 start_va = 0xd260000 end_va = 0xd260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 5268 start_va = 0xd270000 end_va = 0xd270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 5269 start_va = 0xd280000 end_va = 0xd280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 5270 start_va = 0xd280000 end_va = 0xd280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 5271 start_va = 0xd280000 end_va = 0xd280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 5272 start_va = 0xd280000 end_va = 0xd280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 5273 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5274 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5275 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5276 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5277 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5278 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5279 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5280 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5281 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5282 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5283 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5284 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5285 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5286 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5287 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5288 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5289 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5290 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5291 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5292 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5293 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5294 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5295 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5296 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5297 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5298 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5299 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5300 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5301 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5302 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5303 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5304 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5305 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5306 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5307 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5308 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5309 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5310 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5311 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5312 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5313 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5314 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5315 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5316 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5317 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5318 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5319 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5320 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5321 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5322 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5323 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5324 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5325 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5326 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5327 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5328 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5329 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5330 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5331 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5332 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5333 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 5334 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 5335 start_va = 0xd090000 end_va = 0xd0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 5336 start_va = 0xd0d0000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 5337 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5338 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5339 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5340 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5341 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5342 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5343 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5344 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5345 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5346 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5347 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5348 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5349 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5350 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5351 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5352 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5353 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5354 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5355 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5356 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5357 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5358 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5359 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5360 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5361 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5362 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5363 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5364 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5365 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5366 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5367 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5368 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5369 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5370 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5371 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5372 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5373 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5374 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5375 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5376 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5377 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5378 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5379 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5380 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5381 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5382 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5383 start_va = 0xd60000 end_va = 0xd60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 5384 start_va = 0xd70000 end_va = 0xd70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 5385 start_va = 0xd80000 end_va = 0xd80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 5386 start_va = 0xd80000 end_va = 0xd80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 5387 start_va = 0xd90000 end_va = 0xd90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 5388 start_va = 0xda0000 end_va = 0xda0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 5389 start_va = 0xdb0000 end_va = 0xdb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 5390 start_va = 0xdc0000 end_va = 0xdc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 5391 start_va = 0xdd0000 end_va = 0xdd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 5392 start_va = 0xde0000 end_va = 0xde0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 5393 start_va = 0xdf0000 end_va = 0xdf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 5394 start_va = 0xe00000 end_va = 0xe00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 5395 start_va = 0xe10000 end_va = 0xe10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 5396 start_va = 0xe20000 end_va = 0xe20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 5397 start_va = 0xe30000 end_va = 0xe30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 5398 start_va = 0xe40000 end_va = 0xe40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 5399 start_va = 0xe50000 end_va = 0xe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 5400 start_va = 0xe60000 end_va = 0xe60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 5401 start_va = 0xe70000 end_va = 0xe70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 5402 start_va = 0xe80000 end_va = 0xe80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 5403 start_va = 0xe90000 end_va = 0xe90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 5404 start_va = 0xd1d0000 end_va = 0xd1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 5405 start_va = 0xd1e0000 end_va = 0xd1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 5406 start_va = 0xd1f0000 end_va = 0xd1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1f0000" filename = "" Region: id = 5407 start_va = 0xd200000 end_va = 0xd200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d200000" filename = "" Region: id = 5408 start_va = 0xd210000 end_va = 0xd210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 5409 start_va = 0xd220000 end_va = 0xd220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d220000" filename = "" Region: id = 5410 start_va = 0xd230000 end_va = 0xd230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d230000" filename = "" Region: id = 5411 start_va = 0xd240000 end_va = 0xd240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d240000" filename = "" Region: id = 5412 start_va = 0xd250000 end_va = 0xd250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 5413 start_va = 0xd260000 end_va = 0xd260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 5414 start_va = 0xd270000 end_va = 0xd270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 5415 start_va = 0xd280000 end_va = 0xd280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 5416 start_va = 0xd290000 end_va = 0xd290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d290000" filename = "" Region: id = 5417 start_va = 0xd2a0000 end_va = 0xd2a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d2a0000" filename = "" Region: id = 5418 start_va = 0xd200000 end_va = 0xd200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d200000" filename = "" Region: id = 5419 start_va = 0xd200000 end_va = 0xd200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d200000" filename = "" Region: id = 5420 start_va = 0xda0000 end_va = 0xda0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 5421 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5422 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5423 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 5424 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 5425 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 5426 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 5427 start_va = 0xd1d0000 end_va = 0xd20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 5428 start_va = 0xd210000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 5429 start_va = 0xd310000 end_va = 0xd34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 5430 start_va = 0xd350000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d350000" filename = "" Region: id = 5431 start_va = 0xd450000 end_va = 0xd48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 5432 start_va = 0xd490000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 5433 start_va = 0xd590000 end_va = 0xd5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 5434 start_va = 0xd5d0000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d5d0000" filename = "" Region: id = 5435 start_va = 0xd6d0000 end_va = 0xd70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 5436 start_va = 0xd710000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d710000" filename = "" Region: id = 5437 start_va = 0xd810000 end_va = 0xd84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 5438 start_va = 0xd850000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d850000" filename = "" Region: id = 5439 start_va = 0xd950000 end_va = 0xd98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 5440 start_va = 0xd990000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d990000" filename = "" Region: id = 5441 start_va = 0xda90000 end_va = 0xdacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 5442 start_va = 0xdad0000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 5443 start_va = 0xdbd0000 end_va = 0xdc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 5444 start_va = 0xdc10000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 5445 start_va = 0xdd10000 end_va = 0xdd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 5446 start_va = 0xdd50000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd50000" filename = "" Region: id = 5447 start_va = 0xde50000 end_va = 0xde8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 5448 start_va = 0xde90000 end_va = 0xdecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de90000" filename = "" Region: id = 5449 start_va = 0xded0000 end_va = 0xdf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ded0000" filename = "" Region: id = 5450 start_va = 0xdf10000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df10000" filename = "" Region: id = 5451 start_va = 0xe090000 end_va = 0xe18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 5452 start_va = 0xe190000 end_va = 0xe28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e190000" filename = "" Region: id = 5453 start_va = 0xe290000 end_va = 0xe38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e290000" filename = "" Region: id = 5454 start_va = 0xe390000 end_va = 0xe3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e390000" filename = "" Region: id = 5455 start_va = 0xe3d0000 end_va = 0xe40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e3d0000" filename = "" Region: id = 5456 start_va = 0x20480000 end_va = 0x2057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020480000" filename = "" Region: id = 5457 start_va = 0x20580000 end_va = 0x2067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020580000" filename = "" Region: id = 5458 start_va = 0x20680000 end_va = 0x2077ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020680000" filename = "" Region: id = 5459 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5460 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5461 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5462 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5463 start_va = 0xe410000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e410000" filename = "" Region: id = 5464 start_va = 0x20780000 end_va = 0x2087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020780000" filename = "" Region: id = 5465 start_va = 0x20880000 end_va = 0x208bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 5466 start_va = 0x208c0000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000208c0000" filename = "" Region: id = 5467 start_va = 0x209c0000 end_va = 0x209fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000209c0000" filename = "" Region: id = 5468 start_va = 0x20a00000 end_va = 0x20a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 5469 start_va = 0x20a40000 end_va = 0x20a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a40000" filename = "" Region: id = 5470 start_va = 0x20a80000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a80000" filename = "" Region: id = 5471 start_va = 0x20bc0000 end_va = 0x20cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020bc0000" filename = "" Region: id = 5472 start_va = 0x20cc0000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020cc0000" filename = "" Region: id = 5473 start_va = 0x20dc0000 end_va = 0x20ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020dc0000" filename = "" Region: id = 5474 start_va = 0x20ec0000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 5475 start_va = 0x20fc0000 end_va = 0x20ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 5476 start_va = 0x21000000 end_va = 0x210fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021000000" filename = "" Region: id = 5477 start_va = 0x21100000 end_va = 0x2113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021100000" filename = "" Region: id = 5478 start_va = 0x21140000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021140000" filename = "" Region: id = 5479 start_va = 0x21240000 end_va = 0x2127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021240000" filename = "" Region: id = 5480 start_va = 0x21280000 end_va = 0x2137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021280000" filename = "" Region: id = 5481 start_va = 0x21380000 end_va = 0x213bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 5482 start_va = 0x213c0000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000213c0000" filename = "" Region: id = 5483 start_va = 0x214c0000 end_va = 0x214fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000214c0000" filename = "" Region: id = 5484 start_va = 0x21500000 end_va = 0x215fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021500000" filename = "" Region: id = 5485 start_va = 0x21600000 end_va = 0x2163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021600000" filename = "" Region: id = 5486 start_va = 0x21640000 end_va = 0x2173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021640000" filename = "" Region: id = 5487 start_va = 0x21740000 end_va = 0x2177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021740000" filename = "" Region: id = 5488 start_va = 0x21780000 end_va = 0x2187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021780000" filename = "" Region: id = 5489 start_va = 0x21880000 end_va = 0x218bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021880000" filename = "" Region: id = 5490 start_va = 0x218c0000 end_va = 0x219bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000218c0000" filename = "" Region: id = 5491 start_va = 0x219c0000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000219c0000" filename = "" Region: id = 5492 start_va = 0x21a00000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 5493 start_va = 0x21b00000 end_va = 0x21b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b00000" filename = "" Region: id = 5494 start_va = 0x21b40000 end_va = 0x21c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b40000" filename = "" Region: id = 5495 start_va = 0x21c40000 end_va = 0x21c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 5496 start_va = 0x21c80000 end_va = 0x21d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c80000" filename = "" Region: id = 5497 start_va = 0x21d80000 end_va = 0x21dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d80000" filename = "" Region: id = 5498 start_va = 0x21dc0000 end_va = 0x21ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021dc0000" filename = "" Region: id = 5499 start_va = 0x21ec0000 end_va = 0x21efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ec0000" filename = "" Region: id = 5500 start_va = 0x21f00000 end_va = 0x21ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f00000" filename = "" Region: id = 5501 start_va = 0x22000000 end_va = 0x2203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022000000" filename = "" Region: id = 5502 start_va = 0x22040000 end_va = 0x2213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022040000" filename = "" Region: id = 5503 start_va = 0x23140000 end_va = 0x2317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023140000" filename = "" Region: id = 5504 start_va = 0x23180000 end_va = 0x2327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023180000" filename = "" Region: id = 5505 start_va = 0x23280000 end_va = 0x232bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023280000" filename = "" Region: id = 5506 start_va = 0x232c0000 end_va = 0x233bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000232c0000" filename = "" Region: id = 5507 start_va = 0x233c0000 end_va = 0x233fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000233c0000" filename = "" Region: id = 5508 start_va = 0x23400000 end_va = 0x234fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023400000" filename = "" Region: id = 5509 start_va = 0x23500000 end_va = 0x2353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023500000" filename = "" Region: id = 5510 start_va = 0x23540000 end_va = 0x2363ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023540000" filename = "" Region: id = 5511 start_va = 0x23640000 end_va = 0x2367ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023640000" filename = "" Region: id = 5512 start_va = 0x23680000 end_va = 0x2377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023680000" filename = "" Region: id = 5513 start_va = 0x23780000 end_va = 0x237bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023780000" filename = "" Region: id = 5514 start_va = 0x237c0000 end_va = 0x238bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000237c0000" filename = "" Region: id = 5515 start_va = 0x238c0000 end_va = 0x238fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000238c0000" filename = "" Region: id = 5516 start_va = 0x23900000 end_va = 0x239fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023900000" filename = "" Region: id = 5517 start_va = 0x23a00000 end_va = 0x23a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a00000" filename = "" Region: id = 5518 start_va = 0x23a40000 end_va = 0x23b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a40000" filename = "" Region: id = 5519 start_va = 0x23b40000 end_va = 0x23b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023b40000" filename = "" Region: id = 5520 start_va = 0x23b80000 end_va = 0x23c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023b80000" filename = "" Region: id = 5521 start_va = 0x23c80000 end_va = 0x23cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023c80000" filename = "" Region: id = 5522 start_va = 0x23cc0000 end_va = 0x23dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023cc0000" filename = "" Region: id = 5523 start_va = 0x23dc0000 end_va = 0x23dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023dc0000" filename = "" Region: id = 5524 start_va = 0x23e00000 end_va = 0x23efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e00000" filename = "" Region: id = 5525 start_va = 0x23f00000 end_va = 0x23f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023f00000" filename = "" Region: id = 5526 start_va = 0x23f40000 end_va = 0x2403ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023f40000" filename = "" Region: id = 5527 start_va = 0x24040000 end_va = 0x2407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024040000" filename = "" Region: id = 5528 start_va = 0x24080000 end_va = 0x2417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024080000" filename = "" Region: id = 5529 start_va = 0x24180000 end_va = 0x241bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024180000" filename = "" Region: id = 5530 start_va = 0x241c0000 end_va = 0x242bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000241c0000" filename = "" Region: id = 5531 start_va = 0x242c0000 end_va = 0x242fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000242c0000" filename = "" Region: id = 5532 start_va = 0x24300000 end_va = 0x243fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024300000" filename = "" Region: id = 5533 start_va = 0x24400000 end_va = 0x2443ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024400000" filename = "" Region: id = 5534 start_va = 0x24440000 end_va = 0x2453ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024440000" filename = "" Region: id = 5535 start_va = 0x24540000 end_va = 0x2457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024540000" filename = "" Region: id = 5536 start_va = 0x24580000 end_va = 0x2467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024580000" filename = "" Region: id = 5537 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5538 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5539 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5540 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5541 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5542 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5543 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5544 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5545 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5546 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5547 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5548 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5549 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5550 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5551 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5552 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5553 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5554 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5555 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5556 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5557 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5558 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5559 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5560 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5561 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5562 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5563 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5564 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5565 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5566 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5567 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5568 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5569 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5570 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5571 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5572 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5573 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5574 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5575 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5576 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5577 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5578 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5579 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5580 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5581 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5582 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5583 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5584 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5585 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5586 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5587 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 5588 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 5589 start_va = 0xb610000 end_va = 0xb64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b610000" filename = "" Region: id = 5590 start_va = 0xb650000 end_va = 0xb74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b650000" filename = "" Region: id = 5591 start_va = 0xb750000 end_va = 0xb78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 5592 start_va = 0xb790000 end_va = 0xb88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b790000" filename = "" Region: id = 5593 start_va = 0xd1d0000 end_va = 0xd20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 5594 start_va = 0xd210000 end_va = 0xd30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 5595 start_va = 0xd310000 end_va = 0xd34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 5596 start_va = 0xd350000 end_va = 0xd44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d350000" filename = "" Region: id = 5597 start_va = 0xd450000 end_va = 0xd48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 5598 start_va = 0xd490000 end_va = 0xd58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 5599 start_va = 0xd590000 end_va = 0xd5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 5600 start_va = 0xd5d0000 end_va = 0xd6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d5d0000" filename = "" Region: id = 5601 start_va = 0xd6d0000 end_va = 0xd70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 5602 start_va = 0xd710000 end_va = 0xd80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d710000" filename = "" Region: id = 5603 start_va = 0xd810000 end_va = 0xd84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 5604 start_va = 0xd850000 end_va = 0xd94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d850000" filename = "" Region: id = 5605 start_va = 0xd950000 end_va = 0xd98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 5606 start_va = 0xd990000 end_va = 0xda8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d990000" filename = "" Region: id = 5607 start_va = 0xda90000 end_va = 0xdacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 5608 start_va = 0xdad0000 end_va = 0xdbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 5609 start_va = 0xdbd0000 end_va = 0xdc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 5610 start_va = 0xdc10000 end_va = 0xdd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 5611 start_va = 0xdd10000 end_va = 0xdd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 5612 start_va = 0xdd50000 end_va = 0xde4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dd50000" filename = "" Region: id = 5613 start_va = 0xde50000 end_va = 0xde8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 5614 start_va = 0xde90000 end_va = 0xdecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000de90000" filename = "" Region: id = 5615 start_va = 0xded0000 end_va = 0xdf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ded0000" filename = "" Region: id = 5616 start_va = 0xdf10000 end_va = 0xdf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000df10000" filename = "" Region: id = 5617 start_va = 0xe090000 end_va = 0xe18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 5618 start_va = 0xe190000 end_va = 0xe28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e190000" filename = "" Region: id = 5619 start_va = 0xe290000 end_va = 0xe38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e290000" filename = "" Region: id = 5620 start_va = 0xe390000 end_va = 0xe3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e390000" filename = "" Region: id = 5621 start_va = 0xe3d0000 end_va = 0xe40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e3d0000" filename = "" Region: id = 5622 start_va = 0xe410000 end_va = 0xe44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e410000" filename = "" Region: id = 5623 start_va = 0x20480000 end_va = 0x2057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020480000" filename = "" Region: id = 5624 start_va = 0x20580000 end_va = 0x2067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020580000" filename = "" Region: id = 5625 start_va = 0x20680000 end_va = 0x2077ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020680000" filename = "" Region: id = 5626 start_va = 0x20780000 end_va = 0x2087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020780000" filename = "" Region: id = 5627 start_va = 0x209c0000 end_va = 0x209fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000209c0000" filename = "" Region: id = 5628 start_va = 0x20bc0000 end_va = 0x20cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020bc0000" filename = "" Region: id = 5629 start_va = 0x21240000 end_va = 0x2127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021240000" filename = "" Region: id = 5630 start_va = 0x21280000 end_va = 0x2137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021280000" filename = "" Region: id = 5631 start_va = 0x21b00000 end_va = 0x21b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b00000" filename = "" Region: id = 5632 start_va = 0x21b40000 end_va = 0x21c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021b40000" filename = "" Region: id = 5633 start_va = 0x24680000 end_va = 0x246bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024680000" filename = "" Region: id = 5634 start_va = 0x246c0000 end_va = 0x247bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000246c0000" filename = "" Region: id = 5635 start_va = 0x247c0000 end_va = 0x247fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000247c0000" filename = "" Region: id = 5636 start_va = 0x24800000 end_va = 0x248fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024800000" filename = "" Region: id = 5637 start_va = 0x24900000 end_va = 0x2493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024900000" filename = "" Region: id = 5638 start_va = 0x24940000 end_va = 0x24a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024940000" filename = "" Region: id = 5639 start_va = 0x24a40000 end_va = 0x24a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024a40000" filename = "" Region: id = 5640 start_va = 0x24a80000 end_va = 0x24b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024a80000" filename = "" Region: id = 5641 start_va = 0x24b80000 end_va = 0x24bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024b80000" filename = "" Region: id = 5642 start_va = 0x24bc0000 end_va = 0x24cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024bc0000" filename = "" Region: id = 5643 start_va = 0x24cc0000 end_va = 0x24cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024cc0000" filename = "" Region: id = 5644 start_va = 0x24d00000 end_va = 0x24dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024d00000" filename = "" Region: id = 5645 start_va = 0x24e00000 end_va = 0x24e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024e00000" filename = "" Region: id = 5646 start_va = 0x24e40000 end_va = 0x24f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024e40000" filename = "" Region: id = 5647 start_va = 0x24f40000 end_va = 0x24f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024f40000" filename = "" Region: id = 5648 start_va = 0x24f80000 end_va = 0x2507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024f80000" filename = "" Region: id = 5649 start_va = 0x25080000 end_va = 0x250bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025080000" filename = "" Region: id = 5650 start_va = 0x250c0000 end_va = 0x251bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000250c0000" filename = "" Region: id = 5651 start_va = 0x251c0000 end_va = 0x251fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000251c0000" filename = "" Region: id = 5652 start_va = 0x25400000 end_va = 0x254fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025400000" filename = "" Region: id = 5653 start_va = 0x25500000 end_va = 0x2553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025500000" filename = "" Region: id = 5654 start_va = 0x25540000 end_va = 0x2563ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025540000" filename = "" Region: id = 5655 start_va = 0x25640000 end_va = 0x2567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025640000" filename = "" Region: id = 5656 start_va = 0x25680000 end_va = 0x2577ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025680000" filename = "" Region: id = 5657 start_va = 0x25780000 end_va = 0x257bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025780000" filename = "" Region: id = 5658 start_va = 0x257c0000 end_va = 0x258bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000257c0000" filename = "" Region: id = 5659 start_va = 0x258c0000 end_va = 0x258fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000258c0000" filename = "" Region: id = 5660 start_va = 0x25900000 end_va = 0x259fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025900000" filename = "" Region: id = 5661 start_va = 0x25a00000 end_va = 0x25a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025a00000" filename = "" Region: id = 5662 start_va = 0x25a40000 end_va = 0x25b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025a40000" filename = "" Region: id = 5663 start_va = 0x25b40000 end_va = 0x25b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025b40000" filename = "" Region: id = 5664 start_va = 0x25b80000 end_va = 0x25c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025b80000" filename = "" Region: id = 5665 start_va = 0x25c80000 end_va = 0x25cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025c80000" filename = "" Region: id = 5666 start_va = 0x25cc0000 end_va = 0x25dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025cc0000" filename = "" Region: id = 5667 start_va = 0x25dc0000 end_va = 0x25dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025dc0000" filename = "" Region: id = 5668 start_va = 0x25e00000 end_va = 0x25efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025e00000" filename = "" Region: id = 5669 start_va = 0x25f00000 end_va = 0x25f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025f00000" filename = "" Region: id = 5670 start_va = 0x25f40000 end_va = 0x2603ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000025f40000" filename = "" Region: id = 5671 start_va = 0x26040000 end_va = 0x2607ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026040000" filename = "" Region: id = 5672 start_va = 0x26080000 end_va = 0x2617ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026080000" filename = "" Region: id = 5673 start_va = 0x26180000 end_va = 0x261bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026180000" filename = "" Region: id = 5674 start_va = 0x261c0000 end_va = 0x262bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000261c0000" filename = "" Region: id = 5675 start_va = 0x262c0000 end_va = 0x262fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000262c0000" filename = "" Region: id = 5676 start_va = 0x26300000 end_va = 0x263fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026300000" filename = "" Region: id = 5677 start_va = 0x26400000 end_va = 0x2643ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026400000" filename = "" Region: id = 5678 start_va = 0x26440000 end_va = 0x2653ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026440000" filename = "" Region: id = 5679 start_va = 0x26540000 end_va = 0x2657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026540000" filename = "" Region: id = 5680 start_va = 0x26580000 end_va = 0x2667ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026580000" filename = "" Region: id = 5681 start_va = 0x26680000 end_va = 0x266bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026680000" filename = "" Region: id = 5682 start_va = 0x266c0000 end_va = 0x267bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000266c0000" filename = "" Region: id = 5683 start_va = 0x267c0000 end_va = 0x267fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000267c0000" filename = "" Region: id = 5684 start_va = 0x26800000 end_va = 0x268fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026800000" filename = "" Region: id = 5685 start_va = 0x26900000 end_va = 0x2693ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026900000" filename = "" Region: id = 5686 start_va = 0x26940000 end_va = 0x26a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026940000" filename = "" Region: id = 5687 start_va = 0x26a40000 end_va = 0x26a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026a40000" filename = "" Region: id = 5688 start_va = 0x26a80000 end_va = 0x26b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026a80000" filename = "" Region: id = 5689 start_va = 0x26b80000 end_va = 0x26bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026b80000" filename = "" Region: id = 5690 start_va = 0x26bc0000 end_va = 0x26cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026bc0000" filename = "" Region: id = 5691 start_va = 0x26cc0000 end_va = 0x26cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026cc0000" filename = "" Region: id = 5692 start_va = 0x26d00000 end_va = 0x26dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026d00000" filename = "" Region: id = 5693 start_va = 0x26e00000 end_va = 0x26e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026e00000" filename = "" Region: id = 5694 start_va = 0x26e40000 end_va = 0x26f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026e40000" filename = "" Region: id = 5695 start_va = 0x26f40000 end_va = 0x26f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026f40000" filename = "" Region: id = 5696 start_va = 0x26f80000 end_va = 0x2707ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026f80000" filename = "" Region: id = 5697 start_va = 0x27080000 end_va = 0x270bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027080000" filename = "" Region: id = 5698 start_va = 0x270c0000 end_va = 0x271bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000270c0000" filename = "" Region: id = 5699 start_va = 0x271c0000 end_va = 0x271fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000271c0000" filename = "" Region: id = 5700 start_va = 0x27200000 end_va = 0x272fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027200000" filename = "" Region: id = 5701 start_va = 0x27300000 end_va = 0x2733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027300000" filename = "" Region: id = 5702 start_va = 0x27340000 end_va = 0x2743ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027340000" filename = "" Region: id = 5703 start_va = 0x27440000 end_va = 0x2747ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027440000" filename = "" Region: id = 5704 start_va = 0x27480000 end_va = 0x2757ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027480000" filename = "" Region: id = 5705 start_va = 0x27580000 end_va = 0x275bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027580000" filename = "" Region: id = 5706 start_va = 0x275c0000 end_va = 0x276bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000275c0000" filename = "" Region: id = 5707 start_va = 0x276c0000 end_va = 0x276fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000276c0000" filename = "" Region: id = 5708 start_va = 0x27700000 end_va = 0x277fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027700000" filename = "" Region: id = 5709 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5710 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5711 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5712 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5713 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5714 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5715 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5716 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5717 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5718 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5719 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5720 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 5721 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5722 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5723 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5724 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5725 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5726 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5727 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5728 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5729 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5730 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5731 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5732 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5733 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5734 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5735 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5736 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5737 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5738 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5739 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5740 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5741 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5742 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5743 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5744 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 5745 start_va = 0x17bf0000 end_va = 0x17bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bf0000" filename = "" Region: id = 5746 start_va = 0x17bf0000 end_va = 0x17bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bf0000" filename = "" Region: id = 5747 start_va = 0x27800000 end_va = 0x27800fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027800000" filename = "" Region: id = 5748 start_va = 0x27810000 end_va = 0x27810fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027810000" filename = "" Region: id = 5749 start_va = 0x27820000 end_va = 0x27820fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027820000" filename = "" Region: id = 5750 start_va = 0x27830000 end_va = 0x27830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027830000" filename = "" Region: id = 5751 start_va = 0x27840000 end_va = 0x27840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027840000" filename = "" Region: id = 5752 start_va = 0x27850000 end_va = 0x27850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027850000" filename = "" Region: id = 5753 start_va = 0x27860000 end_va = 0x27860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027860000" filename = "" Region: id = 5754 start_va = 0x27870000 end_va = 0x27870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027870000" filename = "" Region: id = 5755 start_va = 0x27880000 end_va = 0x27880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027880000" filename = "" Region: id = 5756 start_va = 0x27890000 end_va = 0x27890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027890000" filename = "" Region: id = 5757 start_va = 0x278a0000 end_va = 0x278a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000278a0000" filename = "" Region: id = 5758 start_va = 0x278b0000 end_va = 0x278b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000278b0000" filename = "" Region: id = 5759 start_va = 0x278c0000 end_va = 0x278c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000278c0000" filename = "" Region: id = 5760 start_va = 0x278d0000 end_va = 0x278d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000278d0000" filename = "" Region: id = 5761 start_va = 0x278e0000 end_va = 0x278e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000278e0000" filename = "" Region: id = 5762 start_va = 0x278f0000 end_va = 0x278f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000278f0000" filename = "" Region: id = 5763 start_va = 0x27900000 end_va = 0x27900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027900000" filename = "" Region: id = 5764 start_va = 0x27910000 end_va = 0x27910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027910000" filename = "" Region: id = 5765 start_va = 0x27920000 end_va = 0x27920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027920000" filename = "" Region: id = 5766 start_va = 0x27930000 end_va = 0x27930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027930000" filename = "" Region: id = 5767 start_va = 0x27940000 end_va = 0x27940fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027940000" filename = "" Region: id = 5768 start_va = 0x27950000 end_va = 0x27950fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027950000" filename = "" Region: id = 5769 start_va = 0x27960000 end_va = 0x27960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027960000" filename = "" Region: id = 5770 start_va = 0x27970000 end_va = 0x27970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027970000" filename = "" Region: id = 5771 start_va = 0x21380000 end_va = 0x213bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 5772 start_va = 0x213c0000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000213c0000" filename = "" Region: id = 5773 start_va = 0x21c40000 end_va = 0x21c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 5774 start_va = 0x21c80000 end_va = 0x21d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c80000" filename = "" Region: id = 5775 start_va = 0x27950000 end_va = 0x2798ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027950000" filename = "" Region: id = 5776 start_va = 0x27990000 end_va = 0x27a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027990000" filename = "" Region: id = 5777 start_va = 0x27a90000 end_va = 0x27acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027a90000" filename = "" Region: id = 5778 start_va = 0x27ad0000 end_va = 0x27bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027ad0000" filename = "" Region: id = 5779 start_va = 0x27bd0000 end_va = 0x27c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027bd0000" filename = "" Region: id = 5780 start_va = 0x27c10000 end_va = 0x27d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027c10000" filename = "" Region: id = 5781 start_va = 0x27d10000 end_va = 0x27d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027d10000" filename = "" Region: id = 5782 start_va = 0x27d50000 end_va = 0x27e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027d50000" filename = "" Region: id = 5783 start_va = 0x27e50000 end_va = 0x27e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027e50000" filename = "" Region: id = 5784 start_va = 0x27e90000 end_va = 0x27f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027e90000" filename = "" Region: id = 5785 start_va = 0x27f90000 end_va = 0x27fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027f90000" filename = "" Region: id = 5786 start_va = 0x27fd0000 end_va = 0x280cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027fd0000" filename = "" Region: id = 5787 start_va = 0x280d0000 end_va = 0x2810ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000280d0000" filename = "" Region: id = 5788 start_va = 0x28110000 end_va = 0x2820ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028110000" filename = "" Region: id = 5789 start_va = 0x28210000 end_va = 0x2824ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028210000" filename = "" Region: id = 5790 start_va = 0x28250000 end_va = 0x2834ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028250000" filename = "" Region: id = 5791 start_va = 0x28350000 end_va = 0x2838ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028350000" filename = "" Region: id = 5792 start_va = 0x28390000 end_va = 0x2848ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028390000" filename = "" Region: id = 5793 start_va = 0x28490000 end_va = 0x28490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028490000" filename = "" Region: id = 5794 start_va = 0x284a0000 end_va = 0x284a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000284a0000" filename = "" Region: id = 5795 start_va = 0x284b0000 end_va = 0x284b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000284b0000" filename = "" Region: id = 5796 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5797 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5798 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5799 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5800 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5801 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5802 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5803 start_va = 0xb4d0000 end_va = 0xb4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5804 start_va = 0xb4e0000 end_va = 0xb4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4e0000" filename = "" Region: id = 5805 start_va = 0xb4f0000 end_va = 0xb4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4f0000" filename = "" Region: id = 5806 start_va = 0xb500000 end_va = 0xb500fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b500000" filename = "" Region: id = 5807 start_va = 0xb510000 end_va = 0xb510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 5808 start_va = 0xb510000 end_va = 0xb510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 5809 start_va = 0xb510000 end_va = 0xb510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 5810 start_va = 0xb4d0000 end_va = 0xb50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5811 start_va = 0xb510000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 5812 start_va = 0x20880000 end_va = 0x208bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 5813 start_va = 0x208c0000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000208c0000" filename = "" Region: id = 5814 start_va = 0x20fc0000 end_va = 0x20ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 5815 start_va = 0x21000000 end_va = 0x210fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021000000" filename = "" Region: id = 5816 start_va = 0x21380000 end_va = 0x213bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 5817 start_va = 0x213c0000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000213c0000" filename = "" Region: id = 5818 start_va = 0x21600000 end_va = 0x21600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021600000" filename = "" Region: id = 5819 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5820 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5821 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5822 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5823 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5824 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5825 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5826 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5827 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5828 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5829 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5830 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5831 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5832 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5833 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5834 start_va = 0x590000 end_va = 0x590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 5835 start_va = 0x5a0000 end_va = 0x5a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 5836 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 5837 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 5838 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5839 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5840 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5841 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 5842 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 5843 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 5844 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 5845 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 5846 start_va = 0x12a0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 5847 start_va = 0x12e0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 5848 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 5849 start_va = 0xb050000 end_va = 0xb14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 5850 start_va = 0xb150000 end_va = 0xb24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 5851 start_va = 0xb250000 end_va = 0xb28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 5852 start_va = 0xb290000 end_va = 0xb38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 5853 start_va = 0xb390000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 5854 start_va = 0xb3d0000 end_va = 0xb4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 5855 start_va = 0xb4d0000 end_va = 0xb50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 5856 start_va = 0xb510000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 5857 start_va = 0x20880000 end_va = 0x208bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 5858 start_va = 0x208c0000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000208c0000" filename = "" Region: id = 5859 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5860 start_va = 0xf5d0000 end_va = 0xf60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 5861 start_va = 0xf610000 end_va = 0xf70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f610000" filename = "" Region: id = 5862 start_va = 0x20a00000 end_va = 0x20a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 5863 start_va = 0x20a40000 end_va = 0x20a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a40000" filename = "" Region: id = 5864 start_va = 0x20a80000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a80000" filename = "" Region: id = 5865 start_va = 0x20cc0000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020cc0000" filename = "" Region: id = 5866 start_va = 0x20dc0000 end_va = 0x20ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020dc0000" filename = "" Region: id = 5867 start_va = 0x20ec0000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 5868 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5869 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5870 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5871 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5872 start_va = 0x20fc0000 end_va = 0x20ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 5873 start_va = 0x21000000 end_va = 0x210fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021000000" filename = "" Region: id = 5874 start_va = 0x21100000 end_va = 0x2113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021100000" filename = "" Region: id = 5875 start_va = 0x21140000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021140000" filename = "" Region: id = 5876 start_va = 0x21380000 end_va = 0x213bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 5877 start_va = 0x213c0000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000213c0000" filename = "" Region: id = 5878 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5879 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5880 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5881 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5882 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 5883 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 5884 start_va = 0xf850000 end_va = 0xf850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 5885 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5886 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5887 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5888 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5889 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5890 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5891 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5892 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5893 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5894 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5895 start_va = 0xf860000 end_va = 0xf860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f860000" filename = "" Region: id = 5896 start_va = 0xf870000 end_va = 0xf870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f870000" filename = "" Region: id = 5897 start_va = 0xf880000 end_va = 0xf880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f880000" filename = "" Region: id = 5898 start_va = 0xf890000 end_va = 0xf890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 5899 start_va = 0x1120000 end_va = 0x1120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 5900 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 5901 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 5902 start_va = 0xf890000 end_va = 0xf890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 5903 start_va = 0xf890000 end_va = 0xf890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 5904 start_va = 0xf8a0000 end_va = 0xf8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8a0000" filename = "" Region: id = 5905 start_va = 0xf8e0000 end_va = 0xf91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8e0000" filename = "" Region: id = 5906 start_va = 0xf920000 end_va = 0xf95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f920000" filename = "" Region: id = 5907 start_va = 0xfbd0000 end_va = 0xfccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fbd0000" filename = "" Region: id = 5908 start_va = 0x20fc0000 end_va = 0x210bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 5909 start_va = 0x214c0000 end_va = 0x215bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000214c0000" filename = "" Region: id = 5910 start_va = 0xf890000 end_va = 0xf890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 5911 start_va = 0xfcd0000 end_va = 0xfd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fcd0000" filename = "" Region: id = 5912 start_va = 0x210c0000 end_va = 0x210fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000210c0000" filename = "" Region: id = 5913 start_va = 0x215c0000 end_va = 0x216bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000215c0000" filename = "" Region: id = 5914 start_va = 0x216c0000 end_va = 0x217bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000216c0000" filename = "" Region: id = 5915 start_va = 0x217c0000 end_va = 0x217fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000217c0000" filename = "" Region: id = 5916 start_va = 0x21800000 end_va = 0x218fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021800000" filename = "" Region: id = 5917 start_va = 0x21900000 end_va = 0x2193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 5918 start_va = 0x21940000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021940000" filename = "" Region: id = 5919 start_va = 0x21a40000 end_va = 0x21a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a40000" filename = "" Region: id = 5920 start_va = 0x21a80000 end_va = 0x21abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a80000" filename = "" Region: id = 5921 start_va = 0x21ac0000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ac0000" filename = "" Region: id = 5922 start_va = 0x21c40000 end_va = 0x21d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 5923 start_va = 0x21d40000 end_va = 0x21e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d40000" filename = "" Region: id = 5924 start_va = 0x21e40000 end_va = 0x21f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e40000" filename = "" Region: id = 5925 start_va = 0x21f40000 end_va = 0x21f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f40000" filename = "" Region: id = 5926 start_va = 0x21f80000 end_va = 0x2207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f80000" filename = "" Region: id = 5927 start_va = 0x22080000 end_va = 0x220bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022080000" filename = "" Region: id = 5928 start_va = 0x220c0000 end_va = 0x220fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000220c0000" filename = "" Region: id = 5929 start_va = 0x23000000 end_va = 0x230fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023000000" filename = "" Region: id = 5930 start_va = 0x23100000 end_va = 0x231fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023100000" filename = "" Region: id = 5931 start_va = 0xb390000 end_va = 0xb390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 5932 start_va = 0xb390000 end_va = 0xb390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 5933 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5934 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5935 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5936 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5937 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5938 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5939 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 5940 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 5941 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 5942 start_va = 0xb390000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 5943 start_va = 0xb3d0000 end_va = 0xb4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 5944 start_va = 0xd090000 end_va = 0xd0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 5945 start_va = 0xd0d0000 end_va = 0xd1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 5946 start_va = 0xf490000 end_va = 0xf4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f490000" filename = "" Region: id = 5947 start_va = 0xf4d0000 end_va = 0xf5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f4d0000" filename = "" Region: id = 5948 start_va = 0xf890000 end_va = 0xf890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 5949 start_va = 0xfe50000 end_va = 0xfe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe50000" filename = "" Region: id = 5950 start_va = 0xfe90000 end_va = 0xff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe90000" filename = "" Region: id = 5951 start_va = 0x100d0000 end_va = 0x1010ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000100d0000" filename = "" Region: id = 5952 start_va = 0x10110000 end_va = 0x1020ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010110000" filename = "" Region: id = 5953 start_va = 0x10850000 end_va = 0x1088ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010850000" filename = "" Region: id = 5954 start_va = 0x10890000 end_va = 0x1098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010890000" filename = "" Region: id = 5955 start_va = 0x11b10000 end_va = 0x11b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b10000" filename = "" Region: id = 5956 start_va = 0x11b50000 end_va = 0x11c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011b50000" filename = "" Region: id = 5957 start_va = 0x22100000 end_va = 0x2213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022100000" filename = "" Region: id = 5958 start_va = 0x23200000 end_va = 0x232fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023200000" filename = "" Region: id = 5959 start_va = 0x23300000 end_va = 0x2333ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023300000" filename = "" Region: id = 5960 start_va = 0x23340000 end_va = 0x2343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023340000" filename = "" Region: id = 5961 start_va = 0x23440000 end_va = 0x2347ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023440000" filename = "" Region: id = 5962 start_va = 0x23480000 end_va = 0x2357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023480000" filename = "" Region: id = 5963 start_va = 0x23580000 end_va = 0x235bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023580000" filename = "" Region: id = 5964 start_va = 0x235c0000 end_va = 0x236bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000235c0000" filename = "" Region: id = 5965 start_va = 0x236c0000 end_va = 0x236fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000236c0000" filename = "" Region: id = 5966 start_va = 0x23700000 end_va = 0x237fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023700000" filename = "" Region: id = 5967 start_va = 0x23800000 end_va = 0x2383ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023800000" filename = "" Region: id = 5968 start_va = 0x23840000 end_va = 0x2393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023840000" filename = "" Region: id = 5969 start_va = 0x23940000 end_va = 0x2397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023940000" filename = "" Region: id = 5970 start_va = 0x23980000 end_va = 0x23a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023980000" filename = "" Region: id = 5971 start_va = 0x23a80000 end_va = 0x23abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023a80000" filename = "" Region: id = 5972 start_va = 0x23ac0000 end_va = 0x23bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023ac0000" filename = "" Region: id = 5973 start_va = 0x23bc0000 end_va = 0x23bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023bc0000" filename = "" Region: id = 5974 start_va = 0x23c00000 end_va = 0x23cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023c00000" filename = "" Region: id = 5975 start_va = 0x23d00000 end_va = 0x23d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023d00000" filename = "" Region: id = 5976 start_va = 0x23d40000 end_va = 0x23e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023d40000" filename = "" Region: id = 5977 start_va = 0x23e40000 end_va = 0x23e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e40000" filename = "" Region: id = 5978 start_va = 0x23e80000 end_va = 0x23f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023e80000" filename = "" Region: id = 5979 start_va = 0x23f80000 end_va = 0x23fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023f80000" filename = "" Region: id = 5980 start_va = 0x23fc0000 end_va = 0x240bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023fc0000" filename = "" Region: id = 5981 start_va = 0x240c0000 end_va = 0x240fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000240c0000" filename = "" Region: id = 5982 start_va = 0x24100000 end_va = 0x241fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024100000" filename = "" Region: id = 5983 start_va = 0x24200000 end_va = 0x2423ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024200000" filename = "" Region: id = 5984 start_va = 0x24240000 end_va = 0x2433ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024240000" filename = "" Region: id = 5985 start_va = 0x24340000 end_va = 0x2437ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024340000" filename = "" Region: id = 5986 start_va = 0x24380000 end_va = 0x2447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024380000" filename = "" Region: id = 5987 start_va = 0x24480000 end_va = 0x244bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024480000" filename = "" Region: id = 5988 start_va = 0x244c0000 end_va = 0x245bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000244c0000" filename = "" Region: id = 5989 start_va = 0x245c0000 end_va = 0x245fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000245c0000" filename = "" Region: id = 5990 start_va = 0x24600000 end_va = 0x2463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024600000" filename = "" Region: id = 5991 start_va = 0x24640000 end_va = 0x2467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000024640000" filename = "" Region: id = 5992 start_va = 0x27800000 end_va = 0x278fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027800000" filename = "" Region: id = 5993 start_va = 0x27900000 end_va = 0x279fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027900000" filename = "" Region: id = 5994 start_va = 0x27a00000 end_va = 0x27afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027a00000" filename = "" Region: id = 5995 start_va = 0x27b00000 end_va = 0x27b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027b00000" filename = "" Region: id = 5996 start_va = 0x27b40000 end_va = 0x27c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027b40000" filename = "" Region: id = 5997 start_va = 0x27c40000 end_va = 0x27c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027c40000" filename = "" Region: id = 5998 start_va = 0x27c80000 end_va = 0x27d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027c80000" filename = "" Region: id = 5999 start_va = 0x27d80000 end_va = 0x27dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027d80000" filename = "" Region: id = 6000 start_va = 0x27dc0000 end_va = 0x27ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027dc0000" filename = "" Region: id = 6001 start_va = 0x27ec0000 end_va = 0x27efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027ec0000" filename = "" Region: id = 6002 start_va = 0x27f00000 end_va = 0x27ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027f00000" filename = "" Region: id = 6003 start_va = 0x28000000 end_va = 0x2803ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028000000" filename = "" Region: id = 6004 start_va = 0x28040000 end_va = 0x2813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028040000" filename = "" Region: id = 6005 start_va = 0x28140000 end_va = 0x2817ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028140000" filename = "" Region: id = 6006 start_va = 0x28180000 end_va = 0x2827ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028180000" filename = "" Region: id = 6007 start_va = 0x28280000 end_va = 0x282bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028280000" filename = "" Region: id = 6008 start_va = 0x282c0000 end_va = 0x283bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000282c0000" filename = "" Region: id = 6009 start_va = 0x283c0000 end_va = 0x283fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000283c0000" filename = "" Region: id = 6010 start_va = 0x28400000 end_va = 0x284fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028400000" filename = "" Region: id = 6011 start_va = 0x28500000 end_va = 0x2853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028500000" filename = "" Region: id = 6012 start_va = 0x28540000 end_va = 0x2863ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028540000" filename = "" Region: id = 6013 start_va = 0x28640000 end_va = 0x2867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028640000" filename = "" Region: id = 6014 start_va = 0x28680000 end_va = 0x2877ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028680000" filename = "" Region: id = 6015 start_va = 0x28780000 end_va = 0x287bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028780000" filename = "" Region: id = 6016 start_va = 0x287c0000 end_va = 0x288bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000287c0000" filename = "" Region: id = 6017 start_va = 0x288c0000 end_va = 0x288fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000288c0000" filename = "" Region: id = 6018 start_va = 0x28900000 end_va = 0x289fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028900000" filename = "" Region: id = 6019 start_va = 0x28a00000 end_va = 0x28a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028a00000" filename = "" Region: id = 6020 start_va = 0x28a40000 end_va = 0x28b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028a40000" filename = "" Region: id = 6021 start_va = 0x28b40000 end_va = 0x28b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028b40000" filename = "" Region: id = 6022 start_va = 0x28b80000 end_va = 0x28c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028b80000" filename = "" Region: id = 6023 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 6024 start_va = 0xf970000 end_va = 0xf970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f970000" filename = "" Region: id = 6025 start_va = 0xf980000 end_va = 0xf980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f980000" filename = "" Region: id = 6026 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 6027 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 6028 start_va = 0x17bf0000 end_va = 0x17bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bf0000" filename = "" Region: id = 6029 start_va = 0x28c80000 end_va = 0x28c80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c80000" filename = "" Region: id = 6030 start_va = 0x28c90000 end_va = 0x28c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c90000" filename = "" Region: id = 6031 start_va = 0x28ca0000 end_va = 0x28ca0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028ca0000" filename = "" Region: id = 6032 start_va = 0x28cb0000 end_va = 0x28cb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028cb0000" filename = "" Region: id = 6033 start_va = 0x28cb0000 end_va = 0x28ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028cb0000" filename = "" Region: id = 6034 start_va = 0x28cf0000 end_va = 0x28deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028cf0000" filename = "" Region: id = 6035 start_va = 0x28df0000 end_va = 0x28df0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028df0000" filename = "" Region: id = 6036 start_va = 0x28e00000 end_va = 0x28e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e00000" filename = "" Region: id = 6037 start_va = 0x28e40000 end_va = 0x28f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e40000" filename = "" Region: id = 6038 start_va = 0x28f40000 end_va = 0x28f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f40000" filename = "" Region: id = 6039 start_va = 0x28f80000 end_va = 0x2907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f80000" filename = "" Region: id = 6040 start_va = 0x29080000 end_va = 0x290bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029080000" filename = "" Region: id = 6041 start_va = 0x290c0000 end_va = 0x291bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000290c0000" filename = "" Region: id = 6042 start_va = 0x28df0000 end_va = 0x28df0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028df0000" filename = "" Region: id = 6043 start_va = 0x291c0000 end_va = 0x291fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000291c0000" filename = "" Region: id = 6044 start_va = 0x29200000 end_va = 0x292fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029200000" filename = "" Region: id = 6045 start_va = 0x29300000 end_va = 0x2933ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029300000" filename = "" Region: id = 6046 start_va = 0x29340000 end_va = 0x2943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029340000" filename = "" Region: id = 6047 start_va = 0x29440000 end_va = 0x2947ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029440000" filename = "" Region: id = 6048 start_va = 0x29480000 end_va = 0x2957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029480000" filename = "" Region: id = 6049 start_va = 0x29580000 end_va = 0x295bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029580000" filename = "" Region: id = 6050 start_va = 0x295c0000 end_va = 0x296bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000295c0000" filename = "" Region: id = 6051 start_va = 0x296c0000 end_va = 0x296fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000296c0000" filename = "" Region: id = 6052 start_va = 0x29700000 end_va = 0x297fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029700000" filename = "" Region: id = 6053 start_va = 0x29800000 end_va = 0x2983ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029800000" filename = "" Region: id = 6054 start_va = 0x29840000 end_va = 0x2993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029840000" filename = "" Region: id = 6055 start_va = 0x29940000 end_va = 0x2997ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029940000" filename = "" Region: id = 6056 start_va = 0x29980000 end_va = 0x29a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029980000" filename = "" Region: id = 6057 start_va = 0x29a80000 end_va = 0x29abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a80000" filename = "" Region: id = 6058 start_va = 0x29ac0000 end_va = 0x29bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029ac0000" filename = "" Region: id = 6059 start_va = 0x29bc0000 end_va = 0x29bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029bc0000" filename = "" Region: id = 6060 start_va = 0x29c00000 end_va = 0x29cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029c00000" filename = "" Region: id = 6061 start_va = 0x11c50000 end_va = 0x11c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 6062 start_va = 0x11c50000 end_va = 0x11c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 6063 start_va = 0x11c50000 end_va = 0x11c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 6064 start_va = 0x11c50000 end_va = 0x11c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 6065 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6066 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6067 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6068 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6069 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6070 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6071 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6072 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6073 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 6074 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 6075 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 6076 start_va = 0x590000 end_va = 0x590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 6077 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6078 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6079 start_va = 0x570000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 6080 start_va = 0x5b0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 6081 start_va = 0x5f0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 6082 start_va = 0x630000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 6083 start_va = 0x12e0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 6084 start_va = 0xb150000 end_va = 0xb24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 6085 start_va = 0xb4d0000 end_va = 0xb5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 6086 start_va = 0xb5d0000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b5d0000" filename = "" Region: id = 6087 start_va = 0xf8a0000 end_va = 0xf8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8a0000" filename = "" Region: id = 6088 start_va = 0xfbd0000 end_va = 0xfccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fbd0000" filename = "" Region: id = 6089 start_va = 0xfcd0000 end_va = 0xfd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fcd0000" filename = "" Region: id = 6090 start_va = 0x11c50000 end_va = 0x11d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 6091 start_va = 0x11d50000 end_va = 0x11d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011d50000" filename = "" Region: id = 6092 start_va = 0x215c0000 end_va = 0x216bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000215c0000" filename = "" Region: id = 6093 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 6094 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 6095 start_va = 0x21a40000 end_va = 0x21a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a40000" filename = "" Region: id = 6096 start_va = 0x21c40000 end_va = 0x21d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 6097 start_va = 0x22080000 end_va = 0x220bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022080000" filename = "" Region: id = 6098 start_va = 0x23000000 end_va = 0x230fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023000000" filename = "" Region: id = 6099 start_va = 0x29d00000 end_va = 0x29dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029d00000" filename = "" Region: id = 6100 start_va = 0x29e00000 end_va = 0x29efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029e00000" filename = "" Region: id = 6101 start_va = 0x29f00000 end_va = 0x29ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029f00000" filename = "" Region: id = 6102 start_va = 0x2a000000 end_va = 0x2a0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a000000" filename = "" Region: id = 6103 start_va = 0x2a100000 end_va = 0x2a13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a100000" filename = "" Region: id = 6104 start_va = 0x2a140000 end_va = 0x2a23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a140000" filename = "" Region: id = 6105 start_va = 0x2a240000 end_va = 0x2a27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a240000" filename = "" Region: id = 6106 start_va = 0x2a280000 end_va = 0x2a37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a280000" filename = "" Region: id = 6107 start_va = 0x2a380000 end_va = 0x2a3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a380000" filename = "" Region: id = 6108 start_va = 0x2a3c0000 end_va = 0x2a4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a3c0000" filename = "" Region: id = 6109 start_va = 0x2a4c0000 end_va = 0x2a4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a4c0000" filename = "" Region: id = 6110 start_va = 0x2a500000 end_va = 0x2a5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a500000" filename = "" Region: id = 6111 start_va = 0x2a600000 end_va = 0x2a63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a600000" filename = "" Region: id = 6112 start_va = 0x2a640000 end_va = 0x2a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a640000" filename = "" Region: id = 6113 start_va = 0x2a740000 end_va = 0x2a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a740000" filename = "" Region: id = 6114 start_va = 0x2a780000 end_va = 0x2a87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a780000" filename = "" Region: id = 6115 start_va = 0x2a880000 end_va = 0x2a8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a880000" filename = "" Region: id = 6116 start_va = 0x2a8c0000 end_va = 0x2a9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a8c0000" filename = "" Region: id = 6117 start_va = 0x2a9c0000 end_va = 0x2a9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a9c0000" filename = "" Region: id = 6118 start_va = 0x2aa00000 end_va = 0x2aafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002aa00000" filename = "" Region: id = 6119 start_va = 0x2ab00000 end_va = 0x2ab3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ab00000" filename = "" Region: id = 6120 start_va = 0x2ab40000 end_va = 0x2ac3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ab40000" filename = "" Region: id = 6121 start_va = 0x2ac40000 end_va = 0x2ac7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ac40000" filename = "" Region: id = 6122 start_va = 0x2ac80000 end_va = 0x2ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ac80000" filename = "" Region: id = 6123 start_va = 0x2ad80000 end_va = 0x2adbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ad80000" filename = "" Region: id = 6124 start_va = 0x2adc0000 end_va = 0x2aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002adc0000" filename = "" Region: id = 6125 start_va = 0x2aec0000 end_va = 0x2aefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002aec0000" filename = "" Region: id = 6126 start_va = 0x2af00000 end_va = 0x2affffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002af00000" filename = "" Region: id = 6127 start_va = 0x2b000000 end_va = 0x2b03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b000000" filename = "" Region: id = 6128 start_va = 0x2b040000 end_va = 0x2b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b040000" filename = "" Region: id = 6129 start_va = 0x2b140000 end_va = 0x2b17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b140000" filename = "" Region: id = 6130 start_va = 0x2b180000 end_va = 0x2b27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b180000" filename = "" Region: id = 6131 start_va = 0x2b280000 end_va = 0x2b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b280000" filename = "" Region: id = 6132 start_va = 0x2b2c0000 end_va = 0x2b3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b2c0000" filename = "" Region: id = 6133 start_va = 0x2b3c0000 end_va = 0x2b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b3c0000" filename = "" Region: id = 6134 start_va = 0x2b400000 end_va = 0x2b4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b400000" filename = "" Region: id = 6135 start_va = 0x2b500000 end_va = 0x2b53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b500000" filename = "" Region: id = 6136 start_va = 0x2b540000 end_va = 0x2b63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b540000" filename = "" Region: id = 6137 start_va = 0x2b640000 end_va = 0x2b67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b640000" filename = "" Region: id = 6138 start_va = 0x2b680000 end_va = 0x2b77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b680000" filename = "" Region: id = 6139 start_va = 0x2b780000 end_va = 0x2b7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b780000" filename = "" Region: id = 6140 start_va = 0x2b7c0000 end_va = 0x2b8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b7c0000" filename = "" Region: id = 6141 start_va = 0x2b8c0000 end_va = 0x2b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b8c0000" filename = "" Region: id = 6142 start_va = 0x2b900000 end_va = 0x2b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b900000" filename = "" Region: id = 6143 start_va = 0x2ba00000 end_va = 0x2ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ba00000" filename = "" Region: id = 6144 start_va = 0x2ba40000 end_va = 0x2bb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ba40000" filename = "" Region: id = 6145 start_va = 0x2bb40000 end_va = 0x2bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002bb40000" filename = "" Region: id = 6146 start_va = 0x2bb80000 end_va = 0x2bc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002bb80000" filename = "" Region: id = 6147 start_va = 0x2bc80000 end_va = 0x2bcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002bc80000" filename = "" Region: id = 6148 start_va = 0x2bcc0000 end_va = 0x2bdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002bcc0000" filename = "" Region: id = 6149 start_va = 0x2bdc0000 end_va = 0x2bdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002bdc0000" filename = "" Region: id = 6150 start_va = 0x2be00000 end_va = 0x2befffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002be00000" filename = "" Region: id = 6151 start_va = 0x2bf00000 end_va = 0x2bf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002bf00000" filename = "" Region: id = 6152 start_va = 0x2bf40000 end_va = 0x2c03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002bf40000" filename = "" Region: id = 6153 start_va = 0x2c040000 end_va = 0x2c07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c040000" filename = "" Region: id = 6154 start_va = 0x2c080000 end_va = 0x2c17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c080000" filename = "" Region: id = 6155 start_va = 0x2c180000 end_va = 0x2c1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c180000" filename = "" Region: id = 6156 start_va = 0x2c1c0000 end_va = 0x2c2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c1c0000" filename = "" Region: id = 6157 start_va = 0x2c2c0000 end_va = 0x2c2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c2c0000" filename = "" Region: id = 6158 start_va = 0x2c300000 end_va = 0x2c3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c300000" filename = "" Region: id = 6159 start_va = 0x2c400000 end_va = 0x2c43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c400000" filename = "" Region: id = 6160 start_va = 0x2c440000 end_va = 0x2c53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c440000" filename = "" Region: id = 6161 start_va = 0x2c540000 end_va = 0x2c57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c540000" filename = "" Region: id = 6162 start_va = 0x2c580000 end_va = 0x2c67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c580000" filename = "" Region: id = 6163 start_va = 0x2c680000 end_va = 0x2c6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c680000" filename = "" Region: id = 6164 start_va = 0x2c6c0000 end_va = 0x2c7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c6c0000" filename = "" Region: id = 6165 start_va = 0x2c7c0000 end_va = 0x2c7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c7c0000" filename = "" Region: id = 6166 start_va = 0x2c800000 end_va = 0x2c8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c800000" filename = "" Region: id = 6167 start_va = 0x2c900000 end_va = 0x2c93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c900000" filename = "" Region: id = 6168 start_va = 0x2c940000 end_va = 0x2ca3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002c940000" filename = "" Region: id = 6169 start_va = 0x2ca40000 end_va = 0x2ca7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ca40000" filename = "" Region: id = 6170 start_va = 0x2ca80000 end_va = 0x2cb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ca80000" filename = "" Region: id = 6171 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6172 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6173 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6174 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6175 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6176 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6177 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 6178 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6179 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6180 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6181 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6182 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 6183 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 6184 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 6185 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 6186 start_va = 0xf710000 end_va = 0xf74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f710000" filename = "" Region: id = 6187 start_va = 0xf750000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f750000" filename = "" Region: id = 6188 start_va = 0x20a00000 end_va = 0x20a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 6189 start_va = 0x20a80000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a80000" filename = "" Region: id = 6190 start_va = 0x20cc0000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020cc0000" filename = "" Region: id = 6191 start_va = 0x20ec0000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 6192 start_va = 0x28e00000 end_va = 0x28e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e00000" filename = "" Region: id = 6193 start_va = 0x28e40000 end_va = 0x28f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e40000" filename = "" Region: id = 6194 start_va = 0x29080000 end_va = 0x290bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029080000" filename = "" Region: id = 6195 start_va = 0x290c0000 end_va = 0x291bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000290c0000" filename = "" Region: id = 6196 start_va = 0x2cb80000 end_va = 0x2cbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cb80000" filename = "" Region: id = 6197 start_va = 0x2cbc0000 end_va = 0x2ccbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cbc0000" filename = "" Region: id = 6198 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6199 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6200 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6201 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6202 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6203 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6204 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6205 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6206 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6207 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6208 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6209 start_va = 0x12a0000 end_va = 0x12a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 6210 start_va = 0x12b0000 end_va = 0x12b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 6211 start_va = 0x12c0000 end_va = 0x12c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 6212 start_va = 0x12d0000 end_va = 0x12d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 6213 start_va = 0x12d0000 end_va = 0x12d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 6214 start_va = 0x12d0000 end_va = 0x12d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 6215 start_va = 0xb050000 end_va = 0xb08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 6216 start_va = 0xb250000 end_va = 0xb34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 6217 start_va = 0x12d0000 end_va = 0x12d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 6218 start_va = 0xb090000 end_va = 0xb090fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b090000" filename = "" Region: id = 6219 start_va = 0xb0a0000 end_va = 0xb0dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b0a0000" filename = "" Region: id = 6220 start_va = 0xb0e0000 end_va = 0xb11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b0e0000" filename = "" Region: id = 6221 start_va = 0xb350000 end_va = 0xb38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b350000" filename = "" Region: id = 6222 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 6223 start_va = 0x20880000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 6224 start_va = 0x29440000 end_va = 0x2953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029440000" filename = "" Region: id = 6225 start_va = 0x29940000 end_va = 0x29a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029940000" filename = "" Region: id = 6226 start_va = 0x2ccc0000 end_va = 0x2cdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ccc0000" filename = "" Region: id = 6227 start_va = 0x20980000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020980000" filename = "" Region: id = 6228 start_va = 0x29bc0000 end_va = 0x29cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029bc0000" filename = "" Region: id = 6229 start_va = 0x29540000 end_va = 0x2957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029540000" filename = "" Region: id = 6230 start_va = 0x29a40000 end_va = 0x29b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 6231 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 6232 start_va = 0x29b80000 end_va = 0x29bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b80000" filename = "" Region: id = 6233 start_va = 0x29cc0000 end_va = 0x29cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029cc0000" filename = "" Region: id = 6234 start_va = 0x2cdc0000 end_va = 0x2cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cdc0000" filename = "" Region: id = 6235 start_va = 0x2cec0000 end_va = 0x2cfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cec0000" filename = "" Region: id = 6236 start_va = 0x2cfc0000 end_va = 0x2d0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cfc0000" filename = "" Region: id = 6237 start_va = 0x2d0c0000 end_va = 0x2d0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d0c0000" filename = "" Region: id = 6238 start_va = 0x2d100000 end_va = 0x2d1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d100000" filename = "" Region: id = 6239 start_va = 0x2d200000 end_va = 0x2d23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d200000" filename = "" Region: id = 6240 start_va = 0x2d240000 end_va = 0x2d33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d240000" filename = "" Region: id = 6241 start_va = 0x2d340000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d340000" filename = "" Region: id = 6242 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 6243 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 6244 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 6245 start_va = 0xf8e0000 end_va = 0xf91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8e0000" filename = "" Region: id = 6246 start_va = 0x20fc0000 end_va = 0x210bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 6247 start_va = 0x21380000 end_va = 0x213bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 6248 start_va = 0x213c0000 end_va = 0x214bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000213c0000" filename = "" Region: id = 6249 start_va = 0x217c0000 end_va = 0x217fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000217c0000" filename = "" Region: id = 6250 start_va = 0x21800000 end_va = 0x218fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021800000" filename = "" Region: id = 6251 start_va = 0x21ac0000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ac0000" filename = "" Region: id = 6252 start_va = 0x21e40000 end_va = 0x21f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e40000" filename = "" Region: id = 6253 start_va = 0x2d480000 end_va = 0x2d4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 6254 start_va = 0x2d4c0000 end_va = 0x2d5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d4c0000" filename = "" Region: id = 6255 start_va = 0x2d5c0000 end_va = 0x2d5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d5c0000" filename = "" Region: id = 6256 start_va = 0x2d600000 end_va = 0x2d6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d600000" filename = "" Region: id = 6257 start_va = 0x2d700000 end_va = 0x2d73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d700000" filename = "" Region: id = 6258 start_va = 0x2d740000 end_va = 0x2d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d740000" filename = "" Region: id = 6259 start_va = 0x2d840000 end_va = 0x2d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d840000" filename = "" Region: id = 6260 start_va = 0x2d880000 end_va = 0x2d97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d880000" filename = "" Region: id = 6261 start_va = 0x2d980000 end_va = 0x2d9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d980000" filename = "" Region: id = 6262 start_va = 0x2d9c0000 end_va = 0x2dabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d9c0000" filename = "" Region: id = 6263 start_va = 0x2dac0000 end_va = 0x2dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dac0000" filename = "" Region: id = 6264 start_va = 0x2db00000 end_va = 0x2dbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db00000" filename = "" Region: id = 6265 start_va = 0x2dc00000 end_va = 0x2dc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dc00000" filename = "" Region: id = 6266 start_va = 0x2dc40000 end_va = 0x2dd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dc40000" filename = "" Region: id = 6267 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6268 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6269 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6270 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6271 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6272 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6273 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6274 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6275 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6276 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6277 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6278 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6279 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6280 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6281 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6282 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6283 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6284 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6285 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6286 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6287 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6288 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6289 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6290 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6291 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6292 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6293 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6294 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6295 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6296 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6297 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6298 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6299 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6300 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6301 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6302 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6303 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6304 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6305 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6306 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6307 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6308 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6309 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6310 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6311 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6312 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6313 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6314 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6315 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6316 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 6317 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6318 start_va = 0x12a0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 6319 start_va = 0x12e0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 6320 start_va = 0xb120000 end_va = 0xb21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b120000" filename = "" Region: id = 6321 start_va = 0xb4d0000 end_va = 0xb5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 6322 start_va = 0xb5d0000 end_va = 0xb60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b5d0000" filename = "" Region: id = 6323 start_va = 0xf890000 end_va = 0xf8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f890000" filename = "" Region: id = 6324 start_va = 0xf920000 end_va = 0xf95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f920000" filename = "" Region: id = 6325 start_va = 0xfbd0000 end_va = 0xfccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fbd0000" filename = "" Region: id = 6326 start_va = 0xfcd0000 end_va = 0xfd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fcd0000" filename = "" Region: id = 6327 start_va = 0x11c50000 end_va = 0x11d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011c50000" filename = "" Region: id = 6328 start_va = 0x11d50000 end_va = 0x11e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011d50000" filename = "" Region: id = 6329 start_va = 0x11e50000 end_va = 0x11e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011e50000" filename = "" Region: id = 6330 start_va = 0x20dc0000 end_va = 0x20ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020dc0000" filename = "" Region: id = 6331 start_va = 0x210c0000 end_va = 0x211bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000210c0000" filename = "" Region: id = 6332 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6333 start_va = 0x11e90000 end_va = 0x11ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011e90000" filename = "" Region: id = 6334 start_va = 0x20a40000 end_va = 0x20a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a40000" filename = "" Region: id = 6335 start_va = 0x214c0000 end_va = 0x215bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000214c0000" filename = "" Region: id = 6336 start_va = 0x215c0000 end_va = 0x216bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000215c0000" filename = "" Region: id = 6337 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6338 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6339 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6340 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6341 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6342 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6343 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6344 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6345 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6346 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6347 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6348 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6349 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6350 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6351 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6352 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6353 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6354 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6355 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6356 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6357 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6358 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6359 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6360 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6361 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6362 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6363 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6364 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6365 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6366 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6367 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6368 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6369 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6370 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6371 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6372 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6373 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6374 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6375 start_va = 0xb090000 end_va = 0xb090fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b090000" filename = "" Region: id = 6376 start_va = 0xb220000 end_va = 0xb220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 6377 start_va = 0xb230000 end_va = 0xb230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b230000" filename = "" Region: id = 6378 start_va = 0xb240000 end_va = 0xb240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b240000" filename = "" Region: id = 6379 start_va = 0xf8d0000 end_va = 0xf8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6380 start_va = 0xf8d0000 end_va = 0xf8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6381 start_va = 0xf8d0000 end_va = 0xf8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6382 start_va = 0xf8d0000 end_va = 0xf8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6383 start_va = 0xf8d0000 end_va = 0xf8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6384 start_va = 0xf8d0000 end_va = 0xf8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6385 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 6386 start_va = 0xf970000 end_va = 0xf970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f970000" filename = "" Region: id = 6387 start_va = 0xf980000 end_va = 0xf980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f980000" filename = "" Region: id = 6388 start_va = 0x11ed0000 end_va = 0x11ed0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ed0000" filename = "" Region: id = 6389 start_va = 0x11ee0000 end_va = 0x11ee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ee0000" filename = "" Region: id = 6390 start_va = 0x11ef0000 end_va = 0x11ef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ef0000" filename = "" Region: id = 6391 start_va = 0x11f00000 end_va = 0x11f00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f00000" filename = "" Region: id = 6392 start_va = 0x11f10000 end_va = 0x11f10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f10000" filename = "" Region: id = 6393 start_va = 0x11f20000 end_va = 0x11f20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f20000" filename = "" Region: id = 6394 start_va = 0x11f30000 end_va = 0x11f30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f30000" filename = "" Region: id = 6395 start_va = 0x11f40000 end_va = 0x11f40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f40000" filename = "" Region: id = 6396 start_va = 0x11f50000 end_va = 0x11f50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f50000" filename = "" Region: id = 6397 start_va = 0x11f60000 end_va = 0x11f60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f60000" filename = "" Region: id = 6398 start_va = 0x11f70000 end_va = 0x11f70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f70000" filename = "" Region: id = 6399 start_va = 0x11f80000 end_va = 0x11f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f80000" filename = "" Region: id = 6400 start_va = 0x11f90000 end_va = 0x11f90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f90000" filename = "" Region: id = 6401 start_va = 0x11fa0000 end_va = 0x11fa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011fa0000" filename = "" Region: id = 6402 start_va = 0x11fb0000 end_va = 0x11fb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011fb0000" filename = "" Region: id = 6403 start_va = 0x11fc0000 end_va = 0x11fc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011fc0000" filename = "" Region: id = 6404 start_va = 0x11fd0000 end_va = 0x11fd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011fd0000" filename = "" Region: id = 6405 start_va = 0x11fe0000 end_va = 0x11fe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011fe0000" filename = "" Region: id = 6406 start_va = 0x11ff0000 end_va = 0x11ff0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011ff0000" filename = "" Region: id = 6407 start_va = 0x12000000 end_va = 0x12000fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012000000" filename = "" Region: id = 6408 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 6409 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 6410 start_va = 0x17bf0000 end_va = 0x17bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bf0000" filename = "" Region: id = 6411 start_va = 0x211c0000 end_va = 0x211c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000211c0000" filename = "" Region: id = 6412 start_va = 0x211d0000 end_va = 0x211d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000211d0000" filename = "" Region: id = 6413 start_va = 0x211e0000 end_va = 0x211e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000211e0000" filename = "" Region: id = 6414 start_va = 0x211f0000 end_va = 0x211f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000211f0000" filename = "" Region: id = 6415 start_va = 0xb050000 end_va = 0xb050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 6416 start_va = 0xb060000 end_va = 0xb060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b060000" filename = "" Region: id = 6417 start_va = 0xea0000 end_va = 0xea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 6418 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6419 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6420 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6421 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 6422 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 6423 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6424 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6425 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 6426 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 6427 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 6428 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 6429 start_va = 0xb050000 end_va = 0xb08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 6430 start_va = 0xb090000 end_va = 0xb0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b090000" filename = "" Region: id = 6431 start_va = 0xb0d0000 end_va = 0xb10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b0d0000" filename = "" Region: id = 6432 start_va = 0xb220000 end_va = 0xb31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 6433 start_va = 0xb320000 end_va = 0xb35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 6434 start_va = 0xf5d0000 end_va = 0xf6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 6435 start_va = 0xf6d0000 end_va = 0xf7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f6d0000" filename = "" Region: id = 6436 start_va = 0xf7d0000 end_va = 0xf80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f7d0000" filename = "" Region: id = 6437 start_va = 0xf810000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f810000" filename = "" Region: id = 6438 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 6439 start_va = 0xf8d0000 end_va = 0xf90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6440 start_va = 0x11e90000 end_va = 0x11f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011e90000" filename = "" Region: id = 6441 start_va = 0x11f90000 end_va = 0x1208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f90000" filename = "" Region: id = 6442 start_va = 0x12090000 end_va = 0x1218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012090000" filename = "" Region: id = 6443 start_va = 0x12190000 end_va = 0x1228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012190000" filename = "" Region: id = 6444 start_va = 0x20880000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 6445 start_va = 0x20980000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020980000" filename = "" Region: id = 6446 start_va = 0x20a00000 end_va = 0x20a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 6447 start_va = 0x20a80000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a80000" filename = "" Region: id = 6448 start_va = 0x20cc0000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020cc0000" filename = "" Region: id = 6449 start_va = 0x20ec0000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 6450 start_va = 0x20fc0000 end_va = 0x210bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 6451 start_va = 0x211c0000 end_va = 0x211fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000211c0000" filename = "" Region: id = 6452 start_va = 0x21200000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021200000" filename = "" Region: id = 6453 start_va = 0x21380000 end_va = 0x2147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 6454 start_va = 0x21480000 end_va = 0x2157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021480000" filename = "" Region: id = 6455 start_va = 0x216c0000 end_va = 0x217bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000216c0000" filename = "" Region: id = 6456 start_va = 0x217c0000 end_va = 0x217fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000217c0000" filename = "" Region: id = 6457 start_va = 0x21800000 end_va = 0x218fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021800000" filename = "" Region: id = 6458 start_va = 0x21900000 end_va = 0x2193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 6459 start_va = 0x21940000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021940000" filename = "" Region: id = 6460 start_va = 0x21a40000 end_va = 0x21a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a40000" filename = "" Region: id = 6461 start_va = 0x21c40000 end_va = 0x21d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 6462 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6463 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6464 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6465 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 6466 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 6467 start_va = 0x21a80000 end_va = 0x21abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a80000" filename = "" Region: id = 6468 start_va = 0x21ac0000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ac0000" filename = "" Region: id = 6469 start_va = 0x21d40000 end_va = 0x21e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d40000" filename = "" Region: id = 6470 start_va = 0x21e40000 end_va = 0x21f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e40000" filename = "" Region: id = 6471 start_va = 0x21f40000 end_va = 0x21f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f40000" filename = "" Region: id = 6472 start_va = 0x21f80000 end_va = 0x2207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f80000" filename = "" Region: id = 6473 start_va = 0x22080000 end_va = 0x220bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022080000" filename = "" Region: id = 6474 start_va = 0x220c0000 end_va = 0x220fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000220c0000" filename = "" Region: id = 6475 start_va = 0x23000000 end_va = 0x230fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023000000" filename = "" Region: id = 6476 start_va = 0x23100000 end_va = 0x231fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023100000" filename = "" Region: id = 6477 start_va = 0x28c80000 end_va = 0x28cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c80000" filename = "" Region: id = 6478 start_va = 0x28cc0000 end_va = 0x28dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028cc0000" filename = "" Region: id = 6479 start_va = 0x28dc0000 end_va = 0x28dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028dc0000" filename = "" Region: id = 6480 start_va = 0x28e00000 end_va = 0x28efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e00000" filename = "" Region: id = 6481 start_va = 0x28f00000 end_va = 0x28f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f00000" filename = "" Region: id = 6482 start_va = 0x28f40000 end_va = 0x2903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f40000" filename = "" Region: id = 6483 start_va = 0x29040000 end_va = 0x2907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029040000" filename = "" Region: id = 6484 start_va = 0x29080000 end_va = 0x2917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029080000" filename = "" Region: id = 6485 start_va = 0x29180000 end_va = 0x291bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029180000" filename = "" Region: id = 6486 start_va = 0x291c0000 end_va = 0x292bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000291c0000" filename = "" Region: id = 6487 start_va = 0x292c0000 end_va = 0x292fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000292c0000" filename = "" Region: id = 6488 start_va = 0x29300000 end_va = 0x293fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029300000" filename = "" Region: id = 6489 start_va = 0x29400000 end_va = 0x2943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029400000" filename = "" Region: id = 6490 start_va = 0x29440000 end_va = 0x2953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029440000" filename = "" Region: id = 6491 start_va = 0x29540000 end_va = 0x2957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029540000" filename = "" Region: id = 6492 start_va = 0x29580000 end_va = 0x2967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029580000" filename = "" Region: id = 6493 start_va = 0x29680000 end_va = 0x296bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029680000" filename = "" Region: id = 6494 start_va = 0x296c0000 end_va = 0x297bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000296c0000" filename = "" Region: id = 6495 start_va = 0x297c0000 end_va = 0x297fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000297c0000" filename = "" Region: id = 6496 start_va = 0x29800000 end_va = 0x298fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029800000" filename = "" Region: id = 6497 start_va = 0x29900000 end_va = 0x2993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029900000" filename = "" Region: id = 6498 start_va = 0x29940000 end_va = 0x29a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029940000" filename = "" Region: id = 6499 start_va = 0x29a40000 end_va = 0x29a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 6500 start_va = 0x29a80000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a80000" filename = "" Region: id = 6501 start_va = 0x29b80000 end_va = 0x29bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b80000" filename = "" Region: id = 6502 start_va = 0x29bc0000 end_va = 0x29cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029bc0000" filename = "" Region: id = 6503 start_va = 0x29cc0000 end_va = 0x29cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029cc0000" filename = "" Region: id = 6504 start_va = 0x29d00000 end_va = 0x29dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029d00000" filename = "" Region: id = 6505 start_va = 0x29e00000 end_va = 0x29e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029e00000" filename = "" Region: id = 6506 start_va = 0x29e40000 end_va = 0x29f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029e40000" filename = "" Region: id = 6507 start_va = 0x29f40000 end_va = 0x29f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029f40000" filename = "" Region: id = 6508 start_va = 0x29f80000 end_va = 0x2a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029f80000" filename = "" Region: id = 6509 start_va = 0x2a080000 end_va = 0x2a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a080000" filename = "" Region: id = 6510 start_va = 0x2a0c0000 end_va = 0x2a1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a0c0000" filename = "" Region: id = 6511 start_va = 0x2a1c0000 end_va = 0x2a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a1c0000" filename = "" Region: id = 6512 start_va = 0x2a200000 end_va = 0x2a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a200000" filename = "" Region: id = 6513 start_va = 0x2a300000 end_va = 0x2a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a300000" filename = "" Region: id = 6514 start_va = 0x2a340000 end_va = 0x2a43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a340000" filename = "" Region: id = 6515 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6516 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6517 start_va = 0x12290000 end_va = 0x122cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012290000" filename = "" Region: id = 6518 start_va = 0x122d0000 end_va = 0x123cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000122d0000" filename = "" Region: id = 6519 start_va = 0x2a440000 end_va = 0x2a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a440000" filename = "" Region: id = 6520 start_va = 0x2a480000 end_va = 0x2a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a480000" filename = "" Region: id = 6521 start_va = 0x2a580000 end_va = 0x2a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a580000" filename = "" Region: id = 6522 start_va = 0x2a5c0000 end_va = 0x2a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a5c0000" filename = "" Region: id = 6523 start_va = 0x2a6c0000 end_va = 0x2a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a6c0000" filename = "" Region: id = 6524 start_va = 0x2a700000 end_va = 0x2a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a700000" filename = "" Region: id = 6525 start_va = 0x2a800000 end_va = 0x2a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a800000" filename = "" Region: id = 6526 start_va = 0x2a840000 end_va = 0x2a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a840000" filename = "" Region: id = 6527 start_va = 0x2a940000 end_va = 0x2a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a940000" filename = "" Region: id = 6528 start_va = 0x2a980000 end_va = 0x2aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a980000" filename = "" Region: id = 6529 start_va = 0x2aa80000 end_va = 0x2aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002aa80000" filename = "" Region: id = 6530 start_va = 0x2aac0000 end_va = 0x2abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002aac0000" filename = "" Region: id = 6531 start_va = 0x2abc0000 end_va = 0x2abfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002abc0000" filename = "" Region: id = 6532 start_va = 0x2ac00000 end_va = 0x2acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ac00000" filename = "" Region: id = 6533 start_va = 0x2ad00000 end_va = 0x2ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ad00000" filename = "" Region: id = 6534 start_va = 0x2ad40000 end_va = 0x2ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ad40000" filename = "" Region: id = 6535 start_va = 0x2ae40000 end_va = 0x2ae7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ae40000" filename = "" Region: id = 6536 start_va = 0x2ae80000 end_va = 0x2af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ae80000" filename = "" Region: id = 6537 start_va = 0x2af80000 end_va = 0x2afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002af80000" filename = "" Region: id = 6538 start_va = 0x2afc0000 end_va = 0x2b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002afc0000" filename = "" Region: id = 6539 start_va = 0x2b0c0000 end_va = 0x2b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b0c0000" filename = "" Region: id = 6540 start_va = 0x2b100000 end_va = 0x2b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b100000" filename = "" Region: id = 6541 start_va = 0x2b200000 end_va = 0x2b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b200000" filename = "" Region: id = 6542 start_va = 0x2b240000 end_va = 0x2b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b240000" filename = "" Region: id = 6543 start_va = 0x2b340000 end_va = 0x2b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b340000" filename = "" Region: id = 6544 start_va = 0x2b380000 end_va = 0x2b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b380000" filename = "" Region: id = 6545 start_va = 0x2b480000 end_va = 0x2b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b480000" filename = "" Region: id = 6546 start_va = 0x2b4c0000 end_va = 0x2b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b4c0000" filename = "" Region: id = 6547 start_va = 0x2b5c0000 end_va = 0x2b5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b5c0000" filename = "" Region: id = 6548 start_va = 0x2b600000 end_va = 0x2b63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b600000" filename = "" Region: id = 6549 start_va = 0x2cb80000 end_va = 0x2cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cb80000" filename = "" Region: id = 6550 start_va = 0x2cc80000 end_va = 0x2cd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cc80000" filename = "" Region: id = 6551 start_va = 0x2cd80000 end_va = 0x2cdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cd80000" filename = "" Region: id = 6552 start_va = 0x2cdc0000 end_va = 0x2cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cdc0000" filename = "" Region: id = 6553 start_va = 0x2cec0000 end_va = 0x2cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cec0000" filename = "" Region: id = 6554 start_va = 0x2cf00000 end_va = 0x2cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cf00000" filename = "" Region: id = 6555 start_va = 0x2d000000 end_va = 0x2d03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d000000" filename = "" Region: id = 6556 start_va = 0x2d040000 end_va = 0x2d13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d040000" filename = "" Region: id = 6557 start_va = 0x2d140000 end_va = 0x2d17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d140000" filename = "" Region: id = 6558 start_va = 0x2d180000 end_va = 0x2d27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d180000" filename = "" Region: id = 6559 start_va = 0x2d280000 end_va = 0x2d2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 6560 start_va = 0x2d2c0000 end_va = 0x2d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d2c0000" filename = "" Region: id = 6561 start_va = 0x2d3c0000 end_va = 0x2d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d3c0000" filename = "" Region: id = 6562 start_va = 0x2d400000 end_va = 0x2d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d400000" filename = "" Region: id = 6563 start_va = 0x2d500000 end_va = 0x2d53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d500000" filename = "" Region: id = 6564 start_va = 0x2d540000 end_va = 0x2d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d540000" filename = "" Region: id = 6565 start_va = 0x2d640000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d640000" filename = "" Region: id = 6566 start_va = 0x2d680000 end_va = 0x2d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 6567 start_va = 0x2d780000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d780000" filename = "" Region: id = 6568 start_va = 0x2d7c0000 end_va = 0x2d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 6569 start_va = 0x2d8c0000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d8c0000" filename = "" Region: id = 6570 start_va = 0x2d900000 end_va = 0x2d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 6571 start_va = 0x2da00000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da00000" filename = "" Region: id = 6572 start_va = 0x2da40000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 6573 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 6574 start_va = 0x2db80000 end_va = 0x2dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db80000" filename = "" Region: id = 6575 start_va = 0x2dc80000 end_va = 0x2dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dc80000" filename = "" Region: id = 6576 start_va = 0x2dcc0000 end_va = 0x2ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 6577 start_va = 0x2ddc0000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 6578 start_va = 0x2de00000 end_va = 0x2defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 6579 start_va = 0x2df00000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df00000" filename = "" Region: id = 6580 start_va = 0x2df40000 end_va = 0x2e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 6581 start_va = 0x2e040000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e040000" filename = "" Region: id = 6582 start_va = 0x2e080000 end_va = 0x2e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 6583 start_va = 0x2e180000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e180000" filename = "" Region: id = 6584 start_va = 0x2e1c0000 end_va = 0x2e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 6585 start_va = 0x2e2c0000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e2c0000" filename = "" Region: id = 6586 start_va = 0x2e300000 end_va = 0x2e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 6587 start_va = 0x2e400000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e400000" filename = "" Region: id = 6588 start_va = 0x2e440000 end_va = 0x2e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 6589 start_va = 0x2e540000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e540000" filename = "" Region: id = 6590 start_va = 0x2e580000 end_va = 0x2e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 6591 start_va = 0x2e680000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e680000" filename = "" Region: id = 6592 start_va = 0x2e6c0000 end_va = 0x2e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 6593 start_va = 0x2e7c0000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e7c0000" filename = "" Region: id = 6594 start_va = 0x2e800000 end_va = 0x2e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 6595 start_va = 0x2e900000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e900000" filename = "" Region: id = 6596 start_va = 0x2e940000 end_va = 0x2ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 6597 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6598 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6599 start_va = 0x2ea40000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea40000" filename = "" Region: id = 6600 start_va = 0x2ea80000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 6601 start_va = 0x2eb80000 end_va = 0x2ebbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb80000" filename = "" Region: id = 6602 start_va = 0x2ebc0000 end_va = 0x2ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ebc0000" filename = "" Region: id = 6603 start_va = 0x2ecc0000 end_va = 0x2ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ecc0000" filename = "" Region: id = 6604 start_va = 0x2ed00000 end_va = 0x2edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ed00000" filename = "" Region: id = 6605 start_va = 0x2ee00000 end_va = 0x2ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ee00000" filename = "" Region: id = 6606 start_va = 0x2ee40000 end_va = 0x2ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ee40000" filename = "" Region: id = 6607 start_va = 0x2ef40000 end_va = 0x2ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ef40000" filename = "" Region: id = 6608 start_va = 0x2ef80000 end_va = 0x2f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ef80000" filename = "" Region: id = 6609 start_va = 0x2f080000 end_va = 0x2f0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f080000" filename = "" Region: id = 6610 start_va = 0x2f0c0000 end_va = 0x2f1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f0c0000" filename = "" Region: id = 6611 start_va = 0x2f1c0000 end_va = 0x2f1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f1c0000" filename = "" Region: id = 6612 start_va = 0x2f200000 end_va = 0x2f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f200000" filename = "" Region: id = 6613 start_va = 0x2f300000 end_va = 0x2f33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f300000" filename = "" Region: id = 6614 start_va = 0x2f340000 end_va = 0x2f43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f340000" filename = "" Region: id = 6615 start_va = 0x2f440000 end_va = 0x2f47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f440000" filename = "" Region: id = 6616 start_va = 0x2f480000 end_va = 0x2f57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f480000" filename = "" Region: id = 6617 start_va = 0x2f580000 end_va = 0x2f5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f580000" filename = "" Region: id = 6618 start_va = 0x2f5c0000 end_va = 0x2f6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f5c0000" filename = "" Region: id = 6619 start_va = 0x2f6c0000 end_va = 0x2f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f6c0000" filename = "" Region: id = 6620 start_va = 0x2f700000 end_va = 0x2f7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f700000" filename = "" Region: id = 6621 start_va = 0x2f800000 end_va = 0x2f83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f800000" filename = "" Region: id = 6622 start_va = 0x2f840000 end_va = 0x2f93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f840000" filename = "" Region: id = 6623 start_va = 0x2f940000 end_va = 0x2f97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f940000" filename = "" Region: id = 6624 start_va = 0x2f980000 end_va = 0x2fa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f980000" filename = "" Region: id = 6625 start_va = 0x2fa80000 end_va = 0x2fabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fa80000" filename = "" Region: id = 6626 start_va = 0x2fac0000 end_va = 0x2fbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fac0000" filename = "" Region: id = 6627 start_va = 0x2fbc0000 end_va = 0x2fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fbc0000" filename = "" Region: id = 6628 start_va = 0x2fc00000 end_va = 0x2fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fc00000" filename = "" Region: id = 6629 start_va = 0x2fd00000 end_va = 0x2fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fd00000" filename = "" Region: id = 6630 start_va = 0x2fd40000 end_va = 0x2fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fd40000" filename = "" Region: id = 6631 start_va = 0x2fe40000 end_va = 0x2fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fe40000" filename = "" Region: id = 6632 start_va = 0x2fe80000 end_va = 0x2ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fe80000" filename = "" Region: id = 6633 start_va = 0x2ff80000 end_va = 0x2ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ff80000" filename = "" Region: id = 6634 start_va = 0x2ffc0000 end_va = 0x300bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ffc0000" filename = "" Region: id = 6635 start_va = 0x300c0000 end_va = 0x300fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000300c0000" filename = "" Region: id = 6636 start_va = 0x30100000 end_va = 0x301fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030100000" filename = "" Region: id = 6637 start_va = 0x30200000 end_va = 0x3023ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030200000" filename = "" Region: id = 6638 start_va = 0x30240000 end_va = 0x3033ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030240000" filename = "" Region: id = 6639 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6640 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6641 start_va = 0x30340000 end_va = 0x3037ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030340000" filename = "" Region: id = 6642 start_va = 0x30380000 end_va = 0x3047ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030380000" filename = "" Region: id = 6643 start_va = 0x30480000 end_va = 0x304bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030480000" filename = "" Region: id = 6644 start_va = 0x304c0000 end_va = 0x305bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000304c0000" filename = "" Region: id = 6645 start_va = 0x305c0000 end_va = 0x305fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000305c0000" filename = "" Region: id = 6646 start_va = 0x30600000 end_va = 0x306fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030600000" filename = "" Region: id = 6647 start_va = 0x30700000 end_va = 0x3073ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030700000" filename = "" Region: id = 6648 start_va = 0x30740000 end_va = 0x3083ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030740000" filename = "" Region: id = 6649 start_va = 0x30840000 end_va = 0x3087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030840000" filename = "" Region: id = 6650 start_va = 0x30880000 end_va = 0x3097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030880000" filename = "" Region: id = 6651 start_va = 0x30980000 end_va = 0x309bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030980000" filename = "" Region: id = 6652 start_va = 0x309c0000 end_va = 0x30abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000309c0000" filename = "" Region: id = 6653 start_va = 0x30ac0000 end_va = 0x30afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 6654 start_va = 0x30b00000 end_va = 0x30bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030b00000" filename = "" Region: id = 6655 start_va = 0x30c00000 end_va = 0x30c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c00000" filename = "" Region: id = 6656 start_va = 0x30c40000 end_va = 0x30d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c40000" filename = "" Region: id = 6657 start_va = 0x30d40000 end_va = 0x30d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030d40000" filename = "" Region: id = 6658 start_va = 0x30d80000 end_va = 0x30e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030d80000" filename = "" Region: id = 6659 start_va = 0x30e80000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030e80000" filename = "" Region: id = 6660 start_va = 0x30ec0000 end_va = 0x30fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ec0000" filename = "" Region: id = 6661 start_va = 0x30fc0000 end_va = 0x30ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030fc0000" filename = "" Region: id = 6662 start_va = 0x31000000 end_va = 0x310fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 6663 start_va = 0x31100000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031100000" filename = "" Region: id = 6664 start_va = 0x31140000 end_va = 0x3123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031140000" filename = "" Region: id = 6665 start_va = 0x31240000 end_va = 0x3127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031240000" filename = "" Region: id = 6666 start_va = 0x31280000 end_va = 0x3137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031280000" filename = "" Region: id = 6667 start_va = 0x31380000 end_va = 0x313bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031380000" filename = "" Region: id = 6668 start_va = 0x313c0000 end_va = 0x314bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000313c0000" filename = "" Region: id = 6669 start_va = 0x314c0000 end_va = 0x314fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000314c0000" filename = "" Region: id = 6670 start_va = 0x31500000 end_va = 0x315fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031500000" filename = "" Region: id = 6671 start_va = 0x31600000 end_va = 0x3163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031600000" filename = "" Region: id = 6672 start_va = 0x31640000 end_va = 0x3173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031640000" filename = "" Region: id = 6673 start_va = 0x31740000 end_va = 0x3177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031740000" filename = "" Region: id = 6674 start_va = 0x31780000 end_va = 0x3187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031780000" filename = "" Region: id = 6675 start_va = 0x31880000 end_va = 0x318bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031880000" filename = "" Region: id = 6676 start_va = 0x318c0000 end_va = 0x319bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000318c0000" filename = "" Region: id = 6677 start_va = 0x319c0000 end_va = 0x319fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000319c0000" filename = "" Region: id = 6678 start_va = 0x31a00000 end_va = 0x31afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a00000" filename = "" Region: id = 6679 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6680 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6681 start_va = 0x31b00000 end_va = 0x31b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b00000" filename = "" Region: id = 6682 start_va = 0x31b40000 end_va = 0x31c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b40000" filename = "" Region: id = 6683 start_va = 0x31c40000 end_va = 0x31c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031c40000" filename = "" Region: id = 6684 start_va = 0x31c80000 end_va = 0x31d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031c80000" filename = "" Region: id = 6685 start_va = 0x31d80000 end_va = 0x31dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031d80000" filename = "" Region: id = 6686 start_va = 0x31dc0000 end_va = 0x31ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031dc0000" filename = "" Region: id = 6687 start_va = 0x31ec0000 end_va = 0x31efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031ec0000" filename = "" Region: id = 6688 start_va = 0x31f00000 end_va = 0x31ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f00000" filename = "" Region: id = 6689 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6690 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6691 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6692 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6693 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6694 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6695 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6696 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6697 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6698 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6699 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6700 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6701 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6702 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6703 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6704 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6705 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6706 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6707 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6708 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6709 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6710 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6711 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6712 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6713 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6714 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6715 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6716 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6717 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6718 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6719 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6720 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6721 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6722 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6723 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6724 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6725 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6726 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6727 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6728 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6729 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6730 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6731 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6732 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6733 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6734 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6735 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6736 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6737 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6738 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6739 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6740 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6741 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6742 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6743 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6744 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6745 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6746 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6747 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6748 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6749 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6750 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6751 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6752 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6753 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6754 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6755 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6756 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6757 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6758 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6759 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6760 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6761 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6762 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6763 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6764 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6765 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6766 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6767 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6768 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6769 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6770 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6771 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6772 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6773 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6774 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6775 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6776 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6777 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6778 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6779 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6780 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6781 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6782 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6783 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6784 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6785 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6786 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6787 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6788 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6789 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6790 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6791 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6792 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6793 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6794 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6795 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6796 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6797 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6798 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6799 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6800 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6801 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6802 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6803 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6804 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6805 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6806 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6807 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6808 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6809 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6810 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6811 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6812 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6813 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6814 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6815 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6816 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6817 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 6818 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6819 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6820 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6821 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6822 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6823 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6824 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6825 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6826 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6827 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6828 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6829 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6830 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6831 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6832 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6833 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6834 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6835 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6836 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6837 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6838 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6839 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6840 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6841 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6842 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6843 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6844 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6845 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6846 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6847 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6848 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6849 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6850 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6851 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6852 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6853 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6854 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6855 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6856 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6857 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6858 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6859 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6860 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6861 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6862 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6863 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6864 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6865 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6866 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6867 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6868 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6869 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6870 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6871 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6872 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6873 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6874 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6875 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6876 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6877 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6878 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6879 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6880 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6881 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6882 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6883 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6884 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6885 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6886 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6887 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6888 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6889 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6890 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6891 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6892 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6893 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6894 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6895 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6896 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6897 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6898 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6899 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6900 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6901 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6902 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6903 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6904 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6905 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6906 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6907 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6908 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6909 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6910 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6911 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6912 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6913 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6914 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6915 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6916 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6917 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6918 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6919 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6920 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6921 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6922 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6923 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6924 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6925 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6926 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6927 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6928 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6929 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6930 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6931 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6932 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6933 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6934 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6935 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6936 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6937 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6938 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6939 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6940 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6941 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6942 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6943 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6944 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6945 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 6946 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 6947 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 6948 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 6949 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 6950 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 6951 start_va = 0xb050000 end_va = 0xb08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 6952 start_va = 0xb090000 end_va = 0xb0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b090000" filename = "" Region: id = 6953 start_va = 0xb0d0000 end_va = 0xb10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b0d0000" filename = "" Region: id = 6954 start_va = 0xb220000 end_va = 0xb31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 6955 start_va = 0xb320000 end_va = 0xb41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 6956 start_va = 0xb420000 end_va = 0xb45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b420000" filename = "" Region: id = 6957 start_va = 0xb460000 end_va = 0xb49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b460000" filename = "" Region: id = 6958 start_va = 0xf5d0000 end_va = 0xf6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 6959 start_va = 0xf6d0000 end_va = 0xf7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f6d0000" filename = "" Region: id = 6960 start_va = 0xf7d0000 end_va = 0xf80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f7d0000" filename = "" Region: id = 6961 start_va = 0xf810000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f810000" filename = "" Region: id = 6962 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 6963 start_va = 0xf8d0000 end_va = 0xf90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 6964 start_va = 0x11e90000 end_va = 0x11f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011e90000" filename = "" Region: id = 6965 start_va = 0x11f90000 end_va = 0x1208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f90000" filename = "" Region: id = 6966 start_va = 0x12090000 end_va = 0x1218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012090000" filename = "" Region: id = 6967 start_va = 0x12190000 end_va = 0x1228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012190000" filename = "" Region: id = 6968 start_va = 0x12290000 end_va = 0x1238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012290000" filename = "" Region: id = 6969 start_va = 0x12390000 end_va = 0x123cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012390000" filename = "" Region: id = 6970 start_va = 0x123d0000 end_va = 0x124cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000123d0000" filename = "" Region: id = 6971 start_va = 0x124d0000 end_va = 0x1250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000124d0000" filename = "" Region: id = 6972 start_va = 0x20880000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 6973 start_va = 0x20980000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020980000" filename = "" Region: id = 6974 start_va = 0x20a00000 end_va = 0x20a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 6975 start_va = 0x20a40000 end_va = 0x20a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a40000" filename = "" Region: id = 6976 start_va = 0x20a80000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a80000" filename = "" Region: id = 6977 start_va = 0x20cc0000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020cc0000" filename = "" Region: id = 6978 start_va = 0x20ec0000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 6979 start_va = 0x20fc0000 end_va = 0x210bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 6980 start_va = 0x211c0000 end_va = 0x211fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000211c0000" filename = "" Region: id = 6981 start_va = 0x21200000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021200000" filename = "" Region: id = 6982 start_va = 0x21380000 end_va = 0x2147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 6983 start_va = 0x21480000 end_va = 0x2157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021480000" filename = "" Region: id = 6984 start_va = 0x21580000 end_va = 0x2167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021580000" filename = "" Region: id = 6985 start_va = 0x21680000 end_va = 0x216bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021680000" filename = "" Region: id = 6986 start_va = 0x216c0000 end_va = 0x217bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000216c0000" filename = "" Region: id = 6987 start_va = 0x217c0000 end_va = 0x217fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000217c0000" filename = "" Region: id = 6988 start_va = 0x21800000 end_va = 0x218fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021800000" filename = "" Region: id = 6989 start_va = 0x21900000 end_va = 0x2193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 6990 start_va = 0x21940000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021940000" filename = "" Region: id = 6991 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6992 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 6993 start_va = 0x21a40000 end_va = 0x21a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a40000" filename = "" Region: id = 6994 start_va = 0x21a80000 end_va = 0x21abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a80000" filename = "" Region: id = 6995 start_va = 0x21ac0000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ac0000" filename = "" Region: id = 6996 start_va = 0x21c40000 end_va = 0x21d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 6997 start_va = 0x21d40000 end_va = 0x21e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d40000" filename = "" Region: id = 6998 start_va = 0x21e40000 end_va = 0x21f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e40000" filename = "" Region: id = 6999 start_va = 0x21f40000 end_va = 0x21f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f40000" filename = "" Region: id = 7000 start_va = 0x21f80000 end_va = 0x2207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f80000" filename = "" Region: id = 7001 start_va = 0x22080000 end_va = 0x220bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022080000" filename = "" Region: id = 7002 start_va = 0x220c0000 end_va = 0x220fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000220c0000" filename = "" Region: id = 7003 start_va = 0x23000000 end_va = 0x230fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023000000" filename = "" Region: id = 7004 start_va = 0x23100000 end_va = 0x231fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023100000" filename = "" Region: id = 7005 start_va = 0x28c80000 end_va = 0x28cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c80000" filename = "" Region: id = 7006 start_va = 0x28cc0000 end_va = 0x28dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028cc0000" filename = "" Region: id = 7007 start_va = 0x28dc0000 end_va = 0x28dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028dc0000" filename = "" Region: id = 7008 start_va = 0x28e00000 end_va = 0x28efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e00000" filename = "" Region: id = 7009 start_va = 0x28f00000 end_va = 0x28f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f00000" filename = "" Region: id = 7010 start_va = 0x28f40000 end_va = 0x2903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f40000" filename = "" Region: id = 7011 start_va = 0x29040000 end_va = 0x2907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029040000" filename = "" Region: id = 7012 start_va = 0x29080000 end_va = 0x2917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029080000" filename = "" Region: id = 7013 start_va = 0x29180000 end_va = 0x291bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029180000" filename = "" Region: id = 7014 start_va = 0x291c0000 end_va = 0x292bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000291c0000" filename = "" Region: id = 7015 start_va = 0x292c0000 end_va = 0x292fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000292c0000" filename = "" Region: id = 7016 start_va = 0x29300000 end_va = 0x293fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029300000" filename = "" Region: id = 7017 start_va = 0x29400000 end_va = 0x2943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029400000" filename = "" Region: id = 7018 start_va = 0x29440000 end_va = 0x2953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029440000" filename = "" Region: id = 7019 start_va = 0x29540000 end_va = 0x2957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029540000" filename = "" Region: id = 7020 start_va = 0x29580000 end_va = 0x2967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029580000" filename = "" Region: id = 7021 start_va = 0x29680000 end_va = 0x296bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029680000" filename = "" Region: id = 7022 start_va = 0x296c0000 end_va = 0x297bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000296c0000" filename = "" Region: id = 7023 start_va = 0x297c0000 end_va = 0x297fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000297c0000" filename = "" Region: id = 7024 start_va = 0x29800000 end_va = 0x298fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029800000" filename = "" Region: id = 7025 start_va = 0x29900000 end_va = 0x2993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029900000" filename = "" Region: id = 7026 start_va = 0x29940000 end_va = 0x29a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029940000" filename = "" Region: id = 7027 start_va = 0x29a40000 end_va = 0x29a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 7028 start_va = 0x29a80000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a80000" filename = "" Region: id = 7029 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7030 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7031 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7032 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7033 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7034 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7035 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7036 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7037 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7038 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7039 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7040 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7041 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7042 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7043 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7044 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7045 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7046 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7047 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7048 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7049 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7050 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7051 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7052 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7053 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7054 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7055 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7056 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7057 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7058 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7059 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7060 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7061 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7062 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7063 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7064 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7065 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7066 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7067 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7068 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7069 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7070 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7071 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7072 start_va = 0x1120000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 7073 start_va = 0x1160000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 7074 start_va = 0x1260000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 7075 start_va = 0xaf50000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 7076 start_va = 0xb050000 end_va = 0xb08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 7077 start_va = 0xb090000 end_va = 0xb0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b090000" filename = "" Region: id = 7078 start_va = 0xb0d0000 end_va = 0xb10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b0d0000" filename = "" Region: id = 7079 start_va = 0xb220000 end_va = 0xb31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 7080 start_va = 0xb320000 end_va = 0xb41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 7081 start_va = 0xb420000 end_va = 0xb45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b420000" filename = "" Region: id = 7082 start_va = 0xb460000 end_va = 0xb49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b460000" filename = "" Region: id = 7083 start_va = 0xf5d0000 end_va = 0xf6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f5d0000" filename = "" Region: id = 7084 start_va = 0xf6d0000 end_va = 0xf7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f6d0000" filename = "" Region: id = 7085 start_va = 0xf7d0000 end_va = 0xf80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f7d0000" filename = "" Region: id = 7086 start_va = 0xf810000 end_va = 0xf84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f810000" filename = "" Region: id = 7087 start_va = 0xf850000 end_va = 0xf88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 7088 start_va = 0xf8d0000 end_va = 0xf90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 7089 start_va = 0x11e90000 end_va = 0x11f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011e90000" filename = "" Region: id = 7090 start_va = 0x11f90000 end_va = 0x1208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000011f90000" filename = "" Region: id = 7091 start_va = 0x12090000 end_va = 0x1218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012090000" filename = "" Region: id = 7092 start_va = 0x12190000 end_va = 0x1228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012190000" filename = "" Region: id = 7093 start_va = 0x12290000 end_va = 0x1238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012290000" filename = "" Region: id = 7094 start_va = 0x12390000 end_va = 0x123cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000012390000" filename = "" Region: id = 7095 start_va = 0x123d0000 end_va = 0x124cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000123d0000" filename = "" Region: id = 7096 start_va = 0x124d0000 end_va = 0x1250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000124d0000" filename = "" Region: id = 7097 start_va = 0x13f50000 end_va = 0x1404ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013f50000" filename = "" Region: id = 7098 start_va = 0x14050000 end_va = 0x1408ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014050000" filename = "" Region: id = 7099 start_va = 0x20880000 end_va = 0x2097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020880000" filename = "" Region: id = 7100 start_va = 0x20980000 end_va = 0x209bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020980000" filename = "" Region: id = 7101 start_va = 0x20a00000 end_va = 0x20a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a00000" filename = "" Region: id = 7102 start_va = 0x20a40000 end_va = 0x20a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a40000" filename = "" Region: id = 7103 start_va = 0x20a80000 end_va = 0x20abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020a80000" filename = "" Region: id = 7104 start_va = 0x20cc0000 end_va = 0x20dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020cc0000" filename = "" Region: id = 7105 start_va = 0x20ec0000 end_va = 0x20fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020ec0000" filename = "" Region: id = 7106 start_va = 0x20fc0000 end_va = 0x210bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000020fc0000" filename = "" Region: id = 7107 start_va = 0x211c0000 end_va = 0x211fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000211c0000" filename = "" Region: id = 7108 start_va = 0x21200000 end_va = 0x2123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021200000" filename = "" Region: id = 7109 start_va = 0x21380000 end_va = 0x2147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021380000" filename = "" Region: id = 7110 start_va = 0x21480000 end_va = 0x2157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021480000" filename = "" Region: id = 7111 start_va = 0x21580000 end_va = 0x2167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021580000" filename = "" Region: id = 7112 start_va = 0x21680000 end_va = 0x216bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021680000" filename = "" Region: id = 7113 start_va = 0x216c0000 end_va = 0x217bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000216c0000" filename = "" Region: id = 7114 start_va = 0x217c0000 end_va = 0x217fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000217c0000" filename = "" Region: id = 7115 start_va = 0x21800000 end_va = 0x218fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021800000" filename = "" Region: id = 7116 start_va = 0x29b80000 end_va = 0x29bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b80000" filename = "" Region: id = 7117 start_va = 0x29bc0000 end_va = 0x29cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029bc0000" filename = "" Region: id = 7118 start_va = 0x29cc0000 end_va = 0x29cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029cc0000" filename = "" Region: id = 7119 start_va = 0x29d00000 end_va = 0x29dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029d00000" filename = "" Region: id = 7120 start_va = 0x29e00000 end_va = 0x29e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029e00000" filename = "" Region: id = 7121 start_va = 0x29e40000 end_va = 0x29f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029e40000" filename = "" Region: id = 7122 start_va = 0x29f40000 end_va = 0x29f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029f40000" filename = "" Region: id = 7123 start_va = 0x29f80000 end_va = 0x2a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029f80000" filename = "" Region: id = 7124 start_va = 0x2a080000 end_va = 0x2a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a080000" filename = "" Region: id = 7125 start_va = 0x2a0c0000 end_va = 0x2a1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a0c0000" filename = "" Region: id = 7126 start_va = 0x2a1c0000 end_va = 0x2a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a1c0000" filename = "" Region: id = 7127 start_va = 0x2a200000 end_va = 0x2a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a200000" filename = "" Region: id = 7128 start_va = 0x2a300000 end_va = 0x2a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a300000" filename = "" Region: id = 7129 start_va = 0x2a340000 end_va = 0x2a43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a340000" filename = "" Region: id = 7130 start_va = 0x2a440000 end_va = 0x2a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a440000" filename = "" Region: id = 7131 start_va = 0x2a480000 end_va = 0x2a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a480000" filename = "" Region: id = 7132 start_va = 0x2a580000 end_va = 0x2a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a580000" filename = "" Region: id = 7133 start_va = 0x2a5c0000 end_va = 0x2a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a5c0000" filename = "" Region: id = 7134 start_va = 0x2a6c0000 end_va = 0x2a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a6c0000" filename = "" Region: id = 7135 start_va = 0x2a700000 end_va = 0x2a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a700000" filename = "" Region: id = 7136 start_va = 0x2a800000 end_va = 0x2a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a800000" filename = "" Region: id = 7137 start_va = 0x2a840000 end_va = 0x2a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a840000" filename = "" Region: id = 7138 start_va = 0x2a940000 end_va = 0x2a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a940000" filename = "" Region: id = 7139 start_va = 0x2a980000 end_va = 0x2aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a980000" filename = "" Region: id = 7140 start_va = 0x2aa80000 end_va = 0x2aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002aa80000" filename = "" Region: id = 7141 start_va = 0x2aac0000 end_va = 0x2abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002aac0000" filename = "" Region: id = 7142 start_va = 0x2abc0000 end_va = 0x2abfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002abc0000" filename = "" Region: id = 7143 start_va = 0x2ac00000 end_va = 0x2acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ac00000" filename = "" Region: id = 7144 start_va = 0x2ad00000 end_va = 0x2ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ad00000" filename = "" Region: id = 7145 start_va = 0x2ad40000 end_va = 0x2ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ad40000" filename = "" Region: id = 7146 start_va = 0x2ae40000 end_va = 0x2ae7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ae40000" filename = "" Region: id = 7147 start_va = 0x2ae80000 end_va = 0x2af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ae80000" filename = "" Region: id = 7148 start_va = 0x2af80000 end_va = 0x2afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002af80000" filename = "" Region: id = 7149 start_va = 0x2afc0000 end_va = 0x2b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002afc0000" filename = "" Region: id = 7150 start_va = 0x2b0c0000 end_va = 0x2b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b0c0000" filename = "" Region: id = 7151 start_va = 0x2b100000 end_va = 0x2b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b100000" filename = "" Region: id = 7152 start_va = 0x2b200000 end_va = 0x2b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b200000" filename = "" Region: id = 7153 start_va = 0x2b240000 end_va = 0x2b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b240000" filename = "" Region: id = 7154 start_va = 0x2b340000 end_va = 0x2b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b340000" filename = "" Region: id = 7155 start_va = 0x2b380000 end_va = 0x2b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b380000" filename = "" Region: id = 7156 start_va = 0x2b480000 end_va = 0x2b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b480000" filename = "" Region: id = 7157 start_va = 0x2b4c0000 end_va = 0x2b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b4c0000" filename = "" Region: id = 7158 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7159 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7160 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7161 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7162 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7163 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7164 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7165 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7166 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7167 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7168 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7169 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7170 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7171 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7172 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7173 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7174 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7175 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7176 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7177 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7178 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7179 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7180 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7181 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7182 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7183 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7184 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7185 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7186 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7187 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7188 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7189 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7190 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7191 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7192 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7193 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 7194 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 7195 start_va = 0x21a40000 end_va = 0x21a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a40000" filename = "" Region: id = 7196 start_va = 0x21a80000 end_va = 0x21abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a80000" filename = "" Region: id = 7197 start_va = 0x21ac0000 end_va = 0x21afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021ac0000" filename = "" Region: id = 7198 start_va = 0x21c40000 end_va = 0x21d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021c40000" filename = "" Region: id = 7199 start_va = 0x21d40000 end_va = 0x21e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021d40000" filename = "" Region: id = 7200 start_va = 0x21e40000 end_va = 0x21f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021e40000" filename = "" Region: id = 7201 start_va = 0x21f40000 end_va = 0x21f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f40000" filename = "" Region: id = 7202 start_va = 0x21f80000 end_va = 0x2207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021f80000" filename = "" Region: id = 7203 start_va = 0x22080000 end_va = 0x220bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000022080000" filename = "" Region: id = 7204 start_va = 0x220c0000 end_va = 0x220fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000220c0000" filename = "" Region: id = 7205 start_va = 0x23000000 end_va = 0x230fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023000000" filename = "" Region: id = 7206 start_va = 0x23100000 end_va = 0x231fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000023100000" filename = "" Region: id = 7207 start_va = 0x28c80000 end_va = 0x28cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c80000" filename = "" Region: id = 7208 start_va = 0x28cc0000 end_va = 0x28dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028cc0000" filename = "" Region: id = 7209 start_va = 0x28dc0000 end_va = 0x28dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028dc0000" filename = "" Region: id = 7210 start_va = 0x28e00000 end_va = 0x28efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e00000" filename = "" Region: id = 7211 start_va = 0x28f00000 end_va = 0x28f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f00000" filename = "" Region: id = 7212 start_va = 0x28f40000 end_va = 0x2903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028f40000" filename = "" Region: id = 7213 start_va = 0x29040000 end_va = 0x2907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029040000" filename = "" Region: id = 7214 start_va = 0x29080000 end_va = 0x2917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029080000" filename = "" Region: id = 7215 start_va = 0x29180000 end_va = 0x291bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029180000" filename = "" Region: id = 7216 start_va = 0x291c0000 end_va = 0x292bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000291c0000" filename = "" Region: id = 7217 start_va = 0x292c0000 end_va = 0x292fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000292c0000" filename = "" Region: id = 7218 start_va = 0x29300000 end_va = 0x293fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029300000" filename = "" Region: id = 7219 start_va = 0x29400000 end_va = 0x2943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029400000" filename = "" Region: id = 7220 start_va = 0x29440000 end_va = 0x2953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029440000" filename = "" Region: id = 7221 start_va = 0x29540000 end_va = 0x2957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029540000" filename = "" Region: id = 7222 start_va = 0x29580000 end_va = 0x2967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029580000" filename = "" Region: id = 7223 start_va = 0x2b5c0000 end_va = 0x2b5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b5c0000" filename = "" Region: id = 7224 start_va = 0x2b600000 end_va = 0x2b63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002b600000" filename = "" Region: id = 7225 start_va = 0x2cb80000 end_va = 0x2cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cb80000" filename = "" Region: id = 7226 start_va = 0x2cc80000 end_va = 0x2cd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cc80000" filename = "" Region: id = 7227 start_va = 0x2cd80000 end_va = 0x2cdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cd80000" filename = "" Region: id = 7228 start_va = 0x2cdc0000 end_va = 0x2cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cdc0000" filename = "" Region: id = 7229 start_va = 0x2cec0000 end_va = 0x2cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cec0000" filename = "" Region: id = 7230 start_va = 0x2cf00000 end_va = 0x2cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002cf00000" filename = "" Region: id = 7231 start_va = 0x2d000000 end_va = 0x2d03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d000000" filename = "" Region: id = 7232 start_va = 0x2d040000 end_va = 0x2d13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d040000" filename = "" Region: id = 7233 start_va = 0x2d140000 end_va = 0x2d17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d140000" filename = "" Region: id = 7234 start_va = 0x2d180000 end_va = 0x2d27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d180000" filename = "" Region: id = 7235 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7236 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 7237 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7238 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 7239 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 7240 start_va = 0x29680000 end_va = 0x296bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029680000" filename = "" Region: id = 7241 start_va = 0x296c0000 end_va = 0x297bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000296c0000" filename = "" Region: id = 7242 start_va = 0x29900000 end_va = 0x2993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029900000" filename = "" Region: id = 7243 start_va = 0x29940000 end_va = 0x29a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029940000" filename = "" Region: id = 7244 start_va = 0x29a40000 end_va = 0x29a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 7245 start_va = 0x29a80000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a80000" filename = "" Region: id = 7246 start_va = 0x2d280000 end_va = 0x2d2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 7247 start_va = 0x2d2c0000 end_va = 0x2d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d2c0000" filename = "" Region: id = 7248 start_va = 0x2d3c0000 end_va = 0x2d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d3c0000" filename = "" Region: id = 7249 start_va = 0x2d400000 end_va = 0x2d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d400000" filename = "" Region: id = 7250 start_va = 0x2d500000 end_va = 0x2d53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d500000" filename = "" Region: id = 7251 start_va = 0x2d540000 end_va = 0x2d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d540000" filename = "" Region: id = 7252 start_va = 0x2d640000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d640000" filename = "" Region: id = 7253 start_va = 0x2d680000 end_va = 0x2d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 7254 start_va = 0x2d780000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d780000" filename = "" Region: id = 7255 start_va = 0x2d7c0000 end_va = 0x2d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 7256 start_va = 0x2d8c0000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d8c0000" filename = "" Region: id = 7257 start_va = 0x2d900000 end_va = 0x2d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 7258 start_va = 0x2da00000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da00000" filename = "" Region: id = 7259 start_va = 0x2da40000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 7260 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 7261 start_va = 0x2db80000 end_va = 0x2dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db80000" filename = "" Region: id = 7262 start_va = 0x2dc80000 end_va = 0x2dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dc80000" filename = "" Region: id = 7263 start_va = 0x2dcc0000 end_va = 0x2ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 7264 start_va = 0x2ddc0000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 7265 start_va = 0x2de00000 end_va = 0x2defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 7266 start_va = 0x2df00000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df00000" filename = "" Region: id = 7267 start_va = 0x2df40000 end_va = 0x2e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 7268 start_va = 0x2e040000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e040000" filename = "" Region: id = 7269 start_va = 0x2e080000 end_va = 0x2e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 7270 start_va = 0x2e180000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e180000" filename = "" Region: id = 7271 start_va = 0x2e1c0000 end_va = 0x2e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 7272 start_va = 0x2e2c0000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e2c0000" filename = "" Region: id = 7273 start_va = 0x2e300000 end_va = 0x2e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 7274 start_va = 0x2e400000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e400000" filename = "" Region: id = 7275 start_va = 0x2e440000 end_va = 0x2e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 7276 start_va = 0x2e540000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e540000" filename = "" Region: id = 7277 start_va = 0x2e580000 end_va = 0x2e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 7278 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7279 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7280 start_va = 0x2e680000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e680000" filename = "" Region: id = 7281 start_va = 0x2e6c0000 end_va = 0x2e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 7282 start_va = 0x2e7c0000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e7c0000" filename = "" Region: id = 7283 start_va = 0x2e800000 end_va = 0x2e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 7284 start_va = 0x2e900000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e900000" filename = "" Region: id = 7285 start_va = 0x2e940000 end_va = 0x2ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 7286 start_va = 0x2ea40000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea40000" filename = "" Region: id = 7287 start_va = 0x2ea80000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 7288 start_va = 0x2eb80000 end_va = 0x2ebbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb80000" filename = "" Region: id = 7289 start_va = 0x2ebc0000 end_va = 0x2ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ebc0000" filename = "" Region: id = 7290 start_va = 0x2ecc0000 end_va = 0x2ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ecc0000" filename = "" Region: id = 7291 start_va = 0x2ed00000 end_va = 0x2edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ed00000" filename = "" Region: id = 7292 start_va = 0x2ee00000 end_va = 0x2ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ee00000" filename = "" Region: id = 7293 start_va = 0x2ee40000 end_va = 0x2ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ee40000" filename = "" Region: id = 7294 start_va = 0x2ef40000 end_va = 0x2ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ef40000" filename = "" Region: id = 7295 start_va = 0x2ef80000 end_va = 0x2f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ef80000" filename = "" Region: id = 7296 start_va = 0x2f080000 end_va = 0x2f0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f080000" filename = "" Region: id = 7297 start_va = 0x2f0c0000 end_va = 0x2f1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f0c0000" filename = "" Region: id = 7298 start_va = 0x2f1c0000 end_va = 0x2f1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f1c0000" filename = "" Region: id = 7299 start_va = 0x2f200000 end_va = 0x2f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f200000" filename = "" Region: id = 7300 start_va = 0x2f300000 end_va = 0x2f33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f300000" filename = "" Region: id = 7301 start_va = 0x2f340000 end_va = 0x2f43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f340000" filename = "" Region: id = 7302 start_va = 0x2f440000 end_va = 0x2f47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f440000" filename = "" Region: id = 7303 start_va = 0x2f480000 end_va = 0x2f57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f480000" filename = "" Region: id = 7304 start_va = 0x2f580000 end_va = 0x2f5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f580000" filename = "" Region: id = 7305 start_va = 0x2f5c0000 end_va = 0x2f6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f5c0000" filename = "" Region: id = 7306 start_va = 0x2f6c0000 end_va = 0x2f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f6c0000" filename = "" Region: id = 7307 start_va = 0x2f700000 end_va = 0x2f7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f700000" filename = "" Region: id = 7308 start_va = 0x2f800000 end_va = 0x2f83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f800000" filename = "" Region: id = 7309 start_va = 0x2f840000 end_va = 0x2f93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f840000" filename = "" Region: id = 7310 start_va = 0x2f940000 end_va = 0x2f97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f940000" filename = "" Region: id = 7311 start_va = 0x2f980000 end_va = 0x2fa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f980000" filename = "" Region: id = 7312 start_va = 0x2fa80000 end_va = 0x2fabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fa80000" filename = "" Region: id = 7313 start_va = 0x2fac0000 end_va = 0x2fbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fac0000" filename = "" Region: id = 7314 start_va = 0x2fbc0000 end_va = 0x2fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fbc0000" filename = "" Region: id = 7315 start_va = 0x2fc00000 end_va = 0x2fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fc00000" filename = "" Region: id = 7316 start_va = 0x2fd00000 end_va = 0x2fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fd00000" filename = "" Region: id = 7317 start_va = 0x2fd40000 end_va = 0x2fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fd40000" filename = "" Region: id = 7318 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7319 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7320 start_va = 0x2fe40000 end_va = 0x2fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fe40000" filename = "" Region: id = 7321 start_va = 0x2fe80000 end_va = 0x2ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fe80000" filename = "" Region: id = 7322 start_va = 0x2ff80000 end_va = 0x2ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ff80000" filename = "" Region: id = 7323 start_va = 0x2ffc0000 end_va = 0x300bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ffc0000" filename = "" Region: id = 7324 start_va = 0x300c0000 end_va = 0x300fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000300c0000" filename = "" Region: id = 7325 start_va = 0x30100000 end_va = 0x301fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030100000" filename = "" Region: id = 7326 start_va = 0x30200000 end_va = 0x3023ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030200000" filename = "" Region: id = 7327 start_va = 0x30240000 end_va = 0x3033ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030240000" filename = "" Region: id = 7328 start_va = 0x30340000 end_va = 0x3037ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030340000" filename = "" Region: id = 7329 start_va = 0x30380000 end_va = 0x3047ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030380000" filename = "" Region: id = 7330 start_va = 0x30480000 end_va = 0x304bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030480000" filename = "" Region: id = 7331 start_va = 0x304c0000 end_va = 0x305bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000304c0000" filename = "" Region: id = 7332 start_va = 0x305c0000 end_va = 0x305fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000305c0000" filename = "" Region: id = 7333 start_va = 0x30600000 end_va = 0x306fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030600000" filename = "" Region: id = 7334 start_va = 0x30700000 end_va = 0x3073ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030700000" filename = "" Region: id = 7335 start_va = 0x30740000 end_va = 0x3083ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030740000" filename = "" Region: id = 7336 start_va = 0x30840000 end_va = 0x3087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030840000" filename = "" Region: id = 7337 start_va = 0x30880000 end_va = 0x3097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030880000" filename = "" Region: id = 7338 start_va = 0x30980000 end_va = 0x309bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030980000" filename = "" Region: id = 7339 start_va = 0x309c0000 end_va = 0x30abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000309c0000" filename = "" Region: id = 7340 start_va = 0x30ac0000 end_va = 0x30afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 7341 start_va = 0x30b00000 end_va = 0x30bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030b00000" filename = "" Region: id = 7342 start_va = 0x30c00000 end_va = 0x30c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c00000" filename = "" Region: id = 7343 start_va = 0x30c40000 end_va = 0x30d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c40000" filename = "" Region: id = 7344 start_va = 0x30d40000 end_va = 0x30d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030d40000" filename = "" Region: id = 7345 start_va = 0x30d80000 end_va = 0x30e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030d80000" filename = "" Region: id = 7346 start_va = 0x30e80000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030e80000" filename = "" Region: id = 7347 start_va = 0x30ec0000 end_va = 0x30fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ec0000" filename = "" Region: id = 7348 start_va = 0x30fc0000 end_va = 0x30ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030fc0000" filename = "" Region: id = 7349 start_va = 0x31000000 end_va = 0x310fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 7350 start_va = 0x31100000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031100000" filename = "" Region: id = 7351 start_va = 0x31140000 end_va = 0x3123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031140000" filename = "" Region: id = 7352 start_va = 0x31240000 end_va = 0x3127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031240000" filename = "" Region: id = 7353 start_va = 0x31280000 end_va = 0x3137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031280000" filename = "" Region: id = 7354 start_va = 0x31380000 end_va = 0x313bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031380000" filename = "" Region: id = 7355 start_va = 0x313c0000 end_va = 0x314bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000313c0000" filename = "" Region: id = 7356 start_va = 0x314c0000 end_va = 0x314fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000314c0000" filename = "" Region: id = 7357 start_va = 0x31500000 end_va = 0x315fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031500000" filename = "" Region: id = 7358 start_va = 0x31600000 end_va = 0x3163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031600000" filename = "" Region: id = 7359 start_va = 0x31640000 end_va = 0x3173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031640000" filename = "" Region: id = 7360 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7361 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7362 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7363 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7364 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7365 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7366 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7367 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7368 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7369 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7370 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7371 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7372 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7373 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7374 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7375 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7376 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7377 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7378 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7379 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7380 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7381 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7382 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7383 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7384 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7385 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7386 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7387 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7388 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7389 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7390 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7391 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7392 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7393 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7394 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7395 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7396 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7397 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7398 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7399 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7400 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7401 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7402 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7403 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7404 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7405 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7406 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7407 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7408 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7409 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7410 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7411 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7412 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7413 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7414 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7415 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7416 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7417 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7418 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7419 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7420 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7421 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7422 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7423 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7424 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7425 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7426 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7427 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7428 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7429 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7430 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7431 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7432 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7433 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7434 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7435 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7436 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7437 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7438 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7439 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7440 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7441 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7442 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7443 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7444 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7445 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7446 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7447 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7448 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7449 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7450 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7451 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7452 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7453 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7454 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7455 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7456 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7457 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7458 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7459 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7460 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7461 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7462 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7463 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7464 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7465 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7466 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7467 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7468 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7469 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7470 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7471 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7472 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7473 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7474 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7475 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7476 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7477 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 7478 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 7479 start_va = 0x141d0000 end_va = 0x1420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000141d0000" filename = "" Region: id = 7480 start_va = 0x14210000 end_va = 0x1430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014210000" filename = "" Region: id = 7481 start_va = 0x29680000 end_va = 0x296bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029680000" filename = "" Region: id = 7482 start_va = 0x296c0000 end_va = 0x297bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000296c0000" filename = "" Region: id = 7483 start_va = 0x297c0000 end_va = 0x297fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000297c0000" filename = "" Region: id = 7484 start_va = 0x29800000 end_va = 0x298fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029800000" filename = "" Region: id = 7485 start_va = 0x29900000 end_va = 0x2993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029900000" filename = "" Region: id = 7486 start_va = 0x29940000 end_va = 0x29a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029940000" filename = "" Region: id = 7487 start_va = 0x29a40000 end_va = 0x29a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 7488 start_va = 0x29a80000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a80000" filename = "" Region: id = 7489 start_va = 0x2d280000 end_va = 0x2d2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 7490 start_va = 0x2d2c0000 end_va = 0x2d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d2c0000" filename = "" Region: id = 7491 start_va = 0x2d3c0000 end_va = 0x2d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d3c0000" filename = "" Region: id = 7492 start_va = 0x2d400000 end_va = 0x2d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d400000" filename = "" Region: id = 7493 start_va = 0x2d500000 end_va = 0x2d53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d500000" filename = "" Region: id = 7494 start_va = 0x2d540000 end_va = 0x2d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d540000" filename = "" Region: id = 7495 start_va = 0x2d640000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d640000" filename = "" Region: id = 7496 start_va = 0x2d680000 end_va = 0x2d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 7497 start_va = 0x2d780000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d780000" filename = "" Region: id = 7498 start_va = 0x2d7c0000 end_va = 0x2d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 7499 start_va = 0x2d8c0000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d8c0000" filename = "" Region: id = 7500 start_va = 0x2d900000 end_va = 0x2d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 7501 start_va = 0x2da00000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da00000" filename = "" Region: id = 7502 start_va = 0x2da40000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 7503 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 7504 start_va = 0x2db80000 end_va = 0x2dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db80000" filename = "" Region: id = 7505 start_va = 0x2dc80000 end_va = 0x2dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dc80000" filename = "" Region: id = 7506 start_va = 0x2dcc0000 end_va = 0x2ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 7507 start_va = 0x2ddc0000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 7508 start_va = 0x2de00000 end_va = 0x2defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 7509 start_va = 0x2df00000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df00000" filename = "" Region: id = 7510 start_va = 0x2df40000 end_va = 0x2e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 7511 start_va = 0x2e040000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e040000" filename = "" Region: id = 7512 start_va = 0x2e080000 end_va = 0x2e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 7513 start_va = 0x2e180000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e180000" filename = "" Region: id = 7514 start_va = 0x2e1c0000 end_va = 0x2e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 7515 start_va = 0x2e2c0000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e2c0000" filename = "" Region: id = 7516 start_va = 0x2e300000 end_va = 0x2e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 7517 start_va = 0x2e400000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e400000" filename = "" Region: id = 7518 start_va = 0x2e440000 end_va = 0x2e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 7519 start_va = 0x2e540000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e540000" filename = "" Region: id = 7520 start_va = 0x2e580000 end_va = 0x2e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 7521 start_va = 0x2e680000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e680000" filename = "" Region: id = 7522 start_va = 0x2e6c0000 end_va = 0x2e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 7523 start_va = 0x2e7c0000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e7c0000" filename = "" Region: id = 7524 start_va = 0x2e800000 end_va = 0x2e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 7525 start_va = 0x2e900000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e900000" filename = "" Region: id = 7526 start_va = 0x2e940000 end_va = 0x2ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 7527 start_va = 0x2ea40000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea40000" filename = "" Region: id = 7528 start_va = 0x2ea80000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 7529 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7530 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7531 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7532 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7533 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7534 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7535 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7536 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7537 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7538 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7539 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7540 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7541 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7542 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 7543 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 7544 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 7545 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 7546 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 7547 start_va = 0x21900000 end_va = 0x2193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 7548 start_va = 0x21940000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021940000" filename = "" Region: id = 7549 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7550 start_va = 0x14450000 end_va = 0x1448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014450000" filename = "" Region: id = 7551 start_va = 0x14490000 end_va = 0x1458ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014490000" filename = "" Region: id = 7552 start_va = 0x29680000 end_va = 0x296bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029680000" filename = "" Region: id = 7553 start_va = 0x296c0000 end_va = 0x297bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000296c0000" filename = "" Region: id = 7554 start_va = 0x297c0000 end_va = 0x297fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000297c0000" filename = "" Region: id = 7555 start_va = 0x29800000 end_va = 0x298fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029800000" filename = "" Region: id = 7556 start_va = 0x29900000 end_va = 0x2993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029900000" filename = "" Region: id = 7557 start_va = 0x29940000 end_va = 0x29a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029940000" filename = "" Region: id = 7558 start_va = 0x2eb80000 end_va = 0x2ebbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb80000" filename = "" Region: id = 7559 start_va = 0x2ebc0000 end_va = 0x2ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ebc0000" filename = "" Region: id = 7560 start_va = 0x2ecc0000 end_va = 0x2ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ecc0000" filename = "" Region: id = 7561 start_va = 0x2ed00000 end_va = 0x2edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ed00000" filename = "" Region: id = 7562 start_va = 0x2ee00000 end_va = 0x2ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ee00000" filename = "" Region: id = 7563 start_va = 0x2ee40000 end_va = 0x2ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ee40000" filename = "" Region: id = 7564 start_va = 0x2ef40000 end_va = 0x2ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ef40000" filename = "" Region: id = 7565 start_va = 0x2ef80000 end_va = 0x2f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ef80000" filename = "" Region: id = 7566 start_va = 0x2f080000 end_va = 0x2f0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f080000" filename = "" Region: id = 7567 start_va = 0x2f0c0000 end_va = 0x2f1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f0c0000" filename = "" Region: id = 7568 start_va = 0x2f1c0000 end_va = 0x2f1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f1c0000" filename = "" Region: id = 7569 start_va = 0x2f200000 end_va = 0x2f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f200000" filename = "" Region: id = 7570 start_va = 0x2f300000 end_va = 0x2f33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f300000" filename = "" Region: id = 7571 start_va = 0x2f340000 end_va = 0x2f43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f340000" filename = "" Region: id = 7572 start_va = 0x2f440000 end_va = 0x2f47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f440000" filename = "" Region: id = 7573 start_va = 0x2f480000 end_va = 0x2f57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f480000" filename = "" Region: id = 7574 start_va = 0x2f580000 end_va = 0x2f5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f580000" filename = "" Region: id = 7575 start_va = 0x2f5c0000 end_va = 0x2f6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f5c0000" filename = "" Region: id = 7576 start_va = 0x2f6c0000 end_va = 0x2f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f6c0000" filename = "" Region: id = 7577 start_va = 0x2f700000 end_va = 0x2f7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f700000" filename = "" Region: id = 7578 start_va = 0x2f800000 end_va = 0x2f83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f800000" filename = "" Region: id = 7579 start_va = 0x2f840000 end_va = 0x2f93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f840000" filename = "" Region: id = 7580 start_va = 0x2f940000 end_va = 0x2f97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f940000" filename = "" Region: id = 7581 start_va = 0x2f980000 end_va = 0x2fa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002f980000" filename = "" Region: id = 7582 start_va = 0x2fa80000 end_va = 0x2fabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fa80000" filename = "" Region: id = 7583 start_va = 0x2fac0000 end_va = 0x2fbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fac0000" filename = "" Region: id = 7584 start_va = 0x2fbc0000 end_va = 0x2fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fbc0000" filename = "" Region: id = 7585 start_va = 0x2fc00000 end_va = 0x2fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fc00000" filename = "" Region: id = 7586 start_va = 0x2fd00000 end_va = 0x2fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fd00000" filename = "" Region: id = 7587 start_va = 0x2fd40000 end_va = 0x2fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fd40000" filename = "" Region: id = 7588 start_va = 0x2fe40000 end_va = 0x2fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fe40000" filename = "" Region: id = 7589 start_va = 0x2fe80000 end_va = 0x2ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002fe80000" filename = "" Region: id = 7590 start_va = 0x2ff80000 end_va = 0x2ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ff80000" filename = "" Region: id = 7591 start_va = 0x2ffc0000 end_va = 0x300bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ffc0000" filename = "" Region: id = 7592 start_va = 0x300c0000 end_va = 0x300fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000300c0000" filename = "" Region: id = 7593 start_va = 0x30100000 end_va = 0x301fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030100000" filename = "" Region: id = 7594 start_va = 0x30200000 end_va = 0x3023ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030200000" filename = "" Region: id = 7595 start_va = 0x30240000 end_va = 0x3033ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030240000" filename = "" Region: id = 7596 start_va = 0x30340000 end_va = 0x3037ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030340000" filename = "" Region: id = 7597 start_va = 0x30380000 end_va = 0x3047ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030380000" filename = "" Region: id = 7598 start_va = 0x30480000 end_va = 0x304bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030480000" filename = "" Region: id = 7599 start_va = 0x304c0000 end_va = 0x305bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000304c0000" filename = "" Region: id = 7600 start_va = 0x305c0000 end_va = 0x305fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000305c0000" filename = "" Region: id = 7601 start_va = 0x30600000 end_va = 0x306fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030600000" filename = "" Region: id = 7602 start_va = 0x30700000 end_va = 0x3073ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030700000" filename = "" Region: id = 7603 start_va = 0x30740000 end_va = 0x3083ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030740000" filename = "" Region: id = 7604 start_va = 0x30840000 end_va = 0x3087ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030840000" filename = "" Region: id = 7605 start_va = 0x30880000 end_va = 0x3097ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030880000" filename = "" Region: id = 7606 start_va = 0x30980000 end_va = 0x309bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030980000" filename = "" Region: id = 7607 start_va = 0x309c0000 end_va = 0x30abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000309c0000" filename = "" Region: id = 7608 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7609 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7610 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7611 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7612 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7613 start_va = 0x30ac0000 end_va = 0x30afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 7614 start_va = 0x30b00000 end_va = 0x30bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030b00000" filename = "" Region: id = 7615 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7616 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7617 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7618 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7619 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7620 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7621 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7622 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7623 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7624 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7625 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7626 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7627 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7628 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7629 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7630 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 7631 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 7632 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 7633 start_va = 0xb4a0000 end_va = 0xb4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4a0000" filename = "" Region: id = 7634 start_va = 0xb4b0000 end_va = 0xb4b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4b0000" filename = "" Region: id = 7635 start_va = 0xb4c0000 end_va = 0xb4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4c0000" filename = "" Region: id = 7636 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 7637 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7638 start_va = 0xf970000 end_va = 0xf970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f970000" filename = "" Region: id = 7639 start_va = 0xf980000 end_va = 0xf980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f980000" filename = "" Region: id = 7640 start_va = 0x17bd0000 end_va = 0x17bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bd0000" filename = "" Region: id = 7641 start_va = 0x17be0000 end_va = 0x17be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017be0000" filename = "" Region: id = 7642 start_va = 0x17bf0000 end_va = 0x17bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000017bf0000" filename = "" Region: id = 7643 start_va = 0x30c00000 end_va = 0x30c00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c00000" filename = "" Region: id = 7644 start_va = 0x30c10000 end_va = 0x30c10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c10000" filename = "" Region: id = 7645 start_va = 0x30c20000 end_va = 0x30c20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c20000" filename = "" Region: id = 7646 start_va = 0x30c30000 end_va = 0x30c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c30000" filename = "" Region: id = 7647 start_va = 0x30c40000 end_va = 0x30c40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c40000" filename = "" Region: id = 7648 start_va = 0x30c50000 end_va = 0x30c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c50000" filename = "" Region: id = 7649 start_va = 0x30c60000 end_va = 0x30c60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c60000" filename = "" Region: id = 7650 start_va = 0x2d8c0000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d8c0000" filename = "" Region: id = 7651 start_va = 0x2d900000 end_va = 0x2d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 7652 start_va = 0x2da00000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da00000" filename = "" Region: id = 7653 start_va = 0x2da40000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 7654 start_va = 0x30c40000 end_va = 0x30c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c40000" filename = "" Region: id = 7655 start_va = 0x30c80000 end_va = 0x30d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c80000" filename = "" Region: id = 7656 start_va = 0x30d80000 end_va = 0x30dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030d80000" filename = "" Region: id = 7657 start_va = 0x30dc0000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030dc0000" filename = "" Region: id = 7658 start_va = 0x30ec0000 end_va = 0x30efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ec0000" filename = "" Region: id = 7659 start_va = 0x30f00000 end_va = 0x30ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030f00000" filename = "" Region: id = 7660 start_va = 0x31000000 end_va = 0x3103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 7661 start_va = 0x31040000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031040000" filename = "" Region: id = 7662 start_va = 0x31140000 end_va = 0x3117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031140000" filename = "" Region: id = 7663 start_va = 0x31180000 end_va = 0x3127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031180000" filename = "" Region: id = 7664 start_va = 0x31280000 end_va = 0x312bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031280000" filename = "" Region: id = 7665 start_va = 0x312c0000 end_va = 0x313bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000312c0000" filename = "" Region: id = 7666 start_va = 0x313c0000 end_va = 0x313fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000313c0000" filename = "" Region: id = 7667 start_va = 0x31400000 end_va = 0x314fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031400000" filename = "" Region: id = 7668 start_va = 0x31500000 end_va = 0x3153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031500000" filename = "" Region: id = 7669 start_va = 0x31540000 end_va = 0x3163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031540000" filename = "" Region: id = 7670 start_va = 0x31640000 end_va = 0x3167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031640000" filename = "" Region: id = 7671 start_va = 0x31680000 end_va = 0x3177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031680000" filename = "" Region: id = 7672 start_va = 0x31780000 end_va = 0x317bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031780000" filename = "" Region: id = 7673 start_va = 0x317c0000 end_va = 0x318bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000317c0000" filename = "" Region: id = 7674 start_va = 0x318c0000 end_va = 0x318fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000318c0000" filename = "" Region: id = 7675 start_va = 0x31900000 end_va = 0x319fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031900000" filename = "" Region: id = 7676 start_va = 0x31a00000 end_va = 0x31a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a00000" filename = "" Region: id = 7677 start_va = 0x31a40000 end_va = 0x31b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a40000" filename = "" Region: id = 7678 start_va = 0x31b40000 end_va = 0x31b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b40000" filename = "" Region: id = 7679 start_va = 0x31b80000 end_va = 0x31c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b80000" filename = "" Region: id = 7680 start_va = 0x31c80000 end_va = 0x31cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031c80000" filename = "" Region: id = 7681 start_va = 0x31cc0000 end_va = 0x31dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031cc0000" filename = "" Region: id = 7682 start_va = 0x31dc0000 end_va = 0x31dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031dc0000" filename = "" Region: id = 7683 start_va = 0x31e00000 end_va = 0x31efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031e00000" filename = "" Region: id = 7684 start_va = 0x31f00000 end_va = 0x31f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f00000" filename = "" Region: id = 7685 start_va = 0x31f40000 end_va = 0x3203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f40000" filename = "" Region: id = 7686 start_va = 0x32040000 end_va = 0x3207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032040000" filename = "" Region: id = 7687 start_va = 0x32080000 end_va = 0x3217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032080000" filename = "" Region: id = 7688 start_va = 0x32180000 end_va = 0x321bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032180000" filename = "" Region: id = 7689 start_va = 0x321c0000 end_va = 0x322bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000321c0000" filename = "" Region: id = 7690 start_va = 0x322c0000 end_va = 0x322fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000322c0000" filename = "" Region: id = 7691 start_va = 0x32300000 end_va = 0x323fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032300000" filename = "" Region: id = 7692 start_va = 0x32400000 end_va = 0x3243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032400000" filename = "" Region: id = 7693 start_va = 0x32440000 end_va = 0x3253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032440000" filename = "" Region: id = 7694 start_va = 0x32540000 end_va = 0x3257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032540000" filename = "" Region: id = 7695 start_va = 0x32580000 end_va = 0x3267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032580000" filename = "" Region: id = 7696 start_va = 0x32680000 end_va = 0x326bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032680000" filename = "" Region: id = 7697 start_va = 0x326c0000 end_va = 0x327bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000326c0000" filename = "" Region: id = 7698 start_va = 0x327c0000 end_va = 0x327c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000327c0000" filename = "" Region: id = 7699 start_va = 0x327d0000 end_va = 0x327d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000327d0000" filename = "" Region: id = 7700 start_va = 0x327e0000 end_va = 0x3281ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000327e0000" filename = "" Region: id = 7701 start_va = 0x32820000 end_va = 0x3291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032820000" filename = "" Region: id = 7702 start_va = 0x32920000 end_va = 0x3295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032920000" filename = "" Region: id = 7703 start_va = 0x32960000 end_va = 0x3299ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032960000" filename = "" Region: id = 7704 start_va = 0x329a0000 end_va = 0x329dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000329a0000" filename = "" Region: id = 7705 start_va = 0x32a00000 end_va = 0x32bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032a00000" filename = "" Region: id = 7706 start_va = 0x32c00000 end_va = 0x32cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032c00000" filename = "" Region: id = 7707 start_va = 0x32d00000 end_va = 0x32dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032d00000" filename = "" Region: id = 7708 start_va = 0x32e00000 end_va = 0x32efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032e00000" filename = "" Region: id = 7709 start_va = 0x32f00000 end_va = 0x32f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032f00000" filename = "" Region: id = 7710 start_va = 0x32f40000 end_va = 0x3303ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032f40000" filename = "" Region: id = 7711 start_va = 0x33040000 end_va = 0x3307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033040000" filename = "" Region: id = 7712 start_va = 0x33080000 end_va = 0x3317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033080000" filename = "" Region: id = 7713 start_va = 0x33180000 end_va = 0x331bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033180000" filename = "" Region: id = 7714 start_va = 0x331c0000 end_va = 0x332bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000331c0000" filename = "" Region: id = 7715 start_va = 0x332c0000 end_va = 0x332fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000332c0000" filename = "" Region: id = 7716 start_va = 0x33300000 end_va = 0x333fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033300000" filename = "" Region: id = 7717 start_va = 0x33400000 end_va = 0x3343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033400000" filename = "" Region: id = 7718 start_va = 0x33440000 end_va = 0x3353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033440000" filename = "" Region: id = 7719 start_va = 0x33540000 end_va = 0x3357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033540000" filename = "" Region: id = 7720 start_va = 0x33580000 end_va = 0x3367ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033580000" filename = "" Region: id = 7721 start_va = 0x33680000 end_va = 0x336bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033680000" filename = "" Region: id = 7722 start_va = 0x336c0000 end_va = 0x337bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000336c0000" filename = "" Region: id = 7723 start_va = 0x337c0000 end_va = 0x337fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000337c0000" filename = "" Region: id = 7724 start_va = 0x33800000 end_va = 0x338fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033800000" filename = "" Region: id = 7725 start_va = 0x33900000 end_va = 0x3393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033900000" filename = "" Region: id = 7726 start_va = 0x33940000 end_va = 0x33a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033940000" filename = "" Region: id = 7727 start_va = 0x33a40000 end_va = 0x33a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033a40000" filename = "" Region: id = 7728 start_va = 0x33a80000 end_va = 0x33b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033a80000" filename = "" Region: id = 7729 start_va = 0x33b80000 end_va = 0x33bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033b80000" filename = "" Region: id = 7730 start_va = 0x33bc0000 end_va = 0x33cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033bc0000" filename = "" Region: id = 7731 start_va = 0x33cc0000 end_va = 0x33cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033cc0000" filename = "" Region: id = 7732 start_va = 0x33d00000 end_va = 0x33dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033d00000" filename = "" Region: id = 7733 start_va = 0x33e00000 end_va = 0x33e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033e00000" filename = "" Region: id = 7734 start_va = 0x33e40000 end_va = 0x33f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033e40000" filename = "" Region: id = 7735 start_va = 0x33f40000 end_va = 0x33f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033f40000" filename = "" Region: id = 7736 start_va = 0x33f80000 end_va = 0x3407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000033f80000" filename = "" Region: id = 7737 start_va = 0x34080000 end_va = 0x340bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034080000" filename = "" Region: id = 7738 start_va = 0x340c0000 end_va = 0x341bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000340c0000" filename = "" Region: id = 7739 start_va = 0x341c0000 end_va = 0x341fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000341c0000" filename = "" Region: id = 7740 start_va = 0x34200000 end_va = 0x342fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034200000" filename = "" Region: id = 7741 start_va = 0x34300000 end_va = 0x3433ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034300000" filename = "" Region: id = 7742 start_va = 0x34340000 end_va = 0x3443ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034340000" filename = "" Region: id = 7743 start_va = 0x34440000 end_va = 0x3447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034440000" filename = "" Region: id = 7744 start_va = 0x34480000 end_va = 0x3457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034480000" filename = "" Region: id = 7745 start_va = 0x34580000 end_va = 0x345bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034580000" filename = "" Region: id = 7746 start_va = 0x345c0000 end_va = 0x346bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000345c0000" filename = "" Region: id = 7747 start_va = 0x346c0000 end_va = 0x346fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000346c0000" filename = "" Region: id = 7748 start_va = 0x34700000 end_va = 0x347fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034700000" filename = "" Region: id = 7749 start_va = 0x34800000 end_va = 0x3483ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034800000" filename = "" Region: id = 7750 start_va = 0x34840000 end_va = 0x3493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034840000" filename = "" Region: id = 7751 start_va = 0x34940000 end_va = 0x3497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034940000" filename = "" Region: id = 7752 start_va = 0x34980000 end_va = 0x34a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034980000" filename = "" Region: id = 7753 start_va = 0x34a80000 end_va = 0x34abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034a80000" filename = "" Region: id = 7754 start_va = 0x34ac0000 end_va = 0x34bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034ac0000" filename = "" Region: id = 7755 start_va = 0x14590000 end_va = 0x14590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014590000" filename = "" Region: id = 7756 start_va = 0x14590000 end_va = 0x14590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014590000" filename = "" Region: id = 7757 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7758 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7759 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7760 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7761 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7762 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7763 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7764 start_va = 0x145a0000 end_va = 0x145a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145a0000" filename = "" Region: id = 7765 start_va = 0x145b0000 end_va = 0x145b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145b0000" filename = "" Region: id = 7766 start_va = 0x145c0000 end_va = 0x145c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145c0000" filename = "" Region: id = 7767 start_va = 0x145d0000 end_va = 0x145d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145d0000" filename = "" Region: id = 7768 start_va = 0x145e0000 end_va = 0x145e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145e0000" filename = "" Region: id = 7769 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7770 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7771 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7772 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7773 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7774 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7775 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7776 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7777 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7778 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7779 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7780 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7781 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7782 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7783 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7784 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7785 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7786 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7787 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7788 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7789 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7790 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7791 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7792 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7793 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7794 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7795 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7796 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7797 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7798 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7799 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7800 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7801 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7802 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7803 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7804 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7805 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7806 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7807 start_va = 0x145f0000 end_va = 0x145f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7808 start_va = 0x145f0000 end_va = 0x1462ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145f0000" filename = "" Region: id = 7809 start_va = 0x30d80000 end_va = 0x30e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030d80000" filename = "" Region: id = 7810 start_va = 0x14630000 end_va = 0x1466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014630000" filename = "" Region: id = 7811 start_va = 0x14670000 end_va = 0x146affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014670000" filename = "" Region: id = 7812 start_va = 0x146b0000 end_va = 0x146b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000146b0000" filename = "" Region: id = 7813 start_va = 0x2df00000 end_va = 0x2dffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df00000" filename = "" Region: id = 7814 start_va = 0x30e80000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030e80000" filename = "" Region: id = 7815 start_va = 0x31000000 end_va = 0x310fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 7816 start_va = 0x31100000 end_va = 0x311fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031100000" filename = "" Region: id = 7817 start_va = 0x31200000 end_va = 0x312fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031200000" filename = "" Region: id = 7818 start_va = 0x31300000 end_va = 0x3133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031300000" filename = "" Region: id = 7819 start_va = 0x31340000 end_va = 0x3143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031340000" filename = "" Region: id = 7820 start_va = 0x31440000 end_va = 0x3147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031440000" filename = "" Region: id = 7821 start_va = 0x31480000 end_va = 0x3157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031480000" filename = "" Region: id = 7822 start_va = 0x31580000 end_va = 0x315bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031580000" filename = "" Region: id = 7823 start_va = 0x315c0000 end_va = 0x316bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000315c0000" filename = "" Region: id = 7824 start_va = 0x316c0000 end_va = 0x316fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000316c0000" filename = "" Region: id = 7825 start_va = 0x31700000 end_va = 0x317fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031700000" filename = "" Region: id = 7826 start_va = 0x31800000 end_va = 0x3183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031800000" filename = "" Region: id = 7827 start_va = 0x31840000 end_va = 0x3193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031840000" filename = "" Region: id = 7828 start_va = 0x31940000 end_va = 0x3197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031940000" filename = "" Region: id = 7829 start_va = 0x31980000 end_va = 0x31a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031980000" filename = "" Region: id = 7830 start_va = 0x31a80000 end_va = 0x31abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a80000" filename = "" Region: id = 7831 start_va = 0x31ac0000 end_va = 0x31bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031ac0000" filename = "" Region: id = 7832 start_va = 0x31bc0000 end_va = 0x31bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031bc0000" filename = "" Region: id = 7833 start_va = 0x31c00000 end_va = 0x31cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031c00000" filename = "" Region: id = 7834 start_va = 0x31d00000 end_va = 0x31d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031d00000" filename = "" Region: id = 7835 start_va = 0x31d40000 end_va = 0x31e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031d40000" filename = "" Region: id = 7836 start_va = 0x31e40000 end_va = 0x31e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031e40000" filename = "" Region: id = 7837 start_va = 0x31e80000 end_va = 0x31f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031e80000" filename = "" Region: id = 7838 start_va = 0x31f80000 end_va = 0x31fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f80000" filename = "" Region: id = 7839 start_va = 0x31fc0000 end_va = 0x320bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031fc0000" filename = "" Region: id = 7840 start_va = 0x320c0000 end_va = 0x320fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000320c0000" filename = "" Region: id = 7841 start_va = 0x32100000 end_va = 0x321fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032100000" filename = "" Region: id = 7842 start_va = 0x32200000 end_va = 0x3223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032200000" filename = "" Region: id = 7843 start_va = 0x32240000 end_va = 0x3233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032240000" filename = "" Region: id = 7844 start_va = 0x32340000 end_va = 0x3237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032340000" filename = "" Region: id = 7845 start_va = 0x32380000 end_va = 0x3247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032380000" filename = "" Region: id = 7846 start_va = 0x146c0000 end_va = 0x146c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000146c0000" filename = "" Region: id = 7847 start_va = 0x30c20000 end_va = 0x30c20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c20000" filename = "" Region: id = 7848 start_va = 0x30c30000 end_va = 0x30c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030c30000" filename = "" Region: id = 7849 start_va = 0x32480000 end_va = 0x32480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032480000" filename = "" Region: id = 7850 start_va = 0x32490000 end_va = 0x32490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032490000" filename = "" Region: id = 7851 start_va = 0x324a0000 end_va = 0x324a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000324a0000" filename = "" Region: id = 7852 start_va = 0x324b0000 end_va = 0x324b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000324b0000" filename = "" Region: id = 7853 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7854 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7855 start_va = 0x14590000 end_va = 0x145cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014590000" filename = "" Region: id = 7856 start_va = 0x324c0000 end_va = 0x325bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000324c0000" filename = "" Region: id = 7857 start_va = 0x325c0000 end_va = 0x325fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000325c0000" filename = "" Region: id = 7858 start_va = 0x32600000 end_va = 0x326fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032600000" filename = "" Region: id = 7859 start_va = 0x32700000 end_va = 0x3273ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032700000" filename = "" Region: id = 7860 start_va = 0x32740000 end_va = 0x3277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032740000" filename = "" Region: id = 7861 start_va = 0x32780000 end_va = 0x327bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032780000" filename = "" Region: id = 7862 start_va = 0x34bc0000 end_va = 0x34cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034bc0000" filename = "" Region: id = 7863 start_va = 0x34cc0000 end_va = 0x34dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034cc0000" filename = "" Region: id = 7864 start_va = 0x34dc0000 end_va = 0x34ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034dc0000" filename = "" Region: id = 7865 start_va = 0x34ec0000 end_va = 0x34efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034ec0000" filename = "" Region: id = 7866 start_va = 0x34f00000 end_va = 0x34ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000034f00000" filename = "" Region: id = 7867 start_va = 0x35000000 end_va = 0x3503ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035000000" filename = "" Region: id = 7868 start_va = 0x35040000 end_va = 0x3513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035040000" filename = "" Region: id = 7869 start_va = 0x35140000 end_va = 0x3517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035140000" filename = "" Region: id = 7870 start_va = 0x35180000 end_va = 0x3527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035180000" filename = "" Region: id = 7871 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 7872 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 7873 start_va = 0xb4a0000 end_va = 0xb4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4a0000" filename = "" Region: id = 7874 start_va = 0xb4b0000 end_va = 0xb4b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4b0000" filename = "" Region: id = 7875 start_va = 0xb4c0000 end_va = 0xb4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4c0000" filename = "" Region: id = 7876 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 7877 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7878 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7879 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7880 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7881 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7882 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7883 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7884 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 7885 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7886 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7887 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7888 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7889 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7890 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7891 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7892 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7893 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7894 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7895 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7896 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7897 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7898 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7899 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 7900 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 7901 start_va = 0x141d0000 end_va = 0x1420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000141d0000" filename = "" Region: id = 7902 start_va = 0x14210000 end_va = 0x1430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014210000" filename = "" Region: id = 7903 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 7904 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 7905 start_va = 0x145d0000 end_va = 0x1460ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145d0000" filename = "" Region: id = 7906 start_va = 0x14610000 end_va = 0x1470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014610000" filename = "" Region: id = 7907 start_va = 0x14710000 end_va = 0x1474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 7908 start_va = 0x14750000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014750000" filename = "" Region: id = 7909 start_va = 0x14850000 end_va = 0x1488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014850000" filename = "" Region: id = 7910 start_va = 0x14890000 end_va = 0x1498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014890000" filename = "" Region: id = 7911 start_va = 0x14990000 end_va = 0x149cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014990000" filename = "" Region: id = 7912 start_va = 0x149d0000 end_va = 0x14a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000149d0000" filename = "" Region: id = 7913 start_va = 0x14a10000 end_va = 0x14a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014a10000" filename = "" Region: id = 7914 start_va = 0x14a50000 end_va = 0x14a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014a50000" filename = "" Region: id = 7915 start_va = 0x29a40000 end_va = 0x29b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 7916 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 7917 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 7918 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 7919 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 7920 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 7921 start_va = 0x2d680000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 7922 start_va = 0x2d6c0000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 7923 start_va = 0x2d7c0000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 7924 start_va = 0x2d800000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 7925 start_va = 0x2d900000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 7926 start_va = 0x2d940000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 7927 start_va = 0x2da40000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 7928 start_va = 0x2da80000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 7929 start_va = 0x2db80000 end_va = 0x2dbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db80000" filename = "" Region: id = 7930 start_va = 0x2dbc0000 end_va = 0x2dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dbc0000" filename = "" Region: id = 7931 start_va = 0x2dcc0000 end_va = 0x2dcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 7932 start_va = 0x2dd00000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dd00000" filename = "" Region: id = 7933 start_va = 0x2de00000 end_va = 0x2de3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 7934 start_va = 0x2de40000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de40000" filename = "" Region: id = 7935 start_va = 0x2df40000 end_va = 0x2df7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 7936 start_va = 0x2df80000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df80000" filename = "" Region: id = 7937 start_va = 0x2e080000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 7938 start_va = 0x2e0c0000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 7939 start_va = 0x2e1c0000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 7940 start_va = 0x2e200000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 7941 start_va = 0x2e300000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 7942 start_va = 0x2e340000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 7943 start_va = 0x2e440000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 7944 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 7945 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 7946 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 7947 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 7948 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 7949 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 7950 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 7951 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7952 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7953 start_va = 0x14a90000 end_va = 0x14acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014a90000" filename = "" Region: id = 7954 start_va = 0x14ad0000 end_va = 0x14bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014ad0000" filename = "" Region: id = 7955 start_va = 0x2e940000 end_va = 0x2e97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 7956 start_va = 0x2e980000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e980000" filename = "" Region: id = 7957 start_va = 0x2ea80000 end_va = 0x2eabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 7958 start_va = 0x2eac0000 end_va = 0x2eafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eac0000" filename = "" Region: id = 7959 start_va = 0x2eb00000 end_va = 0x2eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb00000" filename = "" Region: id = 7960 start_va = 0x2eb40000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb40000" filename = "" Region: id = 7961 start_va = 0x30ac0000 end_va = 0x30bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 7962 start_va = 0x30bc0000 end_va = 0x30cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030bc0000" filename = "" Region: id = 7963 start_va = 0x30cc0000 end_va = 0x30dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030cc0000" filename = "" Region: id = 7964 start_va = 0x30dc0000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030dc0000" filename = "" Region: id = 7965 start_va = 0x30ec0000 end_va = 0x30efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ec0000" filename = "" Region: id = 7966 start_va = 0x30f00000 end_va = 0x30ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030f00000" filename = "" Region: id = 7967 start_va = 0x31000000 end_va = 0x3103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 7968 start_va = 0x31040000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031040000" filename = "" Region: id = 7969 start_va = 0x31140000 end_va = 0x3117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031140000" filename = "" Region: id = 7970 start_va = 0x31180000 end_va = 0x3127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031180000" filename = "" Region: id = 7971 start_va = 0x31280000 end_va = 0x312bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031280000" filename = "" Region: id = 7972 start_va = 0x312c0000 end_va = 0x313bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000312c0000" filename = "" Region: id = 7973 start_va = 0x313c0000 end_va = 0x313fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000313c0000" filename = "" Region: id = 7974 start_va = 0x31400000 end_va = 0x314fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031400000" filename = "" Region: id = 7975 start_va = 0x31500000 end_va = 0x3153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031500000" filename = "" Region: id = 7976 start_va = 0x31540000 end_va = 0x3163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031540000" filename = "" Region: id = 7977 start_va = 0x31640000 end_va = 0x3167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031640000" filename = "" Region: id = 7978 start_va = 0x31680000 end_va = 0x3177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031680000" filename = "" Region: id = 7979 start_va = 0x31780000 end_va = 0x317bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031780000" filename = "" Region: id = 7980 start_va = 0x317c0000 end_va = 0x318bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000317c0000" filename = "" Region: id = 7981 start_va = 0x318c0000 end_va = 0x318fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000318c0000" filename = "" Region: id = 7982 start_va = 0x31900000 end_va = 0x319fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031900000" filename = "" Region: id = 7983 start_va = 0x31a00000 end_va = 0x31a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a00000" filename = "" Region: id = 7984 start_va = 0x31a40000 end_va = 0x31b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a40000" filename = "" Region: id = 7985 start_va = 0x31b40000 end_va = 0x31b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b40000" filename = "" Region: id = 7986 start_va = 0x31b80000 end_va = 0x31c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b80000" filename = "" Region: id = 7987 start_va = 0x31c80000 end_va = 0x31cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031c80000" filename = "" Region: id = 7988 start_va = 0x31cc0000 end_va = 0x31dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031cc0000" filename = "" Region: id = 7989 start_va = 0x31dc0000 end_va = 0x31dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031dc0000" filename = "" Region: id = 7990 start_va = 0x31e00000 end_va = 0x31efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031e00000" filename = "" Region: id = 7991 start_va = 0x31f00000 end_va = 0x31f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f00000" filename = "" Region: id = 7992 start_va = 0x31f40000 end_va = 0x3203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f40000" filename = "" Region: id = 7993 start_va = 0x32040000 end_va = 0x3207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032040000" filename = "" Region: id = 7994 start_va = 0x32080000 end_va = 0x3217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032080000" filename = "" Region: id = 7995 start_va = 0x32180000 end_va = 0x321bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032180000" filename = "" Region: id = 7996 start_va = 0x321c0000 end_va = 0x322bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000321c0000" filename = "" Region: id = 7997 start_va = 0x322c0000 end_va = 0x322fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000322c0000" filename = "" Region: id = 7998 start_va = 0x32300000 end_va = 0x323fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032300000" filename = "" Region: id = 7999 start_va = 0x32400000 end_va = 0x3243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032400000" filename = "" Region: id = 8000 start_va = 0x35280000 end_va = 0x3537ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035280000" filename = "" Region: id = 8001 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8002 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8003 start_va = 0x32440000 end_va = 0x3247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032440000" filename = "" Region: id = 8004 start_va = 0x32480000 end_va = 0x324bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032480000" filename = "" Region: id = 8005 start_va = 0x35380000 end_va = 0x3547ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035380000" filename = "" Region: id = 8006 start_va = 0x35480000 end_va = 0x3557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035480000" filename = "" Region: id = 8007 start_va = 0x35580000 end_va = 0x355bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035580000" filename = "" Region: id = 8008 start_va = 0x355c0000 end_va = 0x356bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000355c0000" filename = "" Region: id = 8009 start_va = 0x356c0000 end_va = 0x356fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000356c0000" filename = "" Region: id = 8010 start_va = 0x35700000 end_va = 0x357fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035700000" filename = "" Region: id = 8011 start_va = 0x35800000 end_va = 0x3583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035800000" filename = "" Region: id = 8012 start_va = 0x35840000 end_va = 0x3593ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035840000" filename = "" Region: id = 8013 start_va = 0x35940000 end_va = 0x3597ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035940000" filename = "" Region: id = 8014 start_va = 0x35980000 end_va = 0x35a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035980000" filename = "" Region: id = 8015 start_va = 0x35a80000 end_va = 0x35abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035a80000" filename = "" Region: id = 8016 start_va = 0x35ac0000 end_va = 0x35bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035ac0000" filename = "" Region: id = 8017 start_va = 0x35bc0000 end_va = 0x35bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035bc0000" filename = "" Region: id = 8018 start_va = 0x35c00000 end_va = 0x35cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035c00000" filename = "" Region: id = 8019 start_va = 0x35d00000 end_va = 0x35d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035d00000" filename = "" Region: id = 8020 start_va = 0x35d40000 end_va = 0x35e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035d40000" filename = "" Region: id = 8021 start_va = 0x35e40000 end_va = 0x35e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035e40000" filename = "" Region: id = 8022 start_va = 0x35e80000 end_va = 0x35f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035e80000" filename = "" Region: id = 8023 start_va = 0x35f80000 end_va = 0x35fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035f80000" filename = "" Region: id = 8024 start_va = 0x35fc0000 end_va = 0x360bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035fc0000" filename = "" Region: id = 8025 start_va = 0x360c0000 end_va = 0x360fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000360c0000" filename = "" Region: id = 8026 start_va = 0x36100000 end_va = 0x361fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036100000" filename = "" Region: id = 8027 start_va = 0x36200000 end_va = 0x3623ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036200000" filename = "" Region: id = 8028 start_va = 0x36240000 end_va = 0x3633ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036240000" filename = "" Region: id = 8029 start_va = 0x36340000 end_va = 0x3637ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036340000" filename = "" Region: id = 8030 start_va = 0x36380000 end_va = 0x3647ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036380000" filename = "" Region: id = 8031 start_va = 0x36480000 end_va = 0x364bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036480000" filename = "" Region: id = 8032 start_va = 0x364c0000 end_va = 0x365bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000364c0000" filename = "" Region: id = 8033 start_va = 0x365c0000 end_va = 0x365fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000365c0000" filename = "" Region: id = 8034 start_va = 0x36600000 end_va = 0x366fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036600000" filename = "" Region: id = 8035 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8036 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8037 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8038 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8039 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8040 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8041 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8042 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8043 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8044 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8045 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8046 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8047 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8048 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8049 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8050 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8051 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8052 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8053 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8054 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8055 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8056 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8057 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8058 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8059 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8060 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8061 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8062 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8063 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8064 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8065 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8066 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8067 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8068 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8069 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8070 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8071 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8072 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8073 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8074 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8075 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8076 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8077 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8078 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8079 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8080 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8081 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8082 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8083 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8084 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8085 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8086 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8087 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8088 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8089 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8090 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8091 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8092 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8093 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8094 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8095 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8096 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8097 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8098 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8099 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8100 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8101 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8102 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8103 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8104 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8105 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8106 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8107 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8108 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8109 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8110 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8111 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8112 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8113 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8114 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8115 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8116 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8117 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8118 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8119 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8120 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8121 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8122 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8123 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8124 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8125 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8126 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8127 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8128 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8129 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8130 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8131 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8132 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8133 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8134 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8135 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8136 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8137 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8138 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8139 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8140 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8141 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8142 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8143 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8144 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8145 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8146 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8147 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8148 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8149 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8150 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8151 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8152 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8153 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8154 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8155 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8156 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8157 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8158 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8159 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8160 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8161 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8162 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8163 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 8164 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 8165 start_va = 0x141d0000 end_va = 0x1420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000141d0000" filename = "" Region: id = 8166 start_va = 0x14210000 end_va = 0x1430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014210000" filename = "" Region: id = 8167 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 8168 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 8169 start_va = 0x145d0000 end_va = 0x1460ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145d0000" filename = "" Region: id = 8170 start_va = 0x14610000 end_va = 0x1470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014610000" filename = "" Region: id = 8171 start_va = 0x14710000 end_va = 0x1474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 8172 start_va = 0x14750000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014750000" filename = "" Region: id = 8173 start_va = 0x14850000 end_va = 0x1488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014850000" filename = "" Region: id = 8174 start_va = 0x14890000 end_va = 0x1498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014890000" filename = "" Region: id = 8175 start_va = 0x14990000 end_va = 0x149cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014990000" filename = "" Region: id = 8176 start_va = 0x149d0000 end_va = 0x14acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000149d0000" filename = "" Region: id = 8177 start_va = 0x14ad0000 end_va = 0x14b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014ad0000" filename = "" Region: id = 8178 start_va = 0x14b10000 end_va = 0x14c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014b10000" filename = "" Region: id = 8179 start_va = 0x14c10000 end_va = 0x14c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c10000" filename = "" Region: id = 8180 start_va = 0x14c50000 end_va = 0x14c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c50000" filename = "" Region: id = 8181 start_va = 0x14c90000 end_va = 0x14ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c90000" filename = "" Region: id = 8182 start_va = 0x29a40000 end_va = 0x29b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 8183 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 8184 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 8185 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8186 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8187 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8188 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8189 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8190 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8191 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8192 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8193 start_va = 0x14cd0000 end_va = 0x14d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014cd0000" filename = "" Region: id = 8194 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 8195 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 8196 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 8197 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 8198 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 8199 start_va = 0x2d680000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 8200 start_va = 0x2d6c0000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 8201 start_va = 0x2d7c0000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 8202 start_va = 0x2d800000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 8203 start_va = 0x2d900000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 8204 start_va = 0x2d940000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 8205 start_va = 0x2da40000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 8206 start_va = 0x2da80000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 8207 start_va = 0x2db80000 end_va = 0x2dbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db80000" filename = "" Region: id = 8208 start_va = 0x2dbc0000 end_va = 0x2dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dbc0000" filename = "" Region: id = 8209 start_va = 0x2dcc0000 end_va = 0x2dcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 8210 start_va = 0x2dd00000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dd00000" filename = "" Region: id = 8211 start_va = 0x2de00000 end_va = 0x2de3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 8212 start_va = 0x2de40000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de40000" filename = "" Region: id = 8213 start_va = 0x2df40000 end_va = 0x2df7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 8214 start_va = 0x2df80000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df80000" filename = "" Region: id = 8215 start_va = 0x2e080000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 8216 start_va = 0x2e0c0000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 8217 start_va = 0x2e1c0000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 8218 start_va = 0x2e200000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 8219 start_va = 0x2e300000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 8220 start_va = 0x2e340000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 8221 start_va = 0x2e440000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 8222 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 8223 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 8224 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 8225 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 8226 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 8227 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 8228 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 8229 start_va = 0x2e940000 end_va = 0x2e97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 8230 start_va = 0x2e980000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e980000" filename = "" Region: id = 8231 start_va = 0x2ea80000 end_va = 0x2eabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 8232 start_va = 0x2eac0000 end_va = 0x2eafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eac0000" filename = "" Region: id = 8233 start_va = 0x2eb00000 end_va = 0x2eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb00000" filename = "" Region: id = 8234 start_va = 0x2eb40000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb40000" filename = "" Region: id = 8235 start_va = 0x30ac0000 end_va = 0x30bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 8236 start_va = 0x30bc0000 end_va = 0x30cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030bc0000" filename = "" Region: id = 8237 start_va = 0x30cc0000 end_va = 0x30dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030cc0000" filename = "" Region: id = 8238 start_va = 0x30dc0000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030dc0000" filename = "" Region: id = 8239 start_va = 0x30ec0000 end_va = 0x30efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ec0000" filename = "" Region: id = 8240 start_va = 0x30f00000 end_va = 0x30ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030f00000" filename = "" Region: id = 8241 start_va = 0x31000000 end_va = 0x3103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 8242 start_va = 0x31040000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031040000" filename = "" Region: id = 8243 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8244 start_va = 0x31140000 end_va = 0x3117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031140000" filename = "" Region: id = 8245 start_va = 0x31180000 end_va = 0x3127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031180000" filename = "" Region: id = 8246 start_va = 0x31280000 end_va = 0x312bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031280000" filename = "" Region: id = 8247 start_va = 0x312c0000 end_va = 0x313bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000312c0000" filename = "" Region: id = 8248 start_va = 0x313c0000 end_va = 0x313fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000313c0000" filename = "" Region: id = 8249 start_va = 0x31400000 end_va = 0x314fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031400000" filename = "" Region: id = 8250 start_va = 0x31500000 end_va = 0x3153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031500000" filename = "" Region: id = 8251 start_va = 0x31540000 end_va = 0x3163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031540000" filename = "" Region: id = 8252 start_va = 0x31640000 end_va = 0x3167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031640000" filename = "" Region: id = 8253 start_va = 0x31680000 end_va = 0x3177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031680000" filename = "" Region: id = 8254 start_va = 0x31780000 end_va = 0x317bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031780000" filename = "" Region: id = 8255 start_va = 0x317c0000 end_va = 0x318bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000317c0000" filename = "" Region: id = 8256 start_va = 0x318c0000 end_va = 0x318fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000318c0000" filename = "" Region: id = 8257 start_va = 0x31900000 end_va = 0x319fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031900000" filename = "" Region: id = 8258 start_va = 0x31a00000 end_va = 0x31a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a00000" filename = "" Region: id = 8259 start_va = 0x31a40000 end_va = 0x31b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031a40000" filename = "" Region: id = 8260 start_va = 0x31b40000 end_va = 0x31b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b40000" filename = "" Region: id = 8261 start_va = 0x31b80000 end_va = 0x31c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031b80000" filename = "" Region: id = 8262 start_va = 0x31c80000 end_va = 0x31cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031c80000" filename = "" Region: id = 8263 start_va = 0x31cc0000 end_va = 0x31dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031cc0000" filename = "" Region: id = 8264 start_va = 0x31dc0000 end_va = 0x31dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031dc0000" filename = "" Region: id = 8265 start_va = 0x31e00000 end_va = 0x31efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031e00000" filename = "" Region: id = 8266 start_va = 0x31f00000 end_va = 0x31f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f00000" filename = "" Region: id = 8267 start_va = 0x31f40000 end_va = 0x3203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031f40000" filename = "" Region: id = 8268 start_va = 0x32040000 end_va = 0x3207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032040000" filename = "" Region: id = 8269 start_va = 0x32080000 end_va = 0x3217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032080000" filename = "" Region: id = 8270 start_va = 0x32180000 end_va = 0x321bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032180000" filename = "" Region: id = 8271 start_va = 0x321c0000 end_va = 0x322bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000321c0000" filename = "" Region: id = 8272 start_va = 0x322c0000 end_va = 0x322fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000322c0000" filename = "" Region: id = 8273 start_va = 0x32300000 end_va = 0x323fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032300000" filename = "" Region: id = 8274 start_va = 0x32400000 end_va = 0x3243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032400000" filename = "" Region: id = 8275 start_va = 0x32440000 end_va = 0x3247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032440000" filename = "" Region: id = 8276 start_va = 0x32480000 end_va = 0x324bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000032480000" filename = "" Region: id = 8277 start_va = 0x35280000 end_va = 0x3537ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035280000" filename = "" Region: id = 8278 start_va = 0x35380000 end_va = 0x3547ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035380000" filename = "" Region: id = 8279 start_va = 0x35480000 end_va = 0x3557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035480000" filename = "" Region: id = 8280 start_va = 0x35580000 end_va = 0x355bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035580000" filename = "" Region: id = 8281 start_va = 0x355c0000 end_va = 0x356bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000355c0000" filename = "" Region: id = 8282 start_va = 0x356c0000 end_va = 0x356fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000356c0000" filename = "" Region: id = 8283 start_va = 0x35700000 end_va = 0x357fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035700000" filename = "" Region: id = 8284 start_va = 0x35800000 end_va = 0x3583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035800000" filename = "" Region: id = 8285 start_va = 0x35840000 end_va = 0x3593ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035840000" filename = "" Region: id = 8286 start_va = 0x35940000 end_va = 0x3597ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035940000" filename = "" Region: id = 8287 start_va = 0x35980000 end_va = 0x35a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035980000" filename = "" Region: id = 8288 start_va = 0x35a80000 end_va = 0x35abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035a80000" filename = "" Region: id = 8289 start_va = 0x35ac0000 end_va = 0x35bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035ac0000" filename = "" Region: id = 8290 start_va = 0x35bc0000 end_va = 0x35bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035bc0000" filename = "" Region: id = 8291 start_va = 0x35c00000 end_va = 0x35cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035c00000" filename = "" Region: id = 8292 start_va = 0x35d00000 end_va = 0x35d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035d00000" filename = "" Region: id = 8293 start_va = 0x35d40000 end_va = 0x35e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035d40000" filename = "" Region: id = 8294 start_va = 0x35e40000 end_va = 0x35e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035e40000" filename = "" Region: id = 8295 start_va = 0x35e80000 end_va = 0x35f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035e80000" filename = "" Region: id = 8296 start_va = 0x35f80000 end_va = 0x35fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035f80000" filename = "" Region: id = 8297 start_va = 0x35fc0000 end_va = 0x360bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000035fc0000" filename = "" Region: id = 8298 start_va = 0x360c0000 end_va = 0x360fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000360c0000" filename = "" Region: id = 8299 start_va = 0x36100000 end_va = 0x361fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036100000" filename = "" Region: id = 8300 start_va = 0x36200000 end_va = 0x3623ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036200000" filename = "" Region: id = 8301 start_va = 0x36240000 end_va = 0x3633ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036240000" filename = "" Region: id = 8302 start_va = 0x36340000 end_va = 0x3637ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036340000" filename = "" Region: id = 8303 start_va = 0x36380000 end_va = 0x3647ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036380000" filename = "" Region: id = 8304 start_va = 0x36700000 end_va = 0x3673ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036700000" filename = "" Region: id = 8305 start_va = 0x36740000 end_va = 0x3683ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036740000" filename = "" Region: id = 8306 start_va = 0x36840000 end_va = 0x3687ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036840000" filename = "" Region: id = 8307 start_va = 0x36880000 end_va = 0x3697ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036880000" filename = "" Region: id = 8308 start_va = 0x36980000 end_va = 0x369bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036980000" filename = "" Region: id = 8309 start_va = 0x369c0000 end_va = 0x36abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000369c0000" filename = "" Region: id = 8310 start_va = 0x36ac0000 end_va = 0x36afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036ac0000" filename = "" Region: id = 8311 start_va = 0x36b00000 end_va = 0x36bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036b00000" filename = "" Region: id = 8312 start_va = 0x36c00000 end_va = 0x36c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036c00000" filename = "" Region: id = 8313 start_va = 0x36c40000 end_va = 0x36d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036c40000" filename = "" Region: id = 8314 start_va = 0x36d40000 end_va = 0x36d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036d40000" filename = "" Region: id = 8315 start_va = 0x36d80000 end_va = 0x36e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036d80000" filename = "" Region: id = 8316 start_va = 0x36e80000 end_va = 0x36ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036e80000" filename = "" Region: id = 8317 start_va = 0x36ec0000 end_va = 0x36fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036ec0000" filename = "" Region: id = 8318 start_va = 0x36fc0000 end_va = 0x36ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036fc0000" filename = "" Region: id = 8319 start_va = 0x37000000 end_va = 0x370fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037000000" filename = "" Region: id = 8320 start_va = 0x37100000 end_va = 0x3713ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037100000" filename = "" Region: id = 8321 start_va = 0x37140000 end_va = 0x3723ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037140000" filename = "" Region: id = 8322 start_va = 0x37240000 end_va = 0x3727ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037240000" filename = "" Region: id = 8323 start_va = 0x37280000 end_va = 0x3737ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037280000" filename = "" Region: id = 8324 start_va = 0x37380000 end_va = 0x373bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037380000" filename = "" Region: id = 8325 start_va = 0x373c0000 end_va = 0x374bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000373c0000" filename = "" Region: id = 8326 start_va = 0x374c0000 end_va = 0x374fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000374c0000" filename = "" Region: id = 8327 start_va = 0x37500000 end_va = 0x375fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037500000" filename = "" Region: id = 8328 start_va = 0x37600000 end_va = 0x3763ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037600000" filename = "" Region: id = 8329 start_va = 0x37640000 end_va = 0x3773ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037640000" filename = "" Region: id = 8330 start_va = 0x37740000 end_va = 0x3777ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037740000" filename = "" Region: id = 8331 start_va = 0x37780000 end_va = 0x3787ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037780000" filename = "" Region: id = 8332 start_va = 0x37880000 end_va = 0x378bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037880000" filename = "" Region: id = 8333 start_va = 0x378c0000 end_va = 0x379bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000378c0000" filename = "" Region: id = 8334 start_va = 0x379c0000 end_va = 0x379fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000379c0000" filename = "" Region: id = 8335 start_va = 0x37a00000 end_va = 0x37afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037a00000" filename = "" Region: id = 8336 start_va = 0x37b00000 end_va = 0x37b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037b00000" filename = "" Region: id = 8337 start_va = 0x37b40000 end_va = 0x37c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037b40000" filename = "" Region: id = 8338 start_va = 0x37c40000 end_va = 0x37c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037c40000" filename = "" Region: id = 8339 start_va = 0x37c80000 end_va = 0x37d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 8340 start_va = 0x37d80000 end_va = 0x37dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037d80000" filename = "" Region: id = 8341 start_va = 0x37dc0000 end_va = 0x37ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037dc0000" filename = "" Region: id = 8342 start_va = 0x37ec0000 end_va = 0x37efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037ec0000" filename = "" Region: id = 8343 start_va = 0x37f00000 end_va = 0x37ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000037f00000" filename = "" Region: id = 8344 start_va = 0x38000000 end_va = 0x3803ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038000000" filename = "" Region: id = 8345 start_va = 0x38040000 end_va = 0x3813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038040000" filename = "" Region: id = 8346 start_va = 0x38140000 end_va = 0x3817ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038140000" filename = "" Region: id = 8347 start_va = 0x38180000 end_va = 0x3827ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038180000" filename = "" Region: id = 8348 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8349 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8350 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8351 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8352 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8353 start_va = 0x38280000 end_va = 0x382bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038280000" filename = "" Region: id = 8354 start_va = 0x382c0000 end_va = 0x383bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000382c0000" filename = "" Region: id = 8355 start_va = 0x383c0000 end_va = 0x383fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000383c0000" filename = "" Region: id = 8356 start_va = 0x38400000 end_va = 0x384fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038400000" filename = "" Region: id = 8357 start_va = 0x38500000 end_va = 0x3853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038500000" filename = "" Region: id = 8358 start_va = 0x38540000 end_va = 0x3863ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038540000" filename = "" Region: id = 8359 start_va = 0x38640000 end_va = 0x3867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038640000" filename = "" Region: id = 8360 start_va = 0x38680000 end_va = 0x3877ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038680000" filename = "" Region: id = 8361 start_va = 0x38780000 end_va = 0x387bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038780000" filename = "" Region: id = 8362 start_va = 0x387c0000 end_va = 0x388bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000387c0000" filename = "" Region: id = 8363 start_va = 0x388c0000 end_va = 0x388fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000388c0000" filename = "" Region: id = 8364 start_va = 0x38900000 end_va = 0x389fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038900000" filename = "" Region: id = 8365 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8366 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8367 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8368 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8369 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8370 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8371 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8372 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8373 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8374 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8375 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8376 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8377 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8378 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8379 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8380 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8381 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8382 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8383 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8384 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8385 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8386 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8387 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8388 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 8389 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 8390 start_va = 0xb4a0000 end_va = 0xb4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4a0000" filename = "" Region: id = 8391 start_va = 0xb4b0000 end_va = 0xb4b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4b0000" filename = "" Region: id = 8392 start_va = 0xb4c0000 end_va = 0xb4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4c0000" filename = "" Region: id = 8393 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 8394 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 8395 start_va = 0xf970000 end_va = 0xf970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f970000" filename = "" Region: id = 8396 start_va = 0xf980000 end_va = 0xf980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f980000" filename = "" Region: id = 8397 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 8398 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8399 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8400 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8401 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8402 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8403 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8404 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8405 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8406 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8407 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8408 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8409 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8410 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8411 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8412 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8413 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 8414 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 8415 start_va = 0x14710000 end_va = 0x1474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 8416 start_va = 0x14750000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014750000" filename = "" Region: id = 8417 start_va = 0x14c50000 end_va = 0x14c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c50000" filename = "" Region: id = 8418 start_va = 0x14c90000 end_va = 0x14ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c90000" filename = "" Region: id = 8419 start_va = 0x14cd0000 end_va = 0x14d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014cd0000" filename = "" Region: id = 8420 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 8421 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 8422 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 8423 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 8424 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 8425 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 8426 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 8427 start_va = 0x2d680000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 8428 start_va = 0x2d6c0000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 8429 start_va = 0x2d900000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 8430 start_va = 0x2d940000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 8431 start_va = 0x2da40000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 8432 start_va = 0x2da80000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 8433 start_va = 0x2de00000 end_va = 0x2de3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 8434 start_va = 0x2de40000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de40000" filename = "" Region: id = 8435 start_va = 0x2df40000 end_va = 0x2df7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 8436 start_va = 0x2df80000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df80000" filename = "" Region: id = 8437 start_va = 0x2e080000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 8438 start_va = 0x2e0c0000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 8439 start_va = 0x2e1c0000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 8440 start_va = 0x2e200000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 8441 start_va = 0x2e300000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 8442 start_va = 0x2e340000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 8443 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8444 start_va = 0x2d7c0000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 8445 start_va = 0x2d800000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 8446 start_va = 0x2e440000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 8447 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 8448 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 8449 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 8450 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 8451 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 8452 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 8453 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 8454 start_va = 0x2e940000 end_va = 0x2e97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 8455 start_va = 0x2e980000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e980000" filename = "" Region: id = 8456 start_va = 0x2ea80000 end_va = 0x2eabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 8457 start_va = 0x2eac0000 end_va = 0x2eafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eac0000" filename = "" Region: id = 8458 start_va = 0x2eb00000 end_va = 0x2eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb00000" filename = "" Region: id = 8459 start_va = 0x2eb40000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb40000" filename = "" Region: id = 8460 start_va = 0x30ac0000 end_va = 0x30bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 8461 start_va = 0x30bc0000 end_va = 0x30cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030bc0000" filename = "" Region: id = 8462 start_va = 0x30cc0000 end_va = 0x30dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030cc0000" filename = "" Region: id = 8463 start_va = 0x30dc0000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030dc0000" filename = "" Region: id = 8464 start_va = 0x38a00000 end_va = 0x38a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a00000" filename = "" Region: id = 8465 start_va = 0x38a40000 end_va = 0x38b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a40000" filename = "" Region: id = 8466 start_va = 0x38b40000 end_va = 0x38b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038b40000" filename = "" Region: id = 8467 start_va = 0x38b80000 end_va = 0x38c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038b80000" filename = "" Region: id = 8468 start_va = 0x38c80000 end_va = 0x38cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038c80000" filename = "" Region: id = 8469 start_va = 0x38cc0000 end_va = 0x38dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038cc0000" filename = "" Region: id = 8470 start_va = 0x38dc0000 end_va = 0x38dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038dc0000" filename = "" Region: id = 8471 start_va = 0x38e00000 end_va = 0x38efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038e00000" filename = "" Region: id = 8472 start_va = 0x38f00000 end_va = 0x38f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f00000" filename = "" Region: id = 8473 start_va = 0x38f40000 end_va = 0x3903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f40000" filename = "" Region: id = 8474 start_va = 0x39040000 end_va = 0x3907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039040000" filename = "" Region: id = 8475 start_va = 0x39080000 end_va = 0x3917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039080000" filename = "" Region: id = 8476 start_va = 0x39180000 end_va = 0x391bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039180000" filename = "" Region: id = 8477 start_va = 0x391c0000 end_va = 0x392bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000391c0000" filename = "" Region: id = 8478 start_va = 0x392c0000 end_va = 0x392fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000392c0000" filename = "" Region: id = 8479 start_va = 0x39300000 end_va = 0x393fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039300000" filename = "" Region: id = 8480 start_va = 0x39400000 end_va = 0x3943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039400000" filename = "" Region: id = 8481 start_va = 0x39440000 end_va = 0x3953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039440000" filename = "" Region: id = 8482 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8483 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8484 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8485 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8486 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8487 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8488 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8489 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8490 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8491 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8492 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8493 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8494 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8495 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8496 start_va = 0x14090000 end_va = 0x140cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014090000" filename = "" Region: id = 8497 start_va = 0x140d0000 end_va = 0x141cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000140d0000" filename = "" Region: id = 8498 start_va = 0x141d0000 end_va = 0x1420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000141d0000" filename = "" Region: id = 8499 start_va = 0x14210000 end_va = 0x1430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014210000" filename = "" Region: id = 8500 start_va = 0x145d0000 end_va = 0x1460ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000145d0000" filename = "" Region: id = 8501 start_va = 0x14610000 end_va = 0x1470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014610000" filename = "" Region: id = 8502 start_va = 0x14850000 end_va = 0x1488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014850000" filename = "" Region: id = 8503 start_va = 0x14890000 end_va = 0x1498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014890000" filename = "" Region: id = 8504 start_va = 0x14990000 end_va = 0x149cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014990000" filename = "" Region: id = 8505 start_va = 0x149d0000 end_va = 0x14acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000149d0000" filename = "" Region: id = 8506 start_va = 0x14ad0000 end_va = 0x14b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014ad0000" filename = "" Region: id = 8507 start_va = 0x14b10000 end_va = 0x14c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014b10000" filename = "" Region: id = 8508 start_va = 0x14c10000 end_va = 0x14c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c10000" filename = "" Region: id = 8509 start_va = 0x14e50000 end_va = 0x14f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e50000" filename = "" Region: id = 8510 start_va = 0x14f50000 end_va = 0x14f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f50000" filename = "" Region: id = 8511 start_va = 0x29a40000 end_va = 0x29b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029a40000" filename = "" Region: id = 8512 start_va = 0x2db80000 end_va = 0x2dbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db80000" filename = "" Region: id = 8513 start_va = 0x2dbc0000 end_va = 0x2dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dbc0000" filename = "" Region: id = 8514 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8515 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8516 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8517 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8518 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8519 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8520 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8521 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8522 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8523 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8524 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8525 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8526 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8527 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8528 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8529 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8530 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8531 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8532 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8533 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8534 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8535 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8536 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8537 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8538 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8539 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8540 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8541 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8542 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8543 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8544 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8545 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8546 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8547 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8548 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8549 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8550 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8551 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8552 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8553 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8554 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8555 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8556 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8557 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8558 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8559 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8560 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8561 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8562 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8563 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8564 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8565 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8566 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8567 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8568 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8569 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8570 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8571 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8572 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8573 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8574 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8575 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8576 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8577 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8578 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8579 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8580 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8581 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8582 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8583 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8584 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8585 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8586 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8587 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8588 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8589 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8590 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8591 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8592 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8593 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8594 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 8595 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 8596 start_va = 0x14710000 end_va = 0x1474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 8597 start_va = 0x14750000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014750000" filename = "" Region: id = 8598 start_va = 0x14c50000 end_va = 0x14c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c50000" filename = "" Region: id = 8599 start_va = 0x14c90000 end_va = 0x14ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c90000" filename = "" Region: id = 8600 start_va = 0x14cd0000 end_va = 0x14d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014cd0000" filename = "" Region: id = 8601 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 8602 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 8603 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 8604 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 8605 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 8606 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 8607 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 8608 start_va = 0x2d680000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 8609 start_va = 0x2d6c0000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 8610 start_va = 0x2d7c0000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 8611 start_va = 0x2d800000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 8612 start_va = 0x2d900000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 8613 start_va = 0x2d940000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 8614 start_va = 0x2da40000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 8615 start_va = 0x2da80000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 8616 start_va = 0x2dcc0000 end_va = 0x2dcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 8617 start_va = 0x2dd00000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dd00000" filename = "" Region: id = 8618 start_va = 0x2de00000 end_va = 0x2de3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 8619 start_va = 0x2de40000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de40000" filename = "" Region: id = 8620 start_va = 0x2df40000 end_va = 0x2df7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 8621 start_va = 0x2df80000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df80000" filename = "" Region: id = 8622 start_va = 0x2e080000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 8623 start_va = 0x2e0c0000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 8624 start_va = 0x2e1c0000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 8625 start_va = 0x2e200000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 8626 start_va = 0x2e300000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 8627 start_va = 0x2e340000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 8628 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8629 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8630 start_va = 0x2e440000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 8631 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 8632 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 8633 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 8634 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 8635 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 8636 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 8637 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 8638 start_va = 0x2e940000 end_va = 0x2e97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 8639 start_va = 0x2e980000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e980000" filename = "" Region: id = 8640 start_va = 0x2ea80000 end_va = 0x2eabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 8641 start_va = 0x2eac0000 end_va = 0x2eafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eac0000" filename = "" Region: id = 8642 start_va = 0x2eb00000 end_va = 0x2eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb00000" filename = "" Region: id = 8643 start_va = 0x2eb40000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb40000" filename = "" Region: id = 8644 start_va = 0x30ac0000 end_va = 0x30bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 8645 start_va = 0x30bc0000 end_va = 0x30cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030bc0000" filename = "" Region: id = 8646 start_va = 0x30cc0000 end_va = 0x30dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030cc0000" filename = "" Region: id = 8647 start_va = 0x30dc0000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030dc0000" filename = "" Region: id = 8648 start_va = 0x30ec0000 end_va = 0x30efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ec0000" filename = "" Region: id = 8649 start_va = 0x30f00000 end_va = 0x30ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030f00000" filename = "" Region: id = 8650 start_va = 0x31000000 end_va = 0x3103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 8651 start_va = 0x31040000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031040000" filename = "" Region: id = 8652 start_va = 0x36480000 end_va = 0x364bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036480000" filename = "" Region: id = 8653 start_va = 0x364c0000 end_va = 0x365bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000364c0000" filename = "" Region: id = 8654 start_va = 0x365c0000 end_va = 0x365fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000365c0000" filename = "" Region: id = 8655 start_va = 0x36600000 end_va = 0x366fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036600000" filename = "" Region: id = 8656 start_va = 0x38280000 end_va = 0x382bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038280000" filename = "" Region: id = 8657 start_va = 0x382c0000 end_va = 0x383bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000382c0000" filename = "" Region: id = 8658 start_va = 0x383c0000 end_va = 0x383fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000383c0000" filename = "" Region: id = 8659 start_va = 0x38400000 end_va = 0x384fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038400000" filename = "" Region: id = 8660 start_va = 0x38500000 end_va = 0x3853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038500000" filename = "" Region: id = 8661 start_va = 0x38540000 end_va = 0x3863ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038540000" filename = "" Region: id = 8662 start_va = 0x38640000 end_va = 0x3867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038640000" filename = "" Region: id = 8663 start_va = 0x38680000 end_va = 0x3877ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038680000" filename = "" Region: id = 8664 start_va = 0x38780000 end_va = 0x387bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038780000" filename = "" Region: id = 8665 start_va = 0x387c0000 end_va = 0x388bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000387c0000" filename = "" Region: id = 8666 start_va = 0x388c0000 end_va = 0x388fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000388c0000" filename = "" Region: id = 8667 start_va = 0x38900000 end_va = 0x389fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038900000" filename = "" Region: id = 8668 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8669 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8670 start_va = 0x38a00000 end_va = 0x38a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a00000" filename = "" Region: id = 8671 start_va = 0x38a40000 end_va = 0x38b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a40000" filename = "" Region: id = 8672 start_va = 0x38b40000 end_va = 0x38b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038b40000" filename = "" Region: id = 8673 start_va = 0x38b80000 end_va = 0x38c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038b80000" filename = "" Region: id = 8674 start_va = 0x38c80000 end_va = 0x38cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038c80000" filename = "" Region: id = 8675 start_va = 0x38cc0000 end_va = 0x38dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038cc0000" filename = "" Region: id = 8676 start_va = 0x38dc0000 end_va = 0x38dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038dc0000" filename = "" Region: id = 8677 start_va = 0x38e00000 end_va = 0x38efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038e00000" filename = "" Region: id = 8678 start_va = 0x38f00000 end_va = 0x38f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f00000" filename = "" Region: id = 8679 start_va = 0x38f40000 end_va = 0x3903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f40000" filename = "" Region: id = 8680 start_va = 0x39040000 end_va = 0x3907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039040000" filename = "" Region: id = 8681 start_va = 0x39080000 end_va = 0x3917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039080000" filename = "" Region: id = 8682 start_va = 0x39180000 end_va = 0x391bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039180000" filename = "" Region: id = 8683 start_va = 0x391c0000 end_va = 0x392bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000391c0000" filename = "" Region: id = 8684 start_va = 0x392c0000 end_va = 0x392fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000392c0000" filename = "" Region: id = 8685 start_va = 0x39300000 end_va = 0x393fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039300000" filename = "" Region: id = 8686 start_va = 0x39400000 end_va = 0x3943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039400000" filename = "" Region: id = 8687 start_va = 0x39440000 end_va = 0x3953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039440000" filename = "" Region: id = 8688 start_va = 0x39540000 end_va = 0x3957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039540000" filename = "" Region: id = 8689 start_va = 0x39580000 end_va = 0x3967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039580000" filename = "" Region: id = 8690 start_va = 0x39680000 end_va = 0x396bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039680000" filename = "" Region: id = 8691 start_va = 0x396c0000 end_va = 0x397bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000396c0000" filename = "" Region: id = 8692 start_va = 0x397c0000 end_va = 0x397fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000397c0000" filename = "" Region: id = 8693 start_va = 0x39800000 end_va = 0x398fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039800000" filename = "" Region: id = 8694 start_va = 0x39900000 end_va = 0x3993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039900000" filename = "" Region: id = 8695 start_va = 0x39940000 end_va = 0x39a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039940000" filename = "" Region: id = 8696 start_va = 0x39a40000 end_va = 0x39a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039a40000" filename = "" Region: id = 8697 start_va = 0x39a80000 end_va = 0x39b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039a80000" filename = "" Region: id = 8698 start_va = 0x39b80000 end_va = 0x39bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039b80000" filename = "" Region: id = 8699 start_va = 0x39bc0000 end_va = 0x39cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039bc0000" filename = "" Region: id = 8700 start_va = 0x39cc0000 end_va = 0x39cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039cc0000" filename = "" Region: id = 8701 start_va = 0x39d00000 end_va = 0x39dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039d00000" filename = "" Region: id = 8702 start_va = 0x39e00000 end_va = 0x39e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039e00000" filename = "" Region: id = 8703 start_va = 0x39e40000 end_va = 0x39f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039e40000" filename = "" Region: id = 8704 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8705 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8706 start_va = 0x39f40000 end_va = 0x39f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039f40000" filename = "" Region: id = 8707 start_va = 0x39f80000 end_va = 0x3a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039f80000" filename = "" Region: id = 8708 start_va = 0x3a080000 end_va = 0x3a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a080000" filename = "" Region: id = 8709 start_va = 0x3a0c0000 end_va = 0x3a1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a0c0000" filename = "" Region: id = 8710 start_va = 0x3a1c0000 end_va = 0x3a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a1c0000" filename = "" Region: id = 8711 start_va = 0x3a200000 end_va = 0x3a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a200000" filename = "" Region: id = 8712 start_va = 0x3a300000 end_va = 0x3a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a300000" filename = "" Region: id = 8713 start_va = 0x3a340000 end_va = 0x3a43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a340000" filename = "" Region: id = 8714 start_va = 0x3a440000 end_va = 0x3a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a440000" filename = "" Region: id = 8715 start_va = 0x3a480000 end_va = 0x3a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a480000" filename = "" Region: id = 8716 start_va = 0x3a580000 end_va = 0x3a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a580000" filename = "" Region: id = 8717 start_va = 0x3a5c0000 end_va = 0x3a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a5c0000" filename = "" Region: id = 8718 start_va = 0x3a6c0000 end_va = 0x3a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a6c0000" filename = "" Region: id = 8719 start_va = 0x3a700000 end_va = 0x3a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a700000" filename = "" Region: id = 8720 start_va = 0x3a800000 end_va = 0x3a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a800000" filename = "" Region: id = 8721 start_va = 0x3a840000 end_va = 0x3a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a840000" filename = "" Region: id = 8722 start_va = 0x3a940000 end_va = 0x3a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a940000" filename = "" Region: id = 8723 start_va = 0x3a980000 end_va = 0x3aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a980000" filename = "" Region: id = 8724 start_va = 0x3aa80000 end_va = 0x3aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003aa80000" filename = "" Region: id = 8725 start_va = 0x3aac0000 end_va = 0x3abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003aac0000" filename = "" Region: id = 8726 start_va = 0x3abc0000 end_va = 0x3abfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003abc0000" filename = "" Region: id = 8727 start_va = 0x3ac00000 end_va = 0x3acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ac00000" filename = "" Region: id = 8728 start_va = 0x3ad00000 end_va = 0x3ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ad00000" filename = "" Region: id = 8729 start_va = 0x3ad40000 end_va = 0x3ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ad40000" filename = "" Region: id = 8730 start_va = 0x3ae40000 end_va = 0x3ae7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ae40000" filename = "" Region: id = 8731 start_va = 0x3ae80000 end_va = 0x3af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ae80000" filename = "" Region: id = 8732 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8733 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8734 start_va = 0x3af80000 end_va = 0x3afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003af80000" filename = "" Region: id = 8735 start_va = 0x3afc0000 end_va = 0x3b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003afc0000" filename = "" Region: id = 8736 start_va = 0x3b0c0000 end_va = 0x3b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b0c0000" filename = "" Region: id = 8737 start_va = 0x3b100000 end_va = 0x3b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b100000" filename = "" Region: id = 8738 start_va = 0x3b200000 end_va = 0x3b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b200000" filename = "" Region: id = 8739 start_va = 0x3b240000 end_va = 0x3b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b240000" filename = "" Region: id = 8740 start_va = 0x3b340000 end_va = 0x3b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b340000" filename = "" Region: id = 8741 start_va = 0x3b380000 end_va = 0x3b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b380000" filename = "" Region: id = 8742 start_va = 0x3b480000 end_va = 0x3b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b480000" filename = "" Region: id = 8743 start_va = 0x3b4c0000 end_va = 0x3b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b4c0000" filename = "" Region: id = 8744 start_va = 0x3b5c0000 end_va = 0x3b5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b5c0000" filename = "" Region: id = 8745 start_va = 0x3b600000 end_va = 0x3b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b600000" filename = "" Region: id = 8746 start_va = 0x3b700000 end_va = 0x3b73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b700000" filename = "" Region: id = 8747 start_va = 0x3b740000 end_va = 0x3b83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b740000" filename = "" Region: id = 8748 start_va = 0x3b840000 end_va = 0x3b87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b840000" filename = "" Region: id = 8749 start_va = 0x3b880000 end_va = 0x3b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b880000" filename = "" Region: id = 8750 start_va = 0x3b980000 end_va = 0x3b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b980000" filename = "" Region: id = 8751 start_va = 0x3b9c0000 end_va = 0x3babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b9c0000" filename = "" Region: id = 8752 start_va = 0x3bac0000 end_va = 0x3bafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bac0000" filename = "" Region: id = 8753 start_va = 0x3bb00000 end_va = 0x3bbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bb00000" filename = "" Region: id = 8754 start_va = 0x3bc00000 end_va = 0x3bc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bc00000" filename = "" Region: id = 8755 start_va = 0x3bc40000 end_va = 0x3bd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bc40000" filename = "" Region: id = 8756 start_va = 0x3bd40000 end_va = 0x3bd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bd40000" filename = "" Region: id = 8757 start_va = 0x3bd80000 end_va = 0x3be7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bd80000" filename = "" Region: id = 8758 start_va = 0x3be80000 end_va = 0x3bebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003be80000" filename = "" Region: id = 8759 start_va = 0x3bec0000 end_va = 0x3bfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bec0000" filename = "" Region: id = 8760 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8761 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8762 start_va = 0x3bfc0000 end_va = 0x3bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bfc0000" filename = "" Region: id = 8763 start_va = 0x3c000000 end_va = 0x3c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c000000" filename = "" Region: id = 8764 start_va = 0x3c100000 end_va = 0x3c13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c100000" filename = "" Region: id = 8765 start_va = 0x3c140000 end_va = 0x3c23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c140000" filename = "" Region: id = 8766 start_va = 0x3c240000 end_va = 0x3c27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c240000" filename = "" Region: id = 8767 start_va = 0x3c280000 end_va = 0x3c37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c280000" filename = "" Region: id = 8768 start_va = 0x3c380000 end_va = 0x3c3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c380000" filename = "" Region: id = 8769 start_va = 0x3c3c0000 end_va = 0x3c4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c3c0000" filename = "" Region: id = 8770 start_va = 0x3c4c0000 end_va = 0x3c4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c4c0000" filename = "" Region: id = 8771 start_va = 0x3c500000 end_va = 0x3c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c500000" filename = "" Region: id = 8772 start_va = 0x3c600000 end_va = 0x3c63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c600000" filename = "" Region: id = 8773 start_va = 0x3c640000 end_va = 0x3c73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c640000" filename = "" Region: id = 8774 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 8775 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 8776 start_va = 0x3c880000 end_va = 0x3c8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c880000" filename = "" Region: id = 8777 start_va = 0x3c8c0000 end_va = 0x3c9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c8c0000" filename = "" Region: id = 8778 start_va = 0x3c9c0000 end_va = 0x3c9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c9c0000" filename = "" Region: id = 8779 start_va = 0x3ca00000 end_va = 0x3cafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ca00000" filename = "" Region: id = 8780 start_va = 0x3cb00000 end_va = 0x3cb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cb00000" filename = "" Region: id = 8781 start_va = 0x3cb40000 end_va = 0x3cc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cb40000" filename = "" Region: id = 8782 start_va = 0x3cc40000 end_va = 0x3cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cc40000" filename = "" Region: id = 8783 start_va = 0x3cc80000 end_va = 0x3cd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cc80000" filename = "" Region: id = 8784 start_va = 0x3cd80000 end_va = 0x3cdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cd80000" filename = "" Region: id = 8785 start_va = 0x3cdc0000 end_va = 0x3cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cdc0000" filename = "" Region: id = 8786 start_va = 0x3cec0000 end_va = 0x3cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cec0000" filename = "" Region: id = 8787 start_va = 0x3cf00000 end_va = 0x3cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cf00000" filename = "" Region: id = 8788 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8789 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8790 start_va = 0x3d000000 end_va = 0x3d03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d000000" filename = "" Region: id = 8791 start_va = 0x3d040000 end_va = 0x3d13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d040000" filename = "" Region: id = 8792 start_va = 0x3d140000 end_va = 0x3d17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d140000" filename = "" Region: id = 8793 start_va = 0x3d180000 end_va = 0x3d27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d180000" filename = "" Region: id = 8794 start_va = 0x3d280000 end_va = 0x3d2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d280000" filename = "" Region: id = 8795 start_va = 0x3d2c0000 end_va = 0x3d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d2c0000" filename = "" Region: id = 8796 start_va = 0x3d3c0000 end_va = 0x3d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d3c0000" filename = "" Region: id = 8797 start_va = 0x3d400000 end_va = 0x3d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d400000" filename = "" Region: id = 8798 start_va = 0x3d500000 end_va = 0x3d53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d500000" filename = "" Region: id = 8799 start_va = 0x3d540000 end_va = 0x3d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d540000" filename = "" Region: id = 8800 start_va = 0x3d640000 end_va = 0x3d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d640000" filename = "" Region: id = 8801 start_va = 0x3d680000 end_va = 0x3d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d680000" filename = "" Region: id = 8802 start_va = 0x3d780000 end_va = 0x3d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d780000" filename = "" Region: id = 8803 start_va = 0x3d7c0000 end_va = 0x3d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d7c0000" filename = "" Region: id = 8804 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 8805 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 8806 start_va = 0x3da00000 end_va = 0x3da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003da00000" filename = "" Region: id = 8807 start_va = 0x3da40000 end_va = 0x3db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003da40000" filename = "" Region: id = 8808 start_va = 0x3db40000 end_va = 0x3db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003db40000" filename = "" Region: id = 8809 start_va = 0x3db80000 end_va = 0x3dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003db80000" filename = "" Region: id = 8810 start_va = 0x3dc80000 end_va = 0x3dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003dc80000" filename = "" Region: id = 8811 start_va = 0x3dcc0000 end_va = 0x3ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003dcc0000" filename = "" Region: id = 8812 start_va = 0x3ddc0000 end_va = 0x3ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ddc0000" filename = "" Region: id = 8813 start_va = 0x3de00000 end_va = 0x3defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003de00000" filename = "" Region: id = 8814 start_va = 0x3df00000 end_va = 0x3df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003df00000" filename = "" Region: id = 8815 start_va = 0x3df40000 end_va = 0x3e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003df40000" filename = "" Region: id = 8816 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8817 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 8818 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8819 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8820 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 8821 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 8822 start_va = 0x3e040000 end_va = 0x3e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e040000" filename = "" Region: id = 8823 start_va = 0x3e080000 end_va = 0x3e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e080000" filename = "" Region: id = 8824 start_va = 0x3e180000 end_va = 0x3e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e180000" filename = "" Region: id = 8825 start_va = 0x3e1c0000 end_va = 0x3e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e1c0000" filename = "" Region: id = 8826 start_va = 0x3e2c0000 end_va = 0x3e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e2c0000" filename = "" Region: id = 8827 start_va = 0x3e300000 end_va = 0x3e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e300000" filename = "" Region: id = 8828 start_va = 0x3e400000 end_va = 0x3e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e400000" filename = "" Region: id = 8829 start_va = 0x3e440000 end_va = 0x3e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e440000" filename = "" Region: id = 8830 start_va = 0x3e540000 end_va = 0x3e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e540000" filename = "" Region: id = 8831 start_va = 0x3e580000 end_va = 0x3e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e580000" filename = "" Region: id = 8832 start_va = 0x3e680000 end_va = 0x3e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e680000" filename = "" Region: id = 8833 start_va = 0x3e6c0000 end_va = 0x3e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e6c0000" filename = "" Region: id = 8834 start_va = 0x3e7c0000 end_va = 0x3e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e7c0000" filename = "" Region: id = 8835 start_va = 0x3e800000 end_va = 0x3e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e800000" filename = "" Region: id = 8836 start_va = 0x3e900000 end_va = 0x3e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e900000" filename = "" Region: id = 8837 start_va = 0x3e940000 end_va = 0x3ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e940000" filename = "" Region: id = 8838 start_va = 0x3ea40000 end_va = 0x3ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ea40000" filename = "" Region: id = 8839 start_va = 0x3ea80000 end_va = 0x3eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ea80000" filename = "" Region: id = 8840 start_va = 0x3eb80000 end_va = 0x3ebbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003eb80000" filename = "" Region: id = 8841 start_va = 0x3ebc0000 end_va = 0x3ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ebc0000" filename = "" Region: id = 8842 start_va = 0x3ecc0000 end_va = 0x3ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ecc0000" filename = "" Region: id = 8843 start_va = 0x3ed00000 end_va = 0x3edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ed00000" filename = "" Region: id = 8844 start_va = 0x3ee00000 end_va = 0x3ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ee00000" filename = "" Region: id = 8845 start_va = 0x3ee40000 end_va = 0x3ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ee40000" filename = "" Region: id = 8846 start_va = 0x3ef40000 end_va = 0x3ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ef40000" filename = "" Region: id = 8847 start_va = 0x3ef80000 end_va = 0x3f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ef80000" filename = "" Region: id = 8848 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8849 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8850 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8851 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8852 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8853 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8854 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8855 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8856 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8857 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8858 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8859 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8860 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8861 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8862 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8863 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8864 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8865 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8866 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8867 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8868 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8869 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8870 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8871 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8872 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8873 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8874 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8875 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8876 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8877 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8878 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8879 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8880 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8881 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8882 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8883 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8884 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8885 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8886 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8887 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8888 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8889 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8890 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8891 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8892 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8893 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8894 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8895 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8896 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8897 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8898 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8899 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8900 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8901 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8902 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8903 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8904 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8905 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8906 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8907 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8908 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8909 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8910 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8911 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8912 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8913 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8914 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8915 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8916 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8917 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8918 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8919 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8920 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8921 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8922 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8923 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8924 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8925 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8926 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8927 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8928 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8929 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8930 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8931 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8932 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8933 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8934 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8935 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8936 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8937 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8938 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8939 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8940 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8941 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8942 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8943 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8944 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8945 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8946 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8947 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8948 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8949 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8950 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8951 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8952 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8953 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8954 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8955 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8956 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8957 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8958 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8959 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8960 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8961 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8962 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8963 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8964 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8965 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8966 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8967 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8968 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8969 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8970 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8971 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8972 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8973 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8974 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8975 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8976 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8977 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8978 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8979 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8980 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8981 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8982 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8983 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8984 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8985 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8986 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8987 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8988 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8989 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8990 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8991 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8992 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8993 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8994 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8995 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8996 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8997 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8998 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 8999 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9000 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9001 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9002 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9003 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9004 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9005 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9006 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9007 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9008 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9009 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9010 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9011 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9012 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9013 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9014 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9015 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9016 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9017 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9022 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9023 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9024 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9025 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9026 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9027 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9028 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9029 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9030 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9031 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9032 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9033 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9034 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9035 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9036 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9037 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9038 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9039 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9040 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9041 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9042 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9043 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9044 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9045 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9046 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9047 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9048 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9049 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9050 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9051 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9052 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9053 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9054 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9055 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9056 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9057 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9058 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9059 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9060 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9061 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9062 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9063 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9064 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9065 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9066 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9067 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9068 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9069 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9070 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9071 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9072 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9073 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9074 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9075 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9076 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9077 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9078 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9079 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9080 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9081 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9082 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9083 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9084 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9085 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9086 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 9087 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 9088 start_va = 0x14710000 end_va = 0x1474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 9089 start_va = 0x14750000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014750000" filename = "" Region: id = 9090 start_va = 0x14c50000 end_va = 0x14c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c50000" filename = "" Region: id = 9091 start_va = 0x14c90000 end_va = 0x14d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c90000" filename = "" Region: id = 9092 start_va = 0x14d90000 end_va = 0x14dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d90000" filename = "" Region: id = 9093 start_va = 0x14dd0000 end_va = 0x14e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014dd0000" filename = "" Region: id = 9094 start_va = 0x14e10000 end_va = 0x14e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014e10000" filename = "" Region: id = 9095 start_va = 0x14f90000 end_va = 0x1508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f90000" filename = "" Region: id = 9096 start_va = 0x15090000 end_va = 0x150cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015090000" filename = "" Region: id = 9097 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 9098 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 9099 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 9100 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 9101 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 9102 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 9103 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 9104 start_va = 0x2d680000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 9105 start_va = 0x2d6c0000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 9106 start_va = 0x2d7c0000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 9107 start_va = 0x2d800000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 9108 start_va = 0x2d900000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 9109 start_va = 0x2d940000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 9110 start_va = 0x2da40000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 9111 start_va = 0x2da80000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 9112 start_va = 0x2dcc0000 end_va = 0x2dcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 9113 start_va = 0x2dd00000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dd00000" filename = "" Region: id = 9114 start_va = 0x2de00000 end_va = 0x2de3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 9115 start_va = 0x2de40000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de40000" filename = "" Region: id = 9116 start_va = 0x2df40000 end_va = 0x2df7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 9117 start_va = 0x2df80000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df80000" filename = "" Region: id = 9118 start_va = 0x2e080000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 9119 start_va = 0x2e0c0000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 9120 start_va = 0x2e1c0000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 9121 start_va = 0x2e200000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 9122 start_va = 0x2e300000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 9123 start_va = 0x2e340000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 9124 start_va = 0x2e440000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 9125 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 9126 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 9127 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 9128 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9129 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9130 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9131 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9132 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9133 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9134 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9135 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9136 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9137 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9138 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9139 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9140 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9141 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9142 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9143 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9144 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9145 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9146 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 9147 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 9148 start_va = 0xb4a0000 end_va = 0xb4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4a0000" filename = "" Region: id = 9149 start_va = 0xb4b0000 end_va = 0xb4b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4b0000" filename = "" Region: id = 9150 start_va = 0xb4c0000 end_va = 0xb4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4c0000" filename = "" Region: id = 9151 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 9152 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 9153 start_va = 0xf970000 end_va = 0xf970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f970000" filename = "" Region: id = 9154 start_va = 0xf980000 end_va = 0xf980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f980000" filename = "" Region: id = 9155 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 9156 start_va = 0x14350000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 9157 start_va = 0x14710000 end_va = 0x1474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 9158 start_va = 0x14750000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014750000" filename = "" Region: id = 9159 start_va = 0x14c50000 end_va = 0x14c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c50000" filename = "" Region: id = 9160 start_va = 0x14c90000 end_va = 0x14d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c90000" filename = "" Region: id = 9161 start_va = 0x14d90000 end_va = 0x14d90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d90000" filename = "" Region: id = 9162 start_va = 0x14da0000 end_va = 0x14da0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014da0000" filename = "" Region: id = 9163 start_va = 0x14db0000 end_va = 0x14deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014db0000" filename = "" Region: id = 9164 start_va = 0x14df0000 end_va = 0x14e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014df0000" filename = "" Region: id = 9165 start_va = 0x14f90000 end_va = 0x1508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f90000" filename = "" Region: id = 9166 start_va = 0x15090000 end_va = 0x1518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015090000" filename = "" Region: id = 9167 start_va = 0x15190000 end_va = 0x151cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 9168 start_va = 0x151d0000 end_va = 0x152cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000151d0000" filename = "" Region: id = 9169 start_va = 0x152d0000 end_va = 0x1530ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000152d0000" filename = "" Region: id = 9170 start_va = 0x15310000 end_va = 0x1534ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015310000" filename = "" Region: id = 9171 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 9172 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 9173 start_va = 0x2d380000 end_va = 0x2d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 9174 start_va = 0x2d3c0000 end_va = 0x2d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d3c0000" filename = "" Region: id = 9175 start_va = 0x2d400000 end_va = 0x2d43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d400000" filename = "" Region: id = 9176 start_va = 0x2d440000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d440000" filename = "" Region: id = 9177 start_va = 0x2e6c0000 end_va = 0x2e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 9178 start_va = 0x2e7c0000 end_va = 0x2e8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e7c0000" filename = "" Region: id = 9179 start_va = 0x2e8c0000 end_va = 0x2e9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e8c0000" filename = "" Region: id = 9180 start_va = 0x2e9c0000 end_va = 0x2eabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e9c0000" filename = "" Region: id = 9181 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9182 start_va = 0x2eac0000 end_va = 0x2eafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eac0000" filename = "" Region: id = 9183 start_va = 0x30ac0000 end_va = 0x30bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 9184 start_va = 0x2eb00000 end_va = 0x2eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb00000" filename = "" Region: id = 9185 start_va = 0x2eb40000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb40000" filename = "" Region: id = 9186 start_va = 0x30bc0000 end_va = 0x30cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030bc0000" filename = "" Region: id = 9187 start_va = 0x30cc0000 end_va = 0x30dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030cc0000" filename = "" Region: id = 9188 start_va = 0x30dc0000 end_va = 0x30dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030dc0000" filename = "" Region: id = 9189 start_va = 0x30e00000 end_va = 0x30efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030e00000" filename = "" Region: id = 9190 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9191 start_va = 0x30f00000 end_va = 0x30f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030f00000" filename = "" Region: id = 9192 start_va = 0x30f40000 end_va = 0x3103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030f40000" filename = "" Region: id = 9193 start_va = 0x31040000 end_va = 0x3107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031040000" filename = "" Region: id = 9194 start_va = 0x31080000 end_va = 0x310bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031080000" filename = "" Region: id = 9195 start_va = 0x310c0000 end_va = 0x310fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000310c0000" filename = "" Region: id = 9196 start_va = 0x31100000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031100000" filename = "" Region: id = 9197 start_va = 0x36480000 end_va = 0x3657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036480000" filename = "" Region: id = 9198 start_va = 0x36580000 end_va = 0x3667ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036580000" filename = "" Region: id = 9199 start_va = 0x36680000 end_va = 0x366bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036680000" filename = "" Region: id = 9200 start_va = 0x38280000 end_va = 0x3837ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038280000" filename = "" Region: id = 9201 start_va = 0x38380000 end_va = 0x3847ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038380000" filename = "" Region: id = 9202 start_va = 0x38480000 end_va = 0x3857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038480000" filename = "" Region: id = 9203 start_va = 0x366c0000 end_va = 0x366fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000366c0000" filename = "" Region: id = 9204 start_va = 0x38580000 end_va = 0x3867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038580000" filename = "" Region: id = 9205 start_va = 0x38680000 end_va = 0x386bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038680000" filename = "" Region: id = 9206 start_va = 0x386c0000 end_va = 0x387bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000386c0000" filename = "" Region: id = 9207 start_va = 0x387c0000 end_va = 0x387fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000387c0000" filename = "" Region: id = 9208 start_va = 0x38800000 end_va = 0x388fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038800000" filename = "" Region: id = 9209 start_va = 0x38900000 end_va = 0x3893ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038900000" filename = "" Region: id = 9210 start_va = 0x38940000 end_va = 0x38a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038940000" filename = "" Region: id = 9211 start_va = 0x38a40000 end_va = 0x38a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a40000" filename = "" Region: id = 9212 start_va = 0x38a80000 end_va = 0x38b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a80000" filename = "" Region: id = 9213 start_va = 0x38b80000 end_va = 0x38bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038b80000" filename = "" Region: id = 9214 start_va = 0x38bc0000 end_va = 0x38cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038bc0000" filename = "" Region: id = 9215 start_va = 0x38cc0000 end_va = 0x38cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038cc0000" filename = "" Region: id = 9216 start_va = 0x38d00000 end_va = 0x38dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038d00000" filename = "" Region: id = 9217 start_va = 0x38e00000 end_va = 0x38e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038e00000" filename = "" Region: id = 9218 start_va = 0x38e40000 end_va = 0x38f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038e40000" filename = "" Region: id = 9219 start_va = 0x38f40000 end_va = 0x38f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f40000" filename = "" Region: id = 9220 start_va = 0x38f80000 end_va = 0x3907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f80000" filename = "" Region: id = 9221 start_va = 0x39080000 end_va = 0x390bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039080000" filename = "" Region: id = 9222 start_va = 0x390c0000 end_va = 0x391bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000390c0000" filename = "" Region: id = 9223 start_va = 0x391c0000 end_va = 0x391fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000391c0000" filename = "" Region: id = 9224 start_va = 0x39200000 end_va = 0x392fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039200000" filename = "" Region: id = 9225 start_va = 0x39300000 end_va = 0x3933ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039300000" filename = "" Region: id = 9226 start_va = 0x39340000 end_va = 0x3943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039340000" filename = "" Region: id = 9227 start_va = 0x39440000 end_va = 0x3947ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039440000" filename = "" Region: id = 9228 start_va = 0x39480000 end_va = 0x3957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039480000" filename = "" Region: id = 9229 start_va = 0x39580000 end_va = 0x395bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039580000" filename = "" Region: id = 9230 start_va = 0x395c0000 end_va = 0x396bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000395c0000" filename = "" Region: id = 9231 start_va = 0x396c0000 end_va = 0x396fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000396c0000" filename = "" Region: id = 9232 start_va = 0x39700000 end_va = 0x397fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039700000" filename = "" Region: id = 9233 start_va = 0x39800000 end_va = 0x3983ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039800000" filename = "" Region: id = 9234 start_va = 0x39840000 end_va = 0x3993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039840000" filename = "" Region: id = 9235 start_va = 0x39940000 end_va = 0x3997ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039940000" filename = "" Region: id = 9236 start_va = 0x39980000 end_va = 0x39a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039980000" filename = "" Region: id = 9237 start_va = 0x39a80000 end_va = 0x39abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039a80000" filename = "" Region: id = 9238 start_va = 0x39ac0000 end_va = 0x39bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039ac0000" filename = "" Region: id = 9239 start_va = 0x39bc0000 end_va = 0x39bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039bc0000" filename = "" Region: id = 9240 start_va = 0x39c00000 end_va = 0x39cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039c00000" filename = "" Region: id = 9241 start_va = 0x39d00000 end_va = 0x39d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039d00000" filename = "" Region: id = 9242 start_va = 0x39d40000 end_va = 0x39e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039d40000" filename = "" Region: id = 9243 start_va = 0x39e40000 end_va = 0x39e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039e40000" filename = "" Region: id = 9244 start_va = 0x39e80000 end_va = 0x39f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039e80000" filename = "" Region: id = 9245 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9246 start_va = 0x39f80000 end_va = 0x39fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039f80000" filename = "" Region: id = 9247 start_va = 0x39fc0000 end_va = 0x3a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039fc0000" filename = "" Region: id = 9248 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9249 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9250 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9251 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9252 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9253 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9254 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9255 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9256 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9257 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9258 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9259 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9260 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9261 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 9262 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 9263 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9264 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 9265 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9266 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9267 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9268 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9269 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9270 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9271 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9272 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9273 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9274 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9275 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9276 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9277 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9278 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9279 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9280 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9281 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9282 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9283 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9284 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9285 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9286 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9287 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9288 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9289 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9290 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9291 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9292 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9293 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9294 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9295 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9296 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9297 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9298 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9299 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9300 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9301 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9302 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9303 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9304 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9305 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9306 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9307 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9308 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9309 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9310 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9311 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9312 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9313 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9314 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9315 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9316 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9317 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9318 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9319 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9320 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9321 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9322 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9323 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9324 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9325 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9326 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9327 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9328 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9329 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9330 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9331 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9332 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9333 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9334 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9335 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9336 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9337 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9338 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9339 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9340 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9341 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9342 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9343 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9344 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9345 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9346 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9347 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9348 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9349 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9350 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9351 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9352 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9353 start_va = 0x14350000 end_va = 0x1438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 9354 start_va = 0x14390000 end_va = 0x143cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014390000" filename = "" Region: id = 9355 start_va = 0x143d0000 end_va = 0x1440ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000143d0000" filename = "" Region: id = 9356 start_va = 0x14410000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014410000" filename = "" Region: id = 9357 start_va = 0x14710000 end_va = 0x1480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 9358 start_va = 0x14810000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014810000" filename = "" Region: id = 9359 start_va = 0x14c50000 end_va = 0x14d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c50000" filename = "" Region: id = 9360 start_va = 0x14d50000 end_va = 0x14e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d50000" filename = "" Region: id = 9361 start_va = 0x14f90000 end_va = 0x1508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f90000" filename = "" Region: id = 9362 start_va = 0x15090000 end_va = 0x1518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015090000" filename = "" Region: id = 9363 start_va = 0x15190000 end_va = 0x151cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 9364 start_va = 0x151d0000 end_va = 0x152cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000151d0000" filename = "" Region: id = 9365 start_va = 0x152d0000 end_va = 0x1530ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000152d0000" filename = "" Region: id = 9366 start_va = 0x15310000 end_va = 0x1540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015310000" filename = "" Region: id = 9367 start_va = 0x15410000 end_va = 0x1544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015410000" filename = "" Region: id = 9368 start_va = 0x15450000 end_va = 0x1548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015450000" filename = "" Region: id = 9369 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 9370 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 9371 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 9372 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 9373 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 9374 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 9375 start_va = 0x2d580000 end_va = 0x2d5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 9376 start_va = 0x2d5c0000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d5c0000" filename = "" Region: id = 9377 start_va = 0x2d6c0000 end_va = 0x2d6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 9378 start_va = 0x2d700000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d700000" filename = "" Region: id = 9379 start_va = 0x2d800000 end_va = 0x2d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 9380 start_va = 0x2d840000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d840000" filename = "" Region: id = 9381 start_va = 0x2d940000 end_va = 0x2d97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 9382 start_va = 0x2d980000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d980000" filename = "" Region: id = 9383 start_va = 0x2da80000 end_va = 0x2dabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 9384 start_va = 0x2dac0000 end_va = 0x2dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dac0000" filename = "" Region: id = 9385 start_va = 0x2db00000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db00000" filename = "" Region: id = 9386 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 9387 start_va = 0x2dcc0000 end_va = 0x2ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 9388 start_va = 0x2ddc0000 end_va = 0x2debffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 9389 start_va = 0x2dec0000 end_va = 0x2dfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dec0000" filename = "" Region: id = 9390 start_va = 0x2dfc0000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dfc0000" filename = "" Region: id = 9391 start_va = 0x2e0c0000 end_va = 0x2e0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 9392 start_va = 0x2e100000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e100000" filename = "" Region: id = 9393 start_va = 0x2e200000 end_va = 0x2e23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 9394 start_va = 0x2e240000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e240000" filename = "" Region: id = 9395 start_va = 0x2e340000 end_va = 0x2e37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 9396 start_va = 0x2e380000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e380000" filename = "" Region: id = 9397 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 9398 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9399 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9400 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9401 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9402 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9403 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9404 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9405 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9406 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9407 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9408 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9409 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9410 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9411 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9412 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9413 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9414 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9415 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9416 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9417 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9418 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9419 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9420 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9421 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9422 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9423 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9424 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9425 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9426 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9427 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9428 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9429 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9430 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9431 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9432 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9433 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9434 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9435 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9436 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9437 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9438 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9439 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9440 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9441 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9442 start_va = 0x14350000 end_va = 0x1438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014350000" filename = "" Region: id = 9443 start_va = 0x14390000 end_va = 0x143cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014390000" filename = "" Region: id = 9444 start_va = 0x143d0000 end_va = 0x1440ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000143d0000" filename = "" Region: id = 9445 start_va = 0x14410000 end_va = 0x1444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014410000" filename = "" Region: id = 9446 start_va = 0x14710000 end_va = 0x1480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014710000" filename = "" Region: id = 9447 start_va = 0x14810000 end_va = 0x1484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014810000" filename = "" Region: id = 9448 start_va = 0x14c50000 end_va = 0x14d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014c50000" filename = "" Region: id = 9449 start_va = 0x14d50000 end_va = 0x14e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014d50000" filename = "" Region: id = 9450 start_va = 0x14f90000 end_va = 0x1508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014f90000" filename = "" Region: id = 9451 start_va = 0x15090000 end_va = 0x1518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015090000" filename = "" Region: id = 9452 start_va = 0x152d0000 end_va = 0x1530ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000152d0000" filename = "" Region: id = 9453 start_va = 0x15310000 end_va = 0x1540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015310000" filename = "" Region: id = 9454 start_va = 0x15490000 end_va = 0x154cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015490000" filename = "" Region: id = 9455 start_va = 0x154d0000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000154d0000" filename = "" Region: id = 9456 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 9457 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 9458 start_va = 0x2d580000 end_va = 0x2d5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 9459 start_va = 0x2d5c0000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d5c0000" filename = "" Region: id = 9460 start_va = 0x2d6c0000 end_va = 0x2d6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 9461 start_va = 0x2d700000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d700000" filename = "" Region: id = 9462 start_va = 0x2d800000 end_va = 0x2d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 9463 start_va = 0x2d840000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d840000" filename = "" Region: id = 9464 start_va = 0x2d940000 end_va = 0x2d97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 9465 start_va = 0x2d980000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d980000" filename = "" Region: id = 9466 start_va = 0x2da80000 end_va = 0x2dabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 9467 start_va = 0x2dac0000 end_va = 0x2dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dac0000" filename = "" Region: id = 9468 start_va = 0x2db00000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db00000" filename = "" Region: id = 9469 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 9470 start_va = 0x2dcc0000 end_va = 0x2ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 9471 start_va = 0x2ddc0000 end_va = 0x2debffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 9472 start_va = 0x2dec0000 end_va = 0x2dfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dec0000" filename = "" Region: id = 9473 start_va = 0x2dfc0000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dfc0000" filename = "" Region: id = 9474 start_va = 0x2e0c0000 end_va = 0x2e0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 9475 start_va = 0x2e100000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e100000" filename = "" Region: id = 9476 start_va = 0x2e200000 end_va = 0x2e23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 9477 start_va = 0x2e240000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e240000" filename = "" Region: id = 9478 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 9479 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 9480 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 9481 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 9482 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 9483 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 9484 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9485 start_va = 0x155d0000 end_va = 0x1560ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000155d0000" filename = "" Region: id = 9486 start_va = 0x15610000 end_va = 0x1570ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015610000" filename = "" Region: id = 9487 start_va = 0x2e940000 end_va = 0x2e97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e940000" filename = "" Region: id = 9488 start_va = 0x2e980000 end_va = 0x2ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e980000" filename = "" Region: id = 9489 start_va = 0x2ea80000 end_va = 0x2eabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ea80000" filename = "" Region: id = 9490 start_va = 0x2eac0000 end_va = 0x2eafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eac0000" filename = "" Region: id = 9491 start_va = 0x2eb00000 end_va = 0x2eb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb00000" filename = "" Region: id = 9492 start_va = 0x2eb40000 end_va = 0x2eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002eb40000" filename = "" Region: id = 9493 start_va = 0x30ac0000 end_va = 0x30bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ac0000" filename = "" Region: id = 9494 start_va = 0x30bc0000 end_va = 0x30cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030bc0000" filename = "" Region: id = 9495 start_va = 0x30cc0000 end_va = 0x30dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030cc0000" filename = "" Region: id = 9496 start_va = 0x30dc0000 end_va = 0x30ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030dc0000" filename = "" Region: id = 9497 start_va = 0x30ec0000 end_va = 0x30efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030ec0000" filename = "" Region: id = 9498 start_va = 0x30f00000 end_va = 0x30ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000030f00000" filename = "" Region: id = 9499 start_va = 0x31000000 end_va = 0x3103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031000000" filename = "" Region: id = 9500 start_va = 0x31040000 end_va = 0x3113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000031040000" filename = "" Region: id = 9501 start_va = 0x36480000 end_va = 0x364bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036480000" filename = "" Region: id = 9502 start_va = 0x364c0000 end_va = 0x365bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000364c0000" filename = "" Region: id = 9503 start_va = 0x365c0000 end_va = 0x365fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000365c0000" filename = "" Region: id = 9504 start_va = 0x36600000 end_va = 0x366fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000036600000" filename = "" Region: id = 9505 start_va = 0x38280000 end_va = 0x382bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038280000" filename = "" Region: id = 9506 start_va = 0x382c0000 end_va = 0x383bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000382c0000" filename = "" Region: id = 9507 start_va = 0x383c0000 end_va = 0x383fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000383c0000" filename = "" Region: id = 9508 start_va = 0x38400000 end_va = 0x384fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038400000" filename = "" Region: id = 9509 start_va = 0x38500000 end_va = 0x3853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038500000" filename = "" Region: id = 9510 start_va = 0x38540000 end_va = 0x3863ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038540000" filename = "" Region: id = 9511 start_va = 0x38640000 end_va = 0x3867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038640000" filename = "" Region: id = 9512 start_va = 0x38680000 end_va = 0x3877ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038680000" filename = "" Region: id = 9513 start_va = 0x38780000 end_va = 0x387bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038780000" filename = "" Region: id = 9514 start_va = 0x387c0000 end_va = 0x388bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000387c0000" filename = "" Region: id = 9515 start_va = 0x388c0000 end_va = 0x388fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000388c0000" filename = "" Region: id = 9516 start_va = 0x38900000 end_va = 0x389fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038900000" filename = "" Region: id = 9517 start_va = 0x38a00000 end_va = 0x38a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a00000" filename = "" Region: id = 9518 start_va = 0x38a40000 end_va = 0x38b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038a40000" filename = "" Region: id = 9519 start_va = 0x38b40000 end_va = 0x38b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038b40000" filename = "" Region: id = 9520 start_va = 0x38b80000 end_va = 0x38c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038b80000" filename = "" Region: id = 9521 start_va = 0x38c80000 end_va = 0x38cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038c80000" filename = "" Region: id = 9522 start_va = 0x38cc0000 end_va = 0x38dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038cc0000" filename = "" Region: id = 9523 start_va = 0x38dc0000 end_va = 0x38dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038dc0000" filename = "" Region: id = 9524 start_va = 0x38e00000 end_va = 0x38efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038e00000" filename = "" Region: id = 9525 start_va = 0x38f00000 end_va = 0x38f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f00000" filename = "" Region: id = 9526 start_va = 0x38f40000 end_va = 0x3903ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000038f40000" filename = "" Region: id = 9527 start_va = 0x39040000 end_va = 0x3907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039040000" filename = "" Region: id = 9528 start_va = 0x39080000 end_va = 0x3917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039080000" filename = "" Region: id = 9529 start_va = 0x39180000 end_va = 0x391bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039180000" filename = "" Region: id = 9530 start_va = 0x391c0000 end_va = 0x392bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000391c0000" filename = "" Region: id = 9531 start_va = 0x392c0000 end_va = 0x392fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000392c0000" filename = "" Region: id = 9532 start_va = 0x39300000 end_va = 0x393fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039300000" filename = "" Region: id = 9533 start_va = 0x39400000 end_va = 0x3943ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039400000" filename = "" Region: id = 9534 start_va = 0x39440000 end_va = 0x3953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039440000" filename = "" Region: id = 9535 start_va = 0x39540000 end_va = 0x3957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039540000" filename = "" Region: id = 9536 start_va = 0x39580000 end_va = 0x3967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039580000" filename = "" Region: id = 9537 start_va = 0x39680000 end_va = 0x396bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039680000" filename = "" Region: id = 9538 start_va = 0x396c0000 end_va = 0x397bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000396c0000" filename = "" Region: id = 9539 start_va = 0x397c0000 end_va = 0x397fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000397c0000" filename = "" Region: id = 9540 start_va = 0x39800000 end_va = 0x398fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039800000" filename = "" Region: id = 9541 start_va = 0x39900000 end_va = 0x3993ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039900000" filename = "" Region: id = 9542 start_va = 0x39940000 end_va = 0x39a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039940000" filename = "" Region: id = 9543 start_va = 0x39a40000 end_va = 0x39a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039a40000" filename = "" Region: id = 9544 start_va = 0x39a80000 end_va = 0x39b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039a80000" filename = "" Region: id = 9545 start_va = 0x39b80000 end_va = 0x39bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039b80000" filename = "" Region: id = 9546 start_va = 0x39bc0000 end_va = 0x39cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039bc0000" filename = "" Region: id = 9547 start_va = 0x39cc0000 end_va = 0x39cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039cc0000" filename = "" Region: id = 9548 start_va = 0x39d00000 end_va = 0x39dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039d00000" filename = "" Region: id = 9549 start_va = 0x39e00000 end_va = 0x39e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039e00000" filename = "" Region: id = 9550 start_va = 0x39e40000 end_va = 0x39f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039e40000" filename = "" Region: id = 9551 start_va = 0x39f40000 end_va = 0x39f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039f40000" filename = "" Region: id = 9552 start_va = 0x39f80000 end_va = 0x3a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000039f80000" filename = "" Region: id = 9553 start_va = 0x3a080000 end_va = 0x3a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a080000" filename = "" Region: id = 9554 start_va = 0x3a0c0000 end_va = 0x3a1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a0c0000" filename = "" Region: id = 9555 start_va = 0x3a1c0000 end_va = 0x3a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a1c0000" filename = "" Region: id = 9556 start_va = 0x3a200000 end_va = 0x3a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a200000" filename = "" Region: id = 9557 start_va = 0x3a300000 end_va = 0x3a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a300000" filename = "" Region: id = 9558 start_va = 0x3a340000 end_va = 0x3a43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a340000" filename = "" Region: id = 9559 start_va = 0x3a440000 end_va = 0x3a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a440000" filename = "" Region: id = 9560 start_va = 0x3a480000 end_va = 0x3a57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a480000" filename = "" Region: id = 9561 start_va = 0x3a580000 end_va = 0x3a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a580000" filename = "" Region: id = 9562 start_va = 0x3a5c0000 end_va = 0x3a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a5c0000" filename = "" Region: id = 9563 start_va = 0x3a6c0000 end_va = 0x3a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a6c0000" filename = "" Region: id = 9564 start_va = 0x3a700000 end_va = 0x3a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a700000" filename = "" Region: id = 9565 start_va = 0x3a800000 end_va = 0x3a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a800000" filename = "" Region: id = 9566 start_va = 0x3a840000 end_va = 0x3a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a840000" filename = "" Region: id = 9567 start_va = 0x3a940000 end_va = 0x3a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a940000" filename = "" Region: id = 9568 start_va = 0x3a980000 end_va = 0x3aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003a980000" filename = "" Region: id = 9569 start_va = 0x3aa80000 end_va = 0x3aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003aa80000" filename = "" Region: id = 9570 start_va = 0x3aac0000 end_va = 0x3abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003aac0000" filename = "" Region: id = 9571 start_va = 0x3abc0000 end_va = 0x3abfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003abc0000" filename = "" Region: id = 9572 start_va = 0x3ac00000 end_va = 0x3acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ac00000" filename = "" Region: id = 9573 start_va = 0x3ad00000 end_va = 0x3ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ad00000" filename = "" Region: id = 9574 start_va = 0x3ad40000 end_va = 0x3ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ad40000" filename = "" Region: id = 9575 start_va = 0x3ae40000 end_va = 0x3ae7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ae40000" filename = "" Region: id = 9576 start_va = 0x3ae80000 end_va = 0x3af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ae80000" filename = "" Region: id = 9577 start_va = 0x3af80000 end_va = 0x3afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003af80000" filename = "" Region: id = 9578 start_va = 0x3afc0000 end_va = 0x3b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003afc0000" filename = "" Region: id = 9579 start_va = 0x3b0c0000 end_va = 0x3b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b0c0000" filename = "" Region: id = 9580 start_va = 0x3b100000 end_va = 0x3b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b100000" filename = "" Region: id = 9581 start_va = 0x3b200000 end_va = 0x3b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b200000" filename = "" Region: id = 9582 start_va = 0x3b240000 end_va = 0x3b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b240000" filename = "" Region: id = 9583 start_va = 0x3b340000 end_va = 0x3b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b340000" filename = "" Region: id = 9584 start_va = 0x3b380000 end_va = 0x3b47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b380000" filename = "" Region: id = 9585 start_va = 0x3b480000 end_va = 0x3b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b480000" filename = "" Region: id = 9586 start_va = 0x3b4c0000 end_va = 0x3b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b4c0000" filename = "" Region: id = 9587 start_va = 0x3b5c0000 end_va = 0x3b5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b5c0000" filename = "" Region: id = 9588 start_va = 0x3b600000 end_va = 0x3b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b600000" filename = "" Region: id = 9589 start_va = 0x3b700000 end_va = 0x3b73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b700000" filename = "" Region: id = 9590 start_va = 0x3b740000 end_va = 0x3b83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b740000" filename = "" Region: id = 9591 start_va = 0x3b840000 end_va = 0x3b87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b840000" filename = "" Region: id = 9592 start_va = 0x3b880000 end_va = 0x3b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b880000" filename = "" Region: id = 9593 start_va = 0x3b980000 end_va = 0x3b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b980000" filename = "" Region: id = 9594 start_va = 0x3b9c0000 end_va = 0x3babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003b9c0000" filename = "" Region: id = 9595 start_va = 0x3bac0000 end_va = 0x3bafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bac0000" filename = "" Region: id = 9596 start_va = 0x3bb00000 end_va = 0x3bbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bb00000" filename = "" Region: id = 9597 start_va = 0x3bc00000 end_va = 0x3bc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bc00000" filename = "" Region: id = 9598 start_va = 0x3bc40000 end_va = 0x3bd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bc40000" filename = "" Region: id = 9599 start_va = 0x3bd40000 end_va = 0x3bd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bd40000" filename = "" Region: id = 9600 start_va = 0x3bd80000 end_va = 0x3be7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bd80000" filename = "" Region: id = 9601 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9602 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9603 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9604 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9605 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9606 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9607 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9608 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9609 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9610 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9611 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9612 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9613 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9614 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9615 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9616 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9617 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9618 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9619 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9620 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9621 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9622 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9623 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9624 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9625 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9626 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9627 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9628 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9629 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9630 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9631 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9632 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9633 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9634 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9635 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9636 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9637 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9638 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9639 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9640 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9641 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9642 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9643 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9644 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9645 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9646 start_va = 0x15190000 end_va = 0x151cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 9647 start_va = 0x151d0000 end_va = 0x152cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000151d0000" filename = "" Region: id = 9648 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9649 start_va = 0x15450000 end_va = 0x1554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015450000" filename = "" Region: id = 9650 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 9651 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 9652 start_va = 0x15710000 end_va = 0x1580ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 9653 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 9654 start_va = 0x15910000 end_va = 0x1594ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 9655 start_va = 0x15950000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015950000" filename = "" Region: id = 9656 start_va = 0x15a50000 end_va = 0x15a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 9657 start_va = 0x15a90000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a90000" filename = "" Region: id = 9658 start_va = 0x15b90000 end_va = 0x15bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 9659 start_va = 0x15bd0000 end_va = 0x15c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015bd0000" filename = "" Region: id = 9660 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 9661 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 9662 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9663 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9664 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9665 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9666 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9667 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9668 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9669 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9670 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9671 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9672 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9673 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9674 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9675 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9676 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9677 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9678 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9679 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9680 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9681 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9682 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9683 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9684 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9685 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9686 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9687 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9688 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9689 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9690 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9691 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9692 start_va = 0x15190000 end_va = 0x151cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 9693 start_va = 0x151d0000 end_va = 0x152cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000151d0000" filename = "" Region: id = 9694 start_va = 0x15410000 end_va = 0x1544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015410000" filename = "" Region: id = 9695 start_va = 0x15450000 end_va = 0x1554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015450000" filename = "" Region: id = 9696 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 9697 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 9698 start_va = 0x15710000 end_va = 0x1580ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 9699 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 9700 start_va = 0x15910000 end_va = 0x1594ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 9701 start_va = 0x15950000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015950000" filename = "" Region: id = 9702 start_va = 0x15a50000 end_va = 0x15a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 9703 start_va = 0x15a90000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a90000" filename = "" Region: id = 9704 start_va = 0x15b90000 end_va = 0x15bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 9705 start_va = 0x15bd0000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015bd0000" filename = "" Region: id = 9706 start_va = 0x15cd0000 end_va = 0x15d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 9707 start_va = 0x15d10000 end_va = 0x15d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d10000" filename = "" Region: id = 9708 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 9709 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 9710 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 9711 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 9712 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 9713 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 9714 start_va = 0x2d580000 end_va = 0x2d5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 9715 start_va = 0x2d5c0000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d5c0000" filename = "" Region: id = 9716 start_va = 0x2d6c0000 end_va = 0x2d6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 9717 start_va = 0x2d700000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d700000" filename = "" Region: id = 9718 start_va = 0x2d800000 end_va = 0x2d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 9719 start_va = 0x2d840000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d840000" filename = "" Region: id = 9720 start_va = 0x2d940000 end_va = 0x2d97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 9721 start_va = 0x2d980000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d980000" filename = "" Region: id = 9722 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9723 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9724 start_va = 0x15d50000 end_va = 0x15d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d50000" filename = "" Region: id = 9725 start_va = 0x15d90000 end_va = 0x15e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d90000" filename = "" Region: id = 9726 start_va = 0x2dac0000 end_va = 0x2dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dac0000" filename = "" Region: id = 9727 start_va = 0x2db00000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db00000" filename = "" Region: id = 9728 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 9729 start_va = 0x2ddc0000 end_va = 0x2debffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 9730 start_va = 0x2dec0000 end_va = 0x2dfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dec0000" filename = "" Region: id = 9731 start_va = 0x2dfc0000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dfc0000" filename = "" Region: id = 9732 start_va = 0x2e0c0000 end_va = 0x2e0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 9733 start_va = 0x2e100000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e100000" filename = "" Region: id = 9734 start_va = 0x2e200000 end_va = 0x2e23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 9735 start_va = 0x2e240000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e240000" filename = "" Region: id = 9736 start_va = 0x2e340000 end_va = 0x2e37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 9737 start_va = 0x2e380000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e380000" filename = "" Region: id = 9738 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 9739 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 9740 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 9741 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 9742 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 9743 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 9744 start_va = 0x3be80000 end_va = 0x3bebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003be80000" filename = "" Region: id = 9745 start_va = 0x3bec0000 end_va = 0x3bfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bec0000" filename = "" Region: id = 9746 start_va = 0x3bfc0000 end_va = 0x3bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bfc0000" filename = "" Region: id = 9747 start_va = 0x3c000000 end_va = 0x3c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c000000" filename = "" Region: id = 9748 start_va = 0x3c100000 end_va = 0x3c13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c100000" filename = "" Region: id = 9749 start_va = 0x3c140000 end_va = 0x3c23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c140000" filename = "" Region: id = 9750 start_va = 0x3c240000 end_va = 0x3c27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c240000" filename = "" Region: id = 9751 start_va = 0x3c280000 end_va = 0x3c37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c280000" filename = "" Region: id = 9752 start_va = 0x3c380000 end_va = 0x3c3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c380000" filename = "" Region: id = 9753 start_va = 0x3c3c0000 end_va = 0x3c4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c3c0000" filename = "" Region: id = 9754 start_va = 0x3c4c0000 end_va = 0x3c4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c4c0000" filename = "" Region: id = 9755 start_va = 0x3c500000 end_va = 0x3c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c500000" filename = "" Region: id = 9756 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9757 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9758 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9759 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9760 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9761 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9762 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9763 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9764 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9765 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9766 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9767 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9768 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9769 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9770 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9771 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9772 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9773 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9774 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9775 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9776 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9777 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9778 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9779 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9780 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9781 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9782 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9783 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9784 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9785 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9786 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9787 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9788 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9789 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9790 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9791 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9792 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9793 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9794 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9795 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9796 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9797 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9798 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9799 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9800 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9801 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9802 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9803 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9804 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9805 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9806 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9807 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9808 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9809 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9810 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9811 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9812 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9813 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9814 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9815 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9816 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9817 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9818 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9819 start_va = 0x15190000 end_va = 0x151cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 9820 start_va = 0x151d0000 end_va = 0x152cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000151d0000" filename = "" Region: id = 9821 start_va = 0x15410000 end_va = 0x1544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015410000" filename = "" Region: id = 9822 start_va = 0x15450000 end_va = 0x1554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015450000" filename = "" Region: id = 9823 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 9824 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 9825 start_va = 0x15710000 end_va = 0x1580ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 9826 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 9827 start_va = 0x15910000 end_va = 0x1594ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 9828 start_va = 0x15950000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015950000" filename = "" Region: id = 9829 start_va = 0x15a50000 end_va = 0x15a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 9830 start_va = 0x15a90000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a90000" filename = "" Region: id = 9831 start_va = 0x15b90000 end_va = 0x15bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 9832 start_va = 0x15bd0000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015bd0000" filename = "" Region: id = 9833 start_va = 0x15cd0000 end_va = 0x15d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 9834 start_va = 0x15d10000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d10000" filename = "" Region: id = 9835 start_va = 0x15e10000 end_va = 0x15e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e10000" filename = "" Region: id = 9836 start_va = 0x15e50000 end_va = 0x15e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e50000" filename = "" Region: id = 9837 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 9838 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 9839 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 9840 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 9841 start_va = 0x2d580000 end_va = 0x2d5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 9842 start_va = 0x2d5c0000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d5c0000" filename = "" Region: id = 9843 start_va = 0x2d800000 end_va = 0x2d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 9844 start_va = 0x2d840000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d840000" filename = "" Region: id = 9845 start_va = 0x2da80000 end_va = 0x2dabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 9846 start_va = 0x2dac0000 end_va = 0x2dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dac0000" filename = "" Region: id = 9847 start_va = 0x2db00000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db00000" filename = "" Region: id = 9848 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 9849 start_va = 0x2dcc0000 end_va = 0x2ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 9850 start_va = 0x2ddc0000 end_va = 0x2debffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 9851 start_va = 0x2dec0000 end_va = 0x2dfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dec0000" filename = "" Region: id = 9852 start_va = 0x2dfc0000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dfc0000" filename = "" Region: id = 9853 start_va = 0x2e0c0000 end_va = 0x2e0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 9854 start_va = 0x2e100000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e100000" filename = "" Region: id = 9855 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9856 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9857 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9858 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 9859 start_va = 0x15190000 end_va = 0x1528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 9860 start_va = 0x15e90000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e90000" filename = "" Region: id = 9861 start_va = 0x15f90000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f90000" filename = "" Region: id = 9862 start_va = 0x2d6c0000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 9863 start_va = 0x2d7c0000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 9864 start_va = 0x2d940000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 9865 start_va = 0x2da40000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 9866 start_va = 0x2e200000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 9867 start_va = 0x2e300000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 9868 start_va = 0x2e340000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 9869 start_va = 0x2e440000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 9870 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 9871 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 9872 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 9873 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 9874 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 9875 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 9876 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 9877 start_va = 0x3be80000 end_va = 0x3bebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003be80000" filename = "" Region: id = 9878 start_va = 0x3bec0000 end_va = 0x3bfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bec0000" filename = "" Region: id = 9879 start_va = 0x3bfc0000 end_va = 0x3bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bfc0000" filename = "" Region: id = 9880 start_va = 0x3c000000 end_va = 0x3c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c000000" filename = "" Region: id = 9881 start_va = 0x3c100000 end_va = 0x3c13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c100000" filename = "" Region: id = 9882 start_va = 0x3c140000 end_va = 0x3c23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c140000" filename = "" Region: id = 9883 start_va = 0x3c240000 end_va = 0x3c27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c240000" filename = "" Region: id = 9884 start_va = 0x3c280000 end_va = 0x3c37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c280000" filename = "" Region: id = 9885 start_va = 0x3c380000 end_va = 0x3c3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c380000" filename = "" Region: id = 9886 start_va = 0x3c3c0000 end_va = 0x3c4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c3c0000" filename = "" Region: id = 9887 start_va = 0x3c4c0000 end_va = 0x3c4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c4c0000" filename = "" Region: id = 9888 start_va = 0x3c500000 end_va = 0x3c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c500000" filename = "" Region: id = 9889 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9890 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9891 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9892 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9893 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9894 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9895 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9896 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9897 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9898 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9899 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9900 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9901 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9902 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9903 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9904 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9905 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9906 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 9907 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 9908 start_va = 0xb110000 end_va = 0xb110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 9909 start_va = 0xb4a0000 end_va = 0xb4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4a0000" filename = "" Region: id = 9910 start_va = 0xb4b0000 end_va = 0xb4b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4b0000" filename = "" Region: id = 9911 start_va = 0xb4c0000 end_va = 0xb4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b4c0000" filename = "" Region: id = 9912 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 9913 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 9914 start_va = 0xf970000 end_va = 0xf970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f970000" filename = "" Region: id = 9915 start_va = 0xf980000 end_va = 0xf980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f980000" filename = "" Region: id = 9916 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 9917 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 9918 start_va = 0xf910000 end_va = 0xf910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f910000" filename = "" Region: id = 9919 start_va = 0x15910000 end_va = 0x1594ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 9920 start_va = 0x15950000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015950000" filename = "" Region: id = 9921 start_va = 0x15a50000 end_va = 0x15a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 9922 start_va = 0x15a90000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a90000" filename = "" Region: id = 9923 start_va = 0x2d580000 end_va = 0x2d5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 9924 start_va = 0x2d5c0000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d5c0000" filename = "" Region: id = 9925 start_va = 0x2d800000 end_va = 0x2d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 9926 start_va = 0x2d840000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d840000" filename = "" Region: id = 9927 start_va = 0x2da80000 end_va = 0x2dabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 9928 start_va = 0x2dcc0000 end_va = 0x2ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 9929 start_va = 0x3c600000 end_va = 0x3c63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c600000" filename = "" Region: id = 9930 start_va = 0x3c640000 end_va = 0x3c73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c640000" filename = "" Region: id = 9931 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 9932 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 9933 start_va = 0x3c880000 end_va = 0x3c8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c880000" filename = "" Region: id = 9934 start_va = 0x3c8c0000 end_va = 0x3c9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c8c0000" filename = "" Region: id = 9935 start_va = 0x3c9c0000 end_va = 0x3c9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c9c0000" filename = "" Region: id = 9936 start_va = 0x3ca00000 end_va = 0x3cafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ca00000" filename = "" Region: id = 9937 start_va = 0x3cb00000 end_va = 0x3cb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cb00000" filename = "" Region: id = 9938 start_va = 0x3cb40000 end_va = 0x3cc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cb40000" filename = "" Region: id = 9939 start_va = 0x3cc40000 end_va = 0x3cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cc40000" filename = "" Region: id = 9940 start_va = 0x3cc80000 end_va = 0x3cd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cc80000" filename = "" Region: id = 9941 start_va = 0x3cd80000 end_va = 0x3cdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cd80000" filename = "" Region: id = 9942 start_va = 0x3cdc0000 end_va = 0x3cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cdc0000" filename = "" Region: id = 9943 start_va = 0x3cec0000 end_va = 0x3cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cec0000" filename = "" Region: id = 9944 start_va = 0x3cf00000 end_va = 0x3cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cf00000" filename = "" Region: id = 9945 start_va = 0x3d000000 end_va = 0x3d03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d000000" filename = "" Region: id = 9946 start_va = 0x3d040000 end_va = 0x3d13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d040000" filename = "" Region: id = 9947 start_va = 0x3d140000 end_va = 0x3d17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d140000" filename = "" Region: id = 9948 start_va = 0x3d180000 end_va = 0x3d27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d180000" filename = "" Region: id = 9949 start_va = 0x3d280000 end_va = 0x3d2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d280000" filename = "" Region: id = 9950 start_va = 0x3d2c0000 end_va = 0x3d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d2c0000" filename = "" Region: id = 9951 start_va = 0x3d3c0000 end_va = 0x3d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d3c0000" filename = "" Region: id = 9952 start_va = 0x3d400000 end_va = 0x3d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d400000" filename = "" Region: id = 9953 start_va = 0x3d500000 end_va = 0x3d53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d500000" filename = "" Region: id = 9954 start_va = 0x3d540000 end_va = 0x3d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d540000" filename = "" Region: id = 9955 start_va = 0x3d640000 end_va = 0x3d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d640000" filename = "" Region: id = 9956 start_va = 0x3d680000 end_va = 0x3d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d680000" filename = "" Region: id = 9957 start_va = 0x3d780000 end_va = 0x3d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d780000" filename = "" Region: id = 9958 start_va = 0x3d7c0000 end_va = 0x3d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d7c0000" filename = "" Region: id = 9959 start_va = 0xf960000 end_va = 0xf960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 9960 start_va = 0xf970000 end_va = 0xf970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f970000" filename = "" Region: id = 9961 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9962 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9963 start_va = 0x15410000 end_va = 0x1544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015410000" filename = "" Region: id = 9964 start_va = 0x15450000 end_va = 0x1554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015450000" filename = "" Region: id = 9965 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 9966 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 9967 start_va = 0x15710000 end_va = 0x1580ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 9968 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 9969 start_va = 0x15cd0000 end_va = 0x15d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 9970 start_va = 0x15d10000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015d10000" filename = "" Region: id = 9971 start_va = 0x15e50000 end_va = 0x15e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e50000" filename = "" Region: id = 9972 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 9973 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 9974 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 9975 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 9976 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 9977 start_va = 0x2dac0000 end_va = 0x2dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dac0000" filename = "" Region: id = 9978 start_va = 0x2db00000 end_va = 0x2db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db00000" filename = "" Region: id = 9979 start_va = 0x2db40000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002db40000" filename = "" Region: id = 9980 start_va = 0x2ddc0000 end_va = 0x2debffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002ddc0000" filename = "" Region: id = 9981 start_va = 0x2dec0000 end_va = 0x2dfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dec0000" filename = "" Region: id = 9982 start_va = 0x2dfc0000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dfc0000" filename = "" Region: id = 9983 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 9984 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 9985 start_va = 0x3da00000 end_va = 0x3da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003da00000" filename = "" Region: id = 9986 start_va = 0x3da40000 end_va = 0x3db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003da40000" filename = "" Region: id = 9987 start_va = 0x3db40000 end_va = 0x3db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003db40000" filename = "" Region: id = 9988 start_va = 0x3db80000 end_va = 0x3dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003db80000" filename = "" Region: id = 9989 start_va = 0x3dc80000 end_va = 0x3dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003dc80000" filename = "" Region: id = 9990 start_va = 0x3dcc0000 end_va = 0x3ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003dcc0000" filename = "" Region: id = 9991 start_va = 0x3ddc0000 end_va = 0x3ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ddc0000" filename = "" Region: id = 9992 start_va = 0x3de00000 end_va = 0x3defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003de00000" filename = "" Region: id = 9993 start_va = 0x3df00000 end_va = 0x3df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003df00000" filename = "" Region: id = 9994 start_va = 0x3df40000 end_va = 0x3e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003df40000" filename = "" Region: id = 9995 start_va = 0x3e040000 end_va = 0x3e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e040000" filename = "" Region: id = 9996 start_va = 0x3e080000 end_va = 0x3e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e080000" filename = "" Region: id = 9997 start_va = 0x3e180000 end_va = 0x3e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e180000" filename = "" Region: id = 9998 start_va = 0x3e1c0000 end_va = 0x3e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e1c0000" filename = "" Region: id = 9999 start_va = 0x3e2c0000 end_va = 0x3e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e2c0000" filename = "" Region: id = 10000 start_va = 0x3e300000 end_va = 0x3e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e300000" filename = "" Region: id = 10001 start_va = 0x3e400000 end_va = 0x3e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e400000" filename = "" Region: id = 10002 start_va = 0x3e440000 end_va = 0x3e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e440000" filename = "" Region: id = 10003 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10004 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10005 start_va = 0x3e540000 end_va = 0x3e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e540000" filename = "" Region: id = 10006 start_va = 0x3e580000 end_va = 0x3e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e580000" filename = "" Region: id = 10007 start_va = 0x3e680000 end_va = 0x3e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e680000" filename = "" Region: id = 10008 start_va = 0x3e6c0000 end_va = 0x3e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e6c0000" filename = "" Region: id = 10009 start_va = 0x3e7c0000 end_va = 0x3e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e7c0000" filename = "" Region: id = 10010 start_va = 0x3e800000 end_va = 0x3e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e800000" filename = "" Region: id = 10011 start_va = 0x3e900000 end_va = 0x3e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e900000" filename = "" Region: id = 10012 start_va = 0x3e940000 end_va = 0x3ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e940000" filename = "" Region: id = 10013 start_va = 0x3ea40000 end_va = 0x3ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ea40000" filename = "" Region: id = 10014 start_va = 0x3ea80000 end_va = 0x3eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ea80000" filename = "" Region: id = 10015 start_va = 0x3eb80000 end_va = 0x3ebbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003eb80000" filename = "" Region: id = 10016 start_va = 0x3ebc0000 end_va = 0x3ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ebc0000" filename = "" Region: id = 10017 start_va = 0x3ecc0000 end_va = 0x3ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ecc0000" filename = "" Region: id = 10018 start_va = 0x3ed00000 end_va = 0x3edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ed00000" filename = "" Region: id = 10019 start_va = 0x3ee00000 end_va = 0x3ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ee00000" filename = "" Region: id = 10020 start_va = 0x3ee40000 end_va = 0x3ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ee40000" filename = "" Region: id = 10021 start_va = 0x3ef40000 end_va = 0x3ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ef40000" filename = "" Region: id = 10022 start_va = 0x3ef80000 end_va = 0x3f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ef80000" filename = "" Region: id = 10023 start_va = 0x3f080000 end_va = 0x3f0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f080000" filename = "" Region: id = 10024 start_va = 0x3f0c0000 end_va = 0x3f1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f0c0000" filename = "" Region: id = 10025 start_va = 0x3f1c0000 end_va = 0x3f1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f1c0000" filename = "" Region: id = 10026 start_va = 0x3f200000 end_va = 0x3f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f200000" filename = "" Region: id = 10027 start_va = 0x3f300000 end_va = 0x3f33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f300000" filename = "" Region: id = 10028 start_va = 0x3f340000 end_va = 0x3f43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f340000" filename = "" Region: id = 10029 start_va = 0x3f440000 end_va = 0x3f47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f440000" filename = "" Region: id = 10030 start_va = 0x3f480000 end_va = 0x3f57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f480000" filename = "" Region: id = 10031 start_va = 0x3f580000 end_va = 0x3f5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f580000" filename = "" Region: id = 10032 start_va = 0x3f5c0000 end_va = 0x3f6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f5c0000" filename = "" Region: id = 10033 start_va = 0x3f6c0000 end_va = 0x3f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f6c0000" filename = "" Region: id = 10034 start_va = 0x3f700000 end_va = 0x3f7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f700000" filename = "" Region: id = 10035 start_va = 0x3f800000 end_va = 0x3f83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f800000" filename = "" Region: id = 10036 start_va = 0x3f840000 end_va = 0x3f93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f840000" filename = "" Region: id = 10037 start_va = 0x3f940000 end_va = 0x3f97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f940000" filename = "" Region: id = 10038 start_va = 0x3f980000 end_va = 0x3fa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f980000" filename = "" Region: id = 10039 start_va = 0x3fa80000 end_va = 0x3fabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fa80000" filename = "" Region: id = 10040 start_va = 0x3fac0000 end_va = 0x3fbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fac0000" filename = "" Region: id = 10041 start_va = 0x3fbc0000 end_va = 0x3fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fbc0000" filename = "" Region: id = 10042 start_va = 0x3fc00000 end_va = 0x3fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fc00000" filename = "" Region: id = 10043 start_va = 0x3fd00000 end_va = 0x3fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd00000" filename = "" Region: id = 10044 start_va = 0x3fd40000 end_va = 0x3fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd40000" filename = "" Region: id = 10045 start_va = 0x3fe40000 end_va = 0x3fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe40000" filename = "" Region: id = 10046 start_va = 0x3fe80000 end_va = 0x3ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe80000" filename = "" Region: id = 10047 start_va = 0x3ff80000 end_va = 0x3ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ff80000" filename = "" Region: id = 10048 start_va = 0x40000000 end_va = 0x401fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040000000" filename = "" Region: id = 10049 start_va = 0x40200000 end_va = 0x402fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040200000" filename = "" Region: id = 10050 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10051 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10052 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10053 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10054 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10055 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10056 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10057 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10058 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10059 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10060 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10061 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10062 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10063 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10064 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10065 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10066 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10067 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10068 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10069 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10070 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10071 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10072 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10073 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10074 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10075 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10076 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10077 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10078 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10079 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10080 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10081 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10082 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10083 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10084 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10085 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10086 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10087 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10088 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10089 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10090 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10091 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10092 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10093 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10094 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10095 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10096 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10097 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10098 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10099 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10100 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10101 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10102 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10103 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10104 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10105 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10106 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10107 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10108 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10109 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10110 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10111 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10112 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10113 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10114 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10115 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10116 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10117 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10118 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10119 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10120 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10121 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10122 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10123 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10124 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10125 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10126 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10127 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10128 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10129 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10130 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10131 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10132 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10133 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10134 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10135 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10136 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10137 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10138 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10139 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10140 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10141 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10142 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10143 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10144 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10145 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10146 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10147 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10148 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10149 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10150 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10151 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10152 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10153 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10154 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10155 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10156 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10157 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10158 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10159 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10160 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10161 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10162 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10163 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10164 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10165 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10166 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10167 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10168 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10169 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10170 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10171 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10172 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10173 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10174 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10175 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10176 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10177 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10178 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10179 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10180 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10181 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10182 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10183 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10184 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10185 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10186 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10187 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10188 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10189 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10190 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10191 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10192 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10193 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10194 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10195 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10196 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10197 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10198 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10199 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10200 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10201 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10202 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10203 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10204 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10205 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10206 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10207 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10208 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10209 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10210 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 10211 start_va = 0x15190000 end_va = 0x1528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 10212 start_va = 0x15290000 end_va = 0x152cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015290000" filename = "" Region: id = 10213 start_va = 0x15410000 end_va = 0x1550ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015410000" filename = "" Region: id = 10214 start_va = 0x15510000 end_va = 0x1554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015510000" filename = "" Region: id = 10215 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 10216 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 10217 start_va = 0x15710000 end_va = 0x1580ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 10218 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 10219 start_va = 0x15910000 end_va = 0x15a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 10220 start_va = 0x15a10000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a10000" filename = "" Region: id = 10221 start_va = 0x15a50000 end_va = 0x15b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 10222 start_va = 0x15b50000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b50000" filename = "" Region: id = 10223 start_va = 0x15b90000 end_va = 0x15c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 10224 start_va = 0x15c90000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c90000" filename = "" Region: id = 10225 start_va = 0x15cd0000 end_va = 0x15dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 10226 start_va = 0x15dd0000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015dd0000" filename = "" Region: id = 10227 start_va = 0x15e10000 end_va = 0x15f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e10000" filename = "" Region: id = 10228 start_va = 0x15f10000 end_va = 0x15f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f10000" filename = "" Region: id = 10229 start_va = 0x15f50000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f50000" filename = "" Region: id = 10230 start_va = 0x15f90000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f90000" filename = "" Region: id = 10231 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 10232 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 10233 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 10234 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 10235 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 10236 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10237 start_va = 0x15fd0000 end_va = 0x1600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015fd0000" filename = "" Region: id = 10238 start_va = 0x16010000 end_va = 0x1610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016010000" filename = "" Region: id = 10239 start_va = 0x2d680000 end_va = 0x2d6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d680000" filename = "" Region: id = 10240 start_va = 0x2d6c0000 end_va = 0x2d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d6c0000" filename = "" Region: id = 10241 start_va = 0x2d7c0000 end_va = 0x2d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d7c0000" filename = "" Region: id = 10242 start_va = 0x2d800000 end_va = 0x2d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d800000" filename = "" Region: id = 10243 start_va = 0x2d900000 end_va = 0x2d93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d900000" filename = "" Region: id = 10244 start_va = 0x2d940000 end_va = 0x2da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d940000" filename = "" Region: id = 10245 start_va = 0x2da40000 end_va = 0x2da7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da40000" filename = "" Region: id = 10246 start_va = 0x2da80000 end_va = 0x2db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002da80000" filename = "" Region: id = 10247 start_va = 0x2dcc0000 end_va = 0x2dcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dcc0000" filename = "" Region: id = 10248 start_va = 0x2dd00000 end_va = 0x2ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002dd00000" filename = "" Region: id = 10249 start_va = 0x2de00000 end_va = 0x2de3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de00000" filename = "" Region: id = 10250 start_va = 0x2de40000 end_va = 0x2df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002de40000" filename = "" Region: id = 10251 start_va = 0x2df40000 end_va = 0x2df7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df40000" filename = "" Region: id = 10252 start_va = 0x2df80000 end_va = 0x2e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002df80000" filename = "" Region: id = 10253 start_va = 0x2e080000 end_va = 0x2e0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e080000" filename = "" Region: id = 10254 start_va = 0x2e0c0000 end_va = 0x2e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e0c0000" filename = "" Region: id = 10255 start_va = 0x2e1c0000 end_va = 0x2e1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e1c0000" filename = "" Region: id = 10256 start_va = 0x2e200000 end_va = 0x2e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e200000" filename = "" Region: id = 10257 start_va = 0x2e300000 end_va = 0x2e33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e300000" filename = "" Region: id = 10258 start_va = 0x2e340000 end_va = 0x2e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e340000" filename = "" Region: id = 10259 start_va = 0x2e440000 end_va = 0x2e47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e440000" filename = "" Region: id = 10260 start_va = 0x2e480000 end_va = 0x2e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e480000" filename = "" Region: id = 10261 start_va = 0x2e580000 end_va = 0x2e5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e580000" filename = "" Region: id = 10262 start_va = 0x2e5c0000 end_va = 0x2e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e5c0000" filename = "" Region: id = 10263 start_va = 0x2e6c0000 end_va = 0x2e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e6c0000" filename = "" Region: id = 10264 start_va = 0x2e700000 end_va = 0x2e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e700000" filename = "" Region: id = 10265 start_va = 0x2e800000 end_va = 0x2e83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e800000" filename = "" Region: id = 10266 start_va = 0x2e840000 end_va = 0x2e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002e840000" filename = "" Region: id = 10267 start_va = 0x3be80000 end_va = 0x3bebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003be80000" filename = "" Region: id = 10268 start_va = 0x3bec0000 end_va = 0x3bfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bec0000" filename = "" Region: id = 10269 start_va = 0x3bfc0000 end_va = 0x3bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003bfc0000" filename = "" Region: id = 10270 start_va = 0x3c000000 end_va = 0x3c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c000000" filename = "" Region: id = 10271 start_va = 0x3c100000 end_va = 0x3c13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c100000" filename = "" Region: id = 10272 start_va = 0x3c140000 end_va = 0x3c23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c140000" filename = "" Region: id = 10273 start_va = 0x3c240000 end_va = 0x3c27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c240000" filename = "" Region: id = 10274 start_va = 0x3c280000 end_va = 0x3c37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c280000" filename = "" Region: id = 10275 start_va = 0x3c380000 end_va = 0x3c3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c380000" filename = "" Region: id = 10276 start_va = 0x3c3c0000 end_va = 0x3c4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c3c0000" filename = "" Region: id = 10277 start_va = 0x3c4c0000 end_va = 0x3c4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c4c0000" filename = "" Region: id = 10278 start_va = 0x3c500000 end_va = 0x3c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c500000" filename = "" Region: id = 10279 start_va = 0x3c600000 end_va = 0x3c63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c600000" filename = "" Region: id = 10280 start_va = 0x3c640000 end_va = 0x3c73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c640000" filename = "" Region: id = 10281 start_va = 0x3c880000 end_va = 0x3c8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c880000" filename = "" Region: id = 10282 start_va = 0x3c8c0000 end_va = 0x3c9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c8c0000" filename = "" Region: id = 10283 start_va = 0x3c9c0000 end_va = 0x3c9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c9c0000" filename = "" Region: id = 10284 start_va = 0x3ca00000 end_va = 0x3cafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ca00000" filename = "" Region: id = 10285 start_va = 0x3cb00000 end_va = 0x3cb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cb00000" filename = "" Region: id = 10286 start_va = 0x3cb40000 end_va = 0x3cc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cb40000" filename = "" Region: id = 10287 start_va = 0x3cc40000 end_va = 0x3cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cc40000" filename = "" Region: id = 10288 start_va = 0x3cc80000 end_va = 0x3cd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cc80000" filename = "" Region: id = 10289 start_va = 0x3cd80000 end_va = 0x3cdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cd80000" filename = "" Region: id = 10290 start_va = 0x3cdc0000 end_va = 0x3cebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cdc0000" filename = "" Region: id = 10291 start_va = 0x3cec0000 end_va = 0x3cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cec0000" filename = "" Region: id = 10292 start_va = 0x3cf00000 end_va = 0x3cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003cf00000" filename = "" Region: id = 10293 start_va = 0x3d000000 end_va = 0x3d03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d000000" filename = "" Region: id = 10294 start_va = 0x3d040000 end_va = 0x3d13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d040000" filename = "" Region: id = 10295 start_va = 0x3d140000 end_va = 0x3d17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d140000" filename = "" Region: id = 10296 start_va = 0x3d180000 end_va = 0x3d27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d180000" filename = "" Region: id = 10297 start_va = 0x3d280000 end_va = 0x3d2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d280000" filename = "" Region: id = 10298 start_va = 0x3d2c0000 end_va = 0x3d3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d2c0000" filename = "" Region: id = 10299 start_va = 0x3d3c0000 end_va = 0x3d3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d3c0000" filename = "" Region: id = 10300 start_va = 0x3d400000 end_va = 0x3d4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d400000" filename = "" Region: id = 10301 start_va = 0x3d500000 end_va = 0x3d53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d500000" filename = "" Region: id = 10302 start_va = 0x3d540000 end_va = 0x3d63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d540000" filename = "" Region: id = 10303 start_va = 0x3d640000 end_va = 0x3d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d640000" filename = "" Region: id = 10304 start_va = 0x3d680000 end_va = 0x3d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d680000" filename = "" Region: id = 10305 start_va = 0x3d780000 end_va = 0x3d7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d780000" filename = "" Region: id = 10306 start_va = 0x3d7c0000 end_va = 0x3d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d7c0000" filename = "" Region: id = 10307 start_va = 0x3da00000 end_va = 0x3da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003da00000" filename = "" Region: id = 10308 start_va = 0x3da40000 end_va = 0x3db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003da40000" filename = "" Region: id = 10309 start_va = 0x3db40000 end_va = 0x3db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003db40000" filename = "" Region: id = 10310 start_va = 0x3db80000 end_va = 0x3dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003db80000" filename = "" Region: id = 10311 start_va = 0x3dc80000 end_va = 0x3dcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003dc80000" filename = "" Region: id = 10312 start_va = 0x3dcc0000 end_va = 0x3ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003dcc0000" filename = "" Region: id = 10313 start_va = 0x3ddc0000 end_va = 0x3ddfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ddc0000" filename = "" Region: id = 10314 start_va = 0x3de00000 end_va = 0x3defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003de00000" filename = "" Region: id = 10315 start_va = 0x3df00000 end_va = 0x3df3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003df00000" filename = "" Region: id = 10316 start_va = 0x3df40000 end_va = 0x3e03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003df40000" filename = "" Region: id = 10317 start_va = 0x3e040000 end_va = 0x3e07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e040000" filename = "" Region: id = 10318 start_va = 0x3e080000 end_va = 0x3e17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e080000" filename = "" Region: id = 10319 start_va = 0x3e180000 end_va = 0x3e1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e180000" filename = "" Region: id = 10320 start_va = 0x3e1c0000 end_va = 0x3e2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e1c0000" filename = "" Region: id = 10321 start_va = 0x3e2c0000 end_va = 0x3e2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e2c0000" filename = "" Region: id = 10322 start_va = 0x3e300000 end_va = 0x3e3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e300000" filename = "" Region: id = 10323 start_va = 0x3e400000 end_va = 0x3e43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e400000" filename = "" Region: id = 10324 start_va = 0x3e440000 end_va = 0x3e53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e440000" filename = "" Region: id = 10325 start_va = 0x3e540000 end_va = 0x3e57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e540000" filename = "" Region: id = 10326 start_va = 0x3e580000 end_va = 0x3e67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e580000" filename = "" Region: id = 10327 start_va = 0x3e680000 end_va = 0x3e6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e680000" filename = "" Region: id = 10328 start_va = 0x3e6c0000 end_va = 0x3e7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e6c0000" filename = "" Region: id = 10329 start_va = 0x3e7c0000 end_va = 0x3e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e7c0000" filename = "" Region: id = 10330 start_va = 0x3e800000 end_va = 0x3e8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e800000" filename = "" Region: id = 10331 start_va = 0x3e900000 end_va = 0x3e93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e900000" filename = "" Region: id = 10332 start_va = 0x3e940000 end_va = 0x3ea3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003e940000" filename = "" Region: id = 10333 start_va = 0x3ea40000 end_va = 0x3ea7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ea40000" filename = "" Region: id = 10334 start_va = 0x3ea80000 end_va = 0x3eb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ea80000" filename = "" Region: id = 10335 start_va = 0x3eb80000 end_va = 0x3ebbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003eb80000" filename = "" Region: id = 10336 start_va = 0x3ebc0000 end_va = 0x3ecbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ebc0000" filename = "" Region: id = 10337 start_va = 0x3ecc0000 end_va = 0x3ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ecc0000" filename = "" Region: id = 10338 start_va = 0x3ed00000 end_va = 0x3edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ed00000" filename = "" Region: id = 10339 start_va = 0x3ee00000 end_va = 0x3ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ee00000" filename = "" Region: id = 10340 start_va = 0x3ee40000 end_va = 0x3ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ee40000" filename = "" Region: id = 10341 start_va = 0x3ef40000 end_va = 0x3ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ef40000" filename = "" Region: id = 10342 start_va = 0x3ef80000 end_va = 0x3f07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ef80000" filename = "" Region: id = 10343 start_va = 0x3f080000 end_va = 0x3f0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f080000" filename = "" Region: id = 10344 start_va = 0x3f0c0000 end_va = 0x3f1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f0c0000" filename = "" Region: id = 10345 start_va = 0x3f1c0000 end_va = 0x3f1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f1c0000" filename = "" Region: id = 10346 start_va = 0x3f200000 end_va = 0x3f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f200000" filename = "" Region: id = 10347 start_va = 0x3f300000 end_va = 0x3f33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f300000" filename = "" Region: id = 10348 start_va = 0x3f340000 end_va = 0x3f43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f340000" filename = "" Region: id = 10349 start_va = 0x3f440000 end_va = 0x3f47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f440000" filename = "" Region: id = 10350 start_va = 0x3f480000 end_va = 0x3f57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f480000" filename = "" Region: id = 10351 start_va = 0x3f580000 end_va = 0x3f5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f580000" filename = "" Region: id = 10352 start_va = 0x3f5c0000 end_va = 0x3f6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f5c0000" filename = "" Region: id = 10353 start_va = 0x3f6c0000 end_va = 0x3f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f6c0000" filename = "" Region: id = 10354 start_va = 0x3f700000 end_va = 0x3f7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f700000" filename = "" Region: id = 10355 start_va = 0x3f800000 end_va = 0x3f83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f800000" filename = "" Region: id = 10356 start_va = 0x3f840000 end_va = 0x3f93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f840000" filename = "" Region: id = 10357 start_va = 0x3f940000 end_va = 0x3f97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f940000" filename = "" Region: id = 10358 start_va = 0x3f980000 end_va = 0x3fa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003f980000" filename = "" Region: id = 10359 start_va = 0x3fa80000 end_va = 0x3fabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fa80000" filename = "" Region: id = 10360 start_va = 0x3fac0000 end_va = 0x3fbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fac0000" filename = "" Region: id = 10361 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10362 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10363 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 10364 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 10365 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 10366 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 10367 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 10368 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 10369 start_va = 0x3fbc0000 end_va = 0x3fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fbc0000" filename = "" Region: id = 10370 start_va = 0x3fc00000 end_va = 0x3fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fc00000" filename = "" Region: id = 10371 start_va = 0x3fd00000 end_va = 0x3fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd00000" filename = "" Region: id = 10372 start_va = 0x3fd40000 end_va = 0x3fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd40000" filename = "" Region: id = 10373 start_va = 0x3fe40000 end_va = 0x3fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe40000" filename = "" Region: id = 10374 start_va = 0x3fe80000 end_va = 0x3ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe80000" filename = "" Region: id = 10375 start_va = 0x3ffc0000 end_va = 0x3fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ffc0000" filename = "" Region: id = 10376 start_va = 0x40300000 end_va = 0x403fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040300000" filename = "" Region: id = 10377 start_va = 0x40400000 end_va = 0x4043ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040400000" filename = "" Region: id = 10378 start_va = 0x40440000 end_va = 0x4053ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040440000" filename = "" Region: id = 10379 start_va = 0x40540000 end_va = 0x4057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040540000" filename = "" Region: id = 10380 start_va = 0x40580000 end_va = 0x4067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040580000" filename = "" Region: id = 10381 start_va = 0x40680000 end_va = 0x406bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040680000" filename = "" Region: id = 10382 start_va = 0x406c0000 end_va = 0x407bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000406c0000" filename = "" Region: id = 10383 start_va = 0x407c0000 end_va = 0x407fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000407c0000" filename = "" Region: id = 10384 start_va = 0x40800000 end_va = 0x408fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040800000" filename = "" Region: id = 10385 start_va = 0x40900000 end_va = 0x4093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040900000" filename = "" Region: id = 10386 start_va = 0x40940000 end_va = 0x40a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040940000" filename = "" Region: id = 10387 start_va = 0x40a40000 end_va = 0x40a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a40000" filename = "" Region: id = 10388 start_va = 0x40a80000 end_va = 0x40b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a80000" filename = "" Region: id = 10389 start_va = 0x40b80000 end_va = 0x40bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040b80000" filename = "" Region: id = 10390 start_va = 0x40bc0000 end_va = 0x40cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040bc0000" filename = "" Region: id = 10391 start_va = 0x40cc0000 end_va = 0x40cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040cc0000" filename = "" Region: id = 10392 start_va = 0x40d00000 end_va = 0x40dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040d00000" filename = "" Region: id = 10393 start_va = 0x40e00000 end_va = 0x40e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040e00000" filename = "" Region: id = 10394 start_va = 0x40e40000 end_va = 0x40f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040e40000" filename = "" Region: id = 10395 start_va = 0x40f40000 end_va = 0x40f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040f40000" filename = "" Region: id = 10396 start_va = 0x40f80000 end_va = 0x4107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040f80000" filename = "" Region: id = 10397 start_va = 0x41080000 end_va = 0x410bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041080000" filename = "" Region: id = 10398 start_va = 0x410c0000 end_va = 0x411bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000410c0000" filename = "" Region: id = 10399 start_va = 0x411c0000 end_va = 0x411fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000411c0000" filename = "" Region: id = 10400 start_va = 0x41200000 end_va = 0x412fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041200000" filename = "" Region: id = 10401 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10402 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10403 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10404 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10405 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10406 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10407 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10408 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10409 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10410 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10411 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10412 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10413 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10414 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10415 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10416 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10417 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10418 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10419 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10420 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10421 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10422 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10423 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10424 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10425 start_va = 0x15290000 end_va = 0x152cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015290000" filename = "" Region: id = 10426 start_va = 0x15410000 end_va = 0x1550ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015410000" filename = "" Region: id = 10427 start_va = 0x15510000 end_va = 0x1554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015510000" filename = "" Region: id = 10428 start_va = 0x15710000 end_va = 0x1580ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015710000" filename = "" Region: id = 10429 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10430 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10431 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10432 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10433 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10434 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10435 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10436 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10437 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10438 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10439 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10440 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10441 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10442 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10443 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10444 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10445 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10446 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10447 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10448 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10449 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10450 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10451 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10452 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10453 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10454 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10455 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10456 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10457 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10458 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10459 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10460 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10461 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10462 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10463 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10464 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10465 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10466 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10467 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 10468 start_va = 0x15190000 end_va = 0x1528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 10469 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 10470 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 10471 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 10472 start_va = 0x15910000 end_va = 0x15a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 10473 start_va = 0x15a10000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a10000" filename = "" Region: id = 10474 start_va = 0x15a50000 end_va = 0x15b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 10475 start_va = 0x15b50000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b50000" filename = "" Region: id = 10476 start_va = 0x15b90000 end_va = 0x15c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 10477 start_va = 0x15c90000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c90000" filename = "" Region: id = 10478 start_va = 0x15cd0000 end_va = 0x15dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 10479 start_va = 0x15dd0000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015dd0000" filename = "" Region: id = 10480 start_va = 0x15e10000 end_va = 0x15f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e10000" filename = "" Region: id = 10481 start_va = 0x15f10000 end_va = 0x15f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f10000" filename = "" Region: id = 10482 start_va = 0x15f50000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f50000" filename = "" Region: id = 10483 start_va = 0x15f90000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f90000" filename = "" Region: id = 10484 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 10485 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 10486 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 10487 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 10488 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 10489 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 10490 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 10491 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 10492 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 10493 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 10494 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 10495 start_va = 0x3fbc0000 end_va = 0x3fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fbc0000" filename = "" Region: id = 10496 start_va = 0x3fc00000 end_va = 0x3fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fc00000" filename = "" Region: id = 10497 start_va = 0x3fd00000 end_va = 0x3fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd00000" filename = "" Region: id = 10498 start_va = 0x3fd40000 end_va = 0x3fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd40000" filename = "" Region: id = 10499 start_va = 0x3fe40000 end_va = 0x3fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe40000" filename = "" Region: id = 10500 start_va = 0x3fe80000 end_va = 0x3ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe80000" filename = "" Region: id = 10501 start_va = 0x3ffc0000 end_va = 0x3fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ffc0000" filename = "" Region: id = 10502 start_va = 0x40300000 end_va = 0x403fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040300000" filename = "" Region: id = 10503 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10504 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10505 start_va = 0x16110000 end_va = 0x1614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 10506 start_va = 0x16150000 end_va = 0x1624ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016150000" filename = "" Region: id = 10507 start_va = 0x40400000 end_va = 0x4043ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040400000" filename = "" Region: id = 10508 start_va = 0x40440000 end_va = 0x4053ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040440000" filename = "" Region: id = 10509 start_va = 0x40540000 end_va = 0x4057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040540000" filename = "" Region: id = 10510 start_va = 0x40580000 end_va = 0x4067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040580000" filename = "" Region: id = 10511 start_va = 0x40680000 end_va = 0x406bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040680000" filename = "" Region: id = 10512 start_va = 0x406c0000 end_va = 0x407bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000406c0000" filename = "" Region: id = 10513 start_va = 0x407c0000 end_va = 0x407fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000407c0000" filename = "" Region: id = 10514 start_va = 0x40800000 end_va = 0x408fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040800000" filename = "" Region: id = 10515 start_va = 0x40900000 end_va = 0x4093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040900000" filename = "" Region: id = 10516 start_va = 0x40940000 end_va = 0x40a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040940000" filename = "" Region: id = 10517 start_va = 0x40a40000 end_va = 0x40a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a40000" filename = "" Region: id = 10518 start_va = 0x40a80000 end_va = 0x40b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a80000" filename = "" Region: id = 10519 start_va = 0x40b80000 end_va = 0x40bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040b80000" filename = "" Region: id = 10520 start_va = 0x40bc0000 end_va = 0x40cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040bc0000" filename = "" Region: id = 10521 start_va = 0x40cc0000 end_va = 0x40cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040cc0000" filename = "" Region: id = 10522 start_va = 0x40d00000 end_va = 0x40dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040d00000" filename = "" Region: id = 10523 start_va = 0x40e00000 end_va = 0x40e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040e00000" filename = "" Region: id = 10524 start_va = 0x40e40000 end_va = 0x40f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040e40000" filename = "" Region: id = 10525 start_va = 0x40f40000 end_va = 0x40f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040f40000" filename = "" Region: id = 10526 start_va = 0x40f80000 end_va = 0x4107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040f80000" filename = "" Region: id = 10527 start_va = 0x41080000 end_va = 0x410bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041080000" filename = "" Region: id = 10528 start_va = 0x410c0000 end_va = 0x411bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000410c0000" filename = "" Region: id = 10529 start_va = 0x411c0000 end_va = 0x411fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000411c0000" filename = "" Region: id = 10530 start_va = 0x41200000 end_va = 0x412fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041200000" filename = "" Region: id = 10531 start_va = 0x41300000 end_va = 0x4133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041300000" filename = "" Region: id = 10532 start_va = 0x41340000 end_va = 0x4143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041340000" filename = "" Region: id = 10533 start_va = 0x41440000 end_va = 0x4147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041440000" filename = "" Region: id = 10534 start_va = 0x41480000 end_va = 0x4157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041480000" filename = "" Region: id = 10535 start_va = 0x41580000 end_va = 0x415bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041580000" filename = "" Region: id = 10536 start_va = 0x415c0000 end_va = 0x416bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000415c0000" filename = "" Region: id = 10537 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10538 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10539 start_va = 0x416c0000 end_va = 0x416fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000416c0000" filename = "" Region: id = 10540 start_va = 0x41700000 end_va = 0x417fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041700000" filename = "" Region: id = 10541 start_va = 0x41800000 end_va = 0x4183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041800000" filename = "" Region: id = 10542 start_va = 0x41840000 end_va = 0x4193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041840000" filename = "" Region: id = 10543 start_va = 0x41940000 end_va = 0x4197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041940000" filename = "" Region: id = 10544 start_va = 0x41980000 end_va = 0x41a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041980000" filename = "" Region: id = 10545 start_va = 0x41a80000 end_va = 0x41abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041a80000" filename = "" Region: id = 10546 start_va = 0x41ac0000 end_va = 0x41bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041ac0000" filename = "" Region: id = 10547 start_va = 0x41bc0000 end_va = 0x41bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041bc0000" filename = "" Region: id = 10548 start_va = 0x41c00000 end_va = 0x41cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041c00000" filename = "" Region: id = 10549 start_va = 0x41d00000 end_va = 0x41d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041d00000" filename = "" Region: id = 10550 start_va = 0x41d40000 end_va = 0x41e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041d40000" filename = "" Region: id = 10551 start_va = 0x41e40000 end_va = 0x41e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041e40000" filename = "" Region: id = 10552 start_va = 0x41e80000 end_va = 0x41f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041e80000" filename = "" Region: id = 10553 start_va = 0x41f80000 end_va = 0x41fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041f80000" filename = "" Region: id = 10554 start_va = 0x41fc0000 end_va = 0x420bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041fc0000" filename = "" Region: id = 10555 start_va = 0x420c0000 end_va = 0x420fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000420c0000" filename = "" Region: id = 10556 start_va = 0x42100000 end_va = 0x421fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042100000" filename = "" Region: id = 10557 start_va = 0x42200000 end_va = 0x4223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042200000" filename = "" Region: id = 10558 start_va = 0x42240000 end_va = 0x4233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042240000" filename = "" Region: id = 10559 start_va = 0x42340000 end_va = 0x4237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042340000" filename = "" Region: id = 10560 start_va = 0x42380000 end_va = 0x4247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042380000" filename = "" Region: id = 10561 start_va = 0x42480000 end_va = 0x424bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042480000" filename = "" Region: id = 10562 start_va = 0x424c0000 end_va = 0x425bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000424c0000" filename = "" Region: id = 10563 start_va = 0x425c0000 end_va = 0x425fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000425c0000" filename = "" Region: id = 10564 start_va = 0x42600000 end_va = 0x426fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042600000" filename = "" Region: id = 10565 start_va = 0x42700000 end_va = 0x4273ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042700000" filename = "" Region: id = 10566 start_va = 0x42740000 end_va = 0x4283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042740000" filename = "" Region: id = 10567 start_va = 0x42840000 end_va = 0x4287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042840000" filename = "" Region: id = 10568 start_va = 0x42880000 end_va = 0x4297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042880000" filename = "" Region: id = 10569 start_va = 0x42980000 end_va = 0x429bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042980000" filename = "" Region: id = 10570 start_va = 0x429c0000 end_va = 0x42abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000429c0000" filename = "" Region: id = 10571 start_va = 0x42ac0000 end_va = 0x42afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042ac0000" filename = "" Region: id = 10572 start_va = 0x42b00000 end_va = 0x42bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042b00000" filename = "" Region: id = 10573 start_va = 0x42c00000 end_va = 0x42c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042c00000" filename = "" Region: id = 10574 start_va = 0x42c40000 end_va = 0x42d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042c40000" filename = "" Region: id = 10575 start_va = 0x42d40000 end_va = 0x42d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042d40000" filename = "" Region: id = 10576 start_va = 0x42d80000 end_va = 0x42e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042d80000" filename = "" Region: id = 10577 start_va = 0x42e80000 end_va = 0x42ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042e80000" filename = "" Region: id = 10578 start_va = 0x42ec0000 end_va = 0x42fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042ec0000" filename = "" Region: id = 10579 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10580 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10581 start_va = 0x42fc0000 end_va = 0x42ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042fc0000" filename = "" Region: id = 10582 start_va = 0x43000000 end_va = 0x430fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043000000" filename = "" Region: id = 10583 start_va = 0x43100000 end_va = 0x4313ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043100000" filename = "" Region: id = 10584 start_va = 0x43140000 end_va = 0x4323ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043140000" filename = "" Region: id = 10585 start_va = 0x43240000 end_va = 0x4327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043240000" filename = "" Region: id = 10586 start_va = 0x43280000 end_va = 0x4337ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043280000" filename = "" Region: id = 10587 start_va = 0x43380000 end_va = 0x433bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043380000" filename = "" Region: id = 10588 start_va = 0x433c0000 end_va = 0x434bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000433c0000" filename = "" Region: id = 10589 start_va = 0x434c0000 end_va = 0x434fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000434c0000" filename = "" Region: id = 10590 start_va = 0x43500000 end_va = 0x435fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043500000" filename = "" Region: id = 10591 start_va = 0x43600000 end_va = 0x4363ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043600000" filename = "" Region: id = 10592 start_va = 0x43640000 end_va = 0x4373ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043640000" filename = "" Region: id = 10593 start_va = 0x43740000 end_va = 0x4377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043740000" filename = "" Region: id = 10594 start_va = 0x43780000 end_va = 0x4387ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043780000" filename = "" Region: id = 10595 start_va = 0x43880000 end_va = 0x438bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043880000" filename = "" Region: id = 10596 start_va = 0x438c0000 end_va = 0x439bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000438c0000" filename = "" Region: id = 10597 start_va = 0x439c0000 end_va = 0x439fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000439c0000" filename = "" Region: id = 10598 start_va = 0x43a00000 end_va = 0x43afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043a00000" filename = "" Region: id = 10599 start_va = 0x43b00000 end_va = 0x43b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043b00000" filename = "" Region: id = 10600 start_va = 0x43b40000 end_va = 0x43c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043b40000" filename = "" Region: id = 10601 start_va = 0x43c40000 end_va = 0x43c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043c40000" filename = "" Region: id = 10602 start_va = 0x43c80000 end_va = 0x43d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043c80000" filename = "" Region: id = 10603 start_va = 0x43d80000 end_va = 0x43dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043d80000" filename = "" Region: id = 10604 start_va = 0x43dc0000 end_va = 0x43ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043dc0000" filename = "" Region: id = 10605 start_va = 0x43ec0000 end_va = 0x43efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043ec0000" filename = "" Region: id = 10606 start_va = 0x43f00000 end_va = 0x43ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043f00000" filename = "" Region: id = 10607 start_va = 0x44000000 end_va = 0x4403ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044000000" filename = "" Region: id = 10608 start_va = 0x44040000 end_va = 0x4413ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044040000" filename = "" Region: id = 10609 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10610 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10611 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10612 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10613 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10614 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10615 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10616 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10617 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10618 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10619 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10620 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10621 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10622 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10623 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10624 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10625 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10626 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10627 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10628 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10629 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10630 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10631 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10632 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10633 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10634 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10635 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10636 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10637 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10638 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10639 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10640 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10641 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10642 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10643 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10644 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10645 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10646 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10647 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10648 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10649 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10650 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10651 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10652 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10653 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10654 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10655 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10656 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10657 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10658 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10659 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10660 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10661 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10662 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10663 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10664 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10665 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10666 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10667 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10668 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10669 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10670 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10671 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10672 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10673 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10674 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10675 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10676 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10677 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10678 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10679 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10680 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10681 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10682 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10683 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10684 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10685 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10686 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10687 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10688 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10689 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10690 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10691 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10692 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10693 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 10694 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 10695 start_va = 0x15a10000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a10000" filename = "" Region: id = 10696 start_va = 0x15a50000 end_va = 0x15b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 10697 start_va = 0x15b50000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b50000" filename = "" Region: id = 10698 start_va = 0x15b90000 end_va = 0x15c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 10699 start_va = 0x15c90000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c90000" filename = "" Region: id = 10700 start_va = 0x15cd0000 end_va = 0x15dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 10701 start_va = 0x15dd0000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015dd0000" filename = "" Region: id = 10702 start_va = 0x15e10000 end_va = 0x15f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e10000" filename = "" Region: id = 10703 start_va = 0x15f10000 end_va = 0x15f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f10000" filename = "" Region: id = 10704 start_va = 0x15f50000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f50000" filename = "" Region: id = 10705 start_va = 0x15f90000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f90000" filename = "" Region: id = 10706 start_va = 0x16110000 end_va = 0x1620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 10707 start_va = 0x16210000 end_va = 0x1630ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016210000" filename = "" Region: id = 10708 start_va = 0x16310000 end_va = 0x1634ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016310000" filename = "" Region: id = 10709 start_va = 0x16350000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016350000" filename = "" Region: id = 10710 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 10711 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 10712 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 10713 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 10714 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 10715 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 10716 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 10717 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 10718 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 10719 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 10720 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 10721 start_va = 0x3fbc0000 end_va = 0x3fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fbc0000" filename = "" Region: id = 10722 start_va = 0x3fc00000 end_va = 0x3fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fc00000" filename = "" Region: id = 10723 start_va = 0x3fd00000 end_va = 0x3fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd00000" filename = "" Region: id = 10724 start_va = 0x3fd40000 end_va = 0x3fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd40000" filename = "" Region: id = 10725 start_va = 0x40400000 end_va = 0x4043ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040400000" filename = "" Region: id = 10726 start_va = 0x40440000 end_va = 0x4053ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040440000" filename = "" Region: id = 10727 start_va = 0x40540000 end_va = 0x4057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040540000" filename = "" Region: id = 10728 start_va = 0x40580000 end_va = 0x4067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040580000" filename = "" Region: id = 10729 start_va = 0x40680000 end_va = 0x406bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040680000" filename = "" Region: id = 10730 start_va = 0x406c0000 end_va = 0x407bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000406c0000" filename = "" Region: id = 10731 start_va = 0x407c0000 end_va = 0x407fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000407c0000" filename = "" Region: id = 10732 start_va = 0x40800000 end_va = 0x408fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040800000" filename = "" Region: id = 10733 start_va = 0x40900000 end_va = 0x4093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040900000" filename = "" Region: id = 10734 start_va = 0x40940000 end_va = 0x40a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040940000" filename = "" Region: id = 10735 start_va = 0x40a40000 end_va = 0x40a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a40000" filename = "" Region: id = 10736 start_va = 0x40a80000 end_va = 0x40b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a80000" filename = "" Region: id = 10737 start_va = 0x40b80000 end_va = 0x40bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040b80000" filename = "" Region: id = 10738 start_va = 0x40bc0000 end_va = 0x40cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040bc0000" filename = "" Region: id = 10739 start_va = 0x40cc0000 end_va = 0x40cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040cc0000" filename = "" Region: id = 10740 start_va = 0x40d00000 end_va = 0x40dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040d00000" filename = "" Region: id = 10741 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10742 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10743 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10744 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10745 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10746 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10747 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10748 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10749 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10750 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10751 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10752 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10753 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10754 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10755 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10756 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10757 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10758 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10759 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10760 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10761 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10762 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10763 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10764 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10765 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10766 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10767 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10768 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10769 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10770 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10771 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10772 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10773 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10774 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10775 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10776 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10777 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10778 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10779 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10780 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10781 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10782 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10783 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10784 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10785 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10786 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10787 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10788 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10789 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 10790 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10791 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10792 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10793 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10794 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10795 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10796 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10797 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10798 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10799 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10800 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10801 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10802 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10803 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10804 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10805 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10806 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10807 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10808 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10809 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10810 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10811 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10812 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10813 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10814 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10815 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10816 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10817 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10818 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10819 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10820 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10821 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10822 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10823 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10824 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10825 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10826 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10827 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10828 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10829 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10830 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10831 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10832 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10833 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10834 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10835 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 10836 start_va = 0x15190000 end_va = 0x1528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 10837 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 10838 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 10839 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 10840 start_va = 0x15910000 end_va = 0x15a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 10841 start_va = 0x15a10000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a10000" filename = "" Region: id = 10842 start_va = 0x15a50000 end_va = 0x15b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 10843 start_va = 0x15b50000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b50000" filename = "" Region: id = 10844 start_va = 0x15b90000 end_va = 0x15c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 10845 start_va = 0x15c90000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c90000" filename = "" Region: id = 10846 start_va = 0x15cd0000 end_va = 0x15dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 10847 start_va = 0x15dd0000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015dd0000" filename = "" Region: id = 10848 start_va = 0x15e10000 end_va = 0x15f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e10000" filename = "" Region: id = 10849 start_va = 0x15f10000 end_va = 0x15f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f10000" filename = "" Region: id = 10850 start_va = 0x16110000 end_va = 0x1620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 10851 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10852 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10853 start_va = 0x15f50000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f50000" filename = "" Region: id = 10854 start_va = 0x16210000 end_va = 0x1630ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016210000" filename = "" Region: id = 10855 start_va = 0x16310000 end_va = 0x1634ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016310000" filename = "" Region: id = 10856 start_va = 0x164d0000 end_va = 0x165cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 10857 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10858 start_va = 0x165d0000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000165d0000" filename = "" Region: id = 10859 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 10860 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 10861 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 10862 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 10863 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 10864 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10865 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 10866 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 10867 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 10868 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 10869 start_va = 0x3fbc0000 end_va = 0x3fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fbc0000" filename = "" Region: id = 10870 start_va = 0x3fc00000 end_va = 0x3fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fc00000" filename = "" Region: id = 10871 start_va = 0x3fd00000 end_va = 0x3fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd00000" filename = "" Region: id = 10872 start_va = 0x3fd40000 end_va = 0x3fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd40000" filename = "" Region: id = 10873 start_va = 0x3fe40000 end_va = 0x3fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe40000" filename = "" Region: id = 10874 start_va = 0x3fe80000 end_va = 0x3ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe80000" filename = "" Region: id = 10875 start_va = 0x3ff80000 end_va = 0x3ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ff80000" filename = "" Region: id = 10876 start_va = 0x3ffc0000 end_va = 0x3fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ffc0000" filename = "" Region: id = 10877 start_va = 0x40200000 end_va = 0x402fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040200000" filename = "" Region: id = 10878 start_va = 0x40300000 end_va = 0x403fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040300000" filename = "" Region: id = 10879 start_va = 0x40400000 end_va = 0x4043ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040400000" filename = "" Region: id = 10880 start_va = 0x40440000 end_va = 0x4053ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040440000" filename = "" Region: id = 10881 start_va = 0x40540000 end_va = 0x4057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040540000" filename = "" Region: id = 10882 start_va = 0x40580000 end_va = 0x4067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040580000" filename = "" Region: id = 10883 start_va = 0x40680000 end_va = 0x406bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040680000" filename = "" Region: id = 10884 start_va = 0x406c0000 end_va = 0x407bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000406c0000" filename = "" Region: id = 10885 start_va = 0x407c0000 end_va = 0x407fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000407c0000" filename = "" Region: id = 10886 start_va = 0x40800000 end_va = 0x408fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040800000" filename = "" Region: id = 10887 start_va = 0x40900000 end_va = 0x4093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040900000" filename = "" Region: id = 10888 start_va = 0x40940000 end_va = 0x40a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040940000" filename = "" Region: id = 10889 start_va = 0x40a40000 end_va = 0x40a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a40000" filename = "" Region: id = 10890 start_va = 0x40a80000 end_va = 0x40b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040a80000" filename = "" Region: id = 10891 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10892 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10893 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10894 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10895 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10896 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10897 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10898 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10899 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10900 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10901 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10902 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10903 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10904 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10905 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10906 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10907 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10908 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10909 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10910 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10911 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10912 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10913 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10914 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10915 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10916 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10917 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10918 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10919 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10920 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10921 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10922 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10923 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10924 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10925 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10926 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10927 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10928 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10929 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10930 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10931 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10932 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10933 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10934 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10935 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10936 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10937 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10938 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10939 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10940 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10941 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10942 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 10943 start_va = 0x14310000 end_va = 0x1434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000014310000" filename = "" Region: id = 10944 start_va = 0x15190000 end_va = 0x1528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015190000" filename = "" Region: id = 10945 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 10946 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 10947 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 10948 start_va = 0x15910000 end_va = 0x15a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 10949 start_va = 0x15a10000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a10000" filename = "" Region: id = 10950 start_va = 0x15a50000 end_va = 0x15b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 10951 start_va = 0x15b50000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b50000" filename = "" Region: id = 10952 start_va = 0x15b90000 end_va = 0x15c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 10953 start_va = 0x15c90000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c90000" filename = "" Region: id = 10954 start_va = 0x15cd0000 end_va = 0x15dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 10955 start_va = 0x15dd0000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015dd0000" filename = "" Region: id = 10956 start_va = 0x15e10000 end_va = 0x15f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e10000" filename = "" Region: id = 10957 start_va = 0x15f10000 end_va = 0x15f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f10000" filename = "" Region: id = 10958 start_va = 0x15f50000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f50000" filename = "" Region: id = 10959 start_va = 0x15f90000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f90000" filename = "" Region: id = 10960 start_va = 0x16110000 end_va = 0x1620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 10961 start_va = 0x16210000 end_va = 0x1630ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016210000" filename = "" Region: id = 10962 start_va = 0x16310000 end_va = 0x1634ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016310000" filename = "" Region: id = 10963 start_va = 0x16350000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016350000" filename = "" Region: id = 10964 start_va = 0x164d0000 end_va = 0x165cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 10965 start_va = 0x165d0000 end_va = 0x1660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000165d0000" filename = "" Region: id = 10966 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 10967 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 10968 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 10969 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 10970 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 10971 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 10972 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 10973 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 10974 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 10975 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 10976 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 10977 start_va = 0x3fbc0000 end_va = 0x3fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fbc0000" filename = "" Region: id = 10978 start_va = 0x3fc00000 end_va = 0x3fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fc00000" filename = "" Region: id = 10979 start_va = 0x3fd00000 end_va = 0x3fd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd00000" filename = "" Region: id = 10980 start_va = 0x3fd40000 end_va = 0x3fe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fd40000" filename = "" Region: id = 10981 start_va = 0x3fe40000 end_va = 0x3fe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe40000" filename = "" Region: id = 10982 start_va = 0x3fe80000 end_va = 0x3ff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fe80000" filename = "" Region: id = 10983 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 10984 start_va = 0x3ff80000 end_va = 0x3ffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ff80000" filename = "" Region: id = 10985 start_va = 0x3ffc0000 end_va = 0x3fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003ffc0000" filename = "" Region: id = 10986 start_va = 0x40200000 end_va = 0x402fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040200000" filename = "" Region: id = 10987 start_va = 0x40300000 end_va = 0x403fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040300000" filename = "" Region: id = 10988 start_va = 0x40400000 end_va = 0x4043ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040400000" filename = "" Region: id = 10989 start_va = 0x40440000 end_va = 0x4053ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040440000" filename = "" Region: id = 10990 start_va = 0x40540000 end_va = 0x4057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040540000" filename = "" Region: id = 10991 start_va = 0x40580000 end_va = 0x4067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040580000" filename = "" Region: id = 10992 start_va = 0x40680000 end_va = 0x406bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040680000" filename = "" Region: id = 10993 start_va = 0x406c0000 end_va = 0x407bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000406c0000" filename = "" Region: id = 10994 start_va = 0x407c0000 end_va = 0x407fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000407c0000" filename = "" Region: id = 10995 start_va = 0x40800000 end_va = 0x408fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040800000" filename = "" Region: id = 10996 start_va = 0x40900000 end_va = 0x4093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040900000" filename = "" Region: id = 10997 start_va = 0x40940000 end_va = 0x40a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040940000" filename = "" Region: id = 10998 start_va = 0x40b80000 end_va = 0x40bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040b80000" filename = "" Region: id = 10999 start_va = 0x40bc0000 end_va = 0x40cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040bc0000" filename = "" Region: id = 11000 start_va = 0x40cc0000 end_va = 0x40cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040cc0000" filename = "" Region: id = 11001 start_va = 0x40d00000 end_va = 0x40dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040d00000" filename = "" Region: id = 11002 start_va = 0x40e00000 end_va = 0x40e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040e00000" filename = "" Region: id = 11003 start_va = 0x40e40000 end_va = 0x40f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040e40000" filename = "" Region: id = 11004 start_va = 0x40f40000 end_va = 0x40f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040f40000" filename = "" Region: id = 11005 start_va = 0x40f80000 end_va = 0x4107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000040f80000" filename = "" Region: id = 11006 start_va = 0x41080000 end_va = 0x410bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041080000" filename = "" Region: id = 11007 start_va = 0x410c0000 end_va = 0x411bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000410c0000" filename = "" Region: id = 11008 start_va = 0x411c0000 end_va = 0x411fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000411c0000" filename = "" Region: id = 11009 start_va = 0x41200000 end_va = 0x412fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041200000" filename = "" Region: id = 11010 start_va = 0x41300000 end_va = 0x4133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041300000" filename = "" Region: id = 11011 start_va = 0x41340000 end_va = 0x4143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041340000" filename = "" Region: id = 11012 start_va = 0x41440000 end_va = 0x4147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041440000" filename = "" Region: id = 11013 start_va = 0x41480000 end_va = 0x4157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041480000" filename = "" Region: id = 11014 start_va = 0x41580000 end_va = 0x415bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041580000" filename = "" Region: id = 11015 start_va = 0x415c0000 end_va = 0x416bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000415c0000" filename = "" Region: id = 11016 start_va = 0x416c0000 end_va = 0x416fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000416c0000" filename = "" Region: id = 11017 start_va = 0x41700000 end_va = 0x417fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041700000" filename = "" Region: id = 11018 start_va = 0x41800000 end_va = 0x4183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041800000" filename = "" Region: id = 11019 start_va = 0x41840000 end_va = 0x4193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041840000" filename = "" Region: id = 11020 start_va = 0x41940000 end_va = 0x4197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041940000" filename = "" Region: id = 11021 start_va = 0x41980000 end_va = 0x41a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041980000" filename = "" Region: id = 11022 start_va = 0x41a80000 end_va = 0x41abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041a80000" filename = "" Region: id = 11023 start_va = 0x41ac0000 end_va = 0x41bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041ac0000" filename = "" Region: id = 11024 start_va = 0x41bc0000 end_va = 0x41bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041bc0000" filename = "" Region: id = 11025 start_va = 0x41c00000 end_va = 0x41cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041c00000" filename = "" Region: id = 11026 start_va = 0x41d00000 end_va = 0x41d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041d00000" filename = "" Region: id = 11027 start_va = 0x41d40000 end_va = 0x41e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041d40000" filename = "" Region: id = 11028 start_va = 0x41e40000 end_va = 0x41e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041e40000" filename = "" Region: id = 11029 start_va = 0x41e80000 end_va = 0x41f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041e80000" filename = "" Region: id = 11030 start_va = 0x41f80000 end_va = 0x41fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041f80000" filename = "" Region: id = 11031 start_va = 0x41fc0000 end_va = 0x420bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000041fc0000" filename = "" Region: id = 11032 start_va = 0x420c0000 end_va = 0x420fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000420c0000" filename = "" Region: id = 11033 start_va = 0x42100000 end_va = 0x421fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042100000" filename = "" Region: id = 11034 start_va = 0x42200000 end_va = 0x4223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042200000" filename = "" Region: id = 11035 start_va = 0x42240000 end_va = 0x4233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042240000" filename = "" Region: id = 11036 start_va = 0x42340000 end_va = 0x4237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042340000" filename = "" Region: id = 11037 start_va = 0x42380000 end_va = 0x4247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042380000" filename = "" Region: id = 11038 start_va = 0x42480000 end_va = 0x424bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042480000" filename = "" Region: id = 11039 start_va = 0x424c0000 end_va = 0x425bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000424c0000" filename = "" Region: id = 11040 start_va = 0x425c0000 end_va = 0x425fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000425c0000" filename = "" Region: id = 11041 start_va = 0x42600000 end_va = 0x426fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042600000" filename = "" Region: id = 11042 start_va = 0x42700000 end_va = 0x4273ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042700000" filename = "" Region: id = 11043 start_va = 0x42740000 end_va = 0x4283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042740000" filename = "" Region: id = 11044 start_va = 0x42840000 end_va = 0x4287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042840000" filename = "" Region: id = 11045 start_va = 0x42880000 end_va = 0x4297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042880000" filename = "" Region: id = 11046 start_va = 0x42980000 end_va = 0x429bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042980000" filename = "" Region: id = 11047 start_va = 0x429c0000 end_va = 0x42abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000429c0000" filename = "" Region: id = 11048 start_va = 0x42ac0000 end_va = 0x42afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042ac0000" filename = "" Region: id = 11049 start_va = 0x42b00000 end_va = 0x42bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042b00000" filename = "" Region: id = 11050 start_va = 0x42c00000 end_va = 0x42c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042c00000" filename = "" Region: id = 11051 start_va = 0x42c40000 end_va = 0x42d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042c40000" filename = "" Region: id = 11052 start_va = 0x42d40000 end_va = 0x42d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042d40000" filename = "" Region: id = 11053 start_va = 0x42d80000 end_va = 0x42e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042d80000" filename = "" Region: id = 11054 start_va = 0x42e80000 end_va = 0x42ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042e80000" filename = "" Region: id = 11055 start_va = 0x42ec0000 end_va = 0x42fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042ec0000" filename = "" Region: id = 11056 start_va = 0x42fc0000 end_va = 0x42ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000042fc0000" filename = "" Region: id = 11057 start_va = 0x43000000 end_va = 0x430fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043000000" filename = "" Region: id = 11058 start_va = 0x43100000 end_va = 0x4313ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043100000" filename = "" Region: id = 11059 start_va = 0x43140000 end_va = 0x4323ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043140000" filename = "" Region: id = 11060 start_va = 0x43240000 end_va = 0x4327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043240000" filename = "" Region: id = 11061 start_va = 0x43280000 end_va = 0x4337ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043280000" filename = "" Region: id = 11062 start_va = 0x43380000 end_va = 0x433bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043380000" filename = "" Region: id = 11063 start_va = 0x433c0000 end_va = 0x434bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000433c0000" filename = "" Region: id = 11064 start_va = 0x434c0000 end_va = 0x434fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000434c0000" filename = "" Region: id = 11065 start_va = 0x43500000 end_va = 0x435fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043500000" filename = "" Region: id = 11066 start_va = 0x43600000 end_va = 0x4363ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043600000" filename = "" Region: id = 11067 start_va = 0x43640000 end_va = 0x4373ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043640000" filename = "" Region: id = 11068 start_va = 0x43740000 end_va = 0x4377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043740000" filename = "" Region: id = 11069 start_va = 0x43780000 end_va = 0x4387ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043780000" filename = "" Region: id = 11070 start_va = 0x43880000 end_va = 0x438bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043880000" filename = "" Region: id = 11071 start_va = 0x438c0000 end_va = 0x439bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000438c0000" filename = "" Region: id = 11072 start_va = 0x439c0000 end_va = 0x439fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000439c0000" filename = "" Region: id = 11073 start_va = 0x43a00000 end_va = 0x43afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043a00000" filename = "" Region: id = 11074 start_va = 0x43b00000 end_va = 0x43b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043b00000" filename = "" Region: id = 11075 start_va = 0x43b40000 end_va = 0x43c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043b40000" filename = "" Region: id = 11076 start_va = 0x43c40000 end_va = 0x43c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043c40000" filename = "" Region: id = 11077 start_va = 0x43c80000 end_va = 0x43d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043c80000" filename = "" Region: id = 11078 start_va = 0x43d80000 end_va = 0x43dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043d80000" filename = "" Region: id = 11079 start_va = 0x43dc0000 end_va = 0x43ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043dc0000" filename = "" Region: id = 11080 start_va = 0x43ec0000 end_va = 0x43efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043ec0000" filename = "" Region: id = 11081 start_va = 0x43f00000 end_va = 0x43ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000043f00000" filename = "" Region: id = 11082 start_va = 0x44000000 end_va = 0x4403ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044000000" filename = "" Region: id = 11083 start_va = 0x44040000 end_va = 0x4413ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044040000" filename = "" Region: id = 11084 start_va = 0x44140000 end_va = 0x4417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044140000" filename = "" Region: id = 11085 start_va = 0x44180000 end_va = 0x4427ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044180000" filename = "" Region: id = 11086 start_va = 0x44280000 end_va = 0x442bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044280000" filename = "" Region: id = 11087 start_va = 0x442c0000 end_va = 0x443bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000442c0000" filename = "" Region: id = 11088 start_va = 0x443c0000 end_va = 0x443fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000443c0000" filename = "" Region: id = 11089 start_va = 0x44400000 end_va = 0x444fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044400000" filename = "" Region: id = 11090 start_va = 0x44500000 end_va = 0x4453ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044500000" filename = "" Region: id = 11091 start_va = 0x44540000 end_va = 0x4463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044540000" filename = "" Region: id = 11092 start_va = 0x44640000 end_va = 0x4467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044640000" filename = "" Region: id = 11093 start_va = 0x44680000 end_va = 0x4477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044680000" filename = "" Region: id = 11094 start_va = 0x44780000 end_va = 0x447bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044780000" filename = "" Region: id = 11095 start_va = 0x447c0000 end_va = 0x448bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000447c0000" filename = "" Region: id = 11096 start_va = 0x448c0000 end_va = 0x448fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000448c0000" filename = "" Region: id = 11097 start_va = 0x44900000 end_va = 0x449fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044900000" filename = "" Region: id = 11098 start_va = 0x44a00000 end_va = 0x44a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044a00000" filename = "" Region: id = 11099 start_va = 0x44a40000 end_va = 0x44b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044a40000" filename = "" Region: id = 11100 start_va = 0x44b40000 end_va = 0x44b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044b40000" filename = "" Region: id = 11101 start_va = 0x44b80000 end_va = 0x44c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044b80000" filename = "" Region: id = 11102 start_va = 0x44c80000 end_va = 0x44cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044c80000" filename = "" Region: id = 11103 start_va = 0x44cc0000 end_va = 0x44dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044cc0000" filename = "" Region: id = 11104 start_va = 0x44dc0000 end_va = 0x44dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044dc0000" filename = "" Region: id = 11105 start_va = 0x44e00000 end_va = 0x44efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044e00000" filename = "" Region: id = 11106 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11107 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11108 start_va = 0x16610000 end_va = 0x1664ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016610000" filename = "" Region: id = 11109 start_va = 0x16650000 end_va = 0x1674ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016650000" filename = "" Region: id = 11110 start_va = 0x44f00000 end_va = 0x44f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044f00000" filename = "" Region: id = 11111 start_va = 0x44f40000 end_va = 0x4503ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000044f40000" filename = "" Region: id = 11112 start_va = 0x45040000 end_va = 0x4507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045040000" filename = "" Region: id = 11113 start_va = 0x45080000 end_va = 0x4517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045080000" filename = "" Region: id = 11114 start_va = 0x45180000 end_va = 0x451bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045180000" filename = "" Region: id = 11115 start_va = 0x451c0000 end_va = 0x452bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000451c0000" filename = "" Region: id = 11116 start_va = 0x452c0000 end_va = 0x452fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000452c0000" filename = "" Region: id = 11117 start_va = 0x45300000 end_va = 0x453fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045300000" filename = "" Region: id = 11118 start_va = 0x45400000 end_va = 0x4543ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045400000" filename = "" Region: id = 11119 start_va = 0x45440000 end_va = 0x4553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045440000" filename = "" Region: id = 11120 start_va = 0x45540000 end_va = 0x4557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045540000" filename = "" Region: id = 11121 start_va = 0x45580000 end_va = 0x4567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045580000" filename = "" Region: id = 11122 start_va = 0x45680000 end_va = 0x456bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045680000" filename = "" Region: id = 11123 start_va = 0x456c0000 end_va = 0x457bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000456c0000" filename = "" Region: id = 11124 start_va = 0x457c0000 end_va = 0x457fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000457c0000" filename = "" Region: id = 11125 start_va = 0x45800000 end_va = 0x458fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045800000" filename = "" Region: id = 11126 start_va = 0x45900000 end_va = 0x4593ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045900000" filename = "" Region: id = 11127 start_va = 0x45940000 end_va = 0x45a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045940000" filename = "" Region: id = 11128 start_va = 0x45a40000 end_va = 0x45a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045a40000" filename = "" Region: id = 11129 start_va = 0x45a80000 end_va = 0x45b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045a80000" filename = "" Region: id = 11130 start_va = 0x45b80000 end_va = 0x45bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045b80000" filename = "" Region: id = 11131 start_va = 0x45bc0000 end_va = 0x45cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045bc0000" filename = "" Region: id = 11132 start_va = 0x45cc0000 end_va = 0x45cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045cc0000" filename = "" Region: id = 11133 start_va = 0x45d00000 end_va = 0x45dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045d00000" filename = "" Region: id = 11134 start_va = 0x45e00000 end_va = 0x45e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045e00000" filename = "" Region: id = 11135 start_va = 0x45e40000 end_va = 0x45f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045e40000" filename = "" Region: id = 11136 start_va = 0x45f40000 end_va = 0x45f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045f40000" filename = "" Region: id = 11137 start_va = 0x45f80000 end_va = 0x4607ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000045f80000" filename = "" Region: id = 11138 start_va = 0x46080000 end_va = 0x460bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046080000" filename = "" Region: id = 11139 start_va = 0x460c0000 end_va = 0x461bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000460c0000" filename = "" Region: id = 11140 start_va = 0x461c0000 end_va = 0x461fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000461c0000" filename = "" Region: id = 11141 start_va = 0x46200000 end_va = 0x462fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046200000" filename = "" Region: id = 11142 start_va = 0x46300000 end_va = 0x4633ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046300000" filename = "" Region: id = 11143 start_va = 0x46340000 end_va = 0x4643ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046340000" filename = "" Region: id = 11144 start_va = 0x46440000 end_va = 0x4647ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046440000" filename = "" Region: id = 11145 start_va = 0x46480000 end_va = 0x4657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046480000" filename = "" Region: id = 11146 start_va = 0x46580000 end_va = 0x465bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046580000" filename = "" Region: id = 11147 start_va = 0x465c0000 end_va = 0x466bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000465c0000" filename = "" Region: id = 11148 start_va = 0x466c0000 end_va = 0x466fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000466c0000" filename = "" Region: id = 11149 start_va = 0x46700000 end_va = 0x467fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046700000" filename = "" Region: id = 11150 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11151 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11152 start_va = 0x46800000 end_va = 0x4683ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046800000" filename = "" Region: id = 11153 start_va = 0x46840000 end_va = 0x4693ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046840000" filename = "" Region: id = 11154 start_va = 0x46940000 end_va = 0x4697ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046940000" filename = "" Region: id = 11155 start_va = 0x46980000 end_va = 0x46a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046980000" filename = "" Region: id = 11156 start_va = 0x46a80000 end_va = 0x46abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046a80000" filename = "" Region: id = 11157 start_va = 0x46ac0000 end_va = 0x46bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046ac0000" filename = "" Region: id = 11158 start_va = 0x46bc0000 end_va = 0x46bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046bc0000" filename = "" Region: id = 11159 start_va = 0x46c00000 end_va = 0x46cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046c00000" filename = "" Region: id = 11160 start_va = 0x46d00000 end_va = 0x46d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046d00000" filename = "" Region: id = 11161 start_va = 0x46d40000 end_va = 0x46e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046d40000" filename = "" Region: id = 11162 start_va = 0x46e40000 end_va = 0x46e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046e40000" filename = "" Region: id = 11163 start_va = 0x46e80000 end_va = 0x46f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046e80000" filename = "" Region: id = 11164 start_va = 0x46f80000 end_va = 0x46fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046f80000" filename = "" Region: id = 11165 start_va = 0x46fc0000 end_va = 0x470bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000046fc0000" filename = "" Region: id = 11166 start_va = 0x470c0000 end_va = 0x470fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000470c0000" filename = "" Region: id = 11167 start_va = 0x47100000 end_va = 0x471fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047100000" filename = "" Region: id = 11168 start_va = 0x47200000 end_va = 0x4723ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047200000" filename = "" Region: id = 11169 start_va = 0x47240000 end_va = 0x4733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047240000" filename = "" Region: id = 11170 start_va = 0x47340000 end_va = 0x4737ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047340000" filename = "" Region: id = 11171 start_va = 0x47380000 end_va = 0x4747ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047380000" filename = "" Region: id = 11172 start_va = 0x47480000 end_va = 0x474bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047480000" filename = "" Region: id = 11173 start_va = 0x474c0000 end_va = 0x475bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000474c0000" filename = "" Region: id = 11174 start_va = 0x475c0000 end_va = 0x475fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000475c0000" filename = "" Region: id = 11175 start_va = 0x47600000 end_va = 0x476fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047600000" filename = "" Region: id = 11176 start_va = 0x47700000 end_va = 0x4773ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047700000" filename = "" Region: id = 11177 start_va = 0x47740000 end_va = 0x4783ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047740000" filename = "" Region: id = 11178 start_va = 0x47840000 end_va = 0x4787ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047840000" filename = "" Region: id = 11179 start_va = 0x47880000 end_va = 0x4797ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047880000" filename = "" Region: id = 11180 start_va = 0x47980000 end_va = 0x479bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047980000" filename = "" Region: id = 11181 start_va = 0x479c0000 end_va = 0x47abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000479c0000" filename = "" Region: id = 11182 start_va = 0x47ac0000 end_va = 0x47afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047ac0000" filename = "" Region: id = 11183 start_va = 0x47b00000 end_va = 0x47bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047b00000" filename = "" Region: id = 11184 start_va = 0x47c00000 end_va = 0x47c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047c00000" filename = "" Region: id = 11185 start_va = 0x47c40000 end_va = 0x47d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047c40000" filename = "" Region: id = 11186 start_va = 0x47d40000 end_va = 0x47d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047d40000" filename = "" Region: id = 11187 start_va = 0x47d80000 end_va = 0x47e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047d80000" filename = "" Region: id = 11188 start_va = 0x47e80000 end_va = 0x47ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047e80000" filename = "" Region: id = 11189 start_va = 0x47ec0000 end_va = 0x47fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047ec0000" filename = "" Region: id = 11190 start_va = 0x47fc0000 end_va = 0x47ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000047fc0000" filename = "" Region: id = 11191 start_va = 0x48000000 end_va = 0x480fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000048000000" filename = "" Region: id = 11192 start_va = 0x48100000 end_va = 0x4813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000048100000" filename = "" Region: id = 11193 start_va = 0x48140000 end_va = 0x4823ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000048140000" filename = "" Region: id = 11194 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11195 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11196 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11197 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11198 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11199 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11200 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11201 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11202 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11203 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11204 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11205 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11206 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11207 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11208 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11209 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11210 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11211 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11212 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11213 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11214 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11215 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11216 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11217 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11218 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11219 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11220 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11221 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11222 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11223 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11224 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11225 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11226 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11227 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11228 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11229 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11230 start_va = 0x15590000 end_va = 0x155cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015590000" filename = "" Region: id = 11231 start_va = 0x15910000 end_va = 0x15a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015910000" filename = "" Region: id = 11232 start_va = 0x15a10000 end_va = 0x15a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a10000" filename = "" Region: id = 11233 start_va = 0x15a50000 end_va = 0x15b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 11234 start_va = 0x15b50000 end_va = 0x15b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b50000" filename = "" Region: id = 11235 start_va = 0x15b90000 end_va = 0x15c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015b90000" filename = "" Region: id = 11236 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11237 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11238 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11239 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11240 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11241 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11242 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11243 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11244 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11245 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11246 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11247 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11248 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11249 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11250 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11251 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11252 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11253 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11254 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11255 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11256 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11257 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11258 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11259 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11260 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11261 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11262 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11263 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11264 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11265 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11266 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11267 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11268 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11269 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11270 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 11271 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11272 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11273 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11274 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11275 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11276 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11277 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11278 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11279 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11280 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11281 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11282 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11283 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11284 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11285 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11286 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11287 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11288 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11289 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11290 start_va = 0x15550000 end_va = 0x1558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015550000" filename = "" Region: id = 11291 start_va = 0x15810000 end_va = 0x1590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015810000" filename = "" Region: id = 11292 start_va = 0x15c90000 end_va = 0x15ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015c90000" filename = "" Region: id = 11293 start_va = 0x15cd0000 end_va = 0x15dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015cd0000" filename = "" Region: id = 11294 start_va = 0x15dd0000 end_va = 0x15e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015dd0000" filename = "" Region: id = 11295 start_va = 0x15e10000 end_va = 0x15f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015e10000" filename = "" Region: id = 11296 start_va = 0x15f10000 end_va = 0x15f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f10000" filename = "" Region: id = 11297 start_va = 0x15f50000 end_va = 0x15f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f50000" filename = "" Region: id = 11298 start_va = 0x15f90000 end_va = 0x15fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015f90000" filename = "" Region: id = 11299 start_va = 0x16110000 end_va = 0x1620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016110000" filename = "" Region: id = 11300 start_va = 0x16210000 end_va = 0x1630ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016210000" filename = "" Region: id = 11301 start_va = 0x16310000 end_va = 0x1634ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016310000" filename = "" Region: id = 11302 start_va = 0x16350000 end_va = 0x1638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016350000" filename = "" Region: id = 11303 start_va = 0x164d0000 end_va = 0x165cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000164d0000" filename = "" Region: id = 11304 start_va = 0x165d0000 end_va = 0x166cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000165d0000" filename = "" Region: id = 11305 start_va = 0x166d0000 end_va = 0x167cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000166d0000" filename = "" Region: id = 11306 start_va = 0x167d0000 end_va = 0x1680ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000167d0000" filename = "" Region: id = 11307 start_va = 0x16810000 end_va = 0x1684ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016810000" filename = "" Region: id = 11308 start_va = 0x16850000 end_va = 0x1688ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000016850000" filename = "" Region: id = 11309 start_va = 0x21900000 end_va = 0x219fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021900000" filename = "" Region: id = 11310 start_va = 0x21a00000 end_va = 0x21a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000021a00000" filename = "" Region: id = 11311 start_va = 0x29b40000 end_va = 0x29b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000029b40000" filename = "" Region: id = 11312 start_va = 0x2d280000 end_va = 0x2d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d280000" filename = "" Region: id = 11313 start_va = 0x2d380000 end_va = 0x2d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d380000" filename = "" Region: id = 11314 start_va = 0x2d480000 end_va = 0x2d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d480000" filename = "" Region: id = 11315 start_va = 0x2d580000 end_va = 0x2d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002d580000" filename = "" Region: id = 11316 start_va = 0x3c740000 end_va = 0x3c77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c740000" filename = "" Region: id = 11317 start_va = 0x3c780000 end_va = 0x3c87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003c780000" filename = "" Region: id = 11318 start_va = 0x3d8c0000 end_va = 0x3d8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d8c0000" filename = "" Region: id = 11319 start_va = 0x3d900000 end_va = 0x3d9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003d900000" filename = "" Region: id = 11320 start_va = 0x3fbc0000 end_va = 0x3fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fbc0000" filename = "" Region: id = 11321 start_va = 0x3fc00000 end_va = 0x3fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000003fc00000" filename = "" Region: id = 11322 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11323 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11324 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11325 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11326 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11327 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11328 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11329 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11330 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11331 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11332 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11333 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11334 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11335 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11336 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11337 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11338 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11339 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11340 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11341 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11342 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11343 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11344 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11345 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11346 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11347 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 11348 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Thread: id = 1 os_tid = 0x1348 [0075.298] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0075.298] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0075.298] GetProcAddress (hModule=0x76910000, lpProcName="InitializeCriticalSectionEx") returned 0x769cd740 [0075.298] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0075.299] GetProcAddress (hModule=0x76910000, lpProcName="FlsAlloc") returned 0x769d4490 [0075.299] GetProcAddress (hModule=0x76910000, lpProcName="FlsSetValue") returned 0x769cd7a0 [0075.300] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0075.300] GetProcAddress (hModule=0x76910000, lpProcName="InitializeCriticalSectionEx") returned 0x769cd740 [0075.301] GetProcessHeap () returned 0x710000 [0075.301] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0075.301] GetProcAddress (hModule=0x76910000, lpProcName="FlsAlloc") returned 0x769d4490 [0075.301] GetLastError () returned 0x0 [0075.301] GetProcAddress (hModule=0x76910000, lpProcName="FlsGetValue") returned 0x769bf350 [0075.301] GetProcAddress (hModule=0x76910000, lpProcName="FlsSetValue") returned 0x769cd7a0 [0075.301] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x71f308 [0075.301] SetLastError (dwErrCode=0x0) [0075.301] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0xe00) returned 0x721df8 [0075.359] GetStartupInfoW (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0075.359] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0075.359] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0075.359] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0075.359] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe\" " [0075.359] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe\" " [0075.360] GetACP () returned 0x4e4 [0075.360] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x220) returned 0x71e1e8 [0075.360] IsValidCodePage (CodePage=0x4e4) returned 1 [0075.360] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19febc | out: lpCPInfo=0x19febc) returned 1 [0075.360] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f784 | out: lpCPInfo=0x19f784) returned 1 [0075.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\㏛∁) returned 256 [0075.360] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\㏛∁, cchSrc=256, lpCharType=0x19f798 | out: lpCharType=0x19f798) returned 1 [0075.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0075.360] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x76910000 [0075.360] GetProcAddress (hModule=0x76910000, lpProcName="LCMapStringEx") returned 0x769b95f0 [0075.360] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0075.361] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x19f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0075.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fc98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ;ü\x02 Ôþ\x19", lpUsedDefaultChar=0x0) returned 256 [0075.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ먫ijĀ") returned 256 [0075.361] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ먫ijĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0075.361] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ먫ijĀ", cchSrc=256, lpDestStr=0x19f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0075.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fb98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ;ü\x02 Ôþ\x19", lpUsedDefaultChar=0x0) returned 256 [0075.361] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x80) returned 0x71e410 [0075.361] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x134cea8, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe")) returned 0x62 [0075.361] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0xce) returned 0x71ed60 [0075.361] RtlInitializeSListHead (in: ListHead=0x134cdd0 | out: ListHead=0x134cdd0) [0075.361] GetLastError () returned 0x0 [0075.361] SetLastError (dwErrCode=0x0) [0075.361] GetEnvironmentStringsW () returned 0x71fe98* [0075.361] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa1a) returned 0x722c00 [0075.362] FreeEnvironmentStringsW (penv=0x71fe98) returned 1 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x90) returned 0x71e498 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3e) returned 0x71ee38 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x5c) returned 0x71ee80 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x6e) returned 0x71f678 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x78) returned 0x723c50 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x62) returned 0x71f6f0 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x28) returned 0x7164d8 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x48) returned 0x71f760 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1a) returned 0x71aa70 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3a) returned 0x71f7b0 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x62) returned 0x71f7f8 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2a) returned 0x71f868 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2e) returned 0x71f8a0 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1c) returned 0x71aa98 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0xd2) returned 0x71f8d8 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x7c) returned 0x71f9b8 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x36) returned 0x71fa40 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3a) returned 0x71fe98 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x90) returned 0x71fee0 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x24) returned 0x71ff78 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x30) returned 0x71ffa8 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x36) returned 0x71ffe0 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x48) returned 0x720020 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x52) returned 0x720070 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3c) returned 0x7200d0 [0075.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0xd6) returned 0x720118 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2e) returned 0x7201f8 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1e) returned 0x71acf0 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2c) returned 0x720230 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x54) returned 0x720268 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x52) returned 0x7202c8 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x24) returned 0x720328 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x42) returned 0x720358 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2c) returned 0x7203a8 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x44) returned 0x7203e0 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x24) returned 0x720430 [0075.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x722c00 | out: hHeap=0x710000) returned 1 [0075.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x800) returned 0x722c00 [0075.363] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0075.364] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13383fd) returned 0x0 [0075.364] GetStartupInfoW (in: lpStartupInfo=0x19ff00 | out: lpStartupInfo=0x19ff00*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0075.364] GetLastError () returned 0x0 [0075.364] SetLastError (dwErrCode=0x0) [0075.364] GetLastError () returned 0x0 [0075.364] SetLastError (dwErrCode=0x0) [0075.365] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x577020 [0095.627] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x577020 | out: hHeap=0x710000) returned 1 [0095.635] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x771d0000 [0095.636] LoadLibraryA (lpLibFileName="bcrypt.dll") returned 0x71560000 [0095.844] LoadLibraryA (lpLibFileName="netutils.dll") returned 0x6f8a0000 [0096.712] LoadLibraryA (lpLibFileName="srvcli.dll") returned 0x6f880000 [0098.634] LoadLibraryA (lpLibFileName="iphlpapi.dll") returned 0x71510000 [0099.015] LoadLibraryA (lpLibFileName="Ws2_32.dll") returned 0x73f30000 [0099.445] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74eb0000 [0111.221] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x6f860000 [0111.727] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x76600000 [0111.728] VirtualAlloc (lpAddress=0x0, dwSize=0x11c60, flAllocationType=0x1000, flProtect=0x4) returned 0x4d0000 [0111.728] VirtualAlloc (lpAddress=0x0, dwSize=0x15ea0, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0111.728] VirtualAlloc (lpAddress=0x0, dwSize=0x2bf20, flAllocationType=0x1000, flProtect=0x40) returned 0x510000 [0111.729] GetWindowsDirectoryA (in: lpBuffer=0x19d114, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0111.729] GetCurrentProcess () returned 0xffffffff [0111.729] K32EnumProcessModules (in: hProcess=0xffffffff, lphModule=0x19c00c, cb=0x1000, lpcbNeeded=0x19c008 | out: lphModule=0x19c00c, lpcbNeeded=0x19c008) returned 1 [0111.730] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x771d0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0111.730] GetModuleFileNameA (in: hModule=0x771d0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0111.730] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0111.730] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=1541280) returned 1 [0111.731] VirtualAlloc (lpAddress=0x0, dwSize=0x1784a0, flAllocationType=0x1000, flProtect=0x4) returned 0xc60000 [0111.731] ReadFile (in: hFile=0x1b4, lpBuffer=0xc60000, nNumberOfBytesToRead=0x1784a0, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0xc60000*, lpNumberOfBytesRead=0x19bd68*=0x1784a0, lpOverlapped=0x0) returned 1 [0111.814] CloseHandle (hObject=0x1b4) returned 1 [0111.814] GetProcAddress (hModule=0x771d0000, lpProcName="A_SHAFinal") returned 0x7722b4c0 [0111.814] GetProcAddress (hModule=0x771d0000, lpProcName="A_SHAInit") returned 0x7725bc90 [0111.814] GetProcAddress (hModule=0x771d0000, lpProcName="A_SHAUpdate") returned 0x7722b5a0 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcAdjustCompletionListConcurrencyCount") returned 0x77288310 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcFreeCompletionListMessage") returned 0x77288340 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcGetCompletionListLastMessageInformation") returned 0x77288430 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcGetCompletionListMessageAttributes") returned 0x77288460 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcGetHeaderSize") returned 0x77239fd0 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcGetMessageAttribute") returned 0x77239f50 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcGetMessageFromCompletionList") returned 0x772884a0 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcGetOutstandingCompletionListMessageCount") returned 0x77288610 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcInitializeMessageAttribute") returned 0x77239f90 [0111.815] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcMaxAllowedMessageLength") returned 0x77288630 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcRegisterCompletionList") returned 0x77288640 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcRegisterCompletionListWorkerThread") returned 0x77288690 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcRundownCompletionList") returned 0x77288710 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcUnregisterCompletionList") returned 0x77288730 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="AlpcUnregisterCompletionListWorkerThread") returned 0x77288750 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="ApiSetQueryApiSetPresence") returned 0x77229fe0 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="CsrAllocateCaptureBuffer") returned 0x77288180 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="CsrAllocateMessagePointer") returned 0x77288190 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="CsrCaptureMessageBuffer") returned 0x772881a0 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="CsrCaptureMessageMultiUnicodeStringsInPlace") returned 0x772881b0 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="CsrCaptureMessageString") returned 0x77288240 [0111.816] GetProcAddress (hModule=0x771d0000, lpProcName="CsrCaptureTimeout") returned 0x77288290 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="CsrClientCallServer") returned 0x772882c0 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="CsrClientConnectToServer") returned 0x7723a6a0 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="CsrFreeCaptureBuffer") returned 0x772882d0 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="CsrGetProcessId") returned 0x772882e0 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="CsrIdentifyAlertableThread") returned 0x772882f0 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="CsrSetPriorityClass") returned 0x7727d840 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="CsrVerifyRegion") returned 0x77288300 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="DbgBreakPoint") returned 0x77248e00 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="DbgPrint") returned 0x771f3870 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="DbgPrintEx") returned 0x771f3840 [0111.817] GetProcAddress (hModule=0x771d0000, lpProcName="DbgPrintReturnControlC") returned 0x772887d0 [0111.818] GetProcAddress (hModule=0x771d0000, lpProcName="DbgPrompt") returned 0x77288800 [0111.818] GetProcAddress (hModule=0x771d0000, lpProcName="DbgQueryDebugFilterState") returned 0x77288840 [0111.818] GetProcAddress (hModule=0x771d0000, lpProcName="DbgSetDebugFilterState") returned 0x77288850 [0111.818] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiConnectToDbg") returned 0x77279e70 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiContinue") returned 0x77279ed0 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiConvertStateChangeStructure") returned 0x77279f00 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiConvertStateChangeStructureEx") returned 0x77279f20 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiDebugActiveProcess") returned 0x7727a120 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiGetThreadDebugObject") returned 0x7727a170 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiIssueRemoteBreakin") returned 0x7727a190 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiRemoteBreakin") returned 0x7727a1e0 [0111.819] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiSetThreadDebugObject") returned 0x7727a240 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiStopDebugging") returned 0x7727a260 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUiWaitStateChange") returned 0x7727a290 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="DbgUserBreakPoint") returned 0x77248df0 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="EtwCreateTraceInstanceId") returned 0x772b55a0 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="EtwDeliverDataBlock") returned 0x77226180 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEnumerateProcessRegGuids") returned 0x772b5740 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventActivityIdControl") returned 0x7722afe0 [0111.820] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventEnabled") returned 0x7722db10 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventProviderEnabled") returned 0x772469e0 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventRegister") returned 0x77218c00 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventSetInformation") returned 0x77232570 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventUnregister") returned 0x7721f5c0 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWrite") returned 0x7722ae80 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWriteEndScenario") returned 0x772b5d70 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWriteEx") returned 0x771f3290 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWriteFull") returned 0x772b5840 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWriteNoRegistration") returned 0x771f4370 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWriteStartScenario") returned 0x772b5e50 [0111.821] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWriteString") returned 0x772b5880 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwEventWriteTransfer") returned 0x772361f0 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwGetTraceEnableFlags") returned 0x7723b190 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwGetTraceEnableLevel") returned 0x7723b1c0 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwGetTraceLoggerHandle") returned 0x77239e70 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwLogTraceEvent") returned 0x77245a10 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwNotificationRegister") returned 0x77219c70 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwNotificationUnregister") returned 0x7721e210 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwProcessPrivateLoggerRequest") returned 0x7723dfd0 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwRegisterSecurityProvider") returned 0x772b5af0 [0111.822] GetProcAddress (hModule=0x771d0000, lpProcName="EtwRegisterTraceGuidsA") returned 0x7723a9c0 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwRegisterTraceGuidsW") returned 0x772189c0 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwReplyNotification") returned 0x772b7520 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwSendNotification") returned 0x772b7560 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwSetMark") returned 0x771f33a0 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwTraceEventInstance") returned 0x772b5fb0 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwTraceMessage") returned 0x772307f0 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwTraceMessageVa") returned 0x77230820 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwUnregisterTraceGuids") returned 0x7721fa10 [0111.823] GetProcAddress (hModule=0x771d0000, lpProcName="EtwWriteUMSecurityEvent") returned 0x772b5b30 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="EtwpCreateEtwThread") returned 0x7723e530 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="EtwpGetCpuSpeed") returned 0x772b7b10 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="EvtIntReportAuthzEventAndSourceAsync") returned 0x772b7b30 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="EvtIntReportEventAndSourceAsync") returned 0x772b7b70 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="KiFastSystemCall") returned 0x77248ff0 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="KiFastSystemCallRet") returned 0x77249000 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="KiIntSystemCall") returned 0x77249010 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="KiRaiseUserExceptionDispatcher") returned 0x77248fa0 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="KiUserApcDispatcher") returned 0x77248e30 [0111.824] GetProcAddress (hModule=0x771d0000, lpProcName="KiUserCallbackDispatcher") returned 0x77248f00 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="KiUserExceptionDispatcher") returned 0x77248f50 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrAccessResource") returned 0x7725bd60 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrAddDllDirectory") returned 0x77286e20 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrAddLoadAsDataTable") returned 0x77228850 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrAddRefDll") returned 0x77225020 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrAppxHandleIntegrityFailure") returned 0x77278a30 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrDisableThreadCalloutsForDll") returned 0x772349a0 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrEnumResources") returned 0x772888c0 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrEnumerateLoadedModules") returned 0x77226d80 [0111.825] GetProcAddress (hModule=0x771d0000, lpProcName="LdrFastFailInLoaderCallout") returned 0x7727a8e0 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrFindEntryForAddress") returned 0x7720faf0 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrFindResourceDirectory_U") returned 0x77288af0 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrFindResourceEx_U") returned 0x7723b500 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrFindResource_U") returned 0x7720c880 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrFlushAlternateResourceModules") returned 0x77288b20 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetDllDirectory") returned 0x771f3790 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetDllFullName") returned 0x77210ed0 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetDllHandle") returned 0x7720b7d0 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetDllHandleByMapping") returned 0x77233bd0 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetDllHandleByName") returned 0x77233880 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetDllHandleEx") returned 0x7720b660 [0111.826] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetDllPath") returned 0x7721ca40 [0111.827] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetFailureData") returned 0x7727a910 [0111.827] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetFileNameFromLoadAsDataTable") returned 0x77288c40 [0111.827] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetProcedureAddress") returned 0x7723a3c0 [0111.827] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetProcedureAddressEx") returned 0x77227580 [0111.827] GetProcAddress (hModule=0x771d0000, lpProcName="LdrGetProcedureAddressForCaller") returned 0x7720cc70 [0111.827] GetProcAddress (hModule=0x771d0000, lpProcName="LdrInitShimEngineDynamic") returned 0x7727c7d0 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrInitializeThunk") returned 0x77234420 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrLoadAlternateResourceModule") returned 0x77288c90 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrLoadAlternateResourceModuleEx") returned 0x7720c280 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrLoadDll") returned 0x772134d0 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrLockLoaderLock") returned 0x77229030 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrOpenImageFileOptionsKey") returned 0x77289b20 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrProcessRelocationBlock") returned 0x77289f20 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrProcessRelocationBlockEx") returned 0x77289f50 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrQueryImageFileExecutionOptions") returned 0x77236e50 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrQueryImageFileExecutionOptionsEx") returned 0x77236e90 [0111.916] GetProcAddress (hModule=0x771d0000, lpProcName="LdrQueryImageFileKeyOption") returned 0x77237080 [0111.917] GetProcAddress (hModule=0x771d0000, lpProcName="LdrQueryModuleServiceTags") returned 0x7727aa60 [0111.917] GetProcAddress (hModule=0x771d0000, lpProcName="LdrQueryOptionalDelayLoadedAPI") returned 0x7727b630 [0111.917] GetProcAddress (hModule=0x771d0000, lpProcName="LdrQueryProcessModuleInformation") returned 0x7727ab00 [0111.917] GetProcAddress (hModule=0x771d0000, lpProcName="LdrRegisterDllNotification") returned 0x77234ff0 [0111.917] GetProcAddress (hModule=0x771d0000, lpProcName="LdrRemoveDllDirectory") returned 0x77286ff0 [0111.917] GetProcAddress (hModule=0x771d0000, lpProcName="LdrRemoveLoadAsDataTable") returned 0x77228700 [0111.917] GetProcAddress (hModule=0x771d0000, lpProcName="LdrResFindResource") returned 0x7728a570 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrResFindResourceDirectory") returned 0x77214900 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrResGetRCConfig") returned 0x772144d0 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrResRelease") returned 0x7728a5d0 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrResSearchResource") returned 0x77212ac0 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrResolveDelayLoadedAPI") returned 0x7720caa0 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrResolveDelayLoadsFromDll") returned 0x7727b710 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrRscIsTypeExist") returned 0x7720f4a0 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrSetAppCompatDllRedirectionCallback") returned 0x7725be90 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrSetDefaultDllDirectories") returned 0x772413b0 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrSetDllDirectory") returned 0x77230d20 [0111.918] GetProcAddress (hModule=0x771d0000, lpProcName="LdrSetDllManifestProber") returned 0x7723b6c0 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrSetImplicitPathOptions") returned 0x7727afb0 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrSetMUICacheType") returned 0x77288fd0 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrShutdownProcess") returned 0x77224170 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrShutdownThread") returned 0x7720ab00 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrStandardizeSystemPath") returned 0x77214960 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrSystemDllInitBlock") returned 0x772dc230 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrUnloadAlternateResourceModule") returned 0x772217c0 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrUnloadAlternateResourceModuleEx") returned 0x772207b0 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrUnloadDll") returned 0x772210d0 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrUnlockLoaderLock") returned 0x77238cf0 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrUnregisterDllNotification") returned 0x7727b020 [0111.919] GetProcAddress (hModule=0x771d0000, lpProcName="LdrVerifyImageMatchesChecksum") returned 0x7727b0a0 [0111.920] GetProcAddress (hModule=0x771d0000, lpProcName="LdrVerifyImageMatchesChecksumEx") returned 0x7727b110 [0111.920] GetProcAddress (hModule=0x771d0000, lpProcName="LdrWx86FormatVirtualImage") returned 0x77281cb0 [0111.920] GetProcAddress (hModule=0x771d0000, lpProcName="LdrpResGetMappingSize") returned 0x77212970 [0111.920] GetProcAddress (hModule=0x771d0000, lpProcName="LdrpResGetResourceDirectory") returned 0x772113d0 [0111.920] GetProcAddress (hModule=0x771d0000, lpProcName="MD4Final") returned 0x772b4820 [0111.920] GetProcAddress (hModule=0x771d0000, lpProcName="MD4Init") returned 0x772b48c0 [0111.920] GetProcAddress (hModule=0x771d0000, lpProcName="MD4Update") returned 0x772b4900 [0111.921] GetProcAddress (hModule=0x771d0000, lpProcName="MD5Final") returned 0x7723d630 [0111.921] GetProcAddress (hModule=0x771d0000, lpProcName="MD5Init") returned 0x77240b60 [0111.921] GetProcAddress (hModule=0x771d0000, lpProcName="MD5Update") returned 0x7723d6d0 [0111.921] GetProcAddress (hModule=0x771d0000, lpProcName="NlsAnsiCodePage") returned 0x772d97d2 [0111.921] GetProcAddress (hModule=0x771d0000, lpProcName="NlsMbCodePageTag") returned 0x772d97c8 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NlsMbOemCodePageTag") returned 0x772d9c22 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAcceptConnectPort") returned 0x77246ca0 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAccessCheck") returned 0x77246c80 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAccessCheckAndAuditAlarm") returned 0x77246f30 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAccessCheckByType") returned 0x772472d0 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAccessCheckByTypeAndAuditAlarm") returned 0x77247230 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAccessCheckByTypeResultList") returned 0x772472e0 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAccessCheckByTypeResultListAndAuditAlarm") returned 0x772472f0 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAccessCheckByTypeResultListAndAuditAlarmByHandle") returned 0x77247300 [0111.922] GetProcAddress (hModule=0x771d0000, lpProcName="NtAddAtom") returned 0x77247110 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAddAtomEx") returned 0x77247310 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAddBootEntry") returned 0x77247320 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAddDriverEntry") returned 0x77247330 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAdjustGroupsToken") returned 0x77247340 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAdjustPrivilegesToken") returned 0x772470b0 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAdjustTokenClaimsAndDeviceGroups") returned 0x77247350 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlertResumeThread") returned 0x77247360 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlertThread") returned 0x77247370 [0111.923] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlertThreadByThreadId") returned 0x77247380 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAllocateLocallyUniqueId") returned 0x77247390 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAllocateReserveObject") returned 0x772473a0 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAllocateUserPhysicalPages") returned 0x772473b0 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAllocateUuids") returned 0x772473c0 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAllocateVirtualMemory") returned 0x77246e00 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcAcceptConnectPort") returned 0x772473d0 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcCancelMessage") returned 0x772473e0 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcConnectPort") returned 0x772473f0 [0111.924] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcConnectPortEx") returned 0x77247400 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcCreatePort") returned 0x77247410 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcCreatePortSection") returned 0x77247420 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcCreateResourceReserve") returned 0x77247430 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcCreateSectionView") returned 0x77247440 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcCreateSecurityContext") returned 0x77247450 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcDeletePortSection") returned 0x77247460 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcDeleteResourceReserve") returned 0x77247470 [0111.925] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcDeleteSectionView") returned 0x77247480 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcDeleteSecurityContext") returned 0x77247490 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcDisconnectPort") returned 0x772474a0 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcImpersonateClientContainerOfPort") returned 0x772474b0 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcImpersonateClientOfPort") returned 0x772474c0 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcOpenSenderProcess") returned 0x772474d0 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcOpenSenderThread") returned 0x772474e0 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcQueryInformation") returned 0x772474f0 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcQueryInformationMessage") returned 0x77247500 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcRevokeSecurityContext") returned 0x77247510 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcSendWaitReceivePort") returned 0x77247520 [0111.926] GetProcAddress (hModule=0x771d0000, lpProcName="NtAlpcSetInformation") returned 0x77247530 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtApphelpCacheControl") returned 0x77247160 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtAreMappedFilesTheSame") returned 0x77247540 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtAssignProcessToJobObject") returned 0x77247550 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtAssociateWaitCompletionPacket") returned 0x77247560 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtCallbackReturn") returned 0x77246cd0 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtCancelIoFile") returned 0x77247270 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtCancelIoFileEx") returned 0x77247570 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtCancelSynchronousIoFile") returned 0x77247580 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtCancelTimer") returned 0x772472b0 [0111.927] GetProcAddress (hModule=0x771d0000, lpProcName="NtCancelTimer2") returned 0x77247590 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCancelWaitCompletionPacket") returned 0x772475a0 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtClearEvent") returned 0x77247080 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtClose") returned 0x77246d70 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCloseObjectAuditAlarm") returned 0x77247050 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCommitComplete") returned 0x772475b0 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCommitEnlistment") returned 0x772475c0 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCommitTransaction") returned 0x772475d0 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCompactKeys") returned 0x772475e0 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCompareObjects") returned 0x772475f0 [0111.928] GetProcAddress (hModule=0x771d0000, lpProcName="NtCompareTokens") returned 0x77247600 [0111.929] GetProcAddress (hModule=0x771d0000, lpProcName="NtCompleteConnectPort") returned 0x77247610 [0111.929] GetProcAddress (hModule=0x771d0000, lpProcName="NtCompressKey") returned 0x77247620 [0111.929] GetProcAddress (hModule=0x771d0000, lpProcName="NtConnectPort") returned 0x77247630 [0111.929] GetProcAddress (hModule=0x771d0000, lpProcName="NtContinue") returned 0x772470d0 [0111.929] GetProcAddress (hModule=0x771d0000, lpProcName="NtCreateDebugObject") returned 0x77247640 [0111.947] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76720000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.DLL" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0111.947] GetModuleFileNameA (in: hModule=0x76720000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.DLL" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0111.947] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\KERNEL32.DLL" (normalized: "c:\\windows\\syswow64\\kernel32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0111.948] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=620176) returned 1 [0111.948] VirtualAlloc (lpAddress=0x0, dwSize=0x97690, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0111.948] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x97690, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x97690, lpOverlapped=0x0) returned 1 [0112.142] CloseHandle (hObject=0x1b4) returned 1 [0112.142] GetProcAddress (hModule=0x76720000, lpProcName="AcquireSRWLockExclusive") returned 0x7721d210 [0112.142] GetProcAddress (hModule=0x76720000, lpProcName="AcquireSRWLockShared") returned 0x772046f0 [0112.142] GetProcAddress (hModule=0x76720000, lpProcName="ActivateActCtx") returned 0x7673d0a0 [0112.142] GetProcAddress (hModule=0x76720000, lpProcName="ActivateActCtxWorker") returned 0x76738550 [0112.143] GetProcAddress (hModule=0x76720000, lpProcName="AddAtomA") returned 0x7673ff60 [0112.143] GetProcAddress (hModule=0x76720000, lpProcName="AddAtomW") returned 0x7673cd30 [0112.143] GetProcAddress (hModule=0x76720000, lpProcName="AddConsoleAliasA") returned 0x76784d80 [0112.143] GetProcAddress (hModule=0x76720000, lpProcName="AddConsoleAliasW") returned 0x76784ed0 [0112.143] GetProcAddress (hModule=0x76720000, lpProcName="AddDllDirectory") returned 0x76a445e0 [0112.145] GetProcAddress (hModule=0x76720000, lpProcName="AddIntegrityLabelToBoundaryDescriptor") returned 0x767628b0 [0112.145] GetProcAddress (hModule=0x76720000, lpProcName="AddLocalAlternateComputerNameA") returned 0x76757c60 [0112.145] GetProcAddress (hModule=0x76720000, lpProcName="AddLocalAlternateComputerNameW") returned 0x76757cb0 [0112.145] GetProcAddress (hModule=0x76720000, lpProcName="AddRefActCtx") returned 0x767603f0 [0112.145] GetProcAddress (hModule=0x76720000, lpProcName="AddRefActCtxWorker") returned 0x7673e050 [0112.147] GetProcAddress (hModule=0x76720000, lpProcName="AddResourceAttributeAce") returned 0x76760400 [0112.147] GetProcAddress (hModule=0x76720000, lpProcName="AddSIDToBoundaryDescriptor") returned 0x7673b270 [0112.147] GetProcAddress (hModule=0x76720000, lpProcName="AddScopedPolicyIDAce") returned 0x76760420 [0112.147] GetProcAddress (hModule=0x76720000, lpProcName="AddSecureMemoryCacheCallback") returned 0x7675cf80 [0112.147] GetProcAddress (hModule=0x76720000, lpProcName="AddVectoredContinueHandler") returned 0x772828d0 [0112.147] GetProcAddress (hModule=0x76720000, lpProcName="AddVectoredExceptionHandler") returned 0x771f3f90 [0112.147] GetProcAddress (hModule=0x76720000, lpProcName="AdjustCalendarDate") returned 0x76774210 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="AllocConsole") returned 0x76746f50 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="AllocateUserPhysicalPages") returned 0x76760460 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="AllocateUserPhysicalPagesNuma") returned 0x76760440 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="AppXGetOSMaxVersionTested") returned 0x769a9f10 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="ApplicationRecoveryFinished") returned 0x7676c730 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="ApplicationRecoveryInProgress") returned 0x7676c750 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="AreFileApisANSI") returned 0x7673f300 [0112.148] GetProcAddress (hModule=0x76720000, lpProcName="AssignProcessToJobObject") returned 0x7676b300 [0112.149] GetProcAddress (hModule=0x76720000, lpProcName="AttachConsole") returned 0x76747030 [0112.149] GetProcAddress (hModule=0x76720000, lpProcName="BackupRead") returned 0x76755e60 [0112.149] GetProcAddress (hModule=0x76720000, lpProcName="BackupSeek") returned 0x76756b50 [0112.149] GetProcAddress (hModule=0x76720000, lpProcName="BackupWrite") returned 0x76756db0 [0112.149] GetProcAddress (hModule=0x76720000, lpProcName="BaseCheckAppcompatCache") returned 0x767604a0 [0112.149] GetProcAddress (hModule=0x76720000, lpProcName="BaseCheckAppcompatCacheEx") returned 0x76760480 [0112.149] GetProcAddress (hModule=0x76720000, lpProcName="BaseCheckAppcompatCacheExWorker") returned 0x76772dc0 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseCheckAppcompatCacheWorker") returned 0x76772dd0 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseCheckElevation") returned 0x7673d7f0 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseCleanupAppcompatCacheSupport") returned 0x767604c0 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseCleanupAppcompatCacheSupportWorker") returned 0x76772de0 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseDestroyVDMEnvironment") returned 0x76767330 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseDllReadWriteIniFile") returned 0x76740fc0 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseDumpAppcompatCache") returned 0x767604e0 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseDumpAppcompatCacheWorker") returned 0x76745e90 [0112.150] GetProcAddress (hModule=0x76720000, lpProcName="BaseElevationPostProcessing") returned 0x7673b190 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseFlushAppcompatCache") returned 0x767604f0 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseFlushAppcompatCacheWorker") returned 0x76772df0 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseFormatObjectAttributes") returned 0x76744ba0 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseFormatTimeOut") returned 0x76782f80 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseFreeAppCompatDataForProcessWorker") returned 0x76740020 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseGenerateAppCompatData") returned 0x7673e1e0 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseGetNamedObjectDirectory") returned 0x76760500 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseInitAppcompatCacheSupport") returned 0x76760520 [0112.151] GetProcAddress (hModule=0x76720000, lpProcName="BaseInitAppcompatCacheSupportWorker") returned 0x76748110 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseIsAppcompatInfrastructureDisabled") returned 0x7673fec0 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseIsAppcompatInfrastructureDisabledWorker") returned 0x7673fec0 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseIsDosApplication") returned 0x767675b0 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseQueryModuleData") returned 0x7673e240 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseReadAppCompatDataForProcessWorker") returned 0x76772e70 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseSetLastNTError") returned 0x767323b0 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseThreadInitThunk") returned 0x767338d0 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseUpdateAppcompatCache") returned 0x76760530 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseUpdateAppcompatCacheWorker") returned 0x76773130 [0112.152] GetProcAddress (hModule=0x76720000, lpProcName="BaseUpdateVDMEntry") returned 0x76767680 [0112.153] GetProcAddress (hModule=0x76720000, lpProcName="BaseVerifyUnicodeString") returned 0x767831d0 [0112.153] GetProcAddress (hModule=0x76720000, lpProcName="BaseWriteErrorElevationRequiredEvent") returned 0x7675af30 [0112.153] GetProcAddress (hModule=0x76720000, lpProcName="Basep8BitStringToDynamicUnicodeString") returned 0x76743d50 [0112.153] GetProcAddress (hModule=0x76720000, lpProcName="BasepAllocateActivationContextActivationBlock") returned 0x76783230 [0112.153] GetProcAddress (hModule=0x76720000, lpProcName="BasepAnsiStringToDynamicUnicodeString") returned 0x76783170 [0112.153] GetProcAddress (hModule=0x76720000, lpProcName="BasepAppContainerEnvironmentExtension") returned 0x76730010 [0112.153] GetProcAddress (hModule=0x76720000, lpProcName="BasepAppXExtension") returned 0x7675ee30 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepCheckAppCompat") returned 0x7673dc00 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepCheckWebBladeHashes") returned 0x7673b130 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepCheckWinSaferRestrictions") returned 0x7673a2d0 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepConstructSxsCreateProcessMessage") returned 0x76738fc0 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepCopyEncryption") returned 0x7675c0a0 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepFreeActivationContextActivationBlock") returned 0x76783330 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepFreeAppCompatData") returned 0x7673ad10 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepGetAppCompatData") returned 0x76735070 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepGetComputerNameFromNtPath") returned 0x76744520 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepGetExeArchType") returned 0x7673dc90 [0112.154] GetProcAddress (hModule=0x76720000, lpProcName="BasepIsProcessAllowed") returned 0x7673a9c0 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepMapModuleHandle") returned 0x76783370 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepNotifyLoadStringResource") returned 0x76733e00 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepPostSuccessAppXExtension") returned 0x7675ee80 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepProcessInvalidImage") returned 0x7675eeb0 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepQueryAppCompat") returned 0x76735990 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepReleaseAppXContext") returned 0x7675f4c0 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepReleaseSxsCreateProcessUtilityStruct") returned 0x7673a060 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepReportFault") returned 0x7676cb20 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="BasepSetFileEncryptionCompression") returned 0x76744950 [0112.155] GetProcAddress (hModule=0x76720000, lpProcName="Beep") returned 0x76757b00 [0112.156] GetProcAddress (hModule=0x76720000, lpProcName="BeginUpdateResourceA") returned 0x767726d0 [0112.156] GetProcAddress (hModule=0x76720000, lpProcName="BeginUpdateResourceW") returned 0x76772720 [0112.156] GetProcAddress (hModule=0x76720000, lpProcName="BindIoCompletionCallback") returned 0x76744fc0 [0112.156] GetProcAddress (hModule=0x76720000, lpProcName="BuildCommDCBA") returned 0x7676a210 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="BuildCommDCBAndTimeoutsA") returned 0x7676a250 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="BuildCommDCBAndTimeoutsW") returned 0x7676a280 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="BuildCommDCBW") returned 0x7676a2f0 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CallNamedPipeA") returned 0x7675dae0 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CallNamedPipeW") returned 0x76746ce0 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CallbackMayRunLong") returned 0x76760550 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CancelDeviceWakeupRequest") returned 0x7675eda0 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CancelIo") returned 0x76760580 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CancelIoEx") returned 0x7673f450 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CancelSynchronousIo") returned 0x767605a0 [0112.157] GetProcAddress (hModule=0x76720000, lpProcName="CancelThreadpoolIo") returned 0x7721cd00 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CancelTimerQueueTimer") returned 0x7676ca80 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CancelWaitableTimer") returned 0x76746670 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CeipIsOptedIn") returned 0x769d5d70 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="ChangeTimerQueueTimer") returned 0x767605c0 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckAllowDecryptedRemoteDestinationPolicy") returned 0x767605e0 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckElevation") returned 0x7673d700 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckElevationEnabled") returned 0x7673f8f0 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckForReadOnlyResource") returned 0x767628e0 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckForReadOnlyResourceFilter") returned 0x76762a10 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckNameLegalDOS8Dot3A") returned 0x7675e610 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckNameLegalDOS8Dot3W") returned 0x7675e690 [0112.158] GetProcAddress (hModule=0x76720000, lpProcName="CheckRemoteDebuggerPresent") returned 0x7673f3f0 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="CheckTokenCapability") returned 0x767605f0 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="CheckTokenMembershipEx") returned 0x76760610 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="ClearCommBreak") returned 0x76746d80 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="ClearCommError") returned 0x76746d90 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="CloseConsoleHandle") returned 0x767857e0 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="ClosePackageInfo") returned 0x769acb60 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="ClosePrivateNamespace") returned 0x7673fd50 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="CloseProfileUserMapping") returned 0x76748110 [0112.159] GetProcAddress (hModule=0x76720000, lpProcName="CloseState") returned 0x769ad910 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CloseThreadpool") returned 0x7723b1f0 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CloseThreadpoolCleanupGroup") returned 0x771f32d0 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CloseThreadpoolCleanupGroupMembers") returned 0x771f31d0 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CloseThreadpoolIo") returned 0x77223950 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CloseThreadpoolTimer") returned 0x77222a50 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CloseThreadpoolWait") returned 0x77222910 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CloseThreadpoolWork") returned 0x77220550 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CmdBatNotification") returned 0x7675dad0 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CommConfigDialogA") returned 0x76765200 [0112.160] GetProcAddress (hModule=0x76720000, lpProcName="CommConfigDialogW") returned 0x76765280 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="CompareCalendarDates") returned 0x767744e0 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="CompareFileTime") returned 0x76746840 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="CompareStringA") returned 0x7673e1c0 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="CompareStringEx") returned 0x7673ff80 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="CompareStringOrdinal") returned 0x76738f60 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="CompareStringW") returned 0x76742630 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="ConnectNamedPipe") returned 0x76745e30 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="ConsoleMenuControl") returned 0x767858a0 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="ContinueDebugEvent") returned 0x76760630 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="ConvertCalDateTimeToSystemTime") returned 0x76774580 [0112.161] GetProcAddress (hModule=0x76720000, lpProcName="ConvertDefaultLocale") returned 0x76760650 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="ConvertFiberToThread") returned 0x76746ed0 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="ConvertNLSDayOfWeekToWin32DayOfWeek") returned 0x76774640 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="ConvertSystemTimeToCalDateTime") returned 0x76774670 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="ConvertThreadToFiber") returned 0x76746ee0 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="ConvertThreadToFiberEx") returned 0x76746ef0 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="CopyContext") returned 0x76760670 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="CopyFile2") returned 0x76760690 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="CopyFileA") returned 0x7673f780 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="CopyFileExA") returned 0x7675c190 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="CopyFileExW") returned 0x7673ffc0 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="CopyFileTransactedA") returned 0x7675c200 [0112.162] GetProcAddress (hModule=0x76720000, lpProcName="CopyFileTransactedW") returned 0x7675c290 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CopyFileW") returned 0x76746ec0 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CopyLZFile") returned 0x767590a0 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateActCtxA") returned 0x7673f0c0 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateActCtxW") returned 0x76745030 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateActCtxWWorker") returned 0x76737ab0 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateBoundaryDescriptorA") returned 0x76762a40 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateBoundaryDescriptorW") returned 0x7673b170 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateConsoleScreenBuffer") returned 0x76747040 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateDirectoryA") returned 0x76746850 [0112.163] GetProcAddress (hModule=0x76720000, lpProcName="CreateDirectoryExA") returned 0x767594b0 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateDirectoryExW") returned 0x767606b0 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateDirectoryTransactedA") returned 0x76759510 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateDirectoryTransactedW") returned 0x76759590 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateDirectoryW") returned 0x76746860 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateEnclave") returned 0x767465f0 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateEventA") returned 0x76746680 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateEventExA") returned 0x76746690 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateEventExW") returned 0x767466a0 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateEventW") returned 0x767466b0 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateFiber") returned 0x76746f00 [0112.164] GetProcAddress (hModule=0x76720000, lpProcName="CreateFiberEx") returned 0x76746f10 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFile2") returned 0x76746870 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileA") returned 0x76746880 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileMappingA") returned 0x767379c0 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileMappingFromApp") returned 0x769d67b0 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileMappingNumaA") returned 0x7675b520 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileMappingNumaW") returned 0x767606d0 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileMappingW") returned 0x767399b0 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileTransactedA") returned 0x7675c4d0 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileTransactedW") returned 0x7675c530 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileW") returned 0x76746890 [0112.165] GetProcAddress (hModule=0x76720000, lpProcName="CreateHardLinkA") returned 0x767606f0 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateHardLinkTransactedA") returned 0x7676bf70 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateHardLinkTransactedW") returned 0x7676bff0 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateHardLinkW") returned 0x76760710 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateIoCompletionPort") returned 0x76744fa0 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateJobObjectA") returned 0x7676b750 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateJobObjectW") returned 0x7676b7a0 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateJobSet") returned 0x7676b890 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateMailslotA") returned 0x7675d4d0 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateMailslotW") returned 0x7675d520 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateMemoryResourceNotification") returned 0x7673b290 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateMutexA") returned 0x767466c0 [0112.166] GetProcAddress (hModule=0x76720000, lpProcName="CreateMutexExA") returned 0x767466d0 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateMutexExW") returned 0x767466e0 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateMutexW") returned 0x767466f0 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateNamedPipeA") returned 0x76745ce0 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateNamedPipeW") returned 0x76760730 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreatePipe") returned 0x76730540 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreatePrivateNamespaceA") returned 0x76762aa0 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreatePrivateNamespaceW") returned 0x7673b0c0 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessA") returned 0x76760750 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessAsUserA") returned 0x76760770 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessAsUserW") returned 0x76760790 [0112.167] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessInternalA") returned 0x767607b0 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessInternalW") returned 0x767607d0 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessW") returned 0x7673b000 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateRemoteThread") returned 0x767607f0 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateRemoteThreadEx") returned 0x769bfc10 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSemaphoreA") returned 0x7673d100 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSemaphoreExA") returned 0x7673d130 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSemaphoreExW") returned 0x76746700 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSemaphoreW") returned 0x76746710 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSocketHandle") returned 0x7676c080 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSymbolicLinkA") returned 0x7675b700 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSymbolicLinkTransactedA") returned 0x7675b780 [0112.168] GetProcAddress (hModule=0x76720000, lpProcName="CreateSymbolicLinkTransactedW") returned 0x7675b810 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateSymbolicLinkW") returned 0x76760830 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateTapePartition") returned 0x7676b040 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateThread") returned 0x76739b90 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateThreadpool") returned 0x767608a0 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateThreadpoolCleanupGroup") returned 0x76760850 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateThreadpoolIo") returned 0x76760880 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateThreadpoolTimer") returned 0x7673ace0 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateThreadpoolWait") returned 0x7673a7b0 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateThreadpoolWork") returned 0x7673ea00 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateTimerQueue") returned 0x767608d0 [0112.169] GetProcAddress (hModule=0x76720000, lpProcName="CreateTimerQueueTimer") returned 0x7673a920 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="CreateToolhelp32Snapshot") returned 0x76747b50 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="CreateWaitableTimerA") returned 0x7673e560 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="CreateWaitableTimerExA") returned 0x7673e590 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="CreateWaitableTimerExW") returned 0x76746720 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="CreateWaitableTimerW") returned 0x7673f3c0 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="CtrlRoutine") returned 0x76a2a840 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="DeactivateActCtx") returned 0x7673d080 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="DeactivateActCtxWorker") returned 0x76738510 [0112.170] GetProcAddress (hModule=0x76720000, lpProcName="DebugActiveProcess") returned 0x76760900 [0112.291] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76910000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0112.291] GetModuleFileNameA (in: hModule=0x76910000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0112.291] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.291] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=1557768) returned 1 [0112.291] VirtualAlloc (lpAddress=0x0, dwSize=0x17c508, flAllocationType=0x1000, flProtect=0x4) returned 0xc60000 [0112.292] ReadFile (in: hFile=0x1b4, lpBuffer=0xc60000, nNumberOfBytesToRead=0x17c508, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0xc60000*, lpNumberOfBytesRead=0x19bd68*=0x17c508, lpOverlapped=0x0) returned 1 [0112.333] CloseHandle (hObject=0x1b4) returned 1 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AccessCheck") returned 0x769d3de0 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AccessCheckAndAuditAlarmW") returned 0x76a433e0 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AccessCheckByType") returned 0x769d4c60 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AccessCheckByTypeAndAuditAlarmW") returned 0x76a43490 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AccessCheckByTypeResultList") returned 0x76a43540 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AccessCheckByTypeResultListAndAuditAlarmByHandleW") returned 0x76a435c0 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AccessCheckByTypeResultListAndAuditAlarmW") returned 0x76a43680 [0112.334] GetProcAddress (hModule=0x76910000, lpProcName="AcquireSRWLockExclusive") returned 0x7721d210 [0112.335] GetProcAddress (hModule=0x76910000, lpProcName="AcquireSRWLockShared") returned 0x772046f0 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="AcquireStateLock") returned 0x76a31e20 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="ActivateActCtx") returned 0x769d2c60 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="AddAccessAllowedAce") returned 0x769d2ea0 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="AddAccessAllowedAceEx") returned 0x769e2000 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="AddAccessAllowedObjectAce") returned 0x76a43740 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="AddAccessDeniedAce") returned 0x76a43790 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="AddAccessDeniedAceEx") returned 0x76a437d0 [0112.336] GetProcAddress (hModule=0x76910000, lpProcName="AddAccessDeniedObjectAce") returned 0x76a43820 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddAce") returned 0x769d5bf0 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddAuditAccessAce") returned 0x76a43870 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddAuditAccessAceEx") returned 0x76a438b0 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddAuditAccessObjectAce") returned 0x76a43900 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddDllDirectory") returned 0x76a445e0 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddMandatoryAce") returned 0x769e04f0 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddRefActCtx") returned 0x769df600 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddResourceAttributeAce") returned 0x76a43960 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddSIDToBoundaryDescriptor") returned 0x769d6bc0 [0112.337] GetProcAddress (hModule=0x76910000, lpProcName="AddScopedPolicyIDAce") returned 0x76a439a0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AddVectoredContinueHandler") returned 0x772828d0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AddVectoredExceptionHandler") returned 0x771f3f90 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AdjustTokenGroups") returned 0x76a439e0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AdjustTokenPrivileges") returned 0x769e24d0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AllocConsole") returned 0x76a296a0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AllocateAndInitializeSid") returned 0x769d2530 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AllocateLocallyUniqueId") returned 0x769e34f0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AllocateUserPhysicalPages") returned 0x76a462a0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AllocateUserPhysicalPagesNuma") returned 0x76a462d0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AppContainerDeriveSidFromMoniker") returned 0x769a96f0 [0112.338] GetProcAddress (hModule=0x76910000, lpProcName="AppContainerFreeMemory") returned 0x769a9ef0 [0112.339] GetProcAddress (hModule=0x76910000, lpProcName="AppContainerLookupDisplayNameMrtReference") returned 0x76a3a3d0 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppContainerLookupMoniker") returned 0x769a9300 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppContainerRegisterSid") returned 0x76a3a460 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppContainerUnregisterSid") returned 0x76a3a4c0 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppXFreeMemory") returned 0x769a9ef0 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppXGetApplicationData") returned 0x76a3a4f0 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppXGetDevelopmentMode") returned 0x76a3a630 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppXGetOSMaxVersionTested") returned 0x769a9f10 [0112.356] GetProcAddress (hModule=0x76910000, lpProcName="AppXGetOSMinVersion") returned 0x76a3a6b0 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXGetPackageCapabilities") returned 0x76a3a730 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXGetPackageSid") returned 0x76a3a960 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXLookupDisplayName") returned 0x76a3aa40 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXLookupMoniker") returned 0x76a3aa90 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXPostSuccessExtension") returned 0x76a3efc0 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXPreCreationExtension") returned 0x76a3f090 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXReleaseAppXContext") returned 0x76a3f300 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AppXUpdatePackageCapabilities") returned 0x76a3abd0 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="ApplicationUserModelIdFromProductId") returned 0x76a35c30 [0112.357] GetProcAddress (hModule=0x76910000, lpProcName="AreAllAccessesGranted") returned 0x76a43a20 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="AreAnyAccessesGranted") returned 0x76a43a40 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="AreFileApisANSI") returned 0x769df5e0 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="AreThereVisibleLogoffScriptsInternal") returned 0x76a11e10 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="AreThereVisibleShutdownScriptsInternal") returned 0x76a11e40 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="AttachConsole") returned 0x76a29710 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="BaseCheckAppcompatCache") returned 0x76a12950 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="BaseCheckAppcompatCacheEx") returned 0x76a12970 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="BaseCleanupAppcompatCacheSupport") returned 0x76a12990 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="BaseDllFreeResourceId") returned 0x769d33f0 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="BaseDllMapResourceIdW") returned 0x769c4f10 [0112.358] GetProcAddress (hModule=0x76910000, lpProcName="BaseDumpAppcompatCache") returned 0x76a129b0 [0112.359] GetProcAddress (hModule=0x76910000, lpProcName="BaseFlushAppcompatCache") returned 0x76a129d0 [0112.370] GetProcAddress (hModule=0x76910000, lpProcName="BaseFormatObjectAttributes") returned 0x769bd5a0 [0112.370] GetProcAddress (hModule=0x76910000, lpProcName="BaseFreeAppCompatDataForProcess") returned 0x76a129f0 [0112.370] GetProcAddress (hModule=0x76910000, lpProcName="BaseGetNamedObjectDirectory") returned 0x769be2f0 [0112.370] GetProcAddress (hModule=0x76910000, lpProcName="BaseInitAppcompatCacheSupport") returned 0x76a12a10 [0112.370] GetProcAddress (hModule=0x76910000, lpProcName="BaseIsAppcompatInfrastructureDisabled") returned 0x769e34d0 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="BaseMarkFileForDelete") returned 0x76a138a0 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="BaseReadAppCompatDataForProcess") returned 0x76a12a30 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="BaseUpdateAppcompatCache") returned 0x76a12a50 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="BasepAdjustObjectAttributesForPrivateNamespace") returned 0x769be200 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="BasepCopyFileCallback") returned 0x769e9190 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="BasepCopyFileExW") returned 0x769da790 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="BasepNotifyTrackingService") returned 0x769e8b90 [0112.371] GetProcAddress (hModule=0x76910000, lpProcName="Beep") returned 0x76a46e30 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CLOSE_LOCAL_HANDLE_INTERNAL") returned 0x769b1f80 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CallNamedPipeW") returned 0x76a46f00 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CallbackMayRunLong") returned 0x769d2e70 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CancelIo") returned 0x76a47890 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CancelIoEx") returned 0x769e27b0 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CancelSynchronousIo") returned 0x76a478d0 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CancelThreadpoolIo") returned 0x7721cd00 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CancelWaitableTimer") returned 0x769d7180 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CeipIsOptedIn") returned 0x769d5d70 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="ChangeTimerQueueTimer") returned 0x76a48050 [0112.372] GetProcAddress (hModule=0x76910000, lpProcName="CharLowerA") returned 0x769b67e0 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharLowerBuffA") returned 0x769e16f0 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharLowerBuffW") returned 0x769eae40 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharLowerW") returned 0x769b87e0 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharNextA") returned 0x769c65c0 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharNextExA") returned 0x76a12be0 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharNextW") returned 0x769ca620 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharPrevA") returned 0x769eb4c0 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharPrevExA") returned 0x76a12c20 [0112.373] GetProcAddress (hModule=0x76910000, lpProcName="CharPrevW") returned 0x769ca060 [0112.374] GetProcAddress (hModule=0x76910000, lpProcName="CharUpperA") returned 0x769e31b0 [0112.374] GetProcAddress (hModule=0x76910000, lpProcName="CharUpperBuffA") returned 0x769e3200 [0112.374] GetProcAddress (hModule=0x76910000, lpProcName="CharUpperBuffW") returned 0x769d4db0 [0112.374] GetProcAddress (hModule=0x76910000, lpProcName="CharUpperW") returned 0x769b9510 [0112.374] GetProcAddress (hModule=0x76910000, lpProcName="CheckAllowDecryptedRemoteDestinationPolicy") returned 0x76a15360 [0112.374] GetProcAddress (hModule=0x76910000, lpProcName="CheckGroupPolicyEnabled") returned 0x76a1c2c0 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="CheckIfStateChangeNotificationExists") returned 0x76a31e80 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="CheckRemoteDebuggerPresent") returned 0x76a48120 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="CheckTokenCapability") returned 0x769ed610 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="CheckTokenMembership") returned 0x769d4130 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="CheckTokenMembershipEx") returned 0x769d49d0 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="ChrCmpIA") returned 0x76a17970 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="ChrCmpIW") returned 0x769d4840 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="ClearCommBreak") returned 0x76a48630 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="ClearCommError") returned 0x76a48650 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="CloseGlobalizationUserSettingsKey") returned 0x769c3890 [0112.375] GetProcAddress (hModule=0x76910000, lpProcName="CloseHandle") returned 0x769bdf10 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="ClosePackageInfo") returned 0x769acb60 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="ClosePrivateNamespace") returned 0x769dfff0 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseState") returned 0x769ad910 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseStateAtom") returned 0x76a31ee0 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseStateChangeNotification") returned 0x76a31f30 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseStateContainer") returned 0x769b0050 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseStateLock") returned 0x76a31f80 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseThreadpool") returned 0x7723b1f0 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseThreadpoolCleanupGroup") returned 0x771f32d0 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseThreadpoolCleanupGroupMembers") returned 0x771f31d0 [0112.376] GetProcAddress (hModule=0x76910000, lpProcName="CloseThreadpoolIo") returned 0x77223950 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CloseThreadpoolTimer") returned 0x77222a50 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CloseThreadpoolWait") returned 0x77222910 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CloseThreadpoolWork") returned 0x77220550 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CommitStateAtom") returned 0x76a31fd0 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CompareFileTime") returned 0x769d1ef0 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CompareObjectHandles") returned 0x769cdc50 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CompareStringA") returned 0x769c54c0 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CompareStringEx") returned 0x769c6140 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CompareStringOrdinal") returned 0x769aeb40 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="CompareStringW") returned 0x769b8dd0 [0112.377] GetProcAddress (hModule=0x76910000, lpProcName="ConnectNamedPipe") returned 0x769ebd60 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="ContinueDebugEvent") returned 0x76a481e0 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="ConvertDefaultLocale") returned 0x769e2c80 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="ConvertFiberToThread") returned 0x769e0f80 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="ConvertThreadToFiber") returned 0x769df6f0 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="ConvertThreadToFiberEx") returned 0x769df710 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x76a43a60 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="CopyContext") returned 0x76a187f0 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="CopyFile2") returned 0x76a153f0 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="CopyFileExW") returned 0x769da6d0 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="CopyFileW") returned 0x769da6a0 [0112.378] GetProcAddress (hModule=0x76910000, lpProcName="CopySid") returned 0x769cd770 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateActCtxW") returned 0x769d5d50 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateAppContainerToken") returned 0x76a4b2d0 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateBoundaryDescriptorW") returned 0x769d6640 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateConsoleScreenBuffer") returned 0x76a29c80 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateDirectoryA") returned 0x769d6810 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateDirectoryExW") returned 0x76a16860 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateDirectoryW") returned 0x769bffc0 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateEnclave") returned 0x76a4b440 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateEventA") returned 0x769cc890 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateEventExA") returned 0x76a47d30 [0112.379] GetProcAddress (hModule=0x76910000, lpProcName="CreateEventExW") returned 0x769cc900 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateEventW") returned 0x769bd130 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFiber") returned 0x769dd1c0 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFiberEx") returned 0x769dd1e0 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFile2") returned 0x769c0340 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFileA") returned 0x769d4980 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFileMappingFromApp") returned 0x769d67b0 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFileMappingNumaW") returned 0x769bd1a0 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFileMappingW") returned 0x769bd170 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateFileW") returned 0x769bd670 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateHardLinkA") returned 0x76a18420 [0112.380] GetProcAddress (hModule=0x76910000, lpProcName="CreateHardLinkW") returned 0x76a184a0 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreateIoCompletionPort") returned 0x769eb700 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreateMemoryResourceNotification") returned 0x769d6a60 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreateMutexA") returned 0x769e6de0 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreateMutexExA") returned 0x76a47d90 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreateMutexExW") returned 0x769bd460 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreateMutexW") returned 0x769bce30 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreateNamedPipeW") returned 0x769eb910 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreatePipe") returned 0x769ac600 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreatePrivateNamespaceW") returned 0x769d5410 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreatePrivateObjectSecurity") returned 0x769e3970 [0112.381] GetProcAddress (hModule=0x76910000, lpProcName="CreatePrivateObjectSecurityEx") returned 0x769eb580 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreatePrivateObjectSecurityWithMultipleInheritance") returned 0x76a43aa0 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateProcessA") returned 0x76a4bad0 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateProcessAsUserA") returned 0x76a4bb10 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateProcessAsUserW") returned 0x76a4bb50 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateProcessInternalA") returned 0x76a4bb90 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateProcessInternalW") returned 0x769cf970 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateProcessW") returned 0x769cf930 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateRemoteThread") returned 0x76a4ab70 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateRemoteThreadEx") returned 0x769bfc10 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateRestrictedToken") returned 0x76a43af0 [0112.382] GetProcAddress (hModule=0x76910000, lpProcName="CreateSemaphoreExW") returned 0x769c04a0 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateSemaphoreW") returned 0x769d6610 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateStateAtom") returned 0x76a32040 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateStateChangeNotification") returned 0x769ec550 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateStateContainer") returned 0x769ad1c0 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateStateLock") returned 0x76a32090 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateStateSubcontainer") returned 0x769afeb0 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateSymbolicLinkW") returned 0x76a16490 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateThread") returned 0x76a4aba0 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateThreadpool") returned 0x769ebc40 [0112.383] GetProcAddress (hModule=0x76910000, lpProcName="CreateThreadpoolCleanupGroup") returned 0x769d6590 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateThreadpoolIo") returned 0x769d2590 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateThreadpoolTimer") returned 0x769d4190 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateThreadpoolWait") returned 0x769d44c0 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateThreadpoolWork") returned 0x769d43f0 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateTimerQueue") returned 0x76a480a0 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateTimerQueueTimer") returned 0x769d4cc0 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateWaitableTimerExW") returned 0x769cd5c0 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateWaitableTimerW") returned 0x769e3830 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CreateWellKnownSid") returned 0x769cc690 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="CtrlRoutine") returned 0x76a2a840 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="DeactivateActCtx") returned 0x769d2c30 [0112.384] GetProcAddress (hModule=0x76910000, lpProcName="DebugActiveProcess") returned 0x76a48230 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DebugActiveProcessStop") returned 0x76a48290 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DebugBreak") returned 0x76a482e0 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DecodePointer") returned 0x7722d830 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DecodeRemotePointer") returned 0x77284730 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DecodeSystemPointer") returned 0x771f4140 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DefineDosDeviceW") returned 0x76a4c790 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DelayLoadFailureHook") returned 0x769ec300 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DelayLoadFailureHookLookup") returned 0x76a2f9d0 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DeleteAce") returned 0x769d65c0 [0112.385] GetProcAddress (hModule=0x76910000, lpProcName="DeleteBoundaryDescriptor") returned 0x769d6bf0 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteCriticalSection") returned 0x77220e60 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteFiber") returned 0x769dfb00 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteFileA") returned 0x769e8230 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteFileW") returned 0x769e91f0 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteProcThreadAttributeList") returned 0x769d6c70 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteStateAtomValue") returned 0x76a320f0 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteStateContainer") returned 0x76a32150 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteStateContainerValue") returned 0x769acfa0 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteSynchronizationBarrier") returned 0x77296af0 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteTimerQueueEx") returned 0x76a480d0 [0112.386] GetProcAddress (hModule=0x76910000, lpProcName="DeleteTimerQueueTimer") returned 0x769d5870 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DeleteVolumeMountPointW") returned 0x76a27ca0 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DestroyPrivateObjectSecurity") returned 0x769eb7a0 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DeviceIoControl") returned 0x769bf3a0 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DisablePredefinedHandleTableInternal") returned 0x76a2df60 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DisableThreadLibraryCalls") returned 0x769d2750 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DisassociateCurrentThreadFromCallback") returned 0x7723b130 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DiscardVirtualMemory") returned 0x76a463c0 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DisconnectNamedPipe") returned 0x76a47020 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DnsHostnameToComputerNameExW") returned 0x76a4cd60 [0112.387] GetProcAddress (hModule=0x76910000, lpProcName="DsBindWithSpnExW") returned 0x76a12750 [0112.400] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73e50000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")) returned 0x1f [0112.400] GetModuleFileNameA (in: hModule=0x73e50000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")) returned 0x1f [0112.400] CreateFileA (lpFileName="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.401] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=581632) returned 1 [0112.401] VirtualAlloc (lpAddress=0x0, dwSize=0x8e000, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0112.401] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x8e000, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x8e000, lpOverlapped=0x0) returned 1 [0112.435] CloseHandle (hObject=0x1b4) returned 1 [0112.435] GetProcAddress (hModule=0x73e50000, lpProcName="AllowPermLayer") returned 0x73e92410 [0112.435] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckExe") returned 0x73e90460 [0112.435] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckIME") returned 0x73e91020 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckInstallShieldPackage") returned 0x73e91060 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckModule") returned 0x73e90490 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckMsiPackage") returned 0x73e91230 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckRunApp") returned 0x73e905f0 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckRunAppEx") returned 0x73e90630 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCheckShellObject") returned 0x73e7c940 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpCreateAppcompatData") returned 0x73e7de20 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpFixMsiPackage") returned 0x73e914b0 [0112.436] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpFixMsiPackageExe") returned 0x73e91750 [0112.437] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpFreeFileAttributes") returned 0x73e925d0 [0112.437] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpGetFileAttributes") returned 0x73e925e0 [0112.437] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpGetMsiProperties") returned 0x73e919a0 [0112.437] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpGetNTVDMInfo") returned 0x73e91a40 [0112.437] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpGetShimDebugLevel") returned 0x73e83a60 [0112.438] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpIsPortMonAllowed") returned 0x73e829b0 [0112.438] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpParseModuleData") returned 0x73e908f0 [0112.438] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpQueryModuleData") returned 0x73e909d0 [0112.438] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpQueryModuleDataEx") returned 0x73e80230 [0112.438] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpShowDialog") returned 0x73e925f0 [0112.438] GetProcAddress (hModule=0x73e50000, lpProcName="ApphelpUpdateCacheEntry") returned 0x73e924c0 [0112.438] GetProcAddress (hModule=0x73e50000, lpProcName="DWM8And16Bit_ChangeDisplaySettingsExW_CallOut") returned 0x73ea3c30 [0112.439] GetProcAddress (hModule=0x73e50000, lpProcName="DWM8And16Bit_DirectDrawCreateEx_CallOut") returned 0x73eb17e0 [0112.439] GetProcAddress (hModule=0x73e50000, lpProcName="DWM8And16Bit_DirectDrawCreate_CallOut") returned 0x73eb1820 [0112.439] GetProcAddress (hModule=0x73e50000, lpProcName="DWM8And16Bit_EnumDisplaySettingsExW_CallOut") returned 0x73ea4430 [0112.439] GetProcAddress (hModule=0x73e50000, lpProcName="DWM8And16Bit_IsShimApplied_CallOut") returned 0x73ea5030 [0112.440] GetProcAddress (hModule=0x73e50000, lpProcName="DWM8And16Bit_RestoreDisplayMode_CallOut") returned 0x73eb1a40 [0112.440] GetProcAddress (hModule=0x73e50000, lpProcName="GetPermLayers") returned 0x73e924f0 [0112.440] GetProcAddress (hModule=0x73e50000, lpProcName="SE_AddHookset") returned 0x73e92f20 [0112.440] GetProcAddress (hModule=0x73e50000, lpProcName="SE_CALLBACK_AddHook") returned 0x73e92fe0 [0112.440] GetProcAddress (hModule=0x73e50000, lpProcName="SE_CALLBACK_Lookup") returned 0x73e93060 [0112.440] GetProcAddress (hModule=0x73e50000, lpProcName="SE_COM_AddHook") returned 0x73e74330 [0112.440] GetProcAddress (hModule=0x73e50000, lpProcName="SE_COM_AddServer") returned 0x73e81c50 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_COM_HookInterface") returned 0x73e930d0 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_COM_HookObject") returned 0x73e93150 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_COM_Lookup") returned 0x73e931d0 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_DllLoaded") returned 0x73e78c80 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_DllUnloaded") returned 0x73e93230 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_DynamicShim") returned 0x73e93280 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_GetHookAPIs") returned 0x73e93520 [0112.441] GetProcAddress (hModule=0x73e50000, lpProcName="SE_GetMaxShimCount") returned 0x73e93660 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_GetProcAddressForCaller") returned 0x73e79f90 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_GetProcAddressIgnoreIncExc") returned 0x73e93670 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_GetProcAddressLoad") returned 0x73e936e0 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_GetShimCount") returned 0x73e93730 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_GetShimId") returned 0x73e6f5e0 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_InitializeEngine") returned 0x73e7e500 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_InstallAfterInit") returned 0x73e70fa0 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_InstallBeforeInit") returned 0x73e707f0 [0112.442] GetProcAddress (hModule=0x73e50000, lpProcName="SE_IsShimDll") returned 0x73e93750 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_LdrEntryRemoved") returned 0x73e72730 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_LdrResolveDllName") returned 0x73e80a10 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_LookupAddress") returned 0x73e937a0 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_LookupCaller") returned 0x73e93870 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_ProcessDying") returned 0x73e80c50 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_ShimDPF") returned 0x73e80b10 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_ShimDllLoaded") returned 0x73e6f680 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_WINRT_AddHook") returned 0x73e939d0 [0112.443] GetProcAddress (hModule=0x73e50000, lpProcName="SE_WINRT_HookObject") returned 0x73e93ac0 [0112.444] GetProcAddress (hModule=0x73e50000, lpProcName="SdbAddLayerTagRefToQuery") returned 0x73e6ea80 [0112.444] GetProcAddress (hModule=0x73e50000, lpProcName="SdbApphelpNotify") returned 0x73e98fc0 [0112.444] GetProcAddress (hModule=0x73e50000, lpProcName="SdbApphelpNotifyEx") returned 0x73e99090 [0112.444] GetProcAddress (hModule=0x73e50000, lpProcName="SdbApphelpNotifyEx2") returned 0x73e99000 [0112.445] GetProcAddress (hModule=0x73e50000, lpProcName="SdbBeginWriteListTag") returned 0x73e97130 [0112.445] GetProcAddress (hModule=0x73e50000, lpProcName="SdbBuildCompatEnvVariables") returned 0x73e9bea0 [0112.445] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCloseApphelpInformation") returned 0x73e991a0 [0112.445] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCloseDatabase") returned 0x73e7ca60 [0112.445] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCloseDatabaseWrite") returned 0x73e973a0 [0112.445] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCloseLocalDatabase") returned 0x73e9ced0 [0112.446] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCommitIndexes") returned 0x73e973c0 [0112.446] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCreateDatabase") returned 0x73e97410 [0112.446] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCreateHelpCenterURL") returned 0x73e99240 [0112.446] GetProcAddress (hModule=0x73e50000, lpProcName="SdbCreateMsiTransformFile") returned 0x73e9d580 [0112.446] GetProcAddress (hModule=0x73e50000, lpProcName="SdbDeclareIndex") returned 0x73e97580 [0112.446] GetProcAddress (hModule=0x73e50000, lpProcName="SdbDeletePermLayerKeys") returned 0x73e9c0a0 [0112.447] GetProcAddress (hModule=0x73e50000, lpProcName="SdbDumpSearchPathPartCaches") returned 0x73e93c70 [0112.447] GetProcAddress (hModule=0x73e50000, lpProcName="SdbEndWriteListTag") returned 0x73e97880 [0112.447] GetProcAddress (hModule=0x73e50000, lpProcName="SdbEnumMsiTransforms") returned 0x73e9d690 [0112.447] GetProcAddress (hModule=0x73e50000, lpProcName="SdbEscapeApphelpURL") returned 0x73e997d0 [0112.447] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindCustomActionForPackage") returned 0x73e9d800 [0112.447] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstDWORDIndexedTag") returned 0x73e9e230 [0112.447] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstGUIDIndexedTag") returned 0x73e9e2d0 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstMsiPackage") returned 0x73e9d8b0 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstMsiPackage_Str") returned 0x73e9d8f0 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstNamedTag") returned 0x73e762e0 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstStringIndexedTag") returned 0x73e6da80 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstTag") returned 0x73e76c90 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindFirstTagRef") returned 0x73e75720 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindMsiPackageByID") returned 0x73e9d970 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindNextDWORDIndexedTag") returned 0x73e9e370 [0112.448] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindNextGUIDIndexedTag") returned 0x73e9e3a0 [0112.449] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindNextMsiPackage") returned 0x73e9d9f0 [0112.449] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindNextStringIndexedTag") returned 0x73e81940 [0112.449] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindNextTag") returned 0x73e76dd0 [0112.449] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFindNextTagRef") returned 0x73e74fb0 [0112.449] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFormatAttribute") returned 0x73e9e800 [0112.449] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFreeDatabaseInformation") returned 0x73e9cad0 [0112.450] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFreeFileAttributes") returned 0x73e9f450 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFreeFileInfo") returned 0x73e93c70 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbFreeFlagInfo") returned 0x73e980e0 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGUIDFromString") returned 0x73e93c80 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGUIDToString") returned 0x73e93cb0 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetAppCompatDataSize") returned 0x73e923a0 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetAppPatchDir") returned 0x73e82a50 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetBinaryTagData") returned 0x73e726b0 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetDatabaseGUID") returned 0x73e98110 [0112.451] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetDatabaseID") returned 0x73e73500 [0112.452] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetDatabaseInformation") returned 0x73e9cb00 [0112.452] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetDatabaseInformationByName") returned 0x73e9cbb0 [0112.452] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetDatabaseMatch") returned 0x73ea05e0 [0112.452] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetDatabaseVersion") returned 0x73e9cd10 [0112.452] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetDllPath") returned 0x73e7d620 [0112.453] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetEntryFlags") returned 0x73ea1d10 [0112.453] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetFileAttributes") returned 0x73e9f4c0 [0112.453] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetFileImageType") returned 0x73e9f740 [0112.453] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetFileImageTypeEx") returned 0x73e80380 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetFileInfo") returned 0x73e93ce0 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetFirstChild") returned 0x73e76970 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetImageType") returned 0x73e9cef0 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetIndex") returned 0x73e6dee0 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetItemFromItemRef") returned 0x73e72200 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetLayerName") returned 0x73e9f820 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetLayerTagRef") returned 0x73e98210 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetLocalPDB") returned 0x73e982c0 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetMatchingExe") returned 0x73e828c0 [0112.454] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetMsiPackageInformation") returned 0x73e9da90 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetNamedLayer") returned 0x73e982e0 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetNextChild") returned 0x73e76af0 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetNthUserSdb") returned 0x73e80190 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetPDBFromGUID") returned 0x73e98350 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetPermLayerKeys") returned 0x73e9c310 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetShowDebugInfoOption") returned 0x73e83a60 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetShowDebugInfoOptionValue") returned 0x73e83a60 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetStandardDatabaseGUID") returned 0x73e9f8d0 [0112.455] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetStringTagPtr") returned 0x73e76110 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetTagDataSize") returned 0x73e76fd0 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGetTagFromTagID") returned 0x73e773c0 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGrabMatchingInfo") returned 0x73ea1e60 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbGrabMatchingInfoEx") returned 0x73ea1e90 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbInitDatabase") returned 0x73e92360 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbInitDatabaseEx") returned 0x73e71c90 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbIsNullGUID") returned 0x73e93ee0 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbIsStandardDatabase") returned 0x73e9f950 [0112.456] GetProcAddress (hModule=0x73e50000, lpProcName="SdbIsTagrefFromLocalDB") returned 0x73e983e0 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbIsTagrefFromMainDB") returned 0x73e71080 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbLoadString") returned 0x73e99960 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbMakeIndexKeyFromString") returned 0x73e9e420 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenApphelpDetailsDatabase") returned 0x73e99a20 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenApphelpDetailsDatabaseSP") returned 0x73e93cf0 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenApphelpInformation") returned 0x73e99ab0 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenApphelpInformationByID") returned 0x73e99c90 [0112.457] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenApphelpResourceFile") returned 0x73e99da0 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenDatabase") returned 0x73e9ce60 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenDbFromGuid") returned 0x73e99e70 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbOpenLocalDatabase") returned 0x73e9cf10 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbPackAppCompatData") returned 0x73e7dfd0 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryApphelpInformation") returned 0x73e99f40 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryBlockUpgrade") returned 0x73e98680 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryContext") returned 0x73e986f0 [0112.458] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryData") returned 0x73e81590 [0112.459] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryDataEx") returned 0x73e815c0 [0112.459] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryDataExTagID") returned 0x73e81630 [0112.459] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryFlagInfo") returned 0x73e98970 [0112.459] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryFlagMask") returned 0x73e82da0 [0112.459] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryName") returned 0x73ea2c90 [0112.459] GetProcAddress (hModule=0x73e50000, lpProcName="SdbQueryReinstallUpgrade") returned 0x73e989d0 [0112.459] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadApphelpData") returned 0x73e9a1d0 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadApphelpDetailsData") returned 0x73e9a2f0 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadBYTETag") returned 0x73ea0200 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadBYTETagRef") returned 0x73ea0280 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadBinaryTag") returned 0x73e721b0 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadDWORDTag") returned 0x73e734a0 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadDWORDTagRef") returned 0x73e6f460 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadEntryInformation") returned 0x73ea07a0 [0112.460] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadMsiTransformInfo") returned 0x73e9dbd0 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadPatchBits") returned 0x73e9cf50 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadQWORDTag") returned 0x73e7fec0 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadQWORDTagRef") returned 0x73e7fe70 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadStringTag") returned 0x73e74890 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadStringTagRef") returned 0x73e74830 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadWORDTag") returned 0x73e73440 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReadWORDTagRef") returned 0x73ea03a0 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbRegisterDatabase") returned 0x73e9ebe0 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbRegisterDatabaseEx") returned 0x73e9ec00 [0112.461] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReleaseDatabase") returned 0x73e7caa0 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbReleaseMatchingExe") returned 0x73e98af0 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbResolveDatabase") returned 0x73e9f9c0 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbSetApphelpDebugParameters") returned 0x73e9a6c0 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbSetEntryFlags") returned 0x73e9fd10 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbSetImageType") returned 0x73e9d090 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbSetPermLayerKeys") returned 0x73e9c3a0 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbShowApphelpDialog") returned 0x73e9a790 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbShowApphelpFromQuery") returned 0x73e7eb60 [0112.462] GetProcAddress (hModule=0x73e50000, lpProcName="SdbStartIndexing") returned 0x73e979c0 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbStopIndexing") returned 0x73e979f0 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbStringDuplicate") returned 0x73e93d00 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbStringReplace") returned 0x73e93d30 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbStringReplaceArray") returned 0x73e93d70 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbTagIDToTagRef") returned 0x73e74790 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbTagRefToTagID") returned 0x73e77400 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbTagToString") returned 0x73e9f760 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbUnpackAppCompatData") returned 0x73e7f020 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbUnpackQueryResult") returned 0x73e7f080 [0112.463] GetProcAddress (hModule=0x73e50000, lpProcName="SdbUnregisterDatabase") returned 0x73e9f1d0 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteBYTETag") returned 0x73e97a20 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteBinaryTag") returned 0x73e97a60 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteBinaryTagFromFile") returned 0x73e97aa0 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteDWORDTag") returned 0x73e97bc0 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteNULLTag") returned 0x73e97c00 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteQWORDTag") returned 0x73e97c40 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteStringRefTag") returned 0x73e97c80 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteStringTag") returned 0x73e97cc0 [0112.464] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteStringTagDirect") returned 0x73e97d10 [0112.465] GetProcAddress (hModule=0x73e50000, lpProcName="SdbWriteWORDTag") returned 0x73e97d70 [0112.465] GetProcAddress (hModule=0x73e50000, lpProcName="SetPermLayerState") returned 0x73e92500 [0112.465] GetProcAddress (hModule=0x73e50000, lpProcName="SetPermLayerStateEx") returned 0x73e92530 [0112.465] GetProcAddress (hModule=0x73e50000, lpProcName="SetPermLayers") returned 0x73e92570 [0112.465] GetProcAddress (hModule=0x73e50000, lpProcName="ShimDbgPrint") returned 0x73e83a60 [0112.465] GetProcAddress (hModule=0x73e50000, lpProcName="ShimDumpCache") returned 0x73e92630 [0112.465] GetProcAddress (hModule=0x73e50000, lpProcName="ShimFlushCache") returned 0x73e91010 [0112.465] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.478] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x71560000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")) returned 0x1e [0112.478] GetModuleFileNameA (in: hModule=0x71560000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")) returned 0x1e [0112.478] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.478] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=107408) returned 1 [0112.479] VirtualAlloc (lpAddress=0x0, dwSize=0x1a390, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0112.479] ReadFile (in: hFile=0x1b4, lpBuffer=0x540000, nNumberOfBytesToRead=0x1a390, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0x1a390, lpOverlapped=0x0) returned 1 [0112.482] CloseHandle (hObject=0x1b4) returned 1 [0112.482] GetProcAddress (hModule=0x71560000, lpProcName="BCryptAddContextFunction") returned 0x7156e1f0 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptAddContextFunctionProvider") returned 0x7156e950 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptCloseAlgorithmProvider") returned 0x71563c50 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptConfigureContext") returned 0x7156df50 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptConfigureContextFunction") returned 0x7156e640 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptCreateContext") returned 0x7156dc10 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptCreateHash") returned 0x71566640 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptCreateMultiHash") returned 0x71566cd0 [0112.483] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDecrypt") returned 0x71564ff0 [0112.494] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDeleteContext") returned 0x7156dd20 [0112.494] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDeriveKey") returned 0x715660e0 [0112.494] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDeriveKeyCapi") returned 0x715678a0 [0112.494] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDeriveKeyPBKDF2") returned 0x71567f00 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDestroyHash") returned 0x71566f30 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDestroyKey") returned 0x71566420 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDestroySecret") returned 0x71566560 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDuplicateHash") returned 0x71567050 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptDuplicateKey") returned 0x71566240 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptEncrypt") returned 0x71564d00 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptEnumAlgorithms") returned 0x71563cd0 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptEnumContextFunctionProviders") returned 0x7156ec20 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptEnumContextFunctions") returned 0x7156e460 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptEnumContexts") returned 0x7156de20 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptEnumProviders") returned 0x715640b0 [0112.495] GetProcAddress (hModule=0x71560000, lpProcName="BCryptEnumRegisteredProviders") returned 0x7156db50 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptExportKey") returned 0x715652b0 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptFinalizeKeyPair") returned 0x71564c30 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptFinishHash") returned 0x71566bb0 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptFreeBuffer") returned 0x71564420 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptGenRandom") returned 0x715677a0 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptGenerateKeyPair") returned 0x71564ae0 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptGenerateSymmetricKey") returned 0x71564910 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptGetFipsAlgorithmMode") returned 0x715691e0 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptGetProperty") returned 0x71564470 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptHash") returned 0x715683d0 [0112.496] GetProcAddress (hModule=0x71560000, lpProcName="BCryptHashData") returned 0x71566b10 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptImportKey") returned 0x71565780 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptImportKeyPair") returned 0x71565a30 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptKeyDerivation") returned 0x715682c0 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptOpenAlgorithmProvider") returned 0x71563760 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptProcessMultiOperations") returned 0x71566ea0 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptQueryContextConfiguration") returned 0x7156e050 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptQueryContextFunctionConfiguration") returned 0x7156e780 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptQueryContextFunctionProperty") returned 0x7156efa0 [0112.497] GetProcAddress (hModule=0x71560000, lpProcName="BCryptQueryProviderRegistration") returned 0x7156d9a0 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptRegisterConfigChangeNotify") returned 0x7156f1a0 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptRegisterProvider") returned 0x7156d700 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptRemoveContextFunction") returned 0x7156e330 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptRemoveContextFunctionProvider") returned 0x7156eac0 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptResolveProviders") returned 0x7156f4a0 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptSecretAgreement") returned 0x71565f90 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptSetAuditingInterface") returned 0x715683b0 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptSetContextFunctionProperty") returned 0x7156ee20 [0112.498] GetProcAddress (hModule=0x71560000, lpProcName="BCryptSetProperty") returned 0x715647e0 [0112.499] GetProcAddress (hModule=0x71560000, lpProcName="BCryptSignHash") returned 0x71567280 [0112.499] GetProcAddress (hModule=0x71560000, lpProcName="BCryptUnregisterConfigChangeNotify") returned 0x7156f330 [0112.499] GetProcAddress (hModule=0x71560000, lpProcName="BCryptUnregisterProvider") returned 0x7156d8c0 [0112.499] GetProcAddress (hModule=0x71560000, lpProcName="BCryptVerifySignature") returned 0x71567540 [0112.499] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.501] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x6f8a0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")) returned 0x20 [0112.502] GetModuleFileNameA (in: hModule=0x6f8a0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")) returned 0x20 [0112.502] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.502] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=34088) returned 1 [0112.502] VirtualAlloc (lpAddress=0x0, dwSize=0x8528, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0112.502] ReadFile (in: hFile=0x1b4, lpBuffer=0x540000, nNumberOfBytesToRead=0x8528, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0x8528, lpOverlapped=0x0) returned 1 [0112.507] CloseHandle (hObject=0x1b4) returned 1 [0112.508] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetApiBufferAllocate") returned 0x6f8a1690 [0112.508] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetApiBufferFree") returned 0x6f8a16d0 [0112.508] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetApiBufferReallocate") returned 0x6f8a41b0 [0112.508] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetApiBufferSize") returned 0x6f8a4200 [0112.508] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetRemoteComputerSupports") returned 0x6f8a1700 [0112.508] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetapipBufferAllocate") returned 0x6f8a17d0 [0112.508] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsComputerNameValid") returned 0x6f8a4830 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsDomainNameValid") returned 0x6f8a2190 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsGroupNameValid") returned 0x6f8a4890 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsRemote") returned 0x6f8a1770 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsRemoteNameValid") returned 0x6f8a48f0 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsShareNameValid") returned 0x6f8a49b0 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsUncComputerNameValid") returned 0x6f8a4a10 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpIsUserNameValid") returned 0x6f8a2130 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwListCanonicalize") returned 0x6f8a4340 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwListTraverse") returned 0x6f8a47f0 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwNameCanonicalize") returned 0x6f8a22f0 [0112.509] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwNameCompare") returned 0x6f8a2220 [0112.510] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwNameValidate") returned 0x6f8a2430 [0112.510] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwPathCanonicalize") returned 0x6f8a17f0 [0112.510] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwPathCompare") returned 0x6f8a4a70 [0112.510] GetProcAddress (hModule=0x6f8a0000, lpProcName="NetpwPathType") returned 0x6f8a1a00 [0112.510] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.511] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76a90000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0112.511] GetModuleFileNameA (in: hModule=0x76a90000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0112.512] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.512] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=773168) returned 1 [0112.512] VirtualAlloc (lpAddress=0x0, dwSize=0xbcc30, flAllocationType=0x1000, flProtect=0x4) returned 0x810000 [0112.512] ReadFile (in: hFile=0x1b4, lpBuffer=0x810000, nNumberOfBytesToRead=0xbcc30, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x810000*, lpNumberOfBytesRead=0x19bd68*=0xbcc30, lpOverlapped=0x0) returned 1 [0112.575] CloseHandle (hObject=0x1b4) returned 1 [0112.575] GetProcAddress (hModule=0x76a90000, lpProcName="$I10_OUTPUT") returned 0x76b20260 [0112.575] GetProcAddress (hModule=0x76a90000, lpProcName="??0__non_rtti_object@@QAE@ABV0@@Z") returned 0x76ac8a90 [0112.575] GetProcAddress (hModule=0x76a90000, lpProcName="??0__non_rtti_object@@QAE@PBD@Z") returned 0x76ac8ac0 [0112.575] GetProcAddress (hModule=0x76a90000, lpProcName="??0bad_cast@@AAE@PBQBD@Z") returned 0x76ac8af0 [0112.575] GetProcAddress (hModule=0x76a90000, lpProcName="??0bad_cast@@QAE@ABQBD@Z") returned 0x76ac8af0 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0bad_cast@@QAE@ABV0@@Z") returned 0x76ac8b20 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0bad_cast@@QAE@PBD@Z") returned 0x76ac8b50 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0bad_typeid@@QAE@ABV0@@Z") returned 0x76ac8b80 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0bad_typeid@@QAE@PBD@Z") returned 0x76ac8bb0 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0exception@@QAE@ABQBD@Z") returned 0x76ac8be0 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0exception@@QAE@ABQBDH@Z") returned 0x76ac8c50 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0exception@@QAE@ABV0@@Z") returned 0x76ac8c80 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??0exception@@QAE@XZ") returned 0x76ac8cf0 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??1__non_rtti_object@@UAE@XZ") returned 0x76ac8d10 [0112.576] GetProcAddress (hModule=0x76a90000, lpProcName="??1bad_cast@@UAE@XZ") returned 0x76ac8d30 [0112.577] GetProcAddress (hModule=0x76a90000, lpProcName="??1bad_typeid@@UAE@XZ") returned 0x76ac8d10 [0112.577] GetProcAddress (hModule=0x76a90000, lpProcName="??1exception@@UAE@XZ") returned 0x76ac8d50 [0112.577] GetProcAddress (hModule=0x76a90000, lpProcName="??1type_info@@UAE@XZ") returned 0x76ad0fd0 [0112.577] GetProcAddress (hModule=0x76a90000, lpProcName="??2@YAPAXI@Z") returned 0x76ad4f30 [0112.577] GetProcAddress (hModule=0x76a90000, lpProcName="??2@YAPAXIHPBDH@Z") returned 0x76ae4ee0 [0112.577] GetProcAddress (hModule=0x76a90000, lpProcName="??3@YAXPAX@Z") returned 0x76ad4f60 [0112.578] GetProcAddress (hModule=0x76a90000, lpProcName="??4__non_rtti_object@@QAEAAV0@ABV0@@Z") returned 0x76ac8d70 [0112.578] GetProcAddress (hModule=0x76a90000, lpProcName="??4bad_cast@@QAEAAV0@ABV0@@Z") returned 0x76ac8d70 [0112.578] GetProcAddress (hModule=0x76a90000, lpProcName="??4bad_typeid@@QAEAAV0@ABV0@@Z") returned 0x76ac8d70 [0112.578] GetProcAddress (hModule=0x76a90000, lpProcName="??4exception@@QAEAAV0@ABV0@@Z") returned 0x76ac8d90 [0112.578] GetProcAddress (hModule=0x76a90000, lpProcName="??8type_info@@QBEHABV0@@Z") returned 0x76ad0fe0 [0112.579] GetProcAddress (hModule=0x76a90000, lpProcName="??9type_info@@QBEHABV0@@Z") returned 0x76ad1030 [0112.579] GetProcAddress (hModule=0x76a90000, lpProcName="??_7__non_rtti_object@@6B@") returned 0x76a92e60 [0112.579] GetProcAddress (hModule=0x76a90000, lpProcName="??_7bad_cast@@6B@") returned 0x76a939f0 [0112.579] GetProcAddress (hModule=0x76a90000, lpProcName="??_7bad_typeid@@6B@") returned 0x76a92e48 [0112.579] GetProcAddress (hModule=0x76a90000, lpProcName="??_7exception@@6B@") returned 0x76a92e30 [0112.579] GetProcAddress (hModule=0x76a90000, lpProcName="??_E__non_rtti_object@@UAEPAXI@Z") returned 0x76ac8e60 [0112.579] GetProcAddress (hModule=0x76a90000, lpProcName="??_Ebad_cast@@UAEPAXI@Z") returned 0x76ac8e00 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_Ebad_typeid@@UAEPAXI@Z") returned 0x76ac8e60 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_Eexception@@UAEPAXI@Z") returned 0x76ac8ec0 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_Fbad_cast@@QAEXXZ") returned 0x76ac8f20 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_Fbad_typeid@@QAEXXZ") returned 0x76ac8f50 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_G__non_rtti_object@@UAEPAXI@Z") returned 0x76ac8fb0 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_Gbad_cast@@UAEPAXI@Z") returned 0x76ac8f80 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_Gbad_typeid@@UAEPAXI@Z") returned 0x76ac8fb0 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_Gexception@@UAEPAXI@Z") returned 0x76ad1890 [0112.580] GetProcAddress (hModule=0x76a90000, lpProcName="??_U@YAPAXI@Z") returned 0x76ad4f70 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="??_U@YAPAXIHPBDH@Z") returned 0x76ae4ee0 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="??_V@YAXPAX@Z") returned 0x76ad4f80 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="?_query_new_handler@@YAP6AHI@ZXZ") returned 0x76ad4f90 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="?_query_new_mode@@YAHXZ") returned 0x76ad5060 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z") returned 0x76ad4fb0 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="?_set_new_mode@@YAHH@Z") returned 0x76ad5070 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z") returned 0x76aca8c0 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="?before@type_info@@QBEHABV1@@Z") returned 0x76ad1110 [0112.581] GetProcAddress (hModule=0x76a90000, lpProcName="?name@type_info@@QBEPBDXZ") returned 0x76aca930 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="?raw_name@type_info@@QBEPBDXZ") returned 0x76ad1160 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="?set_new_handler@@YAP6AXXZP6AXXZ@Z") returned 0x76ad50c0 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="?set_terminate@@YAP6AXXZP6AXXZ@Z") returned 0x76aca8f0 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="?set_unexpected@@YAP6AXXZP6AXXZ@Z") returned 0x76aca910 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="?terminate@@YAXXZ") returned 0x76acaa40 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="?unexpected@@YAXXZ") returned 0x76acaa90 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="?what@exception@@UBEPBDXZ") returned 0x76ac8fe0 [0112.582] GetProcAddress (hModule=0x76a90000, lpProcName="_CIacos") returned 0x76b22a80 [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIasin") returned 0x76b22bd0 [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIatan") returned 0x76b22d20 [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIatan2") returned 0x76b22e0a [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIcos") returned 0x76b22e60 [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIcosh") returned 0x76b22f72 [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIexp") returned 0x76b22fd0 [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIfmod") returned 0x76b2303a [0112.583] GetProcAddress (hModule=0x76a90000, lpProcName="_CIlog") returned 0x76b230a0 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CIlog10") returned 0x76b23200 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CIpow") returned 0x76b23360 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CIsin") returned 0x76b235f0 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CIsinh") returned 0x76b22f68 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CIsqrt") returned 0x76b236e0 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CItan") returned 0x76b237e0 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CItanh") returned 0x76b22f79 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CallMemberFunction0") returned 0x76ac9060 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CallMemberFunction1") returned 0x76ac90a0 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CallMemberFunction2") returned 0x76ac90e0 [0112.584] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtCheckMemory") returned 0x76ae4f00 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtDbgBreak") returned 0x76aed220 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtDbgReport") returned 0x76aed5a0 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtDbgReportV") returned 0x76aed5a0 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtDbgReportW") returned 0x76aed5a0 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtDbgReportWV") returned 0x76aed5a0 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtDoForAllClientObjects") returned 0x76aed220 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtDumpMemoryLeaks") returned 0x76aed5a0 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtIsMemoryBlock") returned 0x76aed5a0 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtIsValidHeapPointer") returned 0x76ae4f00 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtIsValidPointer") returned 0x76ae4f10 [0112.585] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtMemCheckpoint") returned 0x76aed220 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtMemDifference") returned 0x76aed5a0 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtMemDumpAllObjectsSince") returned 0x76aed220 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtMemDumpStatistics") returned 0x76aed220 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtReportBlockType") returned 0x76aed5a0 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetAllocHook") returned 0x76aed5a0 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetBreakAlloc") returned 0x76aed5a0 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetDbgBlockType") returned 0x76aed220 [0112.586] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetDbgFlag") returned 0x76aed5a0 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetDumpClient") returned 0x76aed5a0 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetReportFile") returned 0x76aed5a0 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetReportHook") returned 0x76aed5a0 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetReportHook2") returned 0x76aed5a0 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_CrtSetReportMode") returned 0x76aed5a0 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_CxxThrowException") returned 0x76acaae0 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_EH_prolog") returned 0x76acab50 [0112.587] GetProcAddress (hModule=0x76a90000, lpProcName="_Getdays") returned 0x76b1af70 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_Getmonths") returned 0x76b1b0a0 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_Gettnames") returned 0x76b1b1e0 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_HUGE") returned 0x76b44360 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_Strftime") returned 0x76b1b5c0 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_W_Getdays") returned 0x76b1c1e0 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_W_Getmonths") returned 0x76b1c360 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_W_Gettnames") returned 0x76b1c4e0 [0112.588] GetProcAddress (hModule=0x76a90000, lpProcName="_Wcsftime") returned 0x76b1c9b0 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="_XcptFilter") returned 0x76ae5040 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="__AdjustPointer") returned 0x76ac9f40 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="__CppXcptFilter") returned 0x76ae51d0 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxCallUnwindDelDtor") returned 0x76aca190 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxCallUnwindDtor") returned 0x76aca1e0 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxCallUnwindVecDtor") returned 0x76aca220 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxDetectRethrow") returned 0x76aca270 [0112.589] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxExceptionFilter") returned 0x76aca2d0 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxFrameHandler") returned 0x76ac94c0 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxFrameHandler2") returned 0x76ac94c0 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxFrameHandler3") returned 0x76ac94c0 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxLongjmpUnwind") returned 0x76ac9500 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxQueryExceptionSize") returned 0x76aca440 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxRegisterExceptionObject") returned 0x76aca450 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__CxxUnregisterExceptionObject") returned 0x76aca510 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__DestructExceptionObject") returned 0x76ac9530 [0112.590] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrAssign") returned 0x76ad11e0 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrCompare") returned 0x76ad1200 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrCopy") returned 0x76ad11b0 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrCopyException") returned 0x76ad12e0 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrCreate") returned 0x76ad1170 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrCurrentException") returned 0x76ad1270 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrDestroy") returned 0x76ad1190 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrRethrow") returned 0x76ad12c0 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrSwap") returned 0x76ad1240 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__ExceptionPtrToBool") returned 0x76ad1220 [0112.591] GetProcAddress (hModule=0x76a90000, lpProcName="__RTCastToVoid") returned 0x76acb360 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="__RTDynamicCast") returned 0x76acb3d0 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="__RTtypeid") returned 0x76acb530 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="__STRINGTOLD") returned 0x76abf2a0 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="___lc_codepage_func") returned 0x76ae5200 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="___lc_collate_cp_func") returned 0x76ae5230 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="___lc_handle_func") returned 0x76ae5260 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="___mb_cur_max_func") returned 0x76ae5290 [0112.592] GetProcAddress (hModule=0x76a90000, lpProcName="___setlc_active_func") returned 0x76ae5660 [0112.593] GetProcAddress (hModule=0x76a90000, lpProcName="___unguarded_readlc_active_add_func") returned 0x76ae5670 [0112.593] GetProcAddress (hModule=0x76a90000, lpProcName="__argc") returned 0x76b4519c [0112.593] GetProcAddress (hModule=0x76a90000, lpProcName="__argv") returned 0x76b451a0 [0112.593] GetProcAddress (hModule=0x76a90000, lpProcName="__badioinfo") returned 0x76b43b50 [0112.593] GetProcAddress (hModule=0x76a90000, lpProcName="__crtCompareStringA") returned 0x76ae6d10 [0112.593] GetProcAddress (hModule=0x76a90000, lpProcName="__crtCompareStringW") returned 0x76ae6d60 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__crtGetLocaleInfoW") returned 0x76ae6df0 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__crtGetStringTypeW") returned 0x76ae6e30 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__crtLCMapStringA") returned 0x76ae7160 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__crtLCMapStringW") returned 0x76ae71b0 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__daylight") returned 0x76ac58a0 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__dllonexit") returned 0x76ae7250 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__doserrno") returned 0x76ac5c90 [0112.594] GetProcAddress (hModule=0x76a90000, lpProcName="__dstbias") returned 0x76ac58b0 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__fpecode") returned 0x76ae7470 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__getmainargs") returned 0x76ac5780 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__initenv") returned 0x76b44b90 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__iob_func") returned 0x76af8cc0 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__isascii") returned 0x76abf3d0 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__iscsym") returned 0x76abf3f0 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__iscsymf") returned 0x76abf420 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__lc_codepage") returned 0x76b44db0 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__lc_collate_cp") returned 0x76b44db4 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__lc_handle") returned 0x76b44d98 [0112.595] GetProcAddress (hModule=0x76a90000, lpProcName="__lconv_init") returned 0x76ae79d0 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_acos") returned 0x76b238e0 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_acosf") returned 0x76b23d90 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_asin") returned 0x76b24180 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_asinf") returned 0x76b245d0 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_atan") returned 0x76b249a0 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_atan2") returned 0x76b24bc0 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_atanf") returned 0x76b250e0 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_cos") returned 0x76b25290 [0112.596] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_cosf") returned 0x76b25440 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_exp") returned 0x76b255a0 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_expf") returned 0x76b257c0 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_log") returned 0x76b25920 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_log10") returned 0x76b25b50 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_log10f") returned 0x76b25da0 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_logf") returned 0x76b25f20 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_pow") returned 0x76b260a0 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_powf") returned 0x76b26b20 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_sin") returned 0x76b271e0 [0112.597] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_sinf") returned 0x76b273a0 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_tan") returned 0x76b27500 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__libm_sse2_tanf") returned 0x76b27760 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__mb_cur_max") returned 0x76b43ba4 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p___argc") returned 0x76ac57e0 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p___argv") returned 0x76ac57f0 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p___initenv") returned 0x76ac5800 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p___mb_cur_max") returned 0x76ac5810 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p___wargv") returned 0x76ac5850 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p___winitenv") returned 0x76ac5860 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p__acmdln") returned 0x76ac5870 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p__amblksiz") returned 0x76ac5880 [0112.598] GetProcAddress (hModule=0x76a90000, lpProcName="__p__commode") returned 0x76ac5890 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__daylight") returned 0x76ac58a0 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__dstbias") returned 0x76ac58b0 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__environ") returned 0x76ac58c0 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__fileinfo") returned 0x76ac58d0 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__fmode") returned 0x76ac58e0 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__iob") returned 0x76af8cc0 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__mbcasemap") returned 0x76ac58f0 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__mbctype") returned 0x76ac5900 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__osver") returned 0x76ac5910 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__pctype") returned 0x76ac5920 [0112.599] GetProcAddress (hModule=0x76a90000, lpProcName="__p__pgmptr") returned 0x76ac5960 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__pwctype") returned 0x76ac5970 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__timezone") returned 0x76ac5980 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__tzname") returned 0x76ac5990 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__wcmdln") returned 0x76ac59a0 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__wenviron") returned 0x76ac59b0 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__winmajor") returned 0x76ac59c0 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__winminor") returned 0x76ac59d0 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__winver") returned 0x76ac59e0 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__p__wpgmptr") returned 0x76ac59f0 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__pctype_func") returned 0x76ae7a10 [0112.600] GetProcAddress (hModule=0x76a90000, lpProcName="__pioinfo") returned 0x76b44bc0 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__pwctype_func") returned 0x76ae7a50 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__pxcptinfoptrs") returned 0x76ae7490 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__set_app_type") returned 0x76ae7a60 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__setlc_active") returned 0x76b45d64 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__setusermatherr") returned 0x76b27910 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__strncnt") returned 0x76ae6ce0 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__threadhandle") returned 0x76af6b70 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__threadid") returned 0x76af6b80 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__toascii") returned 0x76abf450 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__unDName") returned 0x76ad0c30 [0112.601] GetProcAddress (hModule=0x76a90000, lpProcName="__unDNameEx") returned 0x76ad0ce0 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__uncaught_exception") returned 0x76ac9f20 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__unguarded_readlc_active") returned 0x76b45d60 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__wargv") returned 0x76b451a4 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__wcserror") returned 0x76ae7ae0 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__wcserror_s") returned 0x76ae7c30 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__wcsncnt") returned 0x76b15e60 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__wgetmainargs") returned 0x76ac5a00 [0112.602] GetProcAddress (hModule=0x76a90000, lpProcName="__winitenv") returned 0x76b45190 [0112.603] GetProcAddress (hModule=0x76a90000, lpProcName="_abnormal_termination") returned 0x76ae7e59 [0112.603] GetProcAddress (hModule=0x76a90000, lpProcName="_abs64") returned 0x76ae7eb0 [0112.603] GetProcAddress (hModule=0x76a90000, lpProcName="_access") returned 0x76ac5e10 [0112.603] GetProcAddress (hModule=0x76a90000, lpProcName="_access_s") returned 0x76ac5e30 [0112.617] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x6f880000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")) returned 0x1e [0112.617] GetModuleFileNameA (in: hModule=0x6f880000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")) returned 0x1e [0112.617] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.618] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=73872) returned 1 [0112.618] VirtualAlloc (lpAddress=0x0, dwSize=0x12090, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0112.618] ReadFile (in: hFile=0x1b4, lpBuffer=0x540000, nNumberOfBytesToRead=0x12090, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0x12090, lpOverlapped=0x0) returned 1 [0112.622] CloseHandle (hObject=0x1b4) returned 1 [0112.622] GetProcAddress (hModule=0x6f880000, lpProcName="I_NetDfsGetVersion") returned 0x6f8858d0 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="I_NetServerSetServiceBits") returned 0x6f884440 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="I_NetServerSetServiceBitsEx") returned 0x6f8861b0 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalAliasGet") returned 0x6f886270 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalFileClose") returned 0x6f886320 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalFileEnum") returned 0x6f8863d0 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalFileEnumEx") returned 0x6f886400 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalFileGetInfo") returned 0x6f886510 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalFileGetInfoEx") returned 0x6f886540 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalSessionDel") returned 0x6f886600 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalSessionEnum") returned 0x6f8866b0 [0112.623] GetProcAddress (hModule=0x6f880000, lpProcName="LocalSessionEnumEx") returned 0x6f8866e0 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalSessionGetInfo") returned 0x6f8867f0 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalSessionGetInfoEx") returned 0x6f886820 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalShareAdd") returned 0x6f8868e0 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalShareDelEx") returned 0x6f886a50 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalShareEnum") returned 0x6f886b00 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalShareEnumEx") returned 0x6f886b30 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalShareGetInfo") returned 0x6f886c20 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalShareGetInfoEx") returned 0x6f886c50 [0112.624] GetProcAddress (hModule=0x6f880000, lpProcName="LocalShareSetInfo") returned 0x6f886d10 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetConnectionEnum") returned 0x6f886e80 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetFileClose") returned 0x6f886f90 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetFileEnum") returned 0x6f887040 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetFileGetInfo") returned 0x6f887150 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetRemoteTOD") returned 0x6f887220 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerAliasAdd") returned 0x6f8872f0 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerAliasDel") returned 0x6f8873c0 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerAliasEnum") returned 0x6f887480 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerComputerNameAdd") returned 0x6f8875a0 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerComputerNameDel") returned 0x6f887890 [0112.625] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerDiskEnum") returned 0x6f8879f0 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerGetInfo") returned 0x6f884080 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerSetInfo") returned 0x6f887af0 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerStatisticsGet") returned 0x6f887ba0 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerTransportAdd") returned 0x6f887c80 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerTransportAddEx") returned 0x6f887d30 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerTransportDel") returned 0x6f887df0 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetServerTransportEnum") returned 0x6f887f80 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetSessionDel") returned 0x6f888090 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetSessionEnum") returned 0x6f888140 [0112.626] GetProcAddress (hModule=0x6f880000, lpProcName="NetSessionGetInfo") returned 0x6f888250 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareAdd") returned 0x6f888380 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareCheck") returned 0x6f888570 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareDel") returned 0x6f888650 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareDelEx") returned 0x6f8887a0 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareDelSticky") returned 0x6f8888c0 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareEnum") returned 0x6f884140 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareEnumSticky") returned 0x6f8889a0 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareGetInfo") returned 0x6f888b10 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetShareSetInfo") returned 0x6f888cd0 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetpsNameCanonicalize") returned 0x6f888ed0 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetpsNameCompare") returned 0x6f888f90 [0112.627] GetProcAddress (hModule=0x6f880000, lpProcName="NetpsNameValidate") returned 0x6f889050 [0112.628] GetProcAddress (hModule=0x6f880000, lpProcName="NetpsPathCanonicalize") returned 0x6f889100 [0112.628] GetProcAddress (hModule=0x6f880000, lpProcName="NetpsPathCompare") returned 0x6f8891c0 [0112.628] GetProcAddress (hModule=0x6f880000, lpProcName="NetpsPathType") returned 0x6f889280 [0112.628] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.630] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76c00000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0112.630] GetModuleFileNameA (in: hModule=0x76c00000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0112.630] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.631] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=707600) returned 1 [0112.631] VirtualAlloc (lpAddress=0x0, dwSize=0xacc10, flAllocationType=0x1000, flProtect=0x4) returned 0x810000 [0112.631] ReadFile (in: hFile=0x1b4, lpBuffer=0x810000, nNumberOfBytesToRead=0xacc10, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x810000*, lpNumberOfBytesRead=0x19bd68*=0xacc10, lpOverlapped=0x0) returned 1 [0112.654] CloseHandle (hObject=0x1b4) returned 1 [0112.654] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_AddRef") returned 0x76c34b00 [0112.654] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_Connect") returned 0x76c85a10 [0112.655] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_CountRefs") returned 0x76c85a50 [0112.655] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_DebugServerQueryInterface") returned 0x76c85a90 [0112.655] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_DebugServerRelease") returned 0x76c85ad0 [0112.655] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_Disconnect") returned 0x76c350c0 [0112.655] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_Invoke") returned 0x76c34a80 [0112.656] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_IsIIDSupported") returned 0x76c85b10 [0112.656] GetProcAddress (hModule=0x76c00000, lpProcName="CStdStubBuffer_QueryInterface") returned 0x76c35270 [0112.656] GetProcAddress (hModule=0x76c00000, lpProcName="CreateProxyFromTypeInfo") returned 0x76c0cff0 [0112.656] GetProcAddress (hModule=0x76c00000, lpProcName="CreateStubFromTypeInfo") returned 0x76c0cfa0 [0112.656] GetProcAddress (hModule=0x76c00000, lpProcName="DceErrorInqTextA") returned 0x76c58a70 [0112.657] GetProcAddress (hModule=0x76c00000, lpProcName="DceErrorInqTextW") returned 0x76c58ad0 [0112.657] GetProcAddress (hModule=0x76c00000, lpProcName="DllGetClassObject") returned 0x76c85b50 [0112.657] GetProcAddress (hModule=0x76c00000, lpProcName="DllRegisterServer") returned 0x76c85bc0 [0112.657] GetProcAddress (hModule=0x76c00000, lpProcName="IUnknown_AddRef_Proxy") returned 0x76c34460 [0112.657] GetProcAddress (hModule=0x76c00000, lpProcName="IUnknown_QueryInterface_Proxy") returned 0x76c34840 [0112.658] GetProcAddress (hModule=0x76c00000, lpProcName="IUnknown_Release_Proxy") returned 0x76c344a0 [0112.658] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcAllocate") returned 0x76c18c60 [0112.658] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcAsyncAbortCall") returned 0x76c58fe0 [0112.658] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcAsyncSetHandle") returned 0x76c27190 [0112.658] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBCacheAllocate") returned 0x76c32a00 [0112.658] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBCacheFree") returned 0x76c68840 [0112.659] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingCopy") returned 0x76c18dd0 [0112.659] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingCreateNP") returned 0x76c59220 [0112.659] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingHandleToAsyncHandle") returned 0x76c5f790 [0112.659] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqClientTokenAttributes") returned 0x76c55ff0 [0112.660] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqCurrentModifiedId") returned 0x76c33660 [0112.660] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqDynamicEndpoint") returned 0x76c56ac0 [0112.660] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqDynamicEndpointA") returned 0x76c392a0 [0112.660] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqDynamicEndpointW") returned 0x76c56ac0 [0112.660] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqLocalClientPID") returned 0x76c33610 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqMarshalledTargetInfo") returned 0x76c5f7e0 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqSecurityContext") returned 0x76c59480 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqSecurityContextKeyInfo") returned 0x76c594f0 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqTransportType") returned 0x76c334b0 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingInqWireIdForSnego") returned 0x76c5f830 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingIsClientLocal") returned 0x76c56b30 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingIsServerLocal") returned 0x76c56bc0 [0112.661] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingSetPrivateOption") returned 0x76c5fb80 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcBindingToStaticStringBindingW") returned 0x76c5fbf0 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcCertProcessAndProvision") returned 0x76c58960 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcClearMutex") returned 0x76c344e0 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcCompleteAndFree") returned 0x76c58e30 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcConnectionInqSockBuffSize") returned 0x76c58b30 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcConnectionSetSockBuffSize") returned 0x76c58b70 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcDeleteMutex") returned 0x76c5fda0 [0112.662] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcEnableWmiTrace") returned 0x76c58840 [0112.663] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcExceptionFilter") returned 0x76c35700 [0112.663] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcFilterDCOMActivation") returned 0x76c68d60 [0112.663] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcFree") returned 0x76c0e390 [0112.663] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcFreeBuffer") returned 0x76c1c180 [0112.663] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcFreePipeBuffer") returned 0x76c68eb0 [0112.663] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcFwThisIsTheManager") returned 0x76c56710 [0112.664] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcGetBuffer") returned 0x76c1ecf0 [0112.664] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcGetBufferWithObject") returned 0x76c1ed10 [0112.664] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcGetCurrentCallHandle") returned 0x76c690b0 [0112.664] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcGetDefaultSD") returned 0x76c56c30 [0112.664] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcGetExtendedError") returned 0x76c695d0 [0112.665] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcGetPortAllocationData") returned 0x76c5fdc0 [0112.665] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcIfInqTransferSyntaxes") returned 0x76c58bc0 [0112.665] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcInitFwImports") returned 0x76c56790 [0112.665] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcInitHttpImports") returned 0x76c8dfe0 [0112.665] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcInitImports") returned 0x76c56800 [0112.665] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcInitNdrImports") returned 0x76c36110 [0112.665] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcLogEvent") returned 0x76c58870 [0112.666] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcMapWin32Status") returned 0x76c36460 [0112.666] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcMarshalBindingHandleAndInterfaceForNDF") returned 0x76c59590 [0112.666] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcMgmtEnableDedicatedThreadPool") returned 0x76c56c60 [0112.666] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcMgmtQueryDedicatedThreadPool") returned 0x76c36410 [0112.666] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNDRCGetWireRepresentation") returned 0x76c80af0 [0112.666] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNDRSContextEmergencyCleanup") returned 0x76c814f0 [0112.667] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNegotiateTransferSyntax") returned 0x76c68f00 [0112.667] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNsBindingSetEntryName") returned 0x76c6dbf0 [0112.667] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNsBindingSetEntryNameA") returned 0x76c39360 [0112.667] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNsBindingSetEntryNameW") returned 0x76c6dbf0 [0112.667] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNsInterfaceExported") returned 0x76c6dbf0 [0112.668] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcNsInterfaceUnexported") returned 0x76c6dbf0 [0112.668] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcOpenClientProcess") returned 0x76c0e480 [0112.668] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcOpenClientThread") returned 0x76c53cd0 [0112.668] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcParseSecurity") returned 0x76c106f0 [0112.668] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcPauseExecution") returned 0x76c58f80 [0112.668] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcReallocPipeBuffer") returned 0x76c69030 [0112.668] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcReceive") returned 0x76c26840 [0112.669] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcRecordCalloutFailure") returned 0x76c6f240 [0112.669] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcRequestMutex") returned 0x76c34110 [0112.669] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcSNCHOption") returned 0x76c58f90 [0112.669] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcSend") returned 0x76c26d90 [0112.669] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcSendReceive") returned 0x76c29cf0 [0112.669] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerAllocateIpPort") returned 0x76c6f750 [0112.669] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerCheckClientRestriction") returned 0x76c6dc30 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerDisableExceptionFilter") returned 0x76c56c90 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerGetAssociationID") returned 0x76c35fb0 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerInqAddressChangeFn") returned 0x76c56cb0 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerInqLocalConnAddress") returned 0x76c56cc0 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerInqRemoteConnAddress") returned 0x76c56d50 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerInqTransportType") returned 0x76c690c0 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerIsClientDisconnected") returned 0x76c56de0 [0112.670] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerRegisterForwardFunction") returned 0x76c56e70 [0112.671] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerSetAddressChangeFn") returned 0x76c56ea0 [0112.671] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerStartService") returned 0x76c56ec0 [0112.671] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerSubscribeForDisconnectNotification") returned 0x76c35f30 [0112.671] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerTurnOnOffKeepalives") returned 0x76c569e0 [0112.673] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerUseProtseq2A") returned 0x76c6fa60 [0112.673] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerUseProtseq2W") returned 0x76c56f10 [0112.673] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerUseProtseqEp2A") returned 0x76c6fbc0 [0112.673] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcServerUseProtseqEp2W") returned 0x76c357c0 [0112.673] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcSessionStrictContextHandle") returned 0x76c56f90 [0112.673] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcSetDCOMAppId") returned 0x76c364b0 [0112.673] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcSsDontSerializeContext") returned 0x76c81510 [0112.674] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcSystemFunction001") returned 0x76c69fa0 [0112.674] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransConnectionAllocatePacket") returned 0x76c5f890 [0112.674] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransConnectionFreePacket") returned 0x76c5f8b0 [0112.674] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransConnectionReallocPacket") returned 0x76c36250 [0112.674] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransDatagramAllocate") returned 0x76c70ce0 [0112.674] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransDatagramAllocate2") returned 0x76c70ce0 [0112.674] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransDatagramFree") returned 0x76c392a0 [0112.675] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransGetThreadEvent") returned 0x76c69610 [0112.675] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransGetThreadEventThreadOptional") returned 0x76c13100 [0112.675] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransIoCancelled") returned 0x76c5f930 [0112.675] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTransServerNewConnection") returned 0x76c68de0 [0112.675] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcTurnOnEEInfoPropagation") returned 0x76c59600 [0112.675] GetProcAddress (hModule=0x76c00000, lpProcName="I_RpcVerifierCorruptionExpected") returned 0x76c585e0 [0112.675] GetProcAddress (hModule=0x76c00000, lpProcName="I_UuidCreate") returned 0x76c70cf0 [0112.676] GetProcAddress (hModule=0x76c00000, lpProcName="MIDL_wchar_strcpy") returned 0x76c81b60 [0112.676] GetProcAddress (hModule=0x76c00000, lpProcName="MIDL_wchar_strlen") returned 0x76c81b90 [0112.676] GetProcAddress (hModule=0x76c00000, lpProcName="MesBufferHandleReset") returned 0x76c33c20 [0112.676] GetProcAddress (hModule=0x76c00000, lpProcName="MesDecodeBufferHandleCreate") returned 0x76c33a40 [0112.676] GetProcAddress (hModule=0x76c00000, lpProcName="MesDecodeIncrementalHandleCreate") returned 0x76c339e0 [0112.676] GetProcAddress (hModule=0x76c00000, lpProcName="MesEncodeDynBufferHandleCreate") returned 0x76c33980 [0112.676] GetProcAddress (hModule=0x76c00000, lpProcName="MesEncodeFixedBufferHandleCreate") returned 0x76c33bb0 [0112.677] GetProcAddress (hModule=0x76c00000, lpProcName="MesEncodeIncrementalHandleCreate") returned 0x76c86800 [0112.677] GetProcAddress (hModule=0x76c00000, lpProcName="MesHandleFree") returned 0x76c34610 [0112.677] GetProcAddress (hModule=0x76c00000, lpProcName="MesIncrementalHandleReset") returned 0x76c33ac0 [0112.677] GetProcAddress (hModule=0x76c00000, lpProcName="MesInqProcEncodingId") returned 0x76c86870 [0112.677] GetProcAddress (hModule=0x76c00000, lpProcName="NDRCContextBinding") returned 0x76c294d0 [0112.677] GetProcAddress (hModule=0x76c00000, lpProcName="NDRCContextMarshall") returned 0x76c29700 [0112.678] GetProcAddress (hModule=0x76c00000, lpProcName="NDRCContextUnmarshall") returned 0x76c80b20 [0112.678] GetProcAddress (hModule=0x76c00000, lpProcName="NDRSContextMarshall") returned 0x76c816c0 [0112.678] GetProcAddress (hModule=0x76c00000, lpProcName="NDRSContextMarshall2") returned 0x76c81520 [0112.678] GetProcAddress (hModule=0x76c00000, lpProcName="NDRSContextMarshallEx") returned 0x76c816f0 [0112.678] GetProcAddress (hModule=0x76c00000, lpProcName="NDRSContextUnmarshall") returned 0x76c81a10 [0112.678] GetProcAddress (hModule=0x76c00000, lpProcName="NDRSContextUnmarshall2") returned 0x76c81720 [0112.678] GetProcAddress (hModule=0x76c00000, lpProcName="NDRSContextUnmarshallEx") returned 0x76c81a40 [0112.679] GetProcAddress (hModule=0x76c00000, lpProcName="NDRcopy") returned 0x76c81c60 [0112.679] GetProcAddress (hModule=0x76c00000, lpProcName="NdrAllocate") returned 0x76c87660 [0112.679] GetProcAddress (hModule=0x76c00000, lpProcName="NdrAsyncClientCall") returned 0x76c03000 [0112.679] GetProcAddress (hModule=0x76c00000, lpProcName="NdrAsyncClientCall2") returned 0x76c02b30 [0112.679] GetProcAddress (hModule=0x76c00000, lpProcName="NdrAsyncServerCall") returned 0x76c04dc0 [0112.680] GetProcAddress (hModule=0x76c00000, lpProcName="NdrByteCountPointerBufferSize") returned 0x76c84730 [0112.680] GetProcAddress (hModule=0x76c00000, lpProcName="NdrByteCountPointerFree") returned 0x76c837c0 [0112.680] GetProcAddress (hModule=0x76c00000, lpProcName="NdrByteCountPointerMarshall") returned 0x76c83d40 [0112.680] GetProcAddress (hModule=0x76c00000, lpProcName="NdrByteCountPointerUnmarshall") returned 0x76c32d60 [0112.681] GetProcAddress (hModule=0x76c00000, lpProcName="NdrCStdStubBuffer2_Release") returned 0x76c35390 [0112.681] GetProcAddress (hModule=0x76c00000, lpProcName="NdrCStdStubBuffer_Release") returned 0x76c34890 [0112.681] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClearOutParameters") returned 0x76c04ae0 [0112.681] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClientCall") returned 0x76c05280 [0112.681] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClientCall2") returned 0x76c03360 [0112.681] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClientCall4") returned 0x76c03340 [0112.681] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClientContextMarshall") returned 0x76c83dc0 [0112.682] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClientContextUnmarshall") returned 0x76c84e60 [0112.682] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClientInitialize") returned 0x76c29d80 [0112.682] GetProcAddress (hModule=0x76c00000, lpProcName="NdrClientInitializeNew") returned 0x76c29bc0 [0112.682] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexArrayBufferSize") returned 0x76c2d260 [0112.682] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexArrayFree") returned 0x76c2b4b0 [0112.682] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexArrayMarshall") returned 0x76c2b8f0 [0112.682] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexArrayMemorySize") returned 0x76c31950 [0112.683] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexArrayUnmarshall") returned 0x76c32090 [0112.683] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexStructBufferSize") returned 0x76c2d800 [0112.683] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexStructFree") returned 0x76c2b6c0 [0112.683] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexStructMarshall") returned 0x76c2bcb0 [0112.683] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexStructMemorySize") returned 0x76c30db0 [0112.683] GetProcAddress (hModule=0x76c00000, lpProcName="NdrComplexStructUnmarshall") returned 0x76c2f1f0 [0112.684] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantArrayBufferSize") returned 0x76c2fd90 [0112.684] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantArrayFree") returned 0x76c2e1c0 [0112.684] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantArrayMarshall") returned 0x76c2fdc0 [0112.684] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantArrayMemorySize") returned 0x76c317a0 [0112.684] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantArrayUnmarshall") returned 0x76c2e200 [0112.684] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStringBufferSize") returned 0x76c28bc0 [0112.684] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStringMarshall") returned 0x76c28cf0 [0112.685] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStringMemorySize") returned 0x76c289f0 [0112.685] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStringUnmarshall") returned 0x76c2ff80 [0112.685] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStructBufferSize") returned 0x76c32540 [0112.685] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStructFree") returned 0x76c83810 [0112.685] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStructMarshall") returned 0x76c32b30 [0112.685] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStructMemorySize") returned 0x76c275a0 [0112.685] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantStructUnmarshall") returned 0x76c322f0 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingArrayBufferSize") returned 0x76c26bf0 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingArrayFree") returned 0x76c83860 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingArrayMarshall") returned 0x76c26ae0 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingArrayMemorySize") returned 0x76c32a30 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingArrayUnmarshall") returned 0x76c280c0 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingStructBufferSize") returned 0x76c84780 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingStructFree") returned 0x76c838c0 [0112.686] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingStructMarshall") returned 0x76c83e10 [0112.687] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingStructMemorySize") returned 0x76c87db0 [0112.690] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConformantVaryingStructUnmarshall") returned 0x76c84eb0 [0112.690] GetProcAddress (hModule=0x76c00000, lpProcName="NdrContextHandleInitialize") returned 0x76c853b0 [0112.690] GetProcAddress (hModule=0x76c00000, lpProcName="NdrContextHandleSize") returned 0x76c84850 [0112.690] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConvert") returned 0x76c89d80 [0112.691] GetProcAddress (hModule=0x76c00000, lpProcName="NdrConvert2") returned 0x76c89ce0 [0112.691] GetProcAddress (hModule=0x76c00000, lpProcName="NdrCorrelationFree") returned 0x76c287d0 [0112.691] GetProcAddress (hModule=0x76c00000, lpProcName="NdrCorrelationInitialize") returned 0x76c28780 [0112.691] GetProcAddress (hModule=0x76c00000, lpProcName="NdrCorrelationPass") returned 0x76c29b70 [0112.691] GetProcAddress (hModule=0x76c00000, lpProcName="NdrCreateServerInterfaceFromStub") returned 0x76c85c20 [0112.691] GetProcAddress (hModule=0x76c00000, lpProcName="NdrDcomAsyncClientCall") returned 0x76c85c80 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrDcomAsyncClientCall2") returned 0x76c85cf0 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrDcomAsyncStubCall") returned 0x76c85d10 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrDllCanUnloadNow") returned 0x76c35070 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrDllGetClassObject") returned 0x76c33ee0 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrDllRegisterProxy") returned 0x76c85d80 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrDllUnregisterProxy") returned 0x76c85df0 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrEncapsulatedUnionBufferSize") returned 0x76c84890 [0112.692] GetProcAddress (hModule=0x76c00000, lpProcName="NdrEncapsulatedUnionFree") returned 0x76c83930 [0112.693] GetProcAddress (hModule=0x76c00000, lpProcName="NdrEncapsulatedUnionMarshall") returned 0x76c83f30 [0112.693] GetProcAddress (hModule=0x76c00000, lpProcName="NdrEncapsulatedUnionMemorySize") returned 0x76c87f20 [0112.693] GetProcAddress (hModule=0x76c00000, lpProcName="NdrEncapsulatedUnionUnmarshall") returned 0x76c85460 [0112.693] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFixedArrayBufferSize") returned 0x76c34b40 [0112.693] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFixedArrayFree") returned 0x76c839d0 [0112.693] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFixedArrayMarshall") returned 0x76c349f0 [0112.693] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFixedArrayMemorySize") returned 0x76c32c10 [0112.694] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFixedArrayUnmarshall") returned 0x76c32ca0 [0112.694] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFreeBuffer") returned 0x76c26710 [0112.694] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFullPointerFree") returned 0x76c83090 [0112.694] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFullPointerInsertRefId") returned 0x76c38870 [0112.694] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFullPointerQueryPointer") returned 0x76c16010 [0112.694] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFullPointerQueryRefId") returned 0x76c0de60 [0112.695] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFullPointerXlatFree") returned 0x76c26900 [0112.695] GetProcAddress (hModule=0x76c00000, lpProcName="NdrFullPointerXlatInit") returned 0x76c15df0 [0112.695] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetBaseInterfaceFromStub") returned 0x76c85e60 [0112.695] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetBuffer") returned 0x76c1c410 [0112.695] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetDcomProtocolVersion") returned 0x76c85ed0 [0112.695] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetSimpleTypeBufferAlignment") returned 0x76c89ff0 [0112.695] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetSimpleTypeBufferSize") returned 0x76c8a010 [0112.696] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetSimpleTypeMemorySize") returned 0x76c8a030 [0112.696] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetTypeFlags") returned 0x76c378c0 [0112.696] GetProcAddress (hModule=0x76c00000, lpProcName="NdrGetUserMarshalInfo") returned 0x76c336c0 [0112.696] GetProcAddress (hModule=0x76c00000, lpProcName="NdrInterfacePointerBufferSize") returned 0x76c84940 [0112.696] GetProcAddress (hModule=0x76c00000, lpProcName="NdrInterfacePointerFree") returned 0x76c83a10 [0112.696] GetProcAddress (hModule=0x76c00000, lpProcName="NdrInterfacePointerMarshall") returned 0x76c83fe0 [0112.697] GetProcAddress (hModule=0x76c00000, lpProcName="NdrInterfacePointerMemorySize") returned 0x76c38aa0 [0112.697] GetProcAddress (hModule=0x76c00000, lpProcName="NdrInterfacePointerUnmarshall") returned 0x76c38960 [0112.697] GetProcAddress (hModule=0x76c00000, lpProcName="NdrMapCommAndFaultStatus") returned 0x76c0e420 [0112.697] GetProcAddress (hModule=0x76c00000, lpProcName="NdrMesProcEncodeDecode") returned 0x76c869a0 [0112.697] GetProcAddress (hModule=0x76c00000, lpProcName="NdrMesProcEncodeDecode2") returned 0x76c86cb0 [0112.697] GetProcAddress (hModule=0x76c00000, lpProcName="NdrMesProcEncodeDecode4") returned 0x76c86ef0 [0112.697] GetProcAddress (hModule=0x76c00000, lpProcName="NdrMesSimpleTypeAlignSize") returned 0x76c86f20 [0112.698] GetProcAddress (hModule=0x76c00000, lpProcName="NdrMesSimpleTypeDecode") returned 0x76c86f60 [0112.698] GetProcAddress (hModule=0x76c00000, lpProcName="NdrMesSimpleTypeEncode") returned 0x76c87030 [0112.718] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73f00000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0112.719] GetModuleFileNameA (in: hModule=0x73f00000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0112.719] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.720] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=116216) returned 1 [0112.720] VirtualAlloc (lpAddress=0x0, dwSize=0x1c5f8, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0112.720] ReadFile (in: hFile=0x1b4, lpBuffer=0x540000, nNumberOfBytesToRead=0x1c5f8, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0x1c5f8, lpOverlapped=0x0) returned 1 [0112.724] CloseHandle (hObject=0x1b4) returned 1 [0112.724] GetProcAddress (hModule=0x73f00000, lpProcName="AcceptSecurityContext") returned 0x73f13670 [0112.725] GetProcAddress (hModule=0x73f00000, lpProcName="AcquireCredentialsHandleA") returned 0x73f12dc0 [0112.725] GetProcAddress (hModule=0x73f00000, lpProcName="AcquireCredentialsHandleW") returned 0x73f12d90 [0112.725] GetProcAddress (hModule=0x73f00000, lpProcName="AddCredentialsA") returned 0x73f13100 [0112.725] GetProcAddress (hModule=0x73f00000, lpProcName="AddCredentialsW") returned 0x73f13020 [0112.726] GetProcAddress (hModule=0x73f00000, lpProcName="AddSecurityPackageA") returned 0x73f0b4d0 [0112.726] GetProcAddress (hModule=0x73f00000, lpProcName="AddSecurityPackageW") returned 0x73f0b480 [0112.726] GetProcAddress (hModule=0x73f00000, lpProcName="ApplyControlToken") returned 0x73f13a70 [0112.726] GetProcAddress (hModule=0x73f00000, lpProcName="ChangeAccountPasswordA") returned 0x73f12c20 [0112.726] GetProcAddress (hModule=0x73f00000, lpProcName="ChangeAccountPasswordW") returned 0x73f12bf0 [0112.726] GetProcAddress (hModule=0x73f00000, lpProcName="CompleteAuthToken") returned 0x73f13c40 [0112.726] GetProcAddress (hModule=0x73f00000, lpProcName="CredMarshalTargetInfo") returned 0x73f045f0 [0112.727] GetProcAddress (hModule=0x73f00000, lpProcName="CredUnmarshalTargetInfo") returned 0x73f04910 [0112.727] GetProcAddress (hModule=0x73f00000, lpProcName="DecryptMessage") returned 0x73f145c0 [0112.727] GetProcAddress (hModule=0x73f00000, lpProcName="DeleteSecurityContext") returned 0x73f139c0 [0112.727] GetProcAddress (hModule=0x73f00000, lpProcName="DeleteSecurityPackageA") returned 0x73f0b540 [0112.727] GetProcAddress (hModule=0x73f00000, lpProcName="DeleteSecurityPackageW") returned 0x73f0b540 [0112.727] GetProcAddress (hModule=0x73f00000, lpProcName="EncryptMessage") returned 0x73f14550 [0112.727] GetProcAddress (hModule=0x73f00000, lpProcName="EnumerateSecurityPackagesA") returned 0x73f13b60 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="EnumerateSecurityPackagesW") returned 0x73f13ae0 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="ExportSecurityContext") returned 0x73f14690 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="FreeContextBuffer") returned 0x73f0b3c0 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="FreeCredentialsHandle") returned 0x73f131e0 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="GetSecurityUserInfo") returned 0x73f0b3a0 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="GetUserNameExA") returned 0x73f0c6f0 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="GetUserNameExW") returned 0x73f0c5f0 [0112.728] GetProcAddress (hModule=0x73f00000, lpProcName="ImpersonateSecurityContext") returned 0x73f13cb0 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="ImportSecurityContextA") returned 0x73f147c0 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="ImportSecurityContextW") returned 0x73f14710 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="InitSecurityInterfaceA") returned 0x73f14630 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="InitSecurityInterfaceW") returned 0x73f14660 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="InitializeSecurityContextA") returned 0x73f13290 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="InitializeSecurityContextW") returned 0x73f13250 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="LogonUserExExW") returned 0x73f16360 [0112.729] GetProcAddress (hModule=0x73f00000, lpProcName="LsaCallAuthenticationPackage") returned 0x73f03b10 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaConnectUntrusted") returned 0x73f03900 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaDeregisterLogonProcess") returned 0x73f03c50 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaEnumerateLogonSessions") returned 0x73f12950 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaFreeReturnBuffer") returned 0x73f03770 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaGetLogonSessionData") returned 0x73f12980 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaLogonUser") returned 0x73f03ad0 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaLookupAuthenticationPackage") returned 0x73f03a10 [0112.730] GetProcAddress (hModule=0x73f00000, lpProcName="LsaRegisterLogonProcess") returned 0x73f037e0 [0112.731] GetProcAddress (hModule=0x73f00000, lpProcName="LsaRegisterPolicyChangeNotification") returned 0x73f128f0 [0112.731] GetProcAddress (hModule=0x73f00000, lpProcName="LsaUnregisterPolicyChangeNotification") returned 0x73f12920 [0112.731] GetProcAddress (hModule=0x73f00000, lpProcName="MakeSignature") returned 0x73f14470 [0112.731] GetProcAddress (hModule=0x73f00000, lpProcName="QueryContextAttributesA") returned 0x73f13f10 [0112.731] GetProcAddress (hModule=0x73f00000, lpProcName="QueryContextAttributesExA") returned 0x73f13f80 [0112.731] GetProcAddress (hModule=0x73f00000, lpProcName="QueryContextAttributesExW") returned 0x73f13e80 [0112.731] GetProcAddress (hModule=0x73f00000, lpProcName="QueryContextAttributesW") returned 0x73f13e10 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="QueryCredentialsAttributesA") returned 0x73f14240 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="QueryCredentialsAttributesExA") returned 0x73f142c0 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="QueryCredentialsAttributesExW") returned 0x73f141b0 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="QueryCredentialsAttributesW") returned 0x73f14130 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="QuerySecurityContextToken") returned 0x73f13d20 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="QuerySecurityPackageInfoA") returned 0x73f13c10 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="QuerySecurityPackageInfoW") returned 0x73f13be0 [0112.732] GetProcAddress (hModule=0x73f00000, lpProcName="RevertSecurityContext") returned 0x73f13da0 [0112.733] GetProcAddress (hModule=0x73f00000, lpProcName="SaslAcceptSecurityContext") returned 0x73f15890 [0112.733] GetProcAddress (hModule=0x73f00000, lpProcName="SaslEnumerateProfilesA") returned 0x73f15530 [0112.733] GetProcAddress (hModule=0x73f00000, lpProcName="SaslEnumerateProfilesW") returned 0x73f15550 [0112.733] GetProcAddress (hModule=0x73f00000, lpProcName="SaslGetContextOption") returned 0x73f14eb0 [0112.733] GetProcAddress (hModule=0x73f00000, lpProcName="SaslGetProfilePackageA") returned 0x73f15570 [0112.733] GetProcAddress (hModule=0x73f00000, lpProcName="SaslGetProfilePackageW") returned 0x73f155d0 [0112.733] GetProcAddress (hModule=0x73f00000, lpProcName="SaslIdentifyPackageA") returned 0x73f15d10 [0112.734] GetProcAddress (hModule=0x73f00000, lpProcName="SaslIdentifyPackageW") returned 0x73f15d40 [0112.734] GetProcAddress (hModule=0x73f00000, lpProcName="SaslInitializeSecurityContextA") returned 0x73f15750 [0112.734] GetProcAddress (hModule=0x73f00000, lpProcName="SaslInitializeSecurityContextW") returned 0x73f15610 [0112.734] GetProcAddress (hModule=0x73f00000, lpProcName="SaslSetContextOption") returned 0x73f14fc0 [0112.734] GetProcAddress (hModule=0x73f00000, lpProcName="SealMessage") returned 0x73f14550 [0112.734] GetProcAddress (hModule=0x73f00000, lpProcName="SecCacheSspiPackages") returned 0x73f0f300 [0112.735] GetProcAddress (hModule=0x73f00000, lpProcName="SecDeleteUserModeContext") returned 0x73f125d0 [0112.735] GetProcAddress (hModule=0x73f00000, lpProcName="SecInitUserModeContext") returned 0x73f12530 [0112.735] GetProcAddress (hModule=0x73f00000, lpProcName="SeciAllocateAndSetCallFlags") returned 0x73f15dd0 [0112.735] GetProcAddress (hModule=0x73f00000, lpProcName="SeciAllocateAndSetIPAddress") returned 0x73f15d70 [0112.735] GetProcAddress (hModule=0x73f00000, lpProcName="SeciFreeCallContext") returned 0x73f15e20 [0112.735] GetProcAddress (hModule=0x73f00000, lpProcName="SeciIsProtectedUser") returned 0x73f129b0 [0112.735] GetProcAddress (hModule=0x73f00000, lpProcName="SetContextAttributesA") returned 0x73f140a0 [0112.736] GetProcAddress (hModule=0x73f00000, lpProcName="SetContextAttributesW") returned 0x73f14010 [0112.736] GetProcAddress (hModule=0x73f00000, lpProcName="SetCredentialsAttributesA") returned 0x73f143e0 [0112.736] GetProcAddress (hModule=0x73f00000, lpProcName="SetCredentialsAttributesW") returned 0x73f14350 [0112.736] GetProcAddress (hModule=0x73f00000, lpProcName="SspiCompareAuthIdentities") returned 0x73f0a050 [0112.736] GetProcAddress (hModule=0x73f00000, lpProcName="SspiCopyAuthIdentity") returned 0x73f09860 [0112.736] GetProcAddress (hModule=0x73f00000, lpProcName="SspiDecryptAuthIdentity") returned 0x73f0c4f0 [0112.737] GetProcAddress (hModule=0x73f00000, lpProcName="SspiDecryptAuthIdentityEx") returned 0x73f0c330 [0112.737] GetProcAddress (hModule=0x73f00000, lpProcName="SspiEncodeAuthIdentityAsStrings") returned 0x73f07fe0 [0112.737] GetProcAddress (hModule=0x73f00000, lpProcName="SspiEncodeStringsAsAuthIdentity") returned 0x73f08d00 [0112.737] GetProcAddress (hModule=0x73f00000, lpProcName="SspiEncryptAuthIdentity") returned 0x73f0c1a0 [0112.737] GetProcAddress (hModule=0x73f00000, lpProcName="SspiEncryptAuthIdentityEx") returned 0x73f0bfc0 [0112.737] GetProcAddress (hModule=0x73f00000, lpProcName="SspiExcludePackage") returned 0x73f0a580 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiFreeAuthIdentity") returned 0x73f09d30 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiGetComputerNameForSPN") returned 0x73f0c8a0 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiGetTargetHostName") returned 0x73f0a4b0 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiIsAuthIdentityEncrypted") returned 0x73f0c5a0 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiLocalFree") returned 0x73f07b90 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiMarshalAuthIdentity") returned 0x73f091c0 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiPrepareForCredRead") returned 0x73f0b330 [0112.738] GetProcAddress (hModule=0x73f00000, lpProcName="SspiPrepareForCredWrite") returned 0x73f0aec0 [0112.739] GetProcAddress (hModule=0x73f00000, lpProcName="SspiUnmarshalAuthIdentity") returned 0x73f09720 [0112.739] GetProcAddress (hModule=0x73f00000, lpProcName="SspiUnmarshalAuthIdentityInternal") returned 0x73f09470 [0112.739] GetProcAddress (hModule=0x73f00000, lpProcName="SspiValidateAuthIdentity") returned 0x73f09740 [0112.739] GetProcAddress (hModule=0x73f00000, lpProcName="SspiZeroAuthIdentity") returned 0x73f09dc0 [0112.739] GetProcAddress (hModule=0x73f00000, lpProcName="UnsealMessage") returned 0x73f145c0 [0112.739] GetProcAddress (hModule=0x73f00000, lpProcName="VerifySignature") returned 0x73f144e0 [0112.739] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.742] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73ef0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0112.743] GetModuleFileNameA (in: hModule=0x73ef0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0112.743] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.743] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=31528) returned 1 [0112.743] VirtualAlloc (lpAddress=0x0, dwSize=0x7b28, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0112.743] ReadFile (in: hFile=0x1b4, lpBuffer=0x540000, nNumberOfBytesToRead=0x7b28, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0x7b28, lpOverlapped=0x0) returned 1 [0112.748] CloseHandle (hObject=0x1b4) returned 1 [0112.748] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction001") returned 0x73ef4ca0 [0112.748] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction002") returned 0x73ef2530 [0112.749] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction003") returned 0x73ef2cb0 [0112.749] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction004") returned 0x73ef49a0 [0112.749] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction005") returned 0x73ef4ae0 [0112.749] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction028") returned 0x73ef43a0 [0112.749] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction029") returned 0x73ef2c00 [0112.749] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction034") returned 0x73ef43f0 [0112.750] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction036") returned 0x73ef2a60 [0112.750] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction040") returned 0x73ef2a90 [0112.750] GetProcAddress (hModule=0x73ef0000, lpProcName="SystemFunction041") returned 0x73ef2b00 [0112.750] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.752] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76840000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")) returned 0x28 [0112.752] GetModuleFileNameA (in: hModule=0x76840000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")) returned 0x28 [0112.752] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.752] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=360480) returned 1 [0112.753] VirtualAlloc (lpAddress=0x0, dwSize=0x58020, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0112.753] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x58020, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x58020, lpOverlapped=0x0) returned 1 [0112.765] CloseHandle (hObject=0x1b4) returned 1 [0112.766] GetProcAddress (hModule=0x76840000, lpProcName="GetAsymmetricEncryptionInterface") returned 0x7686c770 [0112.766] GetProcAddress (hModule=0x76840000, lpProcName="GetCipherInterface") returned 0x7686c530 [0112.766] GetProcAddress (hModule=0x76840000, lpProcName="GetHashInterface") returned 0x768598c0 [0112.766] GetProcAddress (hModule=0x76840000, lpProcName="GetKeyDerivationInterface") returned 0x7686c820 [0112.766] GetProcAddress (hModule=0x76840000, lpProcName="GetRngInterface") returned 0x7686c6a0 [0112.766] GetProcAddress (hModule=0x76840000, lpProcName="GetSecretAgreementInterface") returned 0x7686d340 [0112.767] GetProcAddress (hModule=0x76840000, lpProcName="GetSignatureInterface") returned 0x7684d580 [0112.767] GetProcAddress (hModule=0x76840000, lpProcName="ProcessPrng") returned 0x7685aa60 [0112.767] GetProcAddress (hModule=0x76840000, lpProcName="ProcessPrngGuid") returned 0x76882970 [0112.767] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.773] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76cb0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0112.773] GetModuleFileNameA (in: hModule=0x76cb0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0112.773] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.773] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=269616) returned 1 [0112.773] VirtualAlloc (lpAddress=0x0, dwSize=0x41d30, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0112.774] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x41d30, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x41d30, lpOverlapped=0x0) returned 1 [0112.785] CloseHandle (hObject=0x1b4) returned 1 [0112.785] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditComputeEffectivePolicyBySid") returned 0x76ccd650 [0112.785] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditEnumerateCategories") returned 0x76ce3400 [0112.785] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditEnumeratePerUserPolicy") returned 0x76ce34f0 [0112.785] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditEnumerateSubCategories") returned 0x76ce3570 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditFree") returned 0x76ccabd0 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditLookupCategoryNameW") returned 0x76ce3670 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditLookupSubCategoryNameW") returned 0x76ce3770 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditQueryGlobalSaclW") returned 0x76ce3870 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditQueryPerUserPolicy") returned 0x76ce38c0 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditQuerySecurity") returned 0x76ce3950 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditQuerySystemPolicy") returned 0x76ccd5e0 [0112.786] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditSetGlobalSaclW") returned 0x76ce39f0 [0112.787] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditSetPerUserPolicy") returned 0x76ce3a40 [0112.787] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditSetSecurity") returned 0x76ce3ad0 [0112.787] GetProcAddress (hModule=0x76cb0000, lpProcName="AuditSetSystemPolicy") returned 0x76ce3bc0 [0112.787] GetProcAddress (hModule=0x76cb0000, lpProcName="BuildSecurityDescriptorForSharingAccess") returned 0x76cccab0 [0112.787] GetProcAddress (hModule=0x76cb0000, lpProcName="BuildSecurityDescriptorForSharingAccessEx") returned 0x76cccae0 [0112.787] GetProcAddress (hModule=0x76cb0000, lpProcName="CapabilityCheck") returned 0x76cc9cd0 [0112.787] GetProcAddress (hModule=0x76cb0000, lpProcName="ChangeServiceConfig2A") returned 0x76cdba70 [0112.788] GetProcAddress (hModule=0x76cb0000, lpProcName="ChangeServiceConfig2W") returned 0x76ccd3d0 [0112.788] GetProcAddress (hModule=0x76cb0000, lpProcName="ChangeServiceConfigA") returned 0x76cdbb90 [0112.788] GetProcAddress (hModule=0x76cb0000, lpProcName="ChangeServiceConfigW") returned 0x76cba110 [0112.788] GetProcAddress (hModule=0x76cb0000, lpProcName="CloseServiceHandle") returned 0x76cbd000 [0112.789] GetProcAddress (hModule=0x76cb0000, lpProcName="CloseTrace") returned 0x76cc4510 [0112.789] GetProcAddress (hModule=0x76cb0000, lpProcName="ControlService") returned 0x76cba330 [0112.789] GetProcAddress (hModule=0x76cb0000, lpProcName="ControlServiceExA") returned 0x76cdbd20 [0112.789] GetProcAddress (hModule=0x76cb0000, lpProcName="ControlServiceExW") returned 0x76cba440 [0112.790] GetProcAddress (hModule=0x76cb0000, lpProcName="ControlTraceA") returned 0x76cddbe0 [0112.790] GetProcAddress (hModule=0x76cb0000, lpProcName="ControlTraceW") returned 0x76cc7af0 [0112.790] GetProcAddress (hModule=0x76cb0000, lpProcName="ConvertSecurityDescriptorToStringSecurityDescriptorW") returned 0x76cbe3b0 [0112.790] GetProcAddress (hModule=0x76cb0000, lpProcName="ConvertSidToStringSidW") returned 0x76cbd3c0 [0112.791] GetProcAddress (hModule=0x76cb0000, lpProcName="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned 0x76cbe360 [0112.791] GetProcAddress (hModule=0x76cb0000, lpProcName="ConvertStringSidToSidW") returned 0x76cc0d80 [0112.791] GetProcAddress (hModule=0x76cb0000, lpProcName="CreateServiceA") returned 0x76cdbe10 [0112.791] GetProcAddress (hModule=0x76cb0000, lpProcName="CreateServiceW") returned 0x76cdc050 [0112.791] GetProcAddress (hModule=0x76cb0000, lpProcName="CredBackupCredentials") returned 0x76ce3da0 [0112.792] GetProcAddress (hModule=0x76cb0000, lpProcName="CredDeleteA") returned 0x76ce3ec0 [0112.792] GetProcAddress (hModule=0x76cb0000, lpProcName="CredDeleteW") returned 0x76cc24e0 [0112.792] GetProcAddress (hModule=0x76cb0000, lpProcName="CredEncryptAndMarshalBinaryBlob") returned 0x76ce4c10 [0112.792] GetProcAddress (hModule=0x76cb0000, lpProcName="CredEnumerateA") returned 0x76ce3f70 [0112.792] GetProcAddress (hModule=0x76cb0000, lpProcName="CredEnumerateW") returned 0x76cc2ed0 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredFindBestCredentialA") returned 0x76ce4060 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredFindBestCredentialW") returned 0x76ce4130 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredFree") returned 0x76ccabd0 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredGetSessionTypes") returned 0x76ce4200 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredGetTargetInfoA") returned 0x76ce4280 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredGetTargetInfoW") returned 0x76ce4360 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredIsMarshaledCredentialW") returned 0x76ccb0c0 [0112.793] GetProcAddress (hModule=0x76cb0000, lpProcName="CredIsProtectedA") returned 0x76ce4c40 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredIsProtectedW") returned 0x76ccb0f0 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredMarshalCredentialA") returned 0x76ce4cb0 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredMarshalCredentialW") returned 0x76ccbf00 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredParseUserNameWithType") returned 0x76ccafc0 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredProfileLoaded") returned 0x76ce4440 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredProfileLoadedEx") returned 0x76cc2570 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredProfileUnloaded") returned 0x76ce44b0 [0112.794] GetProcAddress (hModule=0x76cb0000, lpProcName="CredProtectA") returned 0x76ce4d10 [0112.795] GetProcAddress (hModule=0x76cb0000, lpProcName="CredProtectW") returned 0x76ccbd30 [0112.795] GetProcAddress (hModule=0x76cb0000, lpProcName="CredReadA") returned 0x76ce4520 [0112.795] GetProcAddress (hModule=0x76cb0000, lpProcName="CredReadByTokenHandle") returned 0x76ce45f0 [0112.795] GetProcAddress (hModule=0x76cb0000, lpProcName="CredReadDomainCredentialsA") returned 0x76ce46d0 [0112.795] GetProcAddress (hModule=0x76cb0000, lpProcName="CredReadDomainCredentialsW") returned 0x76ce47c0 [0112.795] GetProcAddress (hModule=0x76cb0000, lpProcName="CredReadW") returned 0x76cb9ee0 [0112.795] GetProcAddress (hModule=0x76cb0000, lpProcName="CredRestoreCredentials") returned 0x76ce48b0 [0112.796] GetProcAddress (hModule=0x76cb0000, lpProcName="CredUnmarshalCredentialA") returned 0x76ce4e30 [0112.796] GetProcAddress (hModule=0x76cb0000, lpProcName="CredUnmarshalCredentialW") returned 0x76ccb180 [0112.796] GetProcAddress (hModule=0x76cb0000, lpProcName="CredUnprotectA") returned 0x76ce4ea0 [0112.796] GetProcAddress (hModule=0x76cb0000, lpProcName="CredUnprotectW") returned 0x76ccd070 [0112.797] GetProcAddress (hModule=0x76cb0000, lpProcName="CredWriteA") returned 0x76ce49d0 [0112.797] GetProcAddress (hModule=0x76cb0000, lpProcName="CredWriteDomainCredentialsA") returned 0x76ce4a70 [0112.797] GetProcAddress (hModule=0x76cb0000, lpProcName="CredWriteDomainCredentialsW") returned 0x76ce4b40 [0112.797] GetProcAddress (hModule=0x76cb0000, lpProcName="CredWriteW") returned 0x76cc2cd0 [0112.797] GetProcAddress (hModule=0x76cb0000, lpProcName="CredpConvertCredential") returned 0x76cc2d50 [0112.797] GetProcAddress (hModule=0x76cb0000, lpProcName="CredpConvertOneCredentialSize") returned 0x76cc3950 [0112.797] GetProcAddress (hModule=0x76cb0000, lpProcName="CredpConvertTargetInfo") returned 0x76ce4fe0 [0112.798] GetProcAddress (hModule=0x76cb0000, lpProcName="CredpDecodeCredential") returned 0x76cc3fa0 [0112.798] GetProcAddress (hModule=0x76cb0000, lpProcName="CredpEncodeCredential") returned 0x76cc3b10 [0112.798] GetProcAddress (hModule=0x76cb0000, lpProcName="CredpEncodeSecret") returned 0x76ce51e0 [0112.798] GetProcAddress (hModule=0x76cb0000, lpProcName="DeleteService") returned 0x76cdc1f0 [0112.798] GetProcAddress (hModule=0x76cb0000, lpProcName="EnableTraceEx2") returned 0x76cc8000 [0112.798] GetProcAddress (hModule=0x76cb0000, lpProcName="EnumDependentServicesW") returned 0x76ccbc10 [0112.799] GetProcAddress (hModule=0x76cb0000, lpProcName="EnumServicesStatusExW") returned 0x76cbbec0 [0112.799] GetProcAddress (hModule=0x76cb0000, lpProcName="EnumerateIdentityProviders") returned 0x76cca160 [0112.799] GetProcAddress (hModule=0x76cb0000, lpProcName="EnumerateTraceGuidsEx") returned 0x76ccac40 [0112.799] GetProcAddress (hModule=0x76cb0000, lpProcName="EtwQueryRealtimeConsumer") returned 0x76cdd8e0 [0112.799] GetProcAddress (hModule=0x76cb0000, lpProcName="EventAccessControl") returned 0x76cde210 [0112.800] GetProcAddress (hModule=0x76cb0000, lpProcName="EventAccessQuery") returned 0x76cde260 [0112.800] GetProcAddress (hModule=0x76cb0000, lpProcName="EventAccessRemove") returned 0x76cde370 [0112.800] GetProcAddress (hModule=0x76cb0000, lpProcName="FreeTransientObjectSecurityDescriptor") returned 0x76cbd9c0 [0112.800] GetProcAddress (hModule=0x76cb0000, lpProcName="GetDefaultIdentityProvider") returned 0x76cc9ff0 [0112.800] GetProcAddress (hModule=0x76cb0000, lpProcName="GetIdentityProviderInfoByGUID") returned 0x76cca050 [0112.800] GetProcAddress (hModule=0x76cb0000, lpProcName="GetIdentityProviderInfoByName") returned 0x76ccc9f0 [0112.800] GetProcAddress (hModule=0x76cb0000, lpProcName="GetServiceDisplayNameW") returned 0x76ccb3a0 [0112.801] GetProcAddress (hModule=0x76cb0000, lpProcName="GetServiceKeyNameW") returned 0x76ccb4a0 [0112.801] GetProcAddress (hModule=0x76cb0000, lpProcName="I_QueryTagInformation") returned 0x76cbae70 [0112.801] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScBroadcastServiceControlMessage") returned 0x76ccbba0 [0112.801] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScIsSecurityProcess") returned 0x76ccd980 [0112.801] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScPnPGetServiceName") returned 0x76cbb1c0 [0112.801] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScQueryServiceConfig") returned 0x76cbcdf0 [0112.801] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScRegisterDeviceNotification") returned 0x76cba9f0 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScRegisterPreshutdownRestart") returned 0x76cdc260 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScReparseServiceDatabase") returned 0x76cdc2f0 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScRpcBindA") returned 0x76cdcd80 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScRpcBindW") returned 0x76cbb440 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScSendPnPMessage") returned 0x76cbc690 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScSendTSMessage") returned 0x76ccbba0 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScSetServiceBitsA") returned 0x76cdba50 [0112.802] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScSetServiceBitsW") returned 0x76ccd4d0 [0112.803] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScUnregisterDeviceNotification") returned 0x76ccaa30 [0112.803] GetProcAddress (hModule=0x76cb0000, lpProcName="I_ScValidatePnPService") returned 0x76cbb120 [0112.803] GetProcAddress (hModule=0x76cb0000, lpProcName="LocalGetConditionForString") returned 0x76cc25c0 [0112.803] GetProcAddress (hModule=0x76cb0000, lpProcName="LocalGetReferencedTokenTypesForCondition") returned 0x76cd9d40 [0112.803] GetProcAddress (hModule=0x76cb0000, lpProcName="LocalGetStringForCondition") returned 0x76ccb570 [0112.803] GetProcAddress (hModule=0x76cb0000, lpProcName="LookupAccountNameLocalA") returned 0x76cd6e30 [0112.804] GetProcAddress (hModule=0x76cb0000, lpProcName="LookupAccountNameLocalW") returned 0x76cc19c0 [0112.804] GetProcAddress (hModule=0x76cb0000, lpProcName="LookupAccountSidLocalA") returned 0x76cd6f40 [0112.804] GetProcAddress (hModule=0x76cb0000, lpProcName="LookupAccountSidLocalW") returned 0x76cc1d40 [0112.804] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaAddAccountRights") returned 0x76ce1a50 [0112.805] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaClose") returned 0x76cc33d0 [0112.805] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaCreateSecret") returned 0x76ce2930 [0112.805] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaDelete") returned 0x76ce1c20 [0112.805] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaEnumerateAccountRights") returned 0x76ccbcc0 [0112.805] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaEnumerateAccountsWithUserRight") returned 0x76ce1ae0 [0112.805] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaFreeMemory") returned 0x76ccaa10 [0112.805] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaICLookupNames") returned 0x76ce1cb0 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaICLookupNamesWithCreds") returned 0x76ce2240 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaICLookupSids") returned 0x76cc30e0 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaICLookupSidsWithCreds") returned 0x76ce2390 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupClose") returned 0x76cc21c0 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupFreeMemory") returned 0x76ccaa10 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupGetDomainInfo") returned 0x76cc18f0 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupManageSidNameMapping") returned 0x76cc23f0 [0112.806] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupNames2") returned 0x76ce2510 [0112.807] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupOpenLocalPolicy") returned 0x76cc2210 [0112.807] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupSids") returned 0x76cc2fa0 [0112.807] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupSids2") returned 0x76ce2560 [0112.807] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupTranslateNames") returned 0x76cc1c30 [0112.807] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupTranslateSids") returned 0x76cc1ff0 [0112.807] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaLookupUserAccountType") returned 0x76cc1950 [0112.807] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaOpenPolicy") returned 0x76cc32b0 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaOpenSecret") returned 0x76ce29f0 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaQueryInformationPolicy") returned 0x76cc3220 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaQuerySecret") returned 0x76ce2ab0 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaRemoveAccountRights") returned 0x76ce1b90 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaRetrievePrivateData") returned 0x76ccc2f0 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaSetInformationPolicy") returned 0x76ce2590 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaSetSecret") returned 0x76ce2e20 [0112.808] GetProcAddress (hModule=0x76cb0000, lpProcName="LsaStorePrivateData") returned 0x76ce2fd0 [0112.809] GetProcAddress (hModule=0x76cb0000, lpProcName="NotifyServiceStatusChange") returned 0x76cbb360 [0112.809] GetProcAddress (hModule=0x76cb0000, lpProcName="NotifyServiceStatusChangeA") returned 0x76cba200 [0112.809] GetProcAddress (hModule=0x76cb0000, lpProcName="NotifyServiceStatusChangeW") returned 0x76cbb360 [0112.809] GetProcAddress (hModule=0x76cb0000, lpProcName="OpenSCManagerA") returned 0x76cbce70 [0112.809] GetProcAddress (hModule=0x76cb0000, lpProcName="OpenSCManagerW") returned 0x76cbcf00 [0112.809] GetProcAddress (hModule=0x76cb0000, lpProcName="OpenServiceA") returned 0x76cba2b0 [0112.809] GetProcAddress (hModule=0x76cb0000, lpProcName="OpenServiceW") returned 0x76cbcf90 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="OpenTraceW") returned 0x76cc74f0 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="ProcessTrace") returned 0x76cc45f0 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryAllTracesA") returned 0x76cde400 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryAllTracesW") returned 0x76cc3fe0 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryLocalUserServiceName") returned 0x76cbc9c0 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceConfig2A") returned 0x76cdc380 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceConfig2W") returned 0x76cbc770 [0112.810] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceConfigA") returned 0x76ccd440 [0112.811] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceConfigW") returned 0x76cbc900 [0112.811] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceDynamicInformation") returned 0x76cdc880 [0112.811] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceObjectSecurity") returned 0x76cdc5b0 [0112.811] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceStatus") returned 0x76cbc010 [0112.811] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryServiceStatusEx") returned 0x76cbbf90 [0112.811] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryTransientObjectSecurityDescriptor") returned 0x76cbdd40 [0112.811] GetProcAddress (hModule=0x76cb0000, lpProcName="QueryUserServiceName") returned 0x76cdc650 [0112.812] GetProcAddress (hModule=0x76cb0000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x76cdc8f0 [0112.812] GetProcAddress (hModule=0x76cb0000, lpProcName="RegisterServiceCtrlHandlerExA") returned 0x76cba1b0 [0112.812] GetProcAddress (hModule=0x76cb0000, lpProcName="RegisterServiceCtrlHandlerExW") returned 0x76cbb380 [0112.812] GetProcAddress (hModule=0x76cb0000, lpProcName="RegisterServiceCtrlHandlerW") returned 0x76cba420 [0112.813] GetProcAddress (hModule=0x76cb0000, lpProcName="RegisterTraceGuidsA") returned 0x7723a9c0 [0112.813] GetProcAddress (hModule=0x76cb0000, lpProcName="ReleaseIdentityProviderEnumContext") returned 0x76cca0f0 [0112.813] GetProcAddress (hModule=0x76cb0000, lpProcName="RemoveTraceCallback") returned 0x76cdd9e0 [0112.813] GetProcAddress (hModule=0x76cb0000, lpProcName="RpcClientCapabilityCheck") returned 0x76ccddc0 [0112.813] GetProcAddress (hModule=0x76cb0000, lpProcName="SetServiceObjectSecurity") returned 0x76ccd530 [0112.813] GetProcAddress (hModule=0x76cb0000, lpProcName="SetServiceStatus") returned 0x76cbc1b0 [0112.813] GetProcAddress (hModule=0x76cb0000, lpProcName="SetTraceCallback") returned 0x76cddad0 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="StartServiceA") returned 0x76cb9e90 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="StartServiceCtrlDispatcherA") returned 0x76ccd7f0 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="StartServiceCtrlDispatcherW") returned 0x76cba780 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="StartServiceW") returned 0x76cbcd90 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="StartTraceA") returned 0x76cde420 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="StartTraceW") returned 0x76cc8930 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="StopTraceW") returned 0x76ccb520 [0112.814] GetProcAddress (hModule=0x76cb0000, lpProcName="SubscribeServiceChangeNotifications") returned 0x76cbadc0 [0112.815] GetProcAddress (hModule=0x76cb0000, lpProcName="TraceQueryInformation") returned 0x76cde9b0 [0112.815] GetProcAddress (hModule=0x76cb0000, lpProcName="TraceSetInformation") returned 0x76ccad20 [0112.815] GetProcAddress (hModule=0x76cb0000, lpProcName="UnsubscribeServiceChangeNotifications") returned 0x76ccacf0 [0112.815] GetProcAddress (hModule=0x76cb0000, lpProcName="WaitServiceState") returned 0x76cbcc20 [0112.815] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.820] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x71510000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\iphlpapi.dll" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")) returned 0x20 [0112.821] GetModuleFileNameA (in: hModule=0x71510000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\iphlpapi.dll" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")) returned 0x20 [0112.821] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\iphlpapi.dll" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.821] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=187488) returned 1 [0112.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2dc60, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0112.822] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x2dc60, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x2dc60, lpOverlapped=0x0) returned 1 [0112.832] CloseHandle (hObject=0x1b4) returned 1 [0112.832] GetProcAddress (hModule=0x71510000, lpProcName="AddIPAddress") returned 0x7152eed0 [0112.832] GetProcAddress (hModule=0x71510000, lpProcName="AllocateAndGetInterfaceInfoFromStack") returned 0x7152daa0 [0112.832] GetProcAddress (hModule=0x71510000, lpProcName="AllocateAndGetIpAddrTableFromStack") returned 0x7152e5a0 [0112.833] GetProcAddress (hModule=0x71510000, lpProcName="CancelIPChangeNotify") returned 0x7151bf10 [0112.833] GetProcAddress (hModule=0x71510000, lpProcName="CancelMibChangeNotify2") returned 0x71515250 [0112.833] GetProcAddress (hModule=0x71510000, lpProcName="CloseCompartment") returned 0x71532b80 [0112.833] GetProcAddress (hModule=0x71510000, lpProcName="CloseGetIPPhysicalInterfaceForDestination") returned 0x7152e5d0 [0112.833] GetProcAddress (hModule=0x71510000, lpProcName="ConvertCompartmentGuidToId") returned 0x715331c0 [0112.833] GetProcAddress (hModule=0x71510000, lpProcName="ConvertCompartmentIdToGuid") returned 0x71533230 [0112.834] GetProcAddress (hModule=0x71510000, lpProcName="ConvertGuidToStringA") returned 0x71514cf0 [0112.834] GetProcAddress (hModule=0x71510000, lpProcName="ConvertGuidToStringW") returned 0x7151a5a0 [0112.834] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceAliasToLuid") returned 0x715332e0 [0112.834] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceGuidToLuid") returned 0x71517070 [0112.834] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceIndexToLuid") returned 0x71516a00 [0112.834] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceLuidToAlias") returned 0x7151dfb0 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceLuidToGuid") returned 0x71515870 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceLuidToIndex") returned 0x71516bd0 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceLuidToNameA") returned 0x71533440 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceLuidToNameW") returned 0x7151ae10 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceNameToLuidA") returned 0x715334c0 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfaceNameToLuidW") returned 0x7151b940 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertInterfacePhysicalAddressToLuid") returned 0x71533560 [0112.835] GetProcAddress (hModule=0x71510000, lpProcName="ConvertIpv4MaskToLength") returned 0x71532a10 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertLengthToIpv4Mask") returned 0x7151b4d0 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertRemoteInterfaceAliasToLuid") returned 0x7152dc40 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertRemoteInterfaceGuidToLuid") returned 0x7152dd70 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertRemoteInterfaceIndexToLuid") returned 0x7152de60 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertRemoteInterfaceLuidToAlias") returned 0x7152deb0 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertRemoteInterfaceLuidToGuid") returned 0x7152df90 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertRemoteInterfaceLuidToIndex") returned 0x7152e000 [0112.836] GetProcAddress (hModule=0x71510000, lpProcName="ConvertStringToGuidA") returned 0x7152e060 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="ConvertStringToGuidW") returned 0x71520f60 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="ConvertStringToInterfacePhysicalAddress") returned 0x71533680 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="CreateAnycastIpAddressEntry") returned 0x71533800 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="CreateCompartment") returned 0x71532ba0 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="CreateIpForwardEntry") returned 0x7152efe0 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="CreateIpForwardEntry2") returned 0x71534670 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="CreateIpNetEntry") returned 0x7152f000 [0112.837] GetProcAddress (hModule=0x71510000, lpProcName="CreateIpNetEntry2") returned 0x71534e00 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="CreatePersistentTcpPortReservation") returned 0x71530bc0 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="CreatePersistentUdpPortReservation") returned 0x71530bf0 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="CreateProxyArpEntry") returned 0x7152f230 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="CreateSortedAddressPairs") returned 0x71535400 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="CreateUnicastIpAddressEntry") returned 0x71533820 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="DeleteAnycastIpAddressEntry") returned 0x71533840 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="DeleteCompartment") returned 0x71532ce0 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="DeleteIPAddress") returned 0x7152f250 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="DeleteIpForwardEntry") returned 0x7152f2e0 [0112.838] GetProcAddress (hModule=0x71510000, lpProcName="DeleteIpForwardEntry2") returned 0x71534690 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="DeleteIpNetEntry") returned 0x7152f390 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="DeleteIpNetEntry2") returned 0x71534e20 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="DeletePersistentTcpPortReservation") returned 0x71530c20 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="DeletePersistentUdpPortReservation") returned 0x71530c50 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="DeleteProxyArpEntry") returned 0x7152f420 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="DeleteUnicastIpAddressEntry") returned 0x71533860 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="DisableMediaSense") returned 0x715220d0 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="EnableRouter") returned 0x7152f440 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="FlushIpNetTable") returned 0x7152f490 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="FlushIpNetTable2") returned 0x71534e40 [0112.839] GetProcAddress (hModule=0x71510000, lpProcName="FlushIpPathTable") returned 0x715356c0 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="FreeMibTable") returned 0x71515220 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetAdapterIndex") returned 0x7152e0d0 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetAdapterOrderMap") returned 0x7152e150 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetAdaptersAddresses") returned 0x71515b70 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetAdaptersInfo") returned 0x7151b580 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetAnycastIpAddressEntry") returned 0x71533880 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetAnycastIpAddressTable") returned 0x715338a0 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetBestInterface") returned 0x71515490 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetBestInterfaceEx") returned 0x71515a20 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetBestRoute") returned 0x7152f500 [0112.840] GetProcAddress (hModule=0x71510000, lpProcName="GetBestRoute2") returned 0x71514f10 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetCurrentThreadCompartmentId") returned 0x71518cb0 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetCurrentThreadCompartmentScope") returned 0x71516b70 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetExtendedTcpTable") returned 0x7151ca50 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetExtendedUdpTable") returned 0x7151c7e0 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetFriendlyIfIndex") returned 0x7152e240 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetIcmpStatistics") returned 0x7152f650 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetIcmpStatisticsEx") returned 0x7151c140 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetIfEntry") returned 0x715154f0 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetIfEntry2") returned 0x71517490 [0112.841] GetProcAddress (hModule=0x71510000, lpProcName="GetIfStackTable") returned 0x7151e580 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIfTable") returned 0x7152e260 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIfTable2") returned 0x71515a00 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIfTable2Ex") returned 0x71521030 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetInterfaceInfo") returned 0x71521390 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetInvertedIfStackTable") returned 0x71535b30 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIpAddrTable") returned 0x7152f6a0 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIpErrorString") returned 0x7152da10 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIpForwardEntry2") returned 0x715346b0 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIpForwardTable") returned 0x71521070 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIpForwardTable2") returned 0x71514a30 [0112.842] GetProcAddress (hModule=0x71510000, lpProcName="GetIpInterfaceEntry") returned 0x71514d60 [0112.843] GetProcAddress (hModule=0x71510000, lpProcName="GetIpInterfaceTable") returned 0x7151e280 [0112.843] GetProcAddress (hModule=0x71510000, lpProcName="GetIpNetEntry2") returned 0x71514a70 [0112.843] GetProcAddress (hModule=0x71510000, lpProcName="GetIpNetTable") returned 0x71521540 [0112.843] GetProcAddress (hModule=0x71510000, lpProcName="GetIpNetTable2") returned 0x71534ee0 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetIpNetworkConnectionBandwidthEstimates") returned 0x71535b40 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetIpPathEntry") returned 0x71535760 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetIpPathTable") returned 0x71535920 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetIpStatistics") returned 0x7152f850 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetIpStatisticsEx") returned 0x7151bf40 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetJobCompartmentId") returned 0x71532d10 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetMulticastIpAddressEntry") returned 0x715338c0 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetMulticastIpAddressTable") returned 0x715338e0 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetNetworkInformation") returned 0x71532d60 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetNetworkParams") returned 0x7151c4f0 [0112.844] GetProcAddress (hModule=0x71510000, lpProcName="GetNumberOfInterfaces") returned 0x7151c1f0 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetOwnerModuleFromPidAndInfo") returned 0x7152d500 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetOwnerModuleFromTcp6Entry") returned 0x71531500 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetOwnerModuleFromTcpEntry") returned 0x71531540 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetOwnerModuleFromUdp6Entry") returned 0x715321f0 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetOwnerModuleFromUdpEntry") returned 0x71532230 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetPerAdapterInfo") returned 0x7152d910 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetPerTcp6ConnectionEStats") returned 0x7151cf80 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetPerTcp6ConnectionStats") returned 0x71531580 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetPerTcpConnectionEStats") returned 0x7151d260 [0112.845] GetProcAddress (hModule=0x71510000, lpProcName="GetPerTcpConnectionStats") returned 0x71531610 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetRTTAndHopCount") returned 0x71530120 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetSessionCompartmentId") returned 0x71517020 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetTcp6Table") returned 0x71531890 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetTcp6Table2") returned 0x71531680 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetTcpStatistics") returned 0x71531d40 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetTcpStatisticsEx") returned 0x7151d160 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetTcpTable") returned 0x71531fd0 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetTcpTable2") returned 0x71531d60 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetTeredoPort") returned 0x715360b0 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetUdp6Table") returned 0x71532270 [0112.846] GetProcAddress (hModule=0x71510000, lpProcName="GetUdpStatistics") returned 0x71532610 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="GetUdpStatisticsEx") returned 0x7151d650 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="GetUdpTable") returned 0x71532630 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="GetUniDirectionalAdapterInfo") returned 0x7152f870 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="GetUnicastIpAddressEntry") returned 0x7151e340 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="GetUnicastIpAddressTable") returned 0x71518c90 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="GetWPAOACSupportLevel") returned 0x71532840 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="Icmp6CreateFile") returned 0x7151c5b0 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="Icmp6ParseReplies") returned 0x7151d970 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="Icmp6SendEcho2") returned 0x7151d700 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="IcmpCloseHandle") returned 0x7151dd30 [0112.847] GetProcAddress (hModule=0x71510000, lpProcName="IcmpCreateFile") returned 0x715302d0 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="IcmpParseReplies") returned 0x71530470 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="IcmpSendEcho") returned 0x71530800 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="IcmpSendEcho2") returned 0x715304c0 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="IcmpSendEcho2Ex") returned 0x71530500 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="InitializeCompartmentEntry") returned 0x71532e20 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="InitializeIpForwardEntry") returned 0x71520ff0 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="InitializeIpInterfaceEntry") returned 0x71535be0 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="InitializeUnicastIpAddressEntry") returned 0x715339a0 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="InternalCleanupPersistentStore") returned 0x71535d10 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="InternalCreateAnycastIpAddressEntry") returned 0x71533ac0 [0112.848] GetProcAddress (hModule=0x71510000, lpProcName="InternalCreateIpForwardEntry") returned 0x7152e6b0 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalCreateIpForwardEntry2") returned 0x715348f0 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalCreateIpNetEntry") returned 0x7152e6d0 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalCreateIpNetEntry2") returned 0x71534fb0 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalCreateUnicastIpAddressEntry") returned 0x71533ae0 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalDeleteAnycastIpAddressEntry") returned 0x71533b00 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalDeleteIpForwardEntry") returned 0x7152e6f0 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalDeleteIpForwardEntry2") returned 0x71534920 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalDeleteIpNetEntry") returned 0x7152e710 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalDeleteIpNetEntry2") returned 0x71534fe0 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalDeleteUnicastIpAddressEntry") returned 0x71533b20 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalFindInterfaceByAddress") returned 0x71533b40 [0112.849] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetAnycastIpAddressEntry") returned 0x71533be0 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetAnycastIpAddressTable") returned 0x71533c00 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetBoundTcp6EndpointTable") returned 0x7152e730 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetBoundTcpEndpointTable") returned 0x7152e760 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetForwardIpTable2") returned 0x71516600 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIPPhysicalInterfaceForDestination") returned 0x7151ac60 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIfEntry2") returned 0x71518480 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIfTable") returned 0x7152e8a0 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIfTable2") returned 0x71535da0 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpAddrTable") returned 0x7152e8d0 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpForwardEntry2") returned 0x71534950 [0112.850] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpForwardTable") returned 0x7152e900 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpInterfaceEntry") returned 0x71514d80 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpInterfaceTable") returned 0x7151e080 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpNetEntry2") returned 0x71514a90 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpNetTable") returned 0x7152e930 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetIpNetTable2") returned 0x71535010 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetMulticastIpAddressEntry") returned 0x71533c20 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetMulticastIpAddressTable") returned 0x71533c40 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetRtcSlotInformation") returned 0x7151e630 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcp6Table2") returned 0x7152ea10 [0112.851] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcp6TableWithOwnerModule") returned 0x7152ea40 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcp6TableWithOwnerPid") returned 0x7152ea70 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcpTable") returned 0x7152ead0 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcpTable2") returned 0x7152eaa0 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcpTableEx") returned 0x7152eb00 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcpTableWithOwnerModule") returned 0x7152eb30 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTcpTableWithOwnerPid") returned 0x7152eb60 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetTunnelPhysicalAdapter") returned 0x71515300 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUdp6TableWithOwnerModule") returned 0x7152eb90 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUdp6TableWithOwnerPid") returned 0x7152ebc0 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUdpTable") returned 0x7152ebf0 [0112.852] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUdpTableEx") returned 0x7152ec20 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUdpTableWithOwnerModule") returned 0x7152ec50 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUdpTableWithOwnerPid") returned 0x7152ec80 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUnicastIpAddressEntry") returned 0x71533c60 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalGetUnicastIpAddressTable") returned 0x71533c80 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalIcmpCreateFileEx") returned 0x7152ecb0 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetIfEntry") returned 0x7152ece0 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetIpForwardEntry") returned 0x7152ed00 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetIpForwardEntry2") returned 0x71534b80 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetIpInterfaceEntry") returned 0x71535dc0 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetIpNetEntry") returned 0x7152ed20 [0112.853] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetIpNetEntry2") returned 0x71535230 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetIpStats") returned 0x7152ed40 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetTcpEntry") returned 0x7152ed60 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetTeredoPort") returned 0x71536100 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="InternalSetUnicastIpAddressEntry") returned 0x71533e80 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="IpReleaseAddress") returned 0x7152f980 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="IpRenewAddress") returned 0x7152f9f0 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="LookupPersistentTcpPortReservation") returned 0x71530d00 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="LookupPersistentUdpPortReservation") returned 0x71530d30 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="NTPTimeToNTFileTime") returned 0x7152fdd0 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="NTTimeToNTPTime") returned 0x7152fe50 [0112.854] GetProcAddress (hModule=0x71510000, lpProcName="NhGetGuidFromInterfaceName") returned 0x7152e3d0 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NhGetInterfaceDescriptionFromGuid") returned 0x7152e400 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NhGetInterfaceNameFromDeviceGuid") returned 0x7151d9a0 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NhGetInterfaceNameFromGuid") returned 0x7151d9a0 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NhpAllocateAndGetInterfaceInfoFromStack") returned 0x7152daa0 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyAddrChange") returned 0x7151b910 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyCompartmentChange") returned 0x71532ee0 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyIpInterfaceChange") returned 0x71515750 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyRouteChange") returned 0x7152fa60 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyRouteChange2") returned 0x71520da0 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyStableUnicastIpAddressTable") returned 0x71534490 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyTeredoPortChange") returned 0x715361a0 [0112.855] GetProcAddress (hModule=0x71510000, lpProcName="NotifyUnicastIpAddressChange") returned 0x715153d0 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="OpenCompartment") returned 0x71532f60 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="ParseNetworkString") returned 0x7151d9f0 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="ResolveIpNetEntry2") returned 0x71520e30 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="ResolveNeighbor") returned 0x7152fa90 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="RestoreMediaSense") returned 0x715220d0 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="SendARP") returned 0x7152faa0 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="SetAdapterIpAddress") returned 0x7152ed80 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="SetCurrentThreadCompartmentId") returned 0x71533050 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="SetCurrentThreadCompartmentScope") returned 0x715152d0 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="SetIfEntry") returned 0x7152e4c0 [0112.856] GetProcAddress (hModule=0x71510000, lpProcName="SetIpForwardEntry") returned 0x7152fb80 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetIpForwardEntry2") returned 0x71534de0 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetIpInterfaceEntry") returned 0x71536090 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetIpNetEntry") returned 0x7152fba0 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetIpNetEntry2") returned 0x715353e0 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetIpStatistics") returned 0x7152fbc0 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetIpStatisticsEx") returned 0x7152fbe0 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetIpTTL") returned 0x7152fc90 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetJobCompartmentId") returned 0x71533080 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetNetworkInformation") returned 0x715330c0 [0112.857] GetProcAddress (hModule=0x71510000, lpProcName="SetPerTcp6ConnectionEStats") returned 0x7151c690 [0112.881] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73f30000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\Ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")) returned 0x1e [0112.881] GetModuleFileNameA (in: hModule=0x73f30000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\Ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")) returned 0x1e [0112.881] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\Ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.882] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=388896) returned 1 [0112.882] VirtualAlloc (lpAddress=0x0, dwSize=0x5ef20, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0112.882] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x5ef20, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x5ef20, lpOverlapped=0x0) returned 1 [0112.896] CloseHandle (hObject=0x1b4) returned 1 [0112.897] GetProcAddress (hModule=0x73f30000, lpProcName="GetAddrInfoExA") returned 0x73f5cb70 [0112.897] GetProcAddress (hModule=0x73f30000, lpProcName="GetAddrInfoExCancel") returned 0x73f47570 [0112.897] GetProcAddress (hModule=0x73f30000, lpProcName="GetAddrInfoExOverlappedResult") returned 0x73f35970 [0112.898] GetProcAddress (hModule=0x73f30000, lpProcName="GetAddrInfoExW") returned 0x73f3b070 [0112.898] GetProcAddress (hModule=0x73f30000, lpProcName="GetAddrInfoW") returned 0x73f42180 [0112.898] GetProcAddress (hModule=0x73f30000, lpProcName="GetHostNameW") returned 0x73f606c0 [0112.898] GetProcAddress (hModule=0x73f30000, lpProcName="GetNameInfoW") returned 0x73f44050 [0112.899] GetProcAddress (hModule=0x73f30000, lpProcName="InetNtopW") returned 0x73f5bd80 [0112.899] GetProcAddress (hModule=0x73f30000, lpProcName="InetPtonW") returned 0x73f5bdf0 [0112.899] GetProcAddress (hModule=0x73f30000, lpProcName="SetAddrInfoExA") returned 0x73f5cd20 [0112.899] GetProcAddress (hModule=0x73f30000, lpProcName="SetAddrInfoExW") returned 0x73f46f90 [0112.899] GetProcAddress (hModule=0x73f30000, lpProcName="WEP") returned 0x73f48190 [0112.899] GetProcAddress (hModule=0x73f30000, lpProcName="WPUCompleteOverlappedRequest") returned 0x73f686f0 [0112.900] GetProcAddress (hModule=0x73f30000, lpProcName="WPUGetProviderPathEx") returned 0x73f6dec0 [0112.900] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAccept") returned 0x73f46c40 [0112.900] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAddressToStringA") returned 0x73f379d0 [0112.901] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAddressToStringW") returned 0x73f441c0 [0112.901] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAdvertiseProvider") returned 0x73f6a8a0 [0112.901] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAsyncGetHostByAddr") returned 0x73f60880 [0112.901] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAsyncGetHostByName") returned 0x73f60990 [0112.901] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAsyncGetProtoByName") returned 0x73f60ac0 [0112.901] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAsyncGetProtoByNumber") returned 0x73f60bf0 [0112.901] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAsyncGetServByName") returned 0x73f60cd0 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAsyncGetServByPort") returned 0x73f60e00 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSAAsyncSelect") returned 0x73f46270 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSACancelAsyncRequest") returned 0x73f60ee0 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSACancelBlockingCall") returned 0x73f5f000 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSACleanup") returned 0x73f44c00 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSACloseEvent") returned 0x73f468f0 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSAConnect") returned 0x73f46ed0 [0112.902] GetProcAddress (hModule=0x73f30000, lpProcName="WSAConnectByList") returned 0x73f677d0 [0112.903] GetProcAddress (hModule=0x73f30000, lpProcName="WSAConnectByNameA") returned 0x73f67ff0 [0112.903] GetProcAddress (hModule=0x73f30000, lpProcName="WSAConnectByNameW") returned 0x73f45b70 [0112.903] GetProcAddress (hModule=0x73f30000, lpProcName="WSACreateEvent") returned 0x73f46950 [0112.903] GetProcAddress (hModule=0x73f30000, lpProcName="WSADuplicateSocketA") returned 0x73f5fc20 [0112.903] GetProcAddress (hModule=0x73f30000, lpProcName="WSADuplicateSocketW") returned 0x73f5fca0 [0112.903] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEnumNameSpaceProvidersA") returned 0x73f65fd0 [0112.903] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEnumNameSpaceProvidersExA") returned 0x73f66060 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEnumNameSpaceProvidersExW") returned 0x73f660f0 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEnumNameSpaceProvidersW") returned 0x73f35fb0 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEnumNetworkEvents") returned 0x73f44b40 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEnumProtocolsA") returned 0x73f6e120 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEnumProtocolsW") returned 0x73f47ed0 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAEventSelect") returned 0x73f44a30 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAGetLastError") returned 0x73f34f60 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAGetOverlappedResult") returned 0x73f447e0 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAGetQOSByName") returned 0x73f65100 [0112.904] GetProcAddress (hModule=0x73f30000, lpProcName="WSAGetServiceClassInfoA") returned 0x73f66180 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAGetServiceClassInfoW") returned 0x73f66230 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAGetServiceClassNameByClassIdA") returned 0x73f66380 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAGetServiceClassNameByClassIdW") returned 0x73f665e0 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAHtonl") returned 0x73f5be70 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAHtons") returned 0x73f5bf70 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAInstallServiceClassA") returned 0x73f66820 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAInstallServiceClassW") returned 0x73f668b0 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAIoctl") returned 0x73f42f70 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAIsBlocking") returned 0x73f5f0a0 [0112.905] GetProcAddress (hModule=0x73f30000, lpProcName="WSAJoinLeaf") returned 0x73f68520 [0112.906] GetProcAddress (hModule=0x73f30000, lpProcName="WSALookupServiceBeginA") returned 0x73f669f0 [0112.906] GetProcAddress (hModule=0x73f30000, lpProcName="WSALookupServiceBeginW") returned 0x73f3e4d0 [0112.906] GetProcAddress (hModule=0x73f30000, lpProcName="WSALookupServiceEnd") returned 0x73f43c40 [0112.906] GetProcAddress (hModule=0x73f30000, lpProcName="WSALookupServiceNextA") returned 0x73f66ae0 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSALookupServiceNextW") returned 0x73f3f840 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSANSPIoctl") returned 0x73f66ca0 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSANtohl") returned 0x73f5c060 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSANtohs") returned 0x73f5c160 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSAPoll") returned 0x73f67370 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSAProviderCompleteAsyncCall") returned 0x73f6aa00 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSAProviderConfigChange") returned 0x73f47730 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSARecv") returned 0x73f42c50 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSARecvDisconnect") returned 0x73f65bc0 [0112.907] GetProcAddress (hModule=0x73f30000, lpProcName="WSARecvFrom") returned 0x73f48090 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSARemoveServiceClass") returned 0x73f66d80 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSAResetEvent") returned 0x73f476c0 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASend") returned 0x73f42de0 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASendDisconnect") returned 0x73f67590 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASendMsg") returned 0x73f43140 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASendTo") returned 0x73f47f90 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASetBlockingHook") returned 0x73f5f150 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASetEvent") returned 0x73f47710 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASetLastError") returned 0x73f35a10 [0112.908] GetProcAddress (hModule=0x73f30000, lpProcName="WSASetServiceA") returned 0x73f66ec0 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSASetServiceW") returned 0x73f470c0 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSASocketA") returned 0x73f47670 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSASocketW") returned 0x73f3e7d0 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSAStartup") returned 0x73f36520 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSAStringToAddressA") returned 0x73f46db0 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSAStringToAddressW") returned 0x73f45820 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSAUnadvertiseProvider") returned 0x73f6ab50 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSAUnhookBlockingHook") returned 0x73f5f210 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSAWaitForMultipleEvents") returned 0x73f35a20 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSApSetPostRoutine") returned 0x73f68900 [0112.909] GetProcAddress (hModule=0x73f30000, lpProcName="WSCDeinstallProvider") returned 0x73f6e4f0 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCDeinstallProviderEx") returned 0x73f6e530 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCEnableNSProvider") returned 0x73f704e0 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCEnumProtocols") returned 0x73f36dc0 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCEnumProtocolsEx") returned 0x73f36e00 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCGetApplicationCategory") returned 0x73f6e760 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCGetApplicationCategoryEx") returned 0x73f6e800 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCGetProviderInfo") returned 0x73f6eb70 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCGetProviderPath") returned 0x73f6de80 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCInstallNameSpace") returned 0x73f70600 [0112.910] GetProcAddress (hModule=0x73f30000, lpProcName="WSCInstallNameSpaceEx") returned 0x73f70970 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCInstallNameSpaceEx2") returned 0x73f70770 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCInstallProvider") returned 0x73f6ee40 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCInstallProviderAndChains") returned 0x73f632c0 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCInstallProviderEx") returned 0x73f6f740 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCSetApplicationCategory") returned 0x73f6f7a0 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCSetApplicationCategoryEx") returned 0x73f6f840 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCSetProviderInfo") returned 0x73f6fcc0 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCUnInstallNameSpace") returned 0x73f70ae0 [0112.911] GetProcAddress (hModule=0x73f30000, lpProcName="WSCUnInstallNameSpaceEx2") returned 0x73f70b10 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WSCUpdateProvider") returned 0x73f6ff40 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WSCUpdateProviderEx") returned 0x73f6ffe0 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WSCWriteNameSpaceOrder") returned 0x73f70c80 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WSCWriteProviderOrder") returned 0x73f701a0 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WSCWriteProviderOrderEx") returned 0x73f70220 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WahCloseApcHelper") returned 0x73f35bd0 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WahCloseHandleHelper") returned 0x73f6c950 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WahCloseNotificationHandleHelper") returned 0x73f6d280 [0112.912] GetProcAddress (hModule=0x73f30000, lpProcName="WahCloseSocketHandle") returned 0x73f6c9a0 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahCloseThread") returned 0x73f44670 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahCompleteRequest") returned 0x73f6c9f0 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahCreateHandleContextTable") returned 0x73f362e0 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahCreateNotificationHandle") returned 0x73f47940 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahCreateSocketHandle") returned 0x73f6ca90 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahDestroyHandleContextTable") returned 0x73f6d520 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahDisableNonIFSHandleSupport") returned 0x73f6cc40 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahEnableNonIFSHandleSupport") returned 0x73f6ccd0 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahEnumerateHandleContexts") returned 0x73f34d10 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahInsertHandleContext") returned 0x73f45300 [0112.913] GetProcAddress (hModule=0x73f30000, lpProcName="WahNotifyAllProcesses") returned 0x73f6d2b0 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahOpenApcHelper") returned 0x73f364f0 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahOpenCurrentThread") returned 0x73f44600 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahOpenHandleHelper") returned 0x73f6ce20 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahOpenNotificationHandleHelper") returned 0x73f47830 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahQueueUserApc") returned 0x73f6c2a0 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahReferenceContextByHandle") returned 0x73f43320 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahRemoveHandleContext") returned 0x73f45000 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahWaitForNotification") returned 0x73f47860 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="WahWriteLSPEvent") returned 0x73f6d600 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="__WSAFDIsSet") returned 0x73f347e0 [0112.914] GetProcAddress (hModule=0x73f30000, lpProcName="accept") returned 0x73f46d00 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="bind") returned 0x73f43230 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="closesocket") returned 0x73f3ead0 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="connect") returned 0x73f46090 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="freeaddrinfo") returned 0x73f45ee0 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="getaddrinfo") returned 0x73f455c0 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="gethostbyaddr") returned 0x73f60f80 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="gethostbyname") returned 0x73f61110 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="gethostname") returned 0x73f612a0 [0112.915] GetProcAddress (hModule=0x73f30000, lpProcName="getnameinfo") returned 0x73f446d0 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="getpeername") returned 0x73f448b0 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="getprotobyname") returned 0x73f60050 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="getprotobynumber") returned 0x73f601a0 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="getservbyname") returned 0x73f61450 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="getservbyport") returned 0x73f61630 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="getsockname") returned 0x73f43830 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="getsockopt") returned 0x73f43e40 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="htonl") returned 0x73f34ab0 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="htons") returned 0x73f34a90 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="inet_addr") returned 0x73f35240 [0112.916] GetProcAddress (hModule=0x73f30000, lpProcName="inet_ntoa") returned 0x73f459f0 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="inet_ntop") returned 0x73f5c250 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="inet_pton") returned 0x73f5c2c0 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="ioctlsocket") returned 0x73f3e180 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="listen") returned 0x73f45f50 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="ntohl") returned 0x73f34ab0 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="ntohs") returned 0x73f34a90 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="recv") returned 0x73f41d20 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="recvfrom") returned 0x73f47370 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="select") returned 0x73f41f00 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="send") returned 0x73f41b90 [0112.917] GetProcAddress (hModule=0x73f30000, lpProcName="sendto") returned 0x73f44da0 [0112.918] GetProcAddress (hModule=0x73f30000, lpProcName="setsockopt") returned 0x73f3ecc0 [0112.918] GetProcAddress (hModule=0x73f30000, lpProcName="shutdown") returned 0x73f44970 [0112.918] GetProcAddress (hModule=0x73f30000, lpProcName="socket") returned 0x73f3e6b0 [0112.918] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.923] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x74eb0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")) returned 0x1f [0112.924] GetModuleFileNameA (in: hModule=0x74eb0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")) returned 0x1f [0112.924] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0112.924] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=21125920) returned 1 [0112.924] VirtualAlloc (lpAddress=0x0, dwSize=0x1425b20, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000 [0112.925] ReadFile (in: hFile=0x1b4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1425b20, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x19bd68*=0x1425b20, lpOverlapped=0x0) returned 1 [0113.842] CloseHandle (hObject=0x1b4) returned 1 [0113.842] GetProcAddress (hModule=0x74eb0000, lpProcName="AppCompat_RunDLLW") returned 0x7512e770 [0113.844] GetProcAddress (hModule=0x74eb0000, lpProcName="AssocCreateForClasses") returned 0x74feaa50 [0113.844] GetProcAddress (hModule=0x74eb0000, lpProcName="AssocGetDetailsOfPropKey") returned 0x75068b30 [0113.844] GetProcAddress (hModule=0x74eb0000, lpProcName="CDefFolderMenu_Create2") returned 0x75132f20 [0113.844] GetProcAddress (hModule=0x74eb0000, lpProcName="CIDLData_CreateFromIDArray") returned 0x75133a70 [0113.844] GetProcAddress (hModule=0x74eb0000, lpProcName="CStorageItem_GetValidatedStorageItemObject") returned 0x7510f4d0 [0113.845] GetProcAddress (hModule=0x74eb0000, lpProcName="CheckEscapesW") returned 0x75135800 [0113.845] GetProcAddress (hModule=0x74eb0000, lpProcName="CommandLineToArgvW") returned 0x7505bf80 [0113.845] GetProcAddress (hModule=0x74eb0000, lpProcName="Control_RunDLL") returned 0x75138150 [0113.845] GetProcAddress (hModule=0x74eb0000, lpProcName="Control_RunDLLA") returned 0x75138150 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="Control_RunDLLAsUserW") returned 0x751381b0 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="Control_RunDLLW") returned 0x751381f0 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="CreateStorageItemFromPath_FullTrustCaller") returned 0x7510f510 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="CreateStorageItemFromPath_FullTrustCaller_ForPackage") returned 0x7510f530 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="CreateStorageItemFromPath_PartialTrustCaller") returned 0x7510f550 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="CreateStorageItemFromShellItem_FullTrustCaller") returned 0x74fbc250 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="CreateStorageItemFromShellItem_FullTrustCaller_ForPackage") returned 0x74fbb450 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle") returned 0x7510f570 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage") returned 0x7510f590 [0113.846] GetProcAddress (hModule=0x74eb0000, lpProcName="DAD_AutoScroll") returned 0x75077280 [0113.847] GetProcAddress (hModule=0x74eb0000, lpProcName="DAD_DragEnterEx") returned 0x7507df30 [0113.847] GetProcAddress (hModule=0x74eb0000, lpProcName="DAD_DragEnterEx2") returned 0x75147ec0 [0113.847] GetProcAddress (hModule=0x74eb0000, lpProcName="DAD_DragLeave") returned 0x75147f60 [0113.847] GetProcAddress (hModule=0x74eb0000, lpProcName="DAD_DragMove") returned 0x75147f90 [0113.847] GetProcAddress (hModule=0x74eb0000, lpProcName="DAD_SetDragImage") returned 0x750780d0 [0113.847] GetProcAddress (hModule=0x74eb0000, lpProcName="DAD_ShowDragImage") returned 0x74fbcc20 [0113.848] GetProcAddress (hModule=0x74eb0000, lpProcName="DllCanUnloadNow") returned 0x750579f0 [0113.848] GetProcAddress (hModule=0x74eb0000, lpProcName="DllGetActivationFactory") returned 0x7510e3a0 [0113.848] GetProcAddress (hModule=0x74eb0000, lpProcName="DllGetClassObject") returned 0x7501b190 [0113.848] GetProcAddress (hModule=0x74eb0000, lpProcName="DllGetVersion") returned 0x7537ada0 [0113.849] GetProcAddress (hModule=0x74eb0000, lpProcName="DllInstall") returned 0x75149cc0 [0113.849] GetProcAddress (hModule=0x74eb0000, lpProcName="DllRegisterServer") returned 0x7507a730 [0113.849] GetProcAddress (hModule=0x74eb0000, lpProcName="DllUnregisterServer") returned 0x7507a730 [0113.849] GetProcAddress (hModule=0x74eb0000, lpProcName="DoEnvironmentSubstA") returned 0x75102fe0 [0113.849] GetProcAddress (hModule=0x74eb0000, lpProcName="DoEnvironmentSubstW") returned 0x74fb6b30 [0113.849] GetProcAddress (hModule=0x74eb0000, lpProcName="DragAcceptFiles") returned 0x75063ce0 [0113.849] GetProcAddress (hModule=0x74eb0000, lpProcName="DragFinish") returned 0x7510d8d0 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="DragQueryFile") returned 0x7510d8e0 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="DragQueryFileA") returned 0x7510d8e0 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="DragQueryFileAorW") returned 0x75056b50 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="DragQueryFileW") returned 0x75056b20 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="DragQueryPoint") returned 0x7510da40 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="DriveType") returned 0x7537ae70 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="DuplicateIcon") returned 0x750555b0 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractAssociatedIconA") returned 0x751025f0 [0113.850] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractAssociatedIconExA") returned 0x751026a0 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractAssociatedIconExW") returned 0x75102770 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractAssociatedIconW") returned 0x75102950 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractIconA") returned 0x75102a00 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractIconEx") returned 0x75102a60 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractIconExA") returned 0x75102a60 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractIconExW") returned 0x75052560 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="ExtractIconW") returned 0x75102ac0 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="FindExecutableA") returned 0x75154890 [0113.851] GetProcAddress (hModule=0x74eb0000, lpProcName="FindExecutableW") returned 0x75154930 [0113.852] GetProcAddress (hModule=0x74eb0000, lpProcName="FreeIconList") returned 0x7507c250 [0113.852] GetProcAddress (hModule=0x74eb0000, lpProcName="GetCurrentProcessExplicitAppUserModelID") returned 0x75136830 [0113.852] GetProcAddress (hModule=0x74eb0000, lpProcName="GetFileNameFromBrowse") returned 0x751578e0 [0113.852] GetProcAddress (hModule=0x74eb0000, lpProcName="GetSystemPersistedStorageItemList") returned 0x7510f5d0 [0113.852] GetProcAddress (hModule=0x74eb0000, lpProcName="ILAppendID") returned 0x7515a860 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILClone") returned 0x750308b0 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILCloneFirst") returned 0x75053f60 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILCombine") returned 0x75030b70 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILCreateFromPath") returned 0x75060b60 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILCreateFromPathA") returned 0x7515a920 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILCreateFromPathW") returned 0x75060b60 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILFindChild") returned 0x74fb1cd0 [0113.853] GetProcAddress (hModule=0x74eb0000, lpProcName="ILFindLastID") returned 0x7504bec0 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILFree") returned 0x75055d90 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILGetNext") returned 0x74fb2090 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILGetSize") returned 0x75055610 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILIsEqual") returned 0x7504bbc0 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILIsParent") returned 0x7504bb00 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILLoadFromStreamEx") returned 0x74fa3b30 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILRemoveLastID") returned 0x75030870 [0113.854] GetProcAddress (hModule=0x74eb0000, lpProcName="ILSaveToStream") returned 0x74fab2f0 [0113.855] GetProcAddress (hModule=0x74eb0000, lpProcName="InitNetworkAddressControl") returned 0x7515b690 [0113.855] GetProcAddress (hModule=0x74eb0000, lpProcName="InternalExtractIconListA") returned 0x75077280 [0113.855] GetProcAddress (hModule=0x74eb0000, lpProcName="InternalExtractIconListW") returned 0x75077280 [0113.855] GetProcAddress (hModule=0x74eb0000, lpProcName="IsDesktopExplorerProcess") returned 0x7504a610 [0113.855] GetProcAddress (hModule=0x74eb0000, lpProcName="IsLFNDrive") returned 0x7505b3f0 [0113.855] GetProcAddress (hModule=0x74eb0000, lpProcName="IsLFNDriveA") returned 0x751358a0 [0113.855] GetProcAddress (hModule=0x74eb0000, lpProcName="IsLFNDriveW") returned 0x7505b3f0 [0113.856] GetProcAddress (hModule=0x74eb0000, lpProcName="IsNetDrive") returned 0x7537aeb0 [0113.856] GetProcAddress (hModule=0x74eb0000, lpProcName="IsProcessAnExplorer") returned 0x74fdee40 [0113.856] GetProcAddress (hModule=0x74eb0000, lpProcName="IsUserAnAdmin") returned 0x7515db90 [0113.856] GetProcAddress (hModule=0x74eb0000, lpProcName="LaunchMSHelp_RunDLLW") returned 0x7510e3c0 [0113.856] GetProcAddress (hModule=0x74eb0000, lpProcName="OpenAs_RunDLL") returned 0x750845d0 [0113.856] GetProcAddress (hModule=0x74eb0000, lpProcName="OpenAs_RunDLLA") returned 0x750845d0 [0113.856] GetProcAddress (hModule=0x74eb0000, lpProcName="OpenAs_RunDLLW") returned 0x75110090 [0113.857] GetProcAddress (hModule=0x74eb0000, lpProcName="OpenRegStream") returned 0x750644a0 [0113.857] GetProcAddress (hModule=0x74eb0000, lpProcName="Options_RunDLL") returned 0x7533f4a0 [0113.857] GetProcAddress (hModule=0x74eb0000, lpProcName="Options_RunDLLA") returned 0x7533f4a0 [0113.857] GetProcAddress (hModule=0x74eb0000, lpProcName="Options_RunDLLW") returned 0x7533f4e0 [0113.857] GetProcAddress (hModule=0x74eb0000, lpProcName="PathCleanupSpec") returned 0x75068d50 [0113.857] GetProcAddress (hModule=0x74eb0000, lpProcName="PathGetShortPath") returned 0x75135ac0 [0113.857] GetProcAddress (hModule=0x74eb0000, lpProcName="PathIsExe") returned 0x74f67600 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PathIsSlowA") returned 0x75135d00 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PathIsSlowW") returned 0x75135d50 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PathMakeUniqueName") returned 0x75135e60 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PathQualify") returned 0x751362e0 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PathResolve") returned 0x7505b0d0 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PathYetAnotherMakeUniqueName") returned 0x751363c0 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PickIconDlg") returned 0x75104540 [0113.858] GetProcAddress (hModule=0x74eb0000, lpProcName="PifMgr_CloseProperties") returned 0x7510a620 [0113.881] GetProcAddress (hModule=0x74eb0000, lpProcName="PifMgr_GetProperties") returned 0x7510a6d0 [0113.881] GetProcAddress (hModule=0x74eb0000, lpProcName="PifMgr_OpenProperties") returned 0x7510a990 [0113.881] GetProcAddress (hModule=0x74eb0000, lpProcName="PifMgr_SetProperties") returned 0x7510af00 [0113.881] GetProcAddress (hModule=0x74eb0000, lpProcName="PrepareDiscForBurnRunDllW") returned 0x751137b0 [0113.881] GetProcAddress (hModule=0x74eb0000, lpProcName="PrintersGetCommand_RunDLL") returned 0x7511e760 [0113.882] GetProcAddress (hModule=0x74eb0000, lpProcName="PrintersGetCommand_RunDLLA") returned 0x7511e760 [0113.882] GetProcAddress (hModule=0x74eb0000, lpProcName="PrintersGetCommand_RunDLLW") returned 0x7511e7f0 [0113.882] GetProcAddress (hModule=0x74eb0000, lpProcName="ReadCabinetState") returned 0x74fa56b0 [0113.882] GetProcAddress (hModule=0x74eb0000, lpProcName="RealDriveType") returned 0x7515f170 [0113.882] GetProcAddress (hModule=0x74eb0000, lpProcName="RealShellExecuteA") returned 0x7511f530 [0113.882] GetProcAddress (hModule=0x74eb0000, lpProcName="RealShellExecuteExA") returned 0x7511f520 [0113.882] GetProcAddress (hModule=0x74eb0000, lpProcName="RealShellExecuteExW") returned 0x7511f520 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="RealShellExecuteW") returned 0x7511f530 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="RegenerateUserEnvironment") returned 0x75050d00 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="RestartDialog") returned 0x751489d0 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="RestartDialogEx") returned 0x751489f0 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="RunAsNewUser_RunDLLW") returned 0x7510f100 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="SHAddDefaultPropertiesByExt") returned 0x74f92250 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="SHAddFromPropSheetExtArray") returned 0x751624c0 [0113.883] GetProcAddress (hModule=0x74eb0000, lpProcName="SHAddToRecentDocs") returned 0x75065310 [0113.884] GetProcAddress (hModule=0x74eb0000, lpProcName="SHAlloc") returned 0x7505f870 [0113.884] GetProcAddress (hModule=0x74eb0000, lpProcName="SHAppBarMessage") returned 0x7505b840 [0113.884] GetProcAddress (hModule=0x74eb0000, lpProcName="SHAssocEnumHandlers") returned 0x74fb35b0 [0113.884] GetProcAddress (hModule=0x74eb0000, lpProcName="SHAssocEnumHandlersForProtocolByApplication") returned 0x751677b0 [0113.884] GetProcAddress (hModule=0x74eb0000, lpProcName="SHBindToFolderIDListParent") returned 0x75030680 [0113.884] GetProcAddress (hModule=0x74eb0000, lpProcName="SHBindToFolderIDListParentEx") returned 0x750311f0 [0113.884] GetProcAddress (hModule=0x74eb0000, lpProcName="SHBindToObject") returned 0x75030980 [0113.885] GetProcAddress (hModule=0x74eb0000, lpProcName="SHBindToParent") returned 0x750307e0 [0113.885] GetProcAddress (hModule=0x74eb0000, lpProcName="SHBrowseForFolder") returned 0x7516b190 [0113.885] GetProcAddress (hModule=0x74eb0000, lpProcName="SHBrowseForFolderA") returned 0x7516b190 [0113.885] GetProcAddress (hModule=0x74eb0000, lpProcName="SHBrowseForFolderW") returned 0x7516b330 [0113.885] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCLSIDFromString") returned 0x750597f0 [0113.885] GetProcAddress (hModule=0x74eb0000, lpProcName="SHChangeNotification_Lock") returned 0x750584f0 [0113.885] GetProcAddress (hModule=0x74eb0000, lpProcName="SHChangeNotification_Unlock") returned 0x7505c130 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHChangeNotify") returned 0x7500cd10 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHChangeNotifyDeregister") returned 0x7504bf30 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHChangeNotifyRegister") returned 0x7504bfa0 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHChangeNotifyRegisterThread") returned 0x7504bef0 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHChangeNotifySuspendResume") returned 0x7504b2c0 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCloneSpecialIDList") returned 0x75063940 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCoCreateInstance") returned 0x75058130 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCoCreateInstanceWorker") returned 0x7516bd40 [0113.886] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateAssociationRegistration") returned 0x74fe7c50 [0113.887] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateCategoryEnum") returned 0x7516f1d0 [0113.887] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDataObject") returned 0x74f791b0 [0113.887] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDefaultContextMenu") returned 0x7505c170 [0113.887] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDefaultExtractIcon") returned 0x74fda6d0 [0113.887] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDefaultPropertiesOp") returned 0x751621e0 [0113.887] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDirectory") returned 0x75069b80 [0113.887] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDirectoryExA") returned 0x75128760 [0113.888] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDirectoryExW") returned 0x75060490 [0113.888] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateDrvExtIcon") returned 0x751710d0 [0113.888] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateFileExtractIconW") returned 0x7515d0a0 [0113.888] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateItemFromIDList") returned 0x7500ec40 [0113.888] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateItemFromParsingName") returned 0x7500df60 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateItemFromRelativeName") returned 0x750310f0 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateItemInKnownFolder") returned 0x75031030 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateItemWithParent") returned 0x7500d4e0 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateLocalServerRunDll") returned 0x74fbc7b0 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateProcessAsUserW") returned 0x75120080 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreatePropSheetExtArray") returned 0x75162550 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateQueryCancelAutoPlayMoniker") returned 0x75069bc0 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateShellFolderView") returned 0x75060ce0 [0113.889] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateShellFolderViewEx") returned 0x7518ebd0 [0113.890] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateShellItem") returned 0x75057d30 [0113.890] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateShellItemArray") returned 0x7510f640 [0113.890] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateShellItemArrayFromDataObject") returned 0x7510f660 [0113.890] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateShellItemArrayFromIDLists") returned 0x75063ef0 [0113.890] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateShellItemArrayFromShellItem") returned 0x74fb9010 [0113.890] GetProcAddress (hModule=0x74eb0000, lpProcName="SHCreateStdEnumFmtEtc") returned 0x75102020 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHDefExtractIconA") returned 0x75152cc0 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHDefExtractIconW") returned 0x74fdab60 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHDestroyPropSheetExtArray") returned 0x751626d0 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHDoDragDrop") returned 0x75148030 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_AddToBackIconTable") returned 0x75057fb0 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_AddToFrontIconTable") returned 0x75057f30 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_AreAllItemsAvailable") returned 0x7502d0a0 [0113.891] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_BindToFilePlaceholderHandler") returned 0x75191d40 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CCommonPlacesFolder_CreateInstance") returned 0x75191d60 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_CloseSession") returned 0x75191d70 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_DriveSupportedForDataBurn") returned 0x75191d90 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_Erase") returned 0x75191db0 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_GetCDInfo") returned 0x74fb32c0 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_GetLiveFSDiscInfo") returned 0x75191dd0 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_GetStagingPathOrNormalPath") returned 0x74fa3150 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_GetTaskInfo") returned 0x75191df0 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_IsBlankDisc") returned 0x75191e70 [0113.892] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_IsBlankDisc2") returned 0x75191e20 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_IsLiveFS") returned 0x75191e90 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_OnDeviceChange") returned 0x75191eb0 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_OnEject") returned 0x75191ed0 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDBurn_OnMediaChange") returned 0x75191f30 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDefFolderMenu_Create2") returned 0x75191f50 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDefFolderMenu_Create2Ex") returned 0x75191f60 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDefFolderMenu_MergeMenu") returned 0x75191f90 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDrivesContextMenu_Create") returned 0x75191fa0 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CDrivesDropTarget_Create") returned 0x75191fc0 [0113.893] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CFSDropTarget_CreateInstance") returned 0x7505dd00 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CFSFolderCallback_Create") returned 0x74fb9990 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CFillPropertiesTask_CreateInstance") returned 0x75191fe0 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CLibraryDropTarget_CreateInstance") returned 0x75192000 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CLocationContextMenu_Create") returned 0x75192020 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CMountPoint_DoAutorun") returned 0x75192040 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CMountPoint_DoAutorunPrompt") returned 0x75192060 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CMountPoint_IsAutoRunDriveAndEnabledByPolicy") returned 0x75192080 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CMountPoint_ProcessAutoRunFile") returned 0x751920a0 [0113.894] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CMountPoint_WantAutorunUI") returned 0x751920c0 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CMountPoint_WantAutorunUIGetReady") returned 0x751920e0 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CPL_CategoryIdArrayFromVariant") returned 0x74f62c30 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CPL_IsLegacyCanonicalNameListedUnderKey") returned 0x75192100 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CPL_ModifyWowDisplayName") returned 0x75192120 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CRecentDocsContextMenu_CreateInstance") returned 0x75192140 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CSyncRootManager_CreateInstance") returned 0x74fa9e50 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CTransferConfirmation_CreateInstance") returned 0x75192150 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CallFileCopyHooks") returned 0x74fba330 [0113.895] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CanDisplayWin8CopyDialog") returned 0x74f9eba0 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CloseAutoplayPrompt") returned 0x75192170 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CommandLineFromMsiDescriptor") returned 0x75192190 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CopyExtrinsicPropertyStore") returned 0x751921b0 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CopyFilePlaceholderToNewFile") returned 0x751921d0 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CopySecondaryTiles") returned 0x75192200 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateAlternateStreamFileName") returned 0x75192210 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateConfirmationInterrupt") returned 0x75192230 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateConflictInterrupt") returned 0x75192250 [0113.896] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateDefaultOperationDataProvider") returned 0x75192280 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateExtrinsicPropertyStore") returned 0x75055de0 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateFileFolderContextMenu") returned 0x751922a0 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateLinkInfoW") returned 0x75062320 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreatePlaceholderFile") returned 0x751922d0 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateQosRecorder") returned 0x75192300 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_CreateSharePointView") returned 0x75192320 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_Create_IEnumUICommand") returned 0x75192340 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_DestroyLinkInfo") returned 0x75063280 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_EncryptDirectory") returned 0x75192350 [0113.897] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_EncryptedFileKeyInfo") returned 0x75192370 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_EnumCommonTasks") returned 0x75192390 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_FilePlaceholder_BindToPrimaryStream") returned 0x751923a0 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_FilePlaceholder_CreateInstance") returned 0x7502a530 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_FreeEncryptedFileKeyInfo") returned 0x751923d0 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_GenerateAppID") returned 0x74fb92a0 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_GetAppIDRoot") returned 0x7505c580 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_GetCommandProviderForFolderType") returned 0x751923e0 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_GetDPIAdjustedLogicalSize") returned 0x7505f5f0 [0113.898] GetProcAddress (hModule=0x74eb0000, lpProcName="SHELL32_GetDiskCleanupPath") returned 0x75192400 [0114.010] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76800000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")) returned 0x20 [0114.010] GetModuleFileNameA (in: hModule=0x76800000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")) returned 0x20 [0114.011] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0114.011] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=217976) returned 1 [0114.011] VirtualAlloc (lpAddress=0x0, dwSize=0x35378, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0114.011] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x35378, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x35378, lpOverlapped=0x0) returned 1 [0114.018] CloseHandle (hObject=0x1b4) returned 1 [0114.018] GetProcAddress (hModule=0x76800000, lpProcName="CMP_GetBlockedDriverInfo") returned 0x7681a100 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CMP_GetServerSideDeviceInstallFlags") returned 0x7681a180 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CMP_Init_Detection") returned 0x7681a210 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CMP_RegisterServiceNotification") returned 0x7681a8d0 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CMP_Register_Notification") returned 0x768043d0 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CMP_Report_LogOn") returned 0x7681a240 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CMP_WaitNoPendingInstallEvents") returned 0x76805310 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CMP_WaitServicesAvailable") returned 0x7681a260 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_Driver_PackageW") returned 0x7681a9c0 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_Driver_Package_ExW") returned 0x7681aa90 [0114.019] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_Empty_Log_Conf") returned 0x7681acb0 [0114.020] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_Empty_Log_Conf_Ex") returned 0x7681ae10 [0114.020] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_IDA") returned 0x7681b470 [0114.020] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_IDW") returned 0x7681b490 [0114.020] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_ID_ExA") returned 0x7681b5b0 [0114.020] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_ID_ExW") returned 0x7681b610 [0114.021] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_Range") returned 0x7681c8a0 [0114.021] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_Res_Des") returned 0x7681ddb0 [0114.021] GetProcAddress (hModule=0x76800000, lpProcName="CM_Add_Res_Des_Ex") returned 0x7681e040 [0114.021] GetProcAddress (hModule=0x76800000, lpProcName="CM_Apply_PowerScheme") returned 0x7681a8e0 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Connect_MachineA") returned 0x7681a290 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Connect_MachineW") returned 0x7681a300 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Create_DevNodeA") returned 0x7681b640 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Create_DevNodeW") returned 0x7681b670 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Create_DevNode_ExA") returned 0x7681b830 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Create_DevNode_ExW") returned 0x7681b890 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Create_Range_List") returned 0x7681c990 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Class_Key") returned 0x7681eff0 [0114.022] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Class_Key_Ex") returned 0x7681f070 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_DevNode_Key") returned 0x7681f0a0 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_DevNode_Key_Ex") returned 0x7681f1b0 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Device_Interface_KeyA") returned 0x7681f1e0 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Device_Interface_KeyW") returned 0x7681f200 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Device_Interface_Key_ExA") returned 0x7681f280 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Device_Interface_Key_ExW") returned 0x7681f2e0 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Driver_PackageW") returned 0x7681ab30 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Driver_Package_ExW") returned 0x7681abf0 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_PowerScheme") returned 0x7681c090 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Delete_Range") returned 0x7681ca70 [0114.023] GetProcAddress (hModule=0x76800000, lpProcName="CM_Detect_Resource_Conflict") returned 0x7681e080 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Detect_Resource_Conflict_Ex") returned 0x7681e0b0 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Disable_DevNode") returned 0x7681b8d0 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Disable_DevNode_Ex") returned 0x7681b9f0 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Disconnect_Machine") returned 0x7681a390 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Dup_Range_List") returned 0x7681ccf0 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Duplicate_PowerScheme") returned 0x7681a8f0 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enable_DevNode") returned 0x7681ba20 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enable_DevNode_Ex") returned 0x7681bb40 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enumerate_Classes") returned 0x7681f310 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enumerate_Classes_Ex") returned 0x7681f3a0 [0114.024] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enumerate_EnumeratorsA") returned 0x76821000 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enumerate_EnumeratorsW") returned 0x76821030 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enumerate_Enumerators_ExA") returned 0x768210c0 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Enumerate_Enumerators_ExW") returned 0x76821150 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Find_Range") returned 0x7681ce00 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_First_Range") returned 0x7681d070 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Log_Conf") returned 0x7681ae50 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Log_Conf_Ex") returned 0x7681af90 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7681afc0 [0114.025] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Range_List") returned 0x7681d160 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Res_Des") returned 0x7681e280 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Res_Des_Ex") returned 0x7681e440 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7681e470 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Free_Resource_Conflict_Handle") returned 0x76821670 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Child") returned 0x7680c4d0 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Child_Ex") returned 0x76821190 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Key_NameA") returned 0x7681f3d0 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Key_NameW") returned 0x7681f400 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Key_Name_ExA") returned 0x7681f4b0 [0114.026] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Key_Name_ExW") returned 0x7681f530 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_NameA") returned 0x7681f550 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_NameW") returned 0x7681f580 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Name_ExA") returned 0x7681f660 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Name_ExW") returned 0x7681f6e0 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_PropertyW") returned 0x768076d0 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Property_ExW") returned 0x768071b0 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Property_Keys") returned 0x76821f00 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Property_Keys_Ex") returned 0x76821fc0 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Registry_PropertyA") returned 0x7681f720 [0114.027] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Class_Registry_PropertyW") returned 0x7681f810 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Depth") returned 0x768211c0 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Depth_Ex") returned 0x768212d0 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Custom_PropertyA") returned 0x7681fa90 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Custom_PropertyW") returned 0x76808d60 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Custom_Property_ExA") returned 0x768059f0 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Custom_Property_ExW") returned 0x76805af0 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7680a420 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Property_ExW") returned 0x7680a3f0 [0114.028] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x76822000 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Property_Keys_Ex") returned 0x76822130 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Registry_PropertyA") returned 0x7681fac0 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x768093d0 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Registry_Property_ExA") returned 0x7681faf0 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Registry_Property_ExW") returned 0x768093a0 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Status") returned 0x76807a40 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_DevNode_Status_Ex") returned 0x76811670 [0114.029] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_IDA") returned 0x76806f50 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_IDW") returned 0x76805dc0 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_ExA") returned 0x76807010 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_ExW") returned 0x768090c0 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_ListA") returned 0x76821300 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_ListW") returned 0x7680c7b0 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_List_ExA") returned 0x76821330 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_List_ExW") returned 0x7680c780 [0114.030] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_List_SizeA") returned 0x76821400 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_List_SizeW") returned 0x76821420 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_List_Size_ExA") returned 0x768214f0 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_List_Size_ExW") returned 0x76821560 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_Size") returned 0x76821590 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_ID_Size_Ex") returned 0x768070c0 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_AliasA") returned 0x7681fbf0 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_AliasW") returned 0x7680ceb0 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_Alias_ExA") returned 0x7681fc20 [0114.032] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_Alias_ExW") returned 0x7680cf30 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_ListA") returned 0x7681fd30 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_ListW") returned 0x7680cb70 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_List_ExA") returned 0x7681fd60 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_List_ExW") returned 0x7680cb40 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_List_SizeA") returned 0x7681fe30 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_List_SizeW") returned 0x76805090 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_List_Size_ExA") returned 0x7681fe60 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_List_Size_ExW") returned 0x76805060 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_PropertyW") returned 0x768092a0 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_Property_ExW") returned 0x76809270 [0114.033] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_Property_KeysW") returned 0x76822170 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Device_Interface_Property_Keys_ExW") returned 0x76822210 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_First_Log_Conf") returned 0x7680ff10 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_First_Log_Conf_Ex") returned 0x768116a0 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Global_State") returned 0x7681a3b0 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Global_State_Ex") returned 0x7681a430 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_HW_Prof_FlagsA") returned 0x76822350 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_HW_Prof_FlagsW") returned 0x76822380 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_HW_Prof_Flags_ExA") returned 0x76822440 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_HW_Prof_Flags_ExW") returned 0x768224a0 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Hardware_Profile_InfoA") returned 0x768224e0 [0114.034] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Hardware_Profile_InfoW") returned 0x76822500 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Hardware_Profile_Info_ExA") returned 0x76822580 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Hardware_Profile_Info_ExW") returned 0x76822630 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Log_Conf_Priority") returned 0x7681b040 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Log_Conf_Priority_Ex") returned 0x7681b190 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Next_Log_Conf") returned 0x7681b1c0 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Next_Log_Conf_Ex") returned 0x7681b320 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Next_Res_Des") returned 0x7681e4f0 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Next_Res_Des_Ex") returned 0x7681e6d0 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Parent") returned 0x7680c150 [0114.035] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Parent_Ex") returned 0x76810740 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Res_Des_Data") returned 0x7681e710 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Res_Des_Data_Ex") returned 0x7681e8e0 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7681e920 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Res_Des_Data_Size_Ex") returned 0x7681eaf0 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Resource_Conflict_Count") returned 0x768216e0 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Resource_Conflict_DetailsA") returned 0x76821760 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Resource_Conflict_DetailsW") returned 0x768218c0 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Sibling") returned 0x7680e040 [0114.036] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Sibling_Ex") returned 0x768215b0 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Version") returned 0x7681a460 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Get_Version_Ex") returned 0x7681a470 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Import_PowerScheme") returned 0x7681a8f0 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Install_DevNodeW") returned 0x76822a40 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Install_DevNode_ExW") returned 0x76822b80 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Intersect_Range_List") returned 0x7681d240 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Invert_Range_List") returned 0x7681d4c0 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Is_Dock_Station_Present") returned 0x76822660 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Is_Dock_Station_Present_Ex") returned 0x76822720 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Is_Version_Available") returned 0x7681a4a0 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Is_Version_Available_Ex") returned 0x7681a4d0 [0114.037] GetProcAddress (hModule=0x76800000, lpProcName="CM_Locate_DevNodeA") returned 0x768215e0 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Locate_DevNodeW") returned 0x76809a40 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Locate_DevNode_ExA") returned 0x76821600 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Locate_DevNode_ExW") returned 0x76809a10 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_MapCrToSpErr") returned 0x768052a0 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_MapCrToWin32Err") returned 0x76805220 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Merge_Range_List") returned 0x7681d690 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Modify_Res_Des") returned 0x7681eb20 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Modify_Res_Des_Ex") returned 0x7681eda0 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Move_DevNode") returned 0x7681a8f0 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Move_DevNode_Ex") returned 0x7681bb70 [0114.038] GetProcAddress (hModule=0x76800000, lpProcName="CM_Next_Range") returned 0x7681d9a0 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Class_KeyA") returned 0x7681ff40 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Class_KeyW") returned 0x7680c6f0 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Class_Key_ExA") returned 0x7681ff70 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Class_Key_ExW") returned 0x7680cb10 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_DevNode_Key") returned 0x76805f50 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_DevNode_Key_Ex") returned 0x76805df0 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Device_Interface_KeyA") returned 0x7681ffe0 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Device_Interface_KeyW") returned 0x7680dd00 [0114.039] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Device_Interface_Key_ExA") returned 0x76820010 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Open_Device_Interface_Key_ExW") returned 0x7680dcd0 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_And_Remove_SubTreeA") returned 0x7681bb80 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_And_Remove_SubTreeW") returned 0x7681bbb0 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_And_Remove_SubTree_ExA") returned 0x7681bcf0 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_And_Remove_SubTree_ExW") returned 0x7681bdc0 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_Arbitrator_Free_Data") returned 0x7681a500 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_Arbitrator_Free_Data_Ex") returned 0x7681a640 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_Arbitrator_Free_Size") returned 0x7681a680 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_Arbitrator_Free_Size_Ex") returned 0x7681a7b0 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_Remove_SubTree") returned 0x7681c090 [0114.040] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_Remove_SubTree_Ex") returned 0x7681a8f0 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Query_Resource_Conflict_List") returned 0x76821b40 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Reenumerate_DevNode") returned 0x7681be00 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Reenumerate_DevNode_Ex") returned 0x7681bf20 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Register_Device_Driver") returned 0x7681bf50 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Register_Device_Driver_Ex") returned 0x7681c060 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Register_Device_InterfaceA") returned 0x76820070 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Register_Device_InterfaceW") returned 0x768200a0 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Register_Device_Interface_ExA") returned 0x768201e0 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Register_Device_Interface_ExW") returned 0x76820310 [0114.041] GetProcAddress (hModule=0x76800000, lpProcName="CM_Register_Notification") returned 0x768043a0 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Remove_SubTree") returned 0x7681c090 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Remove_SubTree_Ex") returned 0x7681a8f0 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Request_Device_EjectA") returned 0x7681c0a0 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Request_Device_EjectW") returned 0x7681c0d0 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Request_Device_Eject_ExA") returned 0x7681c220 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Request_Device_Eject_ExW") returned 0x7681c2f0 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Request_Eject_PC") returned 0x76822750 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Request_Eject_PC_Ex") returned 0x76822800 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_RestoreAll_DefaultPowerSchemes") returned 0x7681a900 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Restore_DefaultPowerScheme") returned 0x7681c090 [0114.042] GetProcAddress (hModule=0x76800000, lpProcName="CM_Run_Detection") returned 0x7681a7f0 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Run_Detection_Ex") returned 0x7681a810 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_ActiveScheme") returned 0x7681c090 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_Class_PropertyW") returned 0x76822250 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_Class_Property_ExW") returned 0x76822310 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_Class_Registry_PropertyA") returned 0x76820350 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_Class_Registry_PropertyW") returned 0x76820450 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_Problem") returned 0x7681c330 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_Problem_Ex") returned 0x7681c450 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_PropertyW") returned 0x768105a0 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_Property_ExW") returned 0x76810570 [0114.043] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_Registry_PropertyA") returned 0x76820780 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_Registry_PropertyW") returned 0x768207b0 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_Registry_Property_ExA") returned 0x76820bc0 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_DevNode_Registry_Property_ExW") returned 0x76820cc0 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_Device_Interface_PropertyW") returned 0x76810080 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_Device_Interface_Property_ExW") returned 0x76810050 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_HW_Prof") returned 0x76822830 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_HW_Prof_Ex") returned 0x76822850 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_HW_Prof_FlagsA") returned 0x76822880 [0114.044] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_HW_Prof_FlagsW") returned 0x768228b0 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_HW_Prof_Flags_ExA") returned 0x768229a0 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Set_HW_Prof_Flags_ExW") returned 0x76822a00 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Setup_DevNode") returned 0x7681c480 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Setup_DevNode_Ex") returned 0x7681c5a0 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Test_Range_Available") returned 0x7681da90 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Uninstall_DevNode") returned 0x7681c5d0 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Uninstall_DevNode_Ex") returned 0x7681c6c0 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Unregister_Device_InterfaceA") returned 0x76820d00 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Unregister_Device_InterfaceW") returned 0x76820d20 [0114.045] GetProcAddress (hModule=0x76800000, lpProcName="CM_Unregister_Device_Interface_ExA") returned 0x76820da0 [0114.049] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x745b0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")) returned 0x27 [0114.050] GetModuleFileNameA (in: hModule=0x745b0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")) returned 0x27 [0114.050] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0114.050] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=5237336) returned 1 [0114.050] VirtualAlloc (lpAddress=0x0, dwSize=0x4fea58, flAllocationType=0x1000, flProtect=0x4) returned 0xc60000 [0114.050] ReadFile (in: hFile=0x1b4, lpBuffer=0xc60000, nNumberOfBytesToRead=0x4fea58, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0xc60000*, lpNumberOfBytesRead=0x19bd68*=0x4fea58, lpOverlapped=0x0) returned 1 [0114.200] CloseHandle (hObject=0x1b4) returned 1 [0114.200] GetProcAddress (hModule=0x745b0000, lpProcName="AssocCreateForClasses") returned 0x74677860 [0114.200] GetProcAddress (hModule=0x745b0000, lpProcName="AssocGetDetailsOfPropKey") returned 0x747a0d80 [0114.200] GetProcAddress (hModule=0x745b0000, lpProcName="CCachedShellItem_CreateInstance") returned 0x746e90e0 [0114.201] GetProcAddress (hModule=0x745b0000, lpProcName="CCollectionFactory_CreateInstance") returned 0x747ae1f0 [0114.201] GetProcAddress (hModule=0x745b0000, lpProcName="CFSFolder_CreateEnum") returned 0x74797790 [0114.201] GetProcAddress (hModule=0x745b0000, lpProcName="CFileOperationRecorder_CreateInstance") returned 0x748a8b30 [0114.204] GetProcAddress (hModule=0x745b0000, lpProcName="CFreeThreadedItemContainer_CreateInstance") returned 0x747ae5b0 [0114.204] GetProcAddress (hModule=0x745b0000, lpProcName="CMruLongList_CreateInstance") returned 0x7498b600 [0114.204] GetProcAddress (hModule=0x745b0000, lpProcName="CPrivateProfileCache_Save") returned 0x747b2360 [0114.204] GetProcAddress (hModule=0x745b0000, lpProcName="CRegFolder_CreateAndInit") returned 0x746e8710 [0114.205] GetProcAddress (hModule=0x745b0000, lpProcName="CRegFolder_CreateInstance") returned 0x747b1280 [0114.205] GetProcAddress (hModule=0x745b0000, lpProcName="CShellItemArrayAsCollection_CreateInstance") returned 0x7476a3d0 [0114.205] GetProcAddress (hModule=0x745b0000, lpProcName="CShellItemArrayAsVirtualizedObjectArray_CreateInstance") returned 0x74984ff0 [0114.205] GetProcAddress (hModule=0x745b0000, lpProcName="CShellItemArrayWithCommonParent_CreateInstance") returned 0x746c0d80 [0114.205] GetProcAddress (hModule=0x745b0000, lpProcName="CShellItemArray_CreateInstance") returned 0x74797ea0 [0114.205] GetProcAddress (hModule=0x745b0000, lpProcName="CShellItem_CreateInstance") returned 0x7479de10 [0114.206] GetProcAddress (hModule=0x745b0000, lpProcName="CStorageItem_GetValidatedStorageItemObject") returned 0x748efea0 [0114.206] GetProcAddress (hModule=0x745b0000, lpProcName="CTaskAddDoc_Create") returned 0x746abdf0 [0114.206] GetProcAddress (hModule=0x745b0000, lpProcName="CViewSettings_CreateInstance") returned 0x747b0e40 [0114.206] GetProcAddress (hModule=0x745b0000, lpProcName="CopyDefaultLibrariesFromGroupPolicy") returned 0x74a14590 [0114.206] GetProcAddress (hModule=0x745b0000, lpProcName="CreateItemArrayFromItemStore") returned 0x74985060 [0114.207] GetProcAddress (hModule=0x745b0000, lpProcName="CreateItemArrayFromObjectArray") returned 0x746c0c80 [0114.207] GetProcAddress (hModule=0x745b0000, lpProcName="CreateLocalizationDesktopIni") returned 0x74a0ac20 [0114.207] GetProcAddress (hModule=0x745b0000, lpProcName="CreateSortColumnArray") returned 0x7478ad00 [0114.207] GetProcAddress (hModule=0x745b0000, lpProcName="CreateStorageItemFromPath_FullTrustCaller") returned 0x748d0d30 [0114.208] GetProcAddress (hModule=0x745b0000, lpProcName="CreateStorageItemFromPath_FullTrustCaller_ForPackage") returned 0x748d0d60 [0114.208] GetProcAddress (hModule=0x745b0000, lpProcName="CreateStorageItemFromPath_PartialTrustCaller") returned 0x748eff60 [0114.208] GetProcAddress (hModule=0x745b0000, lpProcName="CreateStorageItemFromShellItem") returned 0x748d1160 [0114.208] GetProcAddress (hModule=0x745b0000, lpProcName="CreateStorageItemFromShellItem_FullTrustCaller_ForPackage") returned 0x746b1480 [0114.209] GetProcAddress (hModule=0x745b0000, lpProcName="DataAccessCaches_InvalidateForLibrary") returned 0x748f04c0 [0114.209] GetProcAddress (hModule=0x745b0000, lpProcName="DetermineFolderDestinationParentAppID") returned 0x746b0f90 [0114.209] GetProcAddress (hModule=0x745b0000, lpProcName="DllCanUnloadNow") returned 0x7479e320 [0114.209] GetProcAddress (hModule=0x745b0000, lpProcName="DllGetActivationFactory") returned 0x747a01b0 [0114.209] GetProcAddress (hModule=0x745b0000, lpProcName="DllGetClassObject") returned 0x74759000 [0114.209] GetProcAddress (hModule=0x745b0000, lpProcName="DllMain") returned 0x74864ef0 [0114.209] GetProcAddress (hModule=0x745b0000, lpProcName="DllRegisterServer") returned 0x7478fd90 [0114.210] GetProcAddress (hModule=0x745b0000, lpProcName="DllUnregisterServer") returned 0x7478fd90 [0114.210] GetProcAddress (hModule=0x745b0000, lpProcName="DragQueryFileW") returned 0x748361b0 [0114.210] GetProcAddress (hModule=0x745b0000, lpProcName="EnumShellItemsFromEnumFullIdList") returned 0x749850f0 [0114.210] GetProcAddress (hModule=0x745b0000, lpProcName="GetCachedFileUpdateInformation") returned 0x748f0130 [0114.210] GetProcAddress (hModule=0x745b0000, lpProcName="GetCommandProviderForFolderType") returned 0x7497af40 [0114.210] GetProcAddress (hModule=0x745b0000, lpProcName="GetFileUndoText") returned 0x748a8c90 [0114.211] GetProcAddress (hModule=0x745b0000, lpProcName="GetFindDataForPath") returned 0x7476c3c0 [0114.211] GetProcAddress (hModule=0x745b0000, lpProcName="GetFindDataFromFileInformationByHandle") returned 0x7476d2d0 [0114.211] GetProcAddress (hModule=0x745b0000, lpProcName="GetRegDataDrivenCommand") returned 0x746d1e70 [0114.211] GetProcAddress (hModule=0x745b0000, lpProcName="GetRegDataDrivenCommandWithAssociation") returned 0x7477d7f0 [0114.211] GetProcAddress (hModule=0x745b0000, lpProcName="GetSelectionStateFromItemArray") returned 0x746db9b0 [0114.211] GetProcAddress (hModule=0x745b0000, lpProcName="GetSystemPersistedStorageItemList") returned 0x746c7760 [0114.211] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_MaxIcons") returned 0x747b1e00 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_Untyped_FileClassSRWLock") returned 0x747ab2f0 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_Untyped_MountPoint") returned 0x747acbe0 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_Untyped_pFileClassCacheTable") returned 0x747aafe0 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_Untyped_pFileHanderMap") returned 0x747ac950 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_Untyped_rgshil") returned 0x747ac8b0 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_afNotRedirected") returned 0x747aeea0 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_ccIcon") returned 0x747b16d0 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_csIconCache") returned 0x747aa320 [0114.212] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_csSCN") returned 0x747b5d50 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_dwThreadBindCtx") returned 0x747b1220 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_dwThreadInitializing") returned 0x747b1be0 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_esServerMode") returned 0x747ad350 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_fEndInitialized") returned 0x747ae1a0 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_fIconCacheHasBeenSuccessfullyCreated") returned 0x746de240 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_fIconCacheIsValid") returned 0x747afd70 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_fNeedsInitBroadcast") returned 0x746de230 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_hwndSCN") returned 0x747afb70 [0114.213] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_iLastSysIcon") returned 0x746de150 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_iLastSystemColorDepth") returned 0x747b1f50 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_iUseLinkPrefix") returned 0x749bd550 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_lProcessClassCount") returned 0x747adb90 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_lrFlags") returned 0x747b1270 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_nImageManagerVersion") returned 0x749bd560 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_tlsChangeClientProxy") returned 0x747b0260 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_tlsIconCache") returned 0x747b0b10 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_tlsThreadFlags") returned 0x747b0bc0 [0114.214] GetProcAddress (hModule=0x745b0000, lpProcName="Global_WindowsStorage_ulNextID") returned 0x747b1880 [0114.215] GetProcAddress (hModule=0x745b0000, lpProcName="ILAppendID") returned 0x748626a0 [0114.215] GetProcAddress (hModule=0x745b0000, lpProcName="ILClone") returned 0x746e4220 [0114.215] GetProcAddress (hModule=0x745b0000, lpProcName="ILCloneFirst") returned 0x74721040 [0114.215] GetProcAddress (hModule=0x745b0000, lpProcName="ILCombine") returned 0x746e3ea0 [0114.215] GetProcAddress (hModule=0x745b0000, lpProcName="ILFindChild") returned 0x74862760 [0114.215] GetProcAddress (hModule=0x745b0000, lpProcName="ILFindLastID") returned 0x7479f040 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILFree") returned 0x747a1b70 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILGetNext") returned 0x747a8020 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILGetSize") returned 0x747ade50 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILIsEqual") returned 0x746e7780 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILIsParent") returned 0x746d8130 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILLoadFromStreamEx") returned 0x747a05a0 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILRemoveLastID") returned 0x746e41e0 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="ILSaveToStream") returned 0x747ab3d0 [0114.216] GetProcAddress (hModule=0x745b0000, lpProcName="IsLFNDriveW") returned 0x746b2b70 [0114.217] GetProcAddress (hModule=0x745b0000, lpProcName="IsLibraryCreatedByPolicy") returned 0x74a14650 [0114.217] GetProcAddress (hModule=0x745b0000, lpProcName="IsLibraryPolicyEnabled") returned 0x747a3950 [0114.217] GetProcAddress (hModule=0x745b0000, lpProcName="IsNameListedUnderKey") returned 0x74946140 [0114.217] GetProcAddress (hModule=0x745b0000, lpProcName="IsUserAnAdmin") returned 0x7487fab0 [0114.217] GetProcAddress (hModule=0x745b0000, lpProcName="PathCleanupSpec") returned 0x746b2a50 [0114.217] GetProcAddress (hModule=0x745b0000, lpProcName="PathIsExe") returned 0x74875cd0 [0114.218] GetProcAddress (hModule=0x745b0000, lpProcName="PathMakeUniqueName") returned 0x74875ed0 [0114.218] GetProcAddress (hModule=0x745b0000, lpProcName="PathYetAnotherMakeUniqueName") returned 0x746b2010 [0114.232] GetProcAddress (hModule=0x745b0000, lpProcName="RegistryVerbs_GetHandlerMultiSelectModel") returned 0x747afef0 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHBindToFolderIDListParent") returned 0x747ae170 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHBindToFolderIDListParentEx") returned 0x747218f0 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHBindToObject") returned 0x746e42e0 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHBindToParent") returned 0x7477c510 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHCLSIDFromString") returned 0x746eb370 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHChangeNotification_Lock") returned 0x747ae500 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHChangeNotification_Unlock") returned 0x747b0720 [0114.233] GetProcAddress (hModule=0x745b0000, lpProcName="SHChangeNotify") returned 0x746e3b60 [0114.234] GetProcAddress (hModule=0x745b0000, lpProcName="SHChangeNotifyDeregister") returned 0x747a6570 [0114.234] GetProcAddress (hModule=0x745b0000, lpProcName="SHChangeNotifyRegister") returned 0x747a65e0 [0114.234] GetProcAddress (hModule=0x745b0000, lpProcName="SHCoCreateInstanceWorker") returned 0x74758470 [0114.234] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateDataObject") returned 0x746da550 [0114.234] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateDefaultExtractIcon") returned 0x747a9790 [0114.234] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateDirectory") returned 0x746de2f0 [0114.234] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateDirectoryExA") returned 0x748858e0 [0114.235] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateDirectoryExW") returned 0x747b0690 [0114.235] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateItemFromIDList") returned 0x74712d70 [0114.235] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateItemFromParsingName") returned 0x74769260 [0114.235] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateItemInKnownFolder") returned 0x74688a80 [0114.235] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateItemWithParent") returned 0x7476bc70 [0114.235] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateItemWithParentAndChildId") returned 0x74985200 [0114.236] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateShellItemArray") returned 0x747a9ea0 [0114.236] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateShellItemArrayFromDataObject") returned 0x74798350 [0114.236] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateShellItemArrayFromIDLists") returned 0x746f62c0 [0114.236] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateShellItemArrayFromShellItem") returned 0x747a9da0 [0114.236] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateShellItemArrayWithFolderParent") returned 0x749852a0 [0114.236] GetProcAddress (hModule=0x745b0000, lpProcName="SHCreateStdEnumFmtEtc") returned 0x74835bd0 [0114.236] GetProcAddress (hModule=0x745b0000, lpProcName="SHFileOperationWithAdditionalFlags") returned 0x746c83c0 [0114.237] GetProcAddress (hModule=0x745b0000, lpProcName="SHFindFiles") returned 0x74885bb0 [0114.237] GetProcAddress (hModule=0x745b0000, lpProcName="SHFlushSFCache") returned 0x7485ca50 [0114.237] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetDesktopFolder") returned 0x747bc340 [0114.237] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetFileInfoW") returned 0x74882170 [0114.237] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetFolderLocation") returned 0x74794fc0 [0114.237] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetFolderPathA") returned 0x746ddbc0 [0114.237] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetFolderPathAndSubDirA") returned 0x74974260 [0114.238] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetFolderPathAndSubDirW") returned 0x747a9040 [0114.238] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetFolderPathEx") returned 0x7475cee0 [0114.238] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetFolderPathW") returned 0x74721110 [0114.238] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetIDListFromObject") returned 0x7471b7c0 [0114.238] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetInstanceExplorer") returned 0x749bd570 [0114.238] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetItemFromObject") returned 0x74793900 [0114.239] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetKnownFolderIDList") returned 0x747950c0 [0114.239] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetKnownFolderIDList_Internal") returned 0x7475ad30 [0114.239] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetKnownFolderItem") returned 0x747a5f20 [0114.239] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetKnownFolderPath") returned 0x7475a410 [0114.239] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetNameFromIDList") returned 0x7477c540 [0114.239] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetPathFromIDListEx") returned 0x746e3f50 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetPathFromIDListW") returned 0x74885c60 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetSetSettings") returned 0x746f5730 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetSpecialFolderLocation") returned 0x74794ee0 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetSpecialFolderPathA") returned 0x749742f0 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetSpecialFolderPathW") returned 0x747ae130 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetStockIconInfo") returned 0x746d3fa0 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHGetTemporaryPropertyForItem") returned 0x74882430 [0114.240] GetProcAddress (hModule=0x745b0000, lpProcName="SHILCreateFromPath") returned 0x748627e0 [0114.241] GetProcAddress (hModule=0x745b0000, lpProcName="SHKnownFolderFromCSIDL") returned 0x7470fbe0 [0114.241] GetProcAddress (hModule=0x745b0000, lpProcName="SHKnownFolderToCSIDL") returned 0x747a16d0 [0114.241] GetProcAddress (hModule=0x745b0000, lpProcName="SHParseDisplayName") returned 0x74769900 [0114.241] GetProcAddress (hModule=0x745b0000, lpProcName="SHPrepareKnownFoldersCommon") returned 0x74a0aca0 [0114.241] GetProcAddress (hModule=0x745b0000, lpProcName="SHPrepareKnownFoldersUser") returned 0x74a0acb0 [0114.241] GetProcAddress (hModule=0x745b0000, lpProcName="SHResolveLibrary") returned 0x74a176f0 [0114.242] GetProcAddress (hModule=0x745b0000, lpProcName="SHRestricted") returned 0x746f56c0 [0114.242] GetProcAddress (hModule=0x745b0000, lpProcName="SHSetFolderPathA") returned 0x74974330 [0114.242] GetProcAddress (hModule=0x745b0000, lpProcName="SHSetFolderPathW") returned 0x749743a0 [0114.242] GetProcAddress (hModule=0x745b0000, lpProcName="SHSetKnownFolderPath") returned 0x747b41d0 [0114.242] GetProcAddress (hModule=0x745b0000, lpProcName="SHSetLocalizedName") returned 0x74882730 [0114.242] GetProcAddress (hModule=0x745b0000, lpProcName="SHSetTemporaryPropertyForItem") returned 0x74712b50 [0114.242] GetProcAddress (hModule=0x745b0000, lpProcName="SHSysErrorMessageBox") returned 0x74886290 [0114.243] GetProcAddress (hModule=0x745b0000, lpProcName="SHTestTokenMembership") returned 0x747ac500 [0114.243] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_AddItemToRecentDocs") returned 0x74685480 [0114.243] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_AddNewFolderToFrequentPlaces") returned 0x749af570 [0114.243] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CEnumFiles_CreateInstance") returned 0x749af590 [0114.243] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CStatusProvider_CreateInstance") returned 0x749af5a0 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CStorageItem_GetValidatedStorageItem") returned 0x746d36a0 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CStorageItem_GetValidatedStorageItemObject") returned 0x749af5c0 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_ClearDestinationsForAllApps") returned 0x749af5d0 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateSortColumnArrayFromListDesc") returned 0x749af5f0 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromPath_FullTrustCaller") returned 0x749af600 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromPath_FullTrustCaller_ForPackage") returned 0x749af610 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromPath_PartialTrustCaller") returned 0x749af620 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromShellItem_FullTrustCaller") returned 0x746ddf90 [0114.244] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage") returned 0x746ddc40 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle") returned 0x749af630 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandleAndSecondaryStreamName") returned 0x747c9400 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage") returned 0x749af670 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_FillResultWithNullForKeys") returned 0x749af690 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_GetShellItemFromStorageItem") returned 0x749af6b0 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_GetSystemPersistedStorageItemList") returned 0x749af6c0 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_MakeDestinationItem") returned 0x749af6d0 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHAddToRecentDocs") returned 0x746dda50 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHAddToRecentDocsEx") returned 0x749af700 [0114.245] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHConfirmOperation") returned 0x749af720 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHCreateDirectory") returned 0x746de2f0 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHCreateDirectoryExA") returned 0x748858e0 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHCreateDirectoryExWWorker") returned 0x747b0690 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHCreateShellItemArray") returned 0x749af740 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHCreateShellItemArrayFromDataObject") returned 0x74798340 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHCreateShellItemArrayFromIDLists") returned 0x747b1260 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHCreateShellItemArrayFromShellItem") returned 0x746dc710 [0114.246] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHFileOperation") returned 0x746d9870 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHFileOperationA") returned 0x749af750 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHFreeNameMappings") returned 0x749af770 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHGetDesktopFolderWorker") returned 0x747217d0 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHGetPathFromMsUri") returned 0x749af790 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHPathPrepareForWriteA") returned 0x749af7b0 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHPathPrepareForWriteW") returned 0x749af810 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="STORAGE_SHValidateMSUri") returned 0x749af830 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="SendNotificationsForLibraryItem") returned 0x747b30f0 [0114.247] GetProcAddress (hModule=0x745b0000, lpProcName="ShellExecuteExW") returned 0x7484a840 [0114.248] GetProcAddress (hModule=0x745b0000, lpProcName="_CleanRecentDocs") returned 0x749971f0 [0114.248] GetProcAddress (hModule=0x745b0000, lpProcName="_PredictReasonableImpact") returned 0x74797660 [0114.248] VirtualFree (lpAddress=0xc60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.319] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x762b0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")) returned 0x1f [0114.320] GetModuleFileNameA (in: hModule=0x762b0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")) returned 0x1f [0114.320] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0114.320] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=1824264) returned 1 [0114.320] VirtualAlloc (lpAddress=0x0, dwSize=0x1bd608, flAllocationType=0x1000, flProtect=0x4) returned 0xc60000 [0114.320] ReadFile (in: hFile=0x1b4, lpBuffer=0xc60000, nNumberOfBytesToRead=0x1bd608, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0xc60000*, lpNumberOfBytesRead=0x19bd68*=0x1bd608, lpOverlapped=0x0) returned 1 [0114.409] CloseHandle (hObject=0x1b4) returned 1 [0114.409] GetProcAddress (hModule=0x762b0000, lpProcName="CLIPFORMAT_UserFree") returned 0x7640c640 [0114.410] GetProcAddress (hModule=0x762b0000, lpProcName="CLIPFORMAT_UserMarshal") returned 0x7640c660 [0114.410] GetProcAddress (hModule=0x762b0000, lpProcName="CLIPFORMAT_UserSize") returned 0x7640c7c0 [0114.410] GetProcAddress (hModule=0x762b0000, lpProcName="CLIPFORMAT_UserUnmarshal") returned 0x7640c870 [0114.410] GetProcAddress (hModule=0x762b0000, lpProcName="CLSIDFromOle1Class") returned 0x762f5c10 [0114.410] GetProcAddress (hModule=0x762b0000, lpProcName="CLSIDFromProgID") returned 0x762f5ec0 [0114.410] GetProcAddress (hModule=0x762b0000, lpProcName="CLSIDFromString") returned 0x7635e3d0 [0114.410] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer2_Connect") returned 0x762c1aa0 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer2_Disconnect") returned 0x762c1b00 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer2_Release") returned 0x762c1b60 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer_AddRef") returned 0x762bcc40 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer_Connect") returned 0x762c1bf0 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer_Disconnect") returned 0x762b9090 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer_Invoke") returned 0x762c1c50 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer_QueryInterface") returned 0x762c1d10 [0114.411] GetProcAddress (hModule=0x762b0000, lpProcName="CStdAsyncStubBuffer_Release") returned 0x762c1e30 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer2_Connect") returned 0x762c2010 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer2_CountRefs") returned 0x762c2070 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer2_Disconnect") returned 0x762b9020 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer2_QueryInterface") returned 0x762b90e0 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_AddRef") returned 0x762bc5d0 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_Connect") returned 0x762c21d0 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_CountRefs") returned 0x762c2250 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_DebugServerQueryInterface") returned 0x762c2270 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_DebugServerRelease") returned 0x762b9000 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_Disconnect") returned 0x762b9090 [0114.412] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_Invoke") returned 0x762bc2b0 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_IsIIDSupported") returned 0x762c22a0 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CStdStubBuffer_QueryInterface") returned 0x762bae70 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CleanupComl2StateInAllTls") returned 0x76389b30 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CleanupOleStateInAllTls") returned 0x763838c0 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CleanupTlsComl2State") returned 0x76389b80 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CleanupTlsOleState") returned 0x76383910 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="ClearCleanupFlag") returned 0x7638e2a0 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CoAddRefServerProcess") returned 0x76380d30 [0114.413] GetProcAddress (hModule=0x762b0000, lpProcName="CoAllowUnmarshalerCLSID") returned 0x7638ddb0 [0114.414] GetProcAddress (hModule=0x762b0000, lpProcName="CoCancelCall") returned 0x76383b50 [0114.414] GetProcAddress (hModule=0x762b0000, lpProcName="CoCopyProxy") returned 0x7636d160 [0114.414] GetProcAddress (hModule=0x762b0000, lpProcName="CoCreateErrorInfo") returned 0x7636d200 [0114.414] GetProcAddress (hModule=0x762b0000, lpProcName="CoCreateFreeThreadedMarshaler") returned 0x76326090 [0114.414] GetProcAddress (hModule=0x762b0000, lpProcName="CoCreateGuid") returned 0x7636e9c0 [0114.414] GetProcAddress (hModule=0x762b0000, lpProcName="CoCreateInstance") returned 0x76330060 [0114.414] GetProcAddress (hModule=0x762b0000, lpProcName="CoCreateInstanceEx") returned 0x76375bc0 [0114.415] GetProcAddress (hModule=0x762b0000, lpProcName="CoCreateInstanceFromApp") returned 0x76377a50 [0114.415] GetProcAddress (hModule=0x762b0000, lpProcName="CoCreateObjectInContext") returned 0x763ecf60 [0114.415] GetProcAddress (hModule=0x762b0000, lpProcName="CoDeactivateObject") returned 0x763ed300 [0114.415] GetProcAddress (hModule=0x762b0000, lpProcName="CoDecodeProxy") returned 0x763ed3d0 [0114.415] GetProcAddress (hModule=0x762b0000, lpProcName="CoDecrementMTAUsage") returned 0x76389f00 [0114.415] GetProcAddress (hModule=0x762b0000, lpProcName="CoDisableCallCancellation") returned 0x76388b70 [0114.415] GetProcAddress (hModule=0x762b0000, lpProcName="CoDisconnectContext") returned 0x763812e0 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoDisconnectObject") returned 0x76381b20 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoEnableCallCancellation") returned 0x76388fc0 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoFreeUnusedLibraries") returned 0x762f4f10 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoFreeUnusedLibrariesEx") returned 0x762f6910 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetActivationState") returned 0x763ed410 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetApartmentID") returned 0x763ef9c0 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetApartmentType") returned 0x7637d100 [0114.416] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetCallContext") returned 0x7634f060 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetCallState") returned 0x763ed450 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetCallerTID") returned 0x7638cce0 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetCancelObject") returned 0x76383bc0 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetClassObject") returned 0x7637c1b0 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetClassVersion") returned 0x763e51a0 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetContextToken") returned 0x7637cce0 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetCurrentLogicalThreadId") returned 0x76360860 [0114.417] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetCurrentProcess") returned 0x7638d530 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetDefaultContext") returned 0x763ed4a0 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetErrorInfo") returned 0x7636d7c0 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetInstanceFromFile") returned 0x764095f0 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetInstanceFromIStorage") returned 0x764096a0 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetInterfaceAndReleaseStream") returned 0x763844f0 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetMalloc") returned 0x7637eb10 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetMarshalSizeMax") returned 0x7633b510 [0114.418] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetModuleType") returned 0x7640f710 [0114.419] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetObjectContext") returned 0x76342df0 [0114.419] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetPSClsid") returned 0x763f05d0 [0114.419] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetProcessIdentifier") returned 0x76389b00 [0114.419] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetStandardMarshal") returned 0x76380150 [0114.419] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetStdMarshalEx") returned 0x76385100 [0114.419] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetSystemSecurityPermissions") returned 0x763ed5c0 [0114.420] GetProcAddress (hModule=0x762b0000, lpProcName="CoGetTreatAsClass") returned 0x7635ff40 [0114.420] GetProcAddress (hModule=0x762b0000, lpProcName="CoImpersonateClient") returned 0x7634efd0 [0114.420] GetProcAddress (hModule=0x762b0000, lpProcName="CoIncrementMTAUsage") returned 0x76305a00 [0114.420] GetProcAddress (hModule=0x762b0000, lpProcName="CoInitializeEx") returned 0x763088d0 [0114.420] GetProcAddress (hModule=0x762b0000, lpProcName="CoInitializeSecurity") returned 0x76373870 [0114.420] GetProcAddress (hModule=0x762b0000, lpProcName="CoInitializeWOW") returned 0x763e5520 [0114.420] GetProcAddress (hModule=0x762b0000, lpProcName="CoInvalidateRemoteMachineBindings") returned 0x763ed5f0 [0114.421] GetProcAddress (hModule=0x762b0000, lpProcName="CoIsHandlerConnected") returned 0x763ed610 [0114.421] GetProcAddress (hModule=0x762b0000, lpProcName="CoLockObjectExternal") returned 0x762f13b0 [0114.421] GetProcAddress (hModule=0x762b0000, lpProcName="CoMarshalHresult") returned 0x763e5290 [0114.421] GetProcAddress (hModule=0x762b0000, lpProcName="CoMarshalInterThreadInterfaceInStream") returned 0x76360c30 [0114.421] GetProcAddress (hModule=0x762b0000, lpProcName="CoMarshalInterface") returned 0x7633b960 [0114.421] GetProcAddress (hModule=0x762b0000, lpProcName="CoPopServiceDomain") returned 0x763f4880 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoPushServiceDomain") returned 0x763f48b0 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoQueryAuthenticationServices") returned 0x763eafe0 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoQueryClientBlanket") returned 0x7638b6c0 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoQueryProxyBlanket") returned 0x7636ce20 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoReactivateObject") returned 0x763ed6a0 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterActivationFilter") returned 0x762f2df0 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterClassObject") returned 0x762f65b0 [0114.422] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterInitializeSpy") returned 0x76383790 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterMallocSpy") returned 0x763e60d0 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterMessageFilter") returned 0x762f6200 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterPSClsid") returned 0x76384a70 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterSurrogate") returned 0x76409330 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoRegisterSurrogateEx") returned 0x762f3060 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoReleaseMarshalData") returned 0x763084f0 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoReleaseServerProcess") returned 0x76383950 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoResumeClassObjects") returned 0x763898c0 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoRetireServer") returned 0x763ed750 [0114.423] GetProcAddress (hModule=0x762b0000, lpProcName="CoRevertToSelf") returned 0x7634ef40 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoRevokeClassObject") returned 0x76381930 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoRevokeInitializeSpy") returned 0x76385690 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoRevokeMallocSpy") returned 0x763e6200 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoSetCancelObject") returned 0x763ea090 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoSetErrorInfo") returned 0x76307790 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoSetProxyBlanket") returned 0x763060a0 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoSuspendClassObjects") returned 0x762f2d80 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoSwitchCallContext") returned 0x763822c0 [0114.424] GetProcAddress (hModule=0x762b0000, lpProcName="CoTaskMemAlloc") returned 0x76309ed0 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoTaskMemFree") returned 0x76309170 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoTaskMemRealloc") returned 0x7637f6d0 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoTestCancel") returned 0x763ea130 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoUninitialize") returned 0x763092a0 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoUnloadingWOW") returned 0x763e5580 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoUnmarshalHresult") returned 0x763e52f0 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoUnmarshalInterface") returned 0x76336980 [0114.425] GetProcAddress (hModule=0x762b0000, lpProcName="CoVrfCheckThreadState") returned 0x76405aa0 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="CoVrfGetThreadState") returned 0x76405e50 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="CoVrfReleaseThreadState") returned 0x76405f40 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="CoWaitForMultipleHandles") returned 0x762f6f50 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="CoWaitForMultipleObjects") returned 0x762f6130 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="CreateErrorInfo") returned 0x7636d200 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="CreateStreamOnHGlobal") returned 0x76361370 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="DcomChannelSetHResult") returned 0x7637ceb0 [0114.426] GetProcAddress (hModule=0x762b0000, lpProcName="DllDebugObjectRPCHook") returned 0x762bde30 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="DllGetActivationFactory") returned 0x7638b5e0 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="DllGetClassObject") returned 0x76333490 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="EnableHookObject") returned 0x763e6780 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="FreePropVariantArray") returned 0x76389e00 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="FreePropVariantArrayWorker") returned 0x76389e20 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="GetCatalogHelper") returned 0x762f4f20 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="GetErrorInfo") returned 0x7636d7c0 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="GetFuncDescs") returned 0x76378190 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="GetHGlobalFromStream") returned 0x76361a60 [0114.427] GetProcAddress (hModule=0x762b0000, lpProcName="GetHookInterface") returned 0x763e67e0 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="GetRestrictedErrorInfo") returned 0x76369830 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HACCEL_UserFree") returned 0x762b9000 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HACCEL_UserMarshal") returned 0x762b8fc0 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HACCEL_UserSize") returned 0x762b8fe0 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HACCEL_UserUnmarshal") returned 0x762bb8a0 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HBITMAP_UserFree") returned 0x7638dde0 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HBITMAP_UserMarshal") returned 0x7638d3f0 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HBITMAP_UserSize") returned 0x7638d980 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HBITMAP_UserUnmarshal") returned 0x7638c540 [0114.428] GetProcAddress (hModule=0x762b0000, lpProcName="HBRUSH_UserFree") returned 0x762b9000 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HBRUSH_UserMarshal") returned 0x762b8fc0 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HBRUSH_UserSize") returned 0x762b8fe0 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HBRUSH_UserUnmarshal") returned 0x762bb8a0 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HDC_UserFree") returned 0x762bdf50 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HDC_UserMarshal") returned 0x762b8fc0 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HDC_UserSize") returned 0x762b8fe0 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HDC_UserUnmarshal") returned 0x762bb8a0 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HGLOBAL_UserFree") returned 0x7638d720 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HGLOBAL_UserMarshal") returned 0x7638ce30 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HGLOBAL_UserSize") returned 0x7638d110 [0114.429] GetProcAddress (hModule=0x762b0000, lpProcName="HGLOBAL_UserUnmarshal") returned 0x7636ccd0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HICON_UserFree") returned 0x762b9000 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HICON_UserMarshal") returned 0x762b8fc0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HICON_UserSize") returned 0x762b8fe0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HICON_UserUnmarshal") returned 0x762bb8a0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMENU_UserFree") returned 0x762b9000 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMENU_UserMarshal") returned 0x762b8fc0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMENU_UserSize") returned 0x762b8fe0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMENU_UserUnmarshal") returned 0x762bb8a0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMONITOR_UserFree") returned 0x762b9000 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMONITOR_UserMarshal") returned 0x762b8fc0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMONITOR_UserSize") returned 0x762b8fe0 [0114.430] GetProcAddress (hModule=0x762b0000, lpProcName="HMONITOR_UserUnmarshal") returned 0x762bb8a0 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HPALETTE_UserFree") returned 0x7640cb80 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HPALETTE_UserMarshal") returned 0x7640cbc0 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HPALETTE_UserSize") returned 0x7640cc90 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HPALETTE_UserUnmarshal") returned 0x7640ccf0 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HRGN_UserFree") returned 0x762bdf50 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HRGN_UserMarshal") returned 0x762b8fc0 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HRGN_UserSize") returned 0x762b8fe0 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HRGN_UserUnmarshal") returned 0x762bb8a0 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HSTRING_UserFree") returned 0x76344be0 [0114.431] GetProcAddress (hModule=0x762b0000, lpProcName="HSTRING_UserMarshal") returned 0x7637e480 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="HSTRING_UserSize") returned 0x7637eb40 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="HSTRING_UserUnmarshal") returned 0x7637dbe0 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="HWND_UserFree") returned 0x762b9000 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="HWND_UserMarshal") returned 0x762b8fc0 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="HWND_UserSize") returned 0x762b8fe0 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="HWND_UserUnmarshal") returned 0x762bb8a0 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="HkOleRegisterObject") returned 0x763e6830 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="IIDFromString") returned 0x76360b40 [0114.432] GetProcAddress (hModule=0x762b0000, lpProcName="InternalAppInvokeExceptionFilter") returned 0x763e4730 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCAggIdRelease") returned 0x763e4760 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCAggIdSetHandler") returned 0x762f2700 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCCFreeUnused") returned 0x763e47a0 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCCGetClassInformationForDde") returned 0x76409f20 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCCGetClassInformationFromKey") returned 0x76409f50 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCCSetDdeServerWindow") returned 0x76409f80 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCMLSendReceive") returned 0x763f4730 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCStdIdentityGetIProxyManager") returned 0x762f2d30 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCStdIdentityGetInternalUnk") returned 0x762f2c30 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCStdIdentityUpdateFlags") returned 0x762f2af0 [0114.433] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCallAsProxyExceptionFilter") returned 0x763e4930 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCallFrameExceptionFilter") returned 0x763e47c0 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCallerIsAppContainer") returned 0x763e47e0 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCanMakeOutCall") returned 0x763f47b0 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCoIsSurrogateProcess") returned 0x763e4800 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCoRegisterDisconnectCallback") returned 0x76380090 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCoRegisterSurrogatedObject") returned 0x763e4820 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCoStdMarshalObject") returned 0x763e4840 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCoUnregisterDisconnectCallback") returned 0x7638e300 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCompleteObjRef") returned 0x7638bd10 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCreateCAggId") returned 0x762f2430 [0114.434] GetProcAddress (hModule=0x762b0000, lpProcName="InternalCreateIdentityHandler") returned 0x763f9670 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalDoATClassCreate") returned 0x763e4870 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalFillLocalOXIDInfo") returned 0x7638bf50 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalFreeObjRef") returned 0x7638d7b0 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalGetWindowPropInterface") returned 0x7638d310 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIrotEnumRunning") returned 0x763e48b0 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIrotGetObject") returned 0x762f25c0 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIrotGetTimeOfLastChange") returned 0x763e48c0 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIrotIsRunning") returned 0x763e48d0 [0114.435] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIrotNoteChangeTime") returned 0x763e48e0 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIrotRegister") returned 0x7638dd50 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIrotRevoke") returned 0x7638df10 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIsApartmentInitialized") returned 0x7638de70 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalIsProcessInitialized") returned 0x76381eb0 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalMarshalObjRef") returned 0x7638d270 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalNotifyDDStartOrStop") returned 0x763e48f0 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalOleModalLoopBlockFn") returned 0x763f47d0 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalRegisterWindowPropInterface") returned 0x7638d260 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalReleaseMarshalObjRef") returned 0x76386310 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalSTAInvoke") returned 0x763e4900 [0114.436] GetProcAddress (hModule=0x762b0000, lpProcName="InternalServerExceptionFilter") returned 0x763e4930 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="InternalSetAptCallCtrlOnTlsIfRequired") returned 0x763f4810 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="InternalSetOleThunkWowPtr") returned 0x763e4950 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="InternalStubInvoke") returned 0x763e4970 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="InternalTlsAllocData") returned 0x76394560 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="InternalUnmarshalObjRef") returned 0x762f2bd0 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="IsErrorPropagationEnabled") returned 0x763872e0 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="NdrCStdStubBuffer2_Release") returned 0x762b9150 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="NdrCStdStubBuffer_Release") returned 0x762b9360 [0114.437] GetProcAddress (hModule=0x762b0000, lpProcName="NdrExtStubInitialize") returned 0x762bb3d0 [0114.449] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76600000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0114.450] GetModuleFileNameA (in: hModule=0x76600000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0114.450] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0114.450] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=499432) returned 1 [0114.450] VirtualAlloc (lpAddress=0x0, dwSize=0x79ee8, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0114.450] ReadFile (in: hFile=0x1b4, lpBuffer=0x670000, nNumberOfBytesToRead=0x79ee8, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x79ee8, lpOverlapped=0x0) returned 1 [0114.468] CloseHandle (hObject=0x1b4) returned 1 [0114.468] GetProcAddress (hModule=0x76600000, lpProcName="A_SHAFinal") returned 0x7722b4c0 [0114.469] GetProcAddress (hModule=0x76600000, lpProcName="A_SHAInit") returned 0x7725bc90 [0114.469] GetProcAddress (hModule=0x76600000, lpProcName="A_SHAUpdate") returned 0x7722b5a0 [0114.469] GetProcAddress (hModule=0x76600000, lpProcName="AbortSystemShutdownA") returned 0x76648390 [0114.469] GetProcAddress (hModule=0x76600000, lpProcName="AbortSystemShutdownW") returned 0x76648400 [0114.469] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheck") returned 0x76621230 [0114.469] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckAndAuditAlarmA") returned 0x76633c30 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckAndAuditAlarmW") returned 0x766360b0 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByType") returned 0x76636150 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByTypeAndAuditAlarmA") returned 0x76633d30 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByTypeAndAuditAlarmW") returned 0x766360d0 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByTypeResultList") returned 0x76636130 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByTypeResultListAndAuditAlarmA") returned 0x76633e40 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByTypeResultListAndAuditAlarmByHandleA") returned 0x76633f50 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByTypeResultListAndAuditAlarmByHandleW") returned 0x766360f0 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AccessCheckByTypeResultListAndAuditAlarmW") returned 0x76636110 [0114.470] GetProcAddress (hModule=0x76600000, lpProcName="AddAccessAllowedAce") returned 0x7661fa40 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAccessAllowedAceEx") returned 0x7661fc30 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAccessAllowedObjectAce") returned 0x76636170 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAccessDeniedAce") returned 0x766361b0 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAccessDeniedAceEx") returned 0x76636190 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAccessDeniedObjectAce") returned 0x766361d0 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAce") returned 0x76621ee0 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAuditAccessAce") returned 0x76636210 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAuditAccessAceEx") returned 0x766361f0 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddAuditAccessObjectAce") returned 0x76636230 [0114.471] GetProcAddress (hModule=0x76600000, lpProcName="AddConditionalAce") returned 0x7664b1c0 [0114.472] GetProcAddress (hModule=0x76600000, lpProcName="AddMandatoryAce") returned 0x769e04f0 [0114.472] GetProcAddress (hModule=0x76600000, lpProcName="AddUsersToEncryptedFile") returned 0x76635430 [0114.472] GetProcAddress (hModule=0x76600000, lpProcName="AddUsersToEncryptedFileEx") returned 0x766354a0 [0114.472] GetProcAddress (hModule=0x76600000, lpProcName="AdjustTokenGroups") returned 0x76636250 [0114.472] GetProcAddress (hModule=0x76600000, lpProcName="AdjustTokenPrivileges") returned 0x76620980 [0114.472] GetProcAddress (hModule=0x76600000, lpProcName="AllocateAndInitializeSid") returned 0x7661f660 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AllocateLocallyUniqueId") returned 0x76625180 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AreAllAccessesGranted") returned 0x76636270 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AreAnyAccessesGranted") returned 0x76636290 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AuditComputeEffectivePolicyBySid") returned 0x766362b0 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AuditComputeEffectivePolicyByToken") returned 0x76638260 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AuditEnumerateCategories") returned 0x766362d0 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AuditEnumeratePerUserPolicy") returned 0x766362f0 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AuditEnumerateSubCategories") returned 0x76636310 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AuditFree") returned 0x76624110 [0114.473] GetProcAddress (hModule=0x76600000, lpProcName="AuditLookupCategoryGuidFromCategoryId") returned 0x76638350 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditLookupCategoryIdFromCategoryGuid") returned 0x76638390 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditLookupCategoryNameA") returned 0x76638400 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditLookupCategoryNameW") returned 0x76636330 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditLookupSubCategoryNameA") returned 0x76638470 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditLookupSubCategoryNameW") returned 0x76636350 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditQueryGlobalSaclA") returned 0x766384e0 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditQueryGlobalSaclW") returned 0x76636370 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditQueryPerUserPolicy") returned 0x76636390 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditQuerySecurity") returned 0x766363b0 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditQuerySystemPolicy") returned 0x766240f0 [0114.474] GetProcAddress (hModule=0x76600000, lpProcName="AuditSetGlobalSaclA") returned 0x76638570 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="AuditSetGlobalSaclW") returned 0x766363d0 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="AuditSetPerUserPolicy") returned 0x766363f0 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="AuditSetSecurity") returned 0x76636410 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="AuditSetSystemPolicy") returned 0x76636430 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="BackupEventLogA") returned 0x76632f00 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="BackupEventLogW") returned 0x76632f70 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegCloseKey") returned 0x76648790 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegCreateKey") returned 0x766487c0 [0114.475] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegDeleteKeyEx") returned 0x76648800 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegDeleteValue") returned 0x76648830 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegFlushKey") returned 0x76648860 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegGetVersion") returned 0x76648890 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegLoadKey") returned 0x766488c0 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegOpenKey") returned 0x766488f0 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegRestoreKey") returned 0x76648920 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegSaveKeyEx") returned 0x76648950 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegSetKeySecurity") returned 0x76648980 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegSetValue") returned 0x766489b0 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BaseRegUnLoadKey") returned 0x766489e0 [0114.476] GetProcAddress (hModule=0x76600000, lpProcName="BuildExplicitAccessWithNameA") returned 0x76622c50 [0114.477] GetProcAddress (hModule=0x76600000, lpProcName="BuildExplicitAccessWithNameW") returned 0x76622c50 [0114.477] GetProcAddress (hModule=0x76600000, lpProcName="BuildImpersonateExplicitAccessWithNameA") returned 0x76641e20 [0114.477] GetProcAddress (hModule=0x76600000, lpProcName="BuildImpersonateExplicitAccessWithNameW") returned 0x76641e20 [0114.477] GetProcAddress (hModule=0x76600000, lpProcName="BuildImpersonateTrusteeA") returned 0x76642750 [0114.477] GetProcAddress (hModule=0x76600000, lpProcName="BuildImpersonateTrusteeW") returned 0x76642750 [0114.477] GetProcAddress (hModule=0x76600000, lpProcName="BuildSecurityDescriptorA") returned 0x76641e60 [0114.477] GetProcAddress (hModule=0x76600000, lpProcName="BuildSecurityDescriptorW") returned 0x7661fd30 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithNameA") returned 0x76622c80 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithNameW") returned 0x76622c80 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithObjectsAndNameA") returned 0x76642770 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithObjectsAndNameW") returned 0x76642770 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithObjectsAndSidA") returned 0x766427d0 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithObjectsAndSidW") returned 0x766427d0 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithSidA") returned 0x76620e80 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="BuildTrusteeWithSidW") returned 0x76620e80 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="CancelOverlappedAccess") returned 0x76642d90 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="ChangeServiceConfig2A") returned 0x76636450 [0114.478] GetProcAddress (hModule=0x76600000, lpProcName="ChangeServiceConfig2W") returned 0x76636470 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="ChangeServiceConfigA") returned 0x76636490 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="ChangeServiceConfigW") returned 0x766364b0 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="CheckForHiberboot") returned 0x76623260 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="CheckTokenMembership") returned 0x7661fb50 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="ClearEventLogA") returned 0x76633210 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="ClearEventLogW") returned 0x76633280 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="CloseCodeAuthzLevel") returned 0x7661f390 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="CloseEncryptedFileRaw") returned 0x76635520 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="CloseEventLog") returned 0x766231d0 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="CloseServiceHandle") returned 0x76620960 [0114.479] GetProcAddress (hModule=0x76600000, lpProcName="CloseThreadWaitChainSession") returned 0x7665c670 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="CloseTrace") returned 0x76620f90 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="CommandLineFromMsiDescriptor") returned 0x76620b10 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ComputeAccessTokenFromCodeAuthzLevel") returned 0x76619750 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ControlService") returned 0x76636510 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ControlServiceExA") returned 0x766364d0 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ControlServiceExW") returned 0x766364f0 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ControlTraceA") returned 0x76625830 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ControlTraceW") returned 0x766211a0 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ConvertAccessToSecurityDescriptorA") returned 0x76642e00 [0114.480] GetProcAddress (hModule=0x76600000, lpProcName="ConvertAccessToSecurityDescriptorW") returned 0x76642f20 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSDToStringSDDomainW") returned 0x7664b800 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSDToStringSDRootDomainA") returned 0x7664b860 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSDToStringSDRootDomainW") returned 0x7664b950 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSecurityDescriptorToAccessA") returned 0x76642f90 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSecurityDescriptorToAccessNamedA") returned 0x76642f90 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSecurityDescriptorToAccessNamedW") returned 0x76642fc0 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSecurityDescriptorToAccessW") returned 0x76642fc0 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSecurityDescriptorToStringSecurityDescriptorA") returned 0x7664b9b0 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSecurityDescriptorToStringSecurityDescriptorW") returned 0x7664ba80 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSidToStringSidA") returned 0x7661f160 [0114.481] GetProcAddress (hModule=0x76600000, lpProcName="ConvertSidToStringSidW") returned 0x7661f060 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSDToSDDomainA") returned 0x7664bb10 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSDToSDDomainW") returned 0x7664bbd0 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSDToSDRootDomainA") returned 0x7664bc50 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSDToSDRootDomainW") returned 0x7664bce0 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSecurityDescriptorToSecurityDescriptorA") returned 0x76623ba0 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned 0x7661cbe0 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSidToSidA") returned 0x7664bd40 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertStringSidToSidW") returned 0x7661ddc0 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x76636530 [0114.482] GetProcAddress (hModule=0x76600000, lpProcName="CopySid") returned 0x7661f7b0 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreateCodeAuthzLevel") returned 0x7663c950 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreatePrivateObjectSecurity") returned 0x766229e0 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreatePrivateObjectSecurityEx") returned 0x76636550 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreatePrivateObjectSecurityWithMultipleInheritance") returned 0x76636570 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreateProcessAsUserA") returned 0x76636590 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreateProcessAsUserW") returned 0x76622c10 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreateProcessWithLogonW") returned 0x76638070 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreateProcessWithTokenW") returned 0x76610f90 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreateRestrictedToken") returned 0x76622cf0 [0114.483] GetProcAddress (hModule=0x76600000, lpProcName="CreateServiceA") returned 0x766365b0 [0114.484] GetProcAddress (hModule=0x76600000, lpProcName="CreateServiceW") returned 0x766365d0 [0114.484] GetProcAddress (hModule=0x76600000, lpProcName="CreateTraceInstanceId") returned 0x772b55a0 [0114.484] GetProcAddress (hModule=0x76600000, lpProcName="CreateWellKnownSid") returned 0x76620af0 [0114.484] GetProcAddress (hModule=0x76600000, lpProcName="CredBackupCredentials") returned 0x766365f0 [0114.484] GetProcAddress (hModule=0x76600000, lpProcName="CredDeleteA") returned 0x76636610 [0114.484] GetProcAddress (hModule=0x76600000, lpProcName="CredDeleteW") returned 0x76636630 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredEncryptAndMarshalBinaryBlob") returned 0x76636650 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredEnumerateA") returned 0x76636670 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredEnumerateW") returned 0x76623880 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredFindBestCredentialA") returned 0x76636690 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredFindBestCredentialW") returned 0x766366b0 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredFree") returned 0x76623930 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredGetSessionTypes") returned 0x766366d0 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredGetTargetInfoA") returned 0x766366f0 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredGetTargetInfoW") returned 0x76636710 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredIsMarshaledCredentialA") returned 0x766387e0 [0114.485] GetProcAddress (hModule=0x76600000, lpProcName="CredIsMarshaledCredentialW") returned 0x76636730 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredIsProtectedA") returned 0x76636750 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredIsProtectedW") returned 0x76636770 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredMarshalCredentialA") returned 0x76636790 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredMarshalCredentialW") returned 0x766367b0 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredProfileLoaded") returned 0x766367f0 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredProfileLoadedEx") returned 0x766367d0 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredProfileUnloaded") returned 0x76636800 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredProtectA") returned 0x76636810 [0114.486] GetProcAddress (hModule=0x76600000, lpProcName="CredProtectW") returned 0x76636830 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredReadA") returned 0x76636850 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredReadByTokenHandle") returned 0x76636870 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredReadDomainCredentialsA") returned 0x76636890 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredReadDomainCredentialsW") returned 0x766368b0 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredReadW") returned 0x766368d0 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredRenameA") returned 0x76638820 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredRenameW") returned 0x76638820 [0114.487] GetProcAddress (hModule=0x76600000, lpProcName="CredRestoreCredentials") returned 0x766368f0 [0114.488] GetProcAddress (hModule=0x76600000, lpProcName="CredUnmarshalCredentialA") returned 0x76636910 [0114.488] GetProcAddress (hModule=0x76600000, lpProcName="CredUnmarshalCredentialW") returned 0x76636930 [0114.488] GetProcAddress (hModule=0x76600000, lpProcName="CredUnprotectA") returned 0x76636950 [0114.488] GetProcAddress (hModule=0x76600000, lpProcName="CredUnprotectW") returned 0x76636970 [0114.488] GetProcAddress (hModule=0x76600000, lpProcName="CredWriteA") returned 0x76636990 [0114.488] GetProcAddress (hModule=0x76600000, lpProcName="CredWriteDomainCredentialsA") returned 0x766369b0 [0114.488] GetProcAddress (hModule=0x76600000, lpProcName="CredWriteDomainCredentialsW") returned 0x766369d0 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CredWriteW") returned 0x766238d0 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CredpConvertCredential") returned 0x766369f0 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CredpConvertOneCredentialSize") returned 0x76636a10 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CredpConvertTargetInfo") returned 0x76636a30 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CredpDecodeCredential") returned 0x76636a50 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CredpEncodeCredential") returned 0x76636a70 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CredpEncodeSecret") returned 0x76636a90 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CryptAcquireContextA") returned 0x76620630 [0114.489] GetProcAddress (hModule=0x76600000, lpProcName="CryptAcquireContextW") returned 0x76620590 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptContextAddRef") returned 0x76636ab0 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptCreateHash") returned 0x7661fa00 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptDecrypt") returned 0x76623860 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptDeriveKey") returned 0x76636ad0 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptDestroyHash") returned 0x766202a0 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptDestroyKey") returned 0x76620400 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptDuplicateHash") returned 0x76636af0 [0114.490] GetProcAddress (hModule=0x76600000, lpProcName="CryptDuplicateKey") returned 0x76636b10 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptEncrypt") returned 0x76636b30 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptEnumProviderTypesA") returned 0x76636b50 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptEnumProviderTypesW") returned 0x76636b70 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptEnumProvidersA") returned 0x76636b90 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptEnumProvidersW") returned 0x76636bb0 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptExportKey") returned 0x7661fb30 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptGenKey") returned 0x76623910 [0114.491] GetProcAddress (hModule=0x76600000, lpProcName="CryptGenRandom") returned 0x766210a0 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptGetDefaultProviderA") returned 0x76636bd0 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptGetDefaultProviderW") returned 0x766205d0 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptGetHashParam") returned 0x7661f7d0 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptGetKeyParam") returned 0x76636bf0 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptGetProvParam") returned 0x76636c10 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptGetUserKey") returned 0x76636c30 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptHashData") returned 0x7661fb10 [0114.492] GetProcAddress (hModule=0x76600000, lpProcName="CryptHashSessionKey") returned 0x76636c50 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptImportKey") returned 0x7661faf0 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptReleaseContext") returned 0x76620650 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptSetHashParam") returned 0x766210e0 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptSetKeyParam") returned 0x76636c70 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptSetProvParam") returned 0x76636c90 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptSetProviderA") returned 0x76636cb0 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptSetProviderExA") returned 0x76636cd0 [0114.493] GetProcAddress (hModule=0x76600000, lpProcName="CryptSetProviderExW") returned 0x76636cf0 [0114.494] GetProcAddress (hModule=0x76600000, lpProcName="CryptSetProviderW") returned 0x76636d10 [0114.494] GetProcAddress (hModule=0x76600000, lpProcName="CryptSignHashA") returned 0x76636d30 [0114.494] GetProcAddress (hModule=0x76600000, lpProcName="CryptSignHashW") returned 0x76636d50 [0114.494] GetProcAddress (hModule=0x76600000, lpProcName="CryptVerifySignatureA") returned 0x76636d70 [0114.494] GetProcAddress (hModule=0x76600000, lpProcName="CryptVerifySignatureW") returned 0x766210c0 [0114.494] GetProcAddress (hModule=0x76600000, lpProcName="DecryptFileA") returned 0x76635560 [0114.494] GetProcAddress (hModule=0x76600000, lpProcName="DecryptFileW") returned 0x76635600 [0114.495] GetProcAddress (hModule=0x76600000, lpProcName="DeleteAce") returned 0x76620480 [0114.495] GetProcAddress (hModule=0x76600000, lpProcName="DeleteService") returned 0x76636d90 [0114.495] GetProcAddress (hModule=0x76600000, lpProcName="DeregisterEventSource") returned 0x76618570 [0114.495] GetProcAddress (hModule=0x76600000, lpProcName="DestroyPrivateObjectSecurity") returned 0x76622a60 [0114.495] GetProcAddress (hModule=0x76600000, lpProcName="DuplicateEncryptionInfoFile") returned 0x76635680 [0114.495] GetProcAddress (hModule=0x76600000, lpProcName="DuplicateToken") returned 0x76621140 [0114.495] GetProcAddress (hModule=0x76600000, lpProcName="DuplicateTokenEx") returned 0x76620ad0 [0114.496] GetProcAddress (hModule=0x76600000, lpProcName="ElfBackupEventLogFileA") returned 0x76651690 [0114.496] GetProcAddress (hModule=0x76600000, lpProcName="ElfBackupEventLogFileW") returned 0x76651740 [0114.496] GetProcAddress (hModule=0x76600000, lpProcName="ElfChangeNotify") returned 0x766517f0 [0114.496] GetProcAddress (hModule=0x76600000, lpProcName="ElfClearEventLogFileA") returned 0x766518a0 [0114.496] GetProcAddress (hModule=0x76600000, lpProcName="ElfClearEventLogFileW") returned 0x76651940 [0114.496] GetProcAddress (hModule=0x76600000, lpProcName="ElfCloseEventLog") returned 0x76623200 [0114.497] GetProcAddress (hModule=0x76600000, lpProcName="ElfDeregisterEventSource") returned 0x766185a0 [0114.497] GetProcAddress (hModule=0x76600000, lpProcName="ElfFlushEventLog") returned 0x766519e0 [0114.497] GetProcAddress (hModule=0x76600000, lpProcName="ElfNumberOfRecords") returned 0x76651a50 [0114.529] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76d00000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0114.530] GetModuleFileNameA (in: hModule=0x76d00000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0114.530] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0114.530] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=276336) returned 1 [0114.531] VirtualAlloc (lpAddress=0x0, dwSize=0x43770, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0114.531] ReadFile (in: hFile=0x1b8, lpBuffer=0x670000, nNumberOfBytesToRead=0x43770, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x43770, lpOverlapped=0x0) returned 1 [0114.543] CloseHandle (hObject=0x1b8) returned 1 [0114.543] GetProcAddress (hModule=0x76d00000, lpProcName="AssocCreate") returned 0x76d16f00 [0114.543] GetProcAddress (hModule=0x76d00000, lpProcName="AssocGetPerceivedType") returned 0x76d1a9b0 [0114.543] GetProcAddress (hModule=0x76d00000, lpProcName="AssocIsDangerous") returned 0x76d264f0 [0114.543] GetProcAddress (hModule=0x76d00000, lpProcName="AssocQueryKeyA") returned 0x76d26b90 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="AssocQueryKeyW") returned 0x76d16d70 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="AssocQueryStringA") returned 0x76d26c80 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="AssocQueryStringByKeyA") returned 0x76d26e00 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="AssocQueryStringByKeyW") returned 0x76d16e30 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="AssocQueryStringW") returned 0x76d16ca0 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="ChrCmpIA") returned 0x76d226d0 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="ChrCmpIW") returned 0x76d226f0 [0114.544] GetProcAddress (hModule=0x76d00000, lpProcName="ColorAdjustLuma") returned 0x76d28300 [0114.545] GetProcAddress (hModule=0x76d00000, lpProcName="ColorHLSToRGB") returned 0x76d18d60 [0114.545] GetProcAddress (hModule=0x76d00000, lpProcName="ColorRGBToHLS") returned 0x76d18b00 [0114.545] GetProcAddress (hModule=0x76d00000, lpProcName="ConnectToConnectionPoint") returned 0x76d17bb0 [0114.545] GetProcAddress (hModule=0x76d00000, lpProcName="DelayLoadFailureHook") returned 0x76d28420 [0114.545] GetProcAddress (hModule=0x76d00000, lpProcName="DllGetClassObject") returned 0x76d2c860 [0114.545] GetProcAddress (hModule=0x76d00000, lpProcName="DllGetVersion") returned 0x76d31e30 [0114.546] GetProcAddress (hModule=0x76d00000, lpProcName="GUIDFromStringW") returned 0x7455aaa0 [0114.546] GetProcAddress (hModule=0x76d00000, lpProcName="GetAcceptLanguagesA") returned 0x76d22710 [0114.546] GetProcAddress (hModule=0x76d00000, lpProcName="GetAcceptLanguagesW") returned 0x76d14b40 [0114.548] GetProcAddress (hModule=0x76d00000, lpProcName="GetMenuPosFromID") returned 0x76d17e60 [0114.548] GetProcAddress (hModule=0x76d00000, lpProcName="HashData") returned 0x76d22730 [0114.548] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_Copy") returned 0x76d14ae0 [0114.549] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_Read") returned 0x76d17f90 [0114.549] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_ReadPidl") returned 0x76d18300 [0114.549] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_ReadStr") returned 0x76d18840 [0114.549] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_Reset") returned 0x76d14a80 [0114.549] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_Size") returned 0x76d14aa0 [0114.549] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_Write") returned 0x76d18ed0 [0114.550] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_WritePidl") returned 0x76d2cad0 [0114.550] GetProcAddress (hModule=0x76d00000, lpProcName="IStream_WriteStr") returned 0x76d14b80 [0114.552] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_AtomicRelease") returned 0x76d238b0 [0114.552] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_Exec") returned 0x76d17630 [0114.552] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_GetSite") returned 0x76d14c00 [0114.552] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_GetWindow") returned 0x76d170d0 [0114.552] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_QueryService") returned 0x76d17940 [0114.553] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_QueryStatus") returned 0x76d174f0 [0114.553] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_Set") returned 0x76d18d10 [0114.553] GetProcAddress (hModule=0x76d00000, lpProcName="IUnknown_SetSite") returned 0x76d18f10 [0114.553] GetProcAddress (hModule=0x76d00000, lpProcName="IntlStrEqWorkerA") returned 0x76d23470 [0114.553] GetProcAddress (hModule=0x76d00000, lpProcName="IntlStrEqWorkerW") returned 0x76d23490 [0114.553] GetProcAddress (hModule=0x76d00000, lpProcName="IsCharSpaceA") returned 0x76d227d0 [0114.554] GetProcAddress (hModule=0x76d00000, lpProcName="IsCharSpaceW") returned 0x76d16ff0 [0114.554] GetProcAddress (hModule=0x76d00000, lpProcName="IsInternetESCEnabled") returned 0x76d22810 [0114.554] GetProcAddress (hModule=0x76d00000, lpProcName="IsOS") returned 0x76d18dd0 [0114.555] GetProcAddress (hModule=0x76d00000, lpProcName="MLLoadLibraryA") returned 0x76d2a1a0 [0114.555] GetProcAddress (hModule=0x76d00000, lpProcName="MLLoadLibraryW") returned 0x76d2a1c0 [0114.555] GetProcAddress (hModule=0x76d00000, lpProcName="ParseURLA") returned 0x76d22820 [0114.555] GetProcAddress (hModule=0x76d00000, lpProcName="ParseURLW") returned 0x76d18990 [0114.555] GetProcAddress (hModule=0x76d00000, lpProcName="PathAddBackslashA") returned 0x76d1d080 [0114.555] GetProcAddress (hModule=0x76d00000, lpProcName="PathAddBackslashW") returned 0x76d1d220 [0114.556] GetProcAddress (hModule=0x76d00000, lpProcName="PathAddExtensionA") returned 0x76d22840 [0114.556] GetProcAddress (hModule=0x76d00000, lpProcName="PathAddExtensionW") returned 0x76d22860 [0114.556] GetProcAddress (hModule=0x76d00000, lpProcName="PathAppendA") returned 0x76d22880 [0114.557] GetProcAddress (hModule=0x76d00000, lpProcName="PathAppendW") returned 0x76d18d20 [0114.557] GetProcAddress (hModule=0x76d00000, lpProcName="PathBuildRootA") returned 0x76d238c0 [0114.557] GetProcAddress (hModule=0x76d00000, lpProcName="PathBuildRootW") returned 0x76d238e0 [0114.557] GetProcAddress (hModule=0x76d00000, lpProcName="PathCanonicalizeA") returned 0x76d228a0 [0114.557] GetProcAddress (hModule=0x76d00000, lpProcName="PathCanonicalizeW") returned 0x76d228c0 [0114.557] GetProcAddress (hModule=0x76d00000, lpProcName="PathCombineA") returned 0x76d228e0 [0114.557] GetProcAddress (hModule=0x76d00000, lpProcName="PathCombineW") returned 0x76d1d1e0 [0114.558] GetProcAddress (hModule=0x76d00000, lpProcName="PathCommonPrefixA") returned 0x76d22900 [0114.558] GetProcAddress (hModule=0x76d00000, lpProcName="PathCommonPrefixW") returned 0x76d22920 [0114.558] GetProcAddress (hModule=0x76d00000, lpProcName="PathCompactPathA") returned 0x76d24470 [0114.558] GetProcAddress (hModule=0x76d00000, lpProcName="PathCompactPathExA") returned 0x76d247a0 [0114.558] GetProcAddress (hModule=0x76d00000, lpProcName="PathCompactPathExW") returned 0x76d156f0 [0114.558] GetProcAddress (hModule=0x76d00000, lpProcName="PathCompactPathW") returned 0x76d27440 [0114.559] GetProcAddress (hModule=0x76d00000, lpProcName="PathCreateFromUrlA") returned 0x76d22940 [0114.560] GetProcAddress (hModule=0x76d00000, lpProcName="PathCreateFromUrlAlloc") returned 0x76d22960 [0114.560] GetProcAddress (hModule=0x76d00000, lpProcName="PathCreateFromUrlW") returned 0x76d17ad0 [0114.560] GetProcAddress (hModule=0x76d00000, lpProcName="PathFileExistsA") returned 0x76d22980 [0114.560] GetProcAddress (hModule=0x76d00000, lpProcName="PathFileExistsAndAttributesW") returned 0x76d15f40 [0114.560] GetProcAddress (hModule=0x76d00000, lpProcName="PathFileExistsW") returned 0x76d18670 [0114.560] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindExtensionA") returned 0x76d229a0 [0114.561] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindExtensionW") returned 0x76d17960 [0114.561] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindFileNameA") returned 0x76d18780 [0114.561] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindFileNameW") returned 0x76d17a50 [0114.561] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindNextComponentA") returned 0x76d229c0 [0114.561] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindNextComponentW") returned 0x76d1d030 [0114.562] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindOnPathA") returned 0x76d24ae0 [0114.562] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindOnPathW") returned 0x76d156d0 [0114.562] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindSuffixArrayA") returned 0x76d24d80 [0114.562] GetProcAddress (hModule=0x76d00000, lpProcName="PathFindSuffixArrayW") returned 0x76d27770 [0114.562] GetProcAddress (hModule=0x76d00000, lpProcName="PathGetArgsA") returned 0x76d229e0 [0114.563] GetProcAddress (hModule=0x76d00000, lpProcName="PathGetArgsW") returned 0x76d1d4a0 [0114.563] GetProcAddress (hModule=0x76d00000, lpProcName="PathGetCharTypeA") returned 0x76d22a00 [0114.563] GetProcAddress (hModule=0x76d00000, lpProcName="PathGetCharTypeW") returned 0x76d1c040 [0114.563] GetProcAddress (hModule=0x76d00000, lpProcName="PathGetDriveNumberA") returned 0x76d22a20 [0114.563] GetProcAddress (hModule=0x76d00000, lpProcName="PathGetDriveNumberW") returned 0x76d18110 [0114.564] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsContentTypeA") returned 0x76d24e20 [0114.564] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsContentTypeW") returned 0x76d277e0 [0114.564] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsDirectoryA") returned 0x76d24eb0 [0114.564] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsDirectoryEmptyA") returned 0x76d24f90 [0114.565] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsDirectoryEmptyW") returned 0x76d27870 [0114.565] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsDirectoryW") returned 0x76d18080 [0114.565] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsFileSpecA") returned 0x76d22a40 [0114.565] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsFileSpecW") returned 0x76d18bd0 [0114.565] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsLFNFileSpecA") returned 0x76d22a60 [0114.565] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsLFNFileSpecW") returned 0x76d22a80 [0114.565] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsNetworkPathA") returned 0x76d23900 [0114.566] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsNetworkPathW") returned 0x76d188e0 [0114.566] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsPrefixA") returned 0x76d22aa0 [0114.566] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsPrefixW") returned 0x76d180f0 [0114.566] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsRelativeA") returned 0x76d22ac0 [0114.566] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsRelativeW") returned 0x76d1d060 [0114.567] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsRootA") returned 0x76d22ae0 [0114.567] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsRootW") returned 0x76d1d240 [0114.567] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsSameRootA") returned 0x76d22b00 [0114.567] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsSameRootW") returned 0x76d22b20 [0114.567] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsSystemFolderA") returned 0x76d1afa0 [0114.568] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsSystemFolderW") returned 0x76d27930 [0114.568] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsUNCA") returned 0x76d22b40 [0114.568] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsUNCServerA") returned 0x76d22b60 [0114.568] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsUNCServerShareA") returned 0x76d22b80 [0114.568] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsUNCServerShareW") returned 0x76d22ba0 [0114.568] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsUNCServerW") returned 0x76d22bc0 [0114.568] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsUNCW") returned 0x76d17f50 [0114.569] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsURLA") returned 0x76d22be0 [0114.569] GetProcAddress (hModule=0x76d00000, lpProcName="PathIsURLW") returned 0x76d17a70 [0114.570] GetProcAddress (hModule=0x76d00000, lpProcName="PathMakePrettyA") returned 0x76d250f0 [0114.570] GetProcAddress (hModule=0x76d00000, lpProcName="PathMakePrettyW") returned 0x76d1cca0 [0114.570] GetProcAddress (hModule=0x76d00000, lpProcName="PathMakeSystemFolderA") returned 0x76d25150 [0114.570] GetProcAddress (hModule=0x76d00000, lpProcName="PathMakeSystemFolderW") returned 0x76d27980 [0114.570] GetProcAddress (hModule=0x76d00000, lpProcName="PathMatchSpecA") returned 0x76d22c20 [0114.571] GetProcAddress (hModule=0x76d00000, lpProcName="PathMatchSpecExA") returned 0x76d22c40 [0114.571] GetProcAddress (hModule=0x76d00000, lpProcName="PathMatchSpecExW") returned 0x76d22c60 [0114.571] GetProcAddress (hModule=0x76d00000, lpProcName="PathMatchSpecW") returned 0x76d22c80 [0114.571] GetProcAddress (hModule=0x76d00000, lpProcName="PathParseIconLocationA") returned 0x76d22ca0 [0114.571] GetProcAddress (hModule=0x76d00000, lpProcName="PathParseIconLocationW") returned 0x76d18560 [0114.571] GetProcAddress (hModule=0x76d00000, lpProcName="PathQuoteSpacesA") returned 0x76d22cc0 [0114.571] GetProcAddress (hModule=0x76d00000, lpProcName="PathQuoteSpacesW") returned 0x76d22ce0 [0114.572] GetProcAddress (hModule=0x76d00000, lpProcName="PathRelativePathToA") returned 0x76d22d00 [0114.573] GetProcAddress (hModule=0x76d00000, lpProcName="PathRelativePathToW") returned 0x76d22d20 [0114.573] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveArgsA") returned 0x76d25270 [0114.573] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveArgsW") returned 0x76d17e30 [0114.573] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveBackslashA") returned 0x76d22d40 [0114.573] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveBackslashW") returned 0x76d17f70 [0114.573] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveBlanksA") returned 0x76d22d60 [0114.574] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveBlanksW") returned 0x76d18f70 [0114.574] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveExtensionA") returned 0x76d22d70 [0114.574] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveExtensionW") returned 0x76d1d260 [0114.574] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveFileSpecA") returned 0x76d22d80 [0114.574] GetProcAddress (hModule=0x76d00000, lpProcName="PathRemoveFileSpecW") returned 0x76d18240 [0114.574] GetProcAddress (hModule=0x76d00000, lpProcName="PathRenameExtensionA") returned 0x76d22da0 [0114.575] GetProcAddress (hModule=0x76d00000, lpProcName="PathRenameExtensionW") returned 0x76d22dc0 [0114.575] GetProcAddress (hModule=0x76d00000, lpProcName="PathSearchAndQualifyA") returned 0x76d22de0 [0114.575] GetProcAddress (hModule=0x76d00000, lpProcName="PathSearchAndQualifyW") returned 0x76d22e00 [0114.575] GetProcAddress (hModule=0x76d00000, lpProcName="PathSetDlgItemPathA") returned 0x76d252a0 [0114.576] GetProcAddress (hModule=0x76d00000, lpProcName="PathSetDlgItemPathW") returned 0x76d27aa0 [0114.576] GetProcAddress (hModule=0x76d00000, lpProcName="PathSkipRootA") returned 0x76d22e20 [0114.576] GetProcAddress (hModule=0x76d00000, lpProcName="PathSkipRootW") returned 0x76d1d010 [0114.576] GetProcAddress (hModule=0x76d00000, lpProcName="PathStripPathA") returned 0x76d22e40 [0114.576] GetProcAddress (hModule=0x76d00000, lpProcName="PathStripPathW") returned 0x76d1d050 [0114.576] GetProcAddress (hModule=0x76d00000, lpProcName="PathStripToRootA") returned 0x76d22e50 [0114.576] GetProcAddress (hModule=0x76d00000, lpProcName="PathStripToRootW") returned 0x76d1d200 [0114.577] GetProcAddress (hModule=0x76d00000, lpProcName="PathUnExpandEnvStringsA") returned 0x76d22e70 [0114.577] GetProcAddress (hModule=0x76d00000, lpProcName="PathUnExpandEnvStringsW") returned 0x76d22e90 [0114.577] GetProcAddress (hModule=0x76d00000, lpProcName="PathUndecorateA") returned 0x76d253d0 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="PathUndecorateW") returned 0x76d1cdb0 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="PathUnmakeSystemFolderA") returned 0x76d25480 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="PathUnmakeSystemFolderW") returned 0x76d27bd0 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="PathUnquoteSpacesA") returned 0x76d22eb0 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="PathUnquoteSpacesW") returned 0x76d18f80 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="QISearch") returned 0x76d16420 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="SHAllocShared") returned 0x76d2cdc0 [0114.579] GetProcAddress (hModule=0x76d00000, lpProcName="SHAnsiToAnsi") returned 0x76d23920 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHAnsiToUnicode") returned 0x76d18ae0 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHAutoComplete") returned 0x76d1c060 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHCopyKeyA") returned 0x76d23940 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHCopyKeyW") returned 0x76d1d0a0 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateMemStream") returned 0x76d18cf0 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateShellPalette") returned 0x76d18690 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateStreamOnFileA") returned 0x76d23960 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateStreamOnFileEx") returned 0x76d14b60 [0114.580] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateStreamOnFileW") returned 0x76d18e10 [0114.582] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateStreamWrapper") returned 0x0 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateThread") returned 0x76d18e30 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateThreadRef") returned 0x76d18aa0 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateThreadWithHandle") returned 0x76d1d480 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHCreateWorkerWindowW") returned 0x76d18bb0 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteEmptyKeyA") returned 0x76d23980 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteEmptyKeyW") returned 0x76d239a0 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteKeyA") returned 0x76d239c0 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteKeyW") returned 0x76d1d270 [0114.650] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteOrphanKeyA") returned 0x0 [0114.653] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteOrphanKeyW") returned 0x0 [0114.657] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteValueA") returned 0x76d239e0 [0114.657] GetProcAddress (hModule=0x76d00000, lpProcName="SHDeleteValueW") returned 0x76d14bc0 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHEnumKeyExA") returned 0x76d23a00 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHEnumKeyExW") returned 0x76d23a20 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHEnumValueA") returned 0x76d23a40 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHEnumValueW") returned 0x76d23a60 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHFormatDateTimeA") returned 0x76d27c90 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHFormatDateTimeW") returned 0x76d27d00 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHFreeShared") returned 0x76d2cde0 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHGetInverseCMAP") returned 0x76d28a30 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHGetThreadRef") returned 0x76d23a80 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHGetValueA") returned 0x76d23aa0 [0114.658] GetProcAddress (hModule=0x76d00000, lpProcName="SHGetValueW") returned 0x76d18480 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHGetViewStatePropertyBag") returned 0x76d191d0 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHIsChildOrSelf") returned 0x76d16c20 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHIsLowMemoryMachine") returned 0x76d1f860 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHLoadIndirectString") returned 0x76d182e0 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHLockShared") returned 0x76d2ce40 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHMessageBoxCheckA") returned 0x76d2a930 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHMessageBoxCheckW") returned 0x76d2ac90 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHOpenRegStream2A") returned 0x76d23ac0 [0114.659] GetProcAddress (hModule=0x76d00000, lpProcName="SHOpenRegStream2W") returned 0x76d14ba0 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHOpenRegStreamA") returned 0x76d23ae0 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHOpenRegStreamW") returned 0x76d23b00 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHPackDispParamsV") returned 0x76d17fd0 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHPinDllOfCLSID") returned 0x76d15100 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHPropertyBag_ReadStrAlloc") returned 0x76d2dcb0 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHPropertyBag_WriteBSTR") returned 0x76d2dd70 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHQueryInfoKeyA") returned 0x76d23b20 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHQueryInfoKeyW") returned 0x76d23b40 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHQueryValueExA") returned 0x76d23b60 [0114.660] GetProcAddress (hModule=0x76d00000, lpProcName="SHQueryValueExW") returned 0x76d1d800 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegCloseUSKey") returned 0x76d22ef0 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegCreateUSKeyA") returned 0x76d22f10 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegCreateUSKeyW") returned 0x76d22f30 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegDeleteEmptyUSKeyA") returned 0x76d22f50 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegDeleteEmptyUSKeyW") returned 0x76d22f70 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegDeleteUSValueA") returned 0x76d22f90 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegDeleteUSValueW") returned 0x76d22fb0 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegDuplicateHKey") returned 0x76d23b80 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegEnumUSKeyA") returned 0x76d22fd0 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegEnumUSKeyW") returned 0x76d22ff0 [0114.661] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegEnumUSValueA") returned 0x76d23010 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegEnumUSValueW") returned 0x76d23030 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetBoolUSValueA") returned 0x76d23050 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetBoolUSValueW") returned 0x76d18ef0 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetBoolValueFromHKCUHKLM") returned 0x76d1ed90 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetIntW") returned 0x76d23ba0 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetPathA") returned 0x76d23bc0 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetPathW") returned 0x76d23be0 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetUSValueA") returned 0x76d23070 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetUSValueW") returned 0x76d1d460 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetValueA") returned 0x76d23c00 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetValueFromHKCUHKLM") returned 0x76d1e8c0 [0114.662] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegGetValueW") returned 0x76d179a0 [0114.663] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegOpenUSKeyA") returned 0x76d23090 [0114.663] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegOpenUSKeyW") returned 0x76d230b0 [0114.663] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegQueryInfoUSKeyA") returned 0x76d230d0 [0114.663] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegQueryInfoUSKeyW") returned 0x76d230f0 [0114.663] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegQueryUSValueA") returned 0x76d23110 [0114.663] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegQueryUSValueW") returned 0x76d23130 [0114.663] GetProcAddress (hModule=0x76d00000, lpProcName="SHRegSetPathA") returned 0x76d23c20 [0114.666] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x74ab0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0114.666] GetModuleFileNameA (in: hModule=0x74ab0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0114.666] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0114.667] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=1371792) returned 1 [0114.667] VirtualAlloc (lpAddress=0x0, dwSize=0x14ee90, flAllocationType=0x1000, flProtect=0x4) returned 0xc60000 [0114.667] ReadFile (in: hFile=0x1b8, lpBuffer=0xc60000, nNumberOfBytesToRead=0x14ee90, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0xc60000*, lpNumberOfBytesRead=0x19bd68*=0x14ee90, lpOverlapped=0x0) returned 1 [0114.729] CloseHandle (hObject=0x1b8) returned 1 [0114.730] GetProcAddress (hModule=0x74ab0000, lpProcName="AbortDoc") returned 0x74b96080 [0114.730] GetProcAddress (hModule=0x74ab0000, lpProcName="AbortPath") returned 0x74b977a0 [0114.731] GetProcAddress (hModule=0x74ab0000, lpProcName="AddFontMemResourceEx") returned 0x74b8ad30 [0114.731] GetProcAddress (hModule=0x74ab0000, lpProcName="AddFontResourceA") returned 0x74b8ad80 [0114.731] GetProcAddress (hModule=0x74ab0000, lpProcName="AddFontResourceExA") returned 0x74b8ada0 [0114.732] GetProcAddress (hModule=0x74ab0000, lpProcName="AddFontResourceExW") returned 0x74b8aed0 [0114.732] GetProcAddress (hModule=0x74ab0000, lpProcName="AddFontResourceTracking") returned 0x74b8af10 [0114.732] GetProcAddress (hModule=0x74ab0000, lpProcName="AddFontResourceW") returned 0x74b8b070 [0114.732] GetProcAddress (hModule=0x74ab0000, lpProcName="AngleArc") returned 0x74b961e0 [0114.732] GetProcAddress (hModule=0x74ab0000, lpProcName="AnimatePalette") returned 0x74b976d0 [0114.732] GetProcAddress (hModule=0x74ab0000, lpProcName="AnyLinkedFonts") returned 0x74b8b0f0 [0114.732] GetProcAddress (hModule=0x74ab0000, lpProcName="Arc") returned 0x74b962b0 [0114.733] GetProcAddress (hModule=0x74ab0000, lpProcName="ArcTo") returned 0x74b963b0 [0114.733] GetProcAddress (hModule=0x74ab0000, lpProcName="BRUSHOBJ_hGetColorTransform") returned 0x74b681c0 [0114.733] GetProcAddress (hModule=0x74ab0000, lpProcName="BRUSHOBJ_pvAllocRbrush") returned 0x74b681d0 [0114.733] GetProcAddress (hModule=0x74ab0000, lpProcName="BRUSHOBJ_pvGetRbrush") returned 0x74b681e0 [0114.733] GetProcAddress (hModule=0x74ab0000, lpProcName="BRUSHOBJ_ulGetBrushColor") returned 0x74b681f0 [0114.733] GetProcAddress (hModule=0x74ab0000, lpProcName="BeginGdiRendering") returned 0x74b68200 [0114.733] GetProcAddress (hModule=0x74ab0000, lpProcName="BeginPath") returned 0x74b62c90 [0114.734] GetProcAddress (hModule=0x74ab0000, lpProcName="BitBlt") returned 0x73e809b0 [0114.734] GetProcAddress (hModule=0x74ab0000, lpProcName="CLIPOBJ_bEnum") returned 0x74b68210 [0114.734] GetProcAddress (hModule=0x74ab0000, lpProcName="CLIPOBJ_cEnumStart") returned 0x74b68220 [0114.735] GetProcAddress (hModule=0x74ab0000, lpProcName="CLIPOBJ_ppoGetPath") returned 0x74b68230 [0114.735] GetProcAddress (hModule=0x74ab0000, lpProcName="CancelDC") returned 0x74b87ae0 [0114.735] GetProcAddress (hModule=0x74ab0000, lpProcName="CheckColorsInGamut") returned 0x74b8d470 [0114.735] GetProcAddress (hModule=0x74ab0000, lpProcName="ChoosePixelFormat") returned 0x74b97ae0 [0114.736] GetProcAddress (hModule=0x74ab0000, lpProcName="Chord") returned 0x74b96490 [0114.736] GetProcAddress (hModule=0x74ab0000, lpProcName="ClearBitmapAttributes") returned 0x74b87750 [0114.736] GetProcAddress (hModule=0x74ab0000, lpProcName="ClearBrushAttributes") returned 0x74b87770 [0114.736] GetProcAddress (hModule=0x74ab0000, lpProcName="CloseEnhMetaFile") returned 0x74b569f0 [0114.738] GetProcAddress (hModule=0x74ab0000, lpProcName="CloseFigure") returned 0x74b647d0 [0114.738] GetProcAddress (hModule=0x74ab0000, lpProcName="CloseMetaFile") returned 0x74b5a350 [0114.738] GetProcAddress (hModule=0x74ab0000, lpProcName="ColorCorrectPalette") returned 0x74b8d620 [0114.738] GetProcAddress (hModule=0x74ab0000, lpProcName="ColorMatchToTarget") returned 0x74b8d850 [0114.738] GetProcAddress (hModule=0x74ab0000, lpProcName="CombineRgn") returned 0x74b5b640 [0114.739] GetProcAddress (hModule=0x74ab0000, lpProcName="CombineTransform") returned 0x74b87820 [0114.739] GetProcAddress (hModule=0x74ab0000, lpProcName="ConfigureOPMProtectedOutput") returned 0x74b682a0 [0114.739] GetProcAddress (hModule=0x74ab0000, lpProcName="CopyEnhMetaFileA") returned 0x74b9e260 [0114.740] GetProcAddress (hModule=0x74ab0000, lpProcName="CopyEnhMetaFileW") returned 0x74b9e310 [0114.740] GetProcAddress (hModule=0x74ab0000, lpProcName="CopyMetaFileA") returned 0x74b94830 [0114.741] GetProcAddress (hModule=0x74ab0000, lpProcName="CopyMetaFileW") returned 0x74b948e0 [0114.741] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateBitmap") returned 0x73e81790 [0114.741] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateBitmapFromDxSurface") returned 0x74b682c0 [0114.741] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateBitmapFromDxSurface2") returned 0x74b682d0 [0114.741] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateBitmapIndirect") returned 0x73ea3610 [0114.741] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateBrushIndirect") returned 0x74b54d30 [0114.742] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateColorSpaceA") returned 0x74b8da90 [0114.742] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateColorSpaceW") returned 0x74b8dd30 [0114.742] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateCompatibleBitmap") returned 0x73e80830 [0114.742] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateCompatibleDC") returned 0x73e80970 [0114.742] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateDCA") returned 0x73e81e00 [0114.742] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateDCW") returned 0x73e817f0 [0114.743] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateDIBPatternBrush") returned 0x74b65610 [0114.743] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateDIBPatternBrushPt") returned 0x74b95ad0 [0114.743] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateDIBSection") returned 0x73e80ac0 [0114.747] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateDIBitmap") returned 0x73e81ba0 [0114.747] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateDiscardableBitmap") returned 0x73ea36a0 [0114.747] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateEllipticRgn") returned 0x74b95b10 [0114.747] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateEllipticRgnIndirect") returned 0x74b95b20 [0114.747] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateEnhMetaFileA") returned 0x74b58dd0 [0114.748] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateEnhMetaFileW") returned 0x74b56d10 [0114.748] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateFontA") returned 0x74b64d20 [0114.748] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateFontIndirectA") returned 0x74b4e9b0 [0114.748] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateFontIndirectExA") returned 0x74b95b50 [0114.748] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateFontIndirectExW") returned 0x74b66550 [0114.748] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateFontIndirectW") returned 0x74b664d0 [0114.749] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateFontW") returned 0x74b61310 [0114.749] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateHalftonePalette") returned 0x74b67990 [0114.749] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateHatchBrush") returned 0x74b95bd0 [0114.749] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateICA") returned 0x74b667c0 [0114.749] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateICW") returned 0x74b62ae0 [0114.750] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateMetaFileA") returned 0x74b94a30 [0114.751] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateMetaFileW") returned 0x74b5a540 [0114.751] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateOPMProtectedOutputs") returned 0x74b68320 [0114.751] GetProcAddress (hModule=0x74ab0000, lpProcName="CreatePalette") returned 0x73e81e70 [0114.751] GetProcAddress (hModule=0x74ab0000, lpProcName="CreatePatternBrush") returned 0x74b66700 [0114.751] GetProcAddress (hModule=0x74ab0000, lpProcName="CreatePen") returned 0x74b61220 [0114.752] GetProcAddress (hModule=0x74ab0000, lpProcName="CreatePenIndirect") returned 0x74b61200 [0114.752] GetProcAddress (hModule=0x74ab0000, lpProcName="CreatePolyPolygonRgn") returned 0x74b97d60 [0114.752] GetProcAddress (hModule=0x74ab0000, lpProcName="CreatePolygonRgn") returned 0x74b65230 [0114.752] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateRectRgn") returned 0x74b657d0 [0114.752] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateRectRgnIndirect") returned 0x74b60ab0 [0114.752] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateRoundRectRgn") returned 0x74b63ec0 [0114.752] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateScalableFontResourceA") returned 0x74b8b100 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateScalableFontResourceW") returned 0x74b8b6b0 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateSessionMappedDIBSection") returned 0x74b87790 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="CreateSolidBrush") returned 0x74b32f50 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTAbandonSwapChain") returned 0x74b684a0 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTAcquireKeyedMutex") returned 0x74b684b0 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTAcquireKeyedMutex2") returned 0x74b684c0 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTAcquireSwapChain") returned 0x74b684d0 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTAdjustFullscreenGamma") returned 0x74b684e0 [0114.753] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCacheHybridQueryValue") returned 0x74b684f0 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTChangeVideoMemoryReservation") returned 0x74b68500 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCheckExclusiveOwnership") returned 0x74b68510 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCheckMonitorPowerState") returned 0x74b68520 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCheckMultiPlaneOverlaySupport") returned 0x74b68530 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCheckMultiPlaneOverlaySupport2") returned 0x74b68540 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCheckOcclusion") returned 0x74b68550 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCheckSharedResourceAccess") returned 0x74b68560 [0114.754] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCheckVidPnExclusiveOwnership") returned 0x74b68570 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCloseAdapter") returned 0x74b68580 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTConfigureSharedResource") returned 0x74b68590 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateAllocation") returned 0x74b33170 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateAllocation2") returned 0x74b685a0 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateContext") returned 0x74b685b0 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateContextVirtual") returned 0x74b685c0 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateDCFromMemory") returned 0x74b685d0 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateDevice") returned 0x74b685e0 [0114.755] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateKeyedMutex") returned 0x74b685f0 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateKeyedMutex2") returned 0x74b68600 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateOutputDupl") returned 0x74b68610 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateOverlay") returned 0x74b68620 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreatePagingQueue") returned 0x74b68630 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateSwapChain") returned 0x74b68640 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateSynchronizationObject") returned 0x74b333e0 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTCreateSynchronizationObject2") returned 0x74b68650 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyAllocation") returned 0x74b68660 [0114.756] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyAllocation2") returned 0x74b68670 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyContext") returned 0x74b68680 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyDCFromMemory") returned 0x74b68690 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyDevice") returned 0x74b686a0 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyKeyedMutex") returned 0x74b686b0 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyOutputDupl") returned 0x74b686c0 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyOverlay") returned 0x74b686d0 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroyPagingQueue") returned 0x74b686e0 [0114.757] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTDestroySynchronizationObject") returned 0x74b686f0 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTEnumAdapters") returned 0x74b68700 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTEnumAdapters2") returned 0x74b68710 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTEscape") returned 0x74b68720 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTEvict") returned 0x74b68730 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTFlipOverlay") returned 0x74b68740 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTFlushHeapTransitions") returned 0x74b68750 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTFreeGpuVirtualAddress") returned 0x74b68760 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetCachedHybridQueryValue") returned 0x74b68770 [0114.758] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetContextInProcessSchedulingPriority") returned 0x74b68780 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetContextSchedulingPriority") returned 0x74b68790 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetDWMVerticalBlankEvent") returned 0x74b687a0 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetDeviceState") returned 0x74b687b0 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetDisplayModeList") returned 0x74b687c0 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetMultisampleMethodList") returned 0x74b687d0 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetOverlayState") returned 0x74b687e0 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetPresentHistory") returned 0x74b687f0 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetPresentQueueEvent") returned 0x74b68800 [0114.759] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetProcessSchedulingPriorityClass") returned 0x74b68810 [0114.760] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetResourcePresentPrivateDriverData") returned 0x74b68820 [0114.760] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetRuntimeData") returned 0x74b68830 [0114.760] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetScanLine") returned 0x74b68840 [0114.760] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetSetSwapChainMetadata") returned 0x74b68850 [0114.760] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetSharedPrimaryHandle") returned 0x74b68860 [0114.760] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTGetSharedResourceAdapterLuid") returned 0x74b68870 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTInvalidateActiveVidPn") returned 0x74b68880 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTInvalidateCache") returned 0x74b68890 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTLock") returned 0x74b688a0 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTLock2") returned 0x74b688b0 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTMakeResident") returned 0x74b688c0 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTMapGpuVirtualAddress") returned 0x74b688d0 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTMarkDeviceAsError") returned 0x74b688e0 [0114.761] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispGetNextChunkInfo") returned 0x74b688f0 [0114.762] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispQueryMiracastDisplayDeviceStatus") returned 0x74b68900 [0114.762] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispQueryMiracastDisplayDeviceSupport") returned 0x74b68910 [0114.762] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispStartMiracastDisplayDevice") returned 0x74b88c00 [0114.762] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispStartMiracastDisplayDevice2") returned 0x74b88b50 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispStartMiracastDisplayDeviceEx") returned 0x74b68920 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispStopMiracastDisplayDevice") returned 0x74b68930 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTNetDispStopSessions") returned 0x74b68940 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOfferAllocations") returned 0x74b68950 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenAdapterFromDeviceName") returned 0x74b68960 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenAdapterFromGdiDisplayName") returned 0x74b88c20 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenAdapterFromHdc") returned 0x74b68970 [0114.763] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenAdapterFromLuid") returned 0x74b68980 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenKeyedMutex") returned 0x74b68990 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenKeyedMutex2") returned 0x74b689a0 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenNtHandleFromName") returned 0x74b689b0 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenResource") returned 0x74b88c90 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenResource2") returned 0x74b689c0 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenResourceFromNtHandle") returned 0x74b689d0 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenSwapChain") returned 0x74b689e0 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenSyncObjectFromNtHandle") returned 0x74b689f0 [0114.764] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenSyncObjectFromNtHandle2") returned 0x74b68a00 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenSyncObjectNtHandleFromName") returned 0x74b68a10 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOpenSynchronizationObject") returned 0x74b68a20 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOutputDuplGetFrameInfo") returned 0x74b68a30 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOutputDuplGetMetaData") returned 0x74b68a40 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOutputDuplGetPointerShapeData") returned 0x74b68a50 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOutputDuplPresent") returned 0x74b68a60 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTOutputDuplReleaseFrame") returned 0x74b68a70 [0114.765] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTPinDirectFlipResources") returned 0x74b68a80 [0114.766] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTPollDisplayChildren") returned 0x74b68a90 [0114.766] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTPresent") returned 0x74b68aa0 [0114.766] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTPresentMultiPlaneOverlay") returned 0x74b68ab0 [0114.767] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTPresentMultiPlaneOverlay2") returned 0x74b68ac0 [0114.767] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryAdapterInfo") returned 0x74b68ad0 [0114.767] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryAllocationResidency") returned 0x74b68ae0 [0114.767] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryClockCalibration") returned 0x74b68af0 [0114.767] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryRemoteVidPnSourceFromGdiDisplayName") returned 0x74b68b00 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryResourceInfo") returned 0x74b68b10 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryResourceInfoFromNtHandle") returned 0x74b68b20 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryStatistics") returned 0x74b68b30 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryVidPnExclusiveOwnership") returned 0x74b68b40 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTQueryVideoMemoryInfo") returned 0x74b68b50 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTReclaimAllocations") returned 0x74b68b60 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTReclaimAllocations2") returned 0x74b68b70 [0114.768] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTRegisterTrimNotification") returned 0x74b334f0 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTReleaseKeyedMutex") returned 0x74b68b80 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTReleaseKeyedMutex2") returned 0x74b68b90 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTReleaseProcessVidPnSourceOwners") returned 0x74b68ba0 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTReleaseSwapChain") returned 0x74b68bb0 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTRender") returned 0x74b68bc0 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTReserveGpuVirtualAddress") returned 0x74b68bd0 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetAllocationPriority") returned 0x74b68be0 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetContextInProcessSchedulingPriority") returned 0x74b68bf0 [0114.769] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetContextSchedulingPriority") returned 0x74b68c00 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetDisplayMode") returned 0x74b68c10 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetDisplayPrivateDriverFormat") returned 0x74b68c20 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetDodIndirectSwapchain") returned 0x74b68c30 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetGammaRamp") returned 0x74b68c40 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetHwProtectionTeardownRecovery") returned 0x74b68c50 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetProcessSchedulingPriorityClass") returned 0x74b68c60 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetQueuedLimit") returned 0x74b68c70 [0114.770] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetStablePowerState") returned 0x74b68c80 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetStereoEnabled") returned 0x74b68c90 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetSyncRefreshCountWaitTarget") returned 0x74b68ca0 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetVidPnSourceHwProtection") returned 0x74b68cb0 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetVidPnSourceOwner") returned 0x74b68cc0 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSetVidPnSourceOwner1") returned 0x74b68cd0 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTShareObjects") returned 0x74b68ce0 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSharedPrimaryLockNotification") returned 0x74b68cf0 [0114.771] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSharedPrimaryUnLockNotification") returned 0x74b68d00 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSignalSynchronizationObject") returned 0x74b88d40 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSignalSynchronizationObject2") returned 0x74b68d10 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSignalSynchronizationObjectFromCpu") returned 0x74b68d20 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSignalSynchronizationObjectFromGpu") returned 0x74b68d30 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSignalSynchronizationObjectFromGpu2") returned 0x74b68d40 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTSubmitCommand") returned 0x74b68d50 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTUnlock") returned 0x74b68d60 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTUnlock2") returned 0x74b68d70 [0114.772] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTUnpinDirectFlipResources") returned 0x74b68d80 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTUnregisterTrimNotification") returned 0x74b66720 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTUpdateGpuVirtualAddress") returned 0x74b68d90 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTUpdateOverlay") returned 0x74b68da0 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTWaitForIdle") returned 0x74b68db0 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTWaitForSynchronizationObject") returned 0x74b88df0 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTWaitForSynchronizationObject2") returned 0x74b68dc0 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTWaitForSynchronizationObjectFromCpu") returned 0x74b68dd0 [0114.773] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTWaitForSynchronizationObjectFromGpu") returned 0x74b68de0 [0114.774] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTWaitForVerticalBlankEvent") returned 0x74b68df0 [0114.774] GetProcAddress (hModule=0x74ab0000, lpProcName="D3DKMTWaitForVerticalBlankEvent2") returned 0x74b68e00 [0114.774] GetProcAddress (hModule=0x74ab0000, lpProcName="DDCCIGetCapabilitiesString") returned 0x74b683a0 [0114.792] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x743d0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0114.793] GetModuleFileNameA (in: hModule=0x743d0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0114.793] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0114.793] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=1337240) returned 1 [0114.794] VirtualAlloc (lpAddress=0x0, dwSize=0x146798, flAllocationType=0x1000, flProtect=0x4) returned 0xc60000 [0114.794] ReadFile (in: hFile=0x1b8, lpBuffer=0xc60000, nNumberOfBytesToRead=0x146798, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0xc60000*, lpNumberOfBytesRead=0x19bd68*=0x146798, lpOverlapped=0x0) returned 1 [0114.849] CloseHandle (hObject=0x1b8) returned 1 [0114.849] GetProcAddress (hModule=0x743d0000, lpProcName="ActivateKeyboardLayout") returned 0x74409ac0 [0114.849] GetProcAddress (hModule=0x743d0000, lpProcName="AddClipboardFormatListener") returned 0x7440bd20 [0114.849] GetProcAddress (hModule=0x743d0000, lpProcName="AdjustWindowRect") returned 0x743ff1f0 [0114.850] GetProcAddress (hModule=0x743d0000, lpProcName="AdjustWindowRectEx") returned 0x743ff230 [0114.850] GetProcAddress (hModule=0x743d0000, lpProcName="AlignRects") returned 0x7445af90 [0114.850] GetProcAddress (hModule=0x743d0000, lpProcName="AllowForegroundActivation") returned 0x7442b890 [0114.850] GetProcAddress (hModule=0x743d0000, lpProcName="AllowSetForegroundWindow") returned 0x74404b10 [0114.850] GetProcAddress (hModule=0x743d0000, lpProcName="AnimateWindow") returned 0x743f8ef0 [0114.851] GetProcAddress (hModule=0x743d0000, lpProcName="AnyPopup") returned 0x744577d0 [0114.851] GetProcAddress (hModule=0x743d0000, lpProcName="AppendMenuA") returned 0x74458fb0 [0114.851] GetProcAddress (hModule=0x743d0000, lpProcName="AppendMenuW") returned 0x7442ecd0 [0114.851] GetProcAddress (hModule=0x743d0000, lpProcName="ArrangeIconicWindows") returned 0x7442b8a0 [0114.852] GetProcAddress (hModule=0x743d0000, lpProcName="AttachThreadInput") returned 0x744097a0 [0114.852] GetProcAddress (hModule=0x743d0000, lpProcName="BeginDeferWindowPos") returned 0x74402860 [0114.852] GetProcAddress (hModule=0x743d0000, lpProcName="BeginPaint") returned 0x74408a60 [0114.852] GetProcAddress (hModule=0x743d0000, lpProcName="BlockInput") returned 0x7440bd60 [0114.852] GetProcAddress (hModule=0x743d0000, lpProcName="BringWindowToTop") returned 0x74403b20 [0114.853] GetProcAddress (hModule=0x743d0000, lpProcName="BroadcastSystemMessage") returned 0x74459000 [0114.853] GetProcAddress (hModule=0x743d0000, lpProcName="BroadcastSystemMessageA") returned 0x74459000 [0114.853] GetProcAddress (hModule=0x743d0000, lpProcName="BroadcastSystemMessageExA") returned 0x74459030 [0114.853] GetProcAddress (hModule=0x743d0000, lpProcName="BroadcastSystemMessageExW") returned 0x7442ed20 [0114.853] GetProcAddress (hModule=0x743d0000, lpProcName="BroadcastSystemMessageW") returned 0x7442ed50 [0114.853] GetProcAddress (hModule=0x743d0000, lpProcName="BuildReasonArray") returned 0x74453ac0 [0114.854] GetProcAddress (hModule=0x743d0000, lpProcName="CalcMenuBar") returned 0x74409250 [0114.854] GetProcAddress (hModule=0x743d0000, lpProcName="CalculatePopupWindowPosition") returned 0x7440bd90 [0114.854] GetProcAddress (hModule=0x743d0000, lpProcName="CallMsgFilter") returned 0x74459540 [0114.854] GetProcAddress (hModule=0x743d0000, lpProcName="CallMsgFilterA") returned 0x74459540 [0114.854] GetProcAddress (hModule=0x743d0000, lpProcName="CallMsgFilterW") returned 0x743f9d50 [0114.854] GetProcAddress (hModule=0x743d0000, lpProcName="CallNextHookEx") returned 0x743e3550 [0114.855] GetProcAddress (hModule=0x743d0000, lpProcName="CallWindowProcA") returned 0x743fdc60 [0114.855] GetProcAddress (hModule=0x743d0000, lpProcName="CallWindowProcW") returned 0x73e80790 [0114.855] GetProcAddress (hModule=0x743d0000, lpProcName="CancelShutdown") returned 0x74438f70 [0114.855] GetProcAddress (hModule=0x743d0000, lpProcName="CascadeChildWindows") returned 0x7442b8c0 [0114.855] GetProcAddress (hModule=0x743d0000, lpProcName="CascadeWindows") returned 0x7444cb70 [0114.856] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeClipboardChain") returned 0x74409a70 [0114.856] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeDisplaySettingsA") returned 0x73ea3270 [0114.856] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeDisplaySettingsExA") returned 0x73ea3350 [0114.856] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeDisplaySettingsExW") returned 0x73ea3440 [0114.856] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeDisplaySettingsW") returned 0x73ea3530 [0114.856] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeMenuA") returned 0x7444da10 [0114.857] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeMenuW") returned 0x7444dac0 [0114.857] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeWindowMessageFilter") returned 0x743efff0 [0114.857] GetProcAddress (hModule=0x743d0000, lpProcName="ChangeWindowMessageFilterEx") returned 0x7440bdd0 [0114.857] GetProcAddress (hModule=0x743d0000, lpProcName="CharLowerA") returned 0x744048e0 [0114.857] GetProcAddress (hModule=0x743d0000, lpProcName="CharLowerBuffA") returned 0x7445ab00 [0114.857] GetProcAddress (hModule=0x743d0000, lpProcName="CharLowerBuffW") returned 0x74404dd0 [0114.858] GetProcAddress (hModule=0x743d0000, lpProcName="CharLowerW") returned 0x7445ab20 [0114.858] GetProcAddress (hModule=0x743d0000, lpProcName="CharNextA") returned 0x743fe240 [0114.858] GetProcAddress (hModule=0x743d0000, lpProcName="CharNextExA") returned 0x7445ab40 [0114.858] GetProcAddress (hModule=0x743d0000, lpProcName="CharNextW") returned 0x744071c0 [0114.859] GetProcAddress (hModule=0x743d0000, lpProcName="CharPrevA") returned 0x744045e0 [0114.859] GetProcAddress (hModule=0x743d0000, lpProcName="CharPrevExA") returned 0x7445ab60 [0114.859] GetProcAddress (hModule=0x743d0000, lpProcName="CharPrevW") returned 0x7445ab80 [0114.859] GetProcAddress (hModule=0x743d0000, lpProcName="CharToOemA") returned 0x74452cf0 [0114.859] GetProcAddress (hModule=0x743d0000, lpProcName="CharToOemBuffA") returned 0x74403f00 [0114.859] GetProcAddress (hModule=0x743d0000, lpProcName="CharToOemBuffW") returned 0x74452d40 [0114.860] GetProcAddress (hModule=0x743d0000, lpProcName="CharToOemW") returned 0x74452d90 [0114.860] GetProcAddress (hModule=0x743d0000, lpProcName="CharUpperA") returned 0x74404ef0 [0114.862] GetProcAddress (hModule=0x743d0000, lpProcName="CharUpperBuffA") returned 0x7445aba0 [0114.862] GetProcAddress (hModule=0x743d0000, lpProcName="CharUpperBuffW") returned 0x74404d90 [0114.862] GetProcAddress (hModule=0x743d0000, lpProcName="CharUpperW") returned 0x743f0010 [0114.862] GetProcAddress (hModule=0x743d0000, lpProcName="CheckDBCSEnabledExt") returned 0x743ee290 [0114.862] GetProcAddress (hModule=0x743d0000, lpProcName="CheckDlgButton") returned 0x743fce60 [0114.862] GetProcAddress (hModule=0x743d0000, lpProcName="CheckMenuItem") returned 0x743f1420 [0114.863] GetProcAddress (hModule=0x743d0000, lpProcName="CheckMenuRadioItem") returned 0x7444db70 [0114.863] GetProcAddress (hModule=0x743d0000, lpProcName="CheckProcessForClipboardAccess") returned 0x7440bdf0 [0114.863] GetProcAddress (hModule=0x743d0000, lpProcName="CheckProcessSession") returned 0x7440be00 [0114.863] GetProcAddress (hModule=0x743d0000, lpProcName="CheckRadioButton") returned 0x7443c060 [0114.863] GetProcAddress (hModule=0x743d0000, lpProcName="CheckWindowThreadDesktop") returned 0x7440be10 [0114.863] GetProcAddress (hModule=0x743d0000, lpProcName="ChildWindowFromPoint") returned 0x7442ba80 [0114.864] GetProcAddress (hModule=0x743d0000, lpProcName="ChildWindowFromPointEx") returned 0x7440be20 [0114.864] GetProcAddress (hModule=0x743d0000, lpProcName="CliImmSetHotKey") returned 0x74424e30 [0114.864] GetProcAddress (hModule=0x743d0000, lpProcName="ClientThreadSetup") returned 0x743ee4e0 [0114.864] GetProcAddress (hModule=0x743d0000, lpProcName="ClientToScreen") returned 0x743e48a0 [0114.864] GetProcAddress (hModule=0x743d0000, lpProcName="ClipCursor") returned 0x7440be40 [0114.864] GetProcAddress (hModule=0x743d0000, lpProcName="CloseClipboard") returned 0x744095c0 [0114.865] GetProcAddress (hModule=0x743d0000, lpProcName="CloseDesktop") returned 0x74409340 [0114.865] GetProcAddress (hModule=0x743d0000, lpProcName="CloseGestureInfoHandle") returned 0x7442b2d0 [0114.865] GetProcAddress (hModule=0x743d0000, lpProcName="CloseTouchInputHandle") returned 0x74430cd0 [0114.865] GetProcAddress (hModule=0x743d0000, lpProcName="CloseWindow") returned 0x7442bb50 [0114.865] GetProcAddress (hModule=0x743d0000, lpProcName="CloseWindowStation") returned 0x74409430 [0114.865] GetProcAddress (hModule=0x743d0000, lpProcName="ConsoleControl") returned 0x74438fc0 [0114.866] GetProcAddress (hModule=0x743d0000, lpProcName="ControlMagnification") returned 0x7440c760 [0114.866] GetProcAddress (hModule=0x743d0000, lpProcName="CopyAcceleratorTableA") returned 0x74430120 [0114.866] GetProcAddress (hModule=0x743d0000, lpProcName="CopyAcceleratorTableW") returned 0x74408bb0 [0114.866] GetProcAddress (hModule=0x743d0000, lpProcName="CopyIcon") returned 0x743fff00 [0114.866] GetProcAddress (hModule=0x743d0000, lpProcName="CopyImage") returned 0x74400780 [0114.866] GetProcAddress (hModule=0x743d0000, lpProcName="CopyRect") returned 0x743edc50 [0114.866] GetProcAddress (hModule=0x743d0000, lpProcName="CountClipboardFormats") returned 0x744099d0 [0114.867] GetProcAddress (hModule=0x743d0000, lpProcName="CreateAcceleratorTableA") returned 0x74430180 [0114.867] GetProcAddress (hModule=0x743d0000, lpProcName="CreateAcceleratorTableW") returned 0x744097f0 [0114.867] GetProcAddress (hModule=0x743d0000, lpProcName="CreateCaret") returned 0x74408c10 [0114.867] GetProcAddress (hModule=0x743d0000, lpProcName="CreateCursor") returned 0x744301d0 [0114.867] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDCompositionHwndTarget") returned 0x7440be60 [0114.867] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDesktopA") returned 0x7442c080 [0114.868] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDesktopExA") returned 0x7442c0b0 [0114.868] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDesktopExW") returned 0x7442c1b0 [0114.868] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDesktopW") returned 0x7442c200 [0114.868] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDialogIndirectParamA") returned 0x743fd250 [0114.868] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDialogIndirectParamAorW") returned 0x743fa2f0 [0114.868] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDialogIndirectParamW") returned 0x743fa290 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDialogParamA") returned 0x743fd280 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateDialogParamW") returned 0x743f9f60 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateIcon") returned 0x74430520 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateIconFromResource") returned 0x744305a0 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateIconFromResourceEx") returned 0x743fefe0 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateIconIndirect") returned 0x743fff50 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateMDIWindowA") returned 0x7444ced0 [0114.869] GetProcAddress (hModule=0x743d0000, lpProcName="CreateMDIWindowW") returned 0x7444cf10 [0114.870] GetProcAddress (hModule=0x743d0000, lpProcName="CreateMenu") returned 0x74404bb0 [0114.870] GetProcAddress (hModule=0x743d0000, lpProcName="CreatePopupMenu") returned 0x74404ec0 [0114.870] GetProcAddress (hModule=0x743d0000, lpProcName="CreateSystemThreads") returned 0x7442f040 [0114.870] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowExA") returned 0x74406f30 [0114.870] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowExW") returned 0x743e9860 [0114.871] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowInBand") returned 0x74457830 [0114.871] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowInBandEx") returned 0x743e16c0 [0114.871] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowIndirect") returned 0x744578b0 [0114.871] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowStationA") returned 0x7442c230 [0114.871] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowStationW") returned 0x7442c280 [0114.871] GetProcAddress (hModule=0x743d0000, lpProcName="CsrBroadcastSystemMessageExW") returned 0x74439050 [0114.872] GetProcAddress (hModule=0x743d0000, lpProcName="CtxInitUser32") returned 0x7442f060 [0114.872] GetProcAddress (hModule=0x743d0000, lpProcName="DdeAbandonTransaction") returned 0x744582f0 [0114.872] GetProcAddress (hModule=0x743d0000, lpProcName="DdeAccessData") returned 0x744441c0 [0114.872] GetProcAddress (hModule=0x743d0000, lpProcName="DdeAddData") returned 0x74444240 [0114.872] GetProcAddress (hModule=0x743d0000, lpProcName="DdeClientTransaction") returned 0x74458390 [0114.873] GetProcAddress (hModule=0x743d0000, lpProcName="DdeCmpStringHandles") returned 0x74444f20 [0114.873] GetProcAddress (hModule=0x743d0000, lpProcName="DdeConnect") returned 0x74435fc0 [0114.873] GetProcAddress (hModule=0x743d0000, lpProcName="DdeConnectList") returned 0x74436070 [0114.873] GetProcAddress (hModule=0x743d0000, lpProcName="DdeCreateDataHandle") returned 0x74444380 [0114.874] GetProcAddress (hModule=0x743d0000, lpProcName="DdeCreateStringHandleA") returned 0x74444f40 [0114.874] GetProcAddress (hModule=0x743d0000, lpProcName="DdeCreateStringHandleW") returned 0x74444f70 [0114.874] GetProcAddress (hModule=0x743d0000, lpProcName="DdeDisconnect") returned 0x744362a0 [0114.874] GetProcAddress (hModule=0x743d0000, lpProcName="DdeDisconnectList") returned 0x74436320 [0114.874] GetProcAddress (hModule=0x743d0000, lpProcName="DdeEnableCallback") returned 0x74429cf0 [0114.874] GetProcAddress (hModule=0x743d0000, lpProcName="DdeFreeDataHandle") returned 0x74444470 [0114.874] GetProcAddress (hModule=0x743d0000, lpProcName="DdeFreeStringHandle") returned 0x74444fa0 [0114.875] GetProcAddress (hModule=0x743d0000, lpProcName="DdeGetData") returned 0x744444d0 [0114.875] GetProcAddress (hModule=0x743d0000, lpProcName="DdeGetLastError") returned 0x7443a390 [0114.875] GetProcAddress (hModule=0x743d0000, lpProcName="DdeGetQualityOfService") returned 0x744363f0 [0114.875] GetProcAddress (hModule=0x743d0000, lpProcName="DdeImpersonateClient") returned 0x7443a3e0 [0114.875] GetProcAddress (hModule=0x743d0000, lpProcName="DdeInitializeA") returned 0x7443a440 [0114.875] GetProcAddress (hModule=0x743d0000, lpProcName="DdeInitializeW") returned 0x7443a470 [0114.875] GetProcAddress (hModule=0x743d0000, lpProcName="DdeKeepStringHandle") returned 0x74445040 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeNameService") returned 0x7443a4a0 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdePostAdvise") returned 0x74458960 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeQueryConvInfo") returned 0x74458bb0 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeQueryNextServer") returned 0x74436400 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeQueryStringA") returned 0x744450d0 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeQueryStringW") returned 0x74445100 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeReconnect") returned 0x74436510 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeSetQualityOfService") returned 0x74436660 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeSetUserHandle") returned 0x74458d50 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeUnaccessData") returned 0x744445d0 [0114.876] GetProcAddress (hModule=0x743d0000, lpProcName="DdeUninitialize") returned 0x7443a6d0 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefDlgProcA") returned 0x7725af90 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefDlgProcW") returned 0x7725afa0 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefFrameProcA") returned 0x743f31e0 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefFrameProcW") returned 0x7444cf50 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefMDIChildProcA") returned 0x743f0860 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefMDIChildProcW") returned 0x7444cf80 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefRawInputProc") returned 0x7442f6a0 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefWindowProcA") returned 0x7725aed0 [0114.877] GetProcAddress (hModule=0x743d0000, lpProcName="DefWindowProcW") returned 0x73e807e0 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DeferWindowPos") returned 0x74401ed0 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DeferWindowPosAndBand") returned 0x7442c2b0 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DeleteMenu") returned 0x744094a0 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DeregisterShellHookWindow") returned 0x74404a50 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyAcceleratorTable") returned 0x743fe2b0 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyCaret") returned 0x74404340 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyCursor") returned 0x743ef880 [0114.878] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyDCompositionHwndTarget") returned 0x7440bee0 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyIcon") returned 0x743ef880 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyMenu") returned 0x744096b0 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyReasons") returned 0x74453fa0 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DestroyWindow") returned 0x73e814e0 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DialogBoxIndirectParamA") returned 0x744305d0 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DialogBoxIndirectParamAorW") returned 0x743f96b0 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DialogBoxIndirectParamW") returned 0x743f9680 [0114.879] GetProcAddress (hModule=0x743d0000, lpProcName="DialogBoxParamA") returned 0x74430600 [0114.880] GetProcAddress (hModule=0x743d0000, lpProcName="DialogBoxParamW") returned 0x744306c0 [0114.880] GetProcAddress (hModule=0x743d0000, lpProcName="DisableProcessWindowsGhosting") returned 0x7442c300 [0114.880] GetProcAddress (hModule=0x743d0000, lpProcName="DispatchMessageA") returned 0x74406f10 [0114.880] GetProcAddress (hModule=0x743d0000, lpProcName="DispatchMessageW") returned 0x743e62e0 [0114.880] GetProcAddress (hModule=0x743d0000, lpProcName="DisplayConfigGetDeviceInfo") returned 0x743efed0 [0114.880] GetProcAddress (hModule=0x743d0000, lpProcName="DisplayConfigSetDeviceInfo") returned 0x7445aca0 [0114.880] GetProcAddress (hModule=0x743d0000, lpProcName="DisplayExitWindowsWarnings") returned 0x744391f0 [0114.881] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirListA") returned 0x74449570 [0114.881] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirListComboBoxA") returned 0x74434400 [0114.881] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirListComboBoxW") returned 0x744344a0 [0114.881] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirListW") returned 0x74449610 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirSelectComboBoxExA") returned 0x744344e0 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirSelectComboBoxExW") returned 0x74434540 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirSelectExA") returned 0x74449650 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DlgDirSelectExW") returned 0x744496c0 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DoSoundConnect") returned 0x7440bf60 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DoSoundDisconnect") returned 0x7440bf70 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DragDetect") returned 0x7440bf80 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DragObject") returned 0x7440bf90 [0114.882] GetProcAddress (hModule=0x743d0000, lpProcName="DrawAnimatedRects") returned 0x7440bfa0 [0114.883] GetProcAddress (hModule=0x743d0000, lpProcName="DrawCaption") returned 0x74451c80 [0114.883] GetProcAddress (hModule=0x743d0000, lpProcName="DrawCaptionTempA") returned 0x74459a70 [0114.883] GetProcAddress (hModule=0x743d0000, lpProcName="DrawCaptionTempW") returned 0x74438e90 [0114.883] GetProcAddress (hModule=0x743d0000, lpProcName="DrawEdge") returned 0x743f2cb0 [0114.883] GetProcAddress (hModule=0x743d0000, lpProcName="DrawFocusRect") returned 0x74401f00 [0114.884] GetProcAddress (hModule=0x743d0000, lpProcName="DrawFrame") returned 0x7445bfd0 [0114.884] GetProcAddress (hModule=0x743d0000, lpProcName="DrawFrameControl") returned 0x74403610 [0114.884] GetProcAddress (hModule=0x743d0000, lpProcName="DrawIcon") returned 0x743ff6e0 [0114.884] GetProcAddress (hModule=0x743d0000, lpProcName="DrawIconEx") returned 0x743ff710 [0114.884] GetProcAddress (hModule=0x743d0000, lpProcName="DrawMenuBar") returned 0x74403ee0 [0114.884] GetProcAddress (hModule=0x743d0000, lpProcName="DrawMenuBarTemp") returned 0x7444dcf0 [0114.885] GetProcAddress (hModule=0x743d0000, lpProcName="DrawStateA") returned 0x7444e650 [0114.885] GetProcAddress (hModule=0x743d0000, lpProcName="DrawStateW") returned 0x743f4160 [0114.885] GetProcAddress (hModule=0x743d0000, lpProcName="DrawTextA") returned 0x743f35f0 [0114.885] GetProcAddress (hModule=0x743d0000, lpProcName="DrawTextExA") returned 0x743f3650 [0114.885] GetProcAddress (hModule=0x743d0000, lpProcName="DrawTextExW") returned 0x743f43f0 [0114.885] GetProcAddress (hModule=0x743d0000, lpProcName="DrawTextW") returned 0x743f4420 [0114.886] GetProcAddress (hModule=0x743d0000, lpProcName="DwmGetDxSharedSurface") returned 0x74454670 [0114.886] GetProcAddress (hModule=0x743d0000, lpProcName="DwmGetRemoteSessionOcclusionEvent") returned 0x7440bfe0 [0114.886] GetProcAddress (hModule=0x743d0000, lpProcName="DwmGetRemoteSessionOcclusionState") returned 0x7440bff0 [0114.886] GetProcAddress (hModule=0x743d0000, lpProcName="DwmKernelShutdown") returned 0x7440c000 [0114.886] GetProcAddress (hModule=0x743d0000, lpProcName="DwmKernelStartup") returned 0x7440c010 [0114.886] GetProcAddress (hModule=0x743d0000, lpProcName="DwmLockScreenUpdates") returned 0x7442c310 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="DwmValidateWindow") returned 0x7440c020 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="EditWndProc") returned 0x743f5e90 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="EmptyClipboard") returned 0x74409860 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="EnableChildWindowDpiMessage") returned 0x7440c030 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="EnableMenuItem") returned 0x743f07d0 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="EnableMouseInPointer") returned 0x7440c050 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="EnableScrollBar") returned 0x74454d10 [0114.887] GetProcAddress (hModule=0x743d0000, lpProcName="EnableSessionForMMCSS") returned 0x74457a50 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EnableWindow") returned 0x744029d0 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EndDeferWindowPos") returned 0x744035f0 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EndDeferWindowPosEx") returned 0x74408b50 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EndDialog") returned 0x743f9e60 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EndMenu") returned 0x7440c080 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EndPaint") returned 0x74408a80 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EndTask") returned 0x7440d3c0 [0114.888] GetProcAddress (hModule=0x743d0000, lpProcName="EnterReaderModeHelper") returned 0x744531b0 [0114.889] GetProcAddress (hModule=0x743d0000, lpProcName="EnumChildWindows") returned 0x73e822b0 [0114.889] GetProcAddress (hModule=0x743d0000, lpProcName="EnumClipboardFormats") returned 0x7442c380 [0114.889] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDesktopWindows") returned 0x7442ac90 [0114.889] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDesktopsA") returned 0x7442acc0 [0114.889] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDesktopsW") returned 0x7442ace0 [0114.890] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDisplayDevicesA") returned 0x73e81eb0 [0114.890] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDisplayDevicesW") returned 0x73ea3720 [0114.890] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDisplayMonitors") returned 0x74408d90 [0114.890] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDisplaySettingsA") returned 0x73ea3770 [0114.890] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDisplaySettingsExA") returned 0x73ea37e0 [0114.890] GetProcAddress (hModule=0x743d0000, lpProcName="EnumDisplaySettingsExW") returned 0x73ea3860 [0114.947] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76d50000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")) returned 0x26 [0114.948] GetModuleFileNameA (in: hModule=0x76d50000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")) returned 0x26 [0114.948] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0114.948] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=39792) returned 1 [0114.948] VirtualAlloc (lpAddress=0x0, dwSize=0x9b70, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0114.948] ReadFile (in: hFile=0x1b8, lpBuffer=0x540000, nNumberOfBytesToRead=0x9b70, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0x9b70, lpOverlapped=0x0) returned 1 [0114.952] CloseHandle (hObject=0x1b8) returned 1 [0114.952] GetProcAddress (hModule=0x76d50000, lpProcName="AcquireStateLock") returned 0x76d52970 [0114.952] GetProcAddress (hModule=0x76d50000, lpProcName="AppContainerDeriveSidFromMoniker") returned 0x76d52980 [0114.953] GetProcAddress (hModule=0x76d50000, lpProcName="AppContainerFreeMemory") returned 0x76d52990 [0114.953] GetProcAddress (hModule=0x76d50000, lpProcName="AppContainerLookupDisplayNameMrtReference") returned 0x76d529a0 [0114.953] GetProcAddress (hModule=0x76d50000, lpProcName="AppContainerLookupMoniker") returned 0x76d529b0 [0114.953] GetProcAddress (hModule=0x76d50000, lpProcName="AppContainerRegisterSid") returned 0x76d529c0 [0114.953] GetProcAddress (hModule=0x76d50000, lpProcName="AppContainerUnregisterSid") returned 0x76d529d0 [0114.953] GetProcAddress (hModule=0x76d50000, lpProcName="AppXFreeMemory") returned 0x76d529e0 [0114.953] GetProcAddress (hModule=0x76d50000, lpProcName="AppXGetApplicationData") returned 0x76d529f0 [0114.954] GetProcAddress (hModule=0x76d50000, lpProcName="AppXGetDevelopmentMode") returned 0x76d52a00 [0114.954] GetProcAddress (hModule=0x76d50000, lpProcName="AppXGetOSMaxVersionTested") returned 0x76d52a10 [0114.954] GetProcAddress (hModule=0x76d50000, lpProcName="AppXGetOSMinVersion") returned 0x76d52a20 [0114.954] GetProcAddress (hModule=0x76d50000, lpProcName="AppXGetPackageCapabilities") returned 0x76d52a30 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="AppXGetPackageSid") returned 0x76d52a40 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="AppXLookupDisplayName") returned 0x76d52a50 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="AppXLookupMoniker") returned 0x76d52a60 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="AppXUpdatePackageCapabilities") returned 0x76d52a70 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="ApplicationUserModelIdFromProductId") returned 0x76d52a80 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="CheckIfStateChangeNotificationExists") returned 0x76d52a90 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="ClosePackageInfo") returned 0x76d52aa0 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="CloseState") returned 0x76d52ab0 [0114.955] GetProcAddress (hModule=0x76d50000, lpProcName="CloseStateAtom") returned 0x76d52ac0 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CloseStateChangeNotification") returned 0x76d52ad0 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CloseStateContainer") returned 0x76d52ae0 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CloseStateLock") returned 0x76d52af0 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CommitStateAtom") returned 0x76d52b00 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CreateStateAtom") returned 0x76d52b10 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CreateStateChangeNotification") returned 0x76d52b20 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CreateStateContainer") returned 0x76d52b30 [0114.956] GetProcAddress (hModule=0x76d50000, lpProcName="CreateStateLock") returned 0x76d52b40 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="CreateStateSubcontainer") returned 0x76d52b50 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="DeleteStateAtomValue") returned 0x76d52b60 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="DeleteStateContainer") returned 0x76d52b70 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="DeleteStateContainerValue") returned 0x76d52b80 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="DuplicateStateContainerHandle") returned 0x76d52b90 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="EnumerateStateAtomValues") returned 0x76d52ba0 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="EnumerateStateContainerItems") returned 0x76d52bb0 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="FindPackagesByPackageFamily") returned 0x76d52bc0 [0114.957] GetProcAddress (hModule=0x76d50000, lpProcName="FormatApplicationUserModelId") returned 0x76d52bd0 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetAlternatePackageRoots") returned 0x76d52be0 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetAppDataFolder") returned 0x76d52bf0 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetAppModelVersion") returned 0x76d52c00 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetApplicationUserModelId") returned 0x76d52c10 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetApplicationUserModelIdFromToken") returned 0x76d52c20 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentApplicationUserModelId") returned 0x76d52c30 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageApplicationContext") returned 0x76d52c40 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageApplicationResourcesContext") returned 0x76d52c50 [0114.958] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageContext") returned 0x76d52c60 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageFamilyName") returned 0x76d52c70 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageFullName") returned 0x76d52c80 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageId") returned 0x76d52c90 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageInfo") returned 0x76d52ca0 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackagePath") returned 0x76d52cb0 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageResourcesContext") returned 0x76d52cc0 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentPackageSecurityContext") returned 0x76d52cd0 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetCurrentTargetPlatformContext") returned 0x76d52ce0 [0114.959] GetProcAddress (hModule=0x76d50000, lpProcName="GetEffectivePackageStatusForUser") returned 0x76d52cf0 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetHivePath") returned 0x76d52d00 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageApplicationContext") returned 0x76d52d10 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageApplicationIds") returned 0x76d52d20 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageApplicationProperty") returned 0x76d52d30 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageApplicationPropertyString") returned 0x76d52d40 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageApplicationResourcesContext") returned 0x76d52d50 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageContext") returned 0x76d52d60 [0114.960] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageFamilyName") returned 0x76d52d70 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageFamilyNameFromToken") returned 0x76d52d80 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageFullName") returned 0x76d52d90 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageFullNameFromToken") returned 0x76d52da0 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageId") returned 0x76d52db0 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageInfo") returned 0x76d52dc0 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageInstallTime") returned 0x76d52dd0 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageOSMaxVersionTested") returned 0x76d52de0 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackagePath") returned 0x76d52df0 [0114.961] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackagePathByFullName") returned 0x76d52e00 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackagePathOnVolume") returned 0x76d52e10 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageProperty") returned 0x76d52e20 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackagePropertyString") returned 0x76d52e30 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageResourcesContext") returned 0x76d52e40 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageResourcesProperty") returned 0x76d52e50 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageSecurityContext") returned 0x76d52e60 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageSecurityProperty") returned 0x76d52e70 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageStatus") returned 0x76d52e80 [0114.962] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageStatusForUser") returned 0x76d52e90 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageTargetPlatformProperty") returned 0x76d52ea0 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackageVolumeSisPath") returned 0x76d52eb0 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetPackagesByPackageFamily") returned 0x76d52ec0 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetPublisherCacheFolder") returned 0x76d52ed0 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetPublisherRootFolder") returned 0x76d52ee0 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetRoamingLastObservedChangeTime") returned 0x76d52ef0 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetSerializedAtomBytes") returned 0x76d52f00 [0114.963] GetProcAddress (hModule=0x76d50000, lpProcName="GetSharedLocalFolder") returned 0x76d52f10 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStagedPackageOrigin") returned 0x76d52f20 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStagedPackagePathByFullName") returned 0x76d52f30 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStateContainerDepth") returned 0x76d52f40 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStateFolder") returned 0x76d52f50 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStateRootFolder") returned 0x76d52f60 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStateRootFolderBase") returned 0x76d52f70 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStateSettingsFolder") returned 0x76d52f80 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetStateVersion") returned 0x76d52f90 [0114.964] GetProcAddress (hModule=0x76d50000, lpProcName="GetSystemAppDataFolder") returned 0x76d52fa0 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="GetSystemAppDataKey") returned 0x76d52fb0 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="GetSystemMetadataPath") returned 0x76d52fc0 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="GetSystemMetadataPathForPackage") returned 0x76d52fd0 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="GetSystemMetadataPathForPackageFamily") returned 0x76d52fe0 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="GetSystemStateRootFolder") returned 0x76d52ff0 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="GetTargetPlatformContext") returned 0x76d53000 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="IncrementPackageStatusVersion") returned 0x76d53010 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="InvalidateAppModelVersionCache") returned 0x76d53020 [0114.965] GetProcAddress (hModule=0x76d50000, lpProcName="IsDeveloperModeEnabled") returned 0x76d53030 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="IsDeveloperModePolicyApplied") returned 0x76d53040 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="IsSideloadingEnabled") returned 0x76d53050 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="IsSideloadingPolicyApplied") returned 0x76d53060 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="OpenPackageInfoByFullName") returned 0x76d53070 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="OpenPackageInfoByFullNameForUser") returned 0x76d53080 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="OpenState") returned 0x76d53090 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="OpenStateAtom") returned 0x76d530a0 [0114.966] GetProcAddress (hModule=0x76d50000, lpProcName="OpenStateExplicit") returned 0x76d530b0 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="OpenStateExplicitForUserSid") returned 0x76d530c0 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="OpenStateExplicitForUserSidString") returned 0x76d530d0 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="OverrideRoamingDataModificationTimesInRange") returned 0x76d530e0 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="PackageFamilyNameFromFullName") returned 0x76d530f0 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="PackageFamilyNameFromId") returned 0x76d53100 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="PackageFamilyNameFromProductId") returned 0x76d53110 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="PackageFullNameFromId") returned 0x76d53120 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="PackageFullNameFromProductId") returned 0x76d53130 [0114.967] GetProcAddress (hModule=0x76d50000, lpProcName="PackageIdFromFullName") returned 0x76d53140 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="PackageIdFromProductId") returned 0x76d53150 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="PackageNameAndPublisherIdFromFamilyName") returned 0x76d53160 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="PackageRelativeApplicationIdFromProductId") returned 0x76d53170 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="PackageSidFromFamilyName") returned 0x76d53180 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="PackageSidFromProductId") returned 0x76d52960 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="ParseApplicationUserModelId") returned 0x76d53190 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="ProductIdFromPackageFamilyName") returned 0x76d531a0 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="PsmActivateApplicationByToken") returned 0x76d539c0 [0114.968] GetProcAddress (hModule=0x76d50000, lpProcName="PsmAdjustActivationToken") returned 0x76d51ae0 [0114.969] GetProcAddress (hModule=0x76d50000, lpProcName="PsmCreateMatchToken") returned 0x76d53b20 [0114.969] GetProcAddress (hModule=0x76d50000, lpProcName="PsmQueryBackgroundActivationType") returned 0x76d52050 [0114.969] GetProcAddress (hModule=0x76d50000, lpProcName="PsmRegisterApplicationProcess") returned 0x76d52100 [0114.969] GetProcAddress (hModule=0x76d50000, lpProcName="PublishStateChangeNotification") returned 0x76d531b0 [0114.969] GetProcAddress (hModule=0x76d50000, lpProcName="QueryStateAtomValueInfo") returned 0x76d531c0 [0114.969] GetProcAddress (hModule=0x76d50000, lpProcName="QueryStateContainerItemInfo") returned 0x76d531d0 [0114.969] GetProcAddress (hModule=0x76d50000, lpProcName="ReadStateAtomValue") returned 0x76d531e0 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="ReadStateContainerValue") returned 0x76d531f0 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="RegisterStateChangeNotification") returned 0x76d53200 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="RegisterStateLock") returned 0x76d53210 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="ReleaseStateLock") returned 0x76d53220 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="RemovePackageStatus") returned 0x76d53230 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="RemovePackageStatusForUser") returned 0x76d53240 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="ResetState") returned 0x76d53250 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="SaveAlternatePackageRootPath") returned 0x76d53260 [0114.970] GetProcAddress (hModule=0x76d50000, lpProcName="SaveStateRootFolderPath") returned 0x76d53270 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="SetIsDeveloperModeEnabled") returned 0x76d53280 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="SetIsSideloadingEnabled") returned 0x76d53290 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="SetRoamingLastObservedChangeTime") returned 0x76d532a0 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="SetStateVersion") returned 0x76d532b0 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="SharedLocalIsEnabled") returned 0x76d532c0 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="SubscribeStateChangeNotification") returned 0x76d532d0 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="UnregisterStateChangeNotification") returned 0x76d532e0 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="UnregisterStateLock") returned 0x76d532f0 [0114.971] GetProcAddress (hModule=0x76d50000, lpProcName="UnsubscribeStateChangeNotification") returned 0x76d53300 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="UpdatePackageStatus") returned 0x76d53310 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="UpdatePackageStatusForUser") returned 0x76d53320 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="VerifyApplicationUserModelId") returned 0x76d53330 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="VerifyPackageFamilyName") returned 0x76d53340 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="VerifyPackageFullName") returned 0x76d53350 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="VerifyPackageId") returned 0x76d53360 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="VerifyPackageRelativeApplicationId") returned 0x76d53370 [0114.972] GetProcAddress (hModule=0x76d50000, lpProcName="WriteStateAtomValue") returned 0x76d53380 [0114.973] GetProcAddress (hModule=0x76d50000, lpProcName="WriteStateContainerValue") returned 0x76d53390 [0114.973] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.974] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x74520000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")) returned 0x1e [0114.974] GetModuleFileNameA (in: hModule=0x74520000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")) returned 0x1e [0114.975] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0114.975] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=569744) returned 1 [0114.975] VirtualAlloc (lpAddress=0x0, dwSize=0x8b190, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0114.975] ReadFile (in: hFile=0x1b8, lpBuffer=0x670000, nNumberOfBytesToRead=0x8b190, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x8b190, lpOverlapped=0x0) returned 1 [0115.010] CloseHandle (hObject=0x1b8) returned 1 [0115.010] GetProcAddress (hModule=0x74520000, lpProcName="CommandLineToArgvW") returned 0x7455f3e0 [0115.010] GetProcAddress (hModule=0x74520000, lpProcName="CreateRandomAccessStreamOnFile") returned 0x7453bfa0 [0115.011] GetProcAddress (hModule=0x74520000, lpProcName="CreateRandomAccessStreamOverStream") returned 0x7453b9e0 [0115.011] GetProcAddress (hModule=0x74520000, lpProcName="CreateStreamOverRandomAccessStream") returned 0x7453db80 [0115.011] GetProcAddress (hModule=0x74520000, lpProcName="DllCanUnloadNow") returned 0x74564630 [0115.011] GetProcAddress (hModule=0x74520000, lpProcName="DllGetActivationFactory") returned 0x74582b10 [0115.011] GetProcAddress (hModule=0x74520000, lpProcName="DllGetClassObject") returned 0x74562820 [0115.011] GetProcAddress (hModule=0x74520000, lpProcName="GetCurrentProcessExplicitAppUserModelID") returned 0x74599410 [0115.012] GetProcAddress (hModule=0x74520000, lpProcName="GetDpiForMonitor") returned 0x74559940 [0115.012] GetProcAddress (hModule=0x74520000, lpProcName="GetDpiForShellUIComponent") returned 0x74584840 [0115.012] GetProcAddress (hModule=0x74520000, lpProcName="GetProcessDpiAwareness") returned 0x74565200 [0115.012] GetProcAddress (hModule=0x74520000, lpProcName="GetProcessReference") returned 0x745624e0 [0115.012] GetProcAddress (hModule=0x74520000, lpProcName="GetScaleFactorForDevice") returned 0x74540f50 [0115.012] GetProcAddress (hModule=0x74520000, lpProcName="GetScaleFactorForMonitor") returned 0x74563a10 [0115.013] GetProcAddress (hModule=0x74520000, lpProcName="IStream_Copy") returned 0x74562a00 [0115.013] GetProcAddress (hModule=0x74520000, lpProcName="IStream_Read") returned 0x7454e330 [0115.013] GetProcAddress (hModule=0x74520000, lpProcName="IStream_ReadStr") returned 0x7454d090 [0115.013] GetProcAddress (hModule=0x74520000, lpProcName="IStream_Reset") returned 0x7454cd20 [0115.013] GetProcAddress (hModule=0x74520000, lpProcName="IStream_Size") returned 0x74560ef0 [0115.013] GetProcAddress (hModule=0x74520000, lpProcName="IStream_Write") returned 0x7453bc90 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="IStream_WriteStr") returned 0x7454d240 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="IUnknown_AtomicRelease") returned 0x74569870 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="IUnknown_GetSite") returned 0x74560400 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="IUnknown_QueryService") returned 0x7455fc30 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="IUnknown_Set") returned 0x7455af70 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="IUnknown_SetSite") returned 0x74560490 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="IsOS") returned 0x7455a0e0 [0115.014] GetProcAddress (hModule=0x74520000, lpProcName="RegisterScaleChangeEvent") returned 0x745658b0 [0115.015] GetProcAddress (hModule=0x74520000, lpProcName="RegisterScaleChangeNotifications") returned 0x7453ae50 [0115.015] GetProcAddress (hModule=0x74520000, lpProcName="RevokeScaleChangeNotifications") returned 0x7453af60 [0115.015] GetProcAddress (hModule=0x74520000, lpProcName="SHAnsiToAnsi") returned 0x74599910 [0115.015] GetProcAddress (hModule=0x74520000, lpProcName="SHAnsiToUnicode") returned 0x7455fa20 [0115.015] GetProcAddress (hModule=0x74520000, lpProcName="SHCopyKeyA") returned 0x74584350 [0115.015] GetProcAddress (hModule=0x74520000, lpProcName="SHCopyKeyW") returned 0x74569470 [0115.015] GetProcAddress (hModule=0x74520000, lpProcName="SHCreateMemStream") returned 0x74546b70 [0115.016] GetProcAddress (hModule=0x74520000, lpProcName="SHCreateStreamOnFileA") returned 0x74591aa0 [0115.017] GetProcAddress (hModule=0x74520000, lpProcName="SHCreateStreamOnFileEx") returned 0x74563c80 [0115.017] GetProcAddress (hModule=0x74520000, lpProcName="SHCreateStreamOnFileW") returned 0x74550b70 [0115.017] GetProcAddress (hModule=0x74520000, lpProcName="SHCreateThread") returned 0x745621c0 [0115.017] GetProcAddress (hModule=0x74520000, lpProcName="SHCreateThreadRef") returned 0x74552ad0 [0115.017] GetProcAddress (hModule=0x74520000, lpProcName="SHCreateThreadWithHandle") returned 0x74562190 [0115.017] GetProcAddress (hModule=0x74520000, lpProcName="SHDeleteEmptyKeyA") returned 0x74583ed0 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHDeleteEmptyKeyW") returned 0x74584250 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHDeleteKeyA") returned 0x745843c0 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHDeleteKeyW") returned 0x74564460 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHDeleteValueA") returned 0x74583f70 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHDeleteValueW") returned 0x74564ee0 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHEnumKeyExA") returned 0x74584420 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHEnumKeyExW") returned 0x74561d60 [0115.018] GetProcAddress (hModule=0x74520000, lpProcName="SHEnumValueA") returned 0x74584450 [0115.019] GetProcAddress (hModule=0x74520000, lpProcName="SHEnumValueW") returned 0x745651c0 [0115.019] GetProcAddress (hModule=0x74520000, lpProcName="SHGetThreadRef") returned 0x7453d030 [0115.019] GetProcAddress (hModule=0x74520000, lpProcName="SHGetValueA") returned 0x74563320 [0115.019] GetProcAddress (hModule=0x74520000, lpProcName="SHGetValueW") returned 0x74557120 [0115.019] GetProcAddress (hModule=0x74520000, lpProcName="SHOpenRegStream2A") returned 0x745917c0 [0115.019] GetProcAddress (hModule=0x74520000, lpProcName="SHOpenRegStream2W") returned 0x7453f630 [0115.019] GetProcAddress (hModule=0x74520000, lpProcName="SHOpenRegStreamA") returned 0x74591860 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHOpenRegStreamW") returned 0x74591890 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHQueryInfoKeyA") returned 0x745844e0 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHQueryInfoKeyW") returned 0x74565640 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHQueryValueExA") returned 0x74584510 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHQueryValueExW") returned 0x745571b0 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHRegDuplicateHKey") returned 0x7453f260 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHRegGetIntW") returned 0x74584540 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHRegGetPathA") returned 0x745845b0 [0115.020] GetProcAddress (hModule=0x74520000, lpProcName="SHRegGetPathW") returned 0x74556770 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHRegGetValueA") returned 0x74563350 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHRegGetValueFromHKCUHKLM") returned 0x745567f0 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHRegGetValueW") returned 0x745564e0 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHRegSetPathA") returned 0x745845e0 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHRegSetPathW") returned 0x74562a70 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHReleaseThreadRef") returned 0x74561a00 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHSetThreadRef") returned 0x745619b0 [0115.021] GetProcAddress (hModule=0x74520000, lpProcName="SHSetValueA") returned 0x74583fd0 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SHSetValueW") returned 0x74562b10 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SHStrDupA") returned 0x745655a0 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SHStrDupW") returned 0x745575c0 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SHUnicodeToAnsi") returned 0x74560100 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SHUnicodeToUnicode") returned 0x74599b40 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SetCurrentProcessExplicitAppUserModelID") returned 0x74561ab0 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SetProcessDpiAwareness") returned 0x7455a010 [0115.022] GetProcAddress (hModule=0x74520000, lpProcName="SetProcessReference") returned 0x74565930 [0115.023] GetProcAddress (hModule=0x74520000, lpProcName="UnregisterScaleChangeEvent") returned 0x74565a80 [0115.023] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.029] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76470000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")) returned 0x20 [0115.030] GetModuleFileNameA (in: hModule=0x76470000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")) returned 0x20 [0115.030] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0115.031] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=270672) returned 1 [0115.031] VirtualAlloc (lpAddress=0x0, dwSize=0x42150, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0115.031] ReadFile (in: hFile=0x1b8, lpBuffer=0x670000, nNumberOfBytesToRead=0x42150, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x42150, lpOverlapped=0x0) returned 1 [0115.045] CloseHandle (hObject=0x1b8) returned 1 [0115.045] GetProcAddress (hModule=0x76470000, lpProcName="CallNtPowerInformation") returned 0x76475540 [0115.045] GetProcAddress (hModule=0x76470000, lpProcName="CanUserWritePwrScheme") returned 0x76478840 [0115.045] GetProcAddress (hModule=0x76470000, lpProcName="DeletePwrScheme") returned 0x764788c0 [0115.046] GetProcAddress (hModule=0x76470000, lpProcName="DevicePowerClose") returned 0x7647caa0 [0115.046] GetProcAddress (hModule=0x76470000, lpProcName="DevicePowerEnumDevices") returned 0x7647cb50 [0115.046] GetProcAddress (hModule=0x76470000, lpProcName="DevicePowerOpen") returned 0x7647d060 [0115.046] GetProcAddress (hModule=0x76470000, lpProcName="DevicePowerSetDeviceState") returned 0x7647d0c0 [0115.046] GetProcAddress (hModule=0x76470000, lpProcName="EnumPwrSchemes") returned 0x76478a20 [0115.046] GetProcAddress (hModule=0x76470000, lpProcName="GUIDFormatToGlobalPowerPolicy") returned 0x7647d560 [0115.047] GetProcAddress (hModule=0x76470000, lpProcName="GUIDFormatToPowerPolicy") returned 0x7647d980 [0115.047] GetProcAddress (hModule=0x76470000, lpProcName="GetActivePwrScheme") returned 0x76478eb0 [0115.047] GetProcAddress (hModule=0x76470000, lpProcName="GetCurrentPowerPolicies") returned 0x76478f40 [0115.047] GetProcAddress (hModule=0x76470000, lpProcName="GetPwrCapabilities") returned 0x76476410 [0115.047] GetProcAddress (hModule=0x76470000, lpProcName="GetPwrDiskSpindownRange") returned 0x76478fc0 [0115.047] GetProcAddress (hModule=0x76470000, lpProcName="IsAdminOverrideActive") returned 0x76479010 [0115.048] GetProcAddress (hModule=0x76470000, lpProcName="IsPwrHibernateAllowed") returned 0x76479020 [0115.048] GetProcAddress (hModule=0x76470000, lpProcName="IsPwrShutdownAllowed") returned 0x76479070 [0115.048] GetProcAddress (hModule=0x76470000, lpProcName="IsPwrSuspendAllowed") returned 0x764790b0 [0115.048] GetProcAddress (hModule=0x76470000, lpProcName="LoadCurrentPwrScheme") returned 0x76479150 [0115.049] GetProcAddress (hModule=0x76470000, lpProcName="MergeLegacyPwrScheme") returned 0x76479150 [0115.049] GetProcAddress (hModule=0x76470000, lpProcName="PowerApplyPowerRequestOverride") returned 0x76480a60 [0115.049] GetProcAddress (hModule=0x76470000, lpProcName="PowerApplySettingChanges") returned 0x7647fa90 [0115.049] GetProcAddress (hModule=0x76470000, lpProcName="PowerCanRestoreIndividualDefaultPowerScheme") returned 0x7647de90 [0115.049] GetProcAddress (hModule=0x76470000, lpProcName="PowerClearUserAwayPrediction") returned 0x7647df70 [0115.049] GetProcAddress (hModule=0x76470000, lpProcName="PowerCloseEnvironmentalMonitor") returned 0x76481860 [0115.049] GetProcAddress (hModule=0x76470000, lpProcName="PowerCloseLimitsMitigation") returned 0x764821f0 [0115.050] GetProcAddress (hModule=0x76470000, lpProcName="PowerCloseLimitsPolicy") returned 0x764829a0 [0115.050] GetProcAddress (hModule=0x76470000, lpProcName="PowerCreatePossibleSetting") returned 0x7647fb00 [0115.050] GetProcAddress (hModule=0x76470000, lpProcName="PowerCreateSetting") returned 0x7647fb80 [0115.050] GetProcAddress (hModule=0x76470000, lpProcName="PowerCustomizePlatformPowerSettings") returned 0x76480bf0 [0115.050] GetProcAddress (hModule=0x76470000, lpProcName="PowerDebugDifPowerPolicies") returned 0x7647a5c0 [0115.050] GetProcAddress (hModule=0x76470000, lpProcName="PowerDebugDifSystemPowerPolicies") returned 0x7647aec0 [0115.050] GetProcAddress (hModule=0x76470000, lpProcName="PowerDebugDumpPowerPolicy") returned 0x7647b5c0 [0115.051] GetProcAddress (hModule=0x76470000, lpProcName="PowerDebugDumpPowerScheme") returned 0x7647b9a0 [0115.051] GetProcAddress (hModule=0x76470000, lpProcName="PowerDebugDumpSystemPowerCapabilities") returned 0x7647c250 [0115.051] GetProcAddress (hModule=0x76470000, lpProcName="PowerDebugDumpSystemPowerPolicy") returned 0x7647c4e0 [0115.051] GetProcAddress (hModule=0x76470000, lpProcName="PowerDeleteScheme") returned 0x7647fbf0 [0115.051] GetProcAddress (hModule=0x76470000, lpProcName="PowerDeterminePlatformRole") returned 0x76476570 [0115.051] GetProcAddress (hModule=0x76470000, lpProcName="PowerDeterminePlatformRoleEx") returned 0x76476580 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerDuplicateScheme") returned 0x7647fc70 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerEnumerate") returned 0x76476810 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerGetActiveScheme") returned 0x764768f0 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerImportPowerScheme") returned 0x7647fde0 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerInformationWithPrivileges") returned 0x764795e0 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerIsSettingRangeDefined") returned 0x7647f150 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerOpenSystemPowerKey") returned 0x7647e040 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerOpenUserPowerKey") returned 0x7647e090 [0115.052] GetProcAddress (hModule=0x76470000, lpProcName="PowerPolicyToGUIDFormat") returned 0x7647e0f0 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadACDefaultIndex") returned 0x7647f250 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadACValue") returned 0x76476760 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadACValueIndex") returned 0x76477070 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadDCDefaultIndex") returned 0x7647f2e0 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadDCValue") returned 0x7647f370 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadDCValueIndex") returned 0x7647f3f0 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadDescription") returned 0x7647f480 [0115.053] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadFriendlyName") returned 0x764768c0 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadIconResourceSpecifier") returned 0x7647f4b0 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadPossibleDescription") returned 0x7647f4e0 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadPossibleFriendlyName") returned 0x7647f510 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadPossibleValue") returned 0x7647f540 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadSecurityDescriptor") returned 0x7647f5d0 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadSettingAttributes") returned 0x7647f6f0 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadValueIncrement") returned 0x7647f800 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadValueMax") returned 0x7647f890 [0115.054] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadValueMin") returned 0x7647f920 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerReadValueUnitsSpecifier") returned 0x7647f9b0 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerReapplyActiveScheme") returned 0x76480ad0 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerRegisterEnvironmentalMonitor") returned 0x76481980 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerRegisterLimitsMitigation") returned 0x76482330 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerRegisterLimitsPolicy") returned 0x76482a30 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerRegisterSuspendResumeNotification") returned 0x76475ea0 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerRemovePowerSetting") returned 0x7647ff20 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerReplaceDefaultPowerSchemes") returned 0x7647e5c0 [0115.055] GetProcAddress (hModule=0x76470000, lpProcName="PowerReportLimitsEvent") returned 0x76482c60 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerReportThermalEvent") returned 0x7647e640 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerRestoreACDefaultIndex") returned 0x7647ff90 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerRestoreDCDefaultIndex") returned 0x76480020 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerRestoreDefaultPowerSchemes") returned 0x7647e690 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerRestoreIndividualDefaultPowerScheme") returned 0x7647e700 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerSetActiveScheme") returned 0x76476680 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerSetAlsBrightnessOffset") returned 0x7647e790 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerSetUserAwayPrediction") returned 0x7647e800 [0115.056] GetProcAddress (hModule=0x76470000, lpProcName="PowerSettingAccessCheck") returned 0x76475430 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerSettingAccessCheckEx") returned 0x7647e960 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerSettingRegisterNotification") returned 0x76475a90 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerSettingRegisterNotificationEx") returned 0x76475ac0 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerSettingUnregisterNotification") returned 0x76476320 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerUnregisterSuspendResumeNotification") returned 0x76476150 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerUpdateEnvironmentalMonitorState") returned 0x76481b10 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerUpdateEnvironmentalMonitorThresholds") returned 0x76481ba0 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerUpdateLimitsMitigation") returned 0x76482520 [0115.057] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteACDefaultIndex") returned 0x764800b0 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteACValueIndex") returned 0x76480130 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteDCDefaultIndex") returned 0x764801d0 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteDCValueIndex") returned 0x76480250 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteDescription") returned 0x764802f0 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteFriendlyName") returned 0x76480370 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteIconResourceSpecifier") returned 0x764803f0 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWritePossibleDescription") returned 0x76480470 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWritePossibleFriendlyName") returned 0x764804f0 [0115.058] GetProcAddress (hModule=0x76470000, lpProcName="PowerWritePossibleValue") returned 0x76480570 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteSecurityDescriptor") returned 0x764805f0 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteSettingAttributes") returned 0x764770e0 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteValueIncrement") returned 0x764806a0 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteValueMax") returned 0x76480720 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteValueMin") returned 0x764807a0 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="PowerWriteValueUnitsSpecifier") returned 0x76480820 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="ReadGlobalPwrPolicy") returned 0x76479640 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="ReadProcessorPwrScheme") returned 0x76479790 [0115.059] GetProcAddress (hModule=0x76470000, lpProcName="ReadPwrScheme") returned 0x764798a0 [0115.060] GetProcAddress (hModule=0x76470000, lpProcName="SetActivePwrScheme") returned 0x76479a40 [0115.060] GetProcAddress (hModule=0x76470000, lpProcName="SetSuspendState") returned 0x76479cc0 [0115.060] GetProcAddress (hModule=0x76470000, lpProcName="ValidatePowerPolicies") returned 0x7647a080 [0115.060] GetProcAddress (hModule=0x76470000, lpProcName="WriteGlobalPwrPolicy") returned 0x7647a1c0 [0115.060] GetProcAddress (hModule=0x76470000, lpProcName="WriteProcessorPwrScheme") returned 0x76479790 [0115.060] GetProcAddress (hModule=0x76470000, lpProcName="WritePwrScheme") returned 0x7647a410 [0115.060] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.065] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73f20000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")) returned 0x1f [0115.065] GetModuleFileNameA (in: hModule=0x73f20000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")) returned 0x1f [0115.066] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0115.066] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=54752) returned 1 [0115.066] VirtualAlloc (lpAddress=0x0, dwSize=0xd5e0, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0115.066] ReadFile (in: hFile=0x1b8, lpBuffer=0x540000, nNumberOfBytesToRead=0xd5e0, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0xd5e0, lpOverlapped=0x0) returned 1 [0115.069] CloseHandle (hObject=0x1b8) returned 1 [0115.069] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.070] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x741b0000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\syswow64\\imm32.dll")) returned 0x1d [0115.071] GetModuleFileNameA (in: hModule=0x741b0000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\syswow64\\imm32.dll")) returned 0x1d [0115.071] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\syswow64\\imm32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0115.071] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=169928) returned 1 [0115.071] VirtualAlloc (lpAddress=0x0, dwSize=0x297c8, flAllocationType=0x1000, flProtect=0x4) returned 0x670000 [0115.072] ReadFile (in: hFile=0x1b8, lpBuffer=0x670000, nNumberOfBytesToRead=0x297c8, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x670000*, lpNumberOfBytesRead=0x19bd68*=0x297c8, lpOverlapped=0x0) returned 1 [0115.078] CloseHandle (hObject=0x1b8) returned 1 [0115.078] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmAppCompatEnableIMEonProtectedCode") returned 0x741cddd0 [0115.078] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmCoUninitialize") returned 0x741b5270 [0115.078] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmDispatchDefImeMessage") returned 0x741b5aa0 [0115.079] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmEnterCoInitCountSkipMode") returned 0x741b5440 [0115.079] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmGenerateMessage") returned 0x741c37c0 [0115.079] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmGetCompatibleKeyboardLayout") returned 0x741cde00 [0115.079] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmGetGlobalIMEStatus") returned 0x741cde20 [0115.079] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmGetGuidAtom") returned 0x741cde50 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmGetIMEFileName") returned 0x741cdec0 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmGetTMAEFlags") returned 0x741b4d70 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmHideToolbarWnd") returned 0x741cdf60 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmIsCiceroEnabled") returned 0x741ce000 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmIsCiceroStartedInThread") returned 0x741b53e0 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmIsComStartedInThread") returned 0x741ce030 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmIsGuidMapEnable") returned 0x741ce060 [0115.080] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmIsTextFrameServiceDisabled") returned 0x741ce0c0 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmLastEnabledWndDestroy") returned 0x741b4c80 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmLeaveCoInitCountSkipMode") returned 0x741b5470 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmNotify") returned 0x741b5ae0 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmRestoreToolbarWnd") returned 0x741ce0d0 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmSetAppCompatFlags") returned 0x741b5650 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmSetCiceroStartInThread") returned 0x741b54a0 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmSetDefaultRemoteKeyboardLayout") returned 0x741ce140 [0115.081] GetProcAddress (hModule=0x741b0000, lpProcName="CtfImmTIMActivate") returned 0x741b5f80 [0115.082] GetProcAddress (hModule=0x741b0000, lpProcName="GetKeyboardLayoutCP") returned 0x741c3900 [0115.082] GetProcAddress (hModule=0x741b0000, lpProcName="ImmActivateLayout") returned 0x741c1060 [0115.082] GetProcAddress (hModule=0x741b0000, lpProcName="ImmAssociateContext") returned 0x741b2380 [0115.082] GetProcAddress (hModule=0x741b0000, lpProcName="ImmAssociateContextEx") returned 0x741bd4b0 [0115.083] GetProcAddress (hModule=0x741b0000, lpProcName="ImmCallImeConsoleIME") returned 0x741cd040 [0115.083] GetProcAddress (hModule=0x741b0000, lpProcName="ImmConfigureIMEA") returned 0x741c11e0 [0115.083] GetProcAddress (hModule=0x741b0000, lpProcName="ImmConfigureIMEW") returned 0x741c1400 [0115.083] GetProcAddress (hModule=0x741b0000, lpProcName="ImmCreateContext") returned 0x741bd5d0 [0115.083] GetProcAddress (hModule=0x741b0000, lpProcName="ImmCreateIMCC") returned 0x741b5560 [0115.083] GetProcAddress (hModule=0x741b0000, lpProcName="ImmCreateSoftKeyboard") returned 0x741c7af0 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmDestroyContext") returned 0x741bd640 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmDestroyIMCC") returned 0x741b55d0 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmDestroySoftKeyboard") returned 0x741c7cd0 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmDisableIME") returned 0x741c3970 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmDisableIme") returned 0x741c3970 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmDisableLegacyIME") returned 0x741c3980 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmDisableTextFrameService") returned 0x741c88d0 [0115.084] GetProcAddress (hModule=0x741b0000, lpProcName="ImmEnumInputContext") returned 0x741b40b0 [0115.085] GetProcAddress (hModule=0x741b0000, lpProcName="ImmEnumRegisterWordA") returned 0x741c4090 [0115.085] GetProcAddress (hModule=0x741b0000, lpProcName="ImmEnumRegisterWordW") returned 0x741c4220 [0115.085] GetProcAddress (hModule=0x741b0000, lpProcName="ImmEscapeA") returned 0x741c1640 [0115.085] GetProcAddress (hModule=0x741b0000, lpProcName="ImmEscapeW") returned 0x741c1900 [0115.085] GetProcAddress (hModule=0x741b0000, lpProcName="ImmFreeLayout") returned 0x741c1b10 [0115.085] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGenerateMessage") returned 0x741c3a20 [0115.086] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetAppCompatFlags") returned 0x741b2870 [0115.086] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCandidateListA") returned 0x741bde40 [0115.086] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCandidateListCountA") returned 0x741bde70 [0115.086] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCandidateListCountW") returned 0x741bde90 [0115.086] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCandidateListW") returned 0x741bdfe0 [0115.086] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCandidateWindow") returned 0x741b2b40 [0115.086] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCompositionFontA") returned 0x741be120 [0115.087] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCompositionFontW") returned 0x741be1d0 [0115.087] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCompositionStringA") returned 0x741be280 [0115.087] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCompositionStringW") returned 0x741be320 [0115.087] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetCompositionWindow") returned 0x741b28a0 [0115.087] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetContext") returned 0x741b2d10 [0115.087] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetConversionListA") returned 0x741be3c0 [0115.087] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetConversionListW") returned 0x741be540 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetConversionStatus") returned 0x741b2750 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetDefaultIMEWnd") returned 0x741b5000 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetDescriptionA") returned 0x741c2c50 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetDescriptionW") returned 0x741c2d00 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetGuideLineA") returned 0x741be6d0 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetGuideLineW") returned 0x741be700 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetHotKey") returned 0x741c0d70 [0115.088] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetIMCCLockCount") returned 0x741c3bb0 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetIMCCSize") returned 0x741c3be0 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetIMCLockCount") returned 0x741c3c00 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetIMEFileNameA") returned 0x741c2db0 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetIMEFileNameW") returned 0x741c2ec0 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetImeInfoEx") returned 0x741b5f00 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetImeMenuItemsA") returned 0x741cd360 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetImeMenuItemsW") returned 0x741cd710 [0115.089] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetOpenStatus") returned 0x741b27f0 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetProperty") returned 0x741c2fe0 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetRegisterWordStyleA") returned 0x741c43d0 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetRegisterWordStyleW") returned 0x741c4510 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetStatusWindowPos") returned 0x741be970 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmGetVirtualKey") returned 0x741c3c40 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIMPGetIMEA") returned 0x741c8420 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIMPGetIMEW") returned 0x741c8490 [0115.090] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIMPQueryIMEA") returned 0x741c84d0 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIMPQueryIMEW") returned 0x741c8570 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIMPSetIMEA") returned 0x741c8690 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIMPSetIMEW") returned 0x741c8710 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmInstallIMEA") returned 0x741c30c0 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmInstallIMEW") returned 0x741c31a0 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIsIME") returned 0x741b5050 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIsUIMessageA") returned 0x741b6180 [0115.091] GetProcAddress (hModule=0x741b0000, lpProcName="ImmIsUIMessageW") returned 0x741c3c90 [0115.092] GetProcAddress (hModule=0x741b0000, lpProcName="ImmLoadIME") returned 0x741b5df0 [0115.092] GetProcAddress (hModule=0x741b0000, lpProcName="ImmLoadLayout") returned 0x741c2160 [0115.092] GetProcAddress (hModule=0x741b0000, lpProcName="ImmLockClientImc") returned 0x741b3100 [0115.092] GetProcAddress (hModule=0x741b0000, lpProcName="ImmLockIMC") returned 0x741b2de0 [0115.092] GetProcAddress (hModule=0x741b0000, lpProcName="ImmLockIMCC") returned 0x741b5180 [0115.092] GetProcAddress (hModule=0x741b0000, lpProcName="ImmLockImeDpi") returned 0x741b3e70 [0115.092] GetProcAddress (hModule=0x741b0000, lpProcName="ImmNotifyIME") returned 0x741c1cb0 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmProcessKey") returned 0x741b42d0 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmPutImeMenuItemsIntoMappedFile") returned 0x741cd9e0 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmReSizeIMCC") returned 0x741c3d60 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmRegisterClient") returned 0x741b60e0 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmRegisterWordA") returned 0x741c4630 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmRegisterWordW") returned 0x741c47a0 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmReleaseContext") returned 0x741b5430 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmRequestMessageA") returned 0x741beb20 [0115.093] GetProcAddress (hModule=0x741b0000, lpProcName="ImmRequestMessageW") returned 0x741bebf0 [0115.094] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSendIMEMessageExA") returned 0x741c8820 [0115.094] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSendIMEMessageExW") returned 0x741c8840 [0115.094] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetActiveContext") returned 0x741b33b0 [0115.094] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetActiveContextConsoleIME") returned 0x741cd1b0 [0115.095] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetCandidateWindow") returned 0x741beee0 [0115.095] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetCompositionFontA") returned 0x741bef70 [0115.095] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetCompositionFontW") returned 0x741b2210 [0115.095] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetCompositionStringA") returned 0x741bf0a0 [0115.095] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetCompositionStringW") returned 0x741bf0d0 [0115.095] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetCompositionWindow") returned 0x741b3780 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetConversionStatus") returned 0x741bf580 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetHotKey") returned 0x74424e30 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetOpenStatus") returned 0x741bf660 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSetStatusWindowPos") returned 0x741bf700 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmShowSoftKeyboard") returned 0x741c7cf0 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSimulateHotKey") returned 0x741c0da0 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmSystemHandler") returned 0x741c3d90 [0115.096] GetProcAddress (hModule=0x741b0000, lpProcName="ImmTranslateMessage") returned 0x741c7f00 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmUnlockClientImc") returned 0x741b4060 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmUnlockIMC") returned 0x741b3f00 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmUnlockIMCC") returned 0x741b51b0 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmUnlockImeDpi") returned 0x741b2700 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmUnregisterWordA") returned 0x741c4930 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmUnregisterWordW") returned 0x741c4aa0 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmWINNLSEnableIME") returned 0x741c8860 [0115.097] GetProcAddress (hModule=0x741b0000, lpProcName="ImmWINNLSGetEnableStatus") returned 0x741c8890 [0115.098] GetProcAddress (hModule=0x741b0000, lpProcName="ImmWINNLSGetIMEHotkey") returned 0x741c88d0 [0115.098] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.100] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x6f860000, lpFilename=0x19d00c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")) returned 0x1b [0115.101] GetModuleFileNameA (in: hModule=0x6f860000, lpFilename=0x19be7c, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")) returned 0x1b [0115.101] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8 [0115.102] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x19bd5c | out: lpFileSize=0x19bd5c*=85720) returned 1 [0115.102] VirtualAlloc (lpAddress=0x0, dwSize=0x14ed8, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0115.102] ReadFile (in: hFile=0x1b8, lpBuffer=0x540000, nNumberOfBytesToRead=0x14ed8, lpNumberOfBytesRead=0x19bd68, lpOverlapped=0x0 | out: lpBuffer=0x540000*, lpNumberOfBytesRead=0x19bd68*=0x14ed8, lpOverlapped=0x0) returned 1 [0115.106] CloseHandle (hObject=0x1b8) returned 1 [0115.106] GetProcAddress (hModule=0x6f860000, lpProcName="DoBroadcastSystemMessage") returned 0x6f86e270 [0115.106] GetProcAddress (hModule=0x6f860000, lpProcName="DoCommandLinePrompt") returned 0x6f86e2a0 [0115.106] GetProcAddress (hModule=0x6f860000, lpProcName="DoPasswordDialog") returned 0x6f86e2d0 [0115.106] GetProcAddress (hModule=0x6f860000, lpProcName="DoProfileErrorDialog") returned 0x6f86e300 [0115.106] GetProcAddress (hModule=0x6f860000, lpProcName="I_MprSaveConn") returned 0x6f86e0e0 [0115.107] GetProcAddress (hModule=0x6f860000, lpProcName="MultinetGetConnectionPerformanceA") returned 0x6f86c1d0 [0115.107] GetProcAddress (hModule=0x6f860000, lpProcName="MultinetGetConnectionPerformanceW") returned 0x6f86a8f0 [0115.107] GetProcAddress (hModule=0x6f860000, lpProcName="MultinetGetErrorTextA") returned 0x6f86c230 [0115.107] GetProcAddress (hModule=0x6f860000, lpProcName="MultinetGetErrorTextW") returned 0x6f86b5d0 [0115.107] GetProcAddress (hModule=0x6f860000, lpProcName="ShowReconnectDialog") returned 0x6f86e320 [0115.107] GetProcAddress (hModule=0x6f860000, lpProcName="ShowReconnectDialogEnd") returned 0x6f86e350 [0115.107] GetProcAddress (hModule=0x6f860000, lpProcName="ShowReconnectDialogUI") returned 0x6f86e370 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetAddConnection2A") returned 0x6f86c350 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetAddConnection2W") returned 0x6f8639e0 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetAddConnection3A") returned 0x6f86c380 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetAddConnection3W") returned 0x6f86a070 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetAddConnectionA") returned 0x6f86c3b0 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetAddConnectionW") returned 0x6f86a0a0 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetCancelConnection2A") returned 0x6f86c450 [0115.108] GetProcAddress (hModule=0x6f860000, lpProcName="WNetCancelConnection2W") returned 0x6f863fa0 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetCancelConnectionA") returned 0x6f86c4c0 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetCancelConnectionW") returned 0x6f86a160 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetClearConnections") returned 0x6f863920 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetCloseEnum") returned 0x6f8626d0 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetConnectionDialog") returned 0x6f86e400 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetConnectionDialog1A") returned 0x6f86c4e0 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetConnectionDialog1W") returned 0x6f86e3d0 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetConnectionDialog2") returned 0x6f86e390 [0115.109] GetProcAddress (hModule=0x6f860000, lpProcName="WNetDirectoryNotifyA") returned 0x6f86c5a0 [0115.110] GetProcAddress (hModule=0x6f860000, lpProcName="WNetDirectoryNotifyW") returned 0x6f86f450 [0115.110] GetProcAddress (hModule=0x6f860000, lpProcName="WNetDisconnectDialog") returned 0x6f86e460 [0115.110] GetProcAddress (hModule=0x6f860000, lpProcName="WNetDisconnectDialog1A") returned 0x6f86c600 [0115.110] GetProcAddress (hModule=0x6f860000, lpProcName="WNetDisconnectDialog1W") returned 0x6f86e430 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetDisconnectDialog2") returned 0x6f86e3b0 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetEnumResourceA") returned 0x6f86c6c0 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetEnumResourceW") returned 0x6f8624a0 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetFormatNetworkNameA") returned 0x6f86c750 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetFormatNetworkNameW") returned 0x6f86b440 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetConnection2A") returned 0x6f86c800 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetConnection2W") returned 0x6f86a180 [0115.111] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetConnection3A") returned 0x6f86c930 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetConnection3W") returned 0x6f86a2b0 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetConnectionA") returned 0x6f86c9a0 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetConnectionW") returned 0x6f863630 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetDirectoryTypeA") returned 0x6f86ca40 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetDirectoryTypeW") returned 0x6f86f660 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetHomeDirectoryW") returned 0x6f86f900 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetLastErrorA") returned 0x6f86caa0 [0115.112] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetLastErrorW") returned 0x6f86b840 [0115.113] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetNetworkInformationA") returned 0x6f86cb00 [0115.113] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetNetworkInformationW") returned 0x6f86e5a0 [0115.113] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetPropertyTextA") returned 0x6f86cb60 [0115.113] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetPropertyTextW") returned 0x6f86d3a0 [0115.113] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetProviderNameA") returned 0x6f86cc00 [0115.113] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetProviderNameW") returned 0x6f86e6d0 [0115.113] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetProviderTypeA") returned 0x6f86cc80 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetProviderTypeW") returned 0x6f86e7f0 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetResourceInformationA") returned 0x6f86cce0 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetResourceInformationW") returned 0x6f86ea00 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetResourceParentA") returned 0x6f86ce00 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetResourceParentW") returned 0x6f86ea50 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetSearchDialog") returned 0x6f86e490 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetUniversalNameA") returned 0x6f86cee0 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetUniversalNameW") returned 0x6f86efb0 [0115.114] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetUserA") returned 0x6f86d060 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetGetUserW") returned 0x6f86f9c0 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetLogonNotify") returned 0x6f863d80 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetOpenEnumA") returned 0x6f86d100 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetOpenEnumW") returned 0x6f862820 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetPasswordChangeNotify") returned 0x6f86aa40 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetPropertyDialogA") returned 0x6f86d170 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetPropertyDialogW") returned 0x6f86d5b0 [0115.115] GetProcAddress (hModule=0x6f860000, lpProcName="WNetRestoreAllConnectionsW") returned 0x6f863ac0 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetRestoreSingleConnectionW") returned 0x6f86a320 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetSetConnectionA") returned 0x6f86d1e0 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetSetConnectionW") returned 0x6f86a490 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetSetLastErrorA") returned 0x6f86d240 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetSetLastErrorW") returned 0x6f86b960 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetSupportGlobalEnum") returned 0x6f86e500 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetUseConnectionA") returned 0x6f86d2a0 [0115.116] GetProcAddress (hModule=0x6f860000, lpProcName="WNetUseConnectionW") returned 0x6f86a700 [0115.116] VirtualFree (lpAddress=0x540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.118] CloseHandle (hObject=0xffffffff) returned 1 [0115.118] GetWindowsDirectoryA (in: lpBuffer=0x19e37c, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0115.118] GetCurrentProcess () returned 0xffffffff [0115.118] K32EnumProcessModules (in: hProcess=0xffffffff, lphModule=0x19d274, cb=0x1000, lpcbNeeded=0x19d270 | out: lphModule=0x19d274, lpcbNeeded=0x19d270) returned 1 [0115.119] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x771d0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0115.119] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76720000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.DLL" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0115.119] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76910000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0115.120] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73e50000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")) returned 0x1f [0115.120] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x71560000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")) returned 0x1e [0115.120] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x6f8a0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")) returned 0x20 [0115.120] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76a90000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0115.121] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x6f880000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")) returned 0x1e [0115.121] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76c00000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0115.121] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73f00000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0115.122] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73ef0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0115.122] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76840000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")) returned 0x28 [0115.122] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76cb0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0115.123] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x71510000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\iphlpapi.dll" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")) returned 0x20 [0115.123] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73f30000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\Ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")) returned 0x1e [0115.124] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x74eb0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")) returned 0x1f [0115.124] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76800000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")) returned 0x20 [0115.125] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x745b0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")) returned 0x27 [0115.127] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x762b0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")) returned 0x1f [0115.128] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76600000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0115.128] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76d00000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0115.129] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x74ab0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0115.130] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x743d0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0115.130] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76d50000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")) returned 0x26 [0115.131] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x74520000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")) returned 0x1e [0115.132] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x76470000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")) returned 0x20 [0115.132] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x73f20000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")) returned 0x1f [0115.133] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x741b0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\syswow64\\imm32.dll")) returned 0x1d [0115.134] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x6f860000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")) returned 0x1b [0115.134] K32GetModuleFileNameExA (in: hProcess=0xffffffff, hModule=0x712e0000, lpFilename=0x19e274, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.DLL" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")) returned 0x1f [0115.135] CloseHandle (hObject=0xffffffff) returned 1 [0115.135] VirtualProtect (in: lpAddress=0x510000, dwSize=0x2bf20, flNewProtect=0x20, lpflOldProtect=0x19d26c | out: lpflOldProtect=0x19d26c*=0x40) returned 1 [0115.152] VirtualFree (lpAddress=0x4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.153] VirtualFree (lpAddress=0x4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.155] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x771d0000 [0115.156] LoadLibraryA (lpLibFileName="bcrypt.dll") returned 0x71560000 [0115.156] LoadLibraryA (lpLibFileName="netutils.dll") returned 0x6f8a0000 [0115.156] LoadLibraryA (lpLibFileName="srvcli.dll") returned 0x6f880000 [0115.156] LoadLibraryA (lpLibFileName="iphlpapi.dll") returned 0x71510000 [0115.156] LoadLibraryA (lpLibFileName="Ws2_32.dll") returned 0x73f30000 [0115.158] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74eb0000 [0115.158] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x6f860000 [0115.158] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x76600000 [0115.158] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe\" " [0115.158] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe\" ", pNumArgs=0x19de48 | out: pNumArgs=0x19de48) returned 0x728010*="C:\\Users\\RDhJ0CNFevzX\\Desktop\\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe" [0115.159] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x134d5cc, pszAlgId="RSA", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x134d5cc) returned 0x0 [0115.160] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x134d5c8, pszAlgId="RNG", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x134d5c8) returned 0x0 [0115.161] BCryptImportKeyPair (in: hAlgorithm=0x727478, hImportKey=0x0, pszBlobType="RSAPUBLICBLOB", phKey=0x134d5e8, pbInput=0x1349ae8, cbInput=0x41b, dwFlags=0x0 | out: phKey=0x134d5e8) returned 0x0 [0115.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2400, flAllocationType=0x1000, flProtect=0x204) returned 0x4d0000 [0115.162] VirtualAlloc (lpAddress=0x0, dwSize=0x8000000, flAllocationType=0x1000, flProtect=0x204) returned 0x2750000 [0115.167] VirtualAlloc (lpAddress=0x0, dwSize=0x7fff00, flAllocationType=0x1000, flProtect=0x4) returned 0xa750000 [0115.203] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0028, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0028) returned 0x0 [0115.228] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0070, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0070) returned 0x0 [0115.249] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d00b8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d00b8) returned 0x0 [0115.274] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0100, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0100) returned 0x0 [0115.291] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0148, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0148) returned 0x0 [0115.309] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0190, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0190) returned 0x0 [0115.327] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d01d8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d01d8) returned 0x0 [0115.346] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0220, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0220) returned 0x0 [0115.371] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0268, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0268) returned 0x0 [0115.388] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d02b0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d02b0) returned 0x0 [0115.406] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d02f8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d02f8) returned 0x0 [0115.425] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0340, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0340) returned 0x0 [0115.442] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0388, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0388) returned 0x0 [0115.460] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d03d0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d03d0) returned 0x0 [0115.477] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0418, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0418) returned 0x0 [0115.496] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0460, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0460) returned 0x0 [0115.524] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d04a8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d04a8) returned 0x0 [0115.541] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d04f0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d04f0) returned 0x0 [0115.562] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0538, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0538) returned 0x0 [0115.579] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0580, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0580) returned 0x0 [0115.608] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d05c8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d05c8) returned 0x0 [0115.632] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0610, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0610) returned 0x0 [0115.657] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0658, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0658) returned 0x0 [0115.676] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d06a0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d06a0) returned 0x0 [0115.700] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d06e8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d06e8) returned 0x0 [0115.727] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0730, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0730) returned 0x0 [0115.747] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0778, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0778) returned 0x0 [0115.768] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d07c0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d07c0) returned 0x0 [0115.790] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0808, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0808) returned 0x0 [0115.809] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0850, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0850) returned 0x0 [0115.827] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0898, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0898) returned 0x0 [0115.848] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d08e0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d08e0) returned 0x0 [0115.866] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0928, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0928) returned 0x0 [0115.887] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0970, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0970) returned 0x0 [0115.947] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d09b8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d09b8) returned 0x0 [0115.968] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0a00, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0a00) returned 0x0 [0115.986] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0a48, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0a48) returned 0x0 [0116.012] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0a90, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0a90) returned 0x0 [0116.030] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0ad8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0ad8) returned 0x0 [0116.050] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0b20, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0b20) returned 0x0 [0116.068] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0b68, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0b68) returned 0x0 [0116.086] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0bb0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0bb0) returned 0x0 [0116.105] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0bf8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0bf8) returned 0x0 [0116.122] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0c40, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0c40) returned 0x0 [0116.140] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0c88, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0c88) returned 0x0 [0116.160] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0cd0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0cd0) returned 0x0 [0116.178] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0d18, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0d18) returned 0x0 [0116.197] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0d60, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0d60) returned 0x0 [0116.215] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0da8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0da8) returned 0x0 [0116.239] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0df0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0df0) returned 0x0 [0116.289] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0e38, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0e38) returned 0x0 [0116.321] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0e80, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0e80) returned 0x0 [0116.347] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0ec8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0ec8) returned 0x0 [0116.365] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0f10, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0f10) returned 0x0 [0116.384] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0f58, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0f58) returned 0x0 [0116.401] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0fa0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0fa0) returned 0x0 [0116.419] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d0fe8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d0fe8) returned 0x0 [0116.440] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1030, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1030) returned 0x0 [0116.457] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1078, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1078) returned 0x0 [0116.475] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d10c0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d10c0) returned 0x0 [0116.494] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1108, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1108) returned 0x0 [0116.512] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1150, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1150) returned 0x0 [0116.552] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1198, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1198) returned 0x0 [0116.568] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d11e0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d11e0) returned 0x0 [0116.588] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1228, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1228) returned 0x0 [0116.605] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1270, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1270) returned 0x0 [0116.624] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d12b8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d12b8) returned 0x0 [0116.659] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1300, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1300) returned 0x0 [0116.683] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1348, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1348) returned 0x0 [0116.706] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1390, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1390) returned 0x0 [0116.776] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d13d8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d13d8) returned 0x0 [0116.798] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1420, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1420) returned 0x0 [0116.822] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1468, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1468) returned 0x0 [0116.845] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d14b0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d14b0) returned 0x0 [0116.868] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d14f8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d14f8) returned 0x0 [0116.890] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1540, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1540) returned 0x0 [0116.987] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1588, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1588) returned 0x0 [0117.009] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d15d0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d15d0) returned 0x0 [0117.037] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1618, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1618) returned 0x0 [0117.067] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1660, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1660) returned 0x0 [0117.097] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d16a8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d16a8) returned 0x0 [0117.148] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d16f0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d16f0) returned 0x0 [0117.172] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1738, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1738) returned 0x0 [0117.210] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1780, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1780) returned 0x0 [0117.235] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d17c8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d17c8) returned 0x0 [0117.287] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1810, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1810) returned 0x0 [0117.306] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1858, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1858) returned 0x0 [0117.331] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d18a0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d18a0) returned 0x0 [0117.353] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d18e8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d18e8) returned 0x0 [0117.383] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1930, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1930) returned 0x0 [0117.406] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1978, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1978) returned 0x0 [0117.430] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d19c0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d19c0) returned 0x0 [0117.450] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1a08, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1a08) returned 0x0 [0117.613] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1a50, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1a50) returned 0x0 [0117.638] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1a98, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1a98) returned 0x0 [0117.750] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1ae0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1ae0) returned 0x0 [0117.766] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1b28, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1b28) returned 0x0 [0117.783] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1b70, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1b70) returned 0x0 [0117.847] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1bb8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1bb8) returned 0x0 [0117.863] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1c00, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1c00) returned 0x0 [0118.001] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1c48, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1c48) returned 0x0 [0118.028] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1c90, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1c90) returned 0x0 [0118.126] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1cd8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1cd8) returned 0x0 [0118.190] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1d20, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1d20) returned 0x0 [0118.209] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1d68, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1d68) returned 0x0 [0118.233] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1db0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1db0) returned 0x0 [0118.251] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1df8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1df8) returned 0x0 [0118.277] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1e40, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1e40) returned 0x0 [0118.300] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1e88, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1e88) returned 0x0 [0118.325] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1ed0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1ed0) returned 0x0 [0118.347] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1f18, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1f18) returned 0x0 [0118.368] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1f60, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1f60) returned 0x0 [0118.387] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1fa8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1fa8) returned 0x0 [0118.406] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d1ff0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d1ff0) returned 0x0 [0118.428] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2038, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2038) returned 0x0 [0118.453] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2080, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2080) returned 0x0 [0118.477] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d20c8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d20c8) returned 0x0 [0118.505] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2110, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2110) returned 0x0 [0118.528] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2158, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2158) returned 0x0 [0118.549] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d21a0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d21a0) returned 0x0 [0118.569] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d21e8, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d21e8) returned 0x0 [0118.588] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2230, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2230) returned 0x0 [0118.607] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2278, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2278) returned 0x0 [0118.626] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d22c0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d22c0) returned 0x0 [0118.659] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2308, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2308) returned 0x0 [0118.680] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2350, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2350) returned 0x0 [0118.699] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d2398, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d2398) returned 0x0 [0118.718] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x4d23e0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x4d23e0) returned 0x0 [0118.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x132f960, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8 [0118.729] FindFirstVolumeW (in: lpszVolumeName=0x19a420, cchBufferLength=0x104 | out: lpszVolumeName="\\\\?\\Volume{4b139111-0000-0000-0000-100000000000}\\") returned 0x7398b0 [0118.730] GetDriveTypeW (lpRootPathName="\\\\?\\Volume{4b139111-0000-0000-0000-100000000000}\\") returned 0x3 [0118.730] GetVolumePathNamesForVolumeNameW (in: lpszVolumeName="\\\\?\\Volume{4b139111-0000-0000-0000-100000000000}\\", lpszVolumePathNames=0x19a010, cchBufferLength=0x208, lpcchReturnLength=0x19a00c | out: lpszVolumePathNames=0x19a010, lpcchReturnLength=0x19a00c) returned 1 [0118.731] FindNextVolumeW (in: hFindVolume=0x7398b0, lpszVolumeName=0x19a420, cchBufferLength=0x104 | out: hFindVolume=0x7398b0, lpszVolumeName="\\\\?\\Volume{4b139111-0000-0000-0000-100000000000}\\") returned 0 [0118.731] FindVolumeClose (hFindVolume=0x7398b0) returned 1 [0118.731] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0118.731] WNetGetUniversalNameW (in: lpLocalPath="A:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.743] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0118.744] WNetGetUniversalNameW (in: lpLocalPath="B:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.744] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0118.744] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x19a624, lpTotalNumberOfBytes=0x19a62c, lpTotalNumberOfFreeBytes=0x19a634 | out: lpFreeBytesAvailableToCaller=0x19a624, lpTotalNumberOfBytes=0x19a62c, lpTotalNumberOfFreeBytes=0x19a634) returned 1 [0118.745] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0118.745] WNetGetUniversalNameW (in: lpLocalPath="D:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.745] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0118.745] WNetGetUniversalNameW (in: lpLocalPath="E:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.746] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0118.746] WNetGetUniversalNameW (in: lpLocalPath="F:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.746] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0118.746] WNetGetUniversalNameW (in: lpLocalPath="G:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.747] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0118.747] WNetGetUniversalNameW (in: lpLocalPath="H:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.747] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0118.747] WNetGetUniversalNameW (in: lpLocalPath="I:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.747] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0118.748] WNetGetUniversalNameW (in: lpLocalPath="J:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.748] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0118.748] WNetGetUniversalNameW (in: lpLocalPath="K:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.748] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0118.749] WNetGetUniversalNameW (in: lpLocalPath="L:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.749] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0118.749] WNetGetUniversalNameW (in: lpLocalPath="M:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.749] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0118.750] WNetGetUniversalNameW (in: lpLocalPath="N:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.750] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0118.750] WNetGetUniversalNameW (in: lpLocalPath="O:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.750] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0118.750] WNetGetUniversalNameW (in: lpLocalPath="P:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.751] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0118.751] WNetGetUniversalNameW (in: lpLocalPath="Q:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.751] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0118.751] WNetGetUniversalNameW (in: lpLocalPath="R:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.752] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0118.752] WNetGetUniversalNameW (in: lpLocalPath="S:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.752] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0118.752] WNetGetUniversalNameW (in: lpLocalPath="T:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.753] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0118.753] WNetGetUniversalNameW (in: lpLocalPath="U:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.753] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0118.753] WNetGetUniversalNameW (in: lpLocalPath="V:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.754] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0118.754] WNetGetUniversalNameW (in: lpLocalPath="W:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.754] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0118.754] WNetGetUniversalNameW (in: lpLocalPath="X:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.755] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0118.755] WNetGetUniversalNameW (in: lpLocalPath="Y:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x8ca [0118.756] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0118.756] WNetGetUniversalNameW (in: lpLocalPath="Z:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x4b1 [0121.204] GetDiskFreeSpaceExW (in: lpDirectoryName="Z:\\", lpFreeBytesAvailableToCaller=0x19a624, lpTotalNumberOfBytes=0x19a62c, lpTotalNumberOfFreeBytes=0x19a634 | out: lpFreeBytesAvailableToCaller=0x19a624, lpTotalNumberOfBytes=0x19a62c, lpTotalNumberOfFreeBytes=0x19a634) returned 0 [0121.204] GetDriveTypeW (lpRootPathName="[:\\") returned 0x1 [0121.204] WNetGetUniversalNameW (in: lpLocalPath="[:\\", dwInfoLevel=0x2, lpBuffer=0x19a744, lpBufferSize=0x19a740 | out: lpBuffer=0x19a744, lpBufferSize=0x19a740) returned 0x4b0 [0121.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x132b290, lpParameter=0x19e2e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0121.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x132b290, lpParameter=0x19e2ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0121.205] WaitForMultipleObjects (nCount=0x2, lpHandles=0x19e3bc*=0x1c0, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xe74 Thread: id = 3 os_tid = 0xe60 [0118.764] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000 [0118.764] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x90fd8c | out: AdapterInfo=0x0, SizePointer=0x90fd8c) returned 0x6f [0119.478] GetProcessHeap () returned 0x710000 [0119.478] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x280) returned 0x73f820 [0119.478] GetAdaptersInfo (in: AdapterInfo=0x73f820, SizePointer=0x90fd8c | out: AdapterInfo=0x73f820, SizePointer=0x90fd8c) returned 0x0 [0119.480] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0119.481] inet_addr (cp="255.255.255.0") returned 0xffffff [0119.481] GetProcessHeap () returned 0x710000 [0119.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x710000) returned 1 [0119.481] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0119.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0119.482] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x204, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0121.206] CloseHandle (hObject=0x204) returned 1 [0121.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0121.207] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x204, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0124.736] CloseHandle (hObject=0x204) returned 1 [0124.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0124.788] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x204, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0130.151] CloseHandle (hObject=0x204) returned 1 [0130.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0130.152] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0xffffffff) returned 0x0 [0133.178] CloseHandle (hObject=0x204) returned 1 [0133.179] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x90fb04 | out: lpWSAData=0x90fb04) returned 0 [0133.187] WSACleanup () returned 0 [0133.634] VirtualFree (lpAddress=0x4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.638] VirtualFree (lpAddress=0x4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.643] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000 [0133.645] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x90fd8c | out: AdapterInfo=0x0, SizePointer=0x90fd8c) returned 0x6f [0133.651] GetProcessHeap () returned 0x710000 [0133.651] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x280) returned 0x78a758 [0133.652] GetAdaptersInfo (in: AdapterInfo=0x78a758, SizePointer=0x90fd8c | out: AdapterInfo=0x78a758, SizePointer=0x90fd8c) returned 0x0 [0133.657] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0133.657] inet_addr (cp="255.255.255.0") returned 0xffffff [0133.657] GetProcessHeap () returned 0x710000 [0133.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x710000) returned 1 [0133.657] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0133.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0133.660] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x8a8, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0135.363] CloseHandle (hObject=0x8a8) returned 1 [0135.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0135.364] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x8a8, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0137.033] CloseHandle (hObject=0x8a8) returned 1 [0137.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0137.034] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x8a8, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0138.498] CloseHandle (hObject=0x8a8) returned 1 [0138.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0138.499] WaitForSingleObject (hHandle=0x8a8, dwMilliseconds=0xffffffff) returned 0x0 [0139.944] CloseHandle (hObject=0x8a8) returned 1 [0139.944] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x90fb04 | out: lpWSAData=0x90fb04) returned 0 [0139.989] WSACleanup () returned 0 [0140.041] VirtualFree (lpAddress=0x4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.043] VirtualFree (lpAddress=0x4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.045] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000 [0140.047] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x90fd8c | out: AdapterInfo=0x0, SizePointer=0x90fd8c) returned 0x6f [0140.050] GetProcessHeap () returned 0x710000 [0140.050] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x280) returned 0x7cdfe8 [0140.050] GetAdaptersInfo (in: AdapterInfo=0x7cdfe8, SizePointer=0x90fd8c | out: AdapterInfo=0x7cdfe8, SizePointer=0x90fd8c) returned 0x0 [0140.052] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0140.053] inet_addr (cp="255.255.255.0") returned 0xffffff [0140.053] GetProcessHeap () returned 0x710000 [0140.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x710000) returned 1 [0140.053] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0140.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0140.055] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x384, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0141.737] CloseHandle (hObject=0x384) returned 1 [0141.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0141.738] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x384, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0143.514] CloseHandle (hObject=0x384) returned 1 [0143.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0143.515] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x384, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0145.056] CloseHandle (hObject=0x384) returned 1 [0145.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0145.100] WaitForSingleObject (hHandle=0xa2c, dwMilliseconds=0xffffffff) returned 0x0 [0146.718] CloseHandle (hObject=0xa2c) returned 1 [0146.718] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x90fb04 | out: lpWSAData=0x90fb04) returned 0 [0146.724] WSACleanup () returned 0 [0146.729] VirtualFree (lpAddress=0x4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.730] VirtualFree (lpAddress=0x4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.731] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000 [0146.731] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x90fd8c | out: AdapterInfo=0x0, SizePointer=0x90fd8c) returned 0x6f [0146.735] GetProcessHeap () returned 0x710000 [0146.735] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x280) returned 0x7ce270 [0146.735] GetAdaptersInfo (in: AdapterInfo=0x7ce270, SizePointer=0x90fd8c | out: AdapterInfo=0x7ce270, SizePointer=0x90fd8c) returned 0x0 [0146.741] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0146.741] inet_addr (cp="255.255.255.0") returned 0xffffff [0146.741] GetProcessHeap () returned 0x710000 [0146.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x710000) returned 1 [0146.741] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0146.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0146.743] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0xadc, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0147.202] CloseHandle (hObject=0xadc) returned 1 [0147.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0147.203] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0xadc, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0147.713] CloseHandle (hObject=0xadc) returned 1 [0147.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0147.714] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0xadc, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0150.093] CloseHandle (hObject=0xadc) returned 1 [0150.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0150.104] WaitForSingleObject (hHandle=0xadc, dwMilliseconds=0xffffffff) returned 0x0 [0153.606] CloseHandle (hObject=0xadc) returned 1 [0153.606] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x90fb04 | out: lpWSAData=0x90fb04) returned 0 [0153.614] WSACleanup () returned 0 [0154.591] VirtualFree (lpAddress=0x4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.593] VirtualFree (lpAddress=0x4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.594] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000 [0154.595] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x90fd8c | out: AdapterInfo=0x0, SizePointer=0x90fd8c) returned 0x6f [0154.598] GetProcessHeap () returned 0x710000 [0154.598] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x280) returned 0x73fca0 [0154.598] GetAdaptersInfo (in: AdapterInfo=0x73fca0, SizePointer=0x90fd8c | out: AdapterInfo=0x73fca0, SizePointer=0x90fd8c) returned 0x0 [0154.601] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0154.601] inet_addr (cp="255.255.255.0") returned 0xffffff [0154.601] GetProcessHeap () returned 0x710000 [0154.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x710000) returned 1 [0154.601] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0154.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0154.603] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x568, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0157.733] CloseHandle (hObject=0x568) returned 1 [0157.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0157.734] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x568, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0160.601] CloseHandle (hObject=0x568) returned 1 [0160.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0160.601] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x568, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0164.907] CloseHandle (hObject=0x568) returned 1 [0164.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0164.908] WaitForSingleObject (hHandle=0x568, dwMilliseconds=0xffffffff) returned 0x0 [0167.053] CloseHandle (hObject=0x568) returned 1 [0167.054] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x90fb04 | out: lpWSAData=0x90fb04) returned 0 [0167.058] WSACleanup () returned 0 [0167.066] VirtualFree (lpAddress=0x4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.071] VirtualFree (lpAddress=0x4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.074] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000 [0167.075] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x90fd8c | out: AdapterInfo=0x0, SizePointer=0x90fd8c) returned 0x6f [0167.080] GetProcessHeap () returned 0x710000 [0167.080] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x280) returned 0x73ff28 [0167.080] GetAdaptersInfo (in: AdapterInfo=0x73ff28, SizePointer=0x90fd8c | out: AdapterInfo=0x73ff28, SizePointer=0x90fd8c) returned 0x0 [0167.082] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0167.082] inet_addr (cp="255.255.255.0") returned 0xffffff [0167.082] GetProcessHeap () returned 0x710000 [0167.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x710000) returned 1 [0167.082] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0167.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0167.084] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x1540, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0173.645] CloseHandle (hObject=0x1540) returned 1 [0173.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0173.645] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x1540, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0176.857] CloseHandle (hObject=0x1540) returned 1 [0176.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0176.864] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x1540, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0180.797] CloseHandle (hObject=0x1540) returned 1 [0180.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0180.798] WaitForSingleObject (hHandle=0x1540, dwMilliseconds=0xffffffff) returned 0x0 [0186.752] CloseHandle (hObject=0x1540) returned 1 [0186.752] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x90fb04 | out: lpWSAData=0x90fb04) returned 0 [0186.757] WSACleanup () returned 0 [0187.886] VirtualFree (lpAddress=0x4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.891] VirtualFree (lpAddress=0x4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.894] VirtualAlloc (lpAddress=0x0, dwSize=0x258, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000 [0187.909] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x90fd8c | out: AdapterInfo=0x0, SizePointer=0x90fd8c) returned 0x6f [0187.913] GetProcessHeap () returned 0x710000 [0187.913] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x280) returned 0x73ccf0 [0187.913] GetAdaptersInfo (in: AdapterInfo=0x73ccf0, SizePointer=0x90fd8c | out: AdapterInfo=0x73ccf0, SizePointer=0x90fd8c) returned 0x0 [0187.916] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0187.916] inet_addr (cp="255.255.255.0") returned 0xffffff [0187.917] GetProcessHeap () returned 0x710000 [0187.917] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x710000) returned 1 [0187.917] VirtualAlloc (lpAddress=0x0, dwSize=0xbf4, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000 [0187.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0189.098] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x768, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0193.627] CloseHandle (hObject=0x768) returned 1 [0193.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0193.628] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x768, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0200.645] CloseHandle (hObject=0x768) returned 1 [0200.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13336c0, lpParameter=0x90fd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0200.646] WaitForMultipleObjects (nCount=0x1, lpHandles=0x90fd8c*=0x768, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0xe44 [0119.484] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x500000 [0119.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0119.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f000c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0119.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0119.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0024, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0119.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0119.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f003c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0119.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0119.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0054, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0119.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0119.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f006c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0119.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0119.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0084, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0119.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0119.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f009c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0119.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0119.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0119.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0119.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0119.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0119.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0119.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0119.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0119.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0119.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0114, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0119.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0119.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f012c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0119.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0119.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0144, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0119.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0119.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f015c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0119.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0119.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0174, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0119.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0119.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f018c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0119.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0119.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0119.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0119.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0119.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0119.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0119.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0119.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0119.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0119.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0204, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0119.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0119.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f021c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0119.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0119.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0234, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0119.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0119.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f024c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0119.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0119.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0264, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0119.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0119.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f027c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0119.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0119.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0294, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0119.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0119.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0119.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0119.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0119.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0119.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0119.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308 [0119.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0119.716] WaitForMultipleObjects (nCount=0x40, lpHandles=0x500000*=0x200, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0121.192] CloseHandle (hObject=0x200) returned 1 [0121.192] CloseHandle (hObject=0x208) returned 1 [0121.192] CloseHandle (hObject=0x20c) returned 1 [0121.192] CloseHandle (hObject=0x210) returned 1 [0121.192] CloseHandle (hObject=0x214) returned 1 [0121.193] CloseHandle (hObject=0x218) returned 1 [0121.193] CloseHandle (hObject=0x21c) returned 1 [0121.193] CloseHandle (hObject=0x220) returned 1 [0121.193] CloseHandle (hObject=0x224) returned 1 [0121.193] CloseHandle (hObject=0x228) returned 1 [0121.193] CloseHandle (hObject=0x22c) returned 1 [0121.193] CloseHandle (hObject=0x230) returned 1 [0121.193] CloseHandle (hObject=0x234) returned 1 [0121.193] CloseHandle (hObject=0x238) returned 1 [0121.193] CloseHandle (hObject=0x23c) returned 1 [0121.194] CloseHandle (hObject=0x240) returned 1 [0121.194] CloseHandle (hObject=0x244) returned 1 [0121.194] CloseHandle (hObject=0x248) returned 1 [0121.194] CloseHandle (hObject=0x24c) returned 1 [0121.194] CloseHandle (hObject=0x250) returned 1 [0121.194] CloseHandle (hObject=0x254) returned 1 [0121.194] CloseHandle (hObject=0x258) returned 1 [0121.194] CloseHandle (hObject=0x25c) returned 1 [0121.194] CloseHandle (hObject=0x260) returned 1 [0121.194] CloseHandle (hObject=0x264) returned 1 [0121.195] CloseHandle (hObject=0x268) returned 1 [0121.195] CloseHandle (hObject=0x26c) returned 1 [0121.195] CloseHandle (hObject=0x270) returned 1 [0121.195] CloseHandle (hObject=0x274) returned 1 [0121.195] CloseHandle (hObject=0x278) returned 1 [0121.195] CloseHandle (hObject=0x27c) returned 1 [0121.195] CloseHandle (hObject=0x280) returned 1 [0121.195] CloseHandle (hObject=0x284) returned 1 [0121.195] CloseHandle (hObject=0x288) returned 1 [0121.195] CloseHandle (hObject=0x28c) returned 1 [0121.196] CloseHandle (hObject=0x290) returned 1 [0121.196] CloseHandle (hObject=0x294) returned 1 [0121.196] CloseHandle (hObject=0x298) returned 1 [0121.196] CloseHandle (hObject=0x29c) returned 1 [0121.196] CloseHandle (hObject=0x2a0) returned 1 [0121.196] CloseHandle (hObject=0x2a4) returned 1 [0121.196] CloseHandle (hObject=0x2a8) returned 1 [0121.196] CloseHandle (hObject=0x2ac) returned 1 [0121.196] CloseHandle (hObject=0x2b8) returned 1 [0121.196] CloseHandle (hObject=0x2c0) returned 1 [0121.196] CloseHandle (hObject=0x2c4) returned 1 [0121.196] CloseHandle (hObject=0x2c8) returned 1 [0121.196] CloseHandle (hObject=0x2cc) returned 1 [0121.196] CloseHandle (hObject=0x2d0) returned 1 [0121.196] CloseHandle (hObject=0x2d4) returned 1 [0121.196] CloseHandle (hObject=0x2d8) returned 1 [0121.196] CloseHandle (hObject=0x2dc) returned 1 [0121.196] CloseHandle (hObject=0x2e0) returned 1 [0121.196] CloseHandle (hObject=0x2e4) returned 1 [0121.196] CloseHandle (hObject=0x2e8) returned 1 [0121.197] CloseHandle (hObject=0x2ec) returned 1 [0121.197] CloseHandle (hObject=0x2f0) returned 1 [0121.197] CloseHandle (hObject=0x2f4) returned 1 [0121.197] CloseHandle (hObject=0x2f8) returned 1 [0121.197] CloseHandle (hObject=0x2fc) returned 1 [0121.197] CloseHandle (hObject=0x300) returned 1 [0121.197] CloseHandle (hObject=0x304) returned 1 [0121.197] CloseHandle (hObject=0x308) returned 1 [0121.197] CloseHandle (hObject=0x30c) returned 1 [0121.197] VirtualFree (lpAddress=0x500000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 5 os_tid = 0xd78 [0119.530] GetLastError () returned 0x57 [0119.530] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73fec8 [0119.530] SetLastError (dwErrCode=0x57) [0119.530] IcmpCreateFile () returned 0x728ac8 [0121.102] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765428 [0121.102] IcmpSendEcho2 (in: IcmpHandle=0x728ac8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x100a8c0, RequestData=0xe9ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765428, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765428) returned 0x0 [0135.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765428 | out: hHeap=0x710000) returned 1 [0135.808] IcmpCloseHandle (IcmpHandle=0x728ac8) returned 1 [0135.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73fec8 | out: hHeap=0x710000) returned 1 Thread: id = 6 os_tid = 0xe54 [0119.729] GetLastError () returned 0x57 [0119.729] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73a6e8 [0119.729] SetLastError (dwErrCode=0x57) [0119.729] IcmpCreateFile () returned 0x728a90 [0120.745] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73ddd8 [0120.877] IcmpSendEcho2 (in: IcmpHandle=0x728a90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x200a8c0, RequestData=0xfdff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73ddd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73ddd8) returned 0x0 [0135.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73ddd8 | out: hHeap=0x710000) returned 1 [0135.822] IcmpCloseHandle (IcmpHandle=0x728a90) returned 1 [0135.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73a6e8 | out: hHeap=0x710000) returned 1 Thread: id = 7 os_tid = 0xd80 [0119.730] GetLastError () returned 0x57 [0119.730] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73ac68 [0119.730] SetLastError (dwErrCode=0x57) [0119.730] IcmpCreateFile () returned 0x728b00 [0121.102] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7652e8 [0121.102] IcmpSendEcho2 (in: IcmpHandle=0x728b00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x300a8c0, RequestData=0x111ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7652e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7652e8) returned 0x0 [0135.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7652e8 | out: hHeap=0x710000) returned 1 [0135.733] IcmpCloseHandle (IcmpHandle=0x728b00) returned 1 [0135.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73ac68 | out: hHeap=0x710000) returned 1 Thread: id = 8 os_tid = 0xe50 [0119.730] GetLastError () returned 0x57 [0119.730] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73b1e8 [0119.731] SetLastError (dwErrCode=0x57) [0119.731] IcmpCreateFile () returned 0x728b38 [0121.101] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765838 [0121.101] IcmpSendEcho2 (in: IcmpHandle=0x728b38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x400a8c0, RequestData=0x125ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765838, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765838) returned 0x0 [0135.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765838 | out: hHeap=0x710000) returned 1 [0135.720] IcmpCloseHandle (IcmpHandle=0x728b38) returned 1 [0135.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73b1e8 | out: hHeap=0x710000) returned 1 Thread: id = 9 os_tid = 0xe40 [0119.731] GetLastError () returned 0x57 [0119.731] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73b768 [0119.731] SetLastError (dwErrCode=0x57) [0119.731] IcmpCreateFile () returned 0x7287b8 [0121.100] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7657e8 [0121.100] IcmpSendEcho2 (in: IcmpHandle=0x7287b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x500a8c0, RequestData=0xb04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7657e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7657e8) returned 0x0 [0135.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7657e8 | out: hHeap=0x710000) returned 1 [0135.706] IcmpCloseHandle (IcmpHandle=0x7287b8) returned 1 [0135.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73b768 | out: hHeap=0x710000) returned 1 Thread: id = 10 os_tid = 0xdd4 [0119.731] GetLastError () returned 0x57 [0119.731] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73bce8 [0119.731] SetLastError (dwErrCode=0x57) [0119.731] IcmpCreateFile () returned 0x728ba8 [0121.099] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765798 [0121.099] IcmpSendEcho2 (in: IcmpHandle=0x728ba8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x600a8c0, RequestData=0xb14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765798, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765798) returned 0x0 [0135.498] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765798 | out: hHeap=0x710000) returned 1 [0135.498] IcmpCloseHandle (IcmpHandle=0x728ba8) returned 1 [0135.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bce8 | out: hHeap=0x710000) returned 1 Thread: id = 11 os_tid = 0xdd0 [0119.731] GetLastError () returned 0x57 [0119.731] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73c268 [0119.731] SetLastError (dwErrCode=0x57) [0119.732] IcmpCreateFile () returned 0x728c18 [0121.098] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7656f8 [0121.098] IcmpSendEcho2 (in: IcmpHandle=0x728c18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x700a8c0, RequestData=0xb24ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7656f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7656f8) returned 0x0 [0135.359] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7656f8 | out: hHeap=0x710000) returned 1 [0135.359] IcmpCloseHandle (IcmpHandle=0x728c18) returned 1 [0135.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c268 | out: hHeap=0x710000) returned 1 Thread: id = 12 os_tid = 0xdcc [0119.732] GetLastError () returned 0x57 [0119.732] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73c7e8 [0119.732] SetLastError (dwErrCode=0x57) [0119.732] IcmpCreateFile () returned 0x728828 [0121.097] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765748 [0121.098] IcmpSendEcho2 (in: IcmpHandle=0x728828, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x800a8c0, RequestData=0xb38ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765748, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765748) returned 0x0 [0135.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765748 | out: hHeap=0x710000) returned 1 [0135.231] IcmpCloseHandle (IcmpHandle=0x728828) returned 1 [0135.232] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c7e8 | out: hHeap=0x710000) returned 1 Thread: id = 13 os_tid = 0xdb0 [0119.732] GetLastError () returned 0x57 [0119.732] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x73cd68 [0119.732] SetLastError (dwErrCode=0x57) [0119.732] IcmpCreateFile () returned 0x728cc0 [0121.097] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7656a8 [0121.097] IcmpSendEcho2 (in: IcmpHandle=0x728cc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x900a8c0, RequestData=0xb4cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7656a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7656a8) returned 0x0 [0135.131] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7656a8 | out: hHeap=0x710000) returned 1 [0135.131] IcmpCloseHandle (IcmpHandle=0x728cc0) returned 1 [0135.132] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73cd68 | out: hHeap=0x710000) returned 1 Thread: id = 14 os_tid = 0xda8 [0119.732] GetLastError () returned 0x57 [0119.732] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x740e48 [0119.733] SetLastError (dwErrCode=0x57) [0119.733] IcmpCreateFile () returned 0x728cf8 [0121.096] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765658 [0121.096] IcmpSendEcho2 (in: IcmpHandle=0x728cf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa00a8c0, RequestData=0xb60ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765658, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765658) returned 0x0 [0135.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765658 | out: hHeap=0x710000) returned 1 [0135.073] IcmpCloseHandle (IcmpHandle=0x728cf8) returned 1 [0135.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x740e48 | out: hHeap=0x710000) returned 1 Thread: id = 15 os_tid = 0xdc8 [0119.733] GetLastError () returned 0x57 [0119.733] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7413c8 [0119.733] SetLastError (dwErrCode=0x57) [0119.733] IcmpCreateFile () returned 0x728d30 [0121.095] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765608 [0121.095] IcmpSendEcho2 (in: IcmpHandle=0x728d30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb00a8c0, RequestData=0xb74ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765608, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765608) returned 0x0 [0134.976] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765608 | out: hHeap=0x710000) returned 1 [0134.976] IcmpCloseHandle (IcmpHandle=0x728d30) returned 1 [0134.976] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7413c8 | out: hHeap=0x710000) returned 1 Thread: id = 16 os_tid = 0xd9c [0119.734] GetLastError () returned 0x57 [0119.734] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x741948 [0119.734] SetLastError (dwErrCode=0x57) [0119.734] IcmpCreateFile () returned 0x728d68 [0121.094] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7655b8 [0121.094] IcmpSendEcho2 (in: IcmpHandle=0x728d68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc00a8c0, RequestData=0xb88ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7655b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7655b8) returned 0x0 [0134.920] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7655b8 | out: hHeap=0x710000) returned 1 [0134.920] IcmpCloseHandle (IcmpHandle=0x728d68) returned 1 [0134.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x741948 | out: hHeap=0x710000) returned 1 Thread: id = 17 os_tid = 0xd98 [0119.734] GetLastError () returned 0x57 [0119.734] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x741ec8 [0119.734] SetLastError (dwErrCode=0x57) [0119.734] IcmpCreateFile () returned 0x728da0 [0121.093] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765568 [0121.093] IcmpSendEcho2 (in: IcmpHandle=0x728da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd00a8c0, RequestData=0xb9cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765568, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765568) returned 0x0 [0134.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765568 | out: hHeap=0x710000) returned 1 [0134.688] IcmpCloseHandle (IcmpHandle=0x728da0) returned 1 [0134.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x741ec8 | out: hHeap=0x710000) returned 1 Thread: id = 18 os_tid = 0xdb4 [0119.735] GetLastError () returned 0x57 [0119.735] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x744240 [0119.735] SetLastError (dwErrCode=0x57) [0119.735] IcmpCreateFile () returned 0x728a58 [0121.093] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7654c8 [0121.093] IcmpSendEcho2 (in: IcmpHandle=0x728a58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe00a8c0, RequestData=0xbb0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7654c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7654c8) returned 0x0 [0134.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7654c8 | out: hHeap=0x710000) returned 1 [0134.590] IcmpCloseHandle (IcmpHandle=0x728a58) returned 1 [0134.591] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x744240 | out: hHeap=0x710000) returned 1 Thread: id = 19 os_tid = 0xd94 [0119.737] GetLastError () returned 0x57 [0119.737] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7445b0 [0119.737] SetLastError (dwErrCode=0x57) [0119.737] IcmpCreateFile () returned 0x728860 [0121.092] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7648e8 [0121.092] IcmpSendEcho2 (in: IcmpHandle=0x728860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf00a8c0, RequestData=0xbc4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7648e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7648e8) returned 0x0 [0134.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7648e8 | out: hHeap=0x710000) returned 1 [0134.484] IcmpCloseHandle (IcmpHandle=0x728860) returned 1 [0134.485] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7445b0 | out: hHeap=0x710000) returned 1 Thread: id = 20 os_tid = 0xd88 [0119.737] GetLastError () returned 0x57 [0119.737] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x744920 [0119.738] SetLastError (dwErrCode=0x57) [0119.738] IcmpCreateFile () returned 0x728898 [0121.091] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765298 [0121.091] IcmpSendEcho2 (in: IcmpHandle=0x728898, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1000a8c0, RequestData=0xbd8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765298, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765298) returned 0x0 [0134.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765298 | out: hHeap=0x710000) returned 1 [0134.435] IcmpCloseHandle (IcmpHandle=0x728898) returned 1 [0134.436] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x744920 | out: hHeap=0x710000) returned 1 Thread: id = 21 os_tid = 0xd84 [0119.738] GetLastError () returned 0x57 [0119.738] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x745ad8 [0119.738] SetLastError (dwErrCode=0x57) [0119.738] IcmpCreateFile () returned 0x7286d8 [0121.090] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765248 [0121.090] IcmpSendEcho2 (in: IcmpHandle=0x7286d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1100a8c0, RequestData=0xbecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765248, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765248) returned 0x0 [0134.385] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765248 | out: hHeap=0x710000) returned 1 [0134.385] IcmpCloseHandle (IcmpHandle=0x7286d8) returned 1 [0134.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x745ad8 | out: hHeap=0x710000) returned 1 Thread: id = 22 os_tid = 0xd74 [0119.738] GetLastError () returned 0x57 [0119.738] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x746570 [0119.739] SetLastError (dwErrCode=0x57) [0119.739] IcmpCreateFile () returned 0x728748 [0121.089] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7651f8 [0121.089] IcmpSendEcho2 (in: IcmpHandle=0x728748, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1200a8c0, RequestData=0xc00ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7651f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7651f8) returned 0x0 [0134.297] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7651f8 | out: hHeap=0x710000) returned 1 [0134.297] IcmpCloseHandle (IcmpHandle=0x728748) returned 1 [0134.298] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x746570 | out: hHeap=0x710000) returned 1 Thread: id = 23 os_tid = 0xfc4 [0119.739] GetLastError () returned 0x57 [0119.739] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7468f8 [0119.739] SetLastError (dwErrCode=0x57) [0119.739] IcmpCreateFile () returned 0x728780 [0121.089] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7651a8 [0121.089] IcmpSendEcho2 (in: IcmpHandle=0x728780, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1300a8c0, RequestData=0xc14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7651a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7651a8) returned 0x0 [0134.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7651a8 | out: hHeap=0x710000) returned 1 [0134.248] IcmpCloseHandle (IcmpHandle=0x728780) returned 1 [0134.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7468f8 | out: hHeap=0x710000) returned 1 Thread: id = 24 os_tid = 0x864 [0119.739] GetLastError () returned 0x57 [0119.739] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x744cb8 [0119.740] SetLastError (dwErrCode=0x57) [0119.740] IcmpCreateFile () returned 0x7288d0 [0121.088] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765158 [0121.088] IcmpSendEcho2 (in: IcmpHandle=0x7288d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1400a8c0, RequestData=0xc28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765158, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765158) returned 0x0 [0134.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765158 | out: hHeap=0x710000) returned 1 [0134.217] IcmpCloseHandle (IcmpHandle=0x7288d0) returned 1 [0134.218] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x744cb8 | out: hHeap=0x710000) returned 1 Thread: id = 25 os_tid = 0x1060 [0119.740] GetLastError () returned 0x57 [0119.740] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x745040 [0119.740] SetLastError (dwErrCode=0x57) [0119.740] IcmpCreateFile () returned 0x728908 [0121.087] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765108 [0121.087] IcmpSendEcho2 (in: IcmpHandle=0x728908, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1500a8c0, RequestData=0xc3cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765108, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765108) returned 0x0 [0134.187] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765108 | out: hHeap=0x710000) returned 1 [0134.187] IcmpCloseHandle (IcmpHandle=0x728908) returned 1 [0134.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x745040 | out: hHeap=0x710000) returned 1 Thread: id = 26 os_tid = 0x105c [0119.740] GetLastError () returned 0x57 [0119.740] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7453c8 [0119.740] SetLastError (dwErrCode=0x57) [0119.740] IcmpCreateFile () returned 0x728940 [0121.086] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7650b8 [0121.086] IcmpSendEcho2 (in: IcmpHandle=0x728940, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1600a8c0, RequestData=0xc50ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7650b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7650b8) returned 0x0 [0134.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7650b8 | out: hHeap=0x710000) returned 1 [0134.176] IcmpCloseHandle (IcmpHandle=0x728940) returned 1 [0134.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7453c8 | out: hHeap=0x710000) returned 1 Thread: id = 27 os_tid = 0x1058 [0119.740] GetLastError () returned 0x57 [0119.740] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x745750 [0119.741] SetLastError (dwErrCode=0x57) [0119.741] IcmpCreateFile () returned 0x728978 [0121.085] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765068 [0121.085] IcmpSendEcho2 (in: IcmpHandle=0x728978, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1700a8c0, RequestData=0xc64ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765068, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765068) returned 0x0 [0134.169] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765068 | out: hHeap=0x710000) returned 1 [0134.169] IcmpCloseHandle (IcmpHandle=0x728978) returned 1 [0134.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x745750 | out: hHeap=0x710000) returned 1 Thread: id = 28 os_tid = 0x1050 [0119.741] GetLastError () returned 0x57 [0119.741] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x745e60 [0119.741] SetLastError (dwErrCode=0x57) [0119.741] IcmpCreateFile () returned 0x7289b0 [0121.085] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765018 [0121.085] IcmpSendEcho2 (in: IcmpHandle=0x7289b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1800a8c0, RequestData=0xc78ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765018, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765018) returned 0x0 [0134.098] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765018 | out: hHeap=0x710000) returned 1 [0134.099] IcmpCloseHandle (IcmpHandle=0x7289b0) returned 1 [0134.099] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x745e60 | out: hHeap=0x710000) returned 1 Thread: id = 29 os_tid = 0x104c [0119.741] GetLastError () returned 0x57 [0119.741] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7461e8 [0119.741] SetLastError (dwErrCode=0x57) [0119.741] IcmpCreateFile () returned 0x728e48 [0121.084] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764fc8 [0121.084] IcmpSendEcho2 (in: IcmpHandle=0x728e48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1900a8c0, RequestData=0xc8cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764fc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764fc8) returned 0x0 [0134.093] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764fc8 | out: hHeap=0x710000) returned 1 [0134.093] IcmpCloseHandle (IcmpHandle=0x728e48) returned 1 [0134.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7461e8 | out: hHeap=0x710000) returned 1 Thread: id = 30 os_tid = 0x128 [0119.741] GetLastError () returned 0x57 [0119.741] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x74a1b8 [0119.742] SetLastError (dwErrCode=0x57) [0119.742] IcmpCreateFile () returned 0x728dd8 [0121.083] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764f78 [0121.083] IcmpSendEcho2 (in: IcmpHandle=0x728dd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1a00a8c0, RequestData=0xca0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764f78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764f78) returned 0x0 [0134.088] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764f78 | out: hHeap=0x710000) returned 1 [0134.088] IcmpCloseHandle (IcmpHandle=0x728dd8) returned 1 [0134.089] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74a1b8 | out: hHeap=0x710000) returned 1 Thread: id = 31 os_tid = 0x4f8 [0119.742] GetLastError () returned 0x57 [0119.742] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x74a540 [0119.742] SetLastError (dwErrCode=0x57) [0119.742] IcmpCreateFile () returned 0x728e10 [0121.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764f28 [0121.082] IcmpSendEcho2 (in: IcmpHandle=0x728e10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b00a8c0, RequestData=0xcb4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764f28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764f28) returned 0x0 [0134.083] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764f28 | out: hHeap=0x710000) returned 1 [0134.083] IcmpCloseHandle (IcmpHandle=0x728e10) returned 1 [0134.084] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74a540 | out: hHeap=0x710000) returned 1 Thread: id = 32 os_tid = 0x538 [0119.743] GetLastError () returned 0x57 [0119.743] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749398 [0119.743] SetLastError (dwErrCode=0x57) [0119.743] IcmpCreateFile () returned 0x724be8 [0121.081] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764c08 [0121.081] IcmpSendEcho2 (in: IcmpHandle=0x724be8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1c00a8c0, RequestData=0xcc8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764c08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764c08) returned 0x0 [0134.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764c08 | out: hHeap=0x710000) returned 1 [0134.078] IcmpCloseHandle (IcmpHandle=0x724be8) returned 1 [0134.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749398 | out: hHeap=0x710000) returned 1 Thread: id = 33 os_tid = 0x2d8 [0119.743] GetLastError () returned 0x57 [0119.743] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x74a8c8 [0119.743] SetLastError (dwErrCode=0x57) [0119.743] IcmpCreateFile () returned 0x74ed48 [0121.080] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764bb8 [0121.080] IcmpSendEcho2 (in: IcmpHandle=0x74ed48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1d00a8c0, RequestData=0xcdcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764bb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764bb8) returned 0x0 [0134.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764bb8 | out: hHeap=0x710000) returned 1 [0134.072] IcmpCloseHandle (IcmpHandle=0x74ed48) returned 1 [0134.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74a8c8 | out: hHeap=0x710000) returned 1 Thread: id = 34 os_tid = 0x674 [0119.744] GetLastError () returned 0x57 [0119.744] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749e30 [0119.744] SetLastError (dwErrCode=0x57) [0119.744] IcmpCreateFile () returned 0x74ed80 [0121.079] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764b68 [0121.079] IcmpSendEcho2 (in: IcmpHandle=0x74ed80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1e00a8c0, RequestData=0xcf0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764b68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764b68) returned 0x0 [0134.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764b68 | out: hHeap=0x710000) returned 1 [0134.066] IcmpCloseHandle (IcmpHandle=0x74ed80) returned 1 [0134.067] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749e30 | out: hHeap=0x710000) returned 1 Thread: id = 35 os_tid = 0xaa4 [0119.744] GetLastError () returned 0x57 [0119.744] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749aa8 [0119.744] SetLastError (dwErrCode=0x57) [0119.744] IcmpCreateFile () returned 0x74efb0 [0121.079] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ed8 [0121.079] IcmpSendEcho2 (in: IcmpHandle=0x74efb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1f00a8c0, RequestData=0xd04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ed8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ed8) returned 0x0 [0134.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ed8 | out: hHeap=0x710000) returned 1 [0134.062] IcmpCloseHandle (IcmpHandle=0x74efb0) returned 1 [0134.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749aa8 | out: hHeap=0x710000) returned 1 Thread: id = 36 os_tid = 0x3c8 [0119.744] GetLastError () returned 0x57 [0119.744] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x746cc0 [0119.745] SetLastError (dwErrCode=0x57) [0119.745] IcmpCreateFile () returned 0x74efe8 [0121.078] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764e88 [0121.078] IcmpSendEcho2 (in: IcmpHandle=0x74efe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2000a8c0, RequestData=0xd18ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764e88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764e88) returned 0x0 [0134.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764e88 | out: hHeap=0x710000) returned 1 [0134.057] IcmpCloseHandle (IcmpHandle=0x74efe8) returned 1 [0134.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x746cc0 | out: hHeap=0x710000) returned 1 Thread: id = 37 os_tid = 0xb74 [0119.745] GetLastError () returned 0x57 [0119.745] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747048 [0119.745] SetLastError (dwErrCode=0x57) [0119.745] IcmpCreateFile () returned 0x74f020 [0121.077] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764e38 [0121.077] IcmpSendEcho2 (in: IcmpHandle=0x74f020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2100a8c0, RequestData=0xd2cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764e38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764e38) returned 0x0 [0134.052] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764e38 | out: hHeap=0x710000) returned 1 [0134.052] IcmpCloseHandle (IcmpHandle=0x74f020) returned 1 [0134.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747048 | out: hHeap=0x710000) returned 1 Thread: id = 38 os_tid = 0x684 [0119.745] GetLastError () returned 0x57 [0119.745] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7473d0 [0119.745] SetLastError (dwErrCode=0x57) [0119.745] IcmpCreateFile () returned 0x74f058 [0121.076] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764de8 [0121.076] IcmpSendEcho2 (in: IcmpHandle=0x74f058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2200a8c0, RequestData=0xd40ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764de8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764de8) returned 0x0 [0134.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764de8 | out: hHeap=0x710000) returned 1 [0134.046] IcmpCloseHandle (IcmpHandle=0x74f058) returned 1 [0134.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7473d0 | out: hHeap=0x710000) returned 1 Thread: id = 39 os_tid = 0x10a8 [0119.745] GetLastError () returned 0x57 [0119.745] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747758 [0119.746] SetLastError (dwErrCode=0x57) [0119.746] IcmpCreateFile () returned 0x74f090 [0121.075] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764d98 [0121.075] IcmpSendEcho2 (in: IcmpHandle=0x74f090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2300a8c0, RequestData=0xd54ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764d98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764d98) returned 0x0 [0134.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764d98 | out: hHeap=0x710000) returned 1 [0134.041] IcmpCloseHandle (IcmpHandle=0x74f090) returned 1 [0134.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747758 | out: hHeap=0x710000) returned 1 Thread: id = 40 os_tid = 0x10b4 [0119.746] GetLastError () returned 0x57 [0119.746] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747ae0 [0119.746] SetLastError (dwErrCode=0x57) [0119.746] IcmpCreateFile () returned 0x74f0c8 [0121.074] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764d48 [0121.074] IcmpSendEcho2 (in: IcmpHandle=0x74f0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2400a8c0, RequestData=0xd68ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764d48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764d48) returned 0x0 [0134.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764d48 | out: hHeap=0x710000) returned 1 [0134.034] IcmpCloseHandle (IcmpHandle=0x74f0c8) returned 1 [0134.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747ae0 | out: hHeap=0x710000) returned 1 Thread: id = 41 os_tid = 0x10b0 [0119.746] GetLastError () returned 0x57 [0119.746] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747e68 [0119.746] SetLastError (dwErrCode=0x57) [0119.746] IcmpCreateFile () returned 0x74f100 [0121.073] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764cf8 [0121.073] IcmpSendEcho2 (in: IcmpHandle=0x74f100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2500a8c0, RequestData=0xd7cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764cf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764cf8) returned 0x0 [0134.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764cf8 | out: hHeap=0x710000) returned 1 [0134.030] IcmpCloseHandle (IcmpHandle=0x74f100) returned 1 [0134.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747e68 | out: hHeap=0x710000) returned 1 Thread: id = 42 os_tid = 0x10ac [0119.746] GetLastError () returned 0x57 [0119.746] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7481f0 [0119.747] SetLastError (dwErrCode=0x57) [0119.747] IcmpCreateFile () returned 0x74f138 [0121.072] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ca8 [0121.073] IcmpSendEcho2 (in: IcmpHandle=0x74f138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2600a8c0, RequestData=0xd90ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ca8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ca8) returned 0x0 [0134.026] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ca8 | out: hHeap=0x710000) returned 1 [0134.026] IcmpCloseHandle (IcmpHandle=0x74f138) returned 1 [0134.026] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7481f0 | out: hHeap=0x710000) returned 1 Thread: id = 43 os_tid = 0x9fc [0119.747] GetLastError () returned 0x57 [0119.747] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x748578 [0119.747] SetLastError (dwErrCode=0x57) [0119.747] IcmpCreateFile () returned 0x74f170 [0121.072] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764c58 [0121.072] IcmpSendEcho2 (in: IcmpHandle=0x74f170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2700a8c0, RequestData=0xda4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764c58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764c58) returned 0x0 [0134.023] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764c58 | out: hHeap=0x710000) returned 1 [0134.023] IcmpCloseHandle (IcmpHandle=0x74f170) returned 1 [0134.023] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x748578 | out: hHeap=0x710000) returned 1 Thread: id = 44 os_tid = 0x10a4 [0119.747] GetLastError () returned 0x57 [0119.747] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x748900 [0119.747] SetLastError (dwErrCode=0x57) [0119.747] IcmpCreateFile () returned 0x74f1a8 [0121.070] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764a78 [0121.070] IcmpSendEcho2 (in: IcmpHandle=0x74f1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2800a8c0, RequestData=0xdb8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764a78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764a78) returned 0x0 [0134.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764a78 | out: hHeap=0x710000) returned 1 [0134.019] IcmpCloseHandle (IcmpHandle=0x74f1a8) returned 1 [0134.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x748900 | out: hHeap=0x710000) returned 1 Thread: id = 45 os_tid = 0x10d8 [0119.747] GetLastError () returned 0x57 [0119.747] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x748c88 [0119.747] SetLastError (dwErrCode=0x57) [0119.748] IcmpCreateFile () returned 0x74f1e0 [0121.069] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764a28 [0121.069] IcmpSendEcho2 (in: IcmpHandle=0x74f1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2900a8c0, RequestData=0xdccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764a28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764a28) returned 0x0 [0134.003] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764a28 | out: hHeap=0x710000) returned 1 [0134.003] IcmpCloseHandle (IcmpHandle=0x74f1e0) returned 1 [0134.004] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x748c88 | out: hHeap=0x710000) returned 1 Thread: id = 46 os_tid = 0x10e0 [0119.748] GetLastError () returned 0x57 [0119.748] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749010 [0119.748] SetLastError (dwErrCode=0x57) [0119.748] IcmpCreateFile () returned 0x74f218 [0121.068] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7649d8 [0121.068] IcmpSendEcho2 (in: IcmpHandle=0x74f218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2a00a8c0, RequestData=0xde0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7649d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7649d8) returned 0x0 [0133.982] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7649d8 | out: hHeap=0x710000) returned 1 [0133.982] IcmpCloseHandle (IcmpHandle=0x74f218) returned 1 [0133.982] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749010 | out: hHeap=0x710000) returned 1 Thread: id = 47 os_tid = 0x10e8 [0119.748] GetLastError () returned 0x57 [0119.748] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749720 [0119.748] SetLastError (dwErrCode=0x57) [0119.748] IcmpCreateFile () returned 0x74f250 [0121.067] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764988 [0121.067] IcmpSendEcho2 (in: IcmpHandle=0x74f250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2b00a8c0, RequestData=0xdf4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764988, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764988) returned 0x0 [0133.968] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764988 | out: hHeap=0x710000) returned 1 [0133.968] IcmpCloseHandle (IcmpHandle=0x74f250) returned 1 [0133.969] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749720 | out: hHeap=0x710000) returned 1 Thread: id = 48 os_tid = 0x10e4 [0120.717] GetLastError () returned 0x57 [0120.717] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f0f0 [0120.717] SetLastError (dwErrCode=0x57) [0120.717] IcmpCreateFile () returned 0x75d428 [0121.042] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e1e8 [0121.042] IcmpSendEcho2 (in: IcmpHandle=0x75d428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2c00a8c0, RequestData=0xe08ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e1e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e1e8) returned 0x0 [0123.144] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e1e8 | out: hHeap=0x710000) returned 1 [0123.145] IcmpCloseHandle (IcmpHandle=0x75d428) returned 1 [0123.145] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75f0f0 | out: hHeap=0x710000) returned 1 Thread: id = 49 os_tid = 0x10dc [0120.707] GetLastError () returned 0x57 [0120.707] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756c60 [0120.708] SetLastError (dwErrCode=0x57) [0120.708] IcmpCreateFile () returned 0x74edf0 [0121.067] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764b18 [0121.067] IcmpSendEcho2 (in: IcmpHandle=0x74edf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2d00a8c0, RequestData=0xe1cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764b18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764b18) returned 0x0 [0133.918] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764b18 | out: hHeap=0x710000) returned 1 [0133.918] IcmpCloseHandle (IcmpHandle=0x74edf0) returned 1 [0133.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756c60 | out: hHeap=0x710000) returned 1 Thread: id = 50 os_tid = 0x10d4 [0120.708] GetLastError () returned 0x57 [0120.709] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755730 [0120.709] SetLastError (dwErrCode=0x57) [0120.709] IcmpCreateFile () returned 0x74f368 [0121.066] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764938 [0121.066] IcmpSendEcho2 (in: IcmpHandle=0x74f368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2e00a8c0, RequestData=0xe30ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764938, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764938) returned 0x0 [0133.912] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764938 | out: hHeap=0x710000) returned 1 [0133.912] IcmpCloseHandle (IcmpHandle=0x74f368) returned 1 [0133.913] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755730 | out: hHeap=0x710000) returned 1 Thread: id = 51 os_tid = 0x10d0 [0120.709] GetLastError () returned 0x57 [0120.709] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755ab8 [0120.709] SetLastError (dwErrCode=0x57) [0120.709] IcmpCreateFile () returned 0x74f3a0 [0121.065] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ac8 [0121.065] IcmpSendEcho2 (in: IcmpHandle=0x74f3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2f00a8c0, RequestData=0xe44ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ac8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ac8) returned 0x0 [0133.907] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ac8 | out: hHeap=0x710000) returned 1 [0133.907] IcmpCloseHandle (IcmpHandle=0x74f3a0) returned 1 [0133.907] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755ab8 | out: hHeap=0x710000) returned 1 Thread: id = 52 os_tid = 0x10cc [0120.709] GetLastError () returned 0x57 [0120.709] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755e40 [0120.709] SetLastError (dwErrCode=0x57) [0120.709] IcmpCreateFile () returned 0x74ecd8 [0121.064] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e008 [0121.064] IcmpSendEcho2 (in: IcmpHandle=0x74ecd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3000a8c0, RequestData=0xe58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e008, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e008) returned 0x0 [0133.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e008 | out: hHeap=0x710000) returned 1 [0133.902] IcmpCloseHandle (IcmpHandle=0x74ecd8) returned 1 [0133.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755e40 | out: hHeap=0x710000) returned 1 Thread: id = 53 os_tid = 0x10bc [0120.709] GetLastError () returned 0x57 [0120.710] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756fe8 [0120.710] SetLastError (dwErrCode=0x57) [0120.710] IcmpCreateFile () returned 0x74ee28 [0121.063] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e198 [0121.064] IcmpSendEcho2 (in: IcmpHandle=0x74ee28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3100a8c0, RequestData=0xe6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e198) returned 0x0 [0133.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e198 | out: hHeap=0x710000) returned 1 [0133.893] IcmpCloseHandle (IcmpHandle=0x74ee28) returned 1 [0133.894] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756fe8 | out: hHeap=0x710000) returned 1 Thread: id = 54 os_tid = 0x10c8 [0120.710] GetLastError () returned 0x57 [0120.710] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7561c8 [0120.710] SetLastError (dwErrCode=0x57) [0120.710] IcmpCreateFile () returned 0x74ed10 [0121.063] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dfb8 [0121.063] IcmpSendEcho2 (in: IcmpHandle=0x74ed10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3200a8c0, RequestData=0xe80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dfb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dfb8) returned 0x0 [0133.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dfb8 | out: hHeap=0x710000) returned 1 [0133.881] IcmpCloseHandle (IcmpHandle=0x74ed10) returned 1 [0133.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7561c8 | out: hHeap=0x710000) returned 1 Thread: id = 55 os_tid = 0x10c4 [0120.710] GetLastError () returned 0x57 [0120.710] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756550 [0120.710] SetLastError (dwErrCode=0x57) [0120.710] IcmpCreateFile () returned 0x74edb8 [0121.057] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df68 [0121.057] IcmpSendEcho2 (in: IcmpHandle=0x74edb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3300a8c0, RequestData=0xe94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df68) returned 0x0 [0133.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df68 | out: hHeap=0x710000) returned 1 [0133.873] IcmpCloseHandle (IcmpHandle=0x74edb8) returned 1 [0133.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756550 | out: hHeap=0x710000) returned 1 Thread: id = 56 os_tid = 0x10c0 [0120.710] GetLastError () returned 0x57 [0120.711] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7568d8 [0120.711] SetLastError (dwErrCode=0x57) [0120.711] IcmpCreateFile () returned 0x74ee60 [0121.056] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df18 [0121.056] IcmpSendEcho2 (in: IcmpHandle=0x74ee60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3400a8c0, RequestData=0xea8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df18) returned 0x0 [0133.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df18 | out: hHeap=0x710000) returned 1 [0133.858] IcmpCloseHandle (IcmpHandle=0x74ee60) returned 1 [0133.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7568d8 | out: hHeap=0x710000) returned 1 Thread: id = 57 os_tid = 0x10b8 [0120.711] GetLastError () returned 0x57 [0120.711] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757370 [0120.711] SetLastError (dwErrCode=0x57) [0120.711] IcmpCreateFile () returned 0x74ee98 [0121.055] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e058 [0121.055] IcmpSendEcho2 (in: IcmpHandle=0x74ee98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3500a8c0, RequestData=0xebcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e058) returned 0x0 [0133.724] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e058 | out: hHeap=0x710000) returned 1 [0133.724] IcmpCloseHandle (IcmpHandle=0x74ee98) returned 1 [0133.725] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757370 | out: hHeap=0x710000) returned 1 Thread: id = 58 os_tid = 0x10f0 [0120.711] GetLastError () returned 0x57 [0120.711] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7576f8 [0120.711] SetLastError (dwErrCode=0x57) [0120.711] IcmpCreateFile () returned 0x74eed0 [0121.054] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de78 [0121.054] IcmpSendEcho2 (in: IcmpHandle=0x74eed0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3600a8c0, RequestData=0xed0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de78) returned 0x0 [0133.668] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de78 | out: hHeap=0x710000) returned 1 [0133.668] IcmpCloseHandle (IcmpHandle=0x74eed0) returned 1 [0133.669] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7576f8 | out: hHeap=0x710000) returned 1 Thread: id = 59 os_tid = 0x828 [0120.711] GetLastError () returned 0x57 [0120.712] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757a80 [0120.712] SetLastError (dwErrCode=0x57) [0120.712] IcmpCreateFile () returned 0x74ef40 [0121.053] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dd38 [0121.054] IcmpSendEcho2 (in: IcmpHandle=0x74ef40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3700a8c0, RequestData=0xee4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dd38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dd38) returned 0x0 [0133.189] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dd38 | out: hHeap=0x710000) returned 1 [0133.189] IcmpCloseHandle (IcmpHandle=0x74ef40) returned 1 [0133.190] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757a80 | out: hHeap=0x710000) returned 1 Thread: id = 60 os_tid = 0x820 [0120.712] GetLastError () returned 0x57 [0120.712] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757e08 [0120.712] SetLastError (dwErrCode=0x57) [0120.712] IcmpCreateFile () returned 0x74ef78 [0121.053] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dce8 [0121.053] IcmpSendEcho2 (in: IcmpHandle=0x74ef78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3800a8c0, RequestData=0xef8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dce8) returned 0x0 [0132.978] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dce8 | out: hHeap=0x710000) returned 1 [0132.978] IcmpCloseHandle (IcmpHandle=0x74ef78) returned 1 [0132.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757e08 | out: hHeap=0x710000) returned 1 Thread: id = 61 os_tid = 0x10f4 [0120.713] GetLastError () returned 0x57 [0120.713] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758190 [0120.713] SetLastError (dwErrCode=0x57) [0120.713] IcmpCreateFile () returned 0x74f410 [0121.052] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de28 [0121.052] IcmpSendEcho2 (in: IcmpHandle=0x74f410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3900a8c0, RequestData=0xf0cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de28) returned 0x0 [0132.728] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de28 | out: hHeap=0x710000) returned 1 [0132.728] IcmpCloseHandle (IcmpHandle=0x74f410) returned 1 [0132.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758190 | out: hHeap=0x710000) returned 1 Thread: id = 62 os_tid = 0x1108 [0120.713] GetLastError () returned 0x57 [0120.713] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758518 [0120.713] SetLastError (dwErrCode=0x57) [0120.713] IcmpCreateFile () returned 0x74f3d8 [0121.051] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc98 [0121.051] IcmpSendEcho2 (in: IcmpHandle=0x74f3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3a00a8c0, RequestData=0xf20ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc98) returned 0x0 [0132.697] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc98 | out: hHeap=0x710000) returned 1 [0132.697] IcmpCloseHandle (IcmpHandle=0x74f3d8) returned 1 [0132.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758518 | out: hHeap=0x710000) returned 1 Thread: id = 63 os_tid = 0x1100 [0120.713] GetLastError () returned 0x57 [0120.713] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7588a0 [0120.714] SetLastError (dwErrCode=0x57) [0120.714] IcmpCreateFile () returned 0x74f448 [0121.050] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc48 [0121.050] IcmpSendEcho2 (in: IcmpHandle=0x74f448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3b00a8c0, RequestData=0xf34ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc48) returned 0x0 [0132.567] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc48 | out: hHeap=0x710000) returned 1 [0132.567] IcmpCloseHandle (IcmpHandle=0x74f448) returned 1 [0132.567] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7588a0 | out: hHeap=0x710000) returned 1 Thread: id = 64 os_tid = 0x1114 [0120.715] GetLastError () returned 0x57 [0120.715] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758c28 [0120.715] SetLastError (dwErrCode=0x57) [0120.715] IcmpCreateFile () returned 0x75d3b8 [0121.049] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dbf8 [0121.049] IcmpSendEcho2 (in: IcmpHandle=0x75d3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3c00a8c0, RequestData=0xf48ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dbf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dbf8) returned 0x0 [0131.690] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dbf8 | out: hHeap=0x710000) returned 1 [0131.691] IcmpCloseHandle (IcmpHandle=0x75d3b8) returned 1 [0131.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758c28 | out: hHeap=0x710000) returned 1 Thread: id = 65 os_tid = 0x1120 [0120.715] GetLastError () returned 0x57 [0120.715] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755020 [0120.715] SetLastError (dwErrCode=0x57) [0120.715] IcmpCreateFile () returned 0x75d540 [0121.049] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dba8 [0121.049] IcmpSendEcho2 (in: IcmpHandle=0x75d540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3d00a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dba8) returned 0x0 [0130.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dba8 | out: hHeap=0x710000) returned 1 [0130.194] IcmpCloseHandle (IcmpHandle=0x75d540) returned 1 [0130.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755020 | out: hHeap=0x710000) returned 1 Thread: id = 66 os_tid = 0x1118 [0120.715] GetLastError () returned 0x57 [0120.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7553a8 [0120.716] SetLastError (dwErrCode=0x57) [0120.716] IcmpCreateFile () returned 0x75d578 [0121.048] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73db08 [0121.048] IcmpSendEcho2 (in: IcmpHandle=0x75d578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3e00a8c0, RequestData=0xf70ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73db08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73db08) returned 0x0 [0128.482] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73db08 | out: hHeap=0x710000) returned 1 [0128.482] IcmpCloseHandle (IcmpHandle=0x75d578) returned 1 [0128.483] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7553a8 | out: hHeap=0x710000) returned 1 Thread: id = 67 os_tid = 0x110c [0120.716] GetLastError () returned 0x57 [0120.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e2d0 [0120.717] SetLastError (dwErrCode=0x57) [0120.717] IcmpCreateFile () returned 0x75d1c0 [0121.047] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e148 [0121.047] IcmpSendEcho2 (in: IcmpHandle=0x75d1c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3f00a8c0, RequestData=0xf84ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e148) returned 0x0 [0126.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e148 | out: hHeap=0x710000) returned 1 [0126.962] IcmpCloseHandle (IcmpHandle=0x75d1c0) returned 1 [0126.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75e2d0 | out: hHeap=0x710000) returned 1 Thread: id = 68 os_tid = 0x1104 [0120.717] GetLastError () returned 0x57 [0120.717] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75ed68 [0120.717] SetLastError (dwErrCode=0x57) [0120.717] IcmpCreateFile () returned 0x75d3f0 [0121.046] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e238 [0121.046] IcmpSendEcho2 (in: IcmpHandle=0x75d3f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4000a8c0, RequestData=0xf98ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e238) returned 0x0 [0125.931] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e238 | out: hHeap=0x710000) returned 1 [0125.931] IcmpCloseHandle (IcmpHandle=0x75d3f0) returned 1 [0125.932] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75ed68 | out: hHeap=0x710000) returned 1 Thread: id = 69 os_tid = 0x10fc Thread: id = 70 os_tid = 0x1160 [0121.207] VirtualAlloc (lpAddress=0x0, dwSize=0xffff, flAllocationType=0x1000, flProtect=0x4) returned 0x500000 [0121.208] VirtualAlloc (lpAddress=0x0, dwSize=0xffff, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0121.209] CreateFileW (lpFileName="\\\\?\\C:\\ReadMe.txt" (normalized: "c:\\readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0121.210] WriteFile (in: hFile=0x308, lpBuffer=0xd5ff40*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0xd5fed8, lpOverlapped=0x0 | out: lpBuffer=0xd5ff40*, lpNumberOfBytesWritten=0xd5fed8*=0x1f, lpOverlapped=0x0) returned 1 [0121.211] CloseHandle (hObject=0x308) returned 1 [0121.213] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*" (normalized: "c:\\*"), lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x772dab4c, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x72b440 [0121.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*" (normalized: "c:\\$recycle.bin\\*"), lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x72b100 [0121.215] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.215] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0121.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*" (normalized: "c:\\$recycle.bin\\s-1-5-18\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x7679c0 [0121.216] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.216] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0121.217] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0121.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0121.218] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1f, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.218] FindClose (in: hFindFile=0x7679c0 | out: hFindFile=0x7679c0) returned 1 [0121.218] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0121.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\*" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0121.218] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.218] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini")) returned 0x26 [0121.219] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0121.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0121.220] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x1f, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.220] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0121.220] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0121.220] FindClose (in: hFindFile=0x72b100 | out: hFindFile=0x72b100) returned 1 [0121.220] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15, dwReserved1=0x772dab4c, cFileName="Boot", cAlternateFileName="")) returned 1 [0121.220] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x15, dwReserved1=0x772dab4c, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0121.220] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x15, dwReserved1=0x772dab4c, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0121.220] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x15, dwReserved1=0x772dab4c, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0121.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0121.221] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0121.221] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0121.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0121.222] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x772dab4c, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0121.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*" (normalized: "c:\\documents and settings\\*"), lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0xd5f9f0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x7721565e, ftLastAccessTime.dwLowDateTime=0x736f00, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e, ftLastWriteTime.dwHighDateTime=0x28, nFileSizeHigh=0xd5fa40, nFileSizeLow=0xd5fa10, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Õ鎫眡", cAlternateFileName="ѹ眠")) returned 0xffffffff [0121.223] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x3b2685fb, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x772dab4c, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0121.223] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x198b0d8f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x198b0d8f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x772dab4c, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0121.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*" (normalized: "c:\\msocache\\*"), lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x198b0d8f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x198b0d8f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName=".", cAlternateFileName="")) returned 0x72b100 [0121.223] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x198b0d8f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x198b0d8f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="..", cAlternateFileName="")) returned 1 [0121.223] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7ea9fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7ea9fb, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0121.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*" (normalized: "c:\\msocache\\all users\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7ea9fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7ea9fb, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0121.225] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7ea9fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7ea9fb, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.226] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x19a337b7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3785d7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3785d7ae, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0011-0000-0000-0000000FF1CE}-C", cAlternateFileName="{90160~2")) returned 1 [0121.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x19a337b7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3785d7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3785d7ae, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0121.229] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x19a337b7, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3785d7ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3785d7ae, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.230] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ce70000, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6ce70000, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x19ac57c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3c3000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Office64WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0121.230] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x12e83a80, ftCreationTime.dwHighDateTime=0x1d0cbb6, ftLastAccessTime.dwLowDateTime=0x12e83a80, ftLastAccessTime.dwHighDateTime=0x1d0cbb6, ftLastWriteTime.dwLowDateTime=0x19a33000, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1380, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Office64WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0121.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml")) returned 0x2020 [0121.230] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0121.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0121.231] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf770f620, ftCreationTime.dwHighDateTime=0x1d0cb97, ftLastAccessTime.dwLowDateTime=0xf770f620, ftLastAccessTime.dwHighDateTime=0x1d0cb97, ftLastWriteTime.dwLowDateTime=0x37850760, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x318b0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0121.231] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bac20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7d3bac20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x36bd98b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x960aa8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0121.231] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a23d2d0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3a23d2d0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x19bd95d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1d2ccbc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OWOW64WW.cab", cAlternateFileName="")) returned 1 [0121.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab")) returned 0x2020 [0121.232] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0121.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0121.233] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x870a50a0, ftCreationTime.dwHighDateTime=0x1d0ca7c, ftLastAccessTime.dwLowDateTime=0x870a50a0, ftLastAccessTime.dwHighDateTime=0x1d0ca7c, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x137258, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0121.233] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16fad80, ftCreationTime.dwHighDateTime=0x1d0ca8d, ftLastAccessTime.dwLowDateTime=0x16fad80, ftLastAccessTime.dwHighDateTime=0x1d0ca8d, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0121.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0121.234] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0121.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0121.234] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19453d90, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x19453d90, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x1b2f0020, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba4000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ProPlusWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0121.234] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20df7960, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x20df7960, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x1b2aba60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x42d4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ProPlusWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0121.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml")) returned 0x2020 [0121.236] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0121.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0121.236] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9bd76f0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xa9bd76f0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x1c985420, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x13496c5e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ProPsWW.cab", cAlternateFileName="")) returned 1 [0121.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab")) returned 0x2020 [0121.237] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0121.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0121.238] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ecd5a60, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x9ecd5a60, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x2c7c5260, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xed9cec7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ProPsWW2.cab", cAlternateFileName="")) returned 1 [0121.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab")) returned 0x2020 [0121.238] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0121.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0121.239] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e3d3da0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7e3d3da0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x36bb75d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x946c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="setup.dll", cAlternateFileName="")) returned 1 [0121.239] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f377c20, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7f377c20, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x36b9a110, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x39cc0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0121.239] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0121.240] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4 [0121.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0121.241] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x417c4f10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x417c4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6c86, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.241] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0121.241] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abfab95, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b39d0ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b39d0ce, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0016-0409-0000-0000000FF1CE}-C", cAlternateFileName="{974F5~1")) returned 1 [0121.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abfab95, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b39d0ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b39d0ce, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767980 [0121.242] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abfab95, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b39d0ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b39d0ce, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.242] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x58095e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0121.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0121.243] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0121.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0121.244] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdfce780, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdfce780, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0121.244] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf47c6f70, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xf47c6f70, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0121.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0121.245] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294 [0121.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0121.245] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b39aaf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0121.246] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0121.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0121.246] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41a72fa0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41a72fa0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b39aaf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.246] FindClose (in: hFindFile=0x767980 | out: hFindFile=0x767980) returned 1 [0121.247] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c54da11, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c6b4905, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c6b4905, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0018-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9CA7F~1")) returned 1 [0121.247] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c54da11, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c6b4905, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c6b4905, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767900 [0121.802] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c54da11, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c6b4905, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c6b4905, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.815] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x169d4f10, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x169d4f10, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c56b3b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0121.815] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34e10110, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x34e10110, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0x3c54def0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x67d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0121.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0121.815] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0121.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0121.816] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6902120, ftCreationTime.dwHighDateTime=0x1d0cbc1, ftLastAccessTime.dwLowDateTime=0x6902120, ftLastAccessTime.dwHighDateTime=0x1d0cbc1, ftLastWriteTime.dwLowDateTime=0x3c5ddfa0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x6048ee, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0121.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0121.816] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4 [0121.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0121.817] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c6b2610, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0121.818] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0121.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0121.818] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426d17b0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x426d17b0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c6b2610, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.818] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0121.818] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c6ca85c, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7d2320, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7d2320, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0019-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9032D~1")) returned 1 [0121.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c6ca85c, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7d2320, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7d2320, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x768080 [0121.820] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c6ca85c, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7d2320, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7d2320, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.820] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16c60cc0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x16c60cc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c6e3350, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x24c000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0121.820] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8263d6b0, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x8263d6b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0x3c6cacb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x67e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0121.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0121.821] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0121.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0121.821] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d82bc70, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x4d82bc70, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3c753830, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3658af, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0121.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0121.822] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0121.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0121.822] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c7d0060, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0121.823] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0121.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0121.823] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4278fe90, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4278fe90, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c7d0060, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.824] FindClose (in: hFindFile=0x768080 | out: hFindFile=0x768080) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c3e6c4d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c534059, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c534059, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-001A-0409-0000-0000000FF1CE}-C", cAlternateFileName="{98E9A~1")) returned 1 [0121.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c3e6c4d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c534059, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c534059, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767900 [0121.826] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c3e6c4d, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c534059, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c534059, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90965df0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x90965df0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3c4bde40, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3d2ce1, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0121.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0121.827] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0121.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0121.827] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749677e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x749677e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c404580, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0121.828] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb696530, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xfb696530, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3c3e70c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0121.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0121.828] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0121.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0121.829] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c533140, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0121.829] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0121.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0121.830] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x425ebfd0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x425ebfd0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c533140, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.830] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0121.830] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c7ea9fb, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3dcbe363, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3dcbe363, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-001B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E8C9~1")) returned 1 [0121.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c7ea9fb, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3dcbe363, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3dcbe363, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767fc0 [0121.831] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c7ea9fb, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3dcbe363, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3dcbe363, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.831] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4289c770, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4289c770, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3dce3880, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0121.833] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0121.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0121.834] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fb20, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xeb3fb20, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x3c858be0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x99cdf5, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0121.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0121.835] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0121.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0121.836] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0e93c80, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc0e93c80, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x3c8034b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x24b000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0121.836] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x3c7eae10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0121.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0121.836] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0121.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0121.837] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5504b0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0x1c5504b0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x3c7eae10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0121.837] FindClose (in: hFindFile=0x767fc0 | out: hFindFile=0x767fc0) returned 1 [0121.837] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3785d7ae, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39a5db44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39a5db44, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-002C-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~3")) returned 1 [0121.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3785d7ae, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39a5db44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39a5db44, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0121.839] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3785d7ae, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39a5db44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39a5db44, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.839] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x37883c64, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x378d01b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x378d01b5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0121.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x37883c64, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x378d01b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x378d01b5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d00 [0121.840] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x37883c64, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x378d01b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x378d01b5, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.840] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2c09d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2c09d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x378cf6a0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xb1e33f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0121.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0121.844] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0121.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0121.844] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbacf58c0, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbacf58c0, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x201000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0121.844] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0121.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0121.845] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0121.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0121.846] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21b6da0, ftCreationTime.dwHighDateTime=0x1d0cbb4, ftLastAccessTime.dwLowDateTime=0xf21b6da0, ftLastAccessTime.dwHighDateTime=0x1d0cbb4, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x613, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0121.846] FindClose (in: hFindFile=0x767d00 | out: hFindFile=0x767d00) returned 1 [0121.846] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38ee9095, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x38f352b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x38f352b8, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0121.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38ee9095, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x38f352b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x38f352b8, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0121.846] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38ee9095, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x38f352b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x38f352b8, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.846] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e4a700, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x18e4a700, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x38f33d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xd43dbd, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0121.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0121.847] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0121.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0121.848] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3553370, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xc3553370, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x38f0cc60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0121.848] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38ee8270, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0121.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0121.848] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0121.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0121.849] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4320350, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x4320350, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38ee8270, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0121.849] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0121.849] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38372840, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x383a8996, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x383a8996, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0121.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\*" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38372840, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x383a8996, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x383a8996, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0121.850] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38372840, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x383a8996, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x383a8996, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0121.850] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c2727d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1c2727d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x383a74b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xd36695, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0121.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0121.850] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0121.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0121.851] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe24ec60, ftCreationTime.dwHighDateTime=0x1d0cbbe, ftLastAccessTime.dwLowDateTime=0xbe24ec60, ftLastAccessTime.dwHighDateTime=0x1d0cbbe, ftLastWriteTime.dwLowDateTime=0x38371950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x203000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0121.851] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38371950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0121.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0121.851] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0121.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0121.852] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578b420, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0x578b420, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x38371950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x681, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0121.852] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0121.852] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a506c00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x1a506c00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x37883bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0121.852] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66266080, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x66266080, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0x3785cab0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0121.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0121.853] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0121.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0121.854] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x39a5c480, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0121.854] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0121.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0121.855] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42175690, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42175690, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x39a5c480, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.855] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0121.855] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b45d49b, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b567558, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b567558, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0044-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9E0A5~1")) returned 1 [0121.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b45d49b, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b567558, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b567558, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767a00 [0123.022] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b45d49b, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b567558, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b567558, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0123.023] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce2ab890, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xce2ab890, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x3b4f07b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3bafe2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0123.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0123.036] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0123.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0123.037] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3d24d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xe3d24d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b476690, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0123.037] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24c51f60, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x24c51f60, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3b45dff0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x1f, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0123.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0123.038] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0123.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0123.038] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b5681c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0123.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0123.039] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0123.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0123.040] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41b31680, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41b31680, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b5681c0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0123.040] FindClose (in: hFindFile=0x767a00 | out: hFindFile=0x767a00) returned 1 [0123.040] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abd4582, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abfab95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abfab95, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0090-0409-0000-0000000FF1CE}-C", cAlternateFileName="{935E4~1")) returned 1 [0123.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abd4582, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abfab95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abfab95, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0123.041] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3abd4582, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abfab95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abfab95, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0123.041] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb87a4fc0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0xb87a4fc0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x9ca36, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DCFMUI.cab", cAlternateFileName="")) returned 1 [0123.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.cab")) returned 0x2020 [0123.042] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0123.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0123.043] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc86a00, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0xdc86a00, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x246000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DCFMUI.msi", cAlternateFileName="")) returned 1 [0123.043] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf06d040, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xdf06d040, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DCFMUI.xml", cAlternateFileName="")) returned 1 [0123.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml")) returned 0x2020 [0123.054] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0123.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0123.055] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0123.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0123.056] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0123.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0123.056] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4198d7c0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4198d7c0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abf98f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0123.056] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0123.056] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39c15733, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3a7d1838, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3a7d1838, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-00A1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9155A~1")) returned 1 [0123.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39c15733, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3a7d1838, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3a7d1838, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767a80 [0123.060] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39c15733, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3a7d1838, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3a7d1838, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0123.060] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cdfd410, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cdfd410, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x39c31080, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0123.060] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6b80780, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa6b80780, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x39c162d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x719, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0123.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0123.061] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0123.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0123.062] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85984230, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x85984230, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x39ca3c70, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xcbc714, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0123.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0123.063] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x644 [0123.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0123.063] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3a7d11b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0123.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0123.064] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x64c [0123.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0123.069] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x423b0b30, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x423b0b30, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3a7d11b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0123.069] FindClose (in: hFindFile=0x767a80 | out: hFindFile=0x767a80) returned 1 [0123.069] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b3c3241, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b4358ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b4358ee, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-00BA-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97C62~1")) returned 1 [0123.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b3c3241, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b4358ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b4358ee, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x768040 [0123.078] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b3c3241, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b4358ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b4358ee, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0123.078] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x224df1f0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x224df1f0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3b40d6e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xd5202, dwReserved0=0x0, dwReserved1=0x1f, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0123.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0123.078] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x654 [0123.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0123.079] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x125bd4d0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x125bd4d0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b3c1bf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x245000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0123.079] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa241b20, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xa241b20, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3b3c1bf0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x466, dwReserved0=0x0, dwReserved1=0x1f, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0123.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0123.079] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x65c [0123.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0123.080] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b4347e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0123.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0123.081] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x664 [0123.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0123.081] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41bf2470, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41bf2470, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b4347e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0123.081] FindClose (in: hFindFile=0x768040 | out: hFindFile=0x768040) returned 1 [0123.081] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3a7d1838, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abd4582, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abd4582, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-00E1-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9C97F~1")) returned 1 [0123.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3a7d1838, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abd4582, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abd4582, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0123.082] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3a7d1838, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3abd4582, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3abd4582, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0123.082] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x923540e0, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x923540e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x41ad, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OSMMUI.cab", cAlternateFileName="")) returned 1 [0123.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.cab")) returned 0x2020 [0123.083] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0123.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0123.083] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72b275a0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x72b275a0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3abc8bb0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OSMMUI.msi", cAlternateFileName="")) returned 1 [0123.083] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1ef3140, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xc1ef3140, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3a7d11b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x463, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OSMMUI.xml", cAlternateFileName="")) returned 1 [0123.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml")) returned 0x2020 [0123.084] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0123.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0123.085] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0123.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0123.085] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0123.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0123.086] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4244a820, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x4244a820, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3abd27f0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0123.086] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0123.086] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c2ed077, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c3cf8f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c3cf8f7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-00E2-0409-0000-0000000FF1CE}-C", cAlternateFileName="{97E7F~1")) returned 1 [0123.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c2ed077, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c3cf8f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c3cf8f7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e00 [0123.086] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3c2ed077, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c3cf8f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c3cf8f7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0123.086] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x912ef470, ftCreationTime.dwHighDateTime=0x1d0cbbf, ftLastAccessTime.dwLowDateTime=0x912ef470, ftLastAccessTime.dwHighDateTime=0x1d0cbbf, ftLastWriteTime.dwLowDateTime=0x3c33e970, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x408e2d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OSMUXMUI.cab", cAlternateFileName="")) returned 1 [0123.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.cab")) returned 0x2020 [0123.088] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0123.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0123.089] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2413e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6e2413e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3c312a50, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OSMUXMUI.msi", cAlternateFileName="")) returned 1 [0123.089] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdcfb7a70, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0xdcfb7a70, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3c2eb950, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OSMUXMUI.xml", cAlternateFileName="")) returned 1 [0123.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml")) returned 0x2020 [0123.090] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0123.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0123.090] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c3cea20, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0123.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0123.091] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0123.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0123.092] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42508f00, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42508f00, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c3cea20, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0123.092] FindClose (in: hFindFile=0x767e00 | out: hFindFile=0x767e00) returned 1 [0123.092] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b67ed24, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c2c6c91, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c2c6c91, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0115-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9AA2F~1")) returned 1 [0123.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b67ed24, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c2c6c91, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c2c6c91, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0124.222] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b67ed24, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c2c6c91, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c2c6c91, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.222] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0x3c278d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0124.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0124.223] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0124.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0124.224] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39355420, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x39355420, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x3b7ad2a0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xb2a1f2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0124.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0124.224] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0124.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0124.225] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6cc80650, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x6cc80650, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b707260, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3da000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0124.225] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdbe85560, ftCreationTime.dwHighDateTime=0x1d0cbb5, ftLastAccessTime.dwLowDateTime=0xdbe85560, ftLastAccessTime.dwHighDateTime=0x1d0cbb5, ftLastWriteTime.dwLowDateTime=0x3b6ec4b0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x149b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0124.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0124.226] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0124.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0124.227] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70035b30, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x70035b30, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b6af420, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0124.227] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x740ab3a0, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x740ab3a0, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3b67e6e0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0124.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0124.227] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x65c [0124.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0124.228] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d804480, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x7d804480, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b6d6520, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OffSetLR.cab", cAlternateFileName="")) returned 1 [0124.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OffSetLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\offsetlr.cab")) returned 0x2020 [0124.228] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OffSetLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\offsetlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x64c [0124.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0124.229] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bc55fd0, ftCreationTime.dwHighDateTime=0x1d0cb96, ftLastAccessTime.dwLowDateTime=0x7bc55fd0, ftLastAccessTime.dwHighDateTime=0x1d0cb96, ftLastWriteTime.dwLowDateTime=0x3c29fe60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x32ac0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0124.229] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7752c460, ftCreationTime.dwHighDateTime=0x1d0990a, ftLastAccessTime.dwLowDateTime=0x7752c460, ftLastAccessTime.dwHighDateTime=0x1d0990a, ftLastWriteTime.dwLowDateTime=0x3c2c4850, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3906, dwReserved0=0x0, dwReserved1=0x1f, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0124.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0124.230] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0124.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0124.231] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x588655b0, ftCreationTime.dwHighDateTime=0x1d0a41d, ftLastAccessTime.dwLowDateTime=0x588655b0, ftLastAccessTime.dwHighDateTime=0x1d0a41d, ftLastWriteTime.dwLowDateTime=0x3c29fe60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x14366, dwReserved0=0x0, dwReserved1=0x1f, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0124.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0124.231] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0124.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0124.232] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41e54a10, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41e54a10, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3c2c4850, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2123, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0124.232] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0124.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0124.233] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0x3c278d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0124.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0124.233] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0124.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0124.234] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5746daf0, ftCreationTime.dwHighDateTime=0x1d0cba8, ftLastAccessTime.dwLowDateTime=0x5746daf0, ftLastAccessTime.dwHighDateTime=0x1d0cba8, ftLastWriteTime.dwLowDateTime=0x3c278d60, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0124.234] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0124.234] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x199fa1e7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x199fa1e7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0116-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~1")) returned 1 [0124.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x199fa1e7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x199fa1e7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767900 [0124.236] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x199fa1e7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x199fa1e7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.236] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75c7a4e0, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x75c7a4e0, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x19948a00, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x12b000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Office64MUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0124.236] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51246020, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x51246020, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x19921900, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Office64MUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0124.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml")) returned 0x2020 [0124.236] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0124.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0124.237] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74e2c320, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x74e2c320, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x198fcf10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Office64MUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0124.237] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69bb1570, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x69bb1570, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x198d5e10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Office64MUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0124.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml")) returned 0x2020 [0124.237] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0124.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0124.238] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3791b640, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0x3791b640, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x199b67d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x1f70a9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OWOW64LR.cab", cAlternateFileName="")) returned 1 [0124.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\owow64lr.cab")) returned 0x2020 [0124.238] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\owow64lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0124.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0124.239] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x199fad90, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0124.239] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0124.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0124.240] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42258760, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x42258760, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x199fad90, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0124.240] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0124.240] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39a5db44, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bff778, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bff778, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-0117-0409-0000-0000000FF1CE}-C", cAlternateFileName="{90160~4")) returned 1 [0124.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39a5db44, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bff778, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bff778, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0124.251] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x39a5db44, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bff778, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bff778, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.251] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x39aa9dc1, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bdfbe4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bdfbe4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0124.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\*" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x39aa9dc1, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bdfbe4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bdfbe4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0124.253] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x39aa9dc1, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x39bdfbe4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x39bdfbe4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.253] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x109b3910, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x109b3910, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x39acf070, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x249000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0124.253] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd03ec950, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xd03ec950, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0x39aa7f70, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0124.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0124.254] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0124.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0124.254] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb194ac00, ftCreationTime.dwHighDateTime=0x1d0cbc9, ftLastAccessTime.dwLowDateTime=0xb194ac00, ftLastAccessTime.dwHighDateTime=0x1d0cbc9, ftLastWriteTime.dwLowDateTime=0x39b1f980, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x525e2e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0124.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0124.255] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0124.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0124.255] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0x39bde060, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0124.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0124.256] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0124.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0124.257] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e1e12f0, ftCreationTime.dwHighDateTime=0x1d0ca7d, ftLastAccessTime.dwLowDateTime=0x2e1e12f0, ftLastAccessTime.dwHighDateTime=0x1d0ca7d, ftLastWriteTime.dwLowDateTime=0x39bde060, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0124.257] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0124.258] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x910d560, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x910d560, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x39a83580, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0124.258] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd382ac0, ftCreationTime.dwHighDateTime=0x1d0cbb1, ftLastAccessTime.dwLowDateTime=0xdd382ac0, ftLastAccessTime.dwHighDateTime=0x1d0cbb1, ftLastWriteTime.dwLowDateTime=0x39a83580, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0124.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0124.259] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0124.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0124.259] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x418f61e0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x418f61e0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x39bfdc30, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0124.260] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0124.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0124.261] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x418f61e0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x418f61e0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x39bfdc30, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0124.261] FindClose (in: hFindFile=0x767b00 | out: hFindFile=0x767b00) returned 1 [0124.261] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b57fb5f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b66670a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b66670a, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-012B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9B15F~1")) returned 1 [0124.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b57fb5f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b66670a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b66670a, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x768080 [0124.261] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b57fb5f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b66670a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b66670a, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.261] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce855bb0, ftCreationTime.dwHighDateTime=0x1d0cbc0, ftLastAccessTime.dwLowDateTime=0xce855bb0, ftLastAccessTime.dwHighDateTime=0x1d0cbc0, ftLastWriteTime.dwLowDateTime=0x3b606cd0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x27cdde, dwReserved0=0x0, dwReserved1=0x1f, cFileName="LyncMUI.cab", cAlternateFileName="")) returned 1 [0124.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.cab")) returned 0x2020 [0124.262] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0124.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0124.262] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11d62a10, ftCreationTime.dwHighDateTime=0x1d0cbbd, ftLastAccessTime.dwLowDateTime=0x11d62a10, ftLastAccessTime.dwHighDateTime=0x1d0cbbd, ftLastWriteTime.dwLowDateTime=0x3b598f00, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x247000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="LyncMUI.msi", cAlternateFileName="")) returned 1 [0124.263] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3894afb0, ftCreationTime.dwHighDateTime=0x1d0cbb2, ftLastAccessTime.dwLowDateTime=0x3894afb0, ftLastAccessTime.dwHighDateTime=0x1d0cbb2, ftLastWriteTime.dwLowDateTime=0x3b57e150, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="LyncMUI.xml", cAlternateFileName="")) returned 1 [0124.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml")) returned 0x2020 [0124.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0124.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0124.264] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41cb0b50, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41cb0b50, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b666040, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0124.264] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0124.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0124.265] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41cb0b50, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x41cb0b50, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x3b666040, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0124.265] FindClose (in: hFindFile=0x768080 | out: hFindFile=0x768080) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x3b57fb5f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3b66670a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3b66670a, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="{90160000-012B-0409-0000-0000000FF1CE}-C", cAlternateFileName="{9B15F~1")) returned 0 [0124.266] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x198b0d8f, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3c7ea9fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3c7ea9fb, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0124.266] FindClose (in: hFindFile=0x72b100 | out: hFindFile=0x72b100) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x3c0f9b9d, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0xa0000003, dwReserved1=0x772dab4c, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x772dab4c, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0124.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*" (normalized: "c:\\perflogs\\*"), lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName=".", cAlternateFileName="")) returned 0x72b100 [0124.266] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="..", cAlternateFileName="")) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="..", cAlternateFileName="")) returned 0 [0124.266] FindClose (in: hFindFile=0x72b100 | out: hFindFile=0x72b100) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x72b440, lpFindFileData=0xd5fb6c | out: lpFindFileData=0xd5fb6c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x90c43f98, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x90c43f98, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x772dab4c, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0124.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x90c43f98, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x90c43f98, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName=".", cAlternateFileName="")) returned 0x72b100 [0124.267] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x90c43f98, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x90c43f98, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="..", cAlternateFileName="")) returned 1 [0124.267] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x8af48972, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8af48972, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0124.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*" (normalized: "c:\\program files\\common files\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x8af48972, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8af48972, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f00 [0124.267] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x8af48972, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8af48972, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.267] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a4e880, ftCreationTime.dwHighDateTime=0x1d89854, ftLastAccessTime.dwLowDateTime=0x2f82c240, ftLastAccessTime.dwHighDateTime=0x1d89d51, ftLastWriteTime.dwLowDateTime=0x2f82c240, ftLastWriteTime.dwHighDateTime=0x1d89d51, nFileSizeHigh=0x0, nFileSizeLow=0x137c8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="F5u84D9.bmp", cAlternateFileName="")) returned 1 [0124.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\F5u84D9.bmp" (normalized: "c:\\program files\\common files\\f5u84d9.bmp")) returned 0x20 [0124.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\F5u84D9.bmp" (normalized: "c:\\program files\\common files\\f5u84d9.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0124.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0124.268] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a66a50, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xf383ab10, ftLastAccessTime.dwHighDateTime=0x1d8a6ba, ftLastWriteTime.dwLowDateTime=0xf383ab10, ftLastWriteTime.dwHighDateTime=0x1d8a6ba, nFileSizeHigh=0x0, nFileSizeLow=0x1676f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="gCH3TZQDDk2j9.png", cAlternateFileName="GCH3TZ~1.PNG")) returned 1 [0124.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\gCH3TZQDDk2j9.png" (normalized: "c:\\program files\\common files\\gch3tzqddk2j9.png")) returned 0x20 [0124.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\gCH3TZQDDk2j9.png" (normalized: "c:\\program files\\common files\\gch3tzqddk2j9.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0124.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0124.270] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44f868e4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0124.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44f868e4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x767a00 [0124.270] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44f868e4, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0124.270] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0124.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767dc0 [0124.270] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.270] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfdd338a3, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfdd338a3, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 0 [0124.270] FindClose (in: hFindFile=0x767dc0 | out: hFindFile=0x767dc0) returned 1 [0124.270] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f868e4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45413013, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x45413013, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="Filters", cAlternateFileName="")) returned 1 [0124.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Filters\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f868e4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45413013, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4554e7c7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0124.271] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f868e4, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45413013, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4554e7c7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45079efa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xa6b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4540e200, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x13aed8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4542f17e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x187ed8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x456b2f65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0124.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0124.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0124.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0124.272] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x456b2f65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x5d12c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0124.272] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0124.272] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="ink", cAlternateFileName="")) returned 1 [0124.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0125.885] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0125.885] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691089ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6912ebfc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0125.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0125.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.887] GetLastError () returned 0x5 [0125.887] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0125.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0125.888] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0125.888] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0125.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0126.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.058] GetLastError () returned 0x5 [0127.008] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.008] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0127.008] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0127.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x7679c0 [0127.008] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.008] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0127.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.009] GetLastError () returned 0x5 [0127.009] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78ae28, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.009] FindClose (in: hFindFile=0x7679c0 | out: hFindFile=0x7679c0) returned 1 [0127.009] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0127.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0127.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.010] GetLastError () returned 0x5 [0127.010] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0127.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767d00 [0127.011] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.011] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0127.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.012] GetLastError () returned 0x5 [0127.012] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.012] FindClose (in: hFindFile=0x767d00 | out: hFindFile=0x767d00) returned 1 [0127.012] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="da-DK", cAlternateFileName="")) returned 1 [0127.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767dc0 [0127.012] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.012] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0127.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.013] GetLastError () returned 0x5 [0127.013] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.013] FindClose (in: hFindFile=0x767dc0 | out: hFindFile=0x767dc0) returned 1 [0127.018] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="de-DE", cAlternateFileName="")) returned 1 [0127.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0127.018] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.018] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0127.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.019] GetLastError () returned 0x5 [0127.019] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.019] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0127.020] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="el-GR", cAlternateFileName="")) returned 1 [0127.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0127.020] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.020] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0127.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.020] GetLastError () returned 0x5 [0127.020] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.020] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0127.020] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-GB", cAlternateFileName="")) returned 1 [0127.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767900 [0127.021] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.021] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0127.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.022] GetLastError () returned 0x5 [0127.022] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.022] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0127.022] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767f80 [0127.094] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.095] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3bdfd4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b3e423a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0127.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0127.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.151] GetLastError () returned 0x5 [0127.153] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3e423a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0127.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0127.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.154] GetLastError () returned 0x5 [0127.154] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4ef2e1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4ef2e1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0127.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0127.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.155] GetLastError () returned 0x5 [0127.155] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0127.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0127.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.184] GetLastError () returned 0x5 [0127.184] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b456971, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0127.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0127.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.186] GetLastError () returned 0x5 [0127.186] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b40a495, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0127.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0127.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.188] GetLastError () returned 0x5 [0127.188] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0127.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0127.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.189] GetLastError () returned 0x5 [0127.189] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c57ed8c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c57ed8c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c57ed8c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0127.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0127.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.190] GetLastError () returned 0x5 [0127.190] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0127.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0127.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.190] GetLastError () returned 0x5 [0127.191] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0127.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0127.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.191] GetLastError () returned 0x5 [0127.191] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0127.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0127.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.192] GetLastError () returned 0x5 [0127.192] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b5619f1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b587c54, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0127.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0127.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.196] GetLastError () returned 0x5 [0127.196] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0127.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0127.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.197] GetLastError () returned 0x5 [0127.197] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0127.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0127.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.198] GetLastError () returned 0x5 [0127.198] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0127.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0127.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.199] GetLastError () returned 0x5 [0127.199] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c558b79, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c558b79, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c558b79, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0127.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0127.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.200] GetLastError () returned 0x5 [0127.200] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0127.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0127.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.200] GetLastError () returned 0x5 [0127.201] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4a2e36, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0127.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0127.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.203] GetLastError () returned 0x5 [0127.203] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a4fbf, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c5a4fbf, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c5a4fbf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0127.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0127.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.204] GetLastError () returned 0x5 [0127.204] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0127.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0127.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.204] GetLastError () returned 0x5 [0127.205] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0127.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0127.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.205] GetLastError () returned 0x5 [0127.205] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0127.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.206] GetLastError () returned 0x5 [0127.206] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0127.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0127.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.207] GetLastError () returned 0x5 [0127.207] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0127.207] FindClose (in: hFindFile=0x767f80 | out: hFindFile=0x767f80) returned 1 [0127.207] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="es-ES", cAlternateFileName="")) returned 1 [0127.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767dc0 [0127.208] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.208] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0127.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.209] GetLastError () returned 0x5 [0127.209] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.209] FindClose (in: hFindFile=0x767dc0 | out: hFindFile=0x767dc0) returned 1 [0127.209] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="es-MX", cAlternateFileName="")) returned 1 [0127.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767c40 [0127.209] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.209] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0127.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.214] GetLastError () returned 0x5 [0127.214] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.214] FindClose (in: hFindFile=0x767c40 | out: hFindFile=0x767c40) returned 1 [0127.214] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="et-EE", cAlternateFileName="")) returned 1 [0127.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767d00 [0127.215] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.215] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0127.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.215] GetLastError () returned 0x5 [0127.215] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.216] FindClose (in: hFindFile=0x767d00 | out: hFindFile=0x767d00) returned 1 [0127.216] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0127.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767a80 [0127.216] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.216] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0127.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.217] GetLastError () returned 0x5 [0127.217] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78a760, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.217] FindClose (in: hFindFile=0x767a80 | out: hFindFile=0x767a80) returned 1 [0127.217] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5ab195d5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5abb1fd7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x1f, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0127.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0127.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.218] GetLastError () returned 0x5 [0127.218] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5abd7ff0, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5ac24455, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0127.218] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0127.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0127.219] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.219] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0127.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.220] GetLastError () returned 0x5 [0127.220] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.220] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0127.220] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0127.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0127.220] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0127.220] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0127.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0127.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.221] GetLastError () returned 0x5 [0127.221] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0127.221] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0127.221] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0127.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0128.827] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0128.828] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0128.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0128.829] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0128.829] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0128.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0128.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.830] GetLastError () returned 0x5 [0128.830] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0128.830] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0128.831] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0128.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0128.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.831] GetLastError () returned 0x5 [0128.831] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="insert", cAlternateFileName="")) returned 1 [0128.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7541e0, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767ac0 [0128.832] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7541e0, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.832] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x7541e0, dwReserved1=0xd5e268, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0128.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0128.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.833] GetLastError () returned 0x5 [0128.833] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x7541e0, dwReserved1=0xd5e268, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0128.833] FindClose (in: hFindFile=0x767ac0 | out: hFindFile=0x767ac0) returned 1 [0128.833] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0128.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0128.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.833] GetLastError () returned 0x5 [0128.833] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="keypad", cAlternateFileName="")) returned 1 [0128.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753568, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x768040 [0128.834] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753568, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.834] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x753568, dwReserved1=0xd5e268, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0128.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0128.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.834] GetLastError () returned 0x5 [0128.834] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x753568, dwReserved1=0xd5e268, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0128.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0128.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.835] GetLastError () returned 0x5 [0128.835] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x753568, dwReserved1=0xd5e268, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0128.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0128.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.835] GetLastError () returned 0x5 [0128.835] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x753568, dwReserved1=0xd5e268, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0128.835] FindClose (in: hFindFile=0x768040 | out: hFindFile=0x768040) returned 1 [0128.838] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0128.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0128.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.838] GetLastError () returned 0x5 [0128.838] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="main", cAlternateFileName="")) returned 1 [0128.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767bc0 [0128.916] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.916] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="base.xml", cAlternateFileName="")) returned 1 [0128.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0128.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.917] GetLastError () returned 0x5 [0128.917] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0128.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0128.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.917] GetLastError () returned 0x5 [0128.917] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0128.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0128.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.918] GetLastError () returned 0x5 [0128.918] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0128.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0128.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.919] GetLastError () returned 0x5 [0128.919] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0128.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0128.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.919] GetLastError () returned 0x5 [0128.919] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0128.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0128.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.920] GetLastError () returned 0x5 [0128.920] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0128.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0128.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.920] GetLastError () returned 0x5 [0128.920] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0128.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0128.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.921] GetLastError () returned 0x5 [0128.921] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0128.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0128.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.922] GetLastError () returned 0x5 [0128.922] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0128.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0128.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.922] GetLastError () returned 0x5 [0128.922] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0128.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0128.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.923] GetLastError () returned 0x5 [0128.923] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0128.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0128.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.923] GetLastError () returned 0x5 [0128.924] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0128.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0128.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.924] GetLastError () returned 0x5 [0128.925] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x753e98, dwReserved1=0xd5e268, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0128.925] FindClose (in: hFindFile=0x767bc0 | out: hFindFile=0x767bc0) returned 1 [0128.925] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0128.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0128.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.925] GetLastError () returned 0x5 [0128.925] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0128.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767d00 [0128.925] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.926] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0128.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0128.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.926] GetLastError () returned 0x5 [0128.926] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0128.926] FindClose (in: hFindFile=0x767d00 | out: hFindFile=0x767d00) returned 1 [0128.926] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0128.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0128.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.927] GetLastError () returned 0x5 [0128.927] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0128.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767d00 [0128.927] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.927] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0128.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0128.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.928] GetLastError () returned 0x5 [0128.928] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0128.928] FindClose (in: hFindFile=0x767d00 | out: hFindFile=0x767d00) returned 1 [0128.928] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0128.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0128.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.929] GetLastError () returned 0x5 [0128.929] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="osknav", cAlternateFileName="")) returned 1 [0128.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x768080 [0128.929] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.929] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0128.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0128.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.929] GetLastError () returned 0x5 [0128.929] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0128.930] FindClose (in: hFindFile=0x768080 | out: hFindFile=0x768080) returned 1 [0128.930] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0128.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0128.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.930] GetLastError () returned 0x5 [0128.930] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0128.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0128.973] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.973] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0128.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0128.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.974] GetLastError () returned 0x5 [0128.974] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x753760, dwReserved1=0xd5e268, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0128.974] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0128.974] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0128.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0128.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.975] GetLastError () returned 0x5 [0128.975] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0128.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767900 [0128.975] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.975] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0128.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0128.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.976] GetLastError () returned 0x5 [0128.976] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0128.976] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0128.976] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0128.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0128.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.976] GetLastError () returned 0x5 [0128.976] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="symbols", cAlternateFileName="")) returned 1 [0128.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0128.977] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0128.977] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0128.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0128.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.977] GetLastError () returned 0x5 [0128.977] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0128.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0128.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.978] GetLastError () returned 0x5 [0128.978] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0128.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0128.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.981] GetLastError () returned 0x5 [0128.981] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x7388e8, dwReserved1=0xd5e268, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0128.981] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0128.981] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0128.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0128.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.982] GetLastError () returned 0x5 [0128.982] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0128.982] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0128.982] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="he-IL", cAlternateFileName="")) returned 1 [0128.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767fc0 [0128.982] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0128.982] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0128.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0128.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.983] GetLastError () returned 0x5 [0128.983] FindNextFileW (in: hFindFile=0x767fc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0128.983] FindClose (in: hFindFile=0x767fc0 | out: hFindFile=0x767fc0) returned 1 [0128.983] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0128.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0128.986] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0128.986] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0128.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0128.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.986] GetLastError () returned 0x5 [0128.986] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0128.986] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0128.986] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0128.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0128.987] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0128.987] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0128.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0128.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.987] GetLastError () returned 0x5 [0128.987] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78fae0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0128.987] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0128.987] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f00a1f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67f00a1f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0128.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0128.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.988] GetLastError () returned 0x5 [0128.988] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0128.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78b918, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767940 [0128.988] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78b918, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0128.989] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78b918, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 0 [0128.989] FindClose (in: hFindFile=0x767940 | out: hFindFile=0x767940) returned 1 [0128.989] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3614fe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd31b567d, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd31db8ce, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x77fd0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0128.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0128.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.989] GetLastError () returned 0x5 [0128.989] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f26c7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67fbf5f5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0128.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0128.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.989] GetLastError () returned 0x5 [0128.989] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4200b7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3417c6c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd3548f4a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2646a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0128.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0128.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.990] GetLastError () returned 0x5 [0128.990] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3f9e60, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3227d93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd33cb79b, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x35ce20, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0128.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0128.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.991] GetLastError () returned 0x5 [0128.991] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0128.991] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1fda00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0128.991] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691ed82a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x69213a47, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5c000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0128.991] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0128.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0129.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.055] GetLastError () returned 0x5 [0129.055] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0129.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0129.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.056] GetLastError () returned 0x5 [0129.056] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0129.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0129.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.057] GetLastError () returned 0x5 [0129.057] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0129.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0129.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.058] GetLastError () returned 0x5 [0129.058] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0129.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0129.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.058] GetLastError () returned 0x5 [0129.058] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0129.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0129.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.061] GetLastError () returned 0x5 [0129.061] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0129.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0129.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.062] GetLastError () returned 0x5 [0129.062] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0129.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0129.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.063] GetLastError () returned 0x5 [0129.063] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0129.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0129.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.063] GetLastError () returned 0x5 [0129.063] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0129.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0129.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.064] GetLastError () returned 0x5 [0129.064] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0129.064] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0129.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0129.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.157] GetLastError () returned 0x5 [0129.157] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0129.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0129.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.158] GetLastError () returned 0x5 [0129.158] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0129.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0129.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.158] GetLastError () returned 0x5 [0129.158] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0129.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0129.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.159] GetLastError () returned 0x5 [0129.159] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0129.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0129.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.160] GetLastError () returned 0x5 [0129.160] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e68076, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0129.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0129.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.160] GetLastError () returned 0x5 [0129.160] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0129.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0129.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.161] GetLastError () returned 0x5 [0129.161] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0129.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0129.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.167] GetLastError () returned 0x5 [0129.167] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0129.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0129.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.168] GetLastError () returned 0x5 [0129.168] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6917b208, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6917b208, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0129.168] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0129.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0129.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.168] GetLastError () returned 0x5 [0129.168] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0129.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0129.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.169] GetLastError () returned 0x5 [0129.169] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0129.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0129.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.170] GetLastError () returned 0x5 [0129.170] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0129.170] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0129.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0129.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.170] GetLastError () returned 0x5 [0129.171] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0129.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0129.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.172] GetLastError () returned 0x5 [0129.172] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0129.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0129.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.172] GetLastError () returned 0x5 [0129.172] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0129.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0129.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.173] GetLastError () returned 0x5 [0129.173] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0129.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0129.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.173] GetLastError () returned 0x5 [0129.173] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0129.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0129.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.174] GetLastError () returned 0x5 [0129.174] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0129.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0129.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.174] GetLastError () returned 0x5 [0129.174] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0129.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0129.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.175] GetLastError () returned 0x5 [0129.175] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="it-IT", cAlternateFileName="")) returned 1 [0129.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0129.175] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.175] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0129.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.176] GetLastError () returned 0x5 [0129.176] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.176] FindClose (in: hFindFile=0x767b00 | out: hFindFile=0x767b00) returned 1 [0129.177] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0129.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0129.177] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.177] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0129.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.178] GetLastError () returned 0x5 [0129.178] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.178] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0129.178] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2306d6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2306d6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2306d6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x136a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0129.178] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0129.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0129.178] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.178] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0129.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.179] GetLastError () returned 0x5 [0129.179] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.179] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0129.179] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0129.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0129.179] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.179] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0129.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0129.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.180] GetLastError () returned 0x5 [0129.180] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0129.180] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0129.180] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0129.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0129.180] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.180] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0129.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.182] GetLastError () returned 0x5 [0129.182] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.182] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0129.182] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0129.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x768080 [0129.182] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0129.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.183] GetLastError () returned 0x5 [0129.183] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.183] FindClose (in: hFindFile=0x768080 | out: hFindFile=0x768080) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b8f5213, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b98dcaf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a9c00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fad53c8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5fad53c8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5fad53c8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5851d393, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5daeeef5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5db87a6d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63fd1a26, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x641c177d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x618000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67e68025, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67eda783, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10b400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0129.183] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0129.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x768000 [0129.184] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.184] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0129.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.184] GetLastError () returned 0x5 [0129.184] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.184] FindClose (in: hFindFile=0x768000 | out: hFindFile=0x768000) returned 1 [0129.184] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0129.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767f80 [0129.185] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.185] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0129.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.185] GetLastError () returned 0x5 [0129.185] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.185] FindClose (in: hFindFile=0x767f80 | out: hFindFile=0x767f80) returned 1 [0129.185] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0129.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0129.186] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.186] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0129.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.186] GetLastError () returned 0x5 [0129.186] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.186] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0129.186] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0129.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767d00 [0129.187] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.187] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0129.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.187] GetLastError () returned 0x5 [0129.187] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.187] FindClose (in: hFindFile=0x767d00 | out: hFindFile=0x767d00) returned 1 [0129.188] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0129.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0129.188] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.188] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16643a7b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16643a7b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0129.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.189] GetLastError () returned 0x5 [0129.189] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16643a7b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16643a7b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.189] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0129.189] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0129.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0129.189] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.189] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0129.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.191] GetLastError () returned 0x5 [0129.191] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.191] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0129.191] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2306d6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2306d6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2306d6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ea00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0129.191] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0129.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x768000 [0129.192] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0129.192] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0129.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0129.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.192] GetLastError () returned 0x5 [0129.192] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0129.192] FindClose (in: hFindFile=0x768000 | out: hFindFile=0x768000) returned 1 [0129.192] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6917b208, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb9400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0129.192] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0129.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0130.153] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.153] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0130.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.154] GetLastError () returned 0x5 [0130.154] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.154] FindClose (in: hFindFile=0x767b00 | out: hFindFile=0x767b00) returned 1 [0130.154] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0130.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0130.154] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.154] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0130.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.155] GetLastError () returned 0x5 [0130.155] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.155] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0130.155] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0130.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0130.156] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.156] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0130.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.156] GetLastError () returned 0x5 [0130.157] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.157] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0130.157] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0130.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0130.157] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.157] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0130.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.158] GetLastError () returned 0x5 [0130.158] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.158] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0130.158] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0130.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767ac0 [0130.159] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.159] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0130.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.160] GetLastError () returned 0x5 [0130.160] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.160] FindClose (in: hFindFile=0x767ac0 | out: hFindFile=0x767ac0) returned 1 [0130.160] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x69239cf3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x69239cf3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0130.160] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0130.160] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4306ec, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b456971, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5e540, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0130.160] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="th-TH", cAlternateFileName="")) returned 1 [0130.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0130.161] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.161] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0130.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.162] GetLastError () returned 0x5 [0130.162] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.162] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0130.162] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4a2e36, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4c9095, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10ce00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0130.162] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0130.162] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4ef2e1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b5619f1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x105400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0130.162] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6276149f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x627876df, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9e000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0130.162] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5faaf16e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5faaf16e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5fad53c8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0130.162] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0130.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x7679c0 [0130.163] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.163] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0130.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.164] GetLastError () returned 0x5 [0130.164] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.164] FindClose (in: hFindFile=0x7679c0 | out: hFindFile=0x7679c0) returned 1 [0130.164] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0130.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767bc0 [0130.164] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.164] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0130.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.165] GetLastError () returned 0x5 [0130.165] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.165] FindClose (in: hFindFile=0x767bc0 | out: hFindFile=0x767bc0) returned 1 [0130.165] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0130.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767900 [0130.166] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.166] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0130.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.167] GetLastError () returned 0x5 [0130.167] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.167] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0130.167] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0130.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767b40 [0130.168] FindNextFileW (in: hFindFile=0x767b40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.168] FindNextFileW (in: hFindFile=0x767b40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk\\tipresx.dll.mui")) returned 0x20 [0130.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.169] GetLastError () returned 0x5 [0130.169] FindNextFileW (in: hFindFile=0x767b40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.169] FindClose (in: hFindFile=0x767b40 | out: hFindFile=0x767b40) returned 1 [0130.169] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0130.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767c40 [0130.169] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0130.170] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0130.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0130.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.170] GetLastError () returned 0x5 [0130.170] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x78f0c0, dwReserved1=0xd5e6a0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0130.170] FindClose (in: hFindFile=0x767c40 | out: hFindFile=0x767c40) returned 1 [0130.171] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0130.171] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0130.171] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0130.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x7679c0 [0130.171] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.171] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0130.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f80 [0130.172] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.172] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9baea5b3, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9baea5b3, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9baea5b3, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0130.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0130.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.173] GetLastError () returned 0x5 [0130.173] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9baea5b3, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9baea5b3, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9baea5b3, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0130.174] FindClose (in: hFindFile=0x767f80 | out: hFindFile=0x767f80) returned 1 [0130.174] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f772ff, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14f772ff, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14f772ff, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0130.174] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f772ff, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14f772ff, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14f772ff, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0130.174] FindClose (in: hFindFile=0x7679c0 | out: hFindFile=0x7679c0) returned 1 [0130.174] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3eecd2ac, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x4553c2ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4553c2ef, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0130.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3eecd2ac, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x4553c2ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4553c2ef, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0130.174] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3eecd2ac, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x4553c2ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4553c2ef, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.174] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e98500, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44c575e3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x24e98500, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x7c0cd8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="CMigrate.exe", cAlternateFileName="")) returned 1 [0130.174] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261ab200, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x261ab200, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x6f86c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0130.174] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45435307, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45435307, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x45437a81, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Cultures", cAlternateFileName="")) returned 1 [0130.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45435307, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45437a81, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x45437a81, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0130.175] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45435307, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45437a81, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x45437a81, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.175] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae3900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4546a307, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x29ae3900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x1b82a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0130.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\office.odf")) returned 0x20 [0130.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.176] GetLastError () returned 0x20 [0130.176] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ae3900, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4546a307, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x29ae3900, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x1b82a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0130.176] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0130.176] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x3eecd2ac, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3eecd2ac, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-us", cAlternateFileName="")) returned 1 [0130.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x3eecd2ac, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3eecd2ac, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0130.177] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x3eecd2ac, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3eecd2ac, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.177] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oregres.dll.mui", cAlternateFileName="OREGRE~1.MUI")) returned 1 [0130.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\oregres.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\oregres.dll.mui")) returned 0x20 [0130.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\oregres.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\oregres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0130.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0130.178] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b30600, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x70b30600, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oregres.dll.mui", cAlternateFileName="OREGRE~1.MUI")) returned 0 [0130.178] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0130.178] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x450c9f0c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x2ff4c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0130.179] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4514c8ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x4758c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0130.179] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4523a9bb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x8e5ac0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Mso40UIwin32client.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0130.179] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45350ea8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x7c38c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Mso99Lwin32client.dll", cAlternateFileName="MSO99L~1.DLL")) returned 1 [0130.179] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x453a3eb4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x150ed8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0130.179] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x453aa0d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x112a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0130.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxev.dll")) returned 0x20 [0130.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0130.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0130.181] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x453c61b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x360a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0130.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmled.exe")) returned 0x20 [0130.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0130.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0130.183] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x453cc39a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x100c8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0130.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmlmf.dll")) returned 0x20 [0130.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0130.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0130.184] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x4553d631, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oregres.dll", cAlternateFileName="")) returned 1 [0130.184] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x4553d631, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oregres.dll", cAlternateFileName="")) returned 0 [0130.184] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0130.184] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ebef3a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ebef3a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0130.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ebef3a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ebef3a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0130.186] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ebef3a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ebef3a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.187] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0130.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0130.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.188] GetLastError () returned 0x5 [0130.188] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0130.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0130.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.189] GetLastError () returned 0x5 [0130.189] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0130.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0130.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.189] GetLastError () returned 0x5 [0130.190] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0130.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0130.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.190] GetLastError () returned 0x5 [0130.190] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0130.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0130.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.191] GetLastError () returned 0x5 [0130.191] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3030bc4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97067fbb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97067fbb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0130.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0130.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0130.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0130.901] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0130.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0130.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.902] GetLastError () returned 0x5 [0130.902] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0130.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0130.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.902] GetLastError () returned 0x5 [0130.902] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0130.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0130.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.904] GetLastError () returned 0x5 [0130.904] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6746c149, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6746c149, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0130.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0130.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.904] GetLastError () returned 0x5 [0130.904] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0130.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0130.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.905] GetLastError () returned 0x5 [0130.905] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0130.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0130.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.906] GetLastError () returned 0x5 [0130.906] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0130.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0130.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.907] GetLastError () returned 0x5 [0130.907] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x1f, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0130.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0130.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.908] GetLastError () returned 0x5 [0130.908] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x1f, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0130.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0130.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.908] GetLastError () returned 0x5 [0130.909] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0130.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0130.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.909] GetLastError () returned 0x5 [0130.909] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0130.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0130.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.910] GetLastError () returned 0x5 [0130.910] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0130.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0130.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.911] GetLastError () returned 0x5 [0130.911] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x677670bc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6778d31e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0130.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0130.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.912] GetLastError () returned 0x5 [0130.912] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0130.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0130.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.912] GetLastError () returned 0x5 [0130.912] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0130.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0130.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.913] GetLastError () returned 0x5 [0130.913] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0130.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0130.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.914] GetLastError () returned 0x5 [0130.915] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5858faa2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0130.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0130.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.915] GetLastError () returned 0x5 [0130.915] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0130.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0130.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.917] GetLastError () returned 0x5 [0130.917] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0130.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0130.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.918] GetLastError () returned 0x5 [0130.918] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0130.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0130.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.919] GetLastError () returned 0x5 [0130.919] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0130.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0130.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.919] GetLastError () returned 0x5 [0130.920] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5858faa2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0130.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0130.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.921] GetLastError () returned 0x5 [0130.921] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0130.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0130.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.921] GetLastError () returned 0x5 [0130.921] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0130.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0130.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.922] GetLastError () returned 0x5 [0130.922] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0130.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0130.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.922] GetLastError () returned 0x5 [0130.922] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0130.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0130.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.923] GetLastError () returned 0x5 [0130.923] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0130.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0130.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.923] GetLastError () returned 0x5 [0130.923] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675e9965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675e9965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0130.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0130.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.924] GetLastError () returned 0x5 [0130.924] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0130.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0130.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.925] GetLastError () returned 0x5 [0130.925] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0130.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0130.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.926] GetLastError () returned 0x5 [0130.927] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674923a8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674923a8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0130.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0130.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.934] GetLastError () returned 0x5 [0130.934] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0130.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0130.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.935] GetLastError () returned 0x5 [0130.935] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0130.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0130.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.935] GetLastError () returned 0x5 [0130.935] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0130.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0130.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.937] GetLastError () returned 0x5 [0130.937] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0130.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0130.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.937] GetLastError () returned 0x5 [0130.937] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0130.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0130.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.938] GetLastError () returned 0x5 [0130.938] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0130.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0130.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.938] GetLastError () returned 0x5 [0130.939] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0130.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0130.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.939] GetLastError () returned 0x5 [0130.939] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0130.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0130.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.940] GetLastError () returned 0x5 [0130.940] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x1f, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0130.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0130.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.940] GetLastError () returned 0x5 [0130.940] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x1f, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0130.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0130.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.941] GetLastError () returned 0x5 [0130.941] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0130.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0130.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.942] GetLastError () returned 0x5 [0130.942] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0130.942] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0130.942] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="TextConv", cAlternateFileName="")) returned 1 [0130.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767c40 [0130.942] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.942] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0130.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0130.943] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0130.943] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 0 [0130.943] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0130.943] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 0 [0130.943] FindClose (in: hFindFile=0x767c40 | out: hFindFile=0x767c40) returned 1 [0130.943] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="Triedit", cAlternateFileName="")) returned 1 [0130.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f80 [0131.138] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0131.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767ac0 [0131.138] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 0 [0131.138] FindClose (in: hFindFile=0x767ac0 | out: hFindFile=0x767ac0) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 0 [0131.138] FindClose (in: hFindFile=0x767f80 | out: hFindFile=0x767f80) returned 1 [0131.139] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x21f31071, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8ff5df0d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x8ff5df0d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="VC", cAlternateFileName="")) returned 1 [0131.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x21f31071, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8ff5df0d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x8ff5df0d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0131.139] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x21f31071, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8ff5df0d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x8ff5df0d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.139] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d6e600, ftCreationTime.dwHighDateTime=0x1cbd07f, ftLastAccessTime.dwLowDateTime=0x32a39c72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x39d6e600, ftLastWriteTime.dwHighDateTime=0x1cbd07f, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0131.139] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31ace400, ftCreationTime.dwHighDateTime=0x1cbfe3f, ftLastAccessTime.dwLowDateTime=0x8ff72c46, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x31ace400, ftLastWriteTime.dwHighDateTime=0x1cbfe3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31ace400, ftCreationTime.dwHighDateTime=0x1cbfe3f, ftLastAccessTime.dwLowDateTime=0x8ff72c46, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x31ace400, ftLastWriteTime.dwHighDateTime=0x1cbfe3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0131.140] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="VGX", cAlternateFileName="")) returned 1 [0131.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0131.140] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0131.140] FindClose (in: hFindFile=0x767b00 | out: hFindFile=0x767b00) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x457148dd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x457148dd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="VSTO", cAlternateFileName="")) returned 1 [0131.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x457148dd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x457148dd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f80 [0131.141] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x457148dd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x457148dd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.141] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45726e10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x45726e10, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="10.0", cAlternateFileName="")) returned 1 [0131.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45726e10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4573936f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x768040 [0131.183] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x45726e10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x4573936f, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.183] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44eedfd3, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="1033", cAlternateFileName="")) returned 1 [0131.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44eedfd3, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0131.184] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x44eedfd3, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x2b00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x4ae8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x4ae8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0131.184] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4572a8d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x182e8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45744301, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x594d0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f1406e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f1406e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0131.184] FindClose (in: hFindFile=0x768040 | out: hFindFile=0x768040) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4571974b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x28ae8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0131.184] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x456fd61f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x1f, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0131.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0131.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0131.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0131.186] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45709a29, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x1f, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0131.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0131.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0131.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0131.191] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45709a29, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x1f, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0131.191] FindClose (in: hFindFile=0x767f80 | out: hFindFile=0x767f80) returned 1 [0131.191] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44eedfd3, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x457148dd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x457148dd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73d2f0, dwReserved1=0xd5ef10, cFileName="VSTO", cAlternateFileName="")) returned 0 [0131.191] FindClose (in: hFindFile=0x767a00 | out: hFindFile=0x767a00) returned 1 [0131.191] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea063230, ftCreationTime.dwHighDateTime=0x1d8a5c3, ftLastAccessTime.dwLowDateTime=0x6bcb3110, ftLastAccessTime.dwHighDateTime=0x1d8a607, ftLastWriteTime.dwLowDateTime=0x6bcb3110, ftLastWriteTime.dwHighDateTime=0x1d8a607, nFileSizeHigh=0x0, nFileSizeLow=0xe0ee, dwReserved0=0x0, dwReserved1=0x1f, cFileName="rdCuc5FgRBkMF64Lt.png", cAlternateFileName="RDCUC5~1.PNG")) returned 1 [0131.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\rdCuc5FgRBkMF64Lt.png" (normalized: "c:\\program files\\common files\\rdcuc5fgrbkmf64lt.png")) returned 0x20 [0131.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\rdCuc5FgRBkMF64Lt.png" (normalized: "c:\\program files\\common files\\rdcuc5fgrbkmf64lt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0131.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0131.192] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Services", cAlternateFileName="")) returned 1 [0131.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*" (normalized: "c:\\program files\\common files\\services\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x767bc0 [0131.193] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0131.193] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0131.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0131.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.194] GetLastError () returned 0x5 [0131.194] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0131.194] FindClose (in: hFindFile=0x767bc0 | out: hFindFile=0x767bc0) returned 1 [0131.194] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="System", cAlternateFileName="")) returned 1 [0131.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*" (normalized: "c:\\program files\\common files\\system\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0131.195] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0131.195] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="ado", cAlternateFileName="")) returned 1 [0131.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*" (normalized: "c:\\program files\\common files\\system\\ado\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0131.197] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.197] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0131.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0131.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.199] GetLastError () returned 0x5 [0131.199] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0131.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0131.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.200] GetLastError () returned 0x5 [0131.200] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0131.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0131.200] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0131.200] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4195a2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d4195a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d4195a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x78f128, dwReserved1=0xd5e6a0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0131.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0131.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.202] GetLastError () returned 0x5 [0131.202] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4195a2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d4195a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d4195a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x78f128, dwReserved1=0xd5e6a0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0131.202] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0131.202] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0131.202] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187321c1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x187321c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x187321c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x133400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0131.202] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0131.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0131.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.203] GetLastError () returned 0x5 [0131.203] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0131.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0131.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.204] GetLastError () returned 0x5 [0131.204] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0131.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0131.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.205] GetLastError () returned 0x5 [0131.205] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0131.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0131.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.206] GetLastError () returned 0x5 [0131.206] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0131.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0131.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.207] GetLastError () returned 0x5 [0131.207] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0131.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0131.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.207] GetLastError () returned 0x5 [0131.207] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19212d44, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19212d44, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19212d44, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0131.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0131.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.208] GetLastError () returned 0x5 [0131.208] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5d200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0131.208] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193b671c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x193b671c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x193b671c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0131.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0131.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.209] GetLastError () returned 0x5 [0131.209] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0131.209] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187321c1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x187321c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x187321c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0131.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0131.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.209] GetLastError () returned 0x5 [0131.209] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x68800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0131.209] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18816fd8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x18816fd8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x18816fd8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0131.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0131.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.211] GetLastError () returned 0x5 [0131.211] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193b671c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x193b671c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x193b671c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0131.211] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193b671c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x193b671c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x193b671c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0131.212] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0131.212] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0131.212] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="en-US", cAlternateFileName="")) returned 1 [0131.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\en-us\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767a00 [0131.212] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.212] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0131.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0131.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.214] GetLastError () returned 0x5 [0131.214] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0131.214] FindClose (in: hFindFile=0x767a00 | out: hFindFile=0x767a00) returned 1 [0131.214] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="msadc", cAlternateFileName="")) returned 1 [0131.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*" (normalized: "c:\\program files\\common files\\system\\msadc\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e00 [0131.241] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.241] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x1f, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0131.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0131.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.868] GetLastError () returned 0x5 [0131.868] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0131.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0131.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.868] GetLastError () returned 0x5 [0131.868] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0131.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767900 [0131.869] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0131.869] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0131.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0131.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.870] GetLastError () returned 0x5 [0131.870] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0131.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0131.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.871] GetLastError () returned 0x5 [0131.871] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0131.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0131.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.872] GetLastError () returned 0x5 [0131.872] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0131.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0131.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.873] GetLastError () returned 0x5 [0131.873] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0131.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0131.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.874] GetLastError () returned 0x5 [0131.874] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x723658, dwReserved1=0xd5e6a0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0131.874] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9b600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40c00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0131.874] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0131.875] FindClose (in: hFindFile=0x767e00 | out: hFindFile=0x767e00) returned 1 [0131.875] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0131.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*" (normalized: "c:\\program files\\common files\\system\\ole db\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0131.875] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.875] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0131.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0131.875] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.875] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0131.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0131.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.876] GetLastError () returned 0x5 [0131.876] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0131.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0131.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.877] GetLastError () returned 0x5 [0131.877] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0131.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0131.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.878] GetLastError () returned 0x5 [0131.878] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0131.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0131.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.879] GetLastError () returned 0x5 [0131.879] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0131.879] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188fbdf3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb0800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe9400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0131.879] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0131.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0131.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.883] GetLastError () returned 0x5 [0131.883] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0131.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0131.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.883] GetLastError () returned 0x5 [0131.883] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd4600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0131.884] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0131.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0131.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.884] GetLastError () returned 0x5 [0131.884] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0131.884] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0131.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0131.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.885] GetLastError () returned 0x5 [0131.885] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0131.885] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0131.885] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1950dc42, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1950dc42, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1950dc42, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7a00, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0131.885] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194e79e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x194e79e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x194e79e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeb800, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0131.885] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194e79e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x194e79e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x194e79e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeb800, dwReserved0=0x78f128, dwReserved1=0xd5ef10, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0131.885] FindClose (in: hFindFile=0x767b00 | out: hFindFile=0x767b00) returned 1 [0131.885] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5711be0, ftCreationTime.dwHighDateTime=0x1d89be7, ftLastAccessTime.dwLowDateTime=0xd69cdc10, ftLastAccessTime.dwHighDateTime=0x1d89f94, ftLastWriteTime.dwLowDateTime=0xd69cdc10, ftLastWriteTime.dwHighDateTime=0x1d89f94, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wear mind.exe", cAlternateFileName="WEARMI~1.EXE")) returned 1 [0131.885] FindNextFileW (in: hFindFile=0x767f00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5711be0, ftCreationTime.dwHighDateTime=0x1d89be7, ftLastAccessTime.dwLowDateTime=0xd69cdc10, ftLastAccessTime.dwHighDateTime=0x1d89f94, ftLastWriteTime.dwLowDateTime=0xd69cdc10, ftLastWriteTime.dwHighDateTime=0x1d89f94, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wear mind.exe", cAlternateFileName="WEARMI~1.EXE")) returned 0 [0131.885] FindClose (in: hFindFile=0x767f00 | out: hFindFile=0x767f00) returned 1 [0131.885] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2f72013, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9701bb02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9701bb02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0131.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0131.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0131.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0131.886] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a526903, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a526903, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0131.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*" (normalized: "c:\\program files\\internet explorer\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a526903, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a526903, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767a80 [0131.887] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a526903, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a526903, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0131.887] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x544070e0, ftCreationTime.dwHighDateTime=0x1d85cf2, ftLastAccessTime.dwLowDateTime=0x7e71b580, ftLastAccessTime.dwHighDateTime=0x1d880ca, ftLastWriteTime.dwLowDateTime=0x7e71b580, ftLastWriteTime.dwHighDateTime=0x1d880ca, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0131.887] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="en-US", cAlternateFileName="")) returned 1 [0131.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*" (normalized: "c:\\program files\\internet explorer\\en-us\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0131.887] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.887] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7175bd4, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa7175bd4, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa7175bd4, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0131.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0131.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.888] GetLastError () returned 0x5 [0131.888] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6884daf, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa6884daf, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa6884daf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0131.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0131.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.889] GetLastError () returned 0x5 [0131.889] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7175bd4, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa7175bd4, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa7175bd4, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0131.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0131.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.889] GetLastError () returned 0x5 [0131.889] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7175bd4, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa7175bd4, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa7175bd4, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0131.889] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0131.889] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38afa640, ftCreationTime.dwHighDateTime=0x1d85b01, ftLastAccessTime.dwLowDateTime=0xb8ddd660, ftLastAccessTime.dwHighDateTime=0x1d877bd, ftLastWriteTime.dwLowDateTime=0xb8ddd660, ftLastWriteTime.dwHighDateTime=0x1d877bd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="far.exe", cAlternateFileName="")) returned 1 [0131.889] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34175f78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34175f78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x78800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3419c1cf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3419c1cf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x78000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34175f78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34175f78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x34175f78, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x36800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3419c1cf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3419c1cf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x66400, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33517c70, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x33517c70, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x33517c70, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc74c0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="images", cAlternateFileName="")) returned 1 [0131.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*" (normalized: "c:\\program files\\internet explorer\\images\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0131.890] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.890] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340dd612, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x340dd612, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x340dd612, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x1f, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0131.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0131.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.890] GetLastError () returned 0x5 [0131.891] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340dd612, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x340dd612, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x340dd612, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x1f, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0131.891] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0131.891] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0131.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*" (normalized: "c:\\program files\\internet explorer\\signup\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0131.891] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.891] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="install.ins", cAlternateFileName="")) returned 1 [0131.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0131.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0131.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0131.892] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="install.ins", cAlternateFileName="")) returned 0 [0131.892] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0131.892] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0131.892] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d8bc90, ftCreationTime.dwHighDateTime=0x1d827fa, ftLastAccessTime.dwLowDateTime=0xb78961b0, ftLastAccessTime.dwHighDateTime=0x1d84cc2, ftLastWriteTime.dwLowDateTime=0xb78961b0, ftLastWriteTime.dwHighDateTime=0x1d84cc2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="whatsapp.exe", cAlternateFileName="")) returned 1 [0131.892] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d8bc90, ftCreationTime.dwHighDateTime=0x1d827fa, ftLastAccessTime.dwLowDateTime=0xb78961b0, ftLastAccessTime.dwHighDateTime=0x1d84cc2, ftLastWriteTime.dwLowDateTime=0xb78961b0, ftLastWriteTime.dwHighDateTime=0x1d84cc2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="whatsapp.exe", cAlternateFileName="")) returned 0 [0131.893] FindClose (in: hFindFile=0x767a80 | out: hFindFile=0x767a80) returned 1 [0131.893] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0131.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*" (normalized: "c:\\program files\\microsoft office\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0131.893] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0131.893] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x456dc716, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x456dc716, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Office16", cAlternateFileName="")) returned 1 [0131.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*" (normalized: "c:\\program files\\microsoft office\\office16\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x456dc716, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x456dc716, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767900 [0131.893] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x456dc716, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x456dc716, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.893] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3eecd2ac, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="1033", cAlternateFileName="")) returned 1 [0131.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\*" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3eecd2ac, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0131.894] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x3edb3185, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x3eecd2ac, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0131.894] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddadc500, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3edb3185, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xddadc500, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x2ab8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0131.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\bhointl.dll")) returned 0x20 [0131.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0131.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0131.895] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddadc500, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3ee2589b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xddadc500, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x87d4a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0131.895] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedef200, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3ee4b947, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xdedef200, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x522a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="lyncDesktopResources.dll", cAlternateFileName="LYNCDE~1.DLL")) returned 1 [0131.895] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddadc500, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3eea6da8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xddadc500, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x2b118, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0131.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mapishellr.dll")) returned 0x20 [0131.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b8 [0131.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0131.896] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x3eea6da8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Mso Example Intl Setup File A.txt", cAlternateFileName="MSOEXA~1.TXT")) returned 1 [0131.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt")) returned 0x20 [0131.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c0 [0131.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0131.897] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x3eea6da8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Mso Example Intl Setup File B.txt", cAlternateFileName="MSOEXA~2.TXT")) returned 1 [0131.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt")) returned 0x20 [0131.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c8 [0131.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0131.898] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedef200, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3ee4b947, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xdedef200, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0xe8a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ocapires.dll", cAlternateFileName="")) returned 1 [0131.898] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedef200, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3ee4b947, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xdedef200, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x2ca8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OcHelperResource.dll", cAlternateFileName="OCHELP~1.DLL")) returned 1 [0131.898] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedef200, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3ee8078e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xdedef200, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x16f0a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OcPubRes.dll", cAlternateFileName="")) returned 1 [0131.898] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="officeinventoryagentfallback.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0131.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml")) returned 0x20 [0131.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d0 [0131.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0131.899] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e43300, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x3eecd2ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x71e43300, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcf6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="officeinventoryagentlogon.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0131.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml")) returned 0x20 [0131.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d8 [0131.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0131.900] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedef200, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3ee8078e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xdedef200, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x28aa8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="UcAddinRes.dll", cAlternateFileName="UCADDI~1.DLL")) returned 1 [0131.900] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedef200, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3eea6da8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xdedef200, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x139aa8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="UccApiRes.dll", cAlternateFileName="UCCAPI~1.DLL")) returned 1 [0131.900] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedef200, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0x3eea6da8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xdedef200, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x139aa8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="UccApiRes.dll", cAlternateFileName="UCCAPI~1.DLL")) returned 0 [0131.901] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0131.901] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48accb00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f6520a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x48accb00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x78a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppSharingChromeHook64.dll", cAlternateFileName="APPSHA~1.DLL")) returned 1 [0131.901] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48accb00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x48accb00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x98a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppSharingHookController64.exe", cAlternateFileName="APPSHA~1.EXE")) returned 1 [0131.901] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86283000, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x44eedfd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86283000, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Custom.propdesc", cAlternateFileName="CUSTOM~1.PRO")) returned 1 [0131.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office16\\custom.propdesc")) returned 0x20 [0131.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office16\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0131.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0131.902] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2adf6600, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f3a395, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x2adf6600, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x210cd8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0131.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\grooveex.dll")) returned 0x20 [0131.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\grooveex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.903] GetLastError () returned 0x20 [0131.903] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f6520a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x478a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0131.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\ieawsdc.dll")) returned 0x20 [0131.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\ieawsdc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e4 [0131.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0131.904] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x11f18, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0131.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\mapishell.dll")) returned 0x20 [0131.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\mapishell.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8ec [0131.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0131.905] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0131.906] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x4535704a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Mso Example Setup File A.txt", cAlternateFileName="MSOEXA~1.TXT")) returned 1 [0131.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt")) returned 0x20 [0132.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b8 [0132.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0132.274] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x4535f982, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x196c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0132.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\msohev.dll")) returned 0x20 [0132.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\msohev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0132.277] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x453681d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x142c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0132.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\msohevi.dll")) returned 0x20 [0132.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\msohevi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f8 [0132.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0132.287] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45370a7b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x168c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0132.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\msohtmed.exe")) returned 0x20 [0132.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\msohtmed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0132.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0132.293] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x274bdf00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45380856, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x274bdf00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x65ab0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msoia.exe", cAlternateFileName="")) returned 1 [0132.294] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x274bdf00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x453e9858, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x274bdf00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x58e8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msoianetutil.dll", cAlternateFileName="MSOIAN~1.DLL")) returned 1 [0132.294] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65490300, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x453e3679, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x65490300, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x4c0c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0132.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\nameext.dll")) returned 0x20 [0132.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\nameext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0132.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0132.296] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x44f868e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x376a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OCHelper.dll", cAlternateFileName="")) returned 1 [0132.296] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x454767b4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x406c8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0132.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\olkfstub.dll")) returned 0x20 [0132.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\olkfstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90c [0132.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0132.297] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45481670, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x38ad8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0132.297] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x45489f7f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x316d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0132.297] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x454ea7b0, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x455374d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x455374d7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OneNote", cAlternateFileName="")) returned 1 [0132.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\*" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x454ea7b0, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x455374d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x455374d7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0132.300] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x454ea7b0, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x455374d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x455374d7, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0132.300] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x4550a1ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="prnms006.inf", cAlternateFileName="")) returned 1 [0132.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnms006.inf" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnms006.inf")) returned 0x20 [0132.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnms006.inf" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnms006.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x918 [0132.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0132.302] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x454ea7b0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e56, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="prnSendToOneNote.cat", cAlternateFileName="PRNSEN~1.CAT")) returned 1 [0132.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote.cat" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote.cat")) returned 0x20 [0132.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote.cat" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x920 [0132.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0132.303] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45532630, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x265e, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="prnSendToOneNote_win7.cat", cAlternateFileName="PRNSEN~2.CAT")) returned 1 [0132.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.cat" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.cat")) returned 0x20 [0132.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.cat" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0132.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0132.304] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45538823, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6fe, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="prnSendToOneNote_win7.inf", cAlternateFileName="PRNSEN~1.INF")) returned 1 [0132.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.inf" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.inf")) returned 0x20 [0132.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.inf" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x930 [0132.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0132.305] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45522910, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="SendToOneNote-manifest.ini", cAlternateFileName="SENDTO~2.INI")) returned 1 [0132.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini")) returned 0x20 [0132.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x938 [0132.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0132.307] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x4552d890, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0132.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml")) returned 0x20 [0132.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x940 [0132.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0132.308] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x455053aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1 [0132.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.gpd")) returned 0x20 [0132.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x948 [0132.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0132.309] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45512ad0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~1.INI")) returned 1 [0132.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini")) returned 0x20 [0132.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x950 [0132.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0132.311] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x4551c739, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x180d0, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="SendToOneNoteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1 [0132.311] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45528a64, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1 [0132.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenotenames.gpd")) returned 0x20 [0132.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenotenames.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x958 [0132.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0132.313] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x45528a64, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x723fd8, dwReserved1=0xd5ead8, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 0 [0132.313] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0132.313] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x454de408, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x3130b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0132.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\onfilter.dll")) returned 0x20 [0132.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\onfilter.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x914 [0132.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0132.315] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x454e585b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0x194e8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0132.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\onlntcomlib.dll")) returned 0x20 [0132.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\onlntcomlib.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x964 [0132.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0132.316] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc091cd00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0x456c405f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xc091cd00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VisioCustom.propdesc", cAlternateFileName="VISIOC~1.PRO")) returned 1 [0132.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\office16\\visiocustom.propdesc")) returned 0x20 [0132.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\office16\\visiocustom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x96c [0132.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0132.318] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x456f744a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xe72b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VISSHE.DLL", cAlternateFileName="")) returned 1 [0132.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VISSHE.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\visshe.dll")) returned 0x20 [0132.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VISSHE.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\visshe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x974 [0132.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0132.319] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a9ef00, ftCreationTime.dwHighDateTime=0x1d0cb6a, ftLastAccessTime.dwLowDateTime=0x456f744a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x86a9ef00, ftLastWriteTime.dwHighDateTime=0x1d0cb6a, nFileSizeHigh=0x0, nFileSizeLow=0xe72b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="VISSHE.DLL", cAlternateFileName="")) returned 0 [0132.319] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0132.319] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffc79f40, ftCreationTime.dwHighDateTime=0x1d8640b, ftLastAccessTime.dwLowDateTime=0x5c9a5500, ftLastAccessTime.dwHighDateTime=0x1d8814e, ftLastWriteTime.dwLowDateTime=0x5c9a5500, ftLastWriteTime.dwHighDateTime=0x1d8814e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="outlook.exe", cAlternateFileName="")) returned 1 [0132.319] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90b1620, ftCreationTime.dwHighDateTime=0x1d87b40, ftLastAccessTime.dwLowDateTime=0x981e65c0, ftLastAccessTime.dwHighDateTime=0x1d89db5, ftLastWriteTime.dwLowDateTime=0x981e65c0, ftLastWriteTime.dwHighDateTime=0x1d89db5, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wide.exe", cAlternateFileName="")) returned 1 [0132.319] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90b1620, ftCreationTime.dwHighDateTime=0x1d87b40, ftLastAccessTime.dwLowDateTime=0x981e65c0, ftLastAccessTime.dwHighDateTime=0x1d89db5, ftLastWriteTime.dwLowDateTime=0x981e65c0, ftLastWriteTime.dwHighDateTime=0x1d89db5, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wide.exe", cAlternateFileName="")) returned 0 [0132.319] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0132.319] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0132.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*" (normalized: "c:\\program files\\msbuild\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767a00 [0132.319] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0132.319] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a338890, ftCreationTime.dwHighDateTime=0x1d866b1, ftLastAccessTime.dwLowDateTime=0x3ddddf40, ftLastAccessTime.dwHighDateTime=0x1d87c23, ftLastWriteTime.dwLowDateTime=0x3ddddf40, ftLastWriteTime.dwHighDateTime=0x1d87c23, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="enter.exe", cAlternateFileName="")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x169ed980, ftCreationTime.dwHighDateTime=0x1d89d60, ftLastAccessTime.dwLowDateTime=0x55907ef0, ftLastAccessTime.dwHighDateTime=0x1d89dc9, ftLastWriteTime.dwLowDateTime=0x55907ef0, ftLastWriteTime.dwHighDateTime=0x1d89dc9, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x635980e0, ftCreationTime.dwHighDateTime=0x1d876c3, ftLastAccessTime.dwLowDateTime=0x8b232020, ftLastAccessTime.dwHighDateTime=0x1d89510, ftLastWriteTime.dwLowDateTime=0x8b232020, ftLastWriteTime.dwHighDateTime=0x1d89510, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x635980e0, ftCreationTime.dwHighDateTime=0x1d876c3, ftLastAccessTime.dwLowDateTime=0x8b232020, ftLastAccessTime.dwHighDateTime=0x1d89510, ftLastWriteTime.dwLowDateTime=0x8b232020, ftLastWriteTime.dwHighDateTime=0x1d89510, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="spcwin.exe", cAlternateFileName="")) returned 0 [0132.320] FindClose (in: hFindFile=0x767a00 | out: hFindFile=0x767a00) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0132.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*" (normalized: "c:\\program files\\reference assemblies\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x768040 [0132.320] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba431470, ftCreationTime.dwHighDateTime=0x1d8583c, ftLastAccessTime.dwLowDateTime=0x75802e70, ftLastAccessTime.dwHighDateTime=0x1d8a2fd, ftLastWriteTime.dwLowDateTime=0x75802e70, ftLastWriteTime.dwHighDateTime=0x1d8a2fd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8926b0, ftCreationTime.dwHighDateTime=0x1d88f9a, ftLastAccessTime.dwLowDateTime=0xd15a2450, ftLastAccessTime.dwHighDateTime=0x1d89e69, ftLastWriteTime.dwLowDateTime=0xd15a2450, ftLastWriteTime.dwHighDateTime=0x1d89e69, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="third-behind.exe", cAlternateFileName="THIRD-~1.EXE")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8926b0, ftCreationTime.dwHighDateTime=0x1d88f9a, ftLastAccessTime.dwLowDateTime=0xd15a2450, ftLastAccessTime.dwHighDateTime=0x1d89e69, ftLastWriteTime.dwLowDateTime=0xd15a2450, ftLastWriteTime.dwHighDateTime=0x1d89e69, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="third-behind.exe", cAlternateFileName="THIRD-~1.EXE")) returned 0 [0132.320] FindClose (in: hFindFile=0x768040 | out: hFindFile=0x768040) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x8a526903, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a526903, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0132.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*" (normalized: "c:\\program files\\uninstall information\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x8a526903, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a526903, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767900 [0132.321] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x8a526903, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a526903, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0132.321] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35189490, ftCreationTime.dwHighDateTime=0x1d8411d, ftLastAccessTime.dwLowDateTime=0x9b05fcb0, ftLastAccessTime.dwHighDateTime=0x1d8965f, ftLastWriteTime.dwLowDateTime=0x9b05fcb0, ftLastWriteTime.dwHighDateTime=0x1d8965f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="yahoomessenger.exe", cAlternateFileName="YAHOOM~1.EXE")) returned 1 [0132.321] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35189490, ftCreationTime.dwHighDateTime=0x1d8411d, ftLastAccessTime.dwLowDateTime=0x9b05fcb0, ftLastAccessTime.dwHighDateTime=0x1d8965f, ftLastWriteTime.dwLowDateTime=0x9b05fcb0, ftLastWriteTime.dwHighDateTime=0x1d8965f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="yahoomessenger.exe", cAlternateFileName="YAHOOM~1.EXE")) returned 0 [0132.321] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0132.321] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0132.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*" (normalized: "c:\\program files\\windows defender\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x7679c0 [0132.321] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0132.321] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24b6, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="AmMonitoringInstall.mof", cAlternateFileName="")) returned 1 [0132.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\AmMonitoringInstall.mof" (normalized: "c:\\program files\\windows defender\\ammonitoringinstall.mof")) returned 0x20 [0132.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\AmMonitoringInstall.mof" (normalized: "c:\\program files\\windows defender\\ammonitoringinstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.321] GetLastError () returned 0x5 [0132.322] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="AMMonitoringProvider.dll", cAlternateFileName="")) returned 1 [0132.322] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x520c, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="AmStatusInstall.mof", cAlternateFileName="")) returned 1 [0132.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\AmStatusInstall.mof" (normalized: "c:\\program files\\windows defender\\amstatusinstall.mof")) returned 0x20 [0132.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\AmStatusInstall.mof" (normalized: "c:\\program files\\windows defender\\amstatusinstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.655] GetLastError () returned 0x5 [0132.655] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab0c6af0, ftCreationTime.dwHighDateTime=0x1d873cc, ftLastAccessTime.dwLowDateTime=0xa55c98e0, ftLastAccessTime.dwHighDateTime=0x1d89524, ftLastWriteTime.dwLowDateTime=0xa55c98e0, ftLastWriteTime.dwHighDateTime=0x1d89524, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ccv_server.exe", cAlternateFileName="CCV_SE~1.EXE")) returned 1 [0132.655] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ClientWMIInstall.mof", cAlternateFileName="")) returned 1 [0132.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\ClientWMIInstall.mof" (normalized: "c:\\program files\\windows defender\\clientwmiinstall.mof")) returned 0x20 [0132.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\ClientWMIInstall.mof" (normalized: "c:\\program files\\windows defender\\clientwmiinstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.656] GetLastError () returned 0x5 [0132.656] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4f000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ConfigSecurityPolicy.exe", cAlternateFileName="")) returned 1 [0132.656] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x68400, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="DataLayer.dll", cAlternateFileName="")) returned 1 [0132.656] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x171cc0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="DbgHelp.dll", cAlternateFileName="")) returned 1 [0132.656] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fc46e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2fc46e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2fc46e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="DefenderCSP.dll", cAlternateFileName="")) returned 1 [0132.656] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="en-US", cAlternateFileName="")) returned 1 [0132.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*" (normalized: "c:\\program files\\windows defender\\en-us\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x767cc0 [0132.657] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0132.657] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="EppManifest.dll.mui", cAlternateFileName="")) returned 1 [0132.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\EppManifest.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\eppmanifest.dll.mui")) returned 0x20 [0132.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\EppManifest.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\eppmanifest.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.658] GetLastError () returned 0x5 [0132.658] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0132.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui")) returned 0x20 [0132.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.658] GetLastError () returned 0x5 [0132.658] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0132.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui")) returned 0x20 [0132.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.659] GetLastError () returned 0x5 [0132.659] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x14800, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1 [0132.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui")) returned 0x20 [0132.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.659] GetLastError () returned 0x5 [0132.659] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="ProtectionManagement.dll.mui", cAlternateFileName="")) returned 1 [0132.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement.dll.mui")) returned 0x20 [0132.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.660] GetLastError () returned 0x5 [0132.660] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="ProtectionManagement.mfl", cAlternateFileName="")) returned 1 [0132.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement.mfl")) returned 0x20 [0132.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement.mfl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.660] GetLastError () returned 0x5 [0132.660] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="ProtectionManagement_Uninstall.mfl", cAlternateFileName="")) returned 1 [0132.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement_Uninstall.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement_uninstall.mfl")) returned 0x20 [0132.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement_Uninstall.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement_uninstall.mfl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.661] GetLastError () returned 0x5 [0132.661] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 1 [0132.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\shellext.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\shellext.dll.mui")) returned 0x20 [0132.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\shellext.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\shellext.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.661] GetLastError () returned 0x5 [0132.661] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x723bd8, dwReserved1=0xd5ef10, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 0 [0132.661] FindClose (in: hFindFile=0x767cc0 | out: hFindFile=0x767cc0) returned 1 [0132.661] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0132.661] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="FepUnregister.mof", cAlternateFileName="")) returned 1 [0132.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\FepUnregister.mof" (normalized: "c:\\program files\\windows defender\\fepunregister.mof")) returned 0x20 [0132.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\FepUnregister.mof" (normalized: "c:\\program files\\windows defender\\fepunregister.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.796] GetLastError () returned 0x5 [0132.796] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19e00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0132.796] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5a660, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpCmdRun.exe", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x52a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpCommu.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpEvMsg.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18e00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpProvider.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x89800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpRtp.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c2400, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpSvc.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpTpmAtt.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="mpuxhostproxy.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdd60, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MpUXSrv.exe", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x145400, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MSASCui.exe", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6120, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MsMpEng.exe", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6a800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="NisIpsPlugin.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="NisLog.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x58fb0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="NisSrv.exe", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="NisWfp.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x91600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0132.797] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xda54, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ProtectionManagement.mof", cAlternateFileName="")) returned 1 [0132.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\ProtectionManagement.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement.mof")) returned 0x20 [0132.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\ProtectionManagement.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.798] GetLastError () returned 0x5 [0132.798] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9aa, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ProtectionManagement_Uninstall.mof", cAlternateFileName="")) returned 1 [0132.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\ProtectionManagement_Uninstall.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement_uninstall.mof")) returned 0x20 [0132.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\ProtectionManagement_Uninstall.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement_uninstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.860] GetLastError () returned 0x5 [0132.860] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51c00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="shellext.dll", cAlternateFileName="")) returned 1 [0132.860] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264c0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="SymSrv.dll", cAlternateFileName="")) returned 1 [0132.860] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="SymSrv.yes", cAlternateFileName="")) returned 1 [0132.860] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="SymSrv.yes", cAlternateFileName="")) returned 0 [0132.860] FindClose (in: hFindFile=0x7679c0 | out: hFindFile=0x7679c0) returned 1 [0132.861] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Journal", cAlternateFileName="WIA843~1")) returned 1 [0132.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\*" (normalized: "c:\\program files\\windows journal\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767980 [0132.861] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x8a54cae8, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a54cae8, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0132.861] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc477d4e0, ftCreationTime.dwHighDateTime=0x1d81d26, ftLastAccessTime.dwLowDateTime=0xf3659710, ftLastAccessTime.dwHighDateTime=0x1d83a22, ftLastWriteTime.dwLowDateTime=0xf3659710, ftLastWriteTime.dwHighDateTime=0x1d83a22, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="aldelo.exe", cAlternateFileName="")) returned 1 [0132.861] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec155f1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="en-US", cAlternateFileName="")) returned 1 [0132.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\*" (normalized: "c:\\program files\\windows journal\\en-us\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec155f1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767900 [0132.896] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec155f1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0132.896] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0132.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui")) returned 0x20 [0132.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.908] GetLastError () returned 0x5 [0132.908] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0132.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui")) returned 0x20 [0132.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.910] GetLastError () returned 0x5 [0132.910] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0132.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui")) returned 0x20 [0132.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.911] GetLastError () returned 0x5 [0132.911] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x15400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0132.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui")) returned 0x20 [0132.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.912] GetLastError () returned 0x5 [0132.912] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0132.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui")) returned 0x20 [0132.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.912] GetLastError () returned 0x5 [0132.912] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0132.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui")) returned 0x20 [0132.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.913] GetLastError () returned 0x5 [0132.913] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0132.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui")) returned 0x20 [0132.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.914] GetLastError () returned 0x5 [0132.914] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 0 [0132.914] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a2df80, ftCreationTime.dwHighDateTime=0x1d8477a, ftLastAccessTime.dwLowDateTime=0x9d873c40, ftLastAccessTime.dwHighDateTime=0x1d851f6, ftLastWriteTime.dwLowDateTime=0x9d873c40, ftLastWriteTime.dwHighDateTime=0x1d851f6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="idea_southern.exe", cAlternateFileName="IDEA_S~1.EXE")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x677670bc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdda00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6760fb5b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x676822a6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13d600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x636e0a69, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x141400, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6369463d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x636ba8bb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x637531d6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x637531d6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674de9a9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6759d49c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x20b000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79d1bd40, ftCreationTime.dwHighDateTime=0x1d8606d, ftLastAccessTime.dwLowDateTime=0x8017e460, ftLastAccessTime.dwHighDateTime=0x1d8a67a, ftLastWriteTime.dwLowDateTime=0x8017e460, ftLastWriteTime.dwHighDateTime=0x1d8a67a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="leg.exe", cAlternateFileName="")) returned 1 [0132.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67387305, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673ad592, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa1200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0132.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL" (normalized: "c:\\program files\\windows journal\\mspvwctl.dll")) returned 0x20 [0132.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL" (normalized: "c:\\program files\\windows journal\\mspvwctl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.915] GetLastError () returned 0x5 [0132.915] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x676822a6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x193600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0132.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll")) returned 0x20 [0132.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.918] GetLastError () returned 0x5 [0132.918] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0132.918] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63779482, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x63779482, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0132.918] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0132.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\*" (normalized: "c:\\program files\\windows journal\\templates\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0132.922] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0132.922] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674b8718, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674b8718, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0132.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp")) returned 0x20 [0132.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.922] GetLastError () returned 0x5 [0132.922] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675e9965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675e9965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0132.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp")) returned 0x20 [0132.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.923] GetLastError () returned 0x5 [0132.923] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0132.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp")) returned 0x20 [0132.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.923] GetLastError () returned 0x5 [0132.923] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0132.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp")) returned 0x20 [0132.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.924] GetLastError () returned 0x5 [0132.924] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6759d49c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6759d49c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0132.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp")) returned 0x20 [0132.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.925] GetLastError () returned 0x5 [0132.925] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6778d31e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6778d31e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0132.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp")) returned 0x20 [0132.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.925] GetLastError () returned 0x5 [0132.925] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0132.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp")) returned 0x20 [0132.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.926] GetLastError () returned 0x5 [0132.926] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673d37bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673d37bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0132.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp")) returned 0x20 [0132.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.930] GetLastError () returned 0x5 [0132.930] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0132.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp")) returned 0x20 [0132.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.930] GetLastError () returned 0x5 [0132.930] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674923a8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674923a8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0132.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp")) returned 0x20 [0132.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.931] GetLastError () returned 0x5 [0132.931] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0132.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp")) returned 0x20 [0132.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.931] GetLastError () returned 0x5 [0132.931] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x76b370, dwReserved1=0xd5ef10, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0 [0132.931] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0132.931] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0132.932] FindClose (in: hFindFile=0x767980 | out: hFindFile=0x767980) returned 1 [0132.932] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0132.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*" (normalized: "c:\\program files\\windows mail\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0132.936] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0132.936] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="en-US", cAlternateFileName="")) returned 1 [0132.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*" (normalized: "c:\\program files\\windows mail\\en-us\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x7679c0 [0132.937] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0132.937] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db8cc30, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9db8cc30, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9db8cc30, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x7a200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0132.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui")) returned 0x20 [0132.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.938] GetLastError () returned 0x5 [0132.938] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0132.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui")) returned 0x20 [0132.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.939] GetLastError () returned 0x5 [0132.939] FindNextFileW (in: hFindFile=0x7679c0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0132.939] FindClose (in: hFindFile=0x7679c0 | out: hFindFile=0x7679c0) returned 1 [0132.939] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2a2de2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2a2de2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2ef297, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x21ac00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25f600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7e600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194e79e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x194e79e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x194e79e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x65a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x65a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0132.940] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Media Player", cAlternateFileName="WINDOW~3")) returned 1 [0132.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*" (normalized: "c:\\program files\\windows media player\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767900 [0132.940] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0132.940] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="en-US", cAlternateFileName="")) returned 1 [0132.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*" (normalized: "c:\\program files\\windows media player\\en-us\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0132.964] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0132.964] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0132.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui")) returned 0x20 [0132.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.969] GetLastError () returned 0x5 [0132.969] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1 [0132.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui")) returned 0x20 [0132.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.969] GetLastError () returned 0x5 [0132.969] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45cc5b7, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45cc5b7, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45cc5b7, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1 [0132.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui")) returned 0x20 [0132.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.970] GetLastError () returned 0x5 [0132.970] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1 [0132.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui")) returned 0x20 [0132.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.972] GetLastError () returned 0x5 [0132.972] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1 [0132.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui")) returned 0x20 [0132.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.972] GetLastError () returned 0x5 [0132.972] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wmpnetwk.exe.mui", cAlternateFileName="")) returned 1 [0132.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui")) returned 0x20 [0132.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.973] GetLastError () returned 0x5 [0132.973] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wmpnscfg.exe.mui", cAlternateFileName="")) returned 1 [0132.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui")) returned 0x20 [0133.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.071] GetLastError () returned 0x5 [0133.071] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1 [0133.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui")) returned 0x20 [0133.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.072] GetLastError () returned 0x5 [0133.072] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1 [0133.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui")) returned 0x20 [0133.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.073] GetLastError () returned 0x5 [0133.073] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45cc5b7, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45cc5b7, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45cc5b7, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WMPSideShowGadget.exe.mui", cAlternateFileName="")) returned 1 [0133.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui")) returned 0x20 [0133.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.073] GetLastError () returned 0x5 [0133.073] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45cc5b7, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45cc5b7, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45cc5b7, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WMPSideShowGadget.exe.mui", cAlternateFileName="")) returned 0 [0133.073] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0133.073] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Icons", cAlternateFileName="")) returned 1 [0133.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*" (normalized: "c:\\program files\\windows media player\\icons\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x768000 [0133.074] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.074] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 0 [0133.074] FindClose (in: hFindFile=0x768000 | out: hFindFile=0x768000) returned 1 [0133.076] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbfc3230, ftCreationTime.dwHighDateTime=0x1d87788, ftLastAccessTime.dwLowDateTime=0x26140ed0, ftLastAccessTime.dwHighDateTime=0x1d87fb0, ftLastWriteTime.dwLowDateTime=0x26140ed0, ftLastWriteTime.dwHighDateTime=0x1d87fb0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="leechftp.exe", cAlternateFileName="")) returned 1 [0133.076] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3161e94, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3161e94, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0133.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*" (normalized: "c:\\program files\\windows media player\\media renderer\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3161e94, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3161e94, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f80 [0133.108] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3161e94, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3161e94, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.108] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570b31b3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x570b31b3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x570b31b3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50db, dwReserved0=0x0, dwReserved1=0x1f, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0133.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml")) returned 0x20 [0133.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.110] GetLastError () returned 0x5 [0133.110] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1534, dwReserved0=0x0, dwReserved1=0x1f, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1 [0133.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml")) returned 0x20 [0133.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.111] GetLastError () returned 0x5 [0133.111] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1 [0133.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg")) returned 0x20 [0133.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.111] GetLastError () returned 0x5 [0133.111] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DMR_120.png", cAlternateFileName="")) returned 1 [0133.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png")) returned 0x20 [0133.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.112] GetLastError () returned 0x5 [0133.112] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1 [0133.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg")) returned 0x20 [0133.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.113] GetLastError () returned 0x5 [0133.113] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DMR_48.png", cAlternateFileName="")) returned 1 [0133.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png")) returned 0x20 [0133.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.113] GetLastError () returned 0x5 [0133.113] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0x0, dwReserved1=0x1f, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1 [0133.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml")) returned 0x20 [0133.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.114] GetLastError () returned 0x5 [0133.114] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5708cf59, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5708cf59, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5708cf59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x1f, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 1 [0133.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl_DMP.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol_dmp.xml")) returned 0x20 [0133.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl_DMP.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol_dmp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.115] GetLastError () returned 0x5 [0133.115] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5708cf59, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5708cf59, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5708cf59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x1f, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 0 [0133.115] FindClose (in: hFindFile=0x767f80 | out: hFindFile=0x767f80) returned 1 [0133.115] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2de00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0133.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\mpvis.DLL" (normalized: "c:\\program files\\windows media player\\mpvis.dll")) returned 0x20 [0133.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\mpvis.DLL" (normalized: "c:\\program files\\windows media player\\mpvis.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.116] GetLastError () returned 0x5 [0133.116] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1 [0133.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*" (normalized: "c:\\program files\\windows media player\\network sharing\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x767c00 [0133.263] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0133.263] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1 [0133.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml")) returned 0x20 [0133.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.266] GetLastError () returned 0x5 [0133.266] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d5b, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="ContentDirectory.xml", cAlternateFileName="")) returned 1 [0133.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml")) returned 0x20 [0133.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.267] GetLastError () returned 0x5 [0133.267] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="MediaReceiverRegistrar.xml", cAlternateFileName="")) returned 1 [0133.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml")) returned 0x20 [0133.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.268] GetLastError () returned 0x5 [0133.268] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1287, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color120.jpg", cAlternateFileName="")) returned 1 [0133.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg")) returned 0x20 [0133.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.269] GetLastError () returned 0x5 [0133.269] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ea5, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color120.png", cAlternateFileName="")) returned 1 [0133.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png")) returned 0x20 [0133.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.271] GetLastError () returned 0x5 [0133.271] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color32.bmp", cAlternateFileName="")) returned 1 [0133.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp")) returned 0x20 [0133.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.272] GetLastError () returned 0x5 [0133.272] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color32.jpg", cAlternateFileName="")) returned 1 [0133.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg")) returned 0x20 [0133.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.273] GetLastError () returned 0x5 [0133.273] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2438, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color48.bmp", cAlternateFileName="")) returned 1 [0133.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp")) returned 0x20 [0133.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.274] GetLastError () returned 0x5 [0133.275] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color48.jpg", cAlternateFileName="")) returned 1 [0133.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg")) returned 0x20 [0133.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.275] GetLastError () returned 0x5 [0133.276] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 1 [0133.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png")) returned 0x20 [0133.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.276] GetLastError () returned 0x5 [0133.276] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 0 [0133.277] FindClose (in: hFindFile=0x767c00 | out: hFindFile=0x767c00) returned 1 [0133.277] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c1800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0133.277] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Skins", cAlternateFileName="")) returned 1 [0133.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*" (normalized: "c:\\program files\\windows media player\\skins\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x767b40 [0133.277] FindNextFileW (in: hFindFile=0x767b40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0133.277] FindNextFileW (in: hFindFile=0x767b40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10506, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0133.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz")) returned 0x20 [0133.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.278] GetLastError () returned 0x5 [0133.278] FindNextFileW (in: hFindFile=0x767b40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10506, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="Revert.wmz", cAlternateFileName="")) returned 0 [0133.278] FindClose (in: hFindFile=0x767b40 | out: hFindFile=0x767b40) returned 1 [0133.278] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0133.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*" (normalized: "c:\\program files\\windows media player\\visualizations\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName=".", cAlternateFileName="")) returned 0x768080 [0133.279] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78f2c8, dwReserved1=0xd5ef10, cFileName="..", cAlternateFileName="")) returned 0 [0133.279] FindClose (in: hFindFile=0x768080 | out: hFindFile=0x768080) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5708cf59, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5708cf59, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5708cf59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1f800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x168000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmpnetwk.exe", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmpnscfg.exe", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1 [0133.279] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmprph.exe", cAlternateFileName="")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="WMPSideShowGadget.exe", cAlternateFileName="")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="WMPSideShowGadget.exe", cAlternateFileName="")) returned 0 [0133.280] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~4")) returned 1 [0133.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Multimedia Platform\\*" (normalized: "c:\\program files\\windows multimedia platform\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0133.280] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a82ea40, ftCreationTime.dwHighDateTime=0x1d87e8f, ftLastAccessTime.dwLowDateTime=0x396d7760, ftLastAccessTime.dwHighDateTime=0x1d8a705, ftLastWriteTime.dwLowDateTime=0x396d7760, ftLastWriteTime.dwHighDateTime=0x1d8a705, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="omnipos.exe", cAlternateFileName="")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44f33e50, ftCreationTime.dwHighDateTime=0x1d8893a, ftLastAccessTime.dwLowDateTime=0xe2ce79b0, ftLastAccessTime.dwHighDateTime=0x1d89fe1, ftLastWriteTime.dwLowDateTime=0xe2ce79b0, ftLastWriteTime.dwHighDateTime=0x1d89fe1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="series recognize.exe", cAlternateFileName="SERIES~1.EXE")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34319950, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34319950, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x34319950, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34319950, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34319950, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x34319950, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0133.281] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows NT", cAlternateFileName="WI67CB~1")) returned 1 [0133.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*" (normalized: "c:\\program files\\windows nt\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767cc0 [0133.281] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0133.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*" (normalized: "c:\\program files\\windows nt\\accessories\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767c00 [0133.281] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767980 [0133.282] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.284] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa005b596, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa005b596, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa005b596, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0133.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\wordpad.exe.mui")) returned 0x20 [0133.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\wordpad.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.285] GetLastError () returned 0x5 [0133.285] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa005b596, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa005b596, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa005b596, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 0 [0133.285] FindClose (in: hFindFile=0x767980 | out: hFindFile=0x767980) returned 1 [0133.286] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2203aecd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2203aecd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44f000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0133.286] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2aa00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0133.286] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2aa00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0 [0133.287] FindClose (in: hFindFile=0x767c00 | out: hFindFile=0x767c00) returned 1 [0133.287] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0133.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*" (normalized: "c:\\program files\\windows nt\\tabletextservice\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767940 [0133.446] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0133.447] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b88724, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa0b88724, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa0b88724, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0133.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\tabletextservice.dll.mui")) returned 0x20 [0133.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\tabletextservice.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.448] GetLastError () returned 0x5 [0133.448] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b88724, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa0b88724, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa0b88724, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 0 [0133.448] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26bc7614, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26bc7614, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26bc7614, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa2600, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x277d946b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x277d946b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x277d946b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3626, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1 [0133.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt")) returned 0x20 [0133.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.449] GetLastError () returned 0x5 [0133.449] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b54f09, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26b54f09, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26b54f09, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x136c70, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1 [0133.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt")) returned 0x20 [0133.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.451] GetLastError () returned 0x5 [0133.451] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2760f839, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2760f839, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2760f839, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xef500, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1 [0133.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt")) returned 0x20 [0133.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.452] GetLastError () returned 0x5 [0133.452] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510703d3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510703d3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510703d3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextServiceTigrinya.txt", cAlternateFileName="")) returned 1 [0133.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicetigrinya.txt")) returned 0x20 [0133.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicetigrinya.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.452] GetLastError () returned 0x5 [0133.452] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26cd268a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26cd268a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26cd268a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1 [0133.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt")) returned 0x20 [0133.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.453] GetLastError () returned 0x5 [0133.453] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26cd268a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26cd268a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26cd268a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x1f, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0 [0133.453] FindClose (in: hFindFile=0x767940 | out: hFindFile=0x767940) returned 1 [0133.453] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0133.454] FindClose (in: hFindFile=0x767cc0 | out: hFindFile=0x767cc0) returned 1 [0133.454] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a788d53, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a788d53, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0133.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*" (normalized: "c:\\program files\\windows photo viewer\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a788d53, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a788d53, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0133.454] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a788d53, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a788d53, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0133.454] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd254645, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*" (normalized: "c:\\program files\\windows photo viewer\\en-us\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd254645, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767cc0 [0133.454] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd254645, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.454] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a5ccbb, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a5ccbb, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a5ccbb, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0133.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui")) returned 0x20 [0133.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.455] GetLastError () returned 0x5 [0133.455] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0133.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui")) returned 0x20 [0133.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.456] GetLastError () returned 0x5 [0133.456] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0133.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui")) returned 0x20 [0133.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.457] GetLastError () returned 0x5 [0133.457] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0133.457] FindClose (in: hFindFile=0x767cc0 | out: hFindFile=0x767cc0) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe65002d0, ftCreationTime.dwHighDateTime=0x1d87c54, ftLastAccessTime.dwLowDateTime=0xea05b700, ftLastAccessTime.dwHighDateTime=0x1d8975f, ftLastWriteTime.dwLowDateTime=0xea05b700, ftLastWriteTime.dwHighDateTime=0x1d8975f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19ac0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x240a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e5600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5714bb11, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5714bb11, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5714bb11, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57171d78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57171d78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1be200, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58c6a50, ftCreationTime.dwHighDateTime=0x1d873d9, ftLastAccessTime.dwLowDateTime=0x41278210, ftLastAccessTime.dwHighDateTime=0x1d88802, ftLastWriteTime.dwLowDateTime=0x41278210, ftLastWriteTime.dwHighDateTime=0x1d88802, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="receivewouldclose.exe", cAlternateFileName="RECEIV~1.EXE")) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58c6a50, ftCreationTime.dwHighDateTime=0x1d873d9, ftLastAccessTime.dwLowDateTime=0x41278210, ftLastAccessTime.dwHighDateTime=0x1d88802, ftLastWriteTime.dwLowDateTime=0x41278210, ftLastWriteTime.dwHighDateTime=0x1d88802, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="receivewouldclose.exe", cAlternateFileName="RECEIV~1.EXE")) returned 0 [0133.457] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0133.457] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0133.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*" (normalized: "c:\\program files\\windows portable devices\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767e00 [0133.458] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8aa5dac1, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8aa5dac1, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0133.458] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447170, ftCreationTime.dwHighDateTime=0x1d887dc, ftLastAccessTime.dwLowDateTime=0xa62ce230, ftLastAccessTime.dwHighDateTime=0x1d89c6c, ftLastWriteTime.dwLowDateTime=0xa62ce230, ftLastWriteTime.dwHighDateTime=0x1d89c6c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80673b80, ftCreationTime.dwHighDateTime=0x1d866c1, ftLastAccessTime.dwLowDateTime=0x7217b580, ftLastAccessTime.dwHighDateTime=0x1d878c0, ftLastWriteTime.dwLowDateTime=0x7217b580, ftLastWriteTime.dwHighDateTime=0x1d878c0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="mxslipstream.exe", cAlternateFileName="MXSLIP~1.EXE")) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8f72f60, ftCreationTime.dwHighDateTime=0x1d8332e, ftLastAccessTime.dwLowDateTime=0x55adfb30, ftLastAccessTime.dwHighDateTime=0x1d83490, ftLastWriteTime.dwLowDateTime=0x55adfb30, ftLastWriteTime.dwHighDateTime=0x1d83490, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3533170f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3533170f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3533170f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3533170f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3533170f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3533170f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0133.459] FindClose (in: hFindFile=0x767e00 | out: hFindFile=0x767e00) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0133.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*" (normalized: "c:\\program files\\windows sidebar\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767c80 [0133.459] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a5006fd, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x8a5006fd, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373b44d0, ftCreationTime.dwHighDateTime=0x1d853a5, ftLastAccessTime.dwLowDateTime=0xd54d5920, ftLastAccessTime.dwHighDateTime=0x1d88a81, ftLastWriteTime.dwLowDateTime=0xd54d5920, ftLastWriteTime.dwHighDateTime=0x1d88a81, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="flashfxp.exe", cAlternateFileName="")) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0133.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*" (normalized: "c:\\program files\\windows sidebar\\gadgets\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767cc0 [0133.460] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.460] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 0 [0133.460] FindClose (in: hFindFile=0x767cc0 | out: hFindFile=0x767cc0) returned 1 [0133.460] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34782680, ftCreationTime.dwHighDateTime=0x1d83a25, ftLastAccessTime.dwLowDateTime=0xad4fe8a0, ftLastAccessTime.dwHighDateTime=0x1d84203, ftLastWriteTime.dwLowDateTime=0xad4fe8a0, ftLastWriteTime.dwHighDateTime=0x1d84203, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="icq.exe", cAlternateFileName="")) returned 1 [0133.460] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0133.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*" (normalized: "c:\\program files\\windows sidebar\\shared gadgets\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e00 [0133.460] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.460] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 0 [0133.460] FindClose (in: hFindFile=0x767e00 | out: hFindFile=0x767e00) returned 1 [0133.460] FindNextFileW (in: hFindFile=0x767c80, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0133.460] FindClose (in: hFindFile=0x767c80 | out: hFindFile=0x767c80) returned 1 [0133.460] FindNextFileW (in: hFindFile=0x72b100, lpFindFileData=0xd5f734 | out: lpFindFileData=0xd5f734*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2224dfa5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2224dfa5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f00, dwReserved1=0xd5f780, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0133.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\*" (normalized: "c:\\program files\\windowsapps\\*"), lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdedf14a6, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdedf14a6, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName=".", cAlternateFileName="")) returned 0x767ec0 [0133.461] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdedf14a6, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdedf14a6, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="..", cAlternateFileName="")) returned 1 [0133.466] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe7ec8112, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe7ec8112, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Deleted", cAlternateFileName="")) returned 1 [0133.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\*" (normalized: "c:\\program files\\windowsapps\\deleted\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe7ec8112, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe7ec8112, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x768040 [0133.466] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe7ec8112, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe7ec8112, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.466] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe7ec8112, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe7ec8112, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 0 [0133.466] FindClose (in: hFindFile=0x768040 | out: hFindFile=0x768040) returned 1 [0133.467] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_N")) returned 1 [0133.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0133.471] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.471] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a03c50a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a03c50a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a03c50a, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0133.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0133.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.472] GetLastError () returned 0x5 [0133.472] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0133.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767a40 [0133.472] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0133.472] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29f313ff, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3ff1, dwReserved0=0x76b370, dwReserved1=0xd5ead8, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0133.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0133.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.473] GetLastError () returned 0x5 [0133.481] FindNextFileW (in: hFindFile=0x767a40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29f313ff, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3ff1, dwReserved0=0x76b370, dwReserved1=0xd5ead8, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0133.481] FindClose (in: hFindFile=0x767a40 | out: hFindFile=0x767a40) returned 1 [0133.481] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a03c50a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a03c50a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a06274a, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0133.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0133.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.482] GetLastError () returned 0x5 [0133.482] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0133.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0133.509] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0133.509] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 0 [0133.509] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0133.509] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0133.509] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0133.509] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_X")) returned 1 [0133.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767c40 [0133.654] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0133.654] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0133.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0133.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.661] GetLastError () returned 0x5 [0133.662] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x11b3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0133.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0133.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.663] GetLastError () returned 0x5 [0133.663] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0133.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0133.663] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0133.663] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0133.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0133.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.664] GetLastError () returned 0x5 [0133.664] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0133.664] FindClose (in: hFindFile=0x767b00 | out: hFindFile=0x767b00) returned 1 [0133.664] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0133.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0133.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.665] GetLastError () returned 0x5 [0133.665] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Assets", cAlternateFileName="")) returned 1 [0133.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x768040 [0133.697] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0133.697] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x7046, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="3mf.ico", cAlternateFileName="")) returned 1 [0133.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\3mf.ico" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\3mf.ico")) returned 0x20 [0133.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\3mf.ico" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\3mf.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.698] GetLastError () returned 0x5 [0133.698] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="Catalog", cAlternateFileName="")) returned 1 [0133.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0133.772] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0133.772] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f08e, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="bulldozer.3mf", cAlternateFileName="")) returned 1 [0133.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\bulldozer.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\bulldozer.3mf")) returned 0x20 [0133.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\bulldozer.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\bulldozer.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.773] GetLastError () returned 0x5 [0133.773] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e17, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Catalog.json", cAlternateFileName="")) returned 1 [0133.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\Catalog.json" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\catalog.json")) returned 0x20 [0133.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\Catalog.json" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\catalog.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.775] GetLastError () returned 0x5 [0133.775] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26a27, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="chess.3mf", cAlternateFileName="")) returned 1 [0133.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\chess.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\chess.3mf")) returned 0x20 [0133.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\chess.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\chess.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.776] GetLastError () returned 0x5 [0133.776] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e48e, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="giftbox.3mf", cAlternateFileName="")) returned 1 [0133.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\giftbox.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\giftbox.3mf")) returned 0x20 [0133.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\giftbox.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\giftbox.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.776] GetLastError () returned 0x5 [0133.776] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4ab3d, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="gimblekeychain.3mf", cAlternateFileName="")) returned 1 [0133.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\gimblekeychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\gimblekeychain.3mf")) returned 0x20 [0133.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\gimblekeychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\gimblekeychain.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.778] GetLastError () returned 0x5 [0133.778] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcf95, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="keychain.3mf", cAlternateFileName="")) returned 1 [0133.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\keychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\keychain.3mf")) returned 0x20 [0133.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\keychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\keychain.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.779] GetLastError () returned 0x5 [0133.779] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e2, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="paperboat.3mf", cAlternateFileName="")) returned 1 [0133.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\paperboat.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\paperboat.3mf")) returned 0x20 [0133.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\paperboat.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\paperboat.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.779] GetLastError () returned 0x5 [0133.779] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d6ce, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="pencilbox.3mf", cAlternateFileName="")) returned 1 [0133.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\pencilbox.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\pencilbox.3mf")) returned 0x20 [0133.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\pencilbox.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\pencilbox.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.780] GetLastError () returned 0x5 [0133.780] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x59ff, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_cone.3mf", cAlternateFileName="")) returned 1 [0133.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cone.3mf")) returned 0x20 [0133.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cone.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.781] GetLastError () returned 0x5 [0133.781] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2377, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_cube.3mf", cAlternateFileName="")) returned 1 [0133.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cube.3mf")) returned 0x20 [0133.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cube.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.781] GetLastError () returned 0x5 [0133.781] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x58de, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_cylinder.3mf", cAlternateFileName="")) returned 1 [0133.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cylinder.3mf")) returned 0x20 [0133.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cylinder.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.782] GetLastError () returned 0x5 [0133.782] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_hexagon.3mf", cAlternateFileName="")) returned 1 [0133.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_hexagon.3mf")) returned 0x20 [0133.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_hexagon.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.782] GetLastError () returned 0x5 [0133.782] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1271, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_pyramid.3mf", cAlternateFileName="")) returned 1 [0133.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_pyramid.3mf")) returned 0x20 [0133.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_pyramid.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.783] GetLastError () returned 0x5 [0133.783] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x214c7, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_sphere.3mf", cAlternateFileName="")) returned 1 [0133.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_sphere.3mf")) returned 0x20 [0133.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_sphere.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.784] GetLastError () returned 0x5 [0133.784] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3be62, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_torus.3mf", cAlternateFileName="")) returned 1 [0133.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_torus.3mf")) returned 0x20 [0133.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_torus.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.784] GetLastError () returned 0x5 [0133.784] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x173f, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shape_wedge.3mf", cAlternateFileName="")) returned 1 [0133.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_wedge.3mf")) returned 0x20 [0133.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_wedge.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.785] GetLastError () returned 0x5 [0133.785] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33976, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="shuttle.3mf", cAlternateFileName="")) returned 1 [0133.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shuttle.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shuttle.3mf")) returned 0x20 [0133.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shuttle.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shuttle.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.785] GetLastError () returned 0x5 [0133.786] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x346af, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="spookytree.3mf", cAlternateFileName="")) returned 1 [0133.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\spookytree.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\spookytree.3mf")) returned 0x20 [0133.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\spookytree.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\spookytree.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.787] GetLastError () returned 0x5 [0133.787] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x37936, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="traincarcaboose.3mf", cAlternateFileName="")) returned 1 [0133.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traincarcaboose.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traincarcaboose.3mf")) returned 0x20 [0133.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traincarcaboose.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traincarcaboose.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.788] GetLastError () returned 0x5 [0133.788] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4acbb, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="trainengine.3mf", cAlternateFileName="")) returned 1 [0133.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trainengine.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trainengine.3mf")) returned 0x20 [0133.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trainengine.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trainengine.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.789] GetLastError () returned 0x5 [0133.789] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x295d0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="traintrackconnector.3mf", cAlternateFileName="")) returned 1 [0133.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackconnector.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackconnector.3mf")) returned 0x20 [0133.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackconnector.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackconnector.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.789] GetLastError () returned 0x5 [0133.789] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b16d, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="traintrackleftturn.3mf", cAlternateFileName="")) returned 1 [0133.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackleftturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackleftturn.3mf")) returned 0x20 [0133.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackleftturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackleftturn.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.790] GetLastError () returned 0x5 [0133.790] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x23e72, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="traintrackrightturn.3mf", cAlternateFileName="")) returned 1 [0133.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackrightturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackrightturn.3mf")) returned 0x20 [0133.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackrightturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackrightturn.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.790] GetLastError () returned 0x5 [0133.790] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x39d3a, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="traintracksplit.3mf", cAlternateFileName="")) returned 1 [0133.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintracksplit.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintracksplit.3mf")) returned 0x20 [0133.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintracksplit.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintracksplit.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.791] GetLastError () returned 0x5 [0133.791] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f7ca, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="traintrackstraight.3mf", cAlternateFileName="")) returned 1 [0133.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackstraight.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackstraight.3mf")) returned 0x20 [0133.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackstraight.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackstraight.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.792] GetLastError () returned 0x5 [0133.792] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x38dfd, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="trophycylinder.3mf", cAlternateFileName="")) returned 1 [0133.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophycylinder.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophycylinder.3mf")) returned 0x20 [0133.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophycylinder.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophycylinder.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.792] GetLastError () returned 0x5 [0133.792] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x48280, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="trophystar.3mf", cAlternateFileName="")) returned 1 [0133.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophystar.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophystar.3mf")) returned 0x20 [0133.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophystar.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophystar.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.793] GetLastError () returned 0x5 [0133.793] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0a, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="windmill.3mf", cAlternateFileName="")) returned 1 [0133.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\windmill.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\windmill.3mf")) returned 0x20 [0133.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\windmill.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\windmill.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.794] GetLastError () returned 0x5 [0133.794] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0a, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="windmill.3mf", cAlternateFileName="")) returned 0 [0133.794] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0133.794] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="Contrast", cAlternateFileName="")) returned 1 [0133.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767bc0 [0133.865] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0133.867] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1 [0133.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\builderlogo.png")) returned 0x20 [0133.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\builderlogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.868] GetLastError () returned 0x5 [0133.868] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0133.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0133.870] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0133.870] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1 [0133.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\builderlogo.png")) returned 0x20 [0134.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\builderlogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.000] GetLastError () returned 0x5 [0134.000] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbab, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-16.png")) returned 0x20 [0134.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.000] GetLastError () returned 0x5 [0134.000] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153c, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-256.png")) returned 0x20 [0134.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.190] GetLastError () returned 0x5 [0134.190] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc6c, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-32.png")) returned 0x20 [0134.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.191] GetLastError () returned 0x5 [0134.191] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd08, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-48.png")) returned 0x20 [0134.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.192] GetLastError () returned 0x5 [0134.192] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1026, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-100.png")) returned 0x20 [0134.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.193] GetLastError () returned 0x5 [0134.193] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xebc, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-80.png")) returned 0x20 [0134.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.194] GetLastError () returned 0x5 [0134.194] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-100.png")) returned 0x20 [0134.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.195] GetLastError () returned 0x5 [0134.195] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbfc, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1 [0134.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-80.png")) returned 0x20 [0134.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.196] GetLastError () returned 0x5 [0134.196] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8f, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-16.png")) returned 0x20 [0134.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.197] GetLastError () returned 0x5 [0134.197] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13bc, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-256.png")) returned 0x20 [0134.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.198] GetLastError () returned 0x5 [0134.198] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc35, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-32.png")) returned 0x20 [0134.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.199] GetLastError () returned 0x5 [0134.199] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-48.png")) returned 0x20 [0134.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.200] GetLastError () returned 0x5 [0134.200] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0134.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\splashscreen.scale-100.png")) returned 0x20 [0134.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.201] GetLastError () returned 0x5 [0134.201] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153d, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-100.png")) returned 0x20 [0134.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.202] GetLastError () returned 0x5 [0134.202] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12d5, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-80.png")) returned 0x20 [0134.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.203] GetLastError () returned 0x5 [0134.203] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8e, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-100.png")) returned 0x20 [0134.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.204] GetLastError () returned 0x5 [0134.205] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-80.png")) returned 0x20 [0134.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.205] GetLastError () returned 0x5 [0134.205] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\storelogo.scale-100.png")) returned 0x20 [0134.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.206] GetLastError () returned 0x5 [0134.206] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b6, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-100.png")) returned 0x20 [0134.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.208] GetLastError () returned 0x5 [0134.208] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-80.png")) returned 0x20 [0134.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.209] GetLastError () returned 0x5 [0134.209] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 0 [0134.209] FindClose (in: hFindFile=0x767b00 | out: hFindFile=0x767b00) returned 1 [0134.209] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0134.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0134.250] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="..", cAlternateFileName="")) returned 1 [0134.250] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1493, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1 [0134.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\builderlogo.png")) returned 0x20 [0134.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\builderlogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.250] GetLastError () returned 0x5 [0134.251] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb9c, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-16.png")) returned 0x20 [0134.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.251] GetLastError () returned 0x5 [0134.251] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-256.png")) returned 0x20 [0134.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.256] GetLastError () returned 0x5 [0134.256] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-32.png")) returned 0x20 [0134.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.256] GetLastError () returned 0x5 [0134.256] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd12, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-48.png")) returned 0x20 [0134.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.257] GetLastError () returned 0x5 [0134.257] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-100.png")) returned 0x20 [0134.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.258] GetLastError () returned 0x5 [0134.258] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xecf, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-80.png")) returned 0x20 [0134.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.259] GetLastError () returned 0x5 [0134.259] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-100.png")) returned 0x20 [0134.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.259] GetLastError () returned 0x5 [0134.259] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbed, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1 [0134.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-80.png")) returned 0x20 [0134.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.260] GetLastError () returned 0x5 [0134.260] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8d, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-16.png")) returned 0x20 [0134.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.260] GetLastError () returned 0x5 [0134.260] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13b1, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-256.png")) returned 0x20 [0134.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.261] GetLastError () returned 0x5 [0134.261] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2b, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-32.png")) returned 0x20 [0134.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.262] GetLastError () returned 0x5 [0134.262] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-48.png")) returned 0x20 [0134.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.262] GetLastError () returned 0x5 [0134.262] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0134.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\splashscreen.scale-100.png")) returned 0x20 [0134.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.263] GetLastError () returned 0x5 [0134.263] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x152b, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-100.png")) returned 0x20 [0134.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.264] GetLastError () returned 0x5 [0134.264] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12dc, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-80.png")) returned 0x20 [0134.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.264] GetLastError () returned 0x5 [0134.264] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-100.png")) returned 0x20 [0134.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.265] GetLastError () returned 0x5 [0134.265] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcde, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-80.png")) returned 0x20 [0134.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.266] GetLastError () returned 0x5 [0134.266] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\storelogo.scale-100.png")) returned 0x20 [0134.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.266] GetLastError () returned 0x5 [0134.266] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b0, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-100.png")) returned 0x20 [0134.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.267] GetLastError () returned 0x5 [0134.267] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf3b, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-80.png")) returned 0x20 [0134.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.268] GetLastError () returned 0x5 [0134.268] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf3b, dwReserved0=0x76b370, dwReserved1=0xd5e268, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 0 [0134.268] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0134.268] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-16.png")) returned 0x20 [0134.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.269] GetLastError () returned 0x5 [0134.269] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16f3, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-256.png")) returned 0x20 [0134.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.269] GetLastError () returned 0x5 [0134.269] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-32.png")) returned 0x20 [0134.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.270] GetLastError () returned 0x5 [0134.270] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-48.png")) returned 0x20 [0134.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.270] GetLastError () returned 0x5 [0134.270] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x108d, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-100.png")) returned 0x20 [0134.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.273] GetLastError () returned 0x5 [0134.273] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-80.png")) returned 0x20 [0134.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.273] GetLastError () returned 0x5 [0134.273] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc45, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-100.png")) returned 0x20 [0134.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.274] GetLastError () returned 0x5 [0134.274] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1 [0134.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-80.png")) returned 0x20 [0134.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.275] GetLastError () returned 0x5 [0134.275] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-16.png")) returned 0x20 [0134.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.278] GetLastError () returned 0x5 [0134.278] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x148e, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-256.png")) returned 0x20 [0134.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.279] GetLastError () returned 0x5 [0134.279] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc71, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-32.png")) returned 0x20 [0134.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.279] GetLastError () returned 0x5 [0134.279] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-48.png")) returned 0x20 [0134.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.280] GetLastError () returned 0x5 [0134.280] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0134.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\splashscreen.scale-100.png")) returned 0x20 [0134.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.281] GetLastError () returned 0x5 [0134.281] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x165a, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-100.png")) returned 0x20 [0134.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.281] GetLastError () returned 0x5 [0134.281] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13d2, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-80.png")) returned 0x20 [0134.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.282] GetLastError () returned 0x5 [0134.282] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdc0, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-100.png")) returned 0x20 [0134.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.283] GetLastError () returned 0x5 [0134.283] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd39, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-80.png")) returned 0x20 [0134.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.283] GetLastError () returned 0x5 [0134.283] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd19, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\storelogo.scale-100.png")) returned 0x20 [0134.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.284] GetLastError () returned 0x5 [0134.284] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-100.png")) returned 0x20 [0134.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.284] GetLastError () returned 0x5 [0134.284] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xfd5, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1 [0134.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-80.png")) returned 0x20 [0134.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.285] GetLastError () returned 0x5 [0134.285] FindNextFileW (in: hFindFile=0x767bc0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xfd5, dwReserved0=0x72bd38, dwReserved1=0xd5e6a0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 0 [0134.285] FindClose (in: hFindFile=0x767bc0 | out: hFindFile=0x767bc0) returned 1 [0134.285] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1455, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="CubeTile_contrast-black.png", cAlternateFileName="")) returned 1 [0134.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-black.png")) returned 0x20 [0134.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.286] GetLastError () returned 0x5 [0134.286] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="CubeTile_contrast-white.png", cAlternateFileName="")) returned 1 [0134.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-white.png")) returned 0x20 [0134.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.287] GetLastError () returned 0x5 [0134.287] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="DarkBlue.png", cAlternateFileName="")) returned 1 [0134.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\darkblue.png")) returned 0x20 [0134.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\darkblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.287] GetLastError () returned 0x5 [0134.287] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="EmbossBitmaps", cAlternateFileName="EMBOSS~1")) returned 1 [0134.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767a80 [0134.289] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0134.291] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x257a, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="4-Point Star.png", cAlternateFileName="")) returned 1 [0134.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star.png")) returned 0x20 [0134.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.292] GetLastError () returned 0x5 [0134.292] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a2b, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="4-Point Star_render.png", cAlternateFileName="")) returned 1 [0134.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star_render.png")) returned 0x20 [0134.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.293] GetLastError () returned 0x5 [0134.293] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2da8, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="8-Point Star.png", cAlternateFileName="")) returned 1 [0134.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star.png")) returned 0x20 [0134.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.299] GetLastError () returned 0x5 [0134.299] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="8-Point Star_render.png", cAlternateFileName="")) returned 1 [0134.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star_render.png")) returned 0x20 [0134.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.300] GetLastError () returned 0x5 [0134.300] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1ca9, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Arrow.png", cAlternateFileName="")) returned 1 [0134.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow.png")) returned 0x20 [0134.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.301] GetLastError () returned 0x5 [0134.301] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e41, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Arrow_render.png", cAlternateFileName="")) returned 1 [0134.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow_render.png")) returned 0x20 [0134.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.303] GetLastError () returned 0x5 [0134.303] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f0a, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Chevron.png", cAlternateFileName="")) returned 1 [0134.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron.png")) returned 0x20 [0134.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.304] GetLastError () returned 0x5 [0134.304] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2633, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Chevron_render.png", cAlternateFileName="")) returned 1 [0134.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron_render.png")) returned 0x20 [0134.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.305] GetLastError () returned 0x5 [0134.305] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x336c, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Cloud.png", cAlternateFileName="")) returned 1 [0134.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud.png")) returned 0x20 [0134.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.305] GetLastError () returned 0x5 [0134.305] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b7f, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Cloud_render.png", cAlternateFileName="")) returned 1 [0134.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud_render.png")) returned 0x20 [0134.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.306] GetLastError () returned 0x5 [0134.306] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3de9, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Donut.png", cAlternateFileName="")) returned 1 [0134.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut.png")) returned 0x20 [0134.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.308] GetLastError () returned 0x5 [0134.308] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b09, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Donut_render.png", cAlternateFileName="")) returned 1 [0134.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut_render.png")) returned 0x20 [0134.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.310] GetLastError () returned 0x5 [0134.310] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Double Wave.png", cAlternateFileName="")) returned 1 [0134.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave.png")) returned 0x20 [0134.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.310] GetLastError () returned 0x5 [0134.310] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f9c, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Double Wave_render.png", cAlternateFileName="")) returned 1 [0134.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave_render.png")) returned 0x20 [0134.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.311] GetLastError () returned 0x5 [0134.311] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3479, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="heart.png", cAlternateFileName="")) returned 1 [0134.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart.png")) returned 0x20 [0134.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.312] GetLastError () returned 0x5 [0134.312] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb3, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="heart_render.png", cAlternateFileName="")) returned 1 [0134.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart_render.png")) returned 0x20 [0134.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.312] GetLastError () returned 0x5 [0134.313] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3d07, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Lightning bolt.png", cAlternateFileName="")) returned 1 [0134.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt.png")) returned 0x20 [0134.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.313] GetLastError () returned 0x5 [0134.313] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3324, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Lightning bolt_render.png", cAlternateFileName="")) returned 1 [0134.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt_render.png")) returned 0x20 [0134.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.314] GetLastError () returned 0x5 [0134.314] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Moon.png", cAlternateFileName="")) returned 1 [0134.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon.png")) returned 0x20 [0134.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.315] GetLastError () returned 0x5 [0134.315] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x28d5, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Moon_render.png", cAlternateFileName="")) returned 1 [0134.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon_render.png")) returned 0x20 [0134.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.315] GetLastError () returned 0x5 [0134.315] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2d4a, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Multiply.png", cAlternateFileName="")) returned 1 [0134.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply.png")) returned 0x20 [0134.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.316] GetLastError () returned 0x5 [0134.316] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2996, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Multiply_render.png", cAlternateFileName="")) returned 1 [0134.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply_render.png")) returned 0x20 [0134.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.316] GetLastError () returned 0x5 [0134.316] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4544, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="No Symbol.png", cAlternateFileName="")) returned 1 [0134.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol.png")) returned 0x20 [0134.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.318] GetLastError () returned 0x5 [0134.318] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4728, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="No Symbol_render.png", cAlternateFileName="")) returned 1 [0134.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol_render.png")) returned 0x20 [0134.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.318] GetLastError () returned 0x5 [0134.318] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2962, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Oval.png", cAlternateFileName="")) returned 1 [0134.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval.png")) returned 0x20 [0134.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.319] GetLastError () returned 0x5 [0134.319] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a06, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Oval_render.png", cAlternateFileName="")) returned 1 [0134.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval_render.png")) returned 0x20 [0134.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.319] GetLastError () returned 0x5 [0134.319] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="plus.png", cAlternateFileName="")) returned 1 [0134.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus.png")) returned 0x20 [0134.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.320] GetLastError () returned 0x5 [0134.320] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c2, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="plus_render.png", cAlternateFileName="")) returned 1 [0134.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus_render.png")) returned 0x20 [0134.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.321] GetLastError () returned 0x5 [0134.321] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf7d, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Rectangle.png", cAlternateFileName="")) returned 1 [0134.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle.png")) returned 0x20 [0134.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.322] GetLastError () returned 0x5 [0134.322] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Rectangle_render.png", cAlternateFileName="")) returned 1 [0134.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle_render.png")) returned 0x20 [0134.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.323] GetLastError () returned 0x5 [0134.323] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x17e0, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Rounded Rectangle.png", cAlternateFileName="")) returned 1 [0134.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded rectangle.png")) returned 0x20 [0134.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded rectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.324] GetLastError () returned 0x5 [0134.324] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Rounded Rectangle_render.png", cAlternateFileName="")) returned 1 [0134.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded rectangle_render.png")) returned 0x20 [0134.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded rectangle_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.325] GetLastError () returned 0x5 [0134.325] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4921, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Smiley face.png", cAlternateFileName="")) returned 1 [0134.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face.png")) returned 0x20 [0134.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.326] GetLastError () returned 0x5 [0134.326] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x380c, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Smiley face_render.png", cAlternateFileName="")) returned 1 [0134.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face_render.png")) returned 0x20 [0134.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.327] GetLastError () returned 0x5 [0134.327] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x337b, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Sun.png", cAlternateFileName="")) returned 1 [0134.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun.png")) returned 0x20 [0134.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.328] GetLastError () returned 0x5 [0134.328] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b76, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Sun_render.png", cAlternateFileName="")) returned 1 [0134.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun_render.png")) returned 0x20 [0134.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.329] GetLastError () returned 0x5 [0134.329] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e87, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Triangle.png", cAlternateFileName="")) returned 1 [0134.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle.png")) returned 0x20 [0134.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.330] GetLastError () returned 0x5 [0134.330] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2419, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Triangle_render.png", cAlternateFileName="")) returned 1 [0134.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle_render.png")) returned 0x20 [0134.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.330] GetLastError () returned 0x5 [0134.331] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26ab, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Wave.png", cAlternateFileName="")) returned 1 [0134.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave.png")) returned 0x20 [0134.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.332] GetLastError () returned 0x5 [0134.332] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x226d, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Wave_render.png", cAlternateFileName="")) returned 1 [0134.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave_render.png")) returned 0x20 [0134.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave_render.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.333] GetLastError () returned 0x5 [0134.333] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x226d, dwReserved0=0x76b370, dwReserved1=0xd5e6a0, cFileName="Wave_render.png", cAlternateFileName="")) returned 0 [0134.333] FindClose (in: hFindFile=0x767a80 | out: hFindFile=0x767a80) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="HelpIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0134.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-black.png")) returned 0x20 [0134.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.334] GetLastError () returned 0x5 [0134.334] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="HelpIcon_contrast-white.png", cAlternateFileName="")) returned 1 [0134.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-white.png")) returned 0x20 [0134.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.340] GetLastError () returned 0x5 [0134.340] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="LightBlue.png", cAlternateFileName="")) returned 1 [0134.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\lightblue.png")) returned 0x20 [0134.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\lightblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.341] GetLastError () returned 0x5 [0134.341] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6b, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="LoadIconRTL_contrast-black.png", cAlternateFileName="")) returned 1 [0134.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-black.png")) returned 0x20 [0134.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.342] GetLastError () returned 0x5 [0134.342] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="LoadIconRTL_contrast-white.png", cAlternateFileName="")) returned 1 [0134.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-white.png")) returned 0x20 [0134.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.342] GetLastError () returned 0x5 [0134.342] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd84, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="LoadIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0134.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-black.png")) returned 0x20 [0134.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.343] GetLastError () returned 0x5 [0134.343] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="LoadIcon_contrast-white.png", cAlternateFileName="")) returned 1 [0134.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-white.png")) returned 0x20 [0134.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.343] GetLastError () returned 0x5 [0134.343] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="MediumBlue.png", cAlternateFileName="")) returned 1 [0134.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\mediumblue.png")) returned 0x20 [0134.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\mediumblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.344] GetLastError () returned 0x5 [0134.344] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="ScanIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0134.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-black.png")) returned 0x20 [0134.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.344] GetLastError () returned 0x5 [0134.344] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="ScanIcon_contrast-white.png", cAlternateFileName="")) returned 1 [0134.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-white.png")) returned 0x20 [0134.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.345] GetLastError () returned 0x5 [0134.345] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="ScanIcon_contrast-white.png", cAlternateFileName="")) returned 0 [0134.345] FindClose (in: hFindFile=0x768040 | out: hFindFile=0x768040) returned 1 [0134.345] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x84f800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Builder3D.exe", cAlternateFileName="")) returned 1 [0134.345] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Common", cAlternateFileName="")) returned 1 [0134.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\common\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x768080 [0134.346] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.346] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="ReadMe.txt", cAlternateFileName="")) returned 1 [0134.346] FindNextFileW (in: hFindFile=0x768080, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="ReadMe.txt", cAlternateFileName="")) returned 0 [0134.346] FindClose (in: hFindFile=0x768080 | out: hFindFile=0x768080) returned 1 [0134.347] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Lib3mfUAP.dll", cAlternateFileName="")) returned 1 [0134.347] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0134.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767940 [0134.347] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.347] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72c628, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 0 [0134.347] FindClose (in: hFindFile=0x767940 | out: hFindFile=0x767940) returned 1 [0134.347] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a99fbb2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a99fbb2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a9c5d29, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x51280, dwReserved0=0x0, dwReserved1=0x1f, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0134.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0134.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.348] GetLastError () returned 0x5 [0134.348] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a99fbb2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a99fbb2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a9c5d29, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x51280, dwReserved0=0x0, dwReserved1=0x1f, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0134.348] FindClose (in: hFindFile=0x767c40 | out: hFindFile=0x767c40) returned 1 [0134.348] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x943087a2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x943087a2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_N")) returned 1 [0134.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x943087a2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x943087a2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0134.353] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x943087a2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x943087a2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.353] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0134.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0134.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.354] GetLastError () returned 0x5 [0134.354] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f59f46a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0134.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0134.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.355] GetLastError () returned 0x5 [0134.355] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0134.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0134.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.356] GetLastError () returned 0x5 [0134.356] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="css", cAlternateFileName="")) returned 1 [0134.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767dc0 [0134.357] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.357] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="default.css", cAlternateFileName="")) returned 1 [0134.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css")) returned 0x20 [0134.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.357] GetLastError () returned 0x5 [0134.357] FindNextFileW (in: hFindFile=0x767dc0, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="default.css", cAlternateFileName="")) returned 0 [0134.357] FindClose (in: hFindFile=0x767dc0 | out: hFindFile=0x767dc0) returned 1 [0134.358] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x1f, cFileName="default.html", cAlternateFileName="")) returned 1 [0134.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html")) returned 0x20 [0134.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.358] GetLastError () returned 0x5 [0134.358] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="images", cAlternateFileName="")) returned 1 [0134.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767c00 [0134.360] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.360] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.scale-100.png", cAlternateFileName="")) returned 1 [0134.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.scale-100.png")) returned 0x20 [0134.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.362] GetLastError () returned 0x5 [0134.362] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-16.png")) returned 0x20 [0134.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.362] GetLastError () returned 0x5 [0134.362] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-20.png", cAlternateFileName="")) returned 1 [0134.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-20.png")) returned 0x20 [0134.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.363] GetLastError () returned 0x5 [0134.364] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-24.png", cAlternateFileName="")) returned 1 [0134.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-24.png")) returned 0x20 [0134.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.364] GetLastError () returned 0x5 [0134.365] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-256.png")) returned 0x20 [0134.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.366] GetLastError () returned 0x5 [0134.366] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-32.png")) returned 0x20 [0134.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.372] GetLastError () returned 0x5 [0134.372] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-40.png", cAlternateFileName="")) returned 1 [0134.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-40.png")) returned 0x20 [0134.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.372] GetLastError () returned 0x5 [0134.373] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-48.png")) returned 0x20 [0134.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.373] GetLastError () returned 0x5 [0134.373] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-64.png", cAlternateFileName="")) returned 1 [0134.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-64.png")) returned 0x20 [0134.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-64.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.374] GetLastError () returned 0x5 [0134.374] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-80.png", cAlternateFileName="")) returned 1 [0134.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-80.png")) returned 0x20 [0134.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.375] GetLastError () returned 0x5 [0134.375] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="AppConnectorAppList.targetsize-96.png", cAlternateFileName="")) returned 1 [0134.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-96.png")) returned 0x20 [0134.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-96.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.376] GetLastError () returned 0x5 [0134.376] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="logo.scale-100.png", cAlternateFileName="")) returned 1 [0134.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png")) returned 0x20 [0134.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.377] GetLastError () returned 0x5 [0134.377] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="smalllogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png")) returned 0x20 [0134.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.379] GetLastError () returned 0x5 [0134.379] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x477, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="splashscreen.scale-100.png", cAlternateFileName="")) returned 1 [0134.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png")) returned 0x20 [0134.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.381] GetLastError () returned 0x5 [0134.381] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="storelogo.scale-100.png", cAlternateFileName="")) returned 1 [0134.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png")) returned 0x20 [0134.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.381] GetLastError () returned 0x5 [0134.381] FindNextFileW (in: hFindFile=0x767c00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="storelogo.scale-100.png", cAlternateFileName="")) returned 0 [0134.382] FindClose (in: hFindFile=0x767c00 | out: hFindFile=0x767c00) returned 1 [0134.382] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="js", cAlternateFileName="")) returned 1 [0134.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x768040 [0134.383] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.383] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x233, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="default.js", cAlternateFileName="")) returned 1 [0134.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js")) returned 0x20 [0134.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.383] GetLastError () returned 0x5 [0134.384] FindNextFileW (in: hFindFile=0x768040, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x233, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="default.js", cAlternateFileName="")) returned 0 [0134.384] FindClose (in: hFindFile=0x768040 | out: hFindFile=0x768040) returned 1 [0134.384] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x943087a2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0134.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x943087a2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767a00 [0134.391] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x943087a2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.391] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="Autogen", cAlternateFileName="")) returned 1 [0134.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0134.392] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.392] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x36cf3cb6, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0x0, dwReserved1=0x1f, cFileName="JSByteCodeCache_64", cAlternateFileName="JSBYTE~1")) returned 1 [0134.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_64")) returned 0x2024 [0134.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_64"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.392] GetLastError () returned 0x5 [0134.392] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x36cf3cb6, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0x0, dwReserved1=0x1f, cFileName="JSByteCodeCache_64", cAlternateFileName="JSBYTE~1")) returned 0 [0134.392] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0134.392] FindNextFileW (in: hFindFile=0x767a00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72bed8, dwReserved1=0xd5ead8, cFileName="Autogen", cAlternateFileName="")) returned 0 [0134.392] FindClose (in: hFindFile=0x767a00 | out: hFindFile=0x767a00) returned 1 [0134.392] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0134.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri")) returned 0x20 [0134.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.393] GetLastError () returned 0x5 [0134.393] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0134.393] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0134.393] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_N")) returned 1 [0134.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767cc0 [0134.395] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.395] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f52d085, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f52d085, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f52d085, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0134.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0134.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.396] GetLastError () returned 0x5 [0134.397] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0134.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0134.397] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.397] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x6b98, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0134.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0134.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.398] GetLastError () returned 0x5 [0134.398] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x6b98, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0134.398] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0134.398] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f52d085, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f52d085, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f552f8d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0134.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0134.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.399] GetLastError () returned 0x5 [0134.399] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0134.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767e40 [0134.399] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.400] FindNextFileW (in: hFindFile=0x767e40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 0 [0134.400] FindClose (in: hFindFile=0x767e40 | out: hFindFile=0x767e40) returned 1 [0134.400] FindNextFileW (in: hFindFile=0x767cc0, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0134.400] FindClose (in: hFindFile=0x767cc0 | out: hFindFile=0x767cc0) returned 1 [0134.400] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_N")) returned 1 [0134.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767900 [0134.402] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.403] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0134.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0134.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.404] GetLastError () returned 0x5 [0134.404] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0134.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0134.404] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.404] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65eb, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0134.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml")) returned 0x20 [0134.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.404] GetLastError () returned 0x5 [0134.404] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65eb, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0134.404] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0134.405] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0134.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0134.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.405] GetLastError () returned 0x5 [0134.405] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0134.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767940 [0134.406] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.406] FindNextFileW (in: hFindFile=0x767940, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 0 [0134.406] FindClose (in: hFindFile=0x767940 | out: hFindFile=0x767940) returned 1 [0134.406] FindNextFileW (in: hFindFile=0x767900, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0134.406] FindClose (in: hFindFile=0x767900 | out: hFindFile=0x767900) returned 1 [0134.406] FindNextFileW (in: hFindFile=0x767ec0, lpFindFileData=0xd5f2fc | out: lpFindFileData=0xd5f2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ba708, dwReserved1=0xd5f348, cFileName="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_X")) returned 1 [0134.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\*"), lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767a80 [0134.408] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.413] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7509, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1 [0134.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml")) returned 0x20 [0134.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.414] GetLastError () returned 0x5 [0134.414] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7e84, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0134.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml")) returned 0x20 [0134.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.414] GetLastError () returned 0x5 [0134.414] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0134.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml")) returned 0x20 [0134.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.415] GetLastError () returned 0x5 [0134.415] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0134.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x768000 [0134.415] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.415] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0134.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat")) returned 0x20 [0134.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.416] GetLastError () returned 0x5 [0134.416] FindNextFileW (in: hFindFile=0x768000, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0134.416] FindClose (in: hFindFile=0x768000 | out: hFindFile=0x768000) returned 1 [0134.416] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x298e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0134.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x")) returned 0x20 [0134.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.417] GetLastError () returned 0x5 [0134.417] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Assets", cAlternateFileName="")) returned 1 [0134.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0134.418] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.418] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0134.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767ac0 [0134.420] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.420] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0134.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767d40 [0134.422] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.424] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0134.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.scale-100.png")) returned 0x20 [0134.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.425] GetLastError () returned 0x5 [0134.425] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-16.png")) returned 0x20 [0134.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.425] GetLastError () returned 0x5 [0134.425] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0134.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-24.png")) returned 0x20 [0134.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.426] GetLastError () returned 0x5 [0134.426] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-256.png")) returned 0x20 [0134.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.427] GetLastError () returned 0x5 [0134.427] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-32.png")) returned 0x20 [0134.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.428] GetLastError () returned 0x5 [0134.428] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-48.png")) returned 0x20 [0134.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.429] GetLastError () returned 0x5 [0134.429] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0134.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_splashscreen.scale-100.png")) returned 0x20 [0134.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.430] GetLastError () returned 0x5 [0134.430] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilelargesquare.scale-100.png")) returned 0x20 [0134.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.431] GetLastError () returned 0x5 [0134.431] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilemediumsquare.scale-100.png")) returned 0x20 [0134.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.431] GetLastError () returned 0x5 [0134.431] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilesmallsquare.scale-100.png")) returned 0x20 [0134.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.432] GetLastError () returned 0x5 [0134.432] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0134.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilewide.scale-100.png")) returned 0x20 [0134.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.433] GetLastError () returned 0x5 [0134.433] FindNextFileW (in: hFindFile=0x767d40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0134.433] FindClose (in: hFindFile=0x767d40 | out: hFindFile=0x767d40) returned 1 [0134.433] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0134.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767f40 [0134.439] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.439] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0134.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.scale-100.png")) returned 0x20 [0134.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.441] GetLastError () returned 0x5 [0134.441] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-16.png")) returned 0x20 [0134.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.441] GetLastError () returned 0x5 [0134.441] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0134.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-24.png")) returned 0x20 [0134.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.443] GetLastError () returned 0x5 [0134.443] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-256.png")) returned 0x20 [0134.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.443] GetLastError () returned 0x5 [0134.444] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-32.png")) returned 0x20 [0134.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.444] GetLastError () returned 0x5 [0134.444] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-48.png")) returned 0x20 [0134.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.445] GetLastError () returned 0x5 [0134.445] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0134.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_splashscreen.scale-100.png")) returned 0x20 [0134.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.446] GetLastError () returned 0x5 [0134.446] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilelargesquare.scale-100.png")) returned 0x20 [0134.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.447] GetLastError () returned 0x5 [0134.447] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilemediumsquare.scale-100.png")) returned 0x20 [0134.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.448] GetLastError () returned 0x5 [0134.448] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilesmallsquare.scale-100.png")) returned 0x20 [0134.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.452] GetLastError () returned 0x5 [0134.452] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0134.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilewide.scale-100.png")) returned 0x20 [0134.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.452] GetLastError () returned 0x5 [0134.452] FindNextFileW (in: hFindFile=0x767f40, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0134.453] FindClose (in: hFindFile=0x767f40 | out: hFindFile=0x767f40) returned 1 [0134.453] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0134.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.scale-100.png")) returned 0x20 [0134.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.453] GetLastError () returned 0x5 [0134.453] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0134.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-16.png")) returned 0x20 [0134.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.454] GetLastError () returned 0x5 [0134.454] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0134.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-24.png")) returned 0x20 [0134.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.455] GetLastError () returned 0x5 [0134.455] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0134.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-256.png")) returned 0x20 [0134.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.455] GetLastError () returned 0x5 [0134.455] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0134.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-32.png")) returned 0x20 [0134.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.456] GetLastError () returned 0x5 [0134.456] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0134.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-48.png")) returned 0x20 [0134.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.456] GetLastError () returned 0x5 [0134.456] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0134.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_splashscreen.scale-100.png")) returned 0x20 [0134.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.457] GetLastError () returned 0x5 [0134.457] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilelargesquare.scale-100.png")) returned 0x20 [0134.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.458] GetLastError () returned 0x5 [0134.458] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilemediumsquare.scale-100.png")) returned 0x20 [0134.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.458] GetLastError () returned 0x5 [0134.459] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0134.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilesmallsquare.scale-100.png")) returned 0x20 [0134.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.459] GetLastError () returned 0x5 [0134.459] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0134.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilewide.scale-100.png")) returned 0x20 [0134.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.460] GetLastError () returned 0x5 [0134.460] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x1f, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0134.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png")) returned 0x20 [0134.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.460] GetLastError () returned 0x5 [0134.460] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x1f, cFileName="StoreLogo.png", cAlternateFileName="")) returned 0 [0134.460] FindClose (in: hFindFile=0x767ac0 | out: hFindFile=0x767ac0) returned 1 [0134.461] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0134.461] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0134.461] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0134.461] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0134.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767c40 [0134.462] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.462] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1 [0134.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0134.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.463] GetLastError () returned 0x5 [0134.463] FindNextFileW (in: hFindFile=0x767c40, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="configuration.sqlite", cAlternateFileName="")) returned 0 [0134.463] FindClose (in: hFindFile=0x767c40 | out: hFindFile=0x767c40) returned 1 [0134.463] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="JsonResources", cAlternateFileName="JSONRE~1")) returned 1 [0134.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767d80 [0134.465] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.465] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a52, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="AboutLinks.json", cAlternateFileName="")) returned 1 [0134.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\aboutlinks.json")) returned 0x20 [0134.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\aboutlinks.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.466] GetLastError () returned 0x5 [0134.466] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4b1c, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="CurrencyInfo.json", cAlternateFileName="")) returned 1 [0134.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\currencyinfo.json")) returned 0x20 [0134.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\currencyinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.467] GetLastError () returned 0x5 [0134.467] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x32a6, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="DefaultCurrencyLoc.json", cAlternateFileName="")) returned 1 [0134.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultcurrencyloc.json")) returned 0x20 [0134.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultcurrencyloc.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.468] GetLastError () returned 0x5 [0134.468] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="DefaultFromToCurrency.json", cAlternateFileName="")) returned 1 [0134.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultfromtocurrency.json")) returned 0x20 [0134.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultfromtocurrency.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.468] GetLastError () returned 0x5 [0134.468] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3b60, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="ExchangeDetails.json", cAlternateFileName="")) returned 1 [0134.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangedetails.json")) returned 0x20 [0134.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangedetails.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.469] GetLastError () returned 0x5 [0134.469] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x36cd, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="ExchangesInfo.json", cAlternateFileName="")) returned 1 [0134.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangesinfo.json")) returned 0x20 [0134.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangesinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.469] GetLastError () returned 0x5 [0134.469] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d73, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="MarketsInfo.json", cAlternateFileName="")) returned 1 [0134.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\marketsinfo.json")) returned 0x20 [0134.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\marketsinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.470] GetLastError () returned 0x5 [0134.470] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="NumberFormattingInfo.json", cAlternateFileName="")) returned 1 [0134.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\numberformattinginfo.json")) returned 0x20 [0134.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\numberformattinginfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.471] GetLastError () returned 0x5 [0134.471] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2f34, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="ToolsDefaultData.json", cAlternateFileName="")) returned 1 [0134.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\toolsdefaultdata.json")) returned 0x20 [0134.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\toolsdefaultdata.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.472] GetLastError () returned 0x5 [0134.473] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="WorldMarketMajorInfo.json", cAlternateFileName="")) returned 1 [0134.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\worldmarketmajorinfo.json")) returned 0x20 [0134.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\worldmarketmajorinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.475] GetLastError () returned 0x5 [0134.475] FindNextFileW (in: hFindFile=0x767d80, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="WorldMarketMajorInfo.json", cAlternateFileName="")) returned 0 [0134.475] FindClose (in: hFindFile=0x767d80 | out: hFindFile=0x767d80) returned 1 [0134.475] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x211d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0134.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml")) returned 0x20 [0134.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.476] GetLastError () returned 0x5 [0134.476] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0134.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767e00 [0134.476] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.476] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0134.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html")) returned 0x20 [0134.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.477] GetLastError () returned 0x5 [0134.477] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="Themes", cAlternateFileName="")) returned 1 [0134.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5e6a0, cFileName=".", cAlternateFileName="")) returned 0x767f80 [0134.477] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5e6a0, cFileName="..", cAlternateFileName="")) returned 1 [0134.477] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x76b300, dwReserved1=0xd5e6a0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1 [0134.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf")) returned 0x20 [0134.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.488] GetLastError () returned 0x5 [0134.488] FindNextFileW (in: hFindFile=0x767f80, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x76b300, dwReserved1=0xd5e6a0, cFileName="Generic.xbf", cAlternateFileName="")) returned 0 [0134.488] FindClose (in: hFindFile=0x767f80 | out: hFindFile=0x767f80) returned 1 [0134.488] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="Themes", cAlternateFileName="")) returned 0 [0134.488] FindClose (in: hFindFile=0x767e00 | out: hFindFile=0x767e00) returned 1 [0134.489] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0134.489] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0134.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd")) returned 0x20 [0134.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.500] GetLastError () returned 0x5 [0134.500] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf1d25aa, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1 [0134.500] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1d25aa, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf1d25aa, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf1d25aa, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1 [0134.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd")) returned 0x20 [0134.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.501] GetLastError () returned 0x5 [0134.501] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1d25aa, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf1d25aa, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbda000, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Msn.Money.dll", cAlternateFileName="")) returned 1 [0134.501] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Msn.Money.exe", cAlternateFileName="")) returned 1 [0134.501] FindNextFileW (in: hFindFile=0x767a80, lpFindFileData=0xd5eec4 | out: lpFindFileData=0xd5eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1 [0134.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\*"), lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName=".", cAlternateFileName="")) returned 0x767b00 [0134.502] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="..", cAlternateFileName="")) returned 1 [0134.502] FindNextFileW (in: hFindFile=0x767b00, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76b300, dwReserved1=0xd5ead8, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1 [0134.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\*"), lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767ac0 [0134.502] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.502] FindNextFileW (in: hFindFile=0x767ac0, lpFindFileData=0xd5e654 | out: lpFindFileData=0xd5e654*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 1 [0134.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\*"), lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e00 [0134.503] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.503] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Finance", cAlternateFileName="")) returned 1 [0134.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\*"), lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767b80 [0134.504] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.504] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Finance.xml", cAlternateFileName="")) returned 1 [0134.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml")) returned 0x20 [0134.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.505] GetLastError () returned 0x5 [0134.505] FindNextFileW (in: hFindFile=0x767b80, lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x1f, cFileName="Finance.xml", cAlternateFileName="")) returned 0 [0134.505] FindClose (in: hFindFile=0x767b80 | out: hFindFile=0x767b80) returned 1 [0134.505] FindNextFileW (in: hFindFile=0x767e00, lpFindFileData=0xd5e21c | out: lpFindFileData=0xd5e21c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0134.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\*"), lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x767e80 [0134.506] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0134.506] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x1f, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 1 [0134.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml")) returned 0x20 [0134.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.507] GetLastError () returned 0x5 [0134.508] FindNextFileW (in: hFindFile=0x767e80, lpFindFileData=0xd5dde4 | out: lpFindFileData=0xd5dde4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x1f, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 0 [0134.508] FindClose (in: hFindFile=0x767e80 | out: hFindFile=0x767e80) returned 1 [0134.514] GetLastError () returned 0x5 [0134.515] GetLastError () returned 0x5 [0134.517] GetLastError () returned 0x5 [0134.518] GetLastError () returned 0x5 [0134.520] GetLastError () returned 0x5 [0134.521] GetLastError () returned 0x5 [0134.525] GetLastError () returned 0x5 [0134.526] GetLastError () returned 0x5 [0134.527] GetLastError () returned 0x5 [0134.528] GetLastError () returned 0x5 [0134.529] GetLastError () returned 0x5 [0134.529] GetLastError () returned 0x5 [0134.531] GetLastError () returned 0x5 [0134.531] GetLastError () returned 0x5 [0134.535] GetLastError () returned 0x5 [0134.536] GetLastError () returned 0x5 [0134.537] GetLastError () returned 0x5 [0134.546] GetLastError () returned 0x5 [0134.546] GetLastError () returned 0x5 [0134.546] GetLastError () returned 0x5 [0134.547] GetLastError () returned 0x5 [0134.548] GetLastError () returned 0x5 [0134.552] GetLastError () returned 0x5 [0134.553] GetLastError () returned 0x5 [0134.554] GetLastError () returned 0x5 [0134.554] GetLastError () returned 0x5 [0134.554] GetLastError () returned 0x5 [0134.555] GetLastError () returned 0x5 [0134.557] GetLastError () returned 0x5 [0134.557] GetLastError () returned 0x5 [0134.558] GetLastError () returned 0x5 [0134.559] GetLastError () returned 0x5 [0134.560] GetLastError () returned 0x5 [0134.564] GetLastError () returned 0x5 [0134.564] GetLastError () returned 0x5 [0134.565] GetLastError () returned 0x5 [0134.566] GetLastError () returned 0x5 [0134.566] GetLastError () returned 0x5 [0134.567] GetLastError () returned 0x5 [0134.568] GetLastError () returned 0x5 [0134.569] GetLastError () returned 0x5 [0134.570] GetLastError () returned 0x5 [0134.571] GetLastError () returned 0x5 [0134.571] GetLastError () returned 0x5 [0134.572] GetLastError () returned 0x5 [0134.572] GetLastError () returned 0x5 [0134.573] GetLastError () returned 0x5 [0134.573] GetLastError () returned 0x5 [0134.574] GetLastError () returned 0x5 [0134.574] GetLastError () returned 0x5 [0134.575] GetLastError () returned 0x5 [0134.575] GetLastError () returned 0x5 [0134.577] GetLastError () returned 0x5 [0134.578] GetLastError () returned 0x5 [0134.578] GetLastError () returned 0x5 [0134.578] GetLastError () returned 0x5 [0134.582] GetLastError () returned 0x5 [0134.582] GetLastError () returned 0x5 [0134.583] GetLastError () returned 0x5 [0134.583] GetLastError () returned 0x5 [0134.584] GetLastError () returned 0x5 [0134.584] GetLastError () returned 0x5 [0134.635] GetLastError () returned 0x5 [0134.636] GetLastError () returned 0x5 [0134.637] GetLastError () returned 0x5 [0134.637] GetLastError () returned 0x5 [0134.638] GetLastError () returned 0x5 [0134.638] GetLastError () returned 0x5 [0134.639] GetLastError () returned 0x5 [0134.640] GetLastError () returned 0x5 [0134.641] GetLastError () returned 0x5 [0134.641] GetLastError () returned 0x5 [0134.642] GetLastError () returned 0x5 [0134.642] GetLastError () returned 0x5 [0134.643] GetLastError () returned 0x5 [0134.643] GetLastError () returned 0x5 [0134.643] GetLastError () returned 0x5 [0134.644] GetLastError () returned 0x5 [0134.646] GetLastError () returned 0x5 [0134.649] GetLastError () returned 0x5 [0134.649] GetLastError () returned 0x5 [0134.653] GetLastError () returned 0x5 [0134.654] GetLastError () returned 0x5 [0134.654] GetLastError () returned 0x5 [0134.656] GetLastError () returned 0x5 [0134.657] GetLastError () returned 0x5 [0134.662] GetLastError () returned 0x5 [0134.663] GetLastError () returned 0x5 [0134.663] GetLastError () returned 0x5 [0134.663] GetLastError () returned 0x5 [0134.664] GetLastError () returned 0x5 [0134.664] GetLastError () returned 0x5 [0134.666] GetLastError () returned 0x5 [0134.667] GetLastError () returned 0x5 [0134.668] GetLastError () returned 0x5 [0134.668] GetLastError () returned 0x5 [0134.669] GetLastError () returned 0x5 [0134.671] GetLastError () returned 0x5 [0134.672] GetLastError () returned 0x5 [0134.672] GetLastError () returned 0x5 [0134.673] GetLastError () returned 0x5 [0134.674] GetLastError () returned 0x5 [0134.674] GetLastError () returned 0x5 [0134.675] GetLastError () returned 0x5 [0134.675] GetLastError () returned 0x5 [0134.676] GetLastError () returned 0x5 [0134.676] GetLastError () returned 0x5 [0134.677] GetLastError () returned 0x5 [0134.678] GetLastError () returned 0x5 [0134.678] GetLastError () returned 0x5 [0134.679] GetLastError () returned 0x5 [0134.679] GetLastError () returned 0x5 [0134.679] GetLastError () returned 0x5 [0134.680] GetLastError () returned 0x5 [0134.680] GetLastError () returned 0x5 [0134.681] GetLastError () returned 0x5 [0134.681] GetLastError () returned 0x5 [0134.682] GetLastError () returned 0x5 [0134.682] GetLastError () returned 0x5 [0134.683] GetLastError () returned 0x5 [0134.683] GetLastError () returned 0x5 [0134.690] GetLastError () returned 0x5 [0134.690] GetLastError () returned 0x5 [0134.691] GetLastError () returned 0x5 [0134.692] GetLastError () returned 0x5 [0134.693] GetLastError () returned 0x5 [0134.693] GetLastError () returned 0x5 [0134.696] GetLastError () returned 0x5 [0134.697] GetLastError () returned 0x5 [0134.697] GetLastError () returned 0x5 [0134.702] GetLastError () returned 0x5 [0134.702] GetLastError () returned 0x5 [0134.703] GetLastError () returned 0x5 [0134.704] GetLastError () returned 0x5 [0134.704] GetLastError () returned 0x5 [0134.705] GetLastError () returned 0x5 [0134.705] GetLastError () returned 0x5 [0134.706] GetLastError () returned 0x5 [0134.706] GetLastError () returned 0x5 [0134.706] GetLastError () returned 0x5 [0134.707] GetLastError () returned 0x5 [0134.708] GetLastError () returned 0x5 [0134.757] GetLastError () returned 0x5 [0134.759] GetLastError () returned 0x5 [0134.878] GetLastError () returned 0x5 [0134.879] GetLastError () returned 0x5 [0134.879] GetLastError () returned 0x5 [0134.884] GetLastError () returned 0x5 [0134.885] GetLastError () returned 0x5 [0134.885] GetLastError () returned 0x5 [0134.886] GetLastError () returned 0x5 [0134.887] GetLastError () returned 0x5 [0134.891] GetLastError () returned 0x5 [0134.892] GetLastError () returned 0x5 [0134.892] GetLastError () returned 0x5 [0134.892] GetLastError () returned 0x5 [0134.902] GetLastError () returned 0x5 [0134.902] GetLastError () returned 0x5 [0134.904] GetLastError () returned 0x5 [0134.904] GetLastError () returned 0x5 [0134.906] GetLastError () returned 0x5 [0134.906] GetLastError () returned 0x5 [0134.907] GetLastError () returned 0x5 [0134.908] GetLastError () returned 0x5 [0134.910] GetLastError () returned 0x5 [0134.913] GetLastError () returned 0x5 [0134.913] GetLastError () returned 0x5 [0134.913] GetLastError () returned 0x5 [0134.914] GetLastError () returned 0x5 [0134.915] GetLastError () returned 0x5 [0134.915] GetLastError () returned 0x5 [0134.916] GetLastError () returned 0x5 [0134.917] GetLastError () returned 0x5 [0134.917] GetLastError () returned 0x5 [0134.918] GetLastError () returned 0x5 [0134.918] GetLastError () returned 0x5 [0134.934] GetLastError () returned 0x5 [0134.934] GetLastError () returned 0x5 [0134.936] GetLastError () returned 0x5 [0134.937] GetLastError () returned 0x5 [0134.937] GetLastError () returned 0x5 [0134.937] GetLastError () returned 0x5 [0134.939] GetLastError () returned 0x5 [0134.940] GetLastError () returned 0x5 [0134.940] GetLastError () returned 0x5 [0134.941] GetLastError () returned 0x5 [0134.941] GetLastError () returned 0x5 [0134.941] GetLastError () returned 0x5 [0134.942] GetLastError () returned 0x5 [0134.943] GetLastError () returned 0x5 [0134.943] GetLastError () returned 0x5 [0134.944] GetLastError () returned 0x5 [0134.944] GetLastError () returned 0x5 [0134.945] GetLastError () returned 0x5 [0134.946] GetLastError () returned 0x5 [0134.946] GetLastError () returned 0x5 [0134.947] GetLastError () returned 0x5 [0134.947] GetLastError () returned 0x5 [0134.948] GetLastError () returned 0x5 [0134.950] GetLastError () returned 0x5 [0134.951] GetLastError () returned 0x5 [0134.951] GetLastError () returned 0x5 [0134.952] GetLastError () returned 0x5 [0134.953] GetLastError () returned 0x5 [0134.953] GetLastError () returned 0x5 [0134.954] GetLastError () returned 0x5 [0134.955] GetLastError () returned 0x5 [0134.955] GetLastError () returned 0x5 [0134.956] GetLastError () returned 0x5 [0134.956] GetLastError () returned 0x5 [0134.959] GetLastError () returned 0x5 [0134.960] GetLastError () returned 0x5 [0134.960] GetLastError () returned 0x5 [0134.964] GetLastError () returned 0x5 [0134.967] GetLastError () returned 0x5 [0134.968] GetLastError () returned 0x5 [0134.969] GetLastError () returned 0x5 [0134.970] GetLastError () returned 0x5 [0134.971] GetLastError () returned 0x5 [0134.971] GetLastError () returned 0x5 [0134.979] GetLastError () returned 0x5 [0134.979] GetLastError () returned 0x5 [0134.980] GetLastError () returned 0x5 [0134.981] GetLastError () returned 0x5 [0134.982] GetLastError () returned 0x5 [0134.982] GetLastError () returned 0x5 [0134.983] GetLastError () returned 0x5 [0134.983] GetLastError () returned 0x5 [0134.985] GetLastError () returned 0x5 [0134.985] GetLastError () returned 0x5 [0134.992] GetLastError () returned 0x5 [0134.992] GetLastError () returned 0x5 [0134.993] GetLastError () returned 0x5 [0134.997] GetLastError () returned 0x5 [0134.998] GetLastError () returned 0x5 [0134.999] GetLastError () returned 0x5 [0135.000] GetLastError () returned 0x5 [0135.004] GetLastError () returned 0x5 [0135.005] GetLastError () returned 0x5 [0135.006] GetLastError () returned 0x5 [0135.007] GetLastError () returned 0x5 [0135.007] GetLastError () returned 0x5 [0135.008] GetLastError () returned 0x5 [0135.009] GetLastError () returned 0x5 [0135.010] GetLastError () returned 0x5 [0135.010] GetLastError () returned 0x5 [0135.011] GetLastError () returned 0x5 [0135.012] GetLastError () returned 0x5 [0140.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\images\\contrast-black\\SwayAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\images\\contrast-black\\swayapplist.targetsize-60_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0145.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0145.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0148.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28 [0148.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0148.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c [0148.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14 [0148.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c [0148.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04 [0148.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0148.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0148.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08 [0148.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18 [0148.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0148.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4 [0148.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0148.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8 [0148.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0148.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0148.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0148.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0148.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0148.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0148.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0148.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0148.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0148.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0148.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0148.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0148.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0148.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0148.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0148.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0148.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0148.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0148.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0148.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0149.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0149.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0149.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8 [0149.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0149.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0149.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0149.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0149.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0149.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0149.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0149.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0149.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0149.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0149.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0149.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0149.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0149.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0149.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0149.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0149.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0149.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0149.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0149.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0149.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0149.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0149.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0149.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0149.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0149.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0149.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0149.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0149.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0149.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0149.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0149.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0149.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0149.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0149.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0150.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0150.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0150.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0150.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0150.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0150.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0150.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0150.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0150.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0150.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0150.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0150.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0150.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0150.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0150.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0150.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0150.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0150.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0150.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0150.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0150.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0150.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0150.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0150.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac [0150.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0150.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0150.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0150.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0150.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0150.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0150.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0150.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0150.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0150.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0150.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0150.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0150.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0150.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0150.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0150.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0150.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0150.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0151.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0151.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0151.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0151.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0151.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0151.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0151.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0151.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0151.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0151.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0151.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0151.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0151.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0151.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0151.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0151.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0151.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0151.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0151.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0151.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0151.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0151.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0151.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0151.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0151.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0151.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0151.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0151.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0151.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0151.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0151.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0151.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0151.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0151.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0151.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0151.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0151.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0152.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0152.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0152.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0152.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0152.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0152.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0152.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0152.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0152.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0152.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0152.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0152.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0152.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0152.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0152.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0153.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0153.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0153.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0153.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0153.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0153.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0153.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0153.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0153.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0153.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0153.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0153.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0153.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0153.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0153.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0153.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0153.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0153.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0153.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0153.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0153.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0154.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0154.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0154.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0154.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0154.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0154.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0154.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0154.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0154.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0154.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0154.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0154.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0154.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0154.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0154.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0154.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0154.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0154.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0154.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0154.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0154.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0154.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0154.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0154.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0154.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0154.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0154.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0154.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0154.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0154.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0154.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0154.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0154.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0154.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0154.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0154.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0154.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30 [0154.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0154.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0155.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0155.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0155.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0155.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0155.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0155.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0155.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0155.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0155.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0155.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0155.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0155.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0155.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0155.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0155.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0155.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0155.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0155.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0155.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0155.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0155.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0155.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0155.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0155.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0155.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0155.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0155.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0155.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0155.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0155.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0155.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0155.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80 [0155.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88 [0155.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90 [0155.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0155.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0155.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8 [0155.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0 [0155.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8 [0155.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc0 [0155.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0155.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0155.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8 [0155.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0 [0155.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8 [0155.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0156.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4 [0156.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbcc [0156.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc4 [0156.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec [0156.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4 [0156.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0156.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94 [0156.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb84 [0156.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb74 [0156.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0156.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98 [0156.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0 [0156.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8 [0156.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0 [0156.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0156.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0156.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0156.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0156.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0156.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0156.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0156.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0 [0156.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8 [0156.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd00 [0156.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08 [0156.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0157.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0157.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4 [0157.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4 [0157.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0157.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0157.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4 [0157.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4 [0157.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0157.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c [0157.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c [0157.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc [0157.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0157.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0157.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0157.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0157.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0157.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30 [0157.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0157.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0157.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48 [0157.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50 [0157.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58 [0157.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60 [0157.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0157.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0157.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd78 [0157.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0157.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88 [0157.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c [0157.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0157.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c [0157.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0157.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c [0157.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c [0157.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0157.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0157.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac [0157.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c [0157.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0157.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc [0157.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec [0157.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c [0157.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0157.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0157.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0157.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0157.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0157.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0157.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0157.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0157.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0157.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0157.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0157.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0157.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0157.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0157.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0157.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0158.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0158.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0158.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0158.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34 [0158.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0158.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0158.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0158.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0158.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c [0158.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc [0158.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0158.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44 [0158.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0158.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0158.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec [0158.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0158.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc [0158.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c [0159.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0159.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0159.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c [0159.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe94 [0159.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe9c [0159.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea4 [0159.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac [0159.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb4 [0159.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xebc [0159.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec0 [0159.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec8 [0159.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0 [0159.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed8 [0160.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4 [0160.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74 [0160.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c [0160.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70 [0160.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78 [0160.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80 [0160.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc [0160.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8 [0160.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0160.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0160.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0160.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c [0160.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0160.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8 [0160.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0160.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98 [0160.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0160.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0160.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0160.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0160.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0160.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0160.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0160.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0160.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0160.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0160.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0160.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0160.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0160.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0160.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90 [0160.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb8 [0160.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0161.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0161.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0161.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfdc [0161.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0161.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfec [0161.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4 [0161.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc [0161.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008 [0161.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1010 [0161.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1018 [0161.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0161.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0161.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030 [0161.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0161.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0161.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0161.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0161.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050 [0161.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0161.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0161.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068 [0161.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0161.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078 [0161.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0161.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1088 [0161.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090 [0161.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098 [0161.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0161.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10dc [0161.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4 [0161.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec [0161.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f4 [0161.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc [0161.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1104 [0161.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0161.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114 [0161.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0161.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0161.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c [0161.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1134 [0161.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c [0161.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0161.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c [0161.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0161.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c [0161.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164 [0161.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c [0161.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0161.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c [0161.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1184 [0161.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0161.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190 [0161.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198 [0161.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0 [0161.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8 [0161.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0161.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d11b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8 [0161.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0161.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0161.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0 [0161.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d12d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0161.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc [0161.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0161.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0161.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f8 [0161.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0161.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208 [0161.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210 [0161.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218 [0161.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220 [0161.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0161.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230 [0161.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1238 [0161.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1240 [0161.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d14d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248 [0161.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1250 [0161.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258 [0161.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1260 [0161.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268 [0161.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1270 [0161.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278 [0161.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d16c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0161.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0161.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290 [0162.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d17a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0 [0162.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0162.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0162.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c [0162.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c [0162.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0162.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0 [0162.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1094 [0162.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0162.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034 [0162.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8 [0162.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1294 [0162.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c [0162.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0162.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ac [0162.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b4 [0162.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0162.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0162.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0162.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4 [0162.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12dc [0162.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4 [0162.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec [0162.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f4 [0162.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12fc [0162.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304 [0162.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c [0162.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314 [0162.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c [0162.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324 [0162.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d17e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x132c [0162.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1330 [0162.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1338 [0162.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1340 [0162.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d18c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1348 [0162.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1350 [0162.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1358 [0162.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1360 [0162.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d19e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1368 [0162.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1370 [0162.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1374 [0162.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x137c [0162.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1384 [0162.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138c [0162.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1394 [0162.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x139c [0162.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0162.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0 [0162.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0 [0162.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a8 [0162.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b0 [0162.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b8 [0162.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c0 [0162.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c8 [0162.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d0 [0162.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0162.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0 [0162.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8 [0162.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f0 [0162.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8 [0162.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1404 [0162.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140c [0162.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1414 [0162.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c [0162.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0162.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x142c [0162.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1434 [0162.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x143c [0162.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d20a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1444 [0162.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d20e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c [0162.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1454 [0162.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x145c [0162.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d21c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1464 [0162.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1120 [0163.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0164.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1364 [0164.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344 [0164.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318 [0164.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8 [0164.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1130 [0164.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1388 [0164.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448 [0164.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0164.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0164.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4 [0164.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4 [0164.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1408 [0164.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13fc [0164.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1428 [0164.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1438 [0164.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1468 [0164.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f4 [0164.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ac [0164.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8 [0164.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378 [0164.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1418 [0164.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x133c [0164.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320 [0164.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4 [0164.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc [0164.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0164.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc [0164.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4 [0164.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0164.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0164.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0164.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0164.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0164.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0164.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0164.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0164.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0164.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94 [0164.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0164.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0164.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0164.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0164.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0164.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0164.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0164.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0164.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0164.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0164.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0164.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0164.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0164.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0164.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0164.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0164.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0164.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8 [0165.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0 [0166.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdd4 [0166.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0166.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0166.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108 [0166.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118 [0166.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1470 [0166.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1478 [0166.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1480 [0166.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488 [0166.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490 [0166.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498 [0166.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0 [0166.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8 [0166.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0166.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300 [0166.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0166.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0166.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0166.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0166.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0166.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac [0166.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b0 [0166.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0166.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0166.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0166.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0166.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c [0166.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0166.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0166.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x146c [0166.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x149c [0166.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0166.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0166.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1390 [0166.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0166.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4 [0166.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0166.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0166.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0166.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x147c [0166.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0166.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0166.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0166.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148c [0166.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0166.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x152c [0166.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534 [0166.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x153c [0166.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544 [0166.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154c [0166.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1550 [0167.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0167.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0167.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc [0167.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328 [0167.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0167.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1398 [0167.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410 [0167.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1450 [0167.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310 [0167.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c [0167.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0167.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1430 [0167.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1460 [0167.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0167.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1474 [0167.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0167.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc [0167.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0167.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530 [0167.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578 [0167.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1580 [0167.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1588 [0167.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1590 [0167.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598 [0167.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0 [0167.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a8 [0167.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b0 [0167.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b8 [0167.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0 [0167.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c8 [0167.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d0 [0167.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8 [0167.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0 [0167.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e8 [0167.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1644 [0167.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164c [0167.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654 [0167.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c [0167.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664 [0167.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x166c [0167.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1674 [0167.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x167c [0167.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1684 [0167.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c [0167.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694 [0167.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c [0167.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d11b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334 [0167.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8 [0167.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0 [0167.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8 [0167.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700 [0167.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708 [0167.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1710 [0167.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718 [0167.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1720 [0168.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4 [0168.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0168.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0168.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c [0168.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734 [0168.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0168.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x173c [0168.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1744 [0168.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c [0168.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754 [0168.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d12d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c [0168.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764 [0168.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x176c [0168.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0168.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0168.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1254 [0168.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0168.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778 [0168.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0168.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788 [0168.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1790 [0168.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798 [0168.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0168.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d14d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8 [0168.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b0 [0168.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0168.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354 [0168.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1380 [0169.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13bc [0169.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1458 [0169.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728 [0169.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1680 [0169.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0169.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1670 [0169.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738 [0169.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758 [0169.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1794 [0169.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b4 [0169.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4 [0169.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100 [0169.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f4 [0169.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1704 [0169.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714 [0169.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0169.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0169.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0169.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0169.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1730 [0170.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0170.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1750 [0170.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0170.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8 [0170.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0 [0170.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d8 [0170.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e0 [0170.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8 [0170.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0 [0170.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8 [0170.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1804 [0170.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180c [0170.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814 [0170.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c [0170.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0170.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x182c [0170.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834 [0170.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c [0170.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1844 [0170.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184c [0170.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1854 [0170.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c [0170.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1864 [0170.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x186c [0170.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1874 [0170.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x187c [0170.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0170.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1884 [0170.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c [0170.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1894 [0170.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x189c [0170.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4 [0170.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac [0170.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4 [0170.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18bc [0170.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c4 [0170.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0170.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0170.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0170.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4 [0170.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec [0170.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4 [0170.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc [0170.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1904 [0170.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c [0170.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d11b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914 [0170.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x191c [0170.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1924 [0170.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x192c [0170.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d12d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1934 [0170.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x193c [0170.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1944 [0170.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194c [0170.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1954 [0170.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x195c [0170.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1964 [0170.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d14d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x196c [0170.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1974 [0170.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x197c [0170.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984 [0170.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c [0170.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1994 [0170.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0170.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d16c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4 [0170.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac [0170.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4 [0170.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d17a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc [0170.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0 [0170.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d17e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8 [0170.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0170.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8 [0170.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d18c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0170.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8 [0170.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f0 [0170.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8 [0170.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d19e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a00 [0170.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a08 [0170.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a10 [0170.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18 [0170.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20 [0170.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28 [0170.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30 [0170.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38 [0170.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a40 [0170.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48 [0170.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50 [0170.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a58 [0170.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a60 [0170.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a64 [0170.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a6c [0170.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a74 [0170.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a7c [0170.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a84 [0170.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8c [0170.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a94 [0170.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a9c [0170.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa4 [0170.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aac [0170.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4 [0170.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc [0170.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d20a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4 [0170.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d20e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1acc [0170.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad4 [0170.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1adc [0170.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d21c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae4 [0170.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aec [0170.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af4 [0170.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1afc [0170.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d22e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b00 [0170.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b08 [0170.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b10 [0170.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b18 [0170.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d23b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20 [0170.342] Sleep (dwMilliseconds=0x1f4) [0173.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0173.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b1c [0173.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b14 [0173.590] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3244dfc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0173.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0173.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0c [0173.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b04 [0173.592] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc324af95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0173.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0173.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1688 [0173.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8 [0173.594] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc324febd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0173.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0173.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1af0 [0173.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae8 [0173.595] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddc65ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0173.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0173.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ae0 [0173.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad8 [0173.597] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc325383d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0173.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0173.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ad0 [0173.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8 [0173.598] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32599fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0173.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0173.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac0 [0173.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab8 [0173.601] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc325fbb1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0173.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0173.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ab0 [0173.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8 [0173.602] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3265da7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0173.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0173.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1aa0 [0173.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a98 [0173.604] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddcb408, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0173.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0173.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a90 [0173.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a88 [0173.605] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc326ab48, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0173.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0173.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a80 [0173.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a78 [0173.607] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3270d52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0173.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0173.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a70 [0173.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a68 [0173.609] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3274775, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0173.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0173.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1668 [0173.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c [0173.610] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddd2980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0173.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0173.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a54 [0173.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c [0173.612] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc327a95a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0173.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0173.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a44 [0173.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0173.614] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc327f780, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0173.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0173.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a34 [0173.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c [0173.615] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3284574, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0173.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0173.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a24 [0173.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a1c [0173.617] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddd638e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0173.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0173.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a14 [0173.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0c [0173.619] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc328ba9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0173.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0173.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a04 [0173.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19fc [0173.620] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc329ba9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0173.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0173.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19f4 [0173.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec [0173.622] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadddb225, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0173.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0173.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19e4 [0173.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc [0173.623] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32aa36a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0173.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0173.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19d4 [0173.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc [0173.625] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadddffd0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0173.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0173.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b1c [0173.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0173.677] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32bef10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0173.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0173.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1678 [0173.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8 [0173.679] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadde7545, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0173.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0173.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19b0 [0173.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a8 [0173.682] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddeb03f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0173.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0173.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19a0 [0173.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998 [0173.683] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddefe01, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0173.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0173.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1990 [0173.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988 [0173.685] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32c3d3a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0173.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0173.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1980 [0173.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1978 [0173.686] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32c8bc7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0173.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0173.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1970 [0173.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1968 [0173.688] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddf4b9f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0173.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0173.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1960 [0173.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1958 [0173.689] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaddfd450, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0173.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0173.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1950 [0173.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1948 [0173.693] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade0230b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0173.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0173.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1940 [0173.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1938 [0173.695] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32cd986, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0173.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0173.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1440 [0173.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0173.697] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32d3b63, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0173.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0173.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1548 [0173.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0173.699] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32d8980, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0173.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0173.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1574 [0173.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x157c [0173.700] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade070e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0173.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0173.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8a4 [0173.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0173.702] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32deada, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0173.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0173.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1584 [0173.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0173.704] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade15c92, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0173.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0173.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16e0 [0173.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0173.705] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade21ed1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0173.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0173.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16d8 [0173.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0173.708] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade2801c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0173.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0173.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16d0 [0173.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc [0173.710] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32e2576, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0173.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0173.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c8 [0173.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0173.711] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32e8771, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0174.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0174.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7dc [0174.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0174.648] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32ee8d4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0174.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0174.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1878 [0174.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0 [0174.649] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32f36e0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0174.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0174.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1870 [0174.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1868 [0174.650] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc32f9a75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0174.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0174.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1860 [0174.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858 [0174.652] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33070e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0174.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0174.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1850 [0174.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848 [0174.653] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade2ce2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0174.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0174.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1840 [0174.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1838 [0174.654] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade3304f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0174.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0174.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1830 [0174.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1828 [0174.702] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc331e3d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0174.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0174.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1820 [0174.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1818 [0174.704] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3324411, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0174.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0174.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1810 [0174.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1808 [0174.706] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade3a539, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0174.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0174.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17fc [0174.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f4 [0174.708] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade3f392, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0174.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0174.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17ec [0174.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e4 [0174.723] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3329247, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0174.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0174.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17dc [0174.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d4 [0174.725] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade44155, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0174.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0174.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17cc [0174.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1690 [0174.726] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade48f9e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0174.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0174.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1768 [0174.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1760 [0174.728] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade5055a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0174.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0174.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134c [0174.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c [0174.730] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc332f4da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0174.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0174.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1748 [0174.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x171c [0174.734] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3334202, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0174.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0174.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170c [0174.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16fc [0174.736] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade53f21, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0174.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0174.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16ec [0174.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264 [0174.737] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade5a1db, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0174.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0174.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x179c [0174.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ac [0174.739] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3337c75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0174.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0174.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x123c [0174.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0174.740] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade5eeff, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0174.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0174.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13d4 [0174.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0174.742] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade650c9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0174.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0174.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7dc [0174.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b64 [0174.803] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc333cae6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0174.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0174.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b68 [0174.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b6c [0174.804] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3343ff1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0174.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0174.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b70 [0174.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b74 [0174.807] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade6b269, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0174.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0174.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b78 [0174.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b7c [0174.809] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade71474, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0174.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0174.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b80 [0174.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b84 [0174.810] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc334a1a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0174.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0174.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b88 [0174.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8c [0174.811] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade7765a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0174.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0174.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b90 [0174.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b94 [0174.813] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade7d777, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0174.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0174.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b98 [0174.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b9c [0174.815] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade825e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0174.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0174.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ba0 [0174.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba4 [0174.817] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade89b06, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0174.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0174.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ba8 [0174.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bac [0174.818] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade8e8d5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0174.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0174.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bb0 [0174.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb4 [0174.820] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc334f009, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0174.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0174.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bb8 [0174.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bbc [0174.822] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3353e45, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0174.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0174.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc0 [0174.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc4 [0174.823] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3359fe7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0174.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0174.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc8 [0174.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bcc [0174.826] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade94b4e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0174.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0174.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bd0 [0174.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd4 [0174.828] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc335edaa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0174.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0174.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bd8 [0174.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bdc [0174.829] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade9ac3d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0174.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0174.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1be0 [0174.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be4 [0174.831] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3364f2e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0174.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0174.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1be8 [0174.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bec [0174.833] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3368981, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0174.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0174.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bf0 [0174.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf4 [0174.834] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xade9fa70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0174.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0174.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bf8 [0174.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bfc [0174.836] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc337124c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0174.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0174.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1878 [0174.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c04 [0174.878] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33760ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0174.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0174.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c08 [0174.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0c [0174.879] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadea34e6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0174.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0174.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c10 [0174.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c14 [0174.881] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeaaa5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0174.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0174.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c18 [0174.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c1c [0174.884] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeaf88d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0174.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0174.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c20 [0174.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c24 [0174.885] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc337aece, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0174.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0174.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c28 [0174.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c2c [0174.887] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeb4669, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0174.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0174.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c30 [0174.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c34 [0174.888] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeb9576, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0174.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0174.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c38 [0174.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c3c [0174.890] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3381054, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0174.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0174.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c40 [0174.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c44 [0174.893] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33885bb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0174.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0174.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c48 [0174.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4c [0174.895] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadebf620, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0174.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0174.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c50 [0174.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c54 [0174.897] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc338c0d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0174.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0174.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c58 [0174.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c5c [0174.899] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3390e47, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0174.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0174.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c60 [0174.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c64 [0174.900] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3397007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0174.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0174.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c68 [0174.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c6c [0174.902] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadec4462, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0174.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0174.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c70 [0174.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c74 [0174.903] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadec9264, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0174.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0174.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c78 [0174.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c7c [0174.905] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc339e6ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0174.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0174.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c80 [0174.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c84 [0174.908] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadecf531, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0174.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0174.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c88 [0174.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8c [0174.910] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bbb700, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xaded55f4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x89bbb700, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0174.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0174.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c90 [0174.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c94 [0174.912] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeda3f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0174.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0174.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c98 [0174.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c9c [0174.914] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeddf54, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0174.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0174.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ca0 [0176.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c98 [0176.452] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33a333a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0176.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0176.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c90 [0176.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c88 [0176.453] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadee4037, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0176.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0176.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c80 [0176.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c78 [0176.454] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33a8173, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0176.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0176.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c70 [0176.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c60 [0176.456] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadeeb58a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0176.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0176.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c68 [0176.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c58 [0176.458] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadef16f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0176.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0176.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c50 [0176.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c48 [0176.459] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33ae337, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0176.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0176.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c40 [0176.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c38 [0176.460] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33b44a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0176.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0176.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c30 [0176.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c28 [0176.462] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33b9311, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0176.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0176.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c20 [0176.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c18 [0176.464] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadef5169, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0176.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0176.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c10 [0176.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c08 [0176.465] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadef9f85, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0176.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0176.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1878 [0176.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf8 [0176.466] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33be0eb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0176.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0176.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bf0 [0176.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be8 [0176.467] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf001b7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0176.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0176.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1be0 [0176.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd8 [0176.469] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33c2f4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0176.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0176.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bd0 [0176.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc8 [0176.470] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf04f6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0176.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0176.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc0 [0176.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb8 [0176.471] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33c9131, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0176.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0176.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bb0 [0176.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba8 [0176.473] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf09df9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0176.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0176.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ba0 [0176.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b98 [0176.474] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33d0667, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0176.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0176.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b90 [0176.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b88 [0176.475] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33d4116, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0176.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0176.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b80 [0176.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b78 [0176.476] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33d8eea, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0176.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0176.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b70 [0176.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b68 [0176.478] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf0ebc5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0176.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0176.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7dc [0176.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0176.479] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf14d53, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0176.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0176.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13d4 [0176.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x123c [0176.480] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33df047, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0176.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0176.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x179c [0176.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec [0176.482] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf19b52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0176.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0176.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170c [0176.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1748 [0176.483] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf1e98f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0176.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0176.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134c [0176.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768 [0176.485] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf237b9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0176.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0176.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17cc [0176.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17dc [0176.486] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33e3e85, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0176.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0176.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c80 [0176.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c70 [0176.851] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33e8d86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0176.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0176.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c68 [0176.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0176.853] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf287a1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0176.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0176.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c80 [0176.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0176.938] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33edaa2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0176.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0176.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8c [0176.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0176.940] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc33f3c52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0176.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0177.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b70 [0177.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c50 [0177.167] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf2d3cf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0177.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0177.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1878 [0177.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0177.169] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf335c0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0177.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0177.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13d4 [0177.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0177.170] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3422ae9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0177.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0177.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0177.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0177.172] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3439677, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0177.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0177.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100c [0177.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0177.173] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf61c81, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0177.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0177.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16a4 [0177.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0177.175] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3440bc9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0177.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0177.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16ac [0177.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0177.176] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf66a59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0177.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0177.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16b4 [0177.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0177.177] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc344947d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0177.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0177.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16bc [0177.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0177.179] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf6cbb2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0177.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0177.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0c [0177.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0177.181] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3451d10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0177.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0177.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1af0 [0177.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae0 [0177.182] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf740bd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0177.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0177.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ad0 [0177.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0177.183] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3458198, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0177.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0177.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ab0 [0177.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0 [0177.185] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc345e17e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0177.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0177.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a90 [0177.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a80 [0177.186] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf7a2a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0177.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0177.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a70 [0177.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668 [0177.188] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf8179c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0177.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0177.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a54 [0177.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0177.189] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34655d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0177.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0177.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a34 [0177.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24 [0177.191] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc346cafc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0177.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0177.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a14 [0177.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a04 [0177.193] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3472c60, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0177.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0177.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19f4 [0177.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4 [0177.194] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf88d5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0177.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0177.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19d4 [0177.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0177.195] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf901e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0177.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0177.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17ec [0177.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc [0177.197] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf963e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0177.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0177.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1810 [0177.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1820 [0177.199] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf9b19a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0177.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0177.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1830 [0177.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840 [0177.200] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadf9ffbb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0177.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0177.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1850 [0177.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860 [0177.202] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3478df9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0177.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0177.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1870 [0177.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca4 [0177.203] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc347dc17, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0177.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0178.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a14 [0178.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4 [0178.121] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfa6200, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0178.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0178.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c30 [0178.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54 [0178.129] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3483dd2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0178.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0178.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1810 [0178.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870 [0178.132] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3488be5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0178.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0178.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a90 [0178.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0178.134] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfac394, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0178.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0178.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a34 [0178.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a70 [0178.137] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfb24e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0178.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0178.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19d4 [0178.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec [0178.138] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc348da3d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0178.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0178.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1830 [0178.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0c [0178.140] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfb9aaf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0178.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0178.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1850 [0178.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad0 [0178.141] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3493ba4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0178.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0178.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16b4 [0178.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0178.144] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34989a2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0178.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0178.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1af0 [0178.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab0 [0178.145] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfbfb9a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0178.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0178.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc0 [0178.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc4 [0178.147] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34a2684, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0178.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0178.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc8 [0178.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dcc [0178.148] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34a7417, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0178.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0178.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dd0 [0178.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd4 [0178.150] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34aea14, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0178.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0178.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dd8 [0178.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ddc [0178.155] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfc5d43, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0178.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0178.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1de0 [0178.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de4 [0178.157] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfcabaf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0178.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0178.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1de8 [0178.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dec [0178.159] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34b376a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0178.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0178.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1df0 [0178.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df4 [0178.160] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34b8595, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0178.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0178.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1df8 [0178.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dfc [0178.162] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfcf987, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0178.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0178.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e00 [0178.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de8 [0178.822] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfd34b4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0178.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0178.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1df8 [0178.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df0 [0178.823] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34be71b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0178.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0178.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19d4 [0178.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34 [0178.825] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfda969, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0178.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0178.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a90 [0178.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810 [0178.826] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfdf802, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0178.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0178.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c30 [0178.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0178.828] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfe461a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0178.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0178.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dd8 [0178.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de0 [0178.829] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadfe93d8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0178.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0178.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dd0 [0178.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc8 [0178.830] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadff0933, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0178.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0178.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc0 [0178.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af0 [0178.832] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34c4918, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0178.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0178.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16b4 [0178.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1850 [0178.834] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadff4495, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0178.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0178.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c20 [0178.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dac [0178.835] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadff9183, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0178.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0178.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1db0 [0178.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db4 [0178.836] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34c96e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0178.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0178.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1db8 [0178.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dbc [0178.837] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xadffe012, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0178.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0178.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c90 [0178.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c40 [0178.838] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae004153, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0178.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0178.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e04 [0178.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e08 [0178.840] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34ce520, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0178.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0178.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0c [0178.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e10 [0178.841] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34d3449, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0178.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0178.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e14 [0178.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e18 [0178.844] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae008fad, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0178.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0178.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e1c [0178.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e20 [0178.845] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae00ddff, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0178.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0178.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e24 [0178.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e28 [0178.846] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae012bf8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0178.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0178.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e2c [0178.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e30 [0178.847] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae018de3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0178.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0178.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e34 [0178.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e38 [0178.849] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae01db79, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0178.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0178.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e3c [0178.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e40 [0178.850] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae023d59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0178.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0178.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e44 [0178.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e48 [0178.852] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34d94f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0178.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0178.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4c [0178.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e50 [0178.854] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae028b61, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0178.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0178.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e54 [0178.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e58 [0178.855] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34dcf5d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0178.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0178.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e5c [0178.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e60 [0178.856] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34e3133, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0178.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0178.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e64 [0178.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e68 [0178.857] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34e92c0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0178.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0178.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e6c [0178.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e70 [0178.859] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae02ed77, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0178.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0178.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e00 [0178.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e90 [0178.906] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34ee158, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0178.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0178.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e94 [0178.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e98 [0178.908] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34f2f0b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0178.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0178.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e9c [0178.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea0 [0178.909] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34f7d1e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0178.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0178.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ea4 [0178.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea8 [0178.910] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc34fcb47, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0178.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0178.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1eac [0178.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb0 [0178.911] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae032794, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0178.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0178.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1eb4 [0178.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb8 [0178.913] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3502d33, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0178.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0178.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ebc [0178.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec0 [0178.916] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3508ea9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0178.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0178.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec4 [0178.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec8 [0178.917] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae038b92, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0178.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0178.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ecc [0178.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed0 [0178.918] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae03feac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0178.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0178.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ed4 [0178.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed8 [0178.919] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0473ba, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0178.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0178.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1edc [0178.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee0 [0178.921] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae04c264, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0178.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0178.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ee4 [0178.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee8 [0178.922] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0523b9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0178.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0178.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1eec [0178.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef0 [0178.924] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae057198, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0178.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0178.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ef4 [0178.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef8 [0178.925] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc350dcf1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0178.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0178.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1efc [0178.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f00 [0178.926] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3512aef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0178.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0178.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f04 [0178.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f08 [0178.927] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3518c71, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0178.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0178.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0c [0178.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f10 [0178.929] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc351db24, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0178.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0178.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f14 [0178.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f18 [0178.930] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae05d35c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0178.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0178.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f1c [0178.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f20 [0178.932] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3523d10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0178.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0178.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f24 [0178.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f28 [0178.933] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae063516, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0178.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0178.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f2c [0178.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f30 [0178.934] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3528b2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0178.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0178.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f34 [0178.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f38 [0178.936] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc352ffa1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0178.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0178.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f3c [0178.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f40 [0178.937] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3534db2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0178.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0178.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f44 [0178.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f48 [0178.939] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae06975d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0178.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0178.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1df8 [0178.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4c [0178.965] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae06f831, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0178.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0178.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f50 [0178.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f54 [0178.966] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3539bf2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0178.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0178.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f58 [0178.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f5c [0178.970] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0759ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0178.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0178.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f60 [0178.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f64 [0178.974] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae07a7c3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0178.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0178.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f68 [0178.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f6c [0178.975] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc353e9f5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0178.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0178.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f70 [0178.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f74 [0178.976] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35c893f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0178.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0178.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f78 [0178.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f7c [0178.979] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae07f636, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0178.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0178.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f80 [0178.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f84 [0178.981] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae08442f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0178.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0178.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f88 [0178.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8c [0178.985] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae08e068, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0178.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0178.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f90 [0178.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f94 [0178.987] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35cfe0a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0178.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 0x20 [0178.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f98 [0178.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f9c [0178.989] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35d4cba, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0178.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 0x20 [0178.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fa0 [0178.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa4 [0178.993] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35dc186, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0178.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 0x20 [0178.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fa8 [0179.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fac [0179.001] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae092e89, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0179.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 0x20 [0179.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fb0 [0179.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb4 [0179.003] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35e3754, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0179.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 0x20 [0179.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fb8 [0179.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d11b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fbc [0179.006] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35eabbc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0179.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 0x20 [0179.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc0 [0179.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc4 [0179.007] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae099028, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0179.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 0x20 [0179.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc8 [0179.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb8 [0180.506] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35f2102, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0180.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 0x20 [0180.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fb0 [0180.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa8 [0180.508] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae09f26a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0180.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 0x20 [0180.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fa0 [0180.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f98 [0180.511] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc35f5c19, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0180.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 0x20 [0180.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f90 [0180.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f88 [0180.512] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0a6728, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0180.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 0x20 [0180.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f80 [0180.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f78 [0180.524] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3611f16, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0180.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 0x20 [0180.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f70 [0180.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f68 [0180.527] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0ac8c1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0180.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 0x20 [0180.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f60 [0180.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f58 [0180.529] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0b16e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0180.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 0x20 [0180.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f50 [0180.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df8 [0180.530] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0b78f5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0180.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 0x20 [0180.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f3c [0180.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f44 [0180.532] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0bda37, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0180.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 0x20 [0180.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f34 [0180.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f2c [0180.536] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0c3c1d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0180.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 0x20 [0180.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f24 [0180.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f1c [0180.537] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc361b920, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0180.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 0x20 [0180.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f14 [0180.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0c [0180.539] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3620713, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0180.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 0x20 [0180.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f04 [0180.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134c [0180.760] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36268ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0180.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 0x20 [0180.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc0 [0180.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170c [0180.761] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0c89d9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0180.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 0x20 [0180.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x179c [0180.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80 [0180.763] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0cebc7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0180.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 0x20 [0180.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0180.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0180.764] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc362caaa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0180.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 0x20 [0180.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0180.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b90 [0180.766] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0d3a2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0180.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 0x20 [0180.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d18 [0180.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d14 [0180.768] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0d9cbd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0180.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 0x20 [0180.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d10 [0180.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0c [0180.769] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3632c45, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0180.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 0x20 [0180.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d08 [0180.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d04 [0180.770] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3637ace, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0180.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 0x20 [0180.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d00 [0180.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cfc [0180.771] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0dfd9a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0180.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 0x20 [0180.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cf8 [0180.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf4 [0180.775] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0e5f14, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0180.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 0x20 [0180.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cf0 [0180.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cec [0180.777] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0ed3f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0180.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 0x20 [0180.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ce8 [0180.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce4 [0180.778] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc363c893, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0180.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 0x20 [0180.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ce0 [0180.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cdc [0180.780] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0f231a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0180.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 0x20 [0180.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cd8 [0180.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd4 [0180.781] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0f703b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0180.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 0x20 [0180.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cd0 [0180.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ccc [0180.782] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3646576, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0180.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 0x20 [0180.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc8 [0180.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc4 [0180.784] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae0fd20d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0180.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 0x20 [0180.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc0 [0180.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cbc [0180.785] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae10475e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0180.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 0x20 [0180.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cb8 [0180.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb4 [0180.787] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc364b2af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0180.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 0x20 [0180.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cb0 [0180.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0180.788] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae109523, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0180.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 0x20 [0180.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x121c [0180.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0180.789] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae10e317, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0180.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 0x20 [0180.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1284 [0180.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0180.791] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36500e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0180.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 0x20 [0180.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0180.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930 [0180.792] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae113158, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0180.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 0x20 [0180.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1928 [0180.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920 [0180.793] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae11a6aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0180.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 0x20 [0180.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x750 [0180.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0180.831] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3656275, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0180.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 0x20 [0180.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1910 [0180.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0180.832] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc365b018, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0180.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 0x20 [0180.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dd8 [0180.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c30 [0180.931] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae11e112, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0180.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 0x20 [0180.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a90 [0180.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0180.933] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc365feb5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0180.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 0x20 [0180.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fcc [0180.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd0 [0180.934] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae122ffb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0180.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 0x20 [0180.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fd4 [0180.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd8 [0180.935] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae127d3d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0180.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 0x20 [0180.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fdc [0180.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe0 [0180.937] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3664cd3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0180.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 0x20 [0180.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fe4 [0180.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe8 [0180.938] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae12df70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0180.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 0x20 [0181.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x121c [0181.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928 [0181.646] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae132d56, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0181.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 0x20 [0181.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cd0 [0181.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd8 [0181.647] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae137b40, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0181.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 0x20 [0181.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f24 [0181.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc0 [0181.649] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3669b21, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0181.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 0x20 [0181.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f04 [0181.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0181.665] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae13dd37, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0181.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 0x20 [0181.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0181.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf8 [0181.667] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae143e6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0181.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 0x20 [0181.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d18 [0181.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf0 [0181.669] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc366fcab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0181.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 0x20 [0181.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f14 [0181.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb0 [0181.672] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36737d9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0181.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 0x20 [0181.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ce0 [0181.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0181.673] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae148e99, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0181.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 0x20 [0181.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc0 [0181.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce8 [0181.675] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3678625, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0181.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 0x20 [0181.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f70 [0181.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb8 [0181.676] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc367d360, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0181.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 0x20 [0181.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1284 [0181.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d10 [0181.678] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae14c74d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0181.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 0x20 [0181.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f90 [0181.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc0 [0181.679] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae15154b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0181.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 0x20 [0181.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fec [0181.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff0 [0181.681] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae15770b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0181.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 0x20 [0181.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ff4 [0181.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff8 [0181.683] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae15ec55, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0181.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 0x20 [0181.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ffc [0181.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2004 [0181.690] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc368353f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0181.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 0x20 [0181.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc8 [0181.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0181.710] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae163a95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0181.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 0x20 [0181.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2008 [0181.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200c [0181.712] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1688b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0181.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 0x20 [0181.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2010 [0181.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2014 [0181.714] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3688358, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0181.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 0x20 [0181.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2018 [0181.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x201c [0181.715] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae16ead3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0181.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 0x20 [0181.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2020 [0181.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2024 [0181.718] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae17384d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0181.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 0x20 [0181.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2028 [0181.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x202c [0181.719] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae17ae05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0181.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 0x20 [0181.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2030 [0181.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2034 [0181.720] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc368d19f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0181.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 0x20 [0181.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2038 [0181.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x203c [0181.722] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc369d1aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0181.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 0x20 [0181.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2040 [0181.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2044 [0181.723] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36acd3c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0181.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 0x20 [0181.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2048 [0181.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204c [0181.726] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae17fbb2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0181.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 0x20 [0181.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2050 [0181.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2054 [0181.727] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae184ab7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0181.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 0x20 [0181.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2058 [0181.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x205c [0181.729] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae18bf65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0181.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 0x20 [0181.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2060 [0181.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2064 [0181.731] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36b1b8b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0181.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 0x20 [0181.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2068 [0181.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x206c [0181.732] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae18f9c7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0181.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 0x20 [0181.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2070 [0181.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2074 [0181.734] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae195b52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0181.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 0x20 [0181.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2078 [0181.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x207c [0181.736] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae19bcd1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0181.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 0x20 [0181.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2080 [0181.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2084 [0181.738] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1a0b59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0181.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 0x20 [0181.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2088 [0181.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208c [0181.740] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36b7d4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0181.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 0x20 [0181.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2090 [0181.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2094 [0181.742] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1a5969, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0181.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 0x20 [0181.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2098 [0181.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2090 [0183.083] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1abb99, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0183.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 0x20 [0183.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2088 [0183.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2080 [0183.085] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36bded3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0183.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 0x20 [0183.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2078 [0183.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2070 [0183.087] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1b1c74, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0183.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 0x20 [0183.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2068 [0183.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2060 [0183.090] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1b7e51, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0183.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 0x20 [0183.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2058 [0183.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2050 [0183.092] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36c4077, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0183.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 0x20 [0183.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2048 [0183.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2040 [0183.095] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36c8ed5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0183.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 0x20 [0183.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2038 [0183.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2030 [0183.097] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1bf3da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0183.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 0x20 [0183.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2028 [0183.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2020 [0183.099] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1c55af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0183.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 0x20 [0183.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2018 [0183.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2010 [0183.101] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36cdcd6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0183.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 0x20 [0183.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2008 [0183.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc8 [0183.103] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36d3e76, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0183.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 0x20 [0183.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ffc [0183.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff4 [0183.106] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36db3ca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0183.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 0x20 [0183.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fec [0183.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f90 [0183.110] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1cca1e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0183.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 0x20 [0183.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1284 [0183.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc0 [0183.113] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1d2c51, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0183.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 0x20 [0183.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f70 [0183.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce0 [0183.115] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36e290f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0183.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 0x20 [0183.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f14 [0183.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d18 [0183.118] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36e8aab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0183.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 0x20 [0183.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0183.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f04 [0183.120] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1d8d6c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0183.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 0x20 [0183.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f24 [0183.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd0 [0183.122] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1e1611, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0183.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 0x20 [0183.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x121c [0183.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe4 [0183.124] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1e8b98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0183.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 0x20 [0183.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2098 [0183.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2170 [0183.409] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36ed8e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0183.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 0x20 [0183.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2174 [0183.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2178 [0183.411] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1ed985, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0183.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 0x20 [0183.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x217c [0183.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2180 [0183.413] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36f3b3c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0183.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 0x20 [0183.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2184 [0183.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2188 [0183.416] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1f2784, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0183.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 0x20 [0183.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218c [0183.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2190 [0183.418] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36f9bfd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0183.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 0x20 [0183.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2194 [0183.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2198 [0183.419] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc36fe9f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0183.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 0x20 [0183.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x219c [0183.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a0 [0183.421] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae1f75cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0183.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 0x20 [0183.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21a4 [0183.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a8 [0183.423] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae24a5e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0183.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 0x20 [0183.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21ac [0183.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b0 [0183.441] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3703845, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0183.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 0x20 [0183.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21b4 [0183.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b8 [0183.444] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae24f3ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0183.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 0x20 [0183.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21bc [0183.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c0 [0183.446] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae254209, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0183.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 0x20 [0183.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c4 [0183.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c8 [0183.447] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae259095, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0183.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 0x20 [0183.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21cc [0183.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d0 [0183.449] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37099cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0183.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 0x20 [0183.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21d4 [0183.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d8 [0183.455] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae25f1e2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0183.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 0x20 [0183.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21dc [0183.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e0 [0183.458] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc370e7e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0183.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 0x20 [0183.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21e4 [0183.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e8 [0183.460] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37149a6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0183.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 0x20 [0183.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21ec [0183.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f0 [0183.461] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc371ab15, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0183.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 0x20 [0183.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21f4 [0183.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f8 [0183.463] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae263fdf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0183.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 0x20 [0183.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21fc [0183.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2200 [0183.465] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3720ccf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0183.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 0x20 [0183.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2088 [0183.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2204 [0183.504] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae268e06, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0183.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 0x20 [0183.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2208 [0183.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220c [0183.506] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae271712, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0183.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 0x20 [0183.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2210 [0183.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2214 [0183.508] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae278cd9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0183.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 0x20 [0183.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2218 [0183.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x221c [0183.510] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3725b17, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0183.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 0x20 [0183.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2220 [0183.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2224 [0183.512] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae27daf8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0183.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 0x20 [0183.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2228 [0183.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x222c [0183.513] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae283bc9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0183.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 0x20 [0183.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2230 [0183.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2234 [0183.515] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2889f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0183.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 0x20 [0183.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2238 [0183.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x223c [0183.517] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae28d875, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0183.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 0x20 [0183.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2240 [0183.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2244 [0183.520] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2939b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0183.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 0x20 [0183.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2248 [0183.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224c [0183.522] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc372a935, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0183.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 0x20 [0183.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2250 [0183.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2254 [0183.524] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae298858, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0183.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 0x20 [0183.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2258 [0183.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x225c [0183.526] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae29e97b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0183.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 0x20 [0183.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2260 [0183.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2264 [0183.527] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2a4ba5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0183.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 0x20 [0183.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2268 [0183.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x226c [0183.531] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2a99c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0183.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 0x20 [0183.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2270 [0183.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2274 [0183.532] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc372f74d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0183.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 0x20 [0183.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2278 [0183.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x227c [0183.536] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2afb35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0183.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 0x20 [0183.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2280 [0183.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2284 [0183.538] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2b4918, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0183.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 0x20 [0183.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2288 [0183.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228c [0183.539] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37358c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0183.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 0x20 [0183.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2078 [0183.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2290 [0183.576] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc373ba8e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0183.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 0x20 [0183.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2294 [0183.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2298 [0183.578] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2bc094, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0183.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 0x20 [0183.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x229c [0183.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a0 [0183.581] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3741c3b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0183.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 0x20 [0183.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22a4 [0183.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a8 [0183.583] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3747dce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0183.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 0x20 [0183.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22ac [0183.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b0 [0183.585] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc374df5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0183.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 0x20 [0183.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22b4 [0183.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b8 [0183.587] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3752d7a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0183.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216612.wmf")) returned 0x20 [0183.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22bc [0183.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c0 [0183.589] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3758f5c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0183.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 0x20 [0183.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c4 [0183.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c8 [0183.591] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc375f149, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0183.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 0x20 [0183.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22cc [0183.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d0 [0183.593] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2c0c27, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0183.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 0x20 [0183.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22d4 [0183.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d8 [0183.594] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2c5acb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0183.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 0x20 [0183.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22dc [0183.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e0 [0183.602] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3765292, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0183.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 0x20 [0183.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22e4 [0183.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d11b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e8 [0183.604] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc376c7b4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0183.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 0x20 [0183.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22ec [0183.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f0 [0183.607] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2ca8d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0183.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 0x20 [0183.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22f4 [0183.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f8 [0183.608] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2d1ddf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0183.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 0x20 [0183.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2068 [0183.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22fc [0183.640] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37715d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0183.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 0x20 [0183.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2300 [0183.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2304 [0183.642] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2d6c18, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0183.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 0x20 [0183.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2308 [0183.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d12d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230c [0183.645] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2dba35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0183.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 0x20 [0183.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2310 [0183.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2314 [0183.651] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2e2f52, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0183.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 0x20 [0183.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2318 [0183.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x231c [0183.653] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37777e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0183.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232395.wmf")) returned 0x20 [0183.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2320 [0183.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2324 [0183.655] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2e7dcd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0183.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 0x20 [0183.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2328 [0183.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x232c [0183.658] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2edfb3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0183.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232797.wmf")) returned 0x20 [0183.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2330 [0183.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2334 [0183.660] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2f40c4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0183.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 0x20 [0183.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2338 [0183.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x233c [0183.662] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc377d997, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0183.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 0x20 [0183.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2340 [0183.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d14d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2344 [0183.664] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3783afd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0183.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233665.wmf")) returned 0x20 [0183.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2348 [0183.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234c [0183.666] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae2fb657, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0183.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233992.wmf")) returned 0x20 [0183.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2350 [0183.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2354 [0183.668] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3789c9e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0183.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234000.wmf")) returned 0x20 [0183.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2358 [0183.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x235c [0183.670] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc378ea98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0183.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234001.wmf")) returned 0x20 [0183.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2360 [0183.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2364 [0183.671] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae302b30, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0183.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234376.wmf")) returned 0x20 [0183.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2058 [0183.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2368 [0183.720] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae308cd7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0183.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237225.wmf")) returned 0x20 [0183.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x236c [0183.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2370 [0183.722] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3794cb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0183.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237228.wmf")) returned 0x20 [0183.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2374 [0183.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2378 [0183.725] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae30ee6f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0183.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237336.wmf")) returned 0x20 [0183.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x237c [0183.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d16c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2380 [0183.727] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae315050, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0183.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237759.wmf")) returned 0x20 [0183.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2384 [0183.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2388 [0183.729] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae31b203, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0183.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238333.wmf")) returned 0x20 [0183.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238c [0183.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2390 [0183.731] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae320004, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0183.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238927.wmf")) returned 0x20 [0183.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2394 [0183.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d17a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2398 [0183.733] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3799af5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0183.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238959.wmf")) returned 0x20 [0183.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x239c [0183.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d17e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a0 [0183.735] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae324df3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0183.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238983.wmf")) returned 0x20 [0183.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23a4 [0183.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a8 [0183.739] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc379e875, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0183.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239057.wmf")) returned 0x20 [0183.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23ac [0183.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b0 [0183.741] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae329c32, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0183.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239063.wmf")) returned 0x20 [0183.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23b4 [0183.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d18c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b8 [0183.743] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae32fdfd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0183.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239079.wmf")) returned 0x20 [0183.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23bc [0183.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c0 [0183.745] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae334be9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0183.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239191.wmf")) returned 0x20 [0183.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c4 [0183.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c8 [0183.747] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37a4a51, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0183.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239611.wmf")) returned 0x20 [0183.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23cc [0183.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d0 [0183.751] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37a98af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0183.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239935.wmf")) returned 0x20 [0183.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2048 [0183.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d19e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d4 [0183.785] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae339a4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0183.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239941.wmf")) returned 0x20 [0183.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23d8 [0183.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23dc [0183.787] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37ae6b5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0183.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239943.wmf")) returned 0x20 [0183.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23e0 [0183.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e4 [0183.790] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae33e7fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0183.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239951.wmf")) returned 0x20 [0183.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23e8 [0183.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ec [0183.791] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37b482f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0183.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239953.wmf")) returned 0x20 [0183.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23f0 [0183.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f4 [0183.793] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37b9663, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0183.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239955.wmf")) returned 0x20 [0183.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23f8 [0183.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23fc [0183.795] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae344965, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0183.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239965.wmf")) returned 0x20 [0183.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2404 [0183.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2408 [0183.798] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3497c9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0183.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239967.wmf")) returned 0x20 [0183.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240c [0183.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2410 [0183.800] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae34d286, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0183.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239973.wmf")) returned 0x20 [0183.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2414 [0183.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2418 [0183.804] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae35475a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0183.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239975.wmf")) returned 0x20 [0183.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x241c [0183.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2420 [0183.806] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3596ae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0183.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239997.wmf")) returned 0x20 [0183.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2424 [0183.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2428 [0183.809] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae360a80, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0183.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240157.wmf")) returned 0x20 [0183.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x242c [0183.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2430 [0183.811] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae366ca9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0183.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240175.wmf")) returned 0x20 [0183.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2434 [0183.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2438 [0183.813] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae36baf4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0183.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240189.wmf")) returned 0x20 [0183.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x243c [0183.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2440 [0183.815] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37be55d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0183.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240291.wmf")) returned 0x20 [0183.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2028 [0183.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2038 [0183.894] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37c3260, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0183.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241019.wmf")) returned 0x20 [0183.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2444 [0183.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2448 [0183.896] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37c6d3b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0183.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241037.wmf")) returned 0x20 [0183.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244c [0183.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2450 [0183.898] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae370c5e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0183.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241041.wmf")) returned 0x20 [0183.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2454 [0183.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2458 [0183.901] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37cbb10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0183.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241043.wmf")) returned 0x20 [0183.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x245c [0183.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2460 [0183.903] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37d1d09, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0183.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241077.wmf")) returned 0x20 [0183.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2464 [0183.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2468 [0183.905] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae37572e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0183.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241773.wmf")) returned 0x20 [0183.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x246c [0183.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2470 [0183.907] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37d7e85, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0183.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241781.wmf")) returned 0x20 [0183.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2474 [0183.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2478 [0183.909] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae37b8b0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0183.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250504.wmf")) returned 0x20 [0183.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x247c [0183.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2480 [0183.913] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae381ae8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0183.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250997.wmf")) returned 0x20 [0183.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2484 [0183.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2488 [0183.915] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae388fb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0183.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0251007.wmf")) returned 0x20 [0183.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248c [0183.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2490 [0183.918] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae38de29, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0183.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252629.wmf")) returned 0x20 [0183.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2494 [0183.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2498 [0183.920] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37db9a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0183.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252669.wmf")) returned 0x20 [0183.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x249c [0183.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d2058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a0 [0183.921] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37e07c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0183.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0278702.wmf")) returned 0x20 [0183.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24a4 [0183.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d20a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a8 [0183.923] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae393ff5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0183.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0279644.wmf")) returned 0x20 [0183.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24ac [0183.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d20e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a4 [0186.682] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37ea406, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0186.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0280468.wmf")) returned 0x20 [0186.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x249c [0186.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2494 [0186.685] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae39b541, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0186.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281008.wmf")) returned 0x20 [0186.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248c [0186.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2484 [0186.687] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37f0533, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0186.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281243.wmf")) returned 0x20 [0186.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x247c [0186.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2474 [0186.688] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3a1607, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0186.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281630.wmf")) returned 0x20 [0186.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x246c [0186.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2464 [0186.690] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3a64c1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0186.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281632.wmf")) returned 0x20 [0186.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x245c [0186.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2454 [0186.692] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37f5341, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0186.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281638.wmf")) returned 0x20 [0186.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244c [0186.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2444 [0186.693] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc37fa171, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0186.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281640.wmf")) returned 0x20 [0186.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2028 [0186.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x243c [0186.694] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3800601, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0186.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282126.wmf")) returned 0x20 [0186.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2434 [0186.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x242c [0186.696] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38064d9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0186.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282928.wmf")) returned 0x20 [0186.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2424 [0186.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x241c [0186.697] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc380b2e5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0186.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282932.wmf")) returned 0x20 [0186.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2414 [0186.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240c [0186.699] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc381016d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0186.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285462.wmf")) returned 0x20 [0186.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2404 [0186.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f8 [0186.700] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3816309, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0186.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285484.wmf")) returned 0x20 [0186.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23f0 [0186.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e8 [0186.702] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc381c637, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0186.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285780.wmf")) returned 0x20 [0186.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23e0 [0186.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d8 [0186.703] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3ab245, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0186.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285782.wmf")) returned 0x20 [0186.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2048 [0186.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23cc [0186.705] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc382127d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0186.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285792.wmf")) returned 0x20 [0186.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c4 [0186.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23bc [0186.706] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3b008c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0186.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285796.wmf")) returned 0x20 [0186.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23b4 [0186.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ac [0186.707] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc382607e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0186.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285808.wmf")) returned 0x20 [0186.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23a4 [0186.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x239c [0186.708] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc382afc9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0186.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285820.wmf")) returned 0x20 [0186.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2394 [0186.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238c [0186.710] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3b62b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0186.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285822.wmf")) returned 0x20 [0186.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2384 [0186.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x237c [0186.712] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38323c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0186.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287018.wmf")) returned 0x20 [0186.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2374 [0186.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x236c [0186.714] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3838588, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0186.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287019.wmf")) returned 0x20 [0186.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2058 [0186.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2360 [0186.716] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3bc3e8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0186.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287020.wmf")) returned 0x20 [0186.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2358 [0186.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2028 [0187.351] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc383e70a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0187.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287024.wmf")) returned 0x20 [0187.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x75c [0187.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2350 [0187.375] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3c38f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0187.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287408.wmf")) returned 0x20 [0187.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x760 [0187.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244c [0187.377] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3846fbe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0187.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287415.wmf")) returned 0x20 [0187.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x245c [0187.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x246c [0187.387] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc384ea4d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0187.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287417.wmf")) returned 0x20 [0187.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x247c [0187.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248c [0187.389] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38546b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0187.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287641.jpg")) returned 0x20 [0187.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x249c [0187.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24ac [0187.391] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3c8727, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0187.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287642.jpg")) returned 0x20 [0187.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1540 [0187.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2340 [0187.392] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3cfc2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0187.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287643.jpg")) returned 0x20 [0187.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2330 [0187.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2328 [0187.393] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3859517, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0187.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287644.jpg")) returned 0x20 [0187.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2320 [0187.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2318 [0187.395] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3d5de5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0187.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287645.jpg")) returned 0x20 [0187.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2310 [0187.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2308 [0187.398] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3dac46, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0187.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0289430.jpg")) returned 0x20 [0187.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2300 [0187.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2068 [0187.399] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3dfa49, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0187.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0290548.wmf")) returned 0x20 [0187.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22f4 [0187.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e4 [0187.402] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3e6f8d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0187.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0291794.wmf")) returned 0x20 [0187.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22ec [0187.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22dc [0187.456] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc385f6e4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0187.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292248.wmf")) returned 0x20 [0187.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22d4 [0187.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22cc [0187.498] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3ebe3b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0187.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292270.wmf")) returned 0x20 [0187.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c4 [0187.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22bc [0187.500] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3f0bbc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0187.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292272.wmf")) returned 0x20 [0187.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2414 [0187.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b4 [0187.502] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3f5a59, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0187.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292278.wmf")) returned 0x20 [0187.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22ac [0187.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a4 [0187.509] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae3fbbd1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0187.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292286.wmf")) returned 0x20 [0187.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x229c [0187.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2294 [0187.520] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae40f5eb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0187.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293800.wmf")) returned 0x20 [0187.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2078 [0187.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2288 [0187.522] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3864484, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0187.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293832.wmf")) returned 0x20 [0187.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2280 [0187.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2278 [0187.523] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae417d05, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0187.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294989.wmf")) returned 0x20 [0187.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2270 [0187.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2268 [0187.524] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc386a652, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0187.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294991.wmf")) returned 0x20 [0187.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2260 [0187.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2258 [0187.525] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae420569, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0187.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0295069.wmf")) returned 0x20 [0187.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2250 [0187.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2248 [0187.527] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae427aab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0187.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296277.wmf")) returned 0x20 [0187.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2058 [0187.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2240 [0187.538] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4303c5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0187.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296279.wmf")) returned 0x20 [0187.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2238 [0187.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2230 [0187.540] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38707d8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0187.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296288.wmf")) returned 0x20 [0187.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2228 [0187.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2220 [0187.541] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae435130, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0187.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297229.wmf")) returned 0x20 [0187.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2218 [0187.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2210 [0187.542] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae43b38e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0187.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297269.wmf")) returned 0x20 [0187.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2208 [0187.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2088 [0187.544] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc387696a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0187.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297725.wmf")) returned 0x20 [0187.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21fc [0187.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f4 [0187.546] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4401da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0187.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297727.wmf")) returned 0x20 [0187.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21ec [0187.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e4 [0187.549] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc387cb71, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0187.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297757.wmf")) returned 0x20 [0187.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21dc [0187.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d4 [0187.550] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4476ab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0187.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297759.wmf")) returned 0x20 [0187.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21cc [0187.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c4 [0187.552] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae44c467, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0187.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0300862.wmf")) returned 0x20 [0187.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21bc [0187.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b4 [0187.554] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae452638, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0187.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301044.wmf")) returned 0x20 [0187.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21ac [0187.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2158 [0187.555] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38819f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0187.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301052.wmf")) returned 0x20 [0187.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2154 [0187.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2150 [0187.556] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae458805, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0187.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301418.wmf")) returned 0x20 [0187.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214c [0187.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2148 [0187.558] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3887b13, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0187.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301432.wmf")) returned 0x20 [0187.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2144 [0187.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2140 [0187.559] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc388ca98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0187.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304371.wmf")) returned 0x20 [0187.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x213c [0187.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2138 [0187.562] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae45c23f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0187.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304405.wmf")) returned 0x20 [0187.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2134 [0187.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd0 [0187.563] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3892aea, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0187.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304853.wmf")) returned 0x20 [0187.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc0 [0187.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0187.565] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3897923, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0187.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304861.wmf")) returned 0x20 [0187.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c20 [0187.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db0 [0187.566] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae46378b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0187.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304875.wmf")) returned 0x20 [0187.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1db8 [0187.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c90 [0187.567] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc389c6ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0187.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309480.jpg")) returned 0x20 [0187.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e04 [0187.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0c [0187.568] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4685d7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0187.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309567.jpg")) returned 0x20 [0187.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e14 [0187.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e1c [0187.570] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38a28af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0187.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309585.jpg")) returned 0x20 [0187.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e24 [0187.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e2c [0187.573] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae46fafd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0187.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309598.jpg")) returned 0x20 [0187.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e34 [0187.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e24 [0189.050] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ab1a7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0189.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309664.jpg")) returned 0x20 [0189.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e14 [0189.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e04 [0189.051] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae47aad1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0189.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309705.jpg")) returned 0x20 [0189.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1db8 [0189.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c20 [0189.054] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae47f8b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0189.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309902.wmf")) returned 0x20 [0189.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc0 [0189.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2134 [0189.055] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38affe7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0189.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309904.wmf")) returned 0x20 [0189.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x213c [0189.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2144 [0189.056] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae485ad4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0189.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309920.wmf")) returned 0x20 [0189.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214c [0189.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2154 [0189.057] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38b74fe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0189.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313896.jpg")) returned 0x20 [0189.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21ac [0189.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21bc [0189.059] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae48d03d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0189.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313965.jpg")) returned 0x20 [0189.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21cc [0189.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21dc [0189.061] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38bea4f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0189.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313970.jpg")) returned 0x20 [0189.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21ec [0189.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21fc [0189.063] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4944dd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0189.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313974.jpg")) returned 0x20 [0189.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2208 [0189.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2218 [0189.064] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38c4be3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0189.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0314068.jpg")) returned 0x20 [0189.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2228 [0189.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2238 [0189.066] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38c860c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0189.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315580.jpg")) returned 0x20 [0189.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2058 [0189.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2250 [0189.067] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae49934e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0189.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315612.jpg")) returned 0x20 [0189.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2260 [0189.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2270 [0189.068] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ce7f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0189.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318448.wmf")) returned 0x20 [0189.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2280 [0189.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2078 [0189.069] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae49cd9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0189.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318804.wmf")) returned 0x20 [0189.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x229c [0189.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ac [0189.071] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38d361e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0189.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318810.wmf")) returned 0x20 [0189.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2414 [0189.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c4 [0189.073] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4a42c3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0189.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0321179.jpg")) returned 0x20 [0189.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22d4 [0189.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ec [0189.074] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38dab98, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0189.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324694.wmf")) returned 0x20 [0189.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22f4 [0189.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2300 [0189.076] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38df936, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0189.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324704.wmf")) returned 0x20 [0189.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2310 [0189.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2320 [0189.077] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38e477c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0189.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0189.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2330 [0189.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0189.078] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ea90e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0189.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0189.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x249c [0189.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x247c [0189.080] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38ef8cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0189.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341344.jpg")) returned 0x20 [0189.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x245c [0189.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0189.082] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4a9130, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0189.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341439.jpg")) returned 0x20 [0189.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x75c [0189.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2348 [0189.083] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4b060a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0189.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0189.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x75c [0189.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x245c [0189.983] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38f58f9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0189.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0189.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x249c [0189.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2330 [0189.984] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc38fa6fd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0189.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0189.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2310 [0189.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f4 [0189.986] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc390301a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0189.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0189.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22d4 [0189.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2414 [0189.988] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4b40a6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0189.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0189.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x229c [0189.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2280 [0189.990] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3907e2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0189.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0189.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2260 [0189.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2058 [0189.992] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc390df61, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0189.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0189.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2228 [0189.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21cc [0189.993] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4bb589, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0189.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0189.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21ac [0189.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214c [0189.995] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4c0461, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0189.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0189.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x213c [0189.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc0 [0189.997] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3912dcd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0189.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0189.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1db8 [0189.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e14 [0189.998] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4c65c0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0189.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341561.jpg")) returned 0x20 [0189.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e34 [0189.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2338 [0190.000] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3918f70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0190.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341634.jpg")) returned 0x20 [0190.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2358 [0190.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0190.002] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc391dd75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0190.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341636.jpg")) returned 0x20 [0190.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2424 [0190.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2434 [0190.004] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4cc91c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0190.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341645.jpg")) returned 0x20 [0190.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2404 [0190.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f0 [0190.005] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4d3c6a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0190.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341653.jpg")) returned 0x20 [0190.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23e0 [0190.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2048 [0190.008] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3923f04, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0190.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341654.jpg")) returned 0x20 [0190.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c4 [0190.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b4 [0190.009] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3928d86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0190.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341738.jpg")) returned 0x20 [0190.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23a4 [0190.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2394 [0190.011] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39315ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0190.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341742.jpg")) returned 0x20 [0190.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2384 [0190.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2374 [0190.014] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4d9e28, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0190.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382836.jpg")) returned 0x20 [0190.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e3c [0190.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e44 [0190.015] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc393b289, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0190.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382925.jpg")) returned 0x20 [0190.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4c [0190.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e54 [0190.017] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc394273e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0190.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382926.jpg")) returned 0x20 [0190.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e5c [0190.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e64 [0190.018] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc394c37a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0190.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382927.jpg")) returned 0x20 [0190.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e6c [0190.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0190.020] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39572f6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0190.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382930.jpg")) returned 0x20 [0190.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2208 [0190.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0191.110] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4e4dc5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0191.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382931.jpg")) returned 0x20 [0191.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2568 [0191.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x256c [0191.112] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4ed6d6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0191.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382938.jpg")) returned 0x20 [0191.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2570 [0191.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2574 [0191.115] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4f8686, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0191.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382939.jpg")) returned 0x20 [0191.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2578 [0191.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x257c [0191.119] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae4ffb87, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0191.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382942.jpg")) returned 0x20 [0191.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2580 [0191.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2584 [0191.121] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc395fbde, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0191.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382944.jpg")) returned 0x20 [0191.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2588 [0191.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258c [0191.123] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae508456, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0191.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382947.jpg")) returned 0x20 [0191.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2590 [0191.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2594 [0191.125] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae51209b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0191.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382948.jpg")) returned 0x20 [0191.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2598 [0191.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x259c [0191.126] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae51d06e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0191.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382950.jpg")) returned 0x20 [0191.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25a0 [0191.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a4 [0191.134] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39670dc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0191.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382952.jpg")) returned 0x20 [0191.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25a8 [0191.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25ac [0191.136] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3970d26, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0191.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382954.jpg")) returned 0x20 [0191.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25b0 [0191.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b4 [0191.138] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae524636, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0191.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382955.jpg")) returned 0x20 [0191.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25b8 [0191.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25bc [0191.140] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae52e290, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0191.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382957.jpg")) returned 0x20 [0191.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c0 [0191.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c4 [0191.141] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc397a9ef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0191.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382958.jpg")) returned 0x20 [0191.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c8 [0191.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25cc [0191.144] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae537ebf, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0191.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382959.jpg")) returned 0x20 [0191.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25d0 [0191.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d4 [0191.146] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc398466d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0191.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382960.jpg")) returned 0x20 [0191.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25d0 [0191.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c8 [0191.590] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc398cedc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0191.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382961.jpg")) returned 0x20 [0191.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c0 [0191.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b8 [0191.592] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3996aeb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0191.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382962.jpg")) returned 0x20 [0191.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25b0 [0191.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a8 [0191.594] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae54070c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0191.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382963.jpg")) returned 0x20 [0191.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25a0 [0191.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2598 [0191.597] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae54b73f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0191.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382965.jpg")) returned 0x20 [0191.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2590 [0191.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2588 [0191.599] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39a070f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0191.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382966.jpg")) returned 0x20 [0191.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2580 [0191.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2578 [0191.602] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae553f5b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0191.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382967.jpg")) returned 0x20 [0191.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2570 [0191.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2568 [0191.603] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae55dbab, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0191.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382968.jpg")) returned 0x20 [0191.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2208 [0191.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0191.605] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae566494, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0191.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382969.jpg")) returned 0x20 [0191.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25f4 [0191.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f8 [0191.608] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39a91f3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0191.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382970.jpg")) returned 0x20 [0191.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25fc [0191.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2600 [0191.610] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae57019f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0191.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384862.jpg")) returned 0x20 [0191.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2604 [0191.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2608 [0191.611] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39b18b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0191.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384885.jpg")) returned 0x20 [0191.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260c [0191.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2610 [0191.613] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39c8d27, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0191.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384888.jpg")) returned 0x20 [0191.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2614 [0191.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2618 [0191.615] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aece400, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39dd825, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8aece400, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0191.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384895.jpg")) returned 0x20 [0191.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x261c [0191.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2620 [0191.618] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae578992, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0191.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0191.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2624 [0191.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2628 [0191.619] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae57eb1b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0191.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0191.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x262c [0191.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2630 [0191.621] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae584cae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0191.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0191.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25d0 [0191.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0191.670] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae589b25, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0191.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0191.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2634 [0191.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2638 [0191.672] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae58fc9a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0191.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0191.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x263c [0191.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2640 [0191.675] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae595e1c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0191.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386764.jpg")) returned 0x20 [0191.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2644 [0191.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2648 [0191.676] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39e395f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0191.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387337.jpg")) returned 0x20 [0191.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264c [0191.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2650 [0191.678] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39e87a5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0191.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387578.jpg")) returned 0x20 [0191.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2654 [0191.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2658 [0191.680] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae59bfa7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0191.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387591.jpg")) returned 0x20 [0191.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x265c [0191.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2660 [0191.683] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39f102d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0191.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387604.jpg")) returned 0x20 [0191.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2664 [0191.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2668 [0191.684] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc39fac60, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0191.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387882.jpg")) returned 0x20 [0191.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x266c [0191.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2670 [0191.687] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5a216a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0191.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387895.jpg")) returned 0x20 [0191.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2674 [0191.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2678 [0191.688] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5a6f41, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0191.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0390072.jpg")) returned 0x20 [0191.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x267c [0191.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2680 [0191.690] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5b1f15, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0191.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400001.png")) returned 0x20 [0191.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2684 [0191.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2688 [0191.692] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5bbdc2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0191.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400002.png")) returned 0x20 [0191.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268c [0191.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2690 [0191.695] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5c57bd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0191.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400003.png")) returned 0x20 [0191.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2694 [0191.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2698 [0191.698] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3a021a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0191.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400004.png")) returned 0x20 [0191.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x269c [0191.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a0 [0191.700] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5cccc5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x1f, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0191.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400005.png")) returned 0x20 [0191.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26a4 [0191.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a8 [0191.701] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xae5d2ea0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x1f, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0191.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0191.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26ac [0191.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b0 [0191.703] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc3a13315, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0191.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0192.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26ac [0192.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a4 [0192.765] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb16de9b7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0192.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf")) returned 0x20 [0192.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x269c [0192.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2694 [0192.767] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb16e383f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0192.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf")) returned 0x20 [0192.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268c [0192.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2684 [0192.770] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb16e9993, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0192.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf")) returned 0x20 [0192.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x267c [0192.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2674 [0192.771] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb52aa0eb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0192.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0192.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x266c [0192.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2664 [0192.774] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92bc247, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0192.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00042_.wmf")) returned 0x20 [0192.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x265c [0192.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2654 [0192.776] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb52f82f7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0192.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00057_.wmf")) returned 0x20 [0192.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264c [0192.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2644 [0192.778] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92c0fec, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0192.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00058_.wmf")) returned 0x20 [0192.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x263c [0192.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2634 [0192.780] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb52fbd6d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0192.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00068_.wmf")) returned 0x20 [0192.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25d0 [0192.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x262c [0192.781] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5304622, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0192.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00238_.wmf")) returned 0x20 [0192.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2624 [0192.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x261c [0192.784] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92c5e2a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0192.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00330_.wmf")) returned 0x20 [0192.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2614 [0192.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260c [0192.785] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb530944a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0192.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00388_.wmf")) returned 0x20 [0192.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2604 [0192.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25fc [0192.787] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92cac7f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0192.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00389_.wmf")) returned 0x20 [0192.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25f4 [0192.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2208 [0192.788] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92cfb2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0192.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00390_.wmf")) returned 0x20 [0192.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2570 [0192.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2580 [0192.791] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92d6fa4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0192.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00391_.wmf")) returned 0x20 [0192.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2590 [0192.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a0 [0192.792] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb530e30f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0192.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00394_.wmf")) returned 0x20 [0192.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25b0 [0192.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c0 [0192.794] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5313076, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0192.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00395_.wmf")) returned 0x20 [0192.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26b4 [0192.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b8 [0192.796] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb535bea8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0192.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00396_.wmf")) returned 0x20 [0192.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26bc [0192.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c0 [0192.798] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5362008, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0192.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00417_.wmf")) returned 0x20 [0192.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26c4 [0192.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c8 [0192.799] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53681ac, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0192.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00433_.wmf")) returned 0x20 [0193.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26ac [0193.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2564 [0193.010] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb536e3a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0193.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00438_.wmf")) returned 0x20 [0193.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2560 [0193.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x255c [0193.011] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53731e1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0193.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00452_.wmf")) returned 0x20 [0193.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2558 [0193.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2554 [0193.013] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92dbdbe, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0193.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00454_.wmf")) returned 0x20 [0193.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0193.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0193.014] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92e0bbd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0193.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00458_.wmf")) returned 0x20 [0193.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24cc [0193.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c8 [0193.016] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92e5994, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0193.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00462_.wmf")) returned 0x20 [0193.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c4 [0193.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c0 [0193.018] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5377fe9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0193.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00487_.wmf")) returned 0x20 [0193.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24bc [0193.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b8 [0193.019] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb537ce86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0193.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00494_.wmf")) returned 0x20 [0193.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24b4 [0193.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b0 [0193.021] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5382f9b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0193.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00512_.wmf")) returned 0x20 [0193.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2018 [0193.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2008 [0193.022] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92ebb75, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0193.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00523_.wmf")) returned 0x20 [0193.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ffc [0193.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0193.024] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92f09d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0193.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00525_.wmf")) returned 0x20 [0193.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fec [0193.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f70 [0193.025] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5387dae, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0193.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00530_.wmf")) returned 0x20 [0193.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f14 [0193.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0193.027] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92f57e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0193.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00532_.wmf")) returned 0x20 [0193.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f24 [0193.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0193.028] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb538f2b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0193.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00538_.wmf")) returned 0x20 [0193.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0193.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2098 [0193.030] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc92fb9c6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0193.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00641_.wmf")) returned 0x20 [0193.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2174 [0193.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x217c [0193.032] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9300797, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0193.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00784_.wmf")) returned 0x20 [0193.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2184 [0193.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218c [0193.033] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5395471, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0193.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00798_.wmf")) returned 0x20 [0193.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2624 [0193.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x266c [0193.403] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc93055a9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0193.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00806_.wmf")) returned 0x20 [0193.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x265c [0193.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2614 [0193.405] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc930a3ed, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0193.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00807_.wmf")) returned 0x20 [0193.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2604 [0193.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b4 [0193.408] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc93105c2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0193.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00808_.wmf")) returned 0x20 [0193.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x267c [0193.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268c [0193.410] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb539a290, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0193.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00809_.wmf")) returned 0x20 [0193.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2194 [0193.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x219c [0193.411] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53a04b1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0193.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00810_.wmf")) returned 0x20 [0193.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1900 [0193.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0193.413] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc93153de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0193.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00932_.wmf")) returned 0x20 [0193.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18f0 [0193.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a4 [0193.414] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53a6615, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0193.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01064_.wmf")) returned 0x20 [0193.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18e8 [0193.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0193.416] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53b295d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0193.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01066_.wmf")) returned 0x20 [0193.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18d8 [0193.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0193.417] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53b77af, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0193.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01069_.wmf")) returned 0x20 [0193.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c8 [0193.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0193.419] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc931a1d4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0193.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01123_.wmf")) returned 0x20 [0193.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18b0 [0193.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0193.420] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53bb1b0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0193.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01126_.wmf")) returned 0x20 [0193.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18a8 [0193.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0193.421] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53bffa6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0193.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01130_.wmf")) returned 0x20 [0193.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1898 [0193.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca0 [0193.423] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53c75b4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0193.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01141_.wmf")) returned 0x20 [0193.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0193.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eec [0193.425] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc931f05a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0193.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01148_.wmf")) returned 0x20 [0193.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ee4 [0193.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc [0193.426] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a034fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0193.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01149_.wmf")) returned 0x20 [0193.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ed4 [0193.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ebc [0193.428] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53cc37a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0193.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01152_.wmf")) returned 0x20 [0193.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec4 [0193.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea4 [0193.430] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a034fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0193.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01154_.wmf")) returned 0x20 [0193.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ecc [0193.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eac [0193.431] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a034fa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0193.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01157_.wmf")) returned 0x20 [0193.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1eb4 [0193.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c [0193.433] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53d11dc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0193.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01158_.wmf")) returned 0x20 [0193.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e94 [0193.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e00 [0193.435] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0193.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01161_.wmf")) returned 0x20 [0193.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0193.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0193.436] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0193.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01164_.wmf")) returned 0x20 [0193.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2590 [0193.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2570 [0193.524] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0193.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01293_.wmf")) returned 0x20 [0193.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25f4 [0193.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264c [0193.525] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0193.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01354_.wmf")) returned 0x20 [0193.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25d0 [0193.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x263c [0193.527] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53d731a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0193.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01356_.wmf")) returned 0x20 [0193.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26cc [0193.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b0 [0193.528] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53dc184, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0193.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01357_.wmf")) returned 0x20 [0193.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26d0 [0193.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x269c [0193.530] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53e230b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0193.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01358_.wmf")) returned 0x20 [0193.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26bc [0193.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d4 [0193.531] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53e71d1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0193.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01361_.wmf")) returned 0x20 [0193.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26d8 [0193.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26dc [0193.534] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53f20da, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0193.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01368_.wmf")) returned 0x20 [0193.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26e0 [0193.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e4 [0193.535] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb53fbcf8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0193.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01421_.wmf")) returned 0x20 [0193.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26e8 [0193.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ec [0193.538] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0193.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01468_.wmf")) returned 0x20 [0193.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26f0 [0193.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f4 [0193.540] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5403280, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0193.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01470_.wmf")) returned 0x20 [0193.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26f8 [0193.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26fc [0193.541] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0193.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01472_.wmf")) returned 0x20 [0193.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2700 [0193.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2704 [0193.543] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0193.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01473_.wmf")) returned 0x20 [0193.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2708 [0193.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270c [0193.544] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb540806e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0193.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01474_.wmf")) returned 0x20 [0193.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2710 [0193.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2714 [0193.546] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb541a5a4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0193.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01627_.wmf")) returned 0x20 [0193.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2718 [0193.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x271c [0193.547] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5422ed0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0193.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01680_.wmf")) returned 0x20 [0193.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2720 [0193.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2724 [0193.549] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a297de, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0193.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01682_.wmf")) returned 0x20 [0193.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2728 [0193.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x272c [0193.551] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb542b6f0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0193.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01701_.wmf")) returned 0x20 [0193.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2730 [0193.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2734 [0193.552] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a4f9db, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0193.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01848_.wmf")) returned 0x20 [0193.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2738 [0193.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x273c [0193.553] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb54318a4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0193.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01849_.wmf")) returned 0x20 [0193.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2740 [0193.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2744 [0193.555] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb54379cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0193.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01852_.wmf")) returned 0x20 [0193.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2748 [0193.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274c [0193.556] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb543db2c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0193.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01858_.wmf")) returned 0x20 [0193.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26c4 [0193.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2750 [0193.587] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a55e07, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0193.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01866_.wmf")) returned 0x20 [0193.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2754 [0193.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2758 [0193.591] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5443d5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0193.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02009_.wmf")) returned 0x20 [0193.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x275c [0193.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2760 [0193.593] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5448b82, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0193.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02041_.wmf")) returned 0x20 [0193.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2764 [0193.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2768 [0193.594] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a598e0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0193.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02066_.wmf")) returned 0x20 [0193.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x276c [0193.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2770 [0193.596] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5e5d1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0193.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02091_.wmf")) returned 0x20 [0193.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2774 [0193.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d11b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2778 [0193.597] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb544c5d3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0193.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02092_.wmf")) returned 0x20 [0193.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x277c [0193.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2780 [0193.599] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0193.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02093_.wmf")) returned 0x20 [0193.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2784 [0193.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2788 [0193.600] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0193.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02124_.wmf")) returned 0x20 [0193.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278c [0193.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2790 [0193.602] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0193.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02125_.wmf")) returned 0x20 [0193.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2794 [0193.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d12d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2798 [0193.604] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0193.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02126_.wmf")) returned 0x20 [0193.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x279c [0193.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a0 [0193.605] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0193.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02127_.wmf")) returned 0x20 [0193.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27a4 [0193.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a8 [0193.607] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb545893f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0193.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02262_.wmf")) returned 0x20 [0193.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27ac [0193.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b0 [0193.609] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0193.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02264_.wmf")) returned 0x20 [0193.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27b4 [0193.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d13f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b8 [0193.611] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0193.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02356_.wmf")) returned 0x20 [0193.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27bc [0193.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c0 [0193.613] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a5f96e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0193.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02361_.wmf")) returned 0x20 [0193.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27c4 [0193.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c8 [0193.614] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0193.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02368_.wmf")) returned 0x20 [0193.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27cc [0193.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d14d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d0 [0193.616] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0193.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02371_.wmf")) returned 0x20 [0193.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27d4 [0193.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d8 [0193.618] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0193.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02373_.wmf")) returned 0x20 [0193.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27dc [0193.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e0 [0193.620] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb545d767, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0193.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02384_.wmf")) returned 0x20 [0193.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27e4 [0193.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e8 [0193.621] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0193.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02386_.wmf")) returned 0x20 [0193.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27ec [0193.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d15f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f0 [0193.623] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5462653, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0193.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02388_.wmf")) returned 0x20 [0193.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27f4 [0193.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f8 [0193.625] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0195.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02389_.wmf")) returned 0x20 [0195.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27f4 [0195.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ec [0195.734] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0195.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02390_.wmf")) returned 0x20 [0195.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27e4 [0195.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27dc [0195.737] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0195.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02398_.wmf")) returned 0x20 [0195.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27d4 [0195.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27cc [0195.740] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5467341, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0195.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02400_.wmf")) returned 0x20 [0195.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27c4 [0195.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27bc [0195.742] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9a86253, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0195.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02404_.wmf")) returned 0x20 [0195.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27b4 [0195.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ac [0195.745] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0195.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02405_.wmf")) returned 0x20 [0195.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27a4 [0195.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x279c [0195.747] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0195.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02407_.wmf")) returned 0x20 [0195.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2794 [0195.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278c [0195.750] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb546d530, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0195.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02413_.wmf")) returned 0x20 [0195.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2784 [0195.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x277c [0195.756] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0195.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02417_.wmf")) returned 0x20 [0195.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2774 [0195.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x276c [0195.758] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0195.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02423_.wmf")) returned 0x20 [0195.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2764 [0195.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x275c [0195.760] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb547238c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0195.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02424_.wmf")) returned 0x20 [0195.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2754 [0195.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c4 [0195.762] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5475e41, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0195.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02426_.wmf")) returned 0x20 [0195.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2748 [0195.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2740 [0195.764] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb547ac4a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0195.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02431_.wmf")) returned 0x20 [0195.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2738 [0195.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2730 [0195.765] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb548218d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0195.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02435_.wmf")) returned 0x20 [0196.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27f4 [0196.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2818 [0196.049] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0196.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02439_.wmf")) returned 0x20 [0196.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x281c [0196.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2820 [0196.051] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0196.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02441_.wmf")) returned 0x20 [0196.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2824 [0196.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2828 [0196.053] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5485c63, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0196.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02443_.wmf")) returned 0x20 [0196.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x282c [0196.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2830 [0196.055] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0196.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02444_.wmf")) returned 0x20 [0196.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2834 [0196.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2838 [0196.057] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb548a9fd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0196.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02446_.wmf")) returned 0x20 [0196.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x283c [0196.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2840 [0196.058] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9aac204, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0196.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02448_.wmf")) returned 0x20 [0196.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2844 [0196.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2848 [0196.060] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb548f880, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0196.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02450_.wmf")) returned 0x20 [0196.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284c [0196.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2850 [0196.061] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5494758, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0196.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02451_.wmf")) returned 0x20 [0196.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2854 [0196.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2858 [0196.064] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb5499451, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0196.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02453_.wmf")) returned 0x20 [0196.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x285c [0196.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2860 [0196.066] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9ad23d4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x1f, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0196.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0196.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2864 [0196.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2868 [0196.067] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xc9c139b8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0196.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0196.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x286c [0196.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2870 [0196.070] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb6cdb133, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0196.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0196.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2874 [0196.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2878 [0196.072] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0196.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0196.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x287c [0196.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2880 [0196.074] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5cce36, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0196.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0196.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2884 [0196.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2888 [0196.077] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5cce36, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0196.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0196.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288c [0196.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2890 [0196.079] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0196.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0196.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2894 [0196.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2898 [0196.080] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0196.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0196.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x289c [0196.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a0 [0196.082] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0196.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0196.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28a4 [0196.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a8 [0196.084] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb816a475, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0197.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0197.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28a4 [0197.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x289c [0197.106] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0197.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0197.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2894 [0197.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288c [0197.109] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0197.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0197.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2884 [0197.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x287c [0197.111] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0197.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0197.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2874 [0197.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x286c [0197.113] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8190569, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0197.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0197.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2864 [0197.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x285c [0197.114] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0197.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf")) returned 0x20 [0197.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2854 [0197.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284c [0197.116] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8279128, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0197.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf")) returned 0x20 [0197.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2844 [0197.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x283c [0197.118] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0197.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf")) returned 0x20 [0197.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2834 [0197.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x282c [0197.119] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82867f2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0197.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf")) returned 0x20 [0197.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2824 [0197.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x281c [0197.122] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0197.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf")) returned 0x20 [0197.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27f4 [0197.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x297c [0197.124] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0197.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf")) returned 0x20 [0197.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2980 [0197.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2984 [0197.126] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca5f3089, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0197.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf")) returned 0x20 [0197.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2988 [0197.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298c [0197.127] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb828dd25, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0197.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf")) returned 0x20 [0197.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2990 [0197.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2994 [0197.129] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8297964, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0197.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf")) returned 0x20 [0197.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2998 [0197.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x299c [0197.130] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0197.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf")) returned 0x20 [0197.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29a0 [0197.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29a4 [0197.132] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82a0252, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0197.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf")) returned 0x20 [0197.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29a8 [0197.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29ac [0197.133] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0197.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf")) returned 0x20 [0197.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29b0 [0197.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29b4 [0197.136] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0197.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf")) returned 0x20 [0197.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29b8 [0197.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29bc [0197.137] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82ab18c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0197.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf")) returned 0x20 [0197.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28a4 [0197.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c8 [0197.181] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82b6137, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0197.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf")) returned 0x20 [0197.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29cc [0197.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29d0 [0197.183] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82bd6a8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0197.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf")) returned 0x20 [0197.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29d4 [0197.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29d8 [0197.185] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0197.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf")) returned 0x20 [0197.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29dc [0197.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29e0 [0197.186] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0197.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf")) returned 0x20 [0197.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29e4 [0197.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29e8 [0197.188] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0197.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf")) returned 0x20 [0197.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29ec [0197.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29f0 [0197.190] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82c5f65, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0197.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf")) returned 0x20 [0197.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29f4 [0197.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29f8 [0197.192] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82d22ea, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0197.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf")) returned 0x20 [0197.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29fc [0197.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a00 [0197.195] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82dbeb7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0197.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf")) returned 0x20 [0197.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a04 [0197.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a08 [0197.196] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0197.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf")) returned 0x20 [0197.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0c [0197.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a10 [0197.198] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca619381, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0197.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf")) returned 0x20 [0197.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a14 [0197.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a18 [0197.200] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0197.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf")) returned 0x20 [0197.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a1c [0197.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a20 [0197.202] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82e5b2b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0197.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf")) returned 0x20 [0197.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a24 [0197.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a28 [0197.203] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82ed022, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0197.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf")) returned 0x20 [0197.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a2c [0197.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a30 [0197.205] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0197.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf")) returned 0x20 [0197.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a34 [0197.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a38 [0197.207] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0197.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf")) returned 0x20 [0197.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a3c [0197.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a40 [0197.210] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb82f6d23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0197.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf")) returned 0x20 [0197.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a44 [0197.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a48 [0197.212] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0197.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf")) returned 0x20 [0197.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2894 [0197.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4c [0197.242] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0197.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf")) returned 0x20 [0197.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a50 [0197.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a54 [0197.244] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8301bff, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0197.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf")) returned 0x20 [0197.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a58 [0197.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a5c [0197.246] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb830a508, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0197.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf")) returned 0x20 [0197.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a60 [0197.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a64 [0197.248] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0197.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf")) returned 0x20 [0197.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a68 [0197.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a6c [0197.251] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8312d74, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0197.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf")) returned 0x20 [0197.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a70 [0197.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a74 [0197.253] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb831ca62, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0197.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf")) returned 0x20 [0197.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a78 [0197.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a7c [0197.255] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0197.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf")) returned 0x20 [0197.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a80 [0197.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a84 [0197.257] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8326629, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0197.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf")) returned 0x20 [0197.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a88 [0197.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8c [0197.259] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb832eef1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0197.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf")) returned 0x20 [0197.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a90 [0197.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a94 [0197.261] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca63f639, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0197.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf")) returned 0x20 [0197.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a98 [0197.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a9c [0197.262] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8338b0b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0197.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf")) returned 0x20 [0197.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2aa0 [0197.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aa4 [0197.264] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca66993f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0197.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf")) returned 0x20 [0197.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2aa8 [0197.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aac [0197.266] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca670c70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0197.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf")) returned 0x20 [0197.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ab0 [0197.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ab4 [0197.268] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0197.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf")) returned 0x20 [0197.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ab8 [0197.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2abc [0197.270] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8344e56, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0197.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf")) returned 0x20 [0197.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac0 [0197.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac4 [0197.274] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb834eaf7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0197.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf")) returned 0x20 [0197.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac8 [0197.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2acc [0197.276] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0197.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf")) returned 0x20 [0197.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ad0 [0197.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad4 [0197.277] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83586ce, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0197.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf")) returned 0x20 [0197.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ad8 [0197.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2adc [0197.279] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0197.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf")) returned 0x20 [0197.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ae0 [0197.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae4 [0197.281] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8362317, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0197.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf")) returned 0x20 [0197.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ae8 [0197.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aec [0197.283] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0197.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf")) returned 0x20 [0197.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2884 [0197.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af0 [0197.318] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb836ab44, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0197.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf")) returned 0x20 [0197.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2af4 [0197.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af8 [0197.322] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb836e5ad, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0197.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf")) returned 0x20 [0197.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2afc [0197.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b00 [0197.324] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0197.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf")) returned 0x20 [0197.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b04 [0197.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b08 [0197.326] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8375ae8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0197.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf")) returned 0x20 [0197.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0c [0197.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b10 [0197.327] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb837a92b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0197.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf")) returned 0x20 [0197.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b14 [0197.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b18 [0197.331] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb837f79e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0197.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf")) returned 0x20 [0197.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b1c [0197.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b20 [0197.333] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0197.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf")) returned 0x20 [0197.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b24 [0197.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b28 [0197.335] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8384554, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0197.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf")) returned 0x20 [0197.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b2c [0197.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b30 [0197.337] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8389395, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0197.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf")) returned 0x20 [0197.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b34 [0197.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b38 [0197.339] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0197.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf")) returned 0x20 [0197.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b3c [0197.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d11b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b40 [0197.341] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb838e20b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0197.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf")) returned 0x20 [0197.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b44 [0197.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b48 [0197.343] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0197.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf")) returned 0x20 [0197.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4c [0197.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b50 [0197.346] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8394386, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0197.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf")) returned 0x20 [0197.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b54 [0197.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b58 [0197.349] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca675ae4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0197.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf")) returned 0x20 [0198.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a98 [0198.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d12d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a88 [0198.949] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0198.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf")) returned 0x20 [0198.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a80 [0198.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a78 [0198.950] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0198.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf")) returned 0x20 [0198.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a70 [0198.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a68 [0198.952] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83991ca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0198.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf")) returned 0x20 [0198.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a60 [0198.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a58 [0198.953] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0198.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf")) returned 0x20 [0198.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a50 [0198.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2894 [0198.955] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb839dfa1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0198.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf")) returned 0x20 [0198.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a44 [0198.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a3c [0198.957] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0198.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf")) returned 0x20 [0198.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a34 [0198.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a2c [0198.958] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83a1a4a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0198.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf")) returned 0x20 [0198.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a24 [0198.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a1c [0198.960] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83a8f9e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0198.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf")) returned 0x20 [0198.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a14 [0198.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0c [0198.963] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83addc2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0198.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf")) returned 0x20 [0198.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a04 [0198.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29fc [0198.965] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83b2c0e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0198.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf")) returned 0x20 [0198.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29f4 [0198.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29ec [0198.966] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83b665b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0198.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf")) returned 0x20 [0198.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29e4 [0198.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29dc [0198.968] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83bef2b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0198.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf")) returned 0x20 [0198.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29d4 [0198.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29cc [0198.970] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca69c007, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0198.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf")) returned 0x20 [0198.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28a4 [0198.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0198.971] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb83c3dd4, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0198.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf")) returned 0x20 [0198.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29b0 [0198.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29a8 [0198.973] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8503a61, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0198.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00601g.gif")) returned 0x20 [0198.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29a0 [0198.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2998 [0198.975] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7c5287, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0198.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp")) returned 0x20 [0198.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2990 [0198.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2988 [0198.977] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7ca077, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0198.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp")) returned 0x20 [0198.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2980 [0198.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f4 [0198.978] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7d290f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0198.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg")) returned 0x20 [0198.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2824 [0198.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2834 [0198.979] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7d9e50, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0198.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg")) returned 0x20 [0198.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2844 [0198.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2854 [0198.982] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7dec86, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0198.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg")) returned 0x20 [0198.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2864 [0198.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2874 [0198.983] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7e3ad0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0198.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg")) returned 0x20 [0198.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b5c [0198.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b60 [0198.985] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85088e3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0198.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp")) returned 0x20 [0198.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b64 [0198.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b68 [0198.986] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb850fdef, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0198.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp")) returned 0x20 [0198.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b6c [0198.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b70 [0198.988] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7e88b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0198.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg")) returned 0x20 [0198.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b74 [0198.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b78 [0198.989] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85162e6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0200.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp")) returned 0x20 [0200.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b74 [0200.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2990 [0200.317] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7eeae2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0200.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01255g.gif")) returned 0x20 [0200.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b5c [0200.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2844 [0200.320] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7f4c95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0200.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp")) returned 0x20 [0200.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2864 [0200.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2980 [0200.322] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb851d4ee, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0200.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp")) returned 0x20 [0200.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2824 [0200.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29b0 [0200.324] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7f9a68, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0200.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp")) returned 0x20 [0200.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29a0 [0200.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29d4 [0200.326] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca7ffbf0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0200.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp")) returned 0x20 [0200.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28a4 [0200.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29e4 [0200.327] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca805da3, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0200.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp")) returned 0x20 [0200.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29f4 [0200.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a04 [0200.330] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca80d2aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0200.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg")) returned 0x20 [0200.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a24 [0200.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a34 [0200.332] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca813472, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0200.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg")) returned 0x20 [0200.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x734 [0200.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a44 [0200.588] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca818293, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0200.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp")) returned 0x20 [0200.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a50 [0200.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a60 [0200.591] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca81f7cc, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0200.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp")) returned 0x20 [0200.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a70 [0200.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a80 [0200.603] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8523687, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0200.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg")) returned 0x20 [0200.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a98 [0200.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2978 [0200.606] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca825970, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0200.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp")) returned 0x20 [0200.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b6c [0200.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b64 [0200.614] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85284a5, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0200.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp")) returned 0x20 [0200.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2974 [0200.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2970 [0200.620] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb852f9c7, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0200.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg")) returned 0x20 [0200.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2814 [0200.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2810 [0200.622] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca82a788, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0200.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp")) returned 0x20 [0200.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280c [0200.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2808 [0200.623] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca830937, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0200.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp")) returned 0x20 [0200.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2804 [0200.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27fc [0200.625] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8538268, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0200.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp")) returned 0x20 [0200.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0200.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24cc [0200.626] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb853e502, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0200.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp")) returned 0x20 [0200.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c4 [0200.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2558 [0200.628] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8543257, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0200.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp")) returned 0x20 [0200.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2560 [0200.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ac [0200.629] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca837eb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0200.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp")) returned 0x20 [0200.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24bc [0200.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b4 [0200.631] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca83e02d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0200.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg")) returned 0x20 [0200.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2018 [0200.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ffc [0200.633] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8549589, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0200.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp")) returned 0x20 [0200.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fec [0200.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f14 [0200.634] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca844209, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0200.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp")) returned 0x20 [0200.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f24 [0200.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0200.635] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca848fb2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0200.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp")) returned 0x20 [0200.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2174 [0200.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2184 [0200.637] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb854f58b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0201.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp")) returned 0x20 [0201.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2174 [0201.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24 [0201.506] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca84f195, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0201.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg")) returned 0x20 [0201.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fec [0201.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2018 [0201.509] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85543b6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0201.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736g.gif")) returned 0x20 [0201.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24bc [0201.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2560 [0201.510] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb855b8e9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0201.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp")) returned 0x20 [0201.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c4 [0201.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0201.514] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca855334, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0201.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp")) returned 0x20 [0201.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2804 [0201.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280c [0201.515] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8562e11, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0201.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740g.gif")) returned 0x20 [0201.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2814 [0201.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2974 [0201.516] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca85a15d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0201.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp")) returned 0x20 [0201.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b6c [0201.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a98 [0201.518] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb856a351, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0201.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742g.gif")) returned 0x20 [0201.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a70 [0201.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a50 [0201.520] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85718aa, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0201.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp")) returned 0x20 [0201.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x734 [0201.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a24 [0201.521] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca86164f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0201.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02743g.gif")) returned 0x20 [0201.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29f4 [0201.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2824 [0201.522] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca868b97, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0201.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746g.gif")) returned 0x20 [0201.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b74 [0201.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a4 [0201.524] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca86d9e6, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0201.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp")) returned 0x20 [0201.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29a0 [0201.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2864 [0201.525] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8727c8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0201.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748g.gif")) returned 0x20 [0201.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b5c [0201.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a14 [0201.527] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8789a0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0201.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp")) returned 0x20 [0201.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2624 [0201.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x265c [0201.528] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca87eb56, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0201.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749g.gif")) returned 0x20 [0201.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2604 [0201.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x267c [0201.532] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca883945, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0201.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp")) returned 0x20 [0201.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2194 [0201.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0201.534] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8577a23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0201.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750g.gif")) returned 0x20 [0201.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18f0 [0201.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0201.536] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb857dc93, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0201.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp")) returned 0x20 [0201.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18d8 [0201.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0201.540] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca88ae5f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0201.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752g.gif")) returned 0x20 [0201.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18b0 [0201.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0201.542] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca88fc95, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0201.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp")) returned 0x20 [0201.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1898 [0201.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0201.544] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8588b9f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0201.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp")) returned 0x20 [0201.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2174 [0201.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0201.648] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8591427, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0201.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp")) returned 0x20 [0201.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ba4 [0201.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ba8 [0201.650] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb8598974, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0201.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp")) returned 0x20 [0201.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bac [0201.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bb0 [0201.652] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85a3938, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0201.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp")) returned 0x20 [0201.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bb4 [0201.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bb8 [0201.653] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85b1051, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0201.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp")) returned 0x20 [0201.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bbc [0201.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc0 [0201.656] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85b992b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0201.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp")) returned 0x20 [0201.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bc4 [0201.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc8 [0201.657] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8971f1, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0201.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0201.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bcc [0201.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bd0 [0201.659] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca89e75c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0201.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0201.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bd4 [0201.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bd8 [0201.661] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8a4909, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0201.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0201.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bdc [0201.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2be0 [0201.663] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8a974f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0201.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02845g.gif")) returned 0x20 [0201.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2be4 [0201.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2be8 [0201.664] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8b0c17, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0201.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg")) returned 0x20 [0201.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bec [0201.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bf0 [0201.667] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85c0dde, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0201.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp")) returned 0x20 [0201.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bf4 [0201.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bf8 [0201.668] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85c5c6f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0201.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp")) returned 0x20 [0201.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bfc [0201.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c04 [0201.670] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8b4712, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0201.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03014_.gif")) returned 0x20 [0201.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c08 [0201.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0c [0201.672] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85cbe2f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0201.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg")) returned 0x20 [0201.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c10 [0201.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c14 [0201.674] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8bbc1a, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0201.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg")) returned 0x20 [0201.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c18 [0201.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c1c [0201.676] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xca8c0a10, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0201.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg")) returned 0x20 [0201.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c20 [0201.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c24 [0201.678] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85d1fb8, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0201.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0201.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c28 [0201.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c2c [0201.679] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85d8128, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0201.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0201.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c30 [0201.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c34 [0201.681] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85dcf40, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0201.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0201.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c38 [0201.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c3c [0201.682] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb85e6b9c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0201.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0201.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c40 [0201.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c44 [0201.684] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb89de563, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0201.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrt.wmf")) returned 0x20 [0201.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c48 [0201.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4c [0201.685] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaa4605d, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0201.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf")) returned 0x20 [0201.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fec [0201.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c50 [0201.716] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaa4fc70, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0201.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\psretro.wmf")) returned 0x20 [0201.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c54 [0201.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c58 [0201.718] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb89f6beb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0201.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf")) returned 0x20 [0201.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c5c [0201.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c60 [0201.720] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaa586ca, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0201.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf")) returned 0x20 [0201.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c64 [0201.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c68 [0201.722] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb89fbad2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x1f, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0201.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pswavy.wmf")) returned 0x20 [0201.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c6c [0201.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c70 [0201.723] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaaf2228, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x1f, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0201.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\re00006_.wmf")) returned 0x20 [0201.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c74 [0201.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c78 [0201.726] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f3e00, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcaafe575, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8d4f3e00, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x1f, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0201.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\recycle.wmf")) returned 0x20 [0201.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c7c [0201.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c80 [0201.727] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcabb3002, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x1f, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0201.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0201.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c84 [0201.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c88 [0201.729] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb125928, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0201.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0201.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8c [0201.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c90 [0201.730] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb148f38, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0201.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0201.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c94 [0201.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c98 [0201.734] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb91d9e55, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0201.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0201.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c9c [0201.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca0 [0201.737] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb922cd1b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0201.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf")) returned 0x20 [0201.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ca4 [0201.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca8 [0201.738] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb212680, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0201.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf")) returned 0x20 [0201.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cac [0201.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cb0 [0201.740] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2173fb, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0201.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf")) returned 0x20 [0201.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cb4 [0201.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cb8 [0201.742] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9232e8e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0201.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf")) returned 0x20 [0201.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cbc [0201.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc0 [0201.743] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb21c369, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0201.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf")) returned 0x20 [0201.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc4 [0201.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc8 [0201.746] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb923691e, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0201.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf")) returned 0x20 [0201.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ccc [0201.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd0 [0201.747] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb221029, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0201.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf")) returned 0x20 [0201.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cd4 [0201.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd8 [0201.749] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb923cb35, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0201.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf")) returned 0x20 [0201.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cdc [0201.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ce0 [0201.750] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb225f7f, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0201.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf")) returned 0x20 [0201.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ce4 [0201.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ce8 [0201.752] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9241912, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0201.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf")) returned 0x20 [0201.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cec [0201.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cf0 [0201.753] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2299b9, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0201.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf")) returned 0x20 [0201.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cf4 [0201.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d1128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c6c [0203.368] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb230e23, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0203.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf")) returned 0x20 [0203.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c64 [0203.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c5c [0203.371] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb235da2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0203.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf")) returned 0x20 [0203.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c54 [0203.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fec [0203.373] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9246736, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0203.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf")) returned 0x20 [0203.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c48 [0203.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c40 [0203.376] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb928fb31, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0203.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00017_.wmf")) returned 0x20 [0203.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c38 [0203.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c30 [0203.379] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9294928, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0203.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00018_.wmf")) returned 0x20 [0203.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c20 [0203.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c18 [0203.381] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb266a15, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0203.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00152_.wmf")) returned 0x20 [0203.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c10 [0203.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c08 [0203.385] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb26b80c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0203.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00157_.wmf")) returned 0x20 [0203.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bfc [0203.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bf4 [0203.387] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb26f222, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0203.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00159_.wmf")) returned 0x20 [0203.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bec [0203.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2be4 [0203.389] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb9299756, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0203.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00166_.wmf")) returned 0x20 [0203.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bdc [0203.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bd4 [0203.391] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb929e55c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0203.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00168_.wmf")) returned 0x20 [0203.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bcc [0203.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc4 [0203.394] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb27677b, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0203.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00170_.wmf")) returned 0x20 [0203.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bbc [0203.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bb4 [0203.396] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb27b59c, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0203.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00177_.wmf")) returned 0x20 [0203.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bac [0203.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ba4 [0203.398] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92a4758, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0203.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00183_.wmf")) returned 0x20 [0203.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2174 [0203.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0203.401] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2803ec, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0203.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00190_.wmf")) returned 0x20 [0203.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dac [0203.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2db0 [0203.403] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xcb2865d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0203.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00191_.wmf")) returned 0x20 [0203.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2db4 [0203.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2db8 [0203.405] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92a9517, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0203.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00192_.wmf")) returned 0x20 [0203.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dbc [0203.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1337090, lpParameter=0x4d0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc0 [0203.407] FindNextFileW (in: hFindFile=0x767980, lpFindFileData=0xd5ea8c | out: lpFindFileData=0xd5ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1e1100, ftCreationTime.dwHighDateTime=0x1d0ca66, ftLastAccessTime.dwLowDateTime=0xb92ae3d2, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x8c1e1100, ftLastWriteTime.dwHighDateTime=0x1d0ca66, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x1f, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0203.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\so00194_.wmf")) Thread: id = 71 os_tid = 0x1164 [0121.225] VirtualAlloc (lpAddress=0x0, dwSize=0xffff, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0121.228] VirtualAlloc (lpAddress=0x0, dwSize=0xffff, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0121.248] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ReadMe.txt" (normalized: "\\\\192.168.0.1\\documents\\readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0126.692] CloseHandle (hObject=0xffffffff) returned 1 [0126.692] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.704] FindFirstFileW (in: lpFileName="\\\\192.168.0.1\\documents\\*" (normalized: "\\\\192.168.0.1\\documents\\*"), lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x6e3a54b5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x767d00 [0129.442] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa583c4d7, ftCreationTime.dwHighDateTime=0x1d828c6, ftLastAccessTime.dwLowDateTime=0x3b3e3839, ftLastAccessTime.dwHighDateTime=0x1d8a632, ftLastWriteTime.dwLowDateTime=0xa583c4d7, ftLastWriteTime.dwHighDateTime=0x1d828c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.442] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99fe5cc, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99fe5cc, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd900, dwReserved0=0x0, dwReserved1=0x0, cFileName="4fcfIBg3Ryeoeu27DM.docx", cAlternateFileName="")) returned 1 [0129.443] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx")) returned 0x80 [0129.443] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\4fcfIBg3Ryeoeu27DM.docx" (normalized: "\\\\192.168.0.1\\documents\\4fcfibg3ryeoeu27dm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.444] GetLastError () returned 0x5 [0129.444] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ad536c, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ad536c, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf197, dwReserved0=0x0, dwReserved1=0x0, cFileName="LgQIok5RNh.mp4", cAlternateFileName="")) returned 1 [0129.444] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4")) returned 0x80 [0129.445] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\LgQIok5RNh.mp4" (normalized: "\\\\192.168.0.1\\documents\\lgqiok5rnh.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.445] GetLastError () returned 0x5 [0129.445] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c177dd, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c177dd, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12cd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="lDq8f54d4hhCIri7rU.rtf", cAlternateFileName="")) returned 1 [0129.445] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf")) returned 0x80 [0129.446] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\lDq8f54d4hhCIri7rU.rtf" (normalized: "\\\\192.168.0.1\\documents\\ldq8f54d4hhciri7ru.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.446] GetLastError () returned 0x5 [0129.446] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bfa318, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bfa318, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15208, dwReserved0=0x0, dwReserved1=0x0, cFileName="gkNzsfx.odt", cAlternateFileName="")) returned 1 [0129.447] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt")) returned 0x80 [0129.447] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\gkNzsfx.odt" (normalized: "\\\\192.168.0.1\\documents\\gknzsfx.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.448] GetLastError () returned 0x5 [0129.448] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c96730, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c96730, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb863, dwReserved0=0x0, dwReserved1=0x0, cFileName="uX9C3BTlu7W5CJLwms.ppt", cAlternateFileName="")) returned 1 [0129.448] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt")) returned 0x80 [0129.448] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\uX9C3BTlu7W5CJLwms.ppt" (normalized: "\\\\192.168.0.1\\documents\\ux9c3btlu7w5cjlwms.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.449] GetLastError () returned 0x5 [0129.449] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x8f98a772, ftLastAccessTime.dwHighDateTime=0x1d8be28, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="vKgP03.mp3", cAlternateFileName="")) returned 1 [0129.449] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3")) returned 0x80 [0129.449] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\vKgP03.mp3" (normalized: "\\\\192.168.0.1\\documents\\vkgp03.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.450] GetLastError () returned 0x5 [0129.450] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ba24cb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x91336c8b, ftLastAccessTime.dwHighDateTime=0x1d8be28, ftLastWriteTime.dwLowDateTime=0xc9ba24cb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7jth.jpg", cAlternateFileName="")) returned 1 [0129.450] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg")) returned 0x80 [0129.450] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\a7jth.jpg" (normalized: "\\\\192.168.0.1\\documents\\a7jth.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.451] GetLastError () returned 0x5 [0129.451] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x158c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYMAYhHoRyK6PFynZFc.mkv", cAlternateFileName="")) returned 1 [0129.451] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv")) returned 0x80 [0129.451] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\zYMAYhHoRyK6PFynZFc.mkv" (normalized: "\\\\192.168.0.1\\documents\\zymayhhoryk6pfynzfc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.452] GetLastError () returned 0x5 [0129.452] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a87161, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a87161, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1546a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EGXGDc6zOuTQrpM.gif", cAlternateFileName="")) returned 1 [0129.452] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif")) returned 0x80 [0129.452] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EGXGDc6zOuTQrpM.gif" (normalized: "\\\\192.168.0.1\\documents\\egxgdc6zoutqrpm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.453] GetLastError () returned 0x5 [0129.453] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99ead49, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x96a26d28, ftLastAccessTime.dwHighDateTime=0x1d8be28, ftLastWriteTime.dwLowDateTime=0xc99ead49, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf284, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E6UGCq.doc", cAlternateFileName="")) returned 1 [0129.453] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc")) returned 0x80 [0129.453] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\2E6UGCq.doc" (normalized: "\\\\192.168.0.1\\documents\\2e6ugcq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.454] GetLastError () returned 0x5 [0129.454] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13179, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCFz76aqfOi4GGvs9d9.m4a", cAlternateFileName="")) returned 1 [0129.454] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a")) returned 0x80 [0129.455] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\nCFz76aqfOi4GGvs9d9.m4a" (normalized: "\\\\192.168.0.1\\documents\\ncfz76aqfoi4ggvs9d9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.462] GetLastError () returned 0x5 [0129.462] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x31dc813, ftLastAccessTime.dwHighDateTime=0x1d8be38, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5140, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9OE6MiLKOuTz5.avi", cAlternateFileName="")) returned 1 [0129.462] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi")) returned 0x80 [0129.462] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\C9OE6MiLKOuTz5.avi" (normalized: "\\\\192.168.0.1\\documents\\c9oe6milkoutz5.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.463] GetLastError () returned 0x5 [0129.463] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bc95d1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583477ef, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bc95d1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xaf7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="b13UpS9k3v.swf", cAlternateFileName="")) returned 1 [0129.464] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf")) returned 0x80 [0129.464] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\b13UpS9k3v.swf" (normalized: "\\\\192.168.0.1\\documents\\b13ups9k3v.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.464] GetLastError () returned 0x5 [0129.465] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9adefae, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9adefae, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x577b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM3Rngzs9r6yCyV.csv", cAlternateFileName="")) returned 1 [0129.465] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv")) returned 0x80 [0129.465] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\MM3Rngzs9r6yCyV.csv" (normalized: "\\\\192.168.0.1\\documents\\mm3rngzs9r6ycyv.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.466] GetLastError () returned 0x5 [0129.466] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15886, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcLK0zRep8.ots", cAlternateFileName="")) returned 1 [0129.466] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots")) returned 0x80 [0129.466] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\mcLK0zRep8.ots" (normalized: "\\\\192.168.0.1\\documents\\mclk0zrep8.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.466] GetLastError () returned 0x5 [0129.467] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c52165, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c52165, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xab34, dwReserved0=0x0, dwReserved1=0x0, cFileName="p7Ha2r1u6wluhJ.pptx", cAlternateFileName="")) returned 1 [0129.467] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx")) returned 0x80 [0129.467] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\p7Ha2r1u6wluhJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\p7ha2r1u6wluhj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.468] GetLastError () returned 0x5 [0129.468] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c03f5a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c03f5a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJonu6wFMMd.bmp", cAlternateFileName="")) returned 1 [0129.468] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp")) returned 0x80 [0129.468] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\iJonu6wFMMd.bmp" (normalized: "\\\\192.168.0.1\\documents\\ijonu6wfmmd.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.469] GetLastError () returned 0x5 [0129.469] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ad536c, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ad536c, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="KeH2iEJnN7k1r.odt", cAlternateFileName="")) returned 1 [0129.469] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt")) returned 0x80 [0129.469] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\KeH2iEJnN7k1r.odt" (normalized: "\\\\192.168.0.1\\documents\\keh2iejnn7k1r.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.470] GetLastError () returned 0x5 [0129.470] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a38f55, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a38f55, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x140ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="9lpH4LUvBOFfSshu6h.csv", cAlternateFileName="")) returned 1 [0129.470] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv")) returned 0x80 [0129.470] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\9lpH4LUvBOFfSshu6h.csv" (normalized: "\\\\192.168.0.1\\documents\\9lph4luvboffsshu6h.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.471] GetLastError () returned 0x5 [0129.471] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99f498b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99f498b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="2XXFjQNQ26X8Wc.swf", cAlternateFileName="")) returned 1 [0129.471] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf")) returned 0x80 [0129.472] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\2XXFjQNQ26X8Wc.swf" (normalized: "\\\\192.168.0.1\\documents\\2xxfjqnq26x8wc.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.472] GetLastError () returned 0x5 [0129.472] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9acb72b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9acb72b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLswtt0JPiPQkCC6R3Lm.m4a", cAlternateFileName="")) returned 1 [0129.473] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a")) returned 0x80 [0129.473] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\KLswtt0JPiPQkCC6R3Lm.m4a" (normalized: "\\\\192.168.0.1\\documents\\klswtt0jpipqkcc6r3lm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.474] GetLastError () returned 0x5 [0129.474] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bc95d1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bc95d1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9304, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVYQpQ1.mp4", cAlternateFileName="")) returned 1 [0129.474] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4")) returned 0x80 [0129.474] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\bVYQpQ1.mp4" (normalized: "\\\\192.168.0.1\\documents\\bvyqpq1.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.475] GetLastError () returned 0x5 [0129.475] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd722, dwReserved0=0x0, dwReserved1=0x0, cFileName="pQaKrG.pptx", cAlternateFileName="")) returned 1 [0129.475] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx")) returned 0x80 [0129.475] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\pQaKrG.pptx" (normalized: "\\\\192.168.0.1\\documents\\pqakrg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.479] GetLastError () returned 0x5 [0129.479] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf4a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AzVWpbVP.doc", cAlternateFileName="")) returned 1 [0129.480] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc")) returned 0x80 [0129.480] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\AzVWpbVP.doc" (normalized: "\\\\192.168.0.1\\documents\\azvwpbvp.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.481] GetLastError () returned 0x5 [0129.481] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a90da2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a90da2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmJj9nJ.pptx", cAlternateFileName="")) returned 1 [0129.481] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx")) returned 0x80 [0129.481] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EmJj9nJ.pptx" (normalized: "\\\\192.168.0.1\\documents\\emjj9nj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.482] GetLastError () returned 0x5 [0129.482] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bf06d7, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bf06d7, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xadfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUgAWuSkZ3EbpCZ5Rvs.gif", cAlternateFileName="")) returned 1 [0129.482] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif")) returned 0x80 [0129.482] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\fUgAWuSkZ3EbpCZ5Rvs.gif" (normalized: "\\\\192.168.0.1\\documents\\fugawuskz3ebpcz5rvs.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.483] GetLastError () returned 0x5 [0129.483] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9adefae, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9adefae, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MwAvirxPiQV.swf", cAlternateFileName="")) returned 1 [0129.484] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf")) returned 0x80 [0129.484] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\MwAvirxPiQV.swf" (normalized: "\\\\192.168.0.1\\documents\\mwavirxpiqv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.484] GetLastError () returned 0x5 [0129.485] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58445678, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1339b, dwReserved0=0x0, dwReserved1=0x0, cFileName="vfiyj.gif", cAlternateFileName="")) returned 1 [0129.485] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif")) returned 0x80 [0129.485] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\vfiyj.gif" (normalized: "\\\\192.168.0.1\\documents\\vfiyj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.486] GetLastError () returned 0x5 [0129.486] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b71784, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b71784, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1526f, dwReserved0=0x0, dwReserved1=0x0, cFileName="USKBVwnLaYIUmcn.mp4", cAlternateFileName="")) returned 1 [0129.486] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4")) returned 0x80 [0129.486] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\USKBVwnLaYIUmcn.mp4" (normalized: "\\\\192.168.0.1\\documents\\uskbvwnlayiumcn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.487] GetLastError () returned 0x5 [0129.487] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c7926b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c7926b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x86dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6JQB.pptx", cAlternateFileName="")) returned 1 [0129.487] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx")) returned 0x80 [0129.487] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\s6JQB.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6jqb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.488] GetLastError () returned 0x5 [0129.488] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9f6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl70jWmP2ggACy.png", cAlternateFileName="")) returned 1 [0129.488] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png")) returned 0x80 [0129.488] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\sl70jWmP2ggACy.png" (normalized: "\\\\192.168.0.1\\documents\\sl70jwmp2ggacy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.489] GetLastError () returned 0x5 [0129.489] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9adefae, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9adefae, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xab59, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBAT3tYNBcHdC.ppt", cAlternateFileName="")) returned 1 [0129.489] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt")) returned 0x80 [0129.489] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NBAT3tYNBcHdC.ppt" (normalized: "\\\\192.168.0.1\\documents\\nbat3tynbchdc.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.490] GetLastError () returned 0x5 [0129.490] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bd3212, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bd3212, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x690b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdHLWs2KE.docx", cAlternateFileName="")) returned 1 [0129.490] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx")) returned 0x80 [0129.490] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\cdHLWs2KE.docx" (normalized: "\\\\192.168.0.1\\documents\\cdhlws2ke.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.491] GetLastError () returned 0x5 [0129.491] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHCEF.gif", cAlternateFileName="")) returned 1 [0129.491] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif")) returned 0x80 [0129.491] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\SHCEF.gif" (normalized: "\\\\192.168.0.1\\documents\\shcef.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.492] GetLastError () returned 0x5 [0129.492] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b36dfb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b36dfb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xfcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6tWitG0.ppt", cAlternateFileName="")) returned 1 [0129.492] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt")) returned 0x80 [0129.492] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\P6tWitG0.ppt" (normalized: "\\\\192.168.0.1\\documents\\p6twitg0.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.493] GetLastError () returned 0x5 [0129.493] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ba24cb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583477ef, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ba24cb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZcPV3qk7PkeQOKKV.xls", cAlternateFileName="")) returned 1 [0129.493] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls")) returned 0x80 [0129.493] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ZcPV3qk7PkeQOKKV.xls" (normalized: "\\\\192.168.0.1\\documents\\zcpv3qk7pkeqokkv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.496] GetLastError () returned 0x5 [0129.496] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b85007, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b85007, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x134dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="X18sQ2pVfY.mp3", cAlternateFileName="")) returned 1 [0129.496] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3")) returned 0x80 [0129.496] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\X18sQ2pVfY.mp3" (normalized: "\\\\192.168.0.1\\documents\\x18sq2pvfy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.497] GetLastError () returned 0x5 [0129.497] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a87161, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a87161, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EOk7P095P.xls", cAlternateFileName="")) returned 1 [0129.497] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls")) returned 0x80 [0129.497] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EOk7P095P.xls" (normalized: "\\\\192.168.0.1\\documents\\eok7p095p.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.498] GetLastError () returned 0x5 [0129.498] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDK13uXlqscCs2sGFIQ.doc", cAlternateFileName="")) returned 1 [0129.498] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc")) returned 0x80 [0129.498] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\BDK13uXlqscCs2sGFIQ.doc" (normalized: "\\\\192.168.0.1\\documents\\bdk13uxlqsccs2sgfiq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.499] GetLastError () returned 0x5 [0129.499] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c52165, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c52165, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x14f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="ow3Vle4.swf", cAlternateFileName="")) returned 1 [0129.499] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf")) returned 0x80 [0129.500] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ow3Vle4.swf" (normalized: "\\\\192.168.0.1\\documents\\ow3vle4.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.500] GetLastError () returned 0x5 [0129.500] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9acb72b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9acb72b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11dda, dwReserved0=0x0, dwReserved1=0x0, cFileName="KLUwMaQCvDlNDoCoQ3.xls", cAlternateFileName="")) returned 1 [0129.500] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls")) returned 0x80 [0129.500] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\KLUwMaQCvDlNDoCoQ3.xls" (normalized: "\\\\192.168.0.1\\documents\\kluwmaqcvdlndocoq3.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.501] GetLastError () returned 0x5 [0129.501] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b40a3d, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b40a3d, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x16f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RBkxpRf3.m4a", cAlternateFileName="")) returned 1 [0129.501] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a")) returned 0x80 [0129.501] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\RBkxpRf3.m4a" (normalized: "\\\\192.168.0.1\\documents\\rbkxprf3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.502] GetLastError () returned 0x5 [0129.502] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9af2831, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9af2831, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCVoNePy.png", cAlternateFileName="")) returned 1 [0129.502] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png")) returned 0x80 [0129.503] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\OCVoNePy.png" (normalized: "\\\\192.168.0.1\\documents\\ocvonepy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.503] GetLastError () returned 0x5 [0129.503] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bdce54, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bdce54, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dPc6HLBDbx19XugtWM.jpg", cAlternateFileName="")) returned 1 [0129.503] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg")) returned 0x80 [0129.504] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\dPc6HLBDbx19XugtWM.jpg" (normalized: "\\\\192.168.0.1\\documents\\dpc6hlbdbx19xugtwm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.504] GetLastError () returned 0x5 [0129.504] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x16fbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywcd6Y1iM3n9j4GZ20Ya.png", cAlternateFileName="")) returned 1 [0129.505] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png")) returned 0x80 [0129.505] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ywcd6Y1iM3n9j4GZ20Ya.png" (normalized: "\\\\192.168.0.1\\documents\\ywcd6y1im3n9j4gz20ya.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.506] GetLastError () returned 0x5 [0129.506] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99f498b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99f498b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x873d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3QVfoNUquygvYJYnxL.m4a", cAlternateFileName="")) returned 1 [0129.506] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a")) returned 0x80 [0129.506] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\3QVfoNUquygvYJYnxL.m4a" (normalized: "\\\\192.168.0.1\\documents\\3qvfonuquygvyjynxl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.507] GetLastError () returned 0x5 [0129.507] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a42b96, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a42b96, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc601, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhsbCQy.csv", cAlternateFileName="")) returned 1 [0129.507] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv")) returned 0x80 [0129.508] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\AhsbCQy.csv" (normalized: "\\\\192.168.0.1\\documents\\ahsbcqy.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.509] GetLastError () returned 0x5 [0129.509] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b0fcf5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b0fcf5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x16e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OpdqDACZhn.ots", cAlternateFileName="")) returned 1 [0130.353] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots")) returned 0x80 [0131.244] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\OpdqDACZhn.ots" (normalized: "\\\\192.168.0.1\\documents\\opdqdaczhn.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.246] GetLastError () returned 0x5 [0131.246] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca9fb3, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca9fb3, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x16ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xxTfgN.jpg", cAlternateFileName="")) returned 1 [0131.246] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg")) returned 0x80 [0131.907] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\xxTfgN.jpg" (normalized: "\\\\192.168.0.1\\documents\\xxtfgn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.351] GetLastError () returned 0x5 [0132.352] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99e1108, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99e1108, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xaeb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1HtpGhRDb.ots", cAlternateFileName="")) returned 1 [0132.352] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots")) returned 0x80 [0132.662] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\1HtpGhRDb.ots" (normalized: "\\\\192.168.0.1\\documents\\1htpghrdb.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.691] GetLastError () returned 0x5 [0132.691] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tE4nVH8Z0MXjyxhaHaNx.pdf", cAlternateFileName="")) returned 1 [0132.691] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf")) returned 0x80 [0132.694] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\tE4nVH8Z0MXjyxhaHaNx.pdf" (normalized: "\\\\192.168.0.1\\documents\\te4nvh8z0mxjyxhahanx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.717] GetLastError () returned 0x5 [0132.717] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ac1ae9, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ac1ae9, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBowTJ.csv", cAlternateFileName="")) returned 1 [0132.718] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv")) returned 0x80 [0132.725] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\IBowTJ.csv" (normalized: "\\\\192.168.0.1\\documents\\ibowtj.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.731] GetLastError () returned 0x5 [0132.731] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a6005b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a6005b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9776, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAYEd2GbRKcU4.jpg", cAlternateFileName="")) returned 1 [0132.731] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg")) returned 0x80 [0132.735] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\CAYEd2GbRKcU4.jpg" (normalized: "\\\\192.168.0.1\\documents\\cayed2gbrkcu4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.980] GetLastError () returned 0x5 [0132.980] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPTqG3qP.ots", cAlternateFileName="")) returned 1 [0132.980] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots")) returned 0x80 [0133.099] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\FPTqG3qP.ots" (normalized: "\\\\192.168.0.1\\documents\\fptqg3qp.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.100] GetLastError () returned 0x5 [0133.101] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99f498b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99f498b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="2cHgIoncB.wav", cAlternateFileName="")) returned 1 [0133.101] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav")) returned 0x80 [0133.166] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\2cHgIoncB.wav" (normalized: "\\\\192.168.0.1\\documents\\2chgioncb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.191] GetLastError () returned 0x5 [0133.191] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrKxpbhKKRTpU.docx", cAlternateFileName="")) returned 1 [0133.192] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx")) returned 0x80 [0133.485] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\BrKxpbhKKRTpU.docx" (normalized: "\\\\192.168.0.1\\documents\\brkxpbhkkrtpu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.671] GetLastError () returned 0x5 [0133.671] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a256d2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a256d2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x14c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="8AEDnDa.avi", cAlternateFileName="")) returned 1 [0133.672] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi")) returned 0x80 [0133.726] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\8AEDnDa.avi" (normalized: "\\\\192.168.0.1\\documents\\8aednda.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.855] GetLastError () returned 0x5 [0133.855] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bf06d7, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bf06d7, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="fmkPuhgsIQDpQcV3y.ppt", cAlternateFileName="")) returned 1 [0133.855] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt")) returned 0x80 [0133.860] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\fmkPuhgsIQDpQcV3y.ppt" (normalized: "\\\\192.168.0.1\\documents\\fmkpuhgsiqdpqcv3y.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.870] GetLastError () returned 0x5 [0133.870] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b36dfb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b36dfb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17bcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oul9aMfiTm6Pt28KJ.xls", cAlternateFileName="")) returned 1 [0133.871] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls")) returned 0x80 [0133.875] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Oul9aMfiTm6Pt28KJ.xls" (normalized: "\\\\192.168.0.1\\documents\\oul9amfitm6pt28kj.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.876] GetLastError () returned 0x5 [0133.876] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bd3212, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bd3212, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x145e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdbHKY8ircatAsd.mp3", cAlternateFileName="")) returned 1 [0133.876] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3")) returned 0x80 [0133.879] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\cdbHKY8ircatAsd.mp3" (normalized: "\\\\192.168.0.1\\documents\\cdbhky8ircatasd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.882] GetLastError () returned 0x5 [0133.882] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a87161, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a87161, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="EInIzXIEURKe2P.odt", cAlternateFileName="")) returned 1 [0133.883] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt")) returned 0x80 [0133.888] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EInIzXIEURKe2P.odt" (normalized: "\\\\192.168.0.1\\documents\\einizxieurke2p.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.889] GetLastError () returned 0x5 [0133.889] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b85007, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b85007, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xfc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDBM7MBYaR.mp3", cAlternateFileName="")) returned 1 [0133.890] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3")) returned 0x80 [0133.895] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\WDBM7MBYaR.mp3" (normalized: "\\\\192.168.0.1\\documents\\wdbm7mbyar.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.897] GetLastError () returned 0x5 [0133.897] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c82ead, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c82ead, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x166d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6tY3yjB6Dh6qgWl.odp", cAlternateFileName="")) returned 1 [0133.897] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp")) returned 0x80 [0133.899] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\s6tY3yjB6Dh6qgWl.odp" (normalized: "\\\\192.168.0.1\\documents\\s6ty3yjb6dh6qgwl.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.903] GetLastError () returned 0x5 [0133.903] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b7b3c5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b7b3c5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrfjPtip.xlsx", cAlternateFileName="")) returned 1 [0133.903] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx")) returned 0x80 [0133.904] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\UrfjPtip.xlsx" (normalized: "\\\\192.168.0.1\\documents\\urfjptip.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.908] GetLastError () returned 0x5 [0133.908] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbcf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qllIIB4PUCq.m4a", cAlternateFileName="")) returned 1 [0133.909] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a")) returned 0x80 [0133.910] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\qllIIB4PUCq.m4a" (normalized: "\\\\192.168.0.1\\documents\\qlliib4pucq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.910] GetLastError () returned 0x5 [0133.910] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c7926b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c7926b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd729, dwReserved0=0x0, dwReserved1=0x0, cFileName="ry23qi7rroS58F.m4a", cAlternateFileName="")) returned 1 [0133.911] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a")) returned 0x80 [0133.915] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ry23qi7rroS58F.m4a" (normalized: "\\\\192.168.0.1\\documents\\ry23qi7rros58f.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.916] GetLastError () returned 0x5 [0133.916] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="zl76M0AJ2xe.ppt", cAlternateFileName="")) returned 1 [0133.917] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt")) returned 0x80 [0133.922] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\zl76M0AJ2xe.ppt" (normalized: "\\\\192.168.0.1\\documents\\zl76m0aj2xe.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.924] GetLastError () returned 0x5 [0133.924] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c177dd, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c177dd, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11bfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="kiZ0JG9WrlZl.ppt", cAlternateFileName="")) returned 1 [0133.925] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt")) returned 0x80 [0133.965] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\kiZ0JG9WrlZl.ppt" (normalized: "\\\\192.168.0.1\\documents\\kiz0jg9wrlzl.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.970] GetLastError () returned 0x5 [0133.970] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bd3212, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bd3212, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13240, dwReserved0=0x0, dwReserved1=0x0, cFileName="byUWhwwpU4G7YhqN.png", cAlternateFileName="")) returned 1 [0133.971] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png")) returned 0x80 [0133.975] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\byUWhwwpU4G7YhqN.png" (normalized: "\\\\192.168.0.1\\documents\\byuwhwwpu4g7yhqn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.976] GetLastError () returned 0x5 [0133.976] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99fe5cc, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99fe5cc, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13665, dwReserved0=0x0, dwReserved1=0x0, cFileName="3lJ1cmsj7wnHDKlL1.xls", cAlternateFileName="")) returned 1 [0133.977] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls")) returned 0x80 [0133.983] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\3lJ1cmsj7wnHDKlL1.xls" (normalized: "\\\\192.168.0.1\\documents\\3lj1cmsj7wnhdkll1.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.987] GetLastError () returned 0x5 [0133.987] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b67b42, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b67b42, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x7fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2BmDJ.odp", cAlternateFileName="")) returned 1 [0133.987] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp")) returned 0x80 [0134.007] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\U2BmDJ.odp" (normalized: "\\\\192.168.0.1\\documents\\u2bmdj.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.008] GetLastError () returned 0x5 [0134.009] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b36dfb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b36dfb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd501, dwReserved0=0x0, dwReserved1=0x0, cFileName="P3XntTjRFtRk.png", cAlternateFileName="")) returned 1 [0134.009] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png")) returned 0x80 [0134.015] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\P3XntTjRFtRk.png" (normalized: "\\\\192.168.0.1\\documents\\p3xnttjrftrk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.016] GetLastError () returned 0x5 [0134.016] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a6005b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a6005b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x58a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="D2y4L1elku1D.pps", cAlternateFileName="")) returned 1 [0134.017] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps")) returned 0x80 [0134.021] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\D2y4L1elku1D.pps" (normalized: "\\\\192.168.0.1\\documents\\d2y4l1elku1d.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.024] GetLastError () returned 0x5 [0134.024] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bc95d1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bc95d1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bbqSpo4X5l6kKSSGQegr.jpg", cAlternateFileName="")) returned 1 [0134.025] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg")) returned 0x80 [0134.027] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\bbqSpo4X5l6kKSSGQegr.jpg" (normalized: "\\\\192.168.0.1\\documents\\bbqspo4x5l6kkssgqegr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.028] GetLastError () returned 0x5 [0134.028] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b67b42, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b67b42, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13305, dwReserved0=0x0, dwReserved1=0x0, cFileName="TqvR2yMTxIsft9J01h3.m4a", cAlternateFileName="")) returned 1 [0134.029] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a")) returned 0x80 [0134.032] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\TqvR2yMTxIsft9J01h3.m4a" (normalized: "\\\\192.168.0.1\\documents\\tqvr2ymtxisft9j01h3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.033] GetLastError () returned 0x5 [0134.033] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9adefae, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9adefae, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17360, dwReserved0=0x0, dwReserved1=0x0, cFileName="LtLIcHIqo8.wav", cAlternateFileName="")) returned 1 [0134.033] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav")) returned 0x80 [0134.036] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\LtLIcHIqo8.wav" (normalized: "\\\\192.168.0.1\\documents\\ltlichiqo8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.039] GetLastError () returned 0x5 [0134.039] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9be6a95, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5835b070, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9be6a95, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xaee1, dwReserved0=0x0, dwReserved1=0x0, cFileName="eMZLYEuOXmzJe.avi", cAlternateFileName="")) returned 1 [0134.039] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi")) returned 0x80 [0134.042] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\eMZLYEuOXmzJe.avi" (normalized: "\\\\192.168.0.1\\documents\\emzlyeuoxmzje.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.045] GetLastError () returned 0x5 [0134.045] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c0db9b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c0db9b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12466, dwReserved0=0x0, dwReserved1=0x0, cFileName="iVoyxyaCL.doc", cAlternateFileName="")) returned 1 [0134.045] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc")) returned 0x80 [0134.048] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\iVoyxyaCL.doc" (normalized: "\\\\192.168.0.1\\documents\\ivoyxyacl.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.050] GetLastError () returned 0x5 [0134.050] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cb3bf4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cb3bf4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x798b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yPKKv7fQ4YK.mkv", cAlternateFileName="")) returned 1 [0134.051] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv")) returned 0x80 [0134.054] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\yPKKv7fQ4YK.mkv" (normalized: "\\\\192.168.0.1\\documents\\ypkkv7fq4yk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.055] GetLastError () returned 0x5 [0134.056] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b5df01, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b5df01, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xe461, dwReserved0=0x0, dwReserved1=0x0, cFileName="T3PGQZ2VabtjY5.mp4", cAlternateFileName="")) returned 1 [0134.056] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4")) returned 0x80 [0134.059] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\T3PGQZ2VabtjY5.mp4" (normalized: "\\\\192.168.0.1\\documents\\t3pgqz2vabtjy5.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.060] GetLastError () returned 0x5 [0134.060] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b8ec48, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b8ec48, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x7545, dwReserved0=0x0, dwReserved1=0x0, cFileName="YMZNKV4.mkv", cAlternateFileName="")) returned 1 [0134.060] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv")) returned 0x80 [0134.064] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\YMZNKV4.mkv" (normalized: "\\\\192.168.0.1\\documents\\ymznkv4.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.065] GetLastError () returned 0x5 [0134.065] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11664, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppEQNd41NzmPglbQ.ppt", cAlternateFileName="")) returned 1 [0134.065] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt")) returned 0x80 [0134.069] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ppEQNd41NzmPglbQ.ppt" (normalized: "\\\\192.168.0.1\\documents\\ppeqnd41nzmpglbq.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.071] GetLastError () returned 0x5 [0134.071] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99fe5cc, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99fe5cc, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x181da, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Qalr2j5fIEqdQ0.swf", cAlternateFileName="")) returned 1 [0134.071] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf")) returned 0x80 [0134.074] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\4Qalr2j5fIEqdQ0.swf" (normalized: "\\\\192.168.0.1\\documents\\4qalr2j5fieqdq0.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.076] GetLastError () returned 0x5 [0134.076] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ae8bef, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ae8bef, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17557, dwReserved0=0x0, dwReserved1=0x0, cFileName="NZjMmNKkZjRI.png", cAlternateFileName="")) returned 1 [0134.076] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png")) returned 0x80 [0134.080] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NZjMmNKkZjRI.png" (normalized: "\\\\192.168.0.1\\documents\\nzjmmnkkzjri.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.082] GetLastError () returned 0x5 [0134.082] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99f498b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99f498b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x120f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2f5wUY1aFYJTCEwR.odp", cAlternateFileName="")) returned 1 [0134.082] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp")) returned 0x80 [0134.085] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\2f5wUY1aFYJTCEwR.odp" (normalized: "\\\\192.168.0.1\\documents\\2f5wuy1afyjtcewr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.086] GetLastError () returned 0x5 [0134.086] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c96730, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c96730, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa155, dwReserved0=0x0, dwReserved1=0x0, cFileName="tdyTR6vSlTZHl.m4a", cAlternateFileName="")) returned 1 [0134.086] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a")) returned 0x80 [0134.087] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\tdyTR6vSlTZHl.m4a" (normalized: "\\\\192.168.0.1\\documents\\tdytr6vsltzhl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.090] GetLastError () returned 0x5 [0134.090] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x80b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GCXxiNbD.avi", cAlternateFileName="")) returned 1 [0134.090] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi")) returned 0x80 [0134.092] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\GCXxiNbD.avi" (normalized: "\\\\192.168.0.1\\documents\\gcxxinbd.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.095] GetLastError () returned 0x5 [0134.095] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ad536c, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ad536c, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="KwuGmh9JdfDxPED09.jpg", cAlternateFileName="")) returned 1 [0134.095] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg")) returned 0x80 [0134.097] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\KwuGmh9JdfDxPED09.jpg" (normalized: "\\\\192.168.0.1\\documents\\kwugmh9jdfdxped09.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.161] GetLastError () returned 0x5 [0134.161] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a1ba91, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a1ba91, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x88b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ZwyeX1xh.doc", cAlternateFileName="")) returned 1 [0134.161] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc")) returned 0x80 [0134.166] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\7ZwyeX1xh.doc" (normalized: "\\\\192.168.0.1\\documents\\7zwyex1xh.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.167] GetLastError () returned 0x5 [0134.168] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a90da2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a90da2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13e67, dwReserved0=0x0, dwReserved1=0x0, cFileName="EkCDp.xls", cAlternateFileName="")) returned 1 [0134.168] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls")) returned 0x80 [0134.173] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EkCDp.xls" (normalized: "\\\\192.168.0.1\\documents\\ekcdp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.175] GetLastError () returned 0x5 [0134.175] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c52165, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c52165, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2b1gzQI.xls", cAlternateFileName="")) returned 1 [0134.175] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls")) returned 0x80 [0134.180] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\p2b1gzQI.xls" (normalized: "\\\\192.168.0.1\\documents\\p2b1gzqi.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.181] GetLastError () returned 0x5 [0134.181] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b7b3c5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b7b3c5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa169, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF8E6ekoFe4DVWHEy.flv", cAlternateFileName="")) returned 1 [0134.182] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv")) returned 0x80 [0134.185] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\VF8E6ekoFe4DVWHEy.flv" (normalized: "\\\\192.168.0.1\\documents\\vf8e6ekofe4dvwhey.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.211] GetLastError () returned 0x5 [0134.211] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8136, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSKEoPSkeN.jpg", cAlternateFileName="")) returned 1 [0134.211] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg")) returned 0x80 [0134.213] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\SSKEoPSkeN.jpg" (normalized: "\\\\192.168.0.1\\documents\\sskeopsken.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.214] GetLastError () returned 0x5 [0134.214] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x10e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="qWCrNc.m4a", cAlternateFileName="")) returned 1 [0134.215] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a")) returned 0x80 [0134.220] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\qWCrNc.m4a" (normalized: "\\\\192.168.0.1\\documents\\qwcrnc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.222] GetLastError () returned 0x5 [0134.222] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bdce54, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bdce54, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc700, dwReserved0=0x0, dwReserved1=0x0, cFileName="cgtqEFU0PAhrauJ.ods", cAlternateFileName="")) returned 1 [0134.222] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods")) returned 0x80 [0134.276] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\cgtqEFU0PAhrauJ.ods" (normalized: "\\\\192.168.0.1\\documents\\cgtqefu0pahrauj.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.289] GetLastError () returned 0x5 [0134.289] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6539, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z1vXQLb4e3vCWmHziUz.mkv", cAlternateFileName="")) returned 1 [0134.289] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv")) returned 0x80 [0134.294] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Z1vXQLb4e3vCWmHziUz.mkv" (normalized: "\\\\192.168.0.1\\documents\\z1vxqlb4e3vcwmhziuz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.295] GetLastError () returned 0x5 [0134.295] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b67b42, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b67b42, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x80d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="U3BnARny7QLta.mp4", cAlternateFileName="")) returned 1 [0134.295] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4")) returned 0x80 [0134.338] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\U3BnARny7QLta.mp4" (normalized: "\\\\192.168.0.1\\documents\\u3bnarny7qlta.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.352] GetLastError () returned 0x5 [0134.352] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a256d2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a256d2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x16804, dwReserved0=0x0, dwReserved1=0x0, cFileName="7jSTZlo2FBO75BUO.wav", cAlternateFileName="")) returned 1 [0134.352] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav")) returned 0x80 [0134.389] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\7jSTZlo2FBO75BUO.wav" (normalized: "\\\\192.168.0.1\\documents\\7jstzlo2fbo75buo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.390] GetLastError () returned 0x5 [0134.390] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b36dfb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b36dfb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x176d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OxtG5eiXbm.xls", cAlternateFileName="")) returned 1 [0134.390] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls")) returned 0x80 [0134.421] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\OxtG5eiXbm.xls" (normalized: "\\\\192.168.0.1\\documents\\oxtg5eixbm.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.438] GetLastError () returned 0x5 [0134.438] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAXOlTuEN.odt", cAlternateFileName="")) returned 1 [0134.439] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt")) returned 0x80 [0134.481] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\sAXOlTuEN.odt" (normalized: "\\\\192.168.0.1\\documents\\saxoltuen.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.482] GetLastError () returned 0x5 [0134.482] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x185b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1VrbK55Uey.bmp", cAlternateFileName="")) returned 1 [0134.483] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp")) returned 0x80 [0134.541] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\S1VrbK55Uey.bmp" (normalized: "\\\\192.168.0.1\\documents\\s1vrbk55uey.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.542] GetLastError () returned 0x5 [0134.542] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a7d51f, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a7d51f, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8235, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWHuuMWix2.flv", cAlternateFileName="")) returned 1 [0134.543] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv")) returned 0x80 [0134.587] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\DWHuuMWix2.flv" (normalized: "\\\\192.168.0.1\\documents\\dwhuumwix2.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.588] GetLastError () returned 0x5 [0134.588] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bf06d7, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bf06d7, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12c0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUsEMWHFeMlUg8RpMG.ots", cAlternateFileName="")) returned 1 [0134.589] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots")) returned 0x80 [0134.647] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\fUsEMWHFeMlUg8RpMG.ots" (normalized: "\\\\192.168.0.1\\documents\\fusemwhfemlug8rpmg.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.651] GetLastError () returned 0x5 [0134.651] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x10386, dwReserved0=0x0, dwReserved1=0x0, cFileName="F4BCJQiL.ots", cAlternateFileName="")) returned 1 [0134.652] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots")) returned 0x80 [0134.686] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\F4BCJQiL.ots" (normalized: "\\\\192.168.0.1\\documents\\f4bcjqil.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.842] GetLastError () returned 0x5 [0134.842] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x796b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YizWtOq9sqniAiG.pptx", cAlternateFileName="")) returned 1 [0134.843] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx")) returned 0x80 [0134.883] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\YizWtOq9sqniAiG.pptx" (normalized: "\\\\192.168.0.1\\documents\\yizwtoq9sqniaig.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.907] GetLastError () returned 0x5 [0134.909] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xe324, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfTEIxbdxeH16.wav", cAlternateFileName="")) returned 1 [0134.919] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav")) returned 0x80 [0134.928] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\SfTEIxbdxeH16.wav" (normalized: "\\\\192.168.0.1\\documents\\sfteixbdxeh16.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.929] GetLastError () returned 0x5 [0134.929] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ac1ae9, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ac1ae9, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xee8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICn9FymqAtw6QQL.ppt", cAlternateFileName="")) returned 1 [0134.929] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt")) returned 0x80 [0134.932] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ICn9FymqAtw6QQL.ppt" (normalized: "\\\\192.168.0.1\\documents\\icn9fymqatw6qql.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.974] GetLastError () returned 0x5 [0134.974] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9be6a95, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58364cb0, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9be6a95, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x7c37, dwReserved0=0x0, dwReserved1=0x0, cFileName="ewbUbaNVSvHfRRfQfQLC.xls", cAlternateFileName="")) returned 1 [0134.974] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls")) returned 0x80 [0134.996] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ewbUbaNVSvHfRRfQfQLC.xls" (normalized: "\\\\192.168.0.1\\documents\\ewbubanvsvhfrrfqfqlc.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.003] GetLastError () returned 0x5 [0135.003] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="svuJsC.pdf", cAlternateFileName="")) returned 1 [0135.019] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf")) returned 0x80 [0135.029] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\svuJsC.pdf" (normalized: "\\\\192.168.0.1\\documents\\svujsc.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.030] GetLastError () returned 0x5 [0135.030] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bfa318, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bfa318, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x124eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gh4zJ.pps", cAlternateFileName="")) returned 1 [0135.030] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps")) returned 0x80 [0135.079] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\gh4zJ.pps" (normalized: "\\\\192.168.0.1\\documents\\gh4zj.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.080] GetLastError () returned 0x5 [0135.080] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c6f62a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c6f62a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa869, dwReserved0=0x0, dwReserved1=0x0, cFileName="qys9GnLkOeS.odt", cAlternateFileName="")) returned 1 [0135.080] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt")) returned 0x80 [0135.126] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\qys9GnLkOeS.odt" (normalized: "\\\\192.168.0.1\\documents\\qys9gnlkoes.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.128] GetLastError () returned 0x5 [0135.128] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58445678, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x592c, dwReserved0=0x0, dwReserved1=0x0, cFileName="v4eytQpoJk.swf", cAlternateFileName="")) returned 1 [0135.128] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf")) returned 0x80 [0135.177] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\v4eytQpoJk.swf" (normalized: "\\\\192.168.0.1\\documents\\v4eytqpojk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.179] GetLastError () returned 0x5 [0135.179] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9be6a95, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58364cb0, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9be6a95, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="evMqhpDEt7CXv.mp3", cAlternateFileName="")) returned 1 [0135.179] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3")) returned 0x80 [0135.211] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\evMqhpDEt7CXv.mp3" (normalized: "\\\\192.168.0.1\\documents\\evmqhpdet7cxv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.212] GetLastError () returned 0x5 [0135.213] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b40a3d, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b40a3d, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd194, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbnq0tEevfYiPYev3.flv", cAlternateFileName="")) returned 1 [0135.229] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv")) returned 0x80 [0135.242] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Pbnq0tEevfYiPYev3.flv" (normalized: "\\\\192.168.0.1\\documents\\pbnq0teevfyipyev3.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.302] GetLastError () returned 0x5 [0135.303] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c48524, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c48524, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13ae1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ofYpMQKf1RjCMx.wav", cAlternateFileName="")) returned 1 [0135.303] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav")) returned 0x80 [0135.356] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ofYpMQKf1RjCMx.wav" (normalized: "\\\\192.168.0.1\\documents\\ofypmqkf1rjcmx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.357] GetLastError () returned 0x5 [0135.357] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ad536c, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ad536c, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa9e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="L1fyabptENWoGXu.rtf", cAlternateFileName="")) returned 1 [0135.357] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf")) returned 0x80 [0135.444] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\L1fyabptENWoGXu.rtf" (normalized: "\\\\192.168.0.1\\documents\\l1fyabptenwogxu.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.445] GetLastError () returned 0x5 [0135.445] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c03f5a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c03f5a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12529, dwReserved0=0x0, dwReserved1=0x0, cFileName="hoPVmBvF77.odt", cAlternateFileName="")) returned 1 [0135.445] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt")) returned 0x80 [0135.631] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\hoPVmBvF77.odt" (normalized: "\\\\192.168.0.1\\documents\\hopvmbvf77.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.634] GetLastError () returned 0x5 [0135.634] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c96730, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c96730, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbc43, dwReserved0=0x0, dwReserved1=0x0, cFileName="umVoob.csv", cAlternateFileName="")) returned 1 [0135.634] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv")) returned 0x80 [0135.703] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\umVoob.csv" (normalized: "\\\\192.168.0.1\\documents\\umvoob.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.704] GetLastError () returned 0x5 [0135.704] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b4a67e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b4a67e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6596, dwReserved0=0x0, dwReserved1=0x0, cFileName="RyYcx2F2hgV.gif", cAlternateFileName="")) returned 1 [0135.705] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif")) returned 0x80 [0135.713] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\RyYcx2F2hgV.gif" (normalized: "\\\\192.168.0.1\\documents\\ryycx2f2hgv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.714] GetLastError () returned 0x5 [0135.714] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a42b96, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a42b96, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AhwQOJysH9.jpg", cAlternateFileName="")) returned 1 [0135.714] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg")) returned 0x80 [0135.717] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\AhwQOJysH9.jpg" (normalized: "\\\\192.168.0.1\\documents\\ahwqojysh9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.718] GetLastError () returned 0x5 [0135.718] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9be6a95, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5835b070, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9be6a95, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12975, dwReserved0=0x0, dwReserved1=0x0, cFileName="eQwKBctI5AfYjbVKmqeN.ods", cAlternateFileName="")) returned 1 [0135.718] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods")) returned 0x80 [0135.723] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\eQwKBctI5AfYjbVKmqeN.ods" (normalized: "\\\\192.168.0.1\\documents\\eqwkbcti5afyjbvkmqen.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.724] GetLastError () returned 0x5 [0135.724] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a1ba91, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a1ba91, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xfd50, dwReserved0=0x0, dwReserved1=0x0, cFileName="6R7qq9DkqNA3WVHMTs.doc", cAlternateFileName="")) returned 1 [0135.724] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc")) returned 0x80 [0135.730] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\6R7qq9DkqNA3WVHMTs.doc" (normalized: "\\\\192.168.0.1\\documents\\6r7qq9dkqna3wvhmts.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.731] GetLastError () returned 0x5 [0135.731] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9acb72b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9acb72b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="KAk0a7xY4jTir.m4a", cAlternateFileName="")) returned 1 [0135.731] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a")) returned 0x80 [0135.789] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\KAk0a7xY4jTir.m4a" (normalized: "\\\\192.168.0.1\\documents\\kak0a7xy4jtir.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.790] GetLastError () returned 0x5 [0135.790] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a11e4f, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a11e4f, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x92e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5n4Otxttbgfrkyd1Qv.mp3", cAlternateFileName="")) returned 1 [0135.791] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3")) returned 0x80 [0135.805] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\5n4Otxttbgfrkyd1Qv.mp3" (normalized: "\\\\192.168.0.1\\documents\\5n4otxttbgfrkyd1qv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.806] GetLastError () returned 0x5 [0135.806] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ba24cb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ba24cb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRruaCKjxo6i.ots", cAlternateFileName="")) returned 1 [0135.806] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots")) returned 0x80 [0135.813] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ZRruaCKjxo6i.ots" (normalized: "\\\\192.168.0.1\\documents\\zrruackjxo6i.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.814] GetLastError () returned 0x5 [0135.814] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c48524, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c48524, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x91ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="oNmnCAGLhaZCfP.bmp", cAlternateFileName="")) returned 1 [0135.814] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp")) returned 0x80 [0135.819] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\oNmnCAGLhaZCfP.bmp" (normalized: "\\\\192.168.0.1\\documents\\onmncaglhazcfp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.820] GetLastError () returned 0x5 [0135.820] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x155ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="B2EjwcG.xls", cAlternateFileName="")) returned 1 [0135.820] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls")) returned 0x80 [0135.827] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\B2EjwcG.xls" (normalized: "\\\\192.168.0.1\\documents\\b2ejwcg.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.832] GetLastError () returned 0x5 [0135.832] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcambCkECjq.ods", cAlternateFileName="")) returned 1 [0135.833] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods")) returned 0x80 [0135.838] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\tcambCkECjq.ods" (normalized: "\\\\192.168.0.1\\documents\\tcambckecjq.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.854] GetLastError () returned 0x5 [0135.854] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99e1108, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99e1108, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11a0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1WjGsbbxyz9w44lK.jpg", cAlternateFileName="")) returned 1 [0135.855] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg")) returned 0x80 [0135.856] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\1WjGsbbxyz9w44lK.jpg" (normalized: "\\\\192.168.0.1\\documents\\1wjgsbbxyz9w44lk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.860] GetLastError () returned 0x5 [0135.860] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a256d2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a256d2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xad00, dwReserved0=0x0, dwReserved1=0x0, cFileName="85sWKB.jpg", cAlternateFileName="")) returned 1 [0135.860] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg")) returned 0x80 [0135.863] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\85sWKB.jpg" (normalized: "\\\\192.168.0.1\\documents\\85swkb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.863] GetLastError () returned 0x5 [0135.864] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a9a9e4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a9a9e4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15a5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F01GLe.odt", cAlternateFileName="")) returned 1 [0135.864] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt")) returned 0x80 [0135.872] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\F01GLe.odt" (normalized: "\\\\192.168.0.1\\documents\\f01gle.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.873] GetLastError () returned 0x5 [0135.873] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a256d2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a256d2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x10636, dwReserved0=0x0, dwReserved1=0x0, cFileName="7wJ29fsIwS36l.ods", cAlternateFileName="")) returned 1 [0135.873] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods")) returned 0x80 [0135.876] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\7wJ29fsIwS36l.ods" (normalized: "\\\\192.168.0.1\\documents\\7wj29fsiws36l.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.877] GetLastError () returned 0x5 [0135.877] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bc95d1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bc95d1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x101cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bv3be5Un8YJj.avi", cAlternateFileName="")) returned 1 [0135.877] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi")) returned 0x80 [0135.882] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\bv3be5Un8YJj.avi" (normalized: "\\\\192.168.0.1\\documents\\bv3be5un8yjj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.883] GetLastError () returned 0x5 [0135.883] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ad536c, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ad536c, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="LLAm0.pps", cAlternateFileName="")) returned 1 [0135.883] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps")) returned 0x80 [0135.885] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\LLAm0.pps" (normalized: "\\\\192.168.0.1\\documents\\llam0.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.890] GetLastError () returned 0x5 [0135.890] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ae8bef, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ae8bef, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NnhUiKm1fKnUDbh8LQYp.mp4", cAlternateFileName="")) returned 1 [0135.890] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4")) returned 0x80 [0135.893] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NnhUiKm1fKnUDbh8LQYp.mp4" (normalized: "\\\\192.168.0.1\\documents\\nnhuikm1fknudbh8lqyp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.894] GetLastError () returned 0x5 [0135.894] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a9a9e4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a9a9e4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1769e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EqQ64IKq2Th.pptx", cAlternateFileName="")) returned 1 [0135.895] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx")) returned 0x80 [0135.899] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EqQ64IKq2Th.pptx" (normalized: "\\\\192.168.0.1\\documents\\eqq64ikq2th.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.900] GetLastError () returned 0x5 [0135.900] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b85007, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b85007, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVJ9AocI35l55mCp.jpg", cAlternateFileName="")) returned 1 [0135.901] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg")) returned 0x80 [0135.903] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\WVJ9AocI35l55mCp.jpg" (normalized: "\\\\192.168.0.1\\documents\\wvj9aoci35l55mcp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.904] GetLastError () returned 0x5 [0135.904] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c177dd, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c177dd, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf281, dwReserved0=0x0, dwReserved1=0x0, cFileName="kmB0a6WlogU.gif", cAlternateFileName="")) returned 1 [0135.904] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif")) returned 0x80 [0135.908] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\kmB0a6WlogU.gif" (normalized: "\\\\192.168.0.1\\documents\\kmb0a6wlogu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.909] GetLastError () returned 0x5 [0135.909] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="G7UtZQV2KEwEgGRw.csv", cAlternateFileName="")) returned 1 [0135.909] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv")) returned 0x80 [0135.912] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\G7UtZQV2KEwEgGRw.csv" (normalized: "\\\\192.168.0.1\\documents\\g7utzqv2keweggrw.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.912] GetLastError () returned 0x5 [0135.913] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c52165, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c52165, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x164b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="pLGCqUlBqdCyIjLjqV.doc", cAlternateFileName="")) returned 1 [0135.913] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc")) returned 0x80 [0135.918] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\pLGCqUlBqdCyIjLjqV.doc" (normalized: "\\\\192.168.0.1\\documents\\plgcqulbqdcyijljqv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.919] GetLastError () returned 0x5 [0135.919] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b0fcf5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b0fcf5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc484, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oq2biITomiSUVed.odt", cAlternateFileName="")) returned 1 [0135.919] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt")) returned 0x80 [0135.921] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Oq2biITomiSUVed.odt" (normalized: "\\\\192.168.0.1\\documents\\oq2biitomisuved.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.922] GetLastError () returned 0x5 [0135.922] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99b03c1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99b03c1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf183, dwReserved0=0x0, dwReserved1=0x0, cFileName="03oNIO07eJKfFtSq1le.pdf", cAlternateFileName="")) returned 1 [0135.923] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf")) returned 0x80 [0135.928] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\03oNIO07eJKfFtSq1le.pdf" (normalized: "\\\\192.168.0.1\\documents\\03onio07ejkfftsq1le.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.928] GetLastError () returned 0x5 [0135.929] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c82ead, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c82ead, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xfa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="s6dEvdGK0.pptx", cAlternateFileName="")) returned 1 [0135.929] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx")) returned 0x80 [0135.932] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\s6dEvdGK0.pptx" (normalized: "\\\\192.168.0.1\\documents\\s6devdgk0.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.933] GetLastError () returned 0x5 [0135.933] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x79d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqAk5x9DCd1vbqL.xls", cAlternateFileName="")) returned 1 [0135.933] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls")) returned 0x80 [0135.939] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\SqAk5x9DCd1vbqL.xls" (normalized: "\\\\192.168.0.1\\documents\\sqak5x9dcd1vbql.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.940] GetLastError () returned 0x5 [0135.940] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c177dd, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c177dd, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xff02, dwReserved0=0x0, dwReserved1=0x0, cFileName="les739ApbVb9h5NbQG.png", cAlternateFileName="")) returned 1 [0135.940] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png")) returned 0x80 [0135.942] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\les739ApbVb9h5NbQG.png" (normalized: "\\\\192.168.0.1\\documents\\les739apbvb9h5nbqg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.944] GetLastError () returned 0x5 [0135.944] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99d74c6, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99d74c6, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9180, dwReserved0=0x0, dwReserved1=0x0, cFileName="0c5f9ps.odt", cAlternateFileName="")) returned 1 [0135.944] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt")) returned 0x80 [0135.950] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\0c5f9ps.odt" (normalized: "\\\\192.168.0.1\\documents\\0c5f9ps.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.951] GetLastError () returned 0x5 [0135.951] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a6005b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a6005b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf510, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUAALsfvQ.odp", cAlternateFileName="")) returned 1 [0135.952] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp")) returned 0x80 [0135.953] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\CUAALsfvQ.odp" (normalized: "\\\\192.168.0.1\\documents\\cuaalsfvq.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.954] GetLastError () returned 0x5 [0135.954] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9acb72b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9acb72b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x107bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="IyGa2UNby.ots", cAlternateFileName="")) returned 1 [0135.955] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots")) returned 0x80 [0135.960] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\IyGa2UNby.ots" (normalized: "\\\\192.168.0.1\\documents\\iyga2unby.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.961] GetLastError () returned 0x5 [0135.961] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9af2831, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9af2831, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xce96, dwReserved0=0x0, dwReserved1=0x0, cFileName="NrdJUxDyhDG3y7Oab1mj.flv", cAlternateFileName="")) returned 1 [0135.962] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv")) returned 0x80 [0135.964] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NrdJUxDyhDG3y7Oab1mj.flv" (normalized: "\\\\192.168.0.1\\documents\\nrdjuxdyhdg3y7oab1mj.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.965] GetLastError () returned 0x5 [0135.965] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ac1ae9, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ac1ae9, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwIsy.png", cAlternateFileName="")) returned 1 [0135.965] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\HwIsy.png" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png")) returned 0x80 [0135.970] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\HwIsy.png" (normalized: "\\\\192.168.0.1\\documents\\hwisy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.971] GetLastError () returned 0x5 [0135.971] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ad536c, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ad536c, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x14b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYsglM.bmp", cAlternateFileName="")) returned 1 [0135.972] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\LYsglM.bmp" (normalized: "\\\\192.168.0.1\\documents\\lysglm.bmp")) returned 0x80 [0135.974] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\LYsglM.bmp" (normalized: "\\\\192.168.0.1\\documents\\lysglm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.975] GetLastError () returned 0x5 [0135.975] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9adefae, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9adefae, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbb11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mro5NomIUcrU.gif", cAlternateFileName="")) returned 1 [0135.975] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Mro5NomIUcrU.gif" (normalized: "\\\\192.168.0.1\\documents\\mro5nomiucru.gif")) returned 0x80 [0135.980] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Mro5NomIUcrU.gif" (normalized: "\\\\192.168.0.1\\documents\\mro5nomiucru.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.981] GetLastError () returned 0x5 [0135.981] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a1ba91, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a1ba91, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17ae3, dwReserved0=0x0, dwReserved1=0x0, cFileName="6IeyZTL6ti1EIr3r.csv", cAlternateFileName="")) returned 1 [0135.982] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\6IeyZTL6ti1EIr3r.csv" (normalized: "\\\\192.168.0.1\\documents\\6ieyztl6ti1eir3r.csv")) returned 0x80 [0135.983] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\6IeyZTL6ti1EIr3r.csv" (normalized: "\\\\192.168.0.1\\documents\\6ieyztl6ti1eir3r.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.984] GetLastError () returned 0x5 [0135.985] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b8ec48, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b8ec48, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xe624, dwReserved0=0x0, dwReserved1=0x0, cFileName="XP77ZtgAwnoAMmLb.odt", cAlternateFileName="")) returned 1 [0135.985] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt")) returned 0x80 [0135.993] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\XP77ZtgAwnoAMmLb.odt" (normalized: "\\\\192.168.0.1\\documents\\xp77ztgawnoammlb.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.994] GetLastError () returned 0x5 [0135.994] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z5eu5ng8aXBTiqaLM.odt", cAlternateFileName="")) returned 1 [0135.995] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt")) returned 0x80 [0136.008] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Z5eu5ng8aXBTiqaLM.odt" (normalized: "\\\\192.168.0.1\\documents\\z5eu5ng8axbtiqalm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.009] GetLastError () returned 0x5 [0136.010] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bd3212, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bd3212, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1463b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cYAzuw.flv", cAlternateFileName="")) returned 1 [0136.010] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\cYAzuw.flv" (normalized: "\\\\192.168.0.1\\documents\\cyazuw.flv")) returned 0x80 [0136.016] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\cYAzuw.flv" (normalized: "\\\\192.168.0.1\\documents\\cyazuw.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.017] GetLastError () returned 0x5 [0136.017] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c48524, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c48524, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17088, dwReserved0=0x0, dwReserved1=0x0, cFileName="ouLbzd5zuNL.xlsx", cAlternateFileName="")) returned 1 [0136.018] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ouLbzd5zuNL.xlsx" (normalized: "\\\\192.168.0.1\\documents\\oulbzd5zunl.xlsx")) returned 0x80 [0136.022] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ouLbzd5zuNL.xlsx" (normalized: "\\\\192.168.0.1\\documents\\oulbzd5zunl.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.023] GetLastError () returned 0x5 [0136.024] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x95ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ziRSYvhMQo.gif", cAlternateFileName="")) returned 1 [0136.024] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ziRSYvhMQo.gif" (normalized: "\\\\192.168.0.1\\documents\\zirsyvhmqo.gif")) returned 0x80 [0136.029] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ziRSYvhMQo.gif" (normalized: "\\\\192.168.0.1\\documents\\zirsyvhmqo.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.030] GetLastError () returned 0x5 [0136.030] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1287d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ziDfPcXQbWyMR.mkv", cAlternateFileName="")) returned 1 [0136.030] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ziDfPcXQbWyMR.mkv" (normalized: "\\\\192.168.0.1\\documents\\zidfpcxqbwymr.mkv")) returned 0x80 [0136.035] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ziDfPcXQbWyMR.mkv" (normalized: "\\\\192.168.0.1\\documents\\zidfpcxqbwymr.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.035] GetLastError () returned 0x5 [0136.036] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b8ec48, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b8ec48, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x16553, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsxuUpRBb.png", cAlternateFileName="")) returned 1 [0136.036] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\XsxuUpRBb.png" (normalized: "\\\\192.168.0.1\\documents\\xsxuuprbb.png")) returned 0x80 [0136.133] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\XsxuUpRBb.png" (normalized: "\\\\192.168.0.1\\documents\\xsxuuprbb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.160] GetLastError () returned 0x5 [0136.161] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ba24cb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583477ef, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ba24cb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11336, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZyT73XuoM.png", cAlternateFileName="")) returned 1 [0136.171] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ZyT73XuoM.png" (normalized: "\\\\192.168.0.1\\documents\\zyt73xuom.png")) returned 0x80 [0136.192] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ZyT73XuoM.png" (normalized: "\\\\192.168.0.1\\documents\\zyt73xuom.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.200] GetLastError () returned 0x5 [0136.200] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x118b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="F2MyXNYBvTRkVNI7iEZq.ods", cAlternateFileName="")) returned 1 [0136.201] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\F2MyXNYBvTRkVNI7iEZq.ods" (normalized: "\\\\192.168.0.1\\documents\\f2myxnybvtrkvni7iezq.ods")) returned 0x80 [0136.205] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\F2MyXNYBvTRkVNI7iEZq.ods" (normalized: "\\\\192.168.0.1\\documents\\f2myxnybvtrkvni7iezq.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.209] GetLastError () returned 0x5 [0136.209] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b8ec48, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b8ec48, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfJ9v2Plxllw22M.pps", cAlternateFileName="")) returned 1 [0136.209] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\YfJ9v2Plxllw22M.pps" (normalized: "\\\\192.168.0.1\\documents\\yfj9v2plxllw22m.pps")) returned 0x80 [0136.259] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\YfJ9v2Plxllw22M.pps" (normalized: "\\\\192.168.0.1\\documents\\yfj9v2plxllw22m.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.321] GetLastError () returned 0x5 [0136.321] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99e1108, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99e1108, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x4fa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="17V0s09qqy.m4a", cAlternateFileName="")) returned 1 [0136.322] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\17V0s09qqy.m4a" (normalized: "\\\\192.168.0.1\\documents\\17v0s09qqy.m4a")) returned 0x80 [0136.358] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\17V0s09qqy.m4a" (normalized: "\\\\192.168.0.1\\documents\\17v0s09qqy.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.367] GetLastError () returned 0x5 [0136.367] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc5f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="lhOcmpk4G7IYSvvb.gif", cAlternateFileName="")) returned 1 [0136.369] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\lhOcmpk4G7IYSvvb.gif" (normalized: "\\\\192.168.0.1\\documents\\lhocmpk4g7iysvvb.gif")) returned 0x80 [0136.376] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\lhOcmpk4G7IYSvvb.gif" (normalized: "\\\\192.168.0.1\\documents\\lhocmpk4g7iysvvb.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.377] GetLastError () returned 0x5 [0136.377] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b8ec48, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b8ec48, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x546b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XAdhL2WimPIvd1az2SF4.avi", cAlternateFileName="")) returned 1 [0136.377] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\XAdhL2WimPIvd1az2SF4.avi" (normalized: "\\\\192.168.0.1\\documents\\xadhl2wimpivd1az2sf4.avi")) returned 0x80 [0136.384] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\XAdhL2WimPIvd1az2SF4.avi" (normalized: "\\\\192.168.0.1\\documents\\xadhl2wimpivd1az2sf4.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.385] GetLastError () returned 0x5 [0136.385] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bf06d7, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bf06d7, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13931, dwReserved0=0x0, dwReserved1=0x0, cFileName="f8MOguJ.mkv", cAlternateFileName="")) returned 1 [0136.385] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\f8MOguJ.mkv" (normalized: "\\\\192.168.0.1\\documents\\f8moguj.mkv")) returned 0x80 [0136.393] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\f8MOguJ.mkv" (normalized: "\\\\192.168.0.1\\documents\\f8moguj.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.394] GetLastError () returned 0x5 [0136.394] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9adefae, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9adefae, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11953, dwReserved0=0x0, dwReserved1=0x0, cFileName="MvTzQbxzFuteK4.avi", cAlternateFileName="")) returned 1 [0136.395] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\MvTzQbxzFuteK4.avi" (normalized: "\\\\192.168.0.1\\documents\\mvtzqbxzfutek4.avi")) returned 0x80 [0136.400] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\MvTzQbxzFuteK4.avi" (normalized: "\\\\192.168.0.1\\documents\\mvtzqbxzfutek4.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.406] GetLastError () returned 0x5 [0136.406] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca9fb3, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca9fb3, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="woWNv.ods", cAlternateFileName="")) returned 1 [0136.406] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\woWNv.ods" (normalized: "\\\\192.168.0.1\\documents\\wownv.ods")) returned 0x80 [0136.410] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\woWNv.ods" (normalized: "\\\\192.168.0.1\\documents\\wownv.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.411] GetLastError () returned 0x5 [0136.411] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99e1108, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99e1108, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17183, dwReserved0=0x0, dwReserved1=0x0, cFileName="0sa57fW.pptx", cAlternateFileName="")) returned 1 [0136.411] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\0sa57fW.pptx" (normalized: "\\\\192.168.0.1\\documents\\0sa57fw.pptx")) returned 0x80 [0136.415] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\0sa57fW.pptx" (normalized: "\\\\192.168.0.1\\documents\\0sa57fw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.416] GetLastError () returned 0x5 [0136.416] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9af2831, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9af2831, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11e19, dwReserved0=0x0, dwReserved1=0x0, cFileName="O2TDqFynLaMJwyS.avi", cAlternateFileName="")) returned 1 [0136.417] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\O2TDqFynLaMJwyS.avi" (normalized: "\\\\192.168.0.1\\documents\\o2tdqfynlamjwys.avi")) returned 0x80 [0136.420] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\O2TDqFynLaMJwyS.avi" (normalized: "\\\\192.168.0.1\\documents\\o2tdqfynlamjwys.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.424] GetLastError () returned 0x5 [0136.424] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x4f21, dwReserved0=0x0, dwReserved1=0x0, cFileName="m2U2YlUMt.gif", cAlternateFileName="")) returned 1 [0136.424] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\m2U2YlUMt.gif" (normalized: "\\\\192.168.0.1\\documents\\m2u2ylumt.gif")) returned 0x80 [0136.434] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\m2U2YlUMt.gif" (normalized: "\\\\192.168.0.1\\documents\\m2u2ylumt.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.436] GetLastError () returned 0x5 [0136.450] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bdce54, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5835b070, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bdce54, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x10ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8sPU7Zk.ots", cAlternateFileName="")) returned 1 [0136.450] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots")) returned 0x80 [0136.480] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\e8sPU7Zk.ots" (normalized: "\\\\192.168.0.1\\documents\\e8spu7zk.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.483] GetLastError () returned 0x5 [0136.483] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c03f5a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c03f5a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hRvB1xDrUsAHG.flv", cAlternateFileName="")) returned 1 [0136.484] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\hRvB1xDrUsAHG.flv" (normalized: "\\\\192.168.0.1\\documents\\hrvb1xdrusahg.flv")) returned 0x80 [0136.487] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\hRvB1xDrUsAHG.flv" (normalized: "\\\\192.168.0.1\\documents\\hrvb1xdrusahg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.495] GetLastError () returned 0x5 [0136.495] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58445678, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6047, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnG2KifH.xlsx", cAlternateFileName="")) returned 1 [0136.495] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\vnG2KifH.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vng2kifh.xlsx")) returned 0x80 [0136.498] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\vnG2KifH.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vng2kifh.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.499] GetLastError () returned 0x5 [0136.499] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bf06d7, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bf06d7, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xcc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="foUlybK2h.xlsx", cAlternateFileName="")) returned 1 [0136.499] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\foUlybK2h.xlsx" (normalized: "\\\\192.168.0.1\\documents\\foulybk2h.xlsx")) returned 0x80 [0136.503] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\foUlybK2h.xlsx" (normalized: "\\\\192.168.0.1\\documents\\foulybk2h.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.507] GetLastError () returned 0x5 [0136.507] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ac1ae9, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ac1ae9, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZnOWmy.gif", cAlternateFileName="")) returned 1 [0136.507] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\IZnOWmy.gif" (normalized: "\\\\192.168.0.1\\documents\\iznowmy.gif")) returned 0x80 [0136.510] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\IZnOWmy.gif" (normalized: "\\\\192.168.0.1\\documents\\iznowmy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.511] GetLastError () returned 0x5 [0136.511] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99e1108, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99e1108, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1FCq528Tci.avi", cAlternateFileName="")) returned 1 [0136.511] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\1FCq528Tci.avi" (normalized: "\\\\192.168.0.1\\documents\\1fcq528tci.avi")) returned 0x80 [0136.515] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\1FCq528Tci.avi" (normalized: "\\\\192.168.0.1\\documents\\1fcq528tci.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.518] GetLastError () returned 0x5 [0136.518] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a1ba91, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a1ba91, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xe48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6IOKuPykR.odp", cAlternateFileName="")) returned 1 [0136.518] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\6IOKuPykR.odp" (normalized: "\\\\192.168.0.1\\documents\\6iokupykr.odp")) returned 0x80 [0136.522] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\6IOKuPykR.odp" (normalized: "\\\\192.168.0.1\\documents\\6iokupykr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.525] GetLastError () returned 0x5 [0136.525] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x758d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GeC6sbZ4BP3n.rtf", cAlternateFileName="")) returned 1 [0136.525] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\GeC6sbZ4BP3n.rtf" (normalized: "\\\\192.168.0.1\\documents\\gec6sbz4bp3n.rtf")) returned 0x80 [0136.529] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\GeC6sbZ4BP3n.rtf" (normalized: "\\\\192.168.0.1\\documents\\gec6sbz4bp3n.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.531] GetLastError () returned 0x5 [0136.532] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ac1ae9, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ac1ae9, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x904d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICCtCDKhaB3ppqcf.pptx", cAlternateFileName="")) returned 1 [0136.532] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ICCtCDKhaB3ppqcf.pptx" (normalized: "\\\\192.168.0.1\\documents\\icctcdkhab3ppqcf.pptx")) returned 0x80 [0136.536] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ICCtCDKhaB3ppqcf.pptx" (normalized: "\\\\192.168.0.1\\documents\\icctcdkhab3ppqcf.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.541] GetLastError () returned 0x5 [0136.541] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a11e4f, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a11e4f, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6825, dwReserved0=0x0, dwReserved1=0x0, cFileName="5IlHsHHuj.flv", cAlternateFileName="")) returned 1 [0136.542] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\5IlHsHHuj.flv" (normalized: "\\\\192.168.0.1\\documents\\5ilhshhuj.flv")) returned 0x80 [0136.546] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\5IlHsHHuj.flv" (normalized: "\\\\192.168.0.1\\documents\\5ilhshhuj.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.547] GetLastError () returned 0x5 [0136.547] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x18042, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfrMVx7qN.pdf", cAlternateFileName="")) returned 1 [0136.548] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\YfrMVx7qN.pdf" (normalized: "\\\\192.168.0.1\\documents\\yfrmvx7qn.pdf")) returned 0x80 [0136.551] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\YfrMVx7qN.pdf" (normalized: "\\\\192.168.0.1\\documents\\yfrmvx7qn.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.552] GetLastError () returned 0x5 [0136.552] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b8ec48, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b8ec48, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17472, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9DJzkehG84l5iXYb.rtf", cAlternateFileName="")) returned 1 [0136.552] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\X9DJzkehG84l5iXYb.rtf" (normalized: "\\\\192.168.0.1\\documents\\x9djzkehg84l5ixyb.rtf")) returned 0x80 [0136.556] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\X9DJzkehG84l5iXYb.rtf" (normalized: "\\\\192.168.0.1\\documents\\x9djzkehg84l5ixyb.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.557] GetLastError () returned 0x5 [0136.557] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bc95d1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583477ef, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bc95d1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x113a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="arFxCRPaJOfVUXqGPh.pps", cAlternateFileName="")) returned 1 [0136.558] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\arFxCRPaJOfVUXqGPh.pps" (normalized: "\\\\192.168.0.1\\documents\\arfxcrpajofvuxqgph.pps")) returned 0x80 [0136.647] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\arFxCRPaJOfVUXqGPh.pps" (normalized: "\\\\192.168.0.1\\documents\\arfxcrpajofvuxqgph.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.652] GetLastError () returned 0x5 [0136.652] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c03f5a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c03f5a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb72e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hzFXuXTiFAk.mp4", cAlternateFileName="")) returned 1 [0136.652] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\hzFXuXTiFAk.mp4" (normalized: "\\\\192.168.0.1\\documents\\hzfxuxtifak.mp4")) returned 0x80 [0136.655] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\hzFXuXTiFAk.mp4" (normalized: "\\\\192.168.0.1\\documents\\hzfxuxtifak.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.661] GetLastError () returned 0x5 [0136.661] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aae267, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aae267, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x86a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HQARGMXmC2WYy.pdf", cAlternateFileName="")) returned 1 [0136.661] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\HQARGMXmC2WYy.pdf" (normalized: "\\\\192.168.0.1\\documents\\hqargmxmc2wyy.pdf")) returned 0x80 [0136.663] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\HQARGMXmC2WYy.pdf" (normalized: "\\\\192.168.0.1\\documents\\hqargmxmc2wyy.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.666] GetLastError () returned 0x5 [0136.666] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cb3bf4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cb3bf4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x167a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="yusqqOM7hYB90.xlsx", cAlternateFileName="")) returned 1 [0136.667] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\yusqqOM7hYB90.xlsx" (normalized: "\\\\192.168.0.1\\documents\\yusqqom7hyb90.xlsx")) returned 0x80 [0136.668] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\yusqqOM7hYB90.xlsx" (normalized: "\\\\192.168.0.1\\documents\\yusqqom7hyb90.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.672] GetLastError () returned 0x5 [0136.672] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ac1ae9, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ac1ae9, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x112b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="I5MGz.gif", cAlternateFileName="")) returned 1 [0136.672] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\I5MGz.gif" (normalized: "\\\\192.168.0.1\\documents\\i5mgz.gif")) returned 0x80 [0136.687] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\I5MGz.gif" (normalized: "\\\\192.168.0.1\\documents\\i5mgz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.691] GetLastError () returned 0x5 [0136.691] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c7926b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c7926b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa877, dwReserved0=0x0, dwReserved1=0x0, cFileName="rbURuD4ORn2Eem6rs.jpg", cAlternateFileName="")) returned 1 [0136.691] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\rbURuD4ORn2Eem6rs.jpg" (normalized: "\\\\192.168.0.1\\documents\\rburud4orn2eem6rs.jpg")) returned 0x80 [0136.693] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\rbURuD4ORn2Eem6rs.jpg" (normalized: "\\\\192.168.0.1\\documents\\rburud4orn2eem6rs.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.697] GetLastError () returned 0x5 [0136.697] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b7b3c5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b7b3c5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x7b24, dwReserved0=0x0, dwReserved1=0x0, cFileName="VTE95H0m59pDCT9UO1IX.docx", cAlternateFileName="")) returned 1 [0136.697] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\VTE95H0m59pDCT9UO1IX.docx" (normalized: "\\\\192.168.0.1\\documents\\vte95h0m59pdct9uo1ix.docx")) returned 0x80 [0136.698] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\VTE95H0m59pDCT9UO1IX.docx" (normalized: "\\\\192.168.0.1\\documents\\vte95h0m59pdct9uo1ix.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.699] GetLastError () returned 0x5 [0136.699] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aae267, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aae267, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x96af, dwReserved0=0x0, dwReserved1=0x0, cFileName="HYsyB74UdGWE4jIKpy9E.xlsx", cAlternateFileName="")) returned 1 [0136.699] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\HYsyB74UdGWE4jIKpy9E.xlsx" (normalized: "\\\\192.168.0.1\\documents\\hysyb74udgwe4jikpy9e.xlsx")) returned 0x80 [0136.702] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\HYsyB74UdGWE4jIKpy9E.xlsx" (normalized: "\\\\192.168.0.1\\documents\\hysyb74udgwe4jikpy9e.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.703] GetLastError () returned 0x5 [0136.703] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99fe5cc, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99fe5cc, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="455kYjCp7KIYqdl.gif", cAlternateFileName="")) returned 1 [0136.703] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\455kYjCp7KIYqdl.gif" (normalized: "\\\\192.168.0.1\\documents\\455kyjcp7kiyqdl.gif")) returned 0x80 [0136.711] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\455kYjCp7KIYqdl.gif" (normalized: "\\\\192.168.0.1\\documents\\455kyjcp7kiyqdl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.716] GetLastError () returned 0x5 [0136.716] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1p7Wn.swf", cAlternateFileName="")) returned 1 [0136.716] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\F1p7Wn.swf" (normalized: "\\\\192.168.0.1\\documents\\f1p7wn.swf")) returned 0x80 [0136.717] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\F1p7Wn.swf" (normalized: "\\\\192.168.0.1\\documents\\f1p7wn.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.720] GetLastError () returned 0x5 [0136.720] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9039, dwReserved0=0x0, dwReserved1=0x0, cFileName="SDdqr3L6NGsiR8gSS.png", cAlternateFileName="")) returned 1 [0136.721] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\SDdqr3L6NGsiR8gSS.png" (normalized: "\\\\192.168.0.1\\documents\\sddqr3l6ngsir8gss.png")) returned 0x80 [0136.722] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\SDdqr3L6NGsiR8gSS.png" (normalized: "\\\\192.168.0.1\\documents\\sddqr3l6ngsir8gss.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.730] GetLastError () returned 0x5 [0136.730] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9be6a95, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5835b070, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9be6a95, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13821, dwReserved0=0x0, dwReserved1=0x0, cFileName="eDeo4.wav", cAlternateFileName="")) returned 1 [0136.730] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\eDeo4.wav" (normalized: "\\\\192.168.0.1\\documents\\edeo4.wav")) returned 0x80 [0136.763] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\eDeo4.wav" (normalized: "\\\\192.168.0.1\\documents\\edeo4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.767] GetLastError () returned 0x5 [0136.767] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a87161, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a87161, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="EYzpuUkMw0nV.m4a", cAlternateFileName="")) returned 1 [0136.767] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EYzpuUkMw0nV.m4a" (normalized: "\\\\192.168.0.1\\documents\\eyzpuukmw0nv.m4a")) returned 0x80 [0136.769] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EYzpuUkMw0nV.m4a" (normalized: "\\\\192.168.0.1\\documents\\eyzpuukmw0nv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.772] GetLastError () returned 0x5 [0136.772] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a7d51f, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a7d51f, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x742f, dwReserved0=0x0, dwReserved1=0x0, cFileName="D91tIUAsFS.mkv", cAlternateFileName="")) returned 1 [0136.772] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\D91tIUAsFS.mkv" (normalized: "\\\\192.168.0.1\\documents\\d91tiuasfs.mkv")) returned 0x80 [0136.775] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\D91tIUAsFS.mkv" (normalized: "\\\\192.168.0.1\\documents\\d91tiuasfs.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.776] GetLastError () returned 0x5 [0136.776] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca9fb3, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca9fb3, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1586e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4KxErTVQYWoCrSXjxG.odt", cAlternateFileName="")) returned 1 [0136.777] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt")) returned 0x80 [0136.779] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\y4KxErTVQYWoCrSXjxG.odt" (normalized: "\\\\192.168.0.1\\documents\\y4kxertvqywocrsxjxg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.782] GetLastError () returned 0x5 [0136.782] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a7d51f, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a7d51f, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x138c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="D3bOsFLtbMJgWgQv8Xrs.m4a", cAlternateFileName="")) returned 1 [0136.783] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\D3bOsFLtbMJgWgQv8Xrs.m4a" (normalized: "\\\\192.168.0.1\\documents\\d3bosfltbmjgwgqv8xrs.m4a")) returned 0x80 [0136.792] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\D3bOsFLtbMJgWgQv8Xrs.m4a" (normalized: "\\\\192.168.0.1\\documents\\d3bosfltbmjgwgqv8xrs.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.792] GetLastError () returned 0x5 [0136.792] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b7b3c5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b7b3c5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc139, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBDptFA1xz7efpLkn.mp4", cAlternateFileName="")) returned 1 [0136.793] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\VBDptFA1xz7efpLkn.mp4" (normalized: "\\\\192.168.0.1\\documents\\vbdptfa1xz7efplkn.mp4")) returned 0x80 [0136.805] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\VBDptFA1xz7efpLkn.mp4" (normalized: "\\\\192.168.0.1\\documents\\vbdptfa1xz7efplkn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.806] GetLastError () returned 0x5 [0136.806] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9acb72b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9acb72b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xafe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="JmVSFmaxSYp.wav", cAlternateFileName="")) returned 1 [0136.806] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\JmVSFmaxSYp.wav" (normalized: "\\\\192.168.0.1\\documents\\jmvsfmaxsyp.wav")) returned 0x80 [0136.810] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\JmVSFmaxSYp.wav" (normalized: "\\\\192.168.0.1\\documents\\jmvsfmaxsyp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.811] GetLastError () returned 0x5 [0136.811] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b85007, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b85007, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15403, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwFhNksqnjKFSaL.doc", cAlternateFileName="")) returned 1 [0136.811] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\WwFhNksqnjKFSaL.doc" (normalized: "\\\\192.168.0.1\\documents\\wwfhnksqnjkfsal.doc")) returned 0x80 [0136.829] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\WwFhNksqnjKFSaL.doc" (normalized: "\\\\192.168.0.1\\documents\\wwfhnksqnjkfsal.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.830] GetLastError () returned 0x5 [0136.830] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bfa318, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bfa318, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x18342, dwReserved0=0x0, dwReserved1=0x0, cFileName="hMbpJsxUxLqdU43X.rtf", cAlternateFileName="")) returned 1 [0136.830] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\hMbpJsxUxLqdU43X.rtf" (normalized: "\\\\192.168.0.1\\documents\\hmbpjsxuxlqdu43x.rtf")) returned 0x80 [0136.834] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\hMbpJsxUxLqdU43X.rtf" (normalized: "\\\\192.168.0.1\\documents\\hmbpjsxuxlqdu43x.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.835] GetLastError () returned 0x5 [0136.835] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x7967, dwReserved0=0x0, dwReserved1=0x0, cFileName="mUs3U.jpg", cAlternateFileName="")) returned 1 [0136.835] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\mUs3U.jpg" (normalized: "\\\\192.168.0.1\\documents\\mus3u.jpg")) returned 0x80 [0136.840] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\mUs3U.jpg" (normalized: "\\\\192.168.0.1\\documents\\mus3u.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.847] GetLastError () returned 0x5 [0136.847] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c3e8e3, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c3e8e3, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1057a, dwReserved0=0x0, dwReserved1=0x0, cFileName="noIQIeDYAhP.m4a", cAlternateFileName="")) returned 1 [0136.847] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\noIQIeDYAhP.m4a" (normalized: "\\\\192.168.0.1\\documents\\noiqiedyahp.m4a")) returned 0x80 [0136.852] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\noIQIeDYAhP.m4a" (normalized: "\\\\192.168.0.1\\documents\\noiqiedyahp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.853] GetLastError () returned 0x5 [0136.853] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b7b3c5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b7b3c5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12170, dwReserved0=0x0, dwReserved1=0x0, cFileName="V7AkBxJ.rtf", cAlternateFileName="")) returned 1 [0136.853] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\V7AkBxJ.rtf" (normalized: "\\\\192.168.0.1\\documents\\v7akbxj.rtf")) returned 0x80 [0136.858] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\V7AkBxJ.rtf" (normalized: "\\\\192.168.0.1\\documents\\v7akbxj.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.861] GetLastError () returned 0x5 [0136.861] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2b060, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2b060, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12d65, dwReserved0=0x0, dwReserved1=0x0, cFileName="nXMaDbExzV3GNxn.rtf", cAlternateFileName="")) returned 1 [0136.862] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\nXMaDbExzV3GNxn.rtf" (normalized: "\\\\192.168.0.1\\documents\\nxmadbexzv3gnxn.rtf")) returned 0x80 [0136.870] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\nXMaDbExzV3GNxn.rtf" (normalized: "\\\\192.168.0.1\\documents\\nxmadbexzv3gnxn.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.873] GetLastError () returned 0x5 [0136.873] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99b03c1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99b03c1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="05sv4vlauTjO82QKoH.odp", cAlternateFileName="")) returned 1 [0136.873] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\05sv4vlauTjO82QKoH.odp" (normalized: "\\\\192.168.0.1\\documents\\05sv4vlautjo82qkoh.odp")) returned 0x80 [0136.876] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\05sv4vlauTjO82QKoH.odp" (normalized: "\\\\192.168.0.1\\documents\\05sv4vlautjo82qkoh.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.877] GetLastError () returned 0x5 [0136.877] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bdce54, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5835b070, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bdce54, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x178b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="e0Lune6IQDhr.swf", cAlternateFileName="")) returned 1 [0136.877] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\e0Lune6IQDhr.swf" (normalized: "\\\\192.168.0.1\\documents\\e0lune6iqdhr.swf")) returned 0x80 [0136.880] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\e0Lune6IQDhr.swf" (normalized: "\\\\192.168.0.1\\documents\\e0lune6iqdhr.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.882] GetLastError () returned 0x5 [0136.882] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b7b3c5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b7b3c5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xef2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UWPd5V722.jpg", cAlternateFileName="")) returned 1 [0136.882] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\UWPd5V722.jpg" (normalized: "\\\\192.168.0.1\\documents\\uwpd5v722.jpg")) returned 0x80 [0136.885] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\UWPd5V722.jpg" (normalized: "\\\\192.168.0.1\\documents\\uwpd5v722.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.892] GetLastError () returned 0x5 [0136.892] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99fe5cc, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99fe5cc, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x112a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="3vXkT9bZW2wQG2nOsz.flv", cAlternateFileName="")) returned 1 [0136.893] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\3vXkT9bZW2wQG2nOsz.flv" (normalized: "\\\\192.168.0.1\\documents\\3vxkt9bzw2wqg2nosz.flv")) returned 0x80 [0136.896] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\3vXkT9bZW2wQG2nOsz.flv" (normalized: "\\\\192.168.0.1\\documents\\3vxkt9bzw2wqg2nosz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.897] GetLastError () returned 0x5 [0136.898] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c7926b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c7926b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x173b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rSvaTPcyuRZ.avi", cAlternateFileName="")) returned 1 [0136.898] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\rSvaTPcyuRZ.avi" (normalized: "\\\\192.168.0.1\\documents\\rsvatpcyurz.avi")) returned 0x80 [0136.901] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\rSvaTPcyuRZ.avi" (normalized: "\\\\192.168.0.1\\documents\\rsvatpcyurz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.902] GetLastError () returned 0x5 [0136.902] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x52b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BEWCWMGvP7.odp", cAlternateFileName="")) returned 1 [0136.902] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\BEWCWMGvP7.odp" (normalized: "\\\\192.168.0.1\\documents\\bewcwmgvp7.odp")) returned 0x80 [0136.907] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\BEWCWMGvP7.odp" (normalized: "\\\\192.168.0.1\\documents\\bewcwmgvp7.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.907] GetLastError () returned 0x5 [0136.908] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a87161, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a87161, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERBbBrh6.mp3", cAlternateFileName="")) returned 1 [0136.908] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ERBbBrh6.mp3" (normalized: "\\\\192.168.0.1\\documents\\erbbbrh6.mp3")) returned 0x80 [0136.910] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ERBbBrh6.mp3" (normalized: "\\\\192.168.0.1\\documents\\erbbbrh6.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.912] GetLastError () returned 0x5 [0136.912] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bd3212, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bd3212, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x968a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cYeVSPPEdjtBCAgcD.m4a", cAlternateFileName="")) returned 1 [0136.912] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\cYeVSPPEdjtBCAgcD.m4a" (normalized: "\\\\192.168.0.1\\documents\\cyevsppedjtbcagcd.m4a")) returned 0x80 [0136.917] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\cYeVSPPEdjtBCAgcD.m4a" (normalized: "\\\\192.168.0.1\\documents\\cyevsppedjtbcagcd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.918] GetLastError () returned 0x5 [0136.918] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf715, dwReserved0=0x0, dwReserved1=0x0, cFileName="t0dVU7jjqdjfnF7OmqO.png", cAlternateFileName="")) returned 1 [0136.919] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\t0dVU7jjqdjfnF7OmqO.png" (normalized: "\\\\192.168.0.1\\documents\\t0dvu7jjqdjfnf7omqo.png")) returned 0x80 [0136.921] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\t0dVU7jjqdjfnF7OmqO.png" (normalized: "\\\\192.168.0.1\\documents\\t0dvu7jjqdjfnf7omqo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.925] GetLastError () returned 0x5 [0136.925] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc295, dwReserved0=0x0, dwReserved1=0x0, cFileName="wPgITKWMM0.rtf", cAlternateFileName="")) returned 1 [0136.926] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\wPgITKWMM0.rtf" (normalized: "\\\\192.168.0.1\\documents\\wpgitkwmm0.rtf")) returned 0x80 [0136.928] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\wPgITKWMM0.rtf" (normalized: "\\\\192.168.0.1\\documents\\wpgitkwmm0.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.984] GetLastError () returned 0x5 [0136.984] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99fe5cc, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99fe5cc, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DTakzSmlzvmIUv.mp3", cAlternateFileName="")) returned 1 [0136.984] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\4DTakzSmlzvmIUv.mp3" (normalized: "\\\\192.168.0.1\\documents\\4dtakzsmlzvmiuv.mp3")) returned 0x80 [0136.990] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\4DTakzSmlzvmIUv.mp3" (normalized: "\\\\192.168.0.1\\documents\\4dtakzsmlzvmiuv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.991] GetLastError () returned 0x5 [0136.991] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bbf990, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583477ef, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bbf990, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x99c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aYwQj9EW4jZuUePCOt1y.jpg", cAlternateFileName="")) returned 1 [0136.992] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\aYwQj9EW4jZuUePCOt1y.jpg" (normalized: "\\\\192.168.0.1\\documents\\aywqj9ew4jzuuepcot1y.jpg")) returned 0x80 [0137.014] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\aYwQj9EW4jZuUePCOt1y.jpg" (normalized: "\\\\192.168.0.1\\documents\\aywqj9ew4jzuuepcot1y.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.018] GetLastError () returned 0x5 [0137.018] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c03f5a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c03f5a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="hzhCnO8TQqI.avi", cAlternateFileName="")) returned 1 [0137.018] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\hzhCnO8TQqI.avi" (normalized: "\\\\192.168.0.1\\documents\\hzhcno8tqqi.avi")) returned 0x80 [0137.023] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\hzhCnO8TQqI.avi" (normalized: "\\\\192.168.0.1\\documents\\hzhcno8tqqi.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.032] GetLastError () returned 0x5 [0137.032] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99d74c6, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99d74c6, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="0fyyBWfRWm61u1MhJ.doc", cAlternateFileName="")) returned 1 [0137.032] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\0fyyBWfRWm61u1MhJ.doc" (normalized: "\\\\192.168.0.1\\documents\\0fyybwfrwm61u1mhj.doc")) returned 0x80 [0137.037] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\0fyyBWfRWm61u1MhJ.doc" (normalized: "\\\\192.168.0.1\\documents\\0fyybwfrwm61u1mhj.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.072] GetLastError () returned 0x5 [0137.072] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bfa318, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bfa318, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hExQispuuoymhG1i192v.ppt", cAlternateFileName="")) returned 1 [0137.072] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\hExQispuuoymhG1i192v.ppt" (normalized: "\\\\192.168.0.1\\documents\\hexqispuuoymhg1i192v.ppt")) returned 0x80 [0137.229] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\hExQispuuoymhG1i192v.ppt" (normalized: "\\\\192.168.0.1\\documents\\hexqispuuoymhg1i192v.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.232] GetLastError () returned 0x5 [0137.232] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b7b3c5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b7b3c5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x100ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="VQa7D2fVvyShxsM.xlsx", cAlternateFileName="")) returned 1 [0137.232] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\VQa7D2fVvyShxsM.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vqa7d2fvvyshxsm.xlsx")) returned 0x80 [0137.238] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\VQa7D2fVvyShxsM.xlsx" (normalized: "\\\\192.168.0.1\\documents\\vqa7d2fvvyshxsm.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.240] GetLastError () returned 0x5 [0137.240] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2b060, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2b060, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xcc9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nVlM8WgmSnZtiC.avi", cAlternateFileName="")) returned 1 [0137.240] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\nVlM8WgmSnZtiC.avi" (normalized: "\\\\192.168.0.1\\documents\\nvlm8wgmsnztic.avi")) returned 0x80 [0137.246] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\nVlM8WgmSnZtiC.avi" (normalized: "\\\\192.168.0.1\\documents\\nvlm8wgmsnztic.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.251] GetLastError () returned 0x5 [0137.251] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a1ba91, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a1ba91, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="6614ZQjKlVVwMsRoTm.pdf", cAlternateFileName="")) returned 1 [0137.251] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\6614ZQjKlVVwMsRoTm.pdf" (normalized: "\\\\192.168.0.1\\documents\\6614zqjklvvwmsrotm.pdf")) returned 0x80 [0137.255] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\6614ZQjKlVVwMsRoTm.pdf" (normalized: "\\\\192.168.0.1\\documents\\6614zqjklvvwmsrotm.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.257] GetLastError () returned 0x5 [0137.257] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bdce54, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bdce54, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf521, dwReserved0=0x0, dwReserved1=0x0, cFileName="d9y1S5e4eLHUosqR.png", cAlternateFileName="")) returned 1 [0137.258] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\d9y1S5e4eLHUosqR.png" (normalized: "\\\\192.168.0.1\\documents\\d9y1s5e4elhuosqr.png")) returned 0x80 [0137.264] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\d9y1S5e4eLHUosqR.png" (normalized: "\\\\192.168.0.1\\documents\\d9y1s5e4elhuosqr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.271] GetLastError () returned 0x5 [0137.271] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xee3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="sWz45.xls", cAlternateFileName="")) returned 1 [0137.272] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\sWz45.xls" (normalized: "\\\\192.168.0.1\\documents\\swz45.xls")) returned 0x80 [0137.316] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\sWz45.xls" (normalized: "\\\\192.168.0.1\\documents\\swz45.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.323] GetLastError () returned 0x5 [0137.323] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cb3bf4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cb3bf4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9841, dwReserved0=0x0, dwReserved1=0x0, cFileName="ydAClD.jpg", cAlternateFileName="")) returned 1 [0137.323] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ydAClD.jpg" (normalized: "\\\\192.168.0.1\\documents\\ydacld.jpg")) returned 0x80 [0137.325] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ydAClD.jpg" (normalized: "\\\\192.168.0.1\\documents\\ydacld.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.327] GetLastError () returned 0x5 [0137.327] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ae8bef, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ae8bef, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xbccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLSuxvhNNdJma1.ods", cAlternateFileName="")) returned 1 [0137.327] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NLSuxvhNNdJma1.ods" (normalized: "\\\\192.168.0.1\\documents\\nlsuxvhnndjma1.ods")) returned 0x80 [0137.331] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NLSuxvhNNdJma1.ods" (normalized: "\\\\192.168.0.1\\documents\\nlsuxvhnndjma1.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.333] GetLastError () returned 0x5 [0137.334] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x646c, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3wsaUYVG.ppt", cAlternateFileName="")) returned 1 [0137.334] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\z3wsaUYVG.ppt" (normalized: "\\\\192.168.0.1\\documents\\z3wsauyvg.ppt")) returned 0x80 [0137.337] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\z3wsaUYVG.ppt" (normalized: "\\\\192.168.0.1\\documents\\z3wsauyvg.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.339] GetLastError () returned 0x5 [0137.339] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="vwYDXw6oVEHN2plf7.xls", cAlternateFileName="")) returned 1 [0137.339] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\vwYDXw6oVEHN2plf7.xls" (normalized: "\\\\192.168.0.1\\documents\\vwydxw6ovehn2plf7.xls")) returned 0x80 [0137.343] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\vwYDXw6oVEHN2plf7.xls" (normalized: "\\\\192.168.0.1\\documents\\vwydxw6ovehn2plf7.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.345] GetLastError () returned 0x5 [0137.345] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a7d51f, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a7d51f, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12190, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5VR0w7cu20SVOPPmTeY.pdf", cAlternateFileName="")) returned 1 [0137.345] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\D5VR0w7cu20SVOPPmTeY.pdf" (normalized: "\\\\192.168.0.1\\documents\\d5vr0w7cu20svoppmtey.pdf")) returned 0x80 [0137.363] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\D5VR0w7cu20SVOPPmTeY.pdf" (normalized: "\\\\192.168.0.1\\documents\\d5vr0w7cu20svoppmtey.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.365] GetLastError () returned 0x5 [0137.365] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c52165, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c52165, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xcf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pEa7gL.ppt", cAlternateFileName="")) returned 1 [0137.365] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\pEa7gL.ppt" (normalized: "\\\\192.168.0.1\\documents\\pea7gl.ppt")) returned 0x80 [0137.373] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\pEa7gL.ppt" (normalized: "\\\\192.168.0.1\\documents\\pea7gl.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.375] GetLastError () returned 0x5 [0137.375] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5d64, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSGieDhFJl7c1ARWbn5.avi", cAlternateFileName="")) returned 1 [0137.375] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\SSGieDhFJl7c1ARWbn5.avi" (normalized: "\\\\192.168.0.1\\documents\\ssgiedhfjl7c1arwbn5.avi")) returned 0x80 [0137.380] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\SSGieDhFJl7c1ARWbn5.avi" (normalized: "\\\\192.168.0.1\\documents\\ssgiedhfjl7c1arwbn5.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.384] GetLastError () returned 0x5 [0137.384] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b40a3d, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b40a3d, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1851f, dwReserved0=0x0, dwReserved1=0x0, cFileName="R7Kb10e3K.ppt", cAlternateFileName="")) returned 1 [0137.385] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\R7Kb10e3K.ppt" (normalized: "\\\\192.168.0.1\\documents\\r7kb10e3k.ppt")) returned 0x80 [0137.389] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\R7Kb10e3K.ppt" (normalized: "\\\\192.168.0.1\\documents\\r7kb10e3k.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.399] GetLastError () returned 0x5 [0137.399] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6142, dwReserved0=0x0, dwReserved1=0x0, cFileName="wM2fuYVT5vb5rvE.avi", cAlternateFileName="")) returned 1 [0137.399] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\wM2fuYVT5vb5rvE.avi" (normalized: "\\\\192.168.0.1\\documents\\wm2fuyvt5vb5rve.avi")) returned 0x80 [0137.402] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\wM2fuYVT5vb5rvE.avi" (normalized: "\\\\192.168.0.1\\documents\\wm2fuyvt5vb5rve.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.405] GetLastError () returned 0x5 [0137.405] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99b03c1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99b03c1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x53dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0O40RGXx.ods", cAlternateFileName="")) returned 1 [0137.405] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\0O40RGXx.ods" (normalized: "\\\\192.168.0.1\\documents\\0o40rgxx.ods")) returned 0x80 [0137.410] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\0O40RGXx.ods" (normalized: "\\\\192.168.0.1\\documents\\0o40rgxx.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.411] GetLastError () returned 0x5 [0137.411] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b40a3d, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b40a3d, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xfcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="RKixholu7QWBM4vIh2Qr.ots", cAlternateFileName="")) returned 1 [0137.412] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots")) returned 0x80 [0137.420] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\RKixholu7QWBM4vIh2Qr.ots" (normalized: "\\\\192.168.0.1\\documents\\rkixholu7qwbm4vih2qr.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.424] GetLastError () returned 0x5 [0137.424] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1446d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z0KtpLCKl6lOwI.csv", cAlternateFileName="")) returned 1 [0137.425] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Z0KtpLCKl6lOwI.csv" (normalized: "\\\\192.168.0.1\\documents\\z0ktplckl6lowi.csv")) returned 0x80 [0137.426] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Z0KtpLCKl6lOwI.csv" (normalized: "\\\\192.168.0.1\\documents\\z0ktplckl6lowi.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.427] GetLastError () returned 0x5 [0137.427] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bc95d1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583477ef, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bc95d1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="b2RYQsRYMuiCI5kbmBC.avi", cAlternateFileName="")) returned 1 [0137.428] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\b2RYQsRYMuiCI5kbmBC.avi" (normalized: "\\\\192.168.0.1\\documents\\b2ryqsrymuici5kbmbc.avi")) returned 0x80 [0137.434] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\b2RYQsRYMuiCI5kbmBC.avi" (normalized: "\\\\192.168.0.1\\documents\\b2ryqsrymuici5kbmbc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.435] GetLastError () returned 0x5 [0137.435] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b0fcf5, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b0fcf5, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OU7w0ZlZCz.png", cAlternateFileName="")) returned 1 [0137.435] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\OU7w0ZlZCz.png" (normalized: "\\\\192.168.0.1\\documents\\ou7w0zlzcz.png")) returned 0x80 [0137.660] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\OU7w0ZlZCz.png" (normalized: "\\\\192.168.0.1\\documents\\ou7w0zlzcz.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.673] GetLastError () returned 0x5 [0137.673] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58445678, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1025d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vHFD0HXkcrOt.ppt", cAlternateFileName="")) returned 1 [0137.674] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\vHFD0HXkcrOt.ppt" (normalized: "\\\\192.168.0.1\\documents\\vhfd0hxkcrot.ppt")) returned 0x80 [0137.752] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\vHFD0HXkcrOt.ppt" (normalized: "\\\\192.168.0.1\\documents\\vhfd0hxkcrot.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.755] GetLastError () returned 0x5 [0137.755] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b67b42, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b67b42, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x14f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2QSFlSKH2V.jpg", cAlternateFileName="")) returned 1 [0137.756] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\U2QSFlSKH2V.jpg" (normalized: "\\\\192.168.0.1\\documents\\u2qsflskh2v.jpg")) returned 0x80 [0137.761] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\U2QSFlSKH2V.jpg" (normalized: "\\\\192.168.0.1\\documents\\u2qsflskh2v.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.762] GetLastError () returned 0x5 [0137.763] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ae8bef, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ae8bef, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x74a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NW3xaHb7.gif", cAlternateFileName="")) returned 1 [0137.763] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NW3xaHb7.gif" (normalized: "\\\\192.168.0.1\\documents\\nw3xahb7.gif")) returned 0x80 [0137.773] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NW3xaHb7.gif" (normalized: "\\\\192.168.0.1\\documents\\nw3xahb7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.774] GetLastError () returned 0x5 [0137.774] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cb3bf4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cb3bf4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x82b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ybbGvlCczfIkCAzvoOo.ods", cAlternateFileName="")) returned 1 [0137.775] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ybbGvlCczfIkCAzvoOo.ods" (normalized: "\\\\192.168.0.1\\documents\\ybbgvlcczfikcazvooo.ods")) returned 0x80 [0137.781] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ybbGvlCczfIkCAzvoOo.ods" (normalized: "\\\\192.168.0.1\\documents\\ybbgvlcczfikcazvooo.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.782] GetLastError () returned 0x5 [0137.782] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a38f55, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a38f55, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11145, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEuRQDrOl9iFUCUZ.gif", cAlternateFileName="")) returned 1 [0137.782] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\AEuRQDrOl9iFUCUZ.gif" (normalized: "\\\\192.168.0.1\\documents\\aeurqdrol9ifucuz.gif")) returned 0x80 [0137.787] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\AEuRQDrOl9iFUCUZ.gif" (normalized: "\\\\192.168.0.1\\documents\\aeurqdrol9ifucuz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.788] GetLastError () returned 0x5 [0137.788] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c48524, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c48524, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xebaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="oHbaMQLYen9icdKg.docx", cAlternateFileName="")) returned 1 [0137.788] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\oHbaMQLYen9icdKg.docx" (normalized: "\\\\192.168.0.1\\documents\\ohbamqlyen9icdkg.docx")) returned 0x80 [0137.821] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\oHbaMQLYen9icdKg.docx" (normalized: "\\\\192.168.0.1\\documents\\ohbamqlyen9icdkg.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.829] GetLastError () returned 0x5 [0137.829] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a2f314, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a2f314, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="8epnap.wav", cAlternateFileName="")) returned 1 [0137.829] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\8epnap.wav" (normalized: "\\\\192.168.0.1\\documents\\8epnap.wav")) returned 0x80 [0137.836] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\8epnap.wav" (normalized: "\\\\192.168.0.1\\documents\\8epnap.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.837] GetLastError () returned 0x5 [0137.837] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b8ec48, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b8ec48, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x67e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XhyKggx8pHn779f8mb.swf", cAlternateFileName="")) returned 1 [0137.837] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\XhyKggx8pHn779f8mb.swf" (normalized: "\\\\192.168.0.1\\documents\\xhykggx8phn779f8mb.swf")) returned 0x80 [0137.841] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\XhyKggx8pHn779f8mb.swf" (normalized: "\\\\192.168.0.1\\documents\\xhykggx8phn779f8mb.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.845] GetLastError () returned 0x5 [0137.845] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c177dd, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c177dd, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x82d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="l5waVaq5umcw.wav", cAlternateFileName="")) returned 1 [0137.845] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\l5waVaq5umcw.wav" (normalized: "\\\\192.168.0.1\\documents\\l5wavaq5umcw.wav")) returned 0x80 [0137.850] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\l5waVaq5umcw.wav" (normalized: "\\\\192.168.0.1\\documents\\l5wavaq5umcw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.853] GetLastError () returned 0x5 [0137.853] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bfa318, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bfa318, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa870, dwReserved0=0x0, dwReserved1=0x0, cFileName="gSQ2YGk9scQfUsGUcoij.wav", cAlternateFileName="")) returned 1 [0137.854] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\gSQ2YGk9scQfUsGUcoij.wav" (normalized: "\\\\192.168.0.1\\documents\\gsq2ygk9scqfusgucoij.wav")) returned 0x80 [0137.858] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\gSQ2YGk9scQfUsGUcoij.wav" (normalized: "\\\\192.168.0.1\\documents\\gsq2ygk9scqfusgucoij.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.859] GetLastError () returned 0x5 [0137.859] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aae267, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aae267, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd55d, dwReserved0=0x0, dwReserved1=0x0, cFileName="H4BFdNII7HeaE.swf", cAlternateFileName="")) returned 1 [0137.859] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\H4BFdNII7HeaE.swf" (normalized: "\\\\192.168.0.1\\documents\\h4bfdnii7heae.swf")) returned 0x80 [0137.963] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\H4BFdNII7HeaE.swf" (normalized: "\\\\192.168.0.1\\documents\\h4bfdnii7heae.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.964] GetLastError () returned 0x5 [0137.964] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bdce54, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5835b070, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bdce54, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5b66, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUSDGqr.odt", cAlternateFileName="")) returned 1 [0137.964] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt")) returned 0x80 [0137.972] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\dUSDGqr.odt" (normalized: "\\\\192.168.0.1\\documents\\dusdgqr.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.973] GetLastError () returned 0x5 [0137.973] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99e1108, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99e1108, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xeb6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1qRDSM.ots", cAlternateFileName="")) returned 1 [0137.974] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots")) returned 0x80 [0137.979] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\1qRDSM.ots" (normalized: "\\\\192.168.0.1\\documents\\1qrdsm.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.980] GetLastError () returned 0x5 [0137.980] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99f498b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99f498b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="3E3mNRHtjqDkD.docx", cAlternateFileName="")) returned 1 [0137.980] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\3E3mNRHtjqDkD.docx" (normalized: "\\\\192.168.0.1\\documents\\3e3mnrhtjqdkd.docx")) returned 0x80 [0137.996] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\3E3mNRHtjqDkD.docx" (normalized: "\\\\192.168.0.1\\documents\\3e3mnrhtjqdkd.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.015] GetLastError () returned 0x5 [0138.015] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ba24cb, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ba24cb, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13677, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZDi6IHm9Gll50uy.wav", cAlternateFileName="")) returned 1 [0138.015] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ZDi6IHm9Gll50uy.wav" (normalized: "\\\\192.168.0.1\\documents\\zdi6ihm9gll50uy.wav")) returned 0x80 [0138.019] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ZDi6IHm9Gll50uy.wav" (normalized: "\\\\192.168.0.1\\documents\\zdi6ihm9gll50uy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.023] GetLastError () returned 0x5 [0138.023] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c48524, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c48524, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x151b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrhycV54UDwXeOVHbaY.ppt", cAlternateFileName="")) returned 1 [0138.023] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\nrhycV54UDwXeOVHbaY.ppt" (normalized: "\\\\192.168.0.1\\documents\\nrhycv54udwxeovhbay.ppt")) returned 0x80 [0138.026] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\nrhycV54UDwXeOVHbaY.ppt" (normalized: "\\\\192.168.0.1\\documents\\nrhycv54udwxeovhbay.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.032] GetLastError () returned 0x5 [0138.032] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b542bf, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b542bf, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVUGEj8tBupVWECY.xls", cAlternateFileName="")) returned 1 [0138.032] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\SVUGEj8tBupVWECY.xls" (normalized: "\\\\192.168.0.1\\documents\\svugej8tbupvwecy.xls")) returned 0x80 [0138.036] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\SVUGEj8tBupVWECY.xls" (normalized: "\\\\192.168.0.1\\documents\\svugej8tbupvwecy.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.043] GetLastError () returned 0x5 [0138.043] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a9a9e4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a9a9e4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x145ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ety66.avi", cAlternateFileName="")) returned 1 [0138.043] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Ety66.avi" (normalized: "\\\\192.168.0.1\\documents\\ety66.avi")) returned 0x80 [0138.048] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Ety66.avi" (normalized: "\\\\192.168.0.1\\documents\\ety66.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.055] GetLastError () returned 0x5 [0138.055] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17f4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="quWT4PWu.png", cAlternateFileName="")) returned 1 [0138.056] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\quWT4PWu.png" (normalized: "\\\\192.168.0.1\\documents\\quwt4pwu.png")) returned 0x80 [0138.059] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\quWT4PWu.png" (normalized: "\\\\192.168.0.1\\documents\\quwt4pwu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.060] GetLastError () returned 0x5 [0138.060] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c0db9b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c0db9b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x117b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="j9JYPCvbXdUa8a9vWWKs.pptx", cAlternateFileName="")) returned 1 [0138.061] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\j9JYPCvbXdUa8a9vWWKs.pptx" (normalized: "\\\\192.168.0.1\\documents\\j9jypcvbxdua8a9vwwks.pptx")) returned 0x80 [0138.066] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\j9JYPCvbXdUa8a9vWWKs.pptx" (normalized: "\\\\192.168.0.1\\documents\\j9jypcvbxdua8a9vwwks.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.075] GetLastError () returned 0x5 [0138.075] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ad536c, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ad536c, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15446, dwReserved0=0x0, dwReserved1=0x0, cFileName="Khw7ULNZgmj8e7C.ots", cAlternateFileName="")) returned 1 [0138.075] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots")) returned 0x80 [0138.078] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Khw7ULNZgmj8e7C.ots" (normalized: "\\\\192.168.0.1\\documents\\khw7ulnzgmj8e7c.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.081] GetLastError () returned 0x5 [0138.081] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c96730, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c96730, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="uKTB42S.swf", cAlternateFileName="")) returned 1 [0138.082] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\uKTB42S.swf" (normalized: "\\\\192.168.0.1\\documents\\uktb42s.swf")) returned 0x80 [0138.083] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\uKTB42S.swf" (normalized: "\\\\192.168.0.1\\documents\\uktb42s.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.183] GetLastError () returned 0x5 [0138.183] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bd3212, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bd3212, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="c9ePpp.flv", cAlternateFileName="")) returned 1 [0138.183] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\c9ePpp.flv" (normalized: "\\\\192.168.0.1\\documents\\c9eppp.flv")) returned 0x80 [0138.213] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\c9ePpp.flv" (normalized: "\\\\192.168.0.1\\documents\\c9eppp.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.231] GetLastError () returned 0x5 [0138.231] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b5df01, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b5df01, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13285, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRokYgqilEOKg8Z1jJGf.xlsx", cAlternateFileName="")) returned 1 [0138.232] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\TRokYgqilEOKg8Z1jJGf.xlsx" (normalized: "\\\\192.168.0.1\\documents\\trokygqileokg8z1jjgf.xlsx")) returned 0x80 [0138.263] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\TRokYgqilEOKg8Z1jJGf.xlsx" (normalized: "\\\\192.168.0.1\\documents\\trokygqileokg8z1jjgf.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.264] GetLastError () returned 0x5 [0138.264] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c6f62a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c6f62a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x99c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="quhItobo4pfIROy.png", cAlternateFileName="")) returned 1 [0138.351] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\quhItobo4pfIROy.png" (normalized: "\\\\192.168.0.1\\documents\\quhitobo4pfiroy.png")) returned 0x80 [0138.357] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\quhItobo4pfIROy.png" (normalized: "\\\\192.168.0.1\\documents\\quhitobo4pfiroy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.359] GetLastError () returned 0x5 [0138.359] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b5df01, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b5df01, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x14269, dwReserved0=0x0, dwReserved1=0x0, cFileName="TkK2vz7hevOC5xNhwJg.mp4", cAlternateFileName="")) returned 1 [0138.359] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\TkK2vz7hevOC5xNhwJg.mp4" (normalized: "\\\\192.168.0.1\\documents\\tkk2vz7hevoc5xnhwjg.mp4")) returned 0x80 [0138.363] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\TkK2vz7hevOC5xNhwJg.mp4" (normalized: "\\\\192.168.0.1\\documents\\tkk2vz7hevoc5xnhwjg.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.366] GetLastError () returned 0x5 [0138.366] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a256d2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a256d2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x163c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Lx84HE6bsZ.wav", cAlternateFileName="")) returned 1 [0138.367] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\8Lx84HE6bsZ.wav" (normalized: "\\\\192.168.0.1\\documents\\8lx84he6bsz.wav")) returned 0x80 [0138.370] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\8Lx84HE6bsZ.wav" (normalized: "\\\\192.168.0.1\\documents\\8lx84he6bsz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.373] GetLastError () returned 0x5 [0138.373] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aa4625, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aa4625, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1469a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GbsTd6ktJr7.ppt", cAlternateFileName="")) returned 1 [0138.373] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\GbsTd6ktJr7.ppt" (normalized: "\\\\192.168.0.1\\documents\\gbstd6ktjr7.ppt")) returned 0x80 [0138.377] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\GbsTd6ktJr7.ppt" (normalized: "\\\\192.168.0.1\\documents\\gbstd6ktjr7.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.379] GetLastError () returned 0x5 [0138.379] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c03f5a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c03f5a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="iN0JFI.xlsx", cAlternateFileName="")) returned 1 [0138.379] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\iN0JFI.xlsx" (normalized: "\\\\192.168.0.1\\documents\\in0jfi.xlsx")) returned 0x80 [0138.382] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\iN0JFI.xlsx" (normalized: "\\\\192.168.0.1\\documents\\in0jfi.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.388] GetLastError () returned 0x5 [0138.388] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8d4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pbmjHxBll.rtf", cAlternateFileName="")) returned 1 [0138.389] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\pbmjHxBll.rtf" (normalized: "\\\\192.168.0.1\\documents\\pbmjhxbll.rtf")) returned 0x80 [0138.390] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\pbmjHxBll.rtf" (normalized: "\\\\192.168.0.1\\documents\\pbmjhxbll.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.391] GetLastError () returned 0x5 [0138.391] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99f498b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99f498b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x54ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="2xLvx0ttbb57lMVLO.ods", cAlternateFileName="")) returned 1 [0138.391] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\2xLvx0ttbb57lMVLO.ods" (normalized: "\\\\192.168.0.1\\documents\\2xlvx0ttbb57lmvlo.ods")) returned 0x80 [0138.399] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\2xLvx0ttbb57lMVLO.ods" (normalized: "\\\\192.168.0.1\\documents\\2xlvx0ttbb57lmvlo.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.401] GetLastError () returned 0x5 [0138.401] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c03f5a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c03f5a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x18602, dwReserved0=0x0, dwReserved1=0x0, cFileName="iRSv1LGGODPvwvEebQE.png", cAlternateFileName="")) returned 1 [0138.402] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\iRSv1LGGODPvwvEebQE.png" (normalized: "\\\\192.168.0.1\\documents\\irsv1lggodpvwveebqe.png")) returned 0x80 [0138.405] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\iRSv1LGGODPvwvEebQE.png" (normalized: "\\\\192.168.0.1\\documents\\irsv1lggodpvwveebqe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.407] GetLastError () returned 0x5 [0138.407] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a42b96, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a42b96, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1571a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AbOnaFU.xlsx", cAlternateFileName="")) returned 1 [0138.408] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\AbOnaFU.xlsx" (normalized: "\\\\192.168.0.1\\documents\\abonafu.xlsx")) returned 0x80 [0138.415] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\AbOnaFU.xlsx" (normalized: "\\\\192.168.0.1\\documents\\abonafu.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.417] GetLastError () returned 0x5 [0138.417] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xce67, dwReserved0=0x0, dwReserved1=0x0, cFileName="nFDzD.png", cAlternateFileName="")) returned 1 [0138.417] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\nFDzD.png" (normalized: "\\\\192.168.0.1\\documents\\nfdzd.png")) returned 0x80 [0138.420] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\nFDzD.png" (normalized: "\\\\192.168.0.1\\documents\\nfdzd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.422] GetLastError () returned 0x5 [0138.422] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b5df01, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b5df01, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="TSbSJ2ohxP3n6KDx.docx", cAlternateFileName="")) returned 1 [0138.422] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\TSbSJ2ohxP3n6KDx.docx" (normalized: "\\\\192.168.0.1\\documents\\tsbsj2ohxp3n6kdx.docx")) returned 0x80 [0138.488] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\TSbSJ2ohxP3n6KDx.docx" (normalized: "\\\\192.168.0.1\\documents\\tsbsj2ohxp3n6kdx.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.497] GetLastError () returned 0x5 [0138.497] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99b03c1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99b03c1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x10a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0EiP8svF6n.mkv", cAlternateFileName="")) returned 1 [0138.498] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\0EiP8svF6n.mkv" (normalized: "\\\\192.168.0.1\\documents\\0eip8svf6n.mkv")) returned 0x80 [0138.502] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\0EiP8svF6n.mkv" (normalized: "\\\\192.168.0.1\\documents\\0eip8svf6n.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.536] GetLastError () returned 0x5 [0138.537] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b40a3d, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b40a3d, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xc4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS5pLVkA29znz.flv", cAlternateFileName="")) returned 1 [0138.537] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\RS5pLVkA29znz.flv" (normalized: "\\\\192.168.0.1\\documents\\rs5plvka29znz.flv")) returned 0x80 [0138.680] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\RS5pLVkA29znz.flv" (normalized: "\\\\192.168.0.1\\documents\\rs5plvka29znz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.728] GetLastError () returned 0x5 [0138.728] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c8caee, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583959f2, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c8caee, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1683c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sYQ0h.ppt", cAlternateFileName="")) returned 1 [0138.728] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\sYQ0h.ppt" (normalized: "\\\\192.168.0.1\\documents\\syq0h.ppt")) returned 0x80 [0138.742] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\sYQ0h.ppt" (normalized: "\\\\192.168.0.1\\documents\\syq0h.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.746] GetLastError () returned 0x5 [0138.746] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca9fb3, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca9fb3, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5e17, dwReserved0=0x0, dwReserved1=0x0, cFileName="wucW1wawWx4ne.doc", cAlternateFileName="")) returned 1 [0138.746] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\wucW1wawWx4ne.doc" (normalized: "\\\\192.168.0.1\\documents\\wucw1wawwx4ne.doc")) returned 0x80 [0138.749] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\wucW1wawWx4ne.doc" (normalized: "\\\\192.168.0.1\\documents\\wucw1wawwx4ne.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.750] GetLastError () returned 0x5 [0138.750] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9be6a95, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58364cb0, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9be6a95, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x14d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="eiiY7fvtLx3dj.bmp", cAlternateFileName="")) returned 1 [0138.750] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\eiiY7fvtLx3dj.bmp" (normalized: "\\\\192.168.0.1\\documents\\eiiy7fvtlx3dj.bmp")) returned 0x80 [0138.758] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\eiiY7fvtLx3dj.bmp" (normalized: "\\\\192.168.0.1\\documents\\eiiy7fvtlx3dj.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.760] GetLastError () returned 0x5 [0138.760] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99e1108, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99e1108, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x92e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1AikB2DT.mp3", cAlternateFileName="")) returned 1 [0138.761] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\1AikB2DT.mp3" (normalized: "\\\\192.168.0.1\\documents\\1aikb2dt.mp3")) returned 0x80 [0138.765] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\1AikB2DT.mp3" (normalized: "\\\\192.168.0.1\\documents\\1aikb2dt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.765] GetLastError () returned 0x5 [0138.766] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b85007, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b85007, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x121c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WmEY4gv.mp3", cAlternateFileName="")) returned 1 [0138.766] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\WmEY4gv.mp3" (normalized: "\\\\192.168.0.1\\documents\\wmey4gv.mp3")) returned 0x80 [0138.768] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\WmEY4gv.mp3" (normalized: "\\\\192.168.0.1\\documents\\wmey4gv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.769] GetLastError () returned 0x5 [0138.769] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a2f314, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a2f314, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17418, dwReserved0=0x0, dwReserved1=0x0, cFileName="8MxVvSu2W.gif", cAlternateFileName="")) returned 1 [0138.770] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\8MxVvSu2W.gif" (normalized: "\\\\192.168.0.1\\documents\\8mxvvsu2w.gif")) returned 0x80 [0138.774] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\8MxVvSu2W.gif" (normalized: "\\\\192.168.0.1\\documents\\8mxvvsu2w.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.775] GetLastError () returned 0x5 [0138.776] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a38f55, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a38f55, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15140, dwReserved0=0x0, dwReserved1=0x0, cFileName="8iKtd3z.mp3", cAlternateFileName="")) returned 1 [0138.776] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\8iKtd3z.mp3" (normalized: "\\\\192.168.0.1\\documents\\8iktd3z.mp3")) returned 0x80 [0138.781] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\8iKtd3z.mp3" (normalized: "\\\\192.168.0.1\\documents\\8iktd3z.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.783] GetLastError () returned 0x5 [0138.783] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bd3212, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bd3212, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x16666, dwReserved0=0x0, dwReserved1=0x0, cFileName="cOTqEVjblHM.odt", cAlternateFileName="")) returned 1 [0138.783] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt")) returned 0x80 [0138.786] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\cOTqEVjblHM.odt" (normalized: "\\\\192.168.0.1\\documents\\cotqevjblhm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.788] GetLastError () returned 0x5 [0138.788] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aae267, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aae267, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17424, dwReserved0=0x0, dwReserved1=0x0, cFileName="GhhNZic0YcS.png", cAlternateFileName="")) returned 1 [0138.788] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\GhhNZic0YcS.png" (normalized: "\\\\192.168.0.1\\documents\\ghhnzic0ycs.png")) returned 0x80 [0138.792] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\GhhNZic0YcS.png" (normalized: "\\\\192.168.0.1\\documents\\ghhnzic0ycs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.800] GetLastError () returned 0x5 [0138.800] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99ead49, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99ead49, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="2AX71T.jpg", cAlternateFileName="")) returned 1 [0138.800] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\2AX71T.jpg" (normalized: "\\\\192.168.0.1\\documents\\2ax71t.jpg")) returned 0x80 [0138.806] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\2AX71T.jpg" (normalized: "\\\\192.168.0.1\\documents\\2ax71t.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.810] GetLastError () returned 0x5 [0138.810] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99b03c1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572af6a5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99b03c1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xec1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="05s7FICPdDH4QU4JQ.pptx", cAlternateFileName="")) returned 1 [0138.811] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\05s7FICPdDH4QU4JQ.pptx" (normalized: "\\\\192.168.0.1\\documents\\05s7ficpddh4qu4jq.pptx")) returned 0x80 [0138.815] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\05s7FICPdDH4QU4JQ.pptx" (normalized: "\\\\192.168.0.1\\documents\\05s7ficpddh4qu4jq.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.817] GetLastError () returned 0x5 [0138.817] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb860, dwReserved0=0x0, dwReserved1=0x0, cFileName="BcxN84fCWe8tEtN.mp3", cAlternateFileName="")) returned 1 [0138.817] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\BcxN84fCWe8tEtN.mp3" (normalized: "\\\\192.168.0.1\\documents\\bcxn84fcwe8tetn.mp3")) returned 0x80 [0138.823] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\BcxN84fCWe8tEtN.mp3" (normalized: "\\\\192.168.0.1\\documents\\bcxn84fcwe8tetn.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.825] GetLastError () returned 0x5 [0138.825] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99f498b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572b92e5, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99f498b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11abe, dwReserved0=0x0, dwReserved1=0x0, cFileName="3fGbugRdy.doc", cAlternateFileName="")) returned 1 [0138.826] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\3fGbugRdy.doc" (normalized: "\\\\192.168.0.1\\documents\\3fgbugrdy.doc")) returned 0x80 [0138.829] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\3fGbugRdy.doc" (normalized: "\\\\192.168.0.1\\documents\\3fgbugrdy.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.830] GetLastError () returned 0x5 [0138.830] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b67b42, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b67b42, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa150, dwReserved0=0x0, dwReserved1=0x0, cFileName="U04chup9Htp9GaipvVKU.mp3", cAlternateFileName="")) returned 1 [0138.831] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\U04chup9Htp9GaipvVKU.mp3" (normalized: "\\\\192.168.0.1\\documents\\u04chup9htp9gaipvvku.mp3")) returned 0x80 [0138.869] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\U04chup9Htp9GaipvVKU.mp3" (normalized: "\\\\192.168.0.1\\documents\\u04chup9htp9gaipvvku.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.879] GetLastError () returned 0x5 [0138.879] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b5df01, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b5df01, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="TSC3rM0mAZRze.gif", cAlternateFileName="")) returned 1 [0138.880] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\TSC3rM0mAZRze.gif" (normalized: "\\\\192.168.0.1\\documents\\tsc3rm0mazrze.gif")) returned 0x80 [0138.881] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\TSC3rM0mAZRze.gif" (normalized: "\\\\192.168.0.1\\documents\\tsc3rm0mazrze.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.897] GetLastError () returned 0x5 [0138.897] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ae8bef, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ae8bef, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd97e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoWCllIvB.mp4", cAlternateFileName="")) returned 1 [0138.898] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NoWCllIvB.mp4" (normalized: "\\\\192.168.0.1\\documents\\nowcllivb.mp4")) returned 0x80 [0138.901] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NoWCllIvB.mp4" (normalized: "\\\\192.168.0.1\\documents\\nowcllivb.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.902] GetLastError () returned 0x5 [0138.902] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a4c7d8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a4c7d8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xe2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BJt1dICMT7jI.odt", cAlternateFileName="")) returned 1 [0138.902] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt")) returned 0x80 [0138.906] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\BJt1dICMT7jI.odt" (normalized: "\\\\192.168.0.1\\documents\\bjt1dicmt7ji.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.907] GetLastError () returned 0x5 [0138.907] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bc95d1, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bc95d1, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x115fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bRONRhxfJSt.mkv", cAlternateFileName="")) returned 1 [0138.907] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\bRONRhxfJSt.mkv" (normalized: "\\\\192.168.0.1\\documents\\bronrhxfjst.mkv")) returned 0x80 [0138.910] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\bRONRhxfJSt.mkv" (normalized: "\\\\192.168.0.1\\documents\\bronrhxfjst.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.913] GetLastError () returned 0x5 [0138.913] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa9c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="mkCTvFrcP2kSnJz4.csv", cAlternateFileName="")) returned 1 [0138.914] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\mkCTvFrcP2kSnJz4.csv" (normalized: "\\\\192.168.0.1\\documents\\mkctvfrcp2ksnjz4.csv")) returned 0x80 [0138.930] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\mkCTvFrcP2kSnJz4.csv" (normalized: "\\\\192.168.0.1\\documents\\mkctvfrcp2ksnjz4.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.932] GetLastError () returned 0x5 [0138.932] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cb3bf4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cb3bf4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFhoJ6DLxdB.gif", cAlternateFileName="")) returned 1 [0138.933] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\yFhoJ6DLxdB.gif" (normalized: "\\\\192.168.0.1\\documents\\yfhoj6dlxdb.gif")) returned 0x80 [0138.939] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\yFhoJ6DLxdB.gif" (normalized: "\\\\192.168.0.1\\documents\\yfhoj6dlxdb.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.941] GetLastError () returned 0x5 [0138.941] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bf06d7, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bf06d7, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="fSdZCoMsu.ppt", cAlternateFileName="")) returned 1 [0138.941] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\fSdZCoMsu.ppt" (normalized: "\\\\192.168.0.1\\documents\\fsdzcomsu.ppt")) returned 0x80 [0138.948] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\fSdZCoMsu.ppt" (normalized: "\\\\192.168.0.1\\documents\\fsdzcomsu.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.949] GetLastError () returned 0x5 [0138.949] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x90fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="qMEqdumGg.xls", cAlternateFileName="")) returned 1 [0138.950] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\qMEqdumGg.xls" (normalized: "\\\\192.168.0.1\\documents\\qmeqdumgg.xls")) returned 0x80 [0138.959] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\qMEqdumGg.xls" (normalized: "\\\\192.168.0.1\\documents\\qmeqdumgg.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.964] GetLastError () returned 0x5 [0138.964] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a1ba91, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a1ba91, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xecf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6bvEhs8ikEXo7i7VwC.odp", cAlternateFileName="")) returned 1 [0138.964] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\6bvEhs8ikEXo7i7VwC.odp" (normalized: "\\\\192.168.0.1\\documents\\6bvehs8ikexo7i7vwc.odp")) returned 0x80 [0138.966] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\6bvEhs8ikEXo7i7VwC.odp" (normalized: "\\\\192.168.0.1\\documents\\6bvehs8ikexo7i7vwc.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.971] GetLastError () returned 0x5 [0138.971] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ae8bef, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ae8bef, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x134b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NDQzoX6pBA3xcoCD4T.pdf", cAlternateFileName="")) returned 1 [0138.971] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\NDQzoX6pBA3xcoCD4T.pdf" (normalized: "\\\\192.168.0.1\\documents\\ndqzox6pba3xcocd4t.pdf")) returned 0x80 [0138.972] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\NDQzoX6pBA3xcoCD4T.pdf" (normalized: "\\\\192.168.0.1\\documents\\ndqzox6pba3xcocd4t.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.983] GetLastError () returned 0x5 [0138.983] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c6f62a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c6f62a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="r0UXmiC.bmp", cAlternateFileName="")) returned 1 [0138.983] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\r0UXmiC.bmp" (normalized: "\\\\192.168.0.1\\documents\\r0uxmic.bmp")) returned 0x80 [0138.992] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\r0UXmiC.bmp" (normalized: "\\\\192.168.0.1\\documents\\r0uxmic.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.005] GetLastError () returned 0x5 [0139.005] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x99c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsUSMSG.odt", cAlternateFileName="")) returned 1 [0139.006] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt")) returned 0x80 [0139.028] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\YsUSMSG.odt" (normalized: "\\\\192.168.0.1\\documents\\ysusmsg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.050] GetLastError () returned 0x5 [0139.052] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2b060, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2b060, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1494d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nHAn9S5wXFCiA.avi", cAlternateFileName="")) returned 1 [0139.052] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\nHAn9S5wXFCiA.avi" (normalized: "\\\\192.168.0.1\\documents\\nhan9s5wxfcia.avi")) returned 0x80 [0139.196] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\nHAn9S5wXFCiA.avi" (normalized: "\\\\192.168.0.1\\documents\\nhan9s5wxfcia.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.201] GetLastError () returned 0x5 [0139.201] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc99fe5cc, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc99fe5cc, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x901e, dwReserved0=0x0, dwReserved1=0x0, cFileName="3w8tH1dj3.avi", cAlternateFileName="")) returned 1 [0139.201] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\3w8tH1dj3.avi" (normalized: "\\\\192.168.0.1\\documents\\3w8th1dj3.avi")) returned 0x80 [0139.264] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\3w8tH1dj3.avi" (normalized: "\\\\192.168.0.1\\documents\\3w8th1dj3.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.322] GetLastError () returned 0x5 [0139.322] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9af2831, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x578fac19, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9af2831, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x15a57, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCrMyD.gif", cAlternateFileName="")) returned 1 [0139.323] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\OCrMyD.gif" (normalized: "\\\\192.168.0.1\\documents\\ocrmyd.gif")) returned 0x80 [0139.399] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\OCrMyD.gif" (normalized: "\\\\192.168.0.1\\documents\\ocrmyd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.443] GetLastError () returned 0x5 [0139.443] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a6005b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a6005b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x96e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CO3BSlwl0AGjF6ik7YUj.ods", cAlternateFileName="")) returned 1 [0139.443] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\CO3BSlwl0AGjF6ik7YUj.ods" (normalized: "\\\\192.168.0.1\\documents\\co3bslwl0agjf6ik7yuj.ods")) returned 0x80 [0139.553] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\CO3BSlwl0AGjF6ik7YUj.ods" (normalized: "\\\\192.168.0.1\\documents\\co3bslwl0agjf6ik7yuj.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.560] GetLastError () returned 0x5 [0139.560] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a2f314, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ccb66, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a2f314, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Zpef8RfCY9KqCV7PE.avi", cAlternateFileName="")) returned 1 [0139.561] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\8Zpef8RfCY9KqCV7PE.avi" (normalized: "\\\\192.168.0.1\\documents\\8zpef8rfcy9kqcv7pe.avi")) returned 0x80 [0139.583] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\8Zpef8RfCY9KqCV7PE.avi" (normalized: "\\\\192.168.0.1\\documents\\8zpef8rfcy9kqcv7pe.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.588] GetLastError () returned 0x5 [0139.588] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a42b96, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a42b96, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xe944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ad6eYrGeF6ADM39N.odt", cAlternateFileName="")) returned 1 [0139.588] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt")) returned 0x80 [0139.605] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Ad6eYrGeF6ADM39N.odt" (normalized: "\\\\192.168.0.1\\documents\\ad6eyrgef6adm39n.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.606] GetLastError () returned 0x5 [0139.606] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b67b42, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790e49a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b67b42, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd0a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TtGiLOV0AbV.jpg", cAlternateFileName="")) returned 1 [0139.607] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\TtGiLOV0AbV.jpg" (normalized: "\\\\192.168.0.1\\documents\\ttgilov0abv.jpg")) returned 0x80 [0139.618] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\TtGiLOV0AbV.jpg" (normalized: "\\\\192.168.0.1\\documents\\ttgilov0abv.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.619] GetLastError () returned 0x5 [0139.619] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c6f62a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c6f62a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12d87, dwReserved0=0x0, dwReserved1=0x0, cFileName="rIxvZBz.mp4", cAlternateFileName="")) returned 1 [0139.620] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\rIxvZBz.mp4" (normalized: "\\\\192.168.0.1\\documents\\rixvzbz.mp4")) returned 0x80 [0139.730] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\rIxvZBz.mp4" (normalized: "\\\\192.168.0.1\\documents\\rixvzbz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.734] GetLastError () returned 0x5 [0139.734] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cbd836, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cbd836, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xee59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywVBC9F7.mkv", cAlternateFileName="")) returned 1 [0139.734] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ywVBC9F7.mkv" (normalized: "\\\\192.168.0.1\\documents\\ywvbc9f7.mkv")) returned 0x80 [0139.843] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ywVBC9F7.mkv" (normalized: "\\\\192.168.0.1\\documents\\ywvbc9f7.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.844] GetLastError () returned 0x5 [0139.844] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a87161, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a87161, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x78b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="EWYXiU.png", cAlternateFileName="")) returned 1 [0139.845] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EWYXiU.png" (normalized: "\\\\192.168.0.1\\documents\\ewyxiu.png")) returned 0x80 [0139.885] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EWYXiU.png" (normalized: "\\\\192.168.0.1\\documents\\ewyxiu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.886] GetLastError () returned 0x5 [0139.886] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xae3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yxa8HDFZVHjsem9K2t.pptx", cAlternateFileName="")) returned 1 [0139.886] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Yxa8HDFZVHjsem9K2t.pptx" (normalized: "\\\\192.168.0.1\\documents\\yxa8hdfzvhjsem9k2t.pptx")) returned 0x80 [0139.901] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Yxa8HDFZVHjsem9K2t.pptx" (normalized: "\\\\192.168.0.1\\documents\\yxa8hdfzvhjsem9k2t.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.912] GetLastError () returned 0x5 [0139.912] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a38f55, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a38f55, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xedc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="9RqmGLGyrOcA3.mp3", cAlternateFileName="")) returned 1 [0139.912] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\9RqmGLGyrOcA3.mp3" (normalized: "\\\\192.168.0.1\\documents\\9rqmglgyroca3.mp3")) returned 0x80 [0139.932] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\9RqmGLGyrOcA3.mp3" (normalized: "\\\\192.168.0.1\\documents\\9rqmglgyroca3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.942] GetLastError () returned 0x5 [0139.942] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c52165, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58382171, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c52165, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xd7fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="pC3tGDvF.doc", cAlternateFileName="")) returned 1 [0139.942] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\pC3tGDvF.doc" (normalized: "\\\\192.168.0.1\\documents\\pc3tgdvf.doc")) returned 0x80 [0140.037] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\pC3tGDvF.doc" (normalized: "\\\\192.168.0.1\\documents\\pc3tgdvf.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.039] GetLastError () returned 0x5 [0140.039] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b9888a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x57921d1b, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b9888a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9668, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yn0PYQpVz8.doc", cAlternateFileName="")) returned 1 [0140.040] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Yn0PYQpVz8.doc" (normalized: "\\\\192.168.0.1\\documents\\yn0pyqpvz8.doc")) returned 0x80 [0140.246] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Yn0PYQpVz8.doc" (normalized: "\\\\192.168.0.1\\documents\\yn0pyqpvz8.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.247] GetLastError () returned 0x5 [0140.247] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c659e8, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c659e8, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x153ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="qkovu43RZ2n.odt", cAlternateFileName="")) returned 1 [0140.247] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt")) returned 0x80 [0140.284] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\qkovu43RZ2n.odt" (normalized: "\\\\192.168.0.1\\documents\\qkovu43rz2n.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.284] GetLastError () returned 0x5 [0140.285] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a90da2, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a90da2, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1663f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EjMAFky9mSGD.mp4", cAlternateFileName="")) returned 1 [0140.285] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\EjMAFky9mSGD.mp4" (normalized: "\\\\192.168.0.1\\documents\\ejmafky9msgd.mp4")) returned 0x80 [0140.299] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\EjMAFky9mSGD.mp4" (normalized: "\\\\192.168.0.1\\documents\\ejmafky9msgd.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.303] GetLastError () returned 0x5 [0140.303] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bdce54, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58351430, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bdce54, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x8daf, dwReserved0=0x0, dwReserved1=0x0, cFileName="dSLdNV.doc", cAlternateFileName="")) returned 1 [0140.303] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\dSLdNV.doc" (normalized: "\\\\192.168.0.1\\documents\\dsldnv.doc")) returned 0x80 [0140.311] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\dSLdNV.doc" (normalized: "\\\\192.168.0.1\\documents\\dsldnv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.314] GetLastError () returned 0x5 [0140.315] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b85007, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x579180da, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b85007, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x7249, dwReserved0=0x0, dwReserved1=0x0, cFileName="VWgLcoYpNW87TI6XH.ods", cAlternateFileName="")) returned 1 [0140.315] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\VWgLcoYpNW87TI6XH.ods" (normalized: "\\\\192.168.0.1\\documents\\vwglcoypnw87ti6xh.ods")) returned 0x80 [0140.328] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\VWgLcoYpNW87TI6XH.ods" (normalized: "\\\\192.168.0.1\\documents\\vwglcoypnw87ti6xh.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.329] GetLastError () returned 0x5 [0140.329] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c6f62a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c6f62a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17618, dwReserved0=0x0, dwReserved1=0x0, cFileName="qw5s04.swf", cAlternateFileName="")) returned 1 [0140.329] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\qw5s04.swf" (normalized: "\\\\192.168.0.1\\documents\\qw5s04.swf")) returned 0x80 [0140.367] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\qw5s04.swf" (normalized: "\\\\192.168.0.1\\documents\\qw5s04.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.368] GetLastError () returned 0x5 [0140.368] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca0371, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58445678, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca0371, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa055, dwReserved0=0x0, dwReserved1=0x0, cFileName="vfO9r7XUdR7Mn9SuaJu.flv", cAlternateFileName="")) returned 1 [0140.369] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\vfO9r7XUdR7Mn9SuaJu.flv" (normalized: "\\\\192.168.0.1\\documents\\vfo9r7xudr7mn9suaju.flv")) returned 0x80 [0140.409] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\vfO9r7XUdR7Mn9SuaJu.flv" (normalized: "\\\\192.168.0.1\\documents\\vfo9r7xudr7mn9suaju.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.411] GetLastError () returned 0x5 [0140.411] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cb3bf4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58458ef8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cb3bf4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="yvd6SxFNPFFdWKTf.bmp", cAlternateFileName="")) returned 1 [0140.411] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\yvd6SxFNPFFdWKTf.bmp" (normalized: "\\\\192.168.0.1\\documents\\yvd6sxfnpffdwktf.bmp")) returned 0x80 [0140.432] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\yvd6SxFNPFFdWKTf.bmp" (normalized: "\\\\192.168.0.1\\documents\\yvd6sxfnpffdwktf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.433] GetLastError () returned 0x5 [0140.433] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aae267, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aae267, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11028, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hs8SJlE.pdf", cAlternateFileName="")) returned 1 [0140.434] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Hs8SJlE.pdf" (normalized: "\\\\192.168.0.1\\documents\\hs8sjle.pdf")) returned 0x80 [0140.452] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Hs8SJlE.pdf" (normalized: "\\\\192.168.0.1\\documents\\hs8sjle.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.455] GetLastError () returned 0x5 [0140.455] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c177dd, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c177dd, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x11e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="k8F1wk5HusiiaH6.pdf", cAlternateFileName="")) returned 1 [0140.456] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\k8F1wk5HusiiaH6.pdf" (normalized: "\\\\192.168.0.1\\documents\\k8f1wk5husiiah6.pdf")) returned 0x80 [0140.582] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\k8F1wk5HusiiaH6.pdf" (normalized: "\\\\192.168.0.1\\documents\\k8f1wk5husiiah6.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.584] GetLastError () returned 0x5 [0140.584] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c6f62a, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5838bdb1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c6f62a, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x5123, dwReserved0=0x0, dwReserved1=0x0, cFileName="r4V67Cxk5wf.pptx", cAlternateFileName="")) returned 1 [0140.584] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\r4V67Cxk5wf.pptx" (normalized: "\\\\192.168.0.1\\documents\\r4v67cxk5wf.pptx")) returned 0x80 [0140.705] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\r4V67Cxk5wf.pptx" (normalized: "\\\\192.168.0.1\\documents\\r4v67cxk5wf.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.706] GetLastError () returned 0x5 [0140.706] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c2141e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c2141e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x6ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ljwMlJaUR.gif", cAlternateFileName="")) returned 1 [0140.706] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ljwMlJaUR.gif" (normalized: "\\\\192.168.0.1\\documents\\ljwmljaur.gif")) returned 0x80 [0140.790] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ljwMlJaUR.gif" (normalized: "\\\\192.168.0.1\\documents\\ljwmljaur.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.804] GetLastError () returned 0x5 [0140.804] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ac1ae9, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ac1ae9, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa862, dwReserved0=0x0, dwReserved1=0x0, cFileName="I235155.jpg", cAlternateFileName="")) returned 1 [0140.805] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\I235155.jpg" (normalized: "\\\\192.168.0.1\\documents\\i235155.jpg")) returned 0x80 [0140.826] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\I235155.jpg" (normalized: "\\\\192.168.0.1\\documents\\i235155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.833] GetLastError () returned 0x5 [0140.833] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c0db9b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c0db9b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x178d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jZ8QQ.png", cAlternateFileName="")) returned 1 [0140.834] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\jZ8QQ.png" (normalized: "\\\\192.168.0.1\\documents\\jz8qq.png")) returned 0x80 [0140.845] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\jZ8QQ.png" (normalized: "\\\\192.168.0.1\\documents\\jz8qq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.854] GetLastError () returned 0x5 [0140.854] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bfa318, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5836e8f1, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bfa318, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xcbff, dwReserved0=0x0, dwReserved1=0x0, cFileName="hHQWi5hCV.pdf", cAlternateFileName="")) returned 1 [0140.855] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\hHQWi5hCV.pdf" (normalized: "\\\\192.168.0.1\\documents\\hhqwi5hcv.pdf")) returned 0x80 [0140.866] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\hHQWi5hCV.pdf" (normalized: "\\\\192.168.0.1\\documents\\hhqwi5hcv.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.871] GetLastError () returned 0x5 [0140.871] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c0db9b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c0db9b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xdd63, dwReserved0=0x0, dwReserved1=0x0, cFileName="jBgQDjljdAi8Iv2PL.gif", cAlternateFileName="")) returned 1 [0140.871] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\jBgQDjljdAi8Iv2PL.gif" (normalized: "\\\\192.168.0.1\\documents\\jbgqdjljdai8iv2pl.gif")) returned 0x80 [0140.904] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\jBgQDjljdAi8Iv2PL.gif" (normalized: "\\\\192.168.0.1\\documents\\jbgqdjljdai8iv2pl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.907] GetLastError () returned 0x5 [0140.908] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9aae267, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572ea027, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9aae267, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17642, dwReserved0=0x0, dwReserved1=0x0, cFileName="HcsLtIJlEmM0NTPGs.xls", cAlternateFileName="")) returned 1 [0140.908] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\HcsLtIJlEmM0NTPGs.xls" (normalized: "\\\\192.168.0.1\\documents\\hcsltijlemm0ntpgs.xls")) returned 0x80 [0140.953] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\HcsLtIJlEmM0NTPGs.xls" (normalized: "\\\\192.168.0.1\\documents\\hcsltijlemm0ntpgs.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.954] GetLastError () returned 0x5 [0140.954] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b40a3d, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b40a3d, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xb087, dwReserved0=0x0, dwReserved1=0x0, cFileName="QfHsttYoiqOGUUjwI5r.swf", cAlternateFileName="")) returned 1 [0140.954] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\QfHsttYoiqOGUUjwI5r.swf" (normalized: "\\\\192.168.0.1\\documents\\qfhsttyoiqoguujwi5r.swf")) returned 0x80 [0140.972] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\QfHsttYoiqOGUUjwI5r.swf" (normalized: "\\\\192.168.0.1\\documents\\qfhsttyoiqoguujwi5r.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.973] GetLastError () returned 0x5 [0140.973] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a38f55, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572d67a6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a38f55, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x607c, dwReserved0=0x0, dwReserved1=0x0, cFileName="8me2d.pptx", cAlternateFileName="")) returned 1 [0140.973] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\8me2d.pptx" (normalized: "\\\\192.168.0.1\\documents\\8me2d.pptx")) returned 0x80 [0141.001] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\8me2d.pptx" (normalized: "\\\\192.168.0.1\\documents\\8me2d.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.002] GetLastError () returned 0x5 [0141.002] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9acb72b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572f3c67, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9acb72b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x9697, dwReserved0=0x0, dwReserved1=0x0, cFileName="K7PKxXbGrKXfVhE.ppt", cAlternateFileName="")) returned 1 [0141.002] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\K7PKxXbGrKXfVhE.ppt" (normalized: "\\\\192.168.0.1\\documents\\k7pkxxbgrkxfvhe.ppt")) returned 0x80 [0141.014] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\K7PKxXbGrKXfVhE.ppt" (normalized: "\\\\192.168.0.1\\documents\\k7pkxxbgrkxfvhe.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.015] GetLastError () returned 0x5 [0141.015] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9cb3bf4, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9cb3bf4, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xa60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFDjrYVFhxr1o.rtf", cAlternateFileName="")) returned 1 [0141.015] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\yFDjrYVFhxr1o.rtf" (normalized: "\\\\192.168.0.1\\documents\\yfdjryvfhxr1o.rtf")) returned 0x80 [0141.084] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\yFDjrYVFhxr1o.rtf" (normalized: "\\\\192.168.0.1\\documents\\yfdjryvfhxr1o.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.091] GetLastError () returned 0x5 [0141.091] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c96730, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58445678, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c96730, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x142d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="uvxie8.docx", cAlternateFileName="")) returned 1 [0141.091] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\uvxie8.docx" (normalized: "\\\\192.168.0.1\\documents\\uvxie8.docx")) returned 0x80 [0141.109] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\uvxie8.docx" (normalized: "\\\\192.168.0.1\\documents\\uvxie8.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.110] GetLastError () returned 0x5 [0141.110] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9bbf990, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x583477ef, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9bbf990, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xfe90, dwReserved0=0x0, dwReserved1=0x0, cFileName="aVdNk.pps", cAlternateFileName="")) returned 1 [0141.110] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\aVdNk.pps" (normalized: "\\\\192.168.0.1\\documents\\avdnk.pps")) returned 0x80 [0141.124] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\aVdNk.pps" (normalized: "\\\\192.168.0.1\\documents\\avdnk.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.125] GetLastError () returned 0x5 [0141.125] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c0db9b, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58378531, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c0db9b, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xf47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="igduZ1s2R.xlsx", cAlternateFileName="")) returned 1 [0141.126] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\igduZ1s2R.xlsx" (normalized: "\\\\192.168.0.1\\documents\\igduz1s2r.xlsx")) returned 0x80 [0141.192] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\igduZ1s2R.xlsx" (normalized: "\\\\192.168.0.1\\documents\\igduz1s2r.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.212] GetLastError () returned 0x5 [0141.212] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9b4a67e, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5790485a, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9b4a67e, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0xcb6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RtBpO.pps", cAlternateFileName="")) returned 1 [0141.212] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\RtBpO.pps" (normalized: "\\\\192.168.0.1\\documents\\rtbpo.pps")) returned 0x80 [0141.246] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\RtBpO.pps" (normalized: "\\\\192.168.0.1\\documents\\rtbpo.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.247] GetLastError () returned 0x5 [0141.247] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9be6a95, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58364cb0, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9be6a95, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x12aca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ekGGyeqFk2bhWU.jpg", cAlternateFileName="")) returned 1 [0141.247] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\ekGGyeqFk2bhWU.jpg" (normalized: "\\\\192.168.0.1\\documents\\ekggyeqfk2bhwu.jpg")) returned 0x80 [0141.262] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\ekGGyeqFk2bhWU.jpg" (normalized: "\\\\192.168.0.1\\documents\\ekggyeqfk2bhwu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.263] GetLastError () returned 0x5 [0141.263] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a87161, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572e03e6, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a87161, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x13a84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Daynev4hNYGuoMWbxLXC.pptx", cAlternateFileName="")) returned 1 [0141.263] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\Daynev4hNYGuoMWbxLXC.pptx" (normalized: "\\\\192.168.0.1\\documents\\daynev4hnyguomwbxlxc.pptx")) returned 0x80 [0141.424] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\Daynev4hNYGuoMWbxLXC.pptx" (normalized: "\\\\192.168.0.1\\documents\\daynev4hnyguomwbxlxc.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.450] GetLastError () returned 0x5 [0141.450] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9a11e4f, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x572c2f25, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9a11e4f, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x147e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4s6BCb3WGeEnQU.bmp", cAlternateFileName="")) returned 1 [0141.475] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\4s6BCb3WGeEnQU.bmp" (normalized: "\\\\192.168.0.1\\documents\\4s6bcb3wgeenqu.bmp")) returned 0x80 [0141.570] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\4s6BCb3WGeEnQU.bmp" (normalized: "\\\\192.168.0.1\\documents\\4s6bcb3wgeenqu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.572] GetLastError () returned 0x5 [0141.572] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9c96730, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x58445678, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9c96730, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x1594c, dwReserved0=0x0, dwReserved1=0x0, cFileName="v0CV5yZU8GBZK.flv", cAlternateFileName="")) returned 1 [0141.572] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\v0CV5yZU8GBZK.flv" (normalized: "\\\\192.168.0.1\\documents\\v0cv5yzu8gbzk.flv")) returned 0x80 [0141.671] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\v0CV5yZU8GBZK.flv" (normalized: "\\\\192.168.0.1\\documents\\v0cv5yzu8gbzk.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.672] GetLastError () returned 0x5 [0141.672] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca9fb3, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca9fb3, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17490, dwReserved0=0x0, dwReserved1=0x0, cFileName="xgOBxEjMJN.swf", cAlternateFileName="")) returned 1 [0141.672] GetFileAttributesW (lpFileName="\\\\192.168.0.1\\documents\\xgOBxEjMJN.swf" (normalized: "\\\\192.168.0.1\\documents\\xgobxejmjn.swf")) returned 0x80 [0141.888] CreateFileW (lpFileName="\\\\192.168.0.1\\documents\\xgOBxEjMJN.swf" (normalized: "\\\\192.168.0.1\\documents\\xgobxejmjn.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.889] GetLastError () returned 0x5 [0141.889] FindNextFileW (in: hFindFile=0x767d00, lpFindFileData=0xfd0fb6c | out: lpFindFileData=0xfd0fb6c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9ca9fb3, ftCreationTime.dwHighDateTime=0x1d8be02, ftLastAccessTime.dwLowDateTime=0x5844f2b8, ftLastAccessTime.dwHighDateTime=0x1d8be03, ftLastWriteTime.dwLowDateTime=0xc9ca9fb3, ftLastWriteTime.dwHighDateTime=0x1d8be02, nFileSizeHigh=0x0, nFileSizeLow=0x17490, dwReserved0=0x0, dwReserved1=0x0, cFileName="xgOBxEjMJN.swf", cAlternateFileName="")) returned 0 [0141.889] FindClose (in: hFindFile=0x767d00 | out: hFindFile=0x767d00) returned 1 [0141.890] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 72 os_tid = 0x115c [0121.256] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0121.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0121.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f030c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0121.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0121.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0324, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0121.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0121.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f033c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0121.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0121.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0354, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0121.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0121.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f036c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0121.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0121.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0384, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0121.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0121.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f039c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0121.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0121.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0121.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0121.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0121.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0121.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0121.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0121.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0121.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0121.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0414, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0121.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0121.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f042c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0121.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0121.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0444, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0121.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0121.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f045c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0121.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0121.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0474, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0121.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0121.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f048c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0121.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0121.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0121.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0121.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0121.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0121.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0121.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0121.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0121.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0121.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0121.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0121.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f051c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0121.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0121.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0534, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0121.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0121.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f054c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0121.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0121.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0564, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0121.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0121.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f057c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0121.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0121.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0594, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0121.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0121.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0121.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0121.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0121.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0121.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0121.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0121.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0121.299] WaitForMultipleObjects (nCount=0x40, lpHandles=0x910000*=0x284, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0123.445] CloseHandle (hObject=0x284) returned 1 [0123.445] CloseHandle (hObject=0x280) returned 1 [0123.445] CloseHandle (hObject=0x27c) returned 1 [0123.445] CloseHandle (hObject=0x278) returned 1 [0123.445] CloseHandle (hObject=0x274) returned 1 [0123.445] CloseHandle (hObject=0x270) returned 1 [0123.445] CloseHandle (hObject=0x26c) returned 1 [0123.445] CloseHandle (hObject=0x268) returned 1 [0123.445] CloseHandle (hObject=0x264) returned 1 [0123.445] CloseHandle (hObject=0x260) returned 1 [0123.446] CloseHandle (hObject=0x25c) returned 1 [0123.446] CloseHandle (hObject=0x258) returned 1 [0123.446] CloseHandle (hObject=0x254) returned 1 [0123.446] CloseHandle (hObject=0x250) returned 1 [0123.446] CloseHandle (hObject=0x24c) returned 1 [0123.446] CloseHandle (hObject=0x248) returned 1 [0123.446] CloseHandle (hObject=0x244) returned 1 [0123.446] CloseHandle (hObject=0x240) returned 1 [0123.446] CloseHandle (hObject=0x23c) returned 1 [0123.446] CloseHandle (hObject=0x238) returned 1 [0123.446] CloseHandle (hObject=0x234) returned 1 [0123.446] CloseHandle (hObject=0x230) returned 1 [0123.446] CloseHandle (hObject=0x22c) returned 1 [0123.446] CloseHandle (hObject=0x228) returned 1 [0123.446] CloseHandle (hObject=0x224) returned 1 [0123.446] CloseHandle (hObject=0x220) returned 1 [0123.446] CloseHandle (hObject=0x21c) returned 1 [0123.446] CloseHandle (hObject=0x218) returned 1 [0123.446] CloseHandle (hObject=0x214) returned 1 [0123.446] CloseHandle (hObject=0x210) returned 1 [0123.447] CloseHandle (hObject=0x20c) returned 1 [0123.447] CloseHandle (hObject=0x208) returned 1 [0123.447] CloseHandle (hObject=0x200) returned 1 [0123.447] CloseHandle (hObject=0x448) returned 1 [0123.447] CloseHandle (hObject=0x44c) returned 1 [0123.447] CloseHandle (hObject=0x450) returned 1 [0123.447] CloseHandle (hObject=0x454) returned 1 [0123.447] CloseHandle (hObject=0x458) returned 1 [0123.447] CloseHandle (hObject=0x45c) returned 1 [0123.447] CloseHandle (hObject=0x460) returned 1 [0123.447] CloseHandle (hObject=0x464) returned 1 [0123.447] CloseHandle (hObject=0x468) returned 1 [0123.447] CloseHandle (hObject=0x46c) returned 1 [0123.447] CloseHandle (hObject=0x470) returned 1 [0123.447] CloseHandle (hObject=0x474) returned 1 [0123.447] CloseHandle (hObject=0x478) returned 1 [0123.447] CloseHandle (hObject=0x47c) returned 1 [0123.447] CloseHandle (hObject=0x480) returned 1 [0123.447] CloseHandle (hObject=0x484) returned 1 [0123.447] CloseHandle (hObject=0x488) returned 1 [0123.447] CloseHandle (hObject=0x48c) returned 1 [0123.448] CloseHandle (hObject=0x490) returned 1 [0123.448] CloseHandle (hObject=0x494) returned 1 [0123.448] CloseHandle (hObject=0x498) returned 1 [0123.448] CloseHandle (hObject=0x49c) returned 1 [0123.448] CloseHandle (hObject=0x4a0) returned 1 [0123.448] CloseHandle (hObject=0x4a4) returned 1 [0123.448] CloseHandle (hObject=0x4a8) returned 1 [0123.448] CloseHandle (hObject=0x4ac) returned 1 [0123.448] CloseHandle (hObject=0x4b0) returned 1 [0123.448] CloseHandle (hObject=0x4b4) returned 1 [0123.448] CloseHandle (hObject=0x4b8) returned 1 [0123.448] CloseHandle (hObject=0x4bc) returned 1 [0123.448] CloseHandle (hObject=0x4c0) returned 1 [0123.448] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 73 os_tid = 0x254 [0121.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0121.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0121.304] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xff8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0121.304] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xff8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xff8f828, pbKeyObject=0x0) returned 0x0 [0121.305] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xff8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xff8f500) returned 0x0 [0121.305] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0121.305] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xff8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xff8f500) returned 0x0 [0121.309] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.310] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.310] WriteFile (in: hFile=0x2fc, lpBuffer=0xff8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xff8f830, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesWritten=0xff8f830*=0x428, lpOverlapped=0x0) returned 1 [0121.313] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.313] ReadFile (in: hFile=0x2fc, lpBuffer=0x2750000, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xff8f61c*=0x81, lpOverlapped=0x0) returned 1 [0121.313] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xffffff7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.313] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2750000, cbInput=0x81, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0xff8f848, pbOutput=0x2750000, pcbResult=0xff8f618) returned 0x0 [0121.313] WriteFile (in: hFile=0x2fc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xff8f61c*=0x90, lpOverlapped=0x0) returned 1 [0121.313] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0121.313] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.313] WriteFile (in: hFile=0x2fc, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.313] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.313] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0121.313] CloseHandle (hObject=0x2fc) returned 1 [0121.314] VirtualAlloc (lpAddress=0x0, dwSize=0x5d, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0121.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), lpNewFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.PLAY" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.play")) returned 1 [0121.316] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 74 os_tid = 0x1180 [0121.326] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0121.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0121.328] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0121.328] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0121.328] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x100cf500) returned 0x0 [0121.328] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0121.328] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x100cf500) returned 0x0 [0121.333] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.334] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.334] WriteFile (in: hFile=0x2f4, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0121.336] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.336] ReadFile (in: hFile=0x2f4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x100cf61c*=0x81, lpOverlapped=0x0) returned 1 [0121.336] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xffffff7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.336] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2850000, cbInput=0x81, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x100cf848, pbOutput=0x2850000, pcbResult=0x100cf618) returned 0x0 [0121.336] WriteFile (in: hFile=0x2f4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x100cf61c*=0x90, lpOverlapped=0x0) returned 1 [0121.337] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0121.337] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.337] WriteFile (in: hFile=0x2f4, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0121.337] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.337] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0121.337] CloseHandle (hObject=0x2f4) returned 1 [0121.338] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0121.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini"), lpNewFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini.PLAY" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini.play")) returned 1 [0121.340] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 75 os_tid = 0x45c [0121.342] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.342] ReadFile (in: hFile=0x304, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.344] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.344] ReadFile (in: hFile=0x304, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.344] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0121.345] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0121.345] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0121.345] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0121.345] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1020f500) returned 0x0 [0121.345] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0121.345] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1020f500) returned 0x0 [0121.348] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.350] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.350] WriteFile (in: hFile=0x304, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0121.355] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.355] ReadFile (in: hFile=0x304, lpBuffer=0x2950000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1020f61c*=0x2000, lpOverlapped=0x0) returned 1 [0121.356] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xffffe000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.356] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2950000, cbInput=0x2000, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1020f848, pbOutput=0x2950000, pcbResult=0x1020f618) returned 0x0 [0121.356] WriteFile (in: hFile=0x304, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1020f61c*=0x2010, lpOverlapped=0x0) returned 1 [0121.356] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0121.356] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.356] WriteFile (in: hFile=0x304, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.356] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x2010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.356] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0121.356] CloseHandle (hObject=0x304) returned 1 [0121.357] VirtualAlloc (lpAddress=0x0, dwSize=0x33, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0121.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="\\\\?\\C:\\BOOTSECT.BAK.PLAY" (normalized: "c:\\bootsect.bak.play")) returned 1 [0121.359] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 76 os_tid = 0x11ec [0121.361] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.361] ReadFile (in: hFile=0x2e0, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.363] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.363] ReadFile (in: hFile=0x2e0, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.363] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0121.364] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0121.364] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0121.364] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0121.364] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1034f500) returned 0x0 [0121.365] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0121.365] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1034f500) returned 0x0 [0121.369] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.370] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.370] WriteFile (in: hFile=0x2e0, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0121.370] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.370] ReadFile (in: hFile=0x2e0, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1380, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1034f61c*=0x1380, lpOverlapped=0x0) returned 1 [0121.370] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0xffffec80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.370] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2a50000, cbInput=0x1380, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1034f848, pbOutput=0x2a50000, pcbResult=0x1034f618) returned 0x0 [0121.370] WriteFile (in: hFile=0x2e0, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1034f61c*=0x1390, lpOverlapped=0x0) returned 1 [0121.370] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0121.371] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.371] WriteFile (in: hFile=0x2e0, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.371] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.371] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0121.371] CloseHandle (hObject=0x2e0) returned 1 [0121.372] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0121.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml.play")) returned 1 [0121.374] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 77 os_tid = 0x11e8 [0121.376] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.376] ReadFile (in: hFile=0x2d8, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.378] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.378] ReadFile (in: hFile=0x2d8, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.378] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0121.379] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0121.379] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0121.379] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0121.379] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1048f500) returned 0x0 [0121.379] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0121.379] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1048f500) returned 0x0 [0121.382] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.384] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.384] WriteFile (in: hFile=0x2d8, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0121.384] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.384] ReadFile (in: hFile=0x2d8, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1048f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.399] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.399] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2b50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x0 | out: hKey=0x76acf0, pbIV=0x1048f848, pbOutput=0x2b50000, pcbResult=0x1048f618) returned 0x0 [0121.400] WriteFile (in: hFile=0x2d8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1048f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.404] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0121.404] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.404] WriteFile (in: hFile=0x2d8, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.404] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.404] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xffeffbd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.404] ReadFile (in: hFile=0x2d8, lpBuffer=0x2b50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1048f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0121.981] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.981] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2b50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1048f848, pbOutput=0x2b50000, pcbResult=0x1048f618) returned 0x0 [0121.982] WriteFile (in: hFile=0x2d8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1048f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.001] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0122.001] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.001] WriteFile (in: hFile=0x2d8, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.001] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x1d2cccc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.001] WriteFile (in: hFile=0x2d8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1048f82c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1048f82c*=0x4, lpOverlapped=0x0) returned 1 [0122.001] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0122.002] CloseHandle (hObject=0x2d8) returned 1 [0132.017] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\owow64ww.cab.play")) returned 1 [0132.021] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 78 os_tid = 0x11e4 [0121.390] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.407] ReadFile (in: hFile=0x2d0, lpBuffer=0x105cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x105cf85c, lpOverlapped=0x0 | out: lpBuffer=0x105cfb34*, lpNumberOfBytesRead=0x105cf85c*=0x428, lpOverlapped=0x0) returned 1 [0121.412] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.412] ReadFile (in: hFile=0x2d0, lpBuffer=0x105cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x105cf85c, lpOverlapped=0x0 | out: lpBuffer=0x105cfb34*, lpNumberOfBytesRead=0x105cf85c*=0x428, lpOverlapped=0x0) returned 1 [0121.412] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0121.413] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0121.414] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x105cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0121.414] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x105cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x105cf828, pbKeyObject=0x0) returned 0x0 [0121.414] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x105cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x105cf500) returned 0x0 [0121.414] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0121.414] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x105cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x105cf500) returned 0x0 [0121.417] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.418] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.418] WriteFile (in: hFile=0x2d0, lpBuffer=0x105cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x105cf830, lpOverlapped=0x0 | out: lpBuffer=0x105cfb34*, lpNumberOfBytesWritten=0x105cf830*=0x428, lpOverlapped=0x0) returned 1 [0121.419] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.419] ReadFile (in: hFile=0x2d0, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x902bb, lpNumberOfBytesRead=0x105cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x105cf61c*=0x902bb, lpOverlapped=0x0) returned 1 [0121.427] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfff6fd45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.427] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2c50000, cbInput=0x902bb, pPaddingInfo=0x0, pbIV=0x105cf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x105cf618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x105cf848, pbOutput=0x2c50000, pcbResult=0x105cf618) returned 0x0 [0121.428] WriteFile (in: hFile=0x2d0, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x105cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x105cf61c*=0x902c0, lpOverlapped=0x0) returned 1 [0121.430] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x105cf60c | out: lpNewFilePointer=0x0) returned 1 [0121.430] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.430] WriteFile (in: hFile=0x2d0, lpBuffer=0x105cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x105cf61c, lpOverlapped=0x0 | out: lpBuffer=0x105cf83c*, lpNumberOfBytesWritten=0x105cf61c*=0x8, lpOverlapped=0x0) returned 1 [0121.430] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x902c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.430] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0121.430] CloseHandle (hObject=0x2d0) returned 1 [0121.442] VirtualAlloc (lpAddress=0x0, dwSize=0xc3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.play")) returned 1 [0122.006] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 79 os_tid = 0x1190 [0121.421] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.422] ReadFile (in: hFile=0x2c8, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.444] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.444] ReadFile (in: hFile=0x2c8, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.444] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xfe50000 [0121.445] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xfe50000) returned 0x0 [0121.445] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0121.445] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xfe50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0121.445] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xfe50000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0xfe50000, pcbResult=0x1070f500) returned 0x0 [0121.445] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xfe50230) returned 0x0 [0121.445] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xfe50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xfe50000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xfe50000, pcbResult=0x1070f500) returned 0x0 [0121.448] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.450] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.450] WriteFile (in: hFile=0x2c8, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0121.450] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.450] ReadFile (in: hFile=0x2c8, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x42d4, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1070f61c*=0x42d4, lpOverlapped=0x0) returned 1 [0121.451] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0xffffbd2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.451] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2d50000, cbInput=0x42d4, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x1070f848, pbOutput=0x2d50000, pcbResult=0x1070f618) returned 0x0 [0121.451] WriteFile (in: hFile=0x2c8, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1070f61c*=0x42e0, lpOverlapped=0x0) returned 1 [0121.451] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0121.451] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.451] WriteFile (in: hFile=0x2c8, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.451] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x42e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.451] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0121.451] CloseHandle (hObject=0x2c8) returned 1 [0121.456] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0xfe50000 [0121.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\proplusww.xml.play")) returned 1 [0121.457] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 80 os_tid = 0x11dc [0121.540] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.540] ReadFile (in: hFile=0x2c0, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.546] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.546] ReadFile (in: hFile=0x2c0, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xfe50000 [0121.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xfe50000) returned 0x0 [0121.547] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0121.547] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xfe50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0121.547] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xfe50000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0xfe50000, pcbResult=0x1084f500) returned 0x0 [0121.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xfe50230) returned 0x0 [0121.547] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xfe50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xfe50000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xfe50000, pcbResult=0x1084f500) returned 0x0 [0121.550] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.552] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.552] WriteFile (in: hFile=0x2c0, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0121.552] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.552] ReadFile (in: hFile=0x2c0, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1084f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.568] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.568] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2e50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x0 | out: hKey=0x76af70, pbIV=0x1084f848, pbOutput=0x2e50000, pcbResult=0x1084f618) returned 0x0 [0121.569] WriteFile (in: hFile=0x2c0, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1084f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.574] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0121.574] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.574] WriteFile (in: hFile=0x2c0, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.574] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.574] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xffeffbd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.574] ReadFile (in: hFile=0x2c0, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1084f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0122.032] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.032] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2e50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x1084f848, pbOutput=0x2e50000, pcbResult=0x1084f618) returned 0x0 [0122.033] WriteFile (in: hFile=0x2c0, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1084f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.040] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0122.040] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.040] WriteFile (in: hFile=0x2c0, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.040] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x13496c6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.040] WriteFile (in: hFile=0x2c0, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1084f82c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1084f82c*=0x2, lpOverlapped=0x0) returned 1 [0122.040] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0122.040] CloseHandle (hObject=0x2c0) returned 1 [0131.428] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww.cab.play")) returned 1 [0131.430] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 81 os_tid = 0x11a4 [0121.545] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.545] ReadFile (in: hFile=0x2ac, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.590] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.590] ReadFile (in: hFile=0x2ac, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.590] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xfe50000 [0121.591] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xfe50000) returned 0x0 [0121.591] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1098f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0121.591] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1098f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xfe50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1098f828, pbKeyObject=0x0) returned 0x0 [0121.591] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xfe50000, cbOutput=0x230, pcbResult=0x1098f500, dwFlags=0x0 | out: pbOutput=0xfe50000, pcbResult=0x1098f500) returned 0x0 [0121.592] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xfe50230) returned 0x0 [0121.592] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xfe50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xfe50000, cbOutput=0x400, pcbResult=0x1098f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xfe50000, pcbResult=0x1098f500) returned 0x0 [0121.597] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.599] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.599] WriteFile (in: hFile=0x2ac, lpBuffer=0x1098fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1098f830, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesWritten=0x1098f830*=0x428, lpOverlapped=0x0) returned 1 [0121.600] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.600] ReadFile (in: hFile=0x2ac, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1098f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.618] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.618] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x2f50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1098f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1098f618, dwFlags=0x0 | out: hKey=0x76b1e0, pbIV=0x1098f848, pbOutput=0x2f50000, pcbResult=0x1098f618) returned 0x0 [0121.620] WriteFile (in: hFile=0x2ac, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1098f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.624] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1098f60c | out: lpNewFilePointer=0x0) returned 1 [0121.624] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.624] WriteFile (in: hFile=0x2ac, lpBuffer=0x1098f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x1098f83c*, lpNumberOfBytesWritten=0x1098f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.625] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.625] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xffeffbcf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.625] ReadFile (in: hFile=0x2ac, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1098f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0121.683] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.683] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x2f50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1098f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1098f618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x1098f848, pbOutput=0x2f50000, pcbResult=0x1098f618) returned 0x0 [0121.684] WriteFile (in: hFile=0x2ac, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1098f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.690] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1098f60c | out: lpNewFilePointer=0x0) returned 1 [0121.691] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.691] WriteFile (in: hFile=0x2ac, lpBuffer=0x1098f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x1098f83c*, lpNumberOfBytesWritten=0x1098f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.691] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0xed9ced7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.691] WriteFile (in: hFile=0x2ac, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x1098f82c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1098f82c*=0x9, lpOverlapped=0x0) returned 1 [0121.691] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0121.691] CloseHandle (hObject=0x2ac) returned 1 [0131.492] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW2.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\propsww2.cab.play")) returned 1 [0131.495] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 82 os_tid = 0x118c [0121.589] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.589] ReadFile (in: hFile=0x2a4, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0121.709] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.709] ReadFile (in: hFile=0x2a4, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0121.709] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xfe50000 [0121.710] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xfe50000) returned 0x0 [0121.710] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0121.710] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xfe50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0121.711] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xfe50000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0xfe50000, pcbResult=0x10acf500) returned 0x0 [0121.711] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xfe50230) returned 0x0 [0121.711] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xfe50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xfe50000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xfe50000, pcbResult=0x10acf500) returned 0x0 [0121.716] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.717] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.718] WriteFile (in: hFile=0x2a4, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0121.718] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.718] ReadFile (in: hFile=0x2a4, lpBuffer=0x3050000, nNumberOfBytesToRead=0x6c86, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x10acf61c*=0x6c86, lpOverlapped=0x0) returned 1 [0121.720] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xffff937a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.720] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3050000, cbInput=0x6c86, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x10acf848, pbOutput=0x3050000, pcbResult=0x10acf618) returned 0x0 [0121.720] WriteFile (in: hFile=0x2a4, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x10acf61c*=0x6c90, lpOverlapped=0x0) returned 1 [0121.720] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0121.721] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.721] WriteFile (in: hFile=0x2a4, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0121.721] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x6c90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.721] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0121.721] CloseHandle (hObject=0x2a4) returned 1 [0121.723] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0xfe50000 [0121.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0011-0000-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0121.733] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 83 os_tid = 0x1210 [0121.735] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.735] ReadFile (in: hFile=0x29c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.737] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.737] ReadFile (in: hFile=0x29c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.737] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xfe50000 [0121.738] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xfe50000) returned 0x0 [0121.738] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0121.738] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xfe50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0121.738] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xfe50000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0xfe50000, pcbResult=0x10c0f500) returned 0x0 [0121.738] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xfe50230) returned 0x0 [0121.738] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xfe50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xfe50000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xfe50000, pcbResult=0x10c0f500) returned 0x0 [0121.742] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.743] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.743] WriteFile (in: hFile=0x29c, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0121.743] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.743] ReadFile (in: hFile=0x29c, lpBuffer=0x3150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x10c0f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.759] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.759] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x0 | out: hKey=0x76b1e0, pbIV=0x10c0f848, pbOutput=0x3150000, pcbResult=0x10c0f618) returned 0x0 [0121.760] WriteFile (in: hFile=0x29c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x10c0f61c*=0x100000, lpOverlapped=0x0) returned 1 [0121.764] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0121.764] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.764] WriteFile (in: hFile=0x29c, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.764] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.764] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xffeffbd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.764] ReadFile (in: hFile=0x29c, lpBuffer=0x3150000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x10c0f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0122.113] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.113] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3150000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x10c0f848, pbOutput=0x3150000, pcbResult=0x10c0f618) returned 0x0 [0122.114] WriteFile (in: hFile=0x29c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x10c0f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.121] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0122.121] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.121] WriteFile (in: hFile=0x29c, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.121] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x58096e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.122] WriteFile (in: hFile=0x29c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x10c0f82c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x10c0f82c*=0x2, lpOverlapped=0x0) returned 1 [0122.122] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0122.122] CloseHandle (hObject=0x29c) returned 1 [0129.064] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0129.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excellr.cab.play")) returned 1 [0129.067] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 84 os_tid = 0x120c [0121.749] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.749] ReadFile (in: hFile=0x294, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.787] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xfe50000 [0121.788] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xfe50000) returned 0x0 [0121.788] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0121.788] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xfe50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0121.788] BCryptExportKey (in: hKey=0x76b460, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xfe50000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0xfe50000, pcbResult=0x10d4f500) returned 0x0 [0121.788] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xfe50230) returned 0x0 [0121.789] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xfe50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xfe50000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xfe50000, pcbResult=0x10d4f500) returned 0x0 [0121.792] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.793] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.793] WriteFile (in: hFile=0x294, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0121.793] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.794] ReadFile (in: hFile=0x294, lpBuffer=0x3250000, nNumberOfBytesToRead=0x6f4, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10d4f61c*=0x6f4, lpOverlapped=0x0) returned 1 [0121.794] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0xfffff90c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.794] BCryptEncrypt (in: hKey=0x76b460, pbInput=0x3250000, cbInput=0x6f4, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x76b460, pbIV=0x10d4f848, pbOutput=0x3250000, pcbResult=0x10d4f618) returned 0x0 [0121.794] WriteFile (in: hFile=0x294, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10d4f61c*=0x700, lpOverlapped=0x0) returned 1 [0121.794] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0121.794] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.794] WriteFile (in: hFile=0x294, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.794] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0x700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.794] BCryptDestroyKey (in: hKey=0x76b460 | out: hKey=0x76b460) returned 0x0 [0121.794] CloseHandle (hObject=0x294) returned 1 [0121.795] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0xfe50000 [0121.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml.play")) returned 1 [0121.798] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 85 os_tid = 0x1208 [0121.800] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.801] ReadFile (in: hFile=0x28c, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.802] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.802] ReadFile (in: hFile=0x28c, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0121.802] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xfe50000 [0121.803] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xfe50000) returned 0x0 [0121.804] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0121.804] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xfe50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0121.804] BCryptExportKey (in: hKey=0x76b460, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xfe50000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0xfe50000, pcbResult=0x10e8f500) returned 0x0 [0121.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xfe50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xfe50230) returned 0x0 [0121.804] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xfe50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xfe50000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xfe50000, pcbResult=0x10e8f500) returned 0x0 [0121.807] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.809] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.809] WriteFile (in: hFile=0x28c, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0121.809] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.809] ReadFile (in: hFile=0x28c, lpBuffer=0x3350000, nNumberOfBytesToRead=0x9b2, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x10e8f61c*=0x9b2, lpOverlapped=0x0) returned 1 [0121.809] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffff64e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.809] BCryptEncrypt (in: hKey=0x76b460, pbInput=0x3350000, cbInput=0x9b2, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x76b460, pbIV=0x10e8f848, pbOutput=0x3350000, pcbResult=0x10e8f618) returned 0x0 [0121.809] WriteFile (in: hFile=0x28c, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x10e8f61c*=0x9c0, lpOverlapped=0x0) returned 1 [0121.809] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0121.810] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.810] WriteFile (in: hFile=0x28c, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0121.810] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x9c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.810] BCryptDestroyKey (in: hKey=0x76b460 | out: hKey=0x76b460) returned 0x0 [0121.810] CloseHandle (hObject=0x28c) returned 1 [0121.811] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0xfe50000 [0121.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0016-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0121.812] VirtualFree (lpAddress=0xfe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 86 os_tid = 0x11fc [0121.868] GetLastError () returned 0x57 [0121.869] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7610b8 [0121.869] SetLastError (dwErrCode=0x57) [0121.869] IcmpCreateFile () returned 0x75d188 [0121.869] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765338 [0121.869] IcmpSendEcho2 (in: IcmpHandle=0x75d188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4100a8c0, RequestData=0x10fcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765338, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765338) returned 0x0 [0135.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765338 | out: hHeap=0x710000) returned 1 [0135.835] IcmpCloseHandle (IcmpHandle=0x75d188) returned 1 [0135.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7610b8 | out: hHeap=0x710000) returned 1 Thread: id = 87 os_tid = 0x1204 [0121.870] GetLastError () returned 0x57 [0121.870] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x761440 [0121.870] SetLastError (dwErrCode=0x57) [0121.870] IcmpCreateFile () returned 0x75d1f8 [0121.870] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765388 [0121.870] IcmpSendEcho2 (in: IcmpHandle=0x75d1f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4200a8c0, RequestData=0x1110ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765388, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765388) returned 0x0 [0135.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765388 | out: hHeap=0x710000) returned 1 [0135.858] IcmpCloseHandle (IcmpHandle=0x75d1f8) returned 1 [0135.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x761440 | out: hHeap=0x710000) returned 1 Thread: id = 88 os_tid = 0x1200 [0121.871] GetLastError () returned 0x57 [0121.871] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75d838 [0121.872] SetLastError (dwErrCode=0x57) [0121.872] IcmpCreateFile () returned 0x75d268 [0121.872] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7653d8 [0121.872] IcmpSendEcho2 (in: IcmpHandle=0x75d268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4300a8c0, RequestData=0x1124ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7653d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7653d8) returned 0x0 [0135.866] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7653d8 | out: hHeap=0x710000) returned 1 [0135.866] IcmpCloseHandle (IcmpHandle=0x75d268) returned 1 [0135.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75d838 | out: hHeap=0x710000) returned 1 Thread: id = 89 os_tid = 0x11f8 [0121.873] GetLastError () returned 0x57 [0121.873] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75dbc0 [0121.873] SetLastError (dwErrCode=0x57) [0121.873] IcmpCreateFile () returned 0x75d2a0 [0121.873] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765478 [0121.873] IcmpSendEcho2 (in: IcmpHandle=0x75d2a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4400a8c0, RequestData=0x1138ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765478, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765478) returned 0x0 [0135.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765478 | out: hHeap=0x710000) returned 1 [0135.879] IcmpCloseHandle (IcmpHandle=0x75d2a0) returned 1 [0135.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75dbc0 | out: hHeap=0x710000) returned 1 Thread: id = 90 os_tid = 0x1244 [0121.874] GetLastError () returned 0x57 [0121.874] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75df48 [0121.874] SetLastError (dwErrCode=0x57) [0121.874] IcmpCreateFile () returned 0x75d2d8 [0121.874] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765518 [0121.874] IcmpSendEcho2 (in: IcmpHandle=0x75d2d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4500a8c0, RequestData=0x114cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765518, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765518) returned 0x0 [0135.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765518 | out: hHeap=0x710000) returned 1 [0135.887] IcmpCloseHandle (IcmpHandle=0x75d2d8) returned 1 [0135.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75df48 | out: hHeap=0x710000) returned 1 Thread: id = 91 os_tid = 0x1240 [0121.875] GetLastError () returned 0x57 [0121.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e658 [0121.875] SetLastError (dwErrCode=0x57) [0121.875] IcmpCreateFile () returned 0x75d310 [0121.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b7a8 [0121.875] IcmpSendEcho2 (in: IcmpHandle=0x75d310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4600a8c0, RequestData=0x1160ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b7a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b7a8) returned 0x0 [0135.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b7a8 | out: hHeap=0x710000) returned 1 [0135.897] IcmpCloseHandle (IcmpHandle=0x75d310) returned 1 [0135.898] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75e658 | out: hHeap=0x710000) returned 1 Thread: id = 92 os_tid = 0x123c [0121.876] GetLastError () returned 0x57 [0121.876] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e9e0 [0121.876] SetLastError (dwErrCode=0x57) [0121.877] IcmpCreateFile () returned 0x75d508 [0121.877] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b848 [0121.877] IcmpSendEcho2 (in: IcmpHandle=0x75d508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4700a8c0, RequestData=0x1174ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b848, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b848) returned 0x0 [0135.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b848 | out: hHeap=0x710000) returned 1 [0135.905] IcmpCloseHandle (IcmpHandle=0x75d508) returned 1 [0135.906] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75e9e0 | out: hHeap=0x710000) returned 1 Thread: id = 93 os_tid = 0x1230 [0121.877] GetLastError () returned 0x57 [0121.878] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f478 [0121.878] SetLastError (dwErrCode=0x57) [0121.878] IcmpCreateFile () returned 0x75d620 [0121.878] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b898 [0121.878] IcmpSendEcho2 (in: IcmpHandle=0x75d620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4800a8c0, RequestData=0x1188ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b898, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b898) returned 0x0 [0135.915] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b898 | out: hHeap=0x710000) returned 1 [0135.915] IcmpCloseHandle (IcmpHandle=0x75d620) returned 1 [0135.916] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75f478 | out: hHeap=0x710000) returned 1 Thread: id = 94 os_tid = 0x1238 [0121.879] GetLastError () returned 0x57 [0121.879] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f800 [0121.879] SetLastError (dwErrCode=0x57) [0121.879] IcmpCreateFile () returned 0x75d658 [0121.879] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b8e8 [0121.879] IcmpSendEcho2 (in: IcmpHandle=0x75d658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4900a8c0, RequestData=0x119cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b8e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b8e8) returned 0x0 [0135.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b8e8 | out: hHeap=0x710000) returned 1 [0135.924] IcmpCloseHandle (IcmpHandle=0x75d658) returned 1 [0135.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75f800 | out: hHeap=0x710000) returned 1 Thread: id = 95 os_tid = 0x1234 [0121.881] GetLastError () returned 0x57 [0121.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75fb88 [0121.881] SetLastError (dwErrCode=0x57) [0121.881] IcmpCreateFile () returned 0x75d690 [0121.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b938 [0121.881] IcmpSendEcho2 (in: IcmpHandle=0x75d690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4a00a8c0, RequestData=0x11b0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b938, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b938) returned 0x0 [0135.935] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b938 | out: hHeap=0x710000) returned 1 [0135.935] IcmpCloseHandle (IcmpHandle=0x75d690) returned 1 [0135.935] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75fb88 | out: hHeap=0x710000) returned 1 Thread: id = 96 os_tid = 0x122c [0121.882] GetLastError () returned 0x57 [0121.882] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75ff10 [0121.882] SetLastError (dwErrCode=0x57) [0121.882] IcmpCreateFile () returned 0x75d6c8 [0121.882] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b988 [0121.882] IcmpSendEcho2 (in: IcmpHandle=0x75d6c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4b00a8c0, RequestData=0x11c4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b988, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b988) returned 0x0 [0135.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b988 | out: hHeap=0x710000) returned 1 [0135.947] IcmpCloseHandle (IcmpHandle=0x75d6c8) returned 1 [0135.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75ff10 | out: hHeap=0x710000) returned 1 Thread: id = 97 os_tid = 0x1048 [0121.885] GetLastError () returned 0x57 [0121.885] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760298 [0121.885] SetLastError (dwErrCode=0x57) [0121.885] IcmpCreateFile () returned 0x75d498 [0121.886] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba78 [0121.886] IcmpSendEcho2 (in: IcmpHandle=0x75d498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4c00a8c0, RequestData=0x11d8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76ba78) returned 0x0 [0135.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76ba78 | out: hHeap=0x710000) returned 1 [0135.957] IcmpCloseHandle (IcmpHandle=0x75d498) returned 1 [0135.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x760298 | out: hHeap=0x710000) returned 1 Thread: id = 98 os_tid = 0x328 [0121.886] GetLastError () returned 0x57 [0121.887] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760620 [0121.887] SetLastError (dwErrCode=0x57) [0121.887] IcmpCreateFile () returned 0x75d348 [0121.887] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc08 [0121.887] IcmpSendEcho2 (in: IcmpHandle=0x75d348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4d00a8c0, RequestData=0x11ecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bc08) returned 0x0 [0135.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bc08 | out: hHeap=0x710000) returned 1 [0135.967] IcmpCloseHandle (IcmpHandle=0x75d348) returned 1 [0135.968] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x760620 | out: hHeap=0x710000) returned 1 Thread: id = 99 os_tid = 0x4ac [0121.888] GetLastError () returned 0x57 [0121.888] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7609a8 [0121.888] SetLastError (dwErrCode=0x57) [0121.888] IcmpCreateFile () returned 0x75d380 [0121.888] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc58 [0121.888] IcmpSendEcho2 (in: IcmpHandle=0x75d380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4e00a8c0, RequestData=0x1200ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bc58) returned 0x0 [0135.977] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bc58 | out: hHeap=0x710000) returned 1 [0135.977] IcmpCloseHandle (IcmpHandle=0x75d380) returned 1 [0135.978] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7609a8 | out: hHeap=0x710000) returned 1 Thread: id = 100 os_tid = 0xab4 [0121.890] GetLastError () returned 0x57 [0121.890] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760d30 [0121.890] SetLastError (dwErrCode=0x57) [0121.890] IcmpCreateFile () returned 0x75d700 [0121.890] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bac8 [0121.890] IcmpSendEcho2 (in: IcmpHandle=0x75d700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4f00a8c0, RequestData=0x1214ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bac8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bac8) returned 0x0 [0135.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bac8 | out: hHeap=0x710000) returned 1 [0135.987] IcmpCloseHandle (IcmpHandle=0x75d700) returned 1 [0135.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x760d30 | out: hHeap=0x710000) returned 1 Thread: id = 101 os_tid = 0x480 [0121.891] GetLastError () returned 0x57 [0121.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771d48 [0121.892] SetLastError (dwErrCode=0x57) [0121.892] IcmpCreateFile () returned 0x75d070 [0121.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bde8 [0121.892] IcmpSendEcho2 (in: IcmpHandle=0x75d070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5000a8c0, RequestData=0x1228ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bde8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bde8) returned 0x0 [0136.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bde8 | out: hHeap=0x710000) returned 1 [0136.012] IcmpCloseHandle (IcmpHandle=0x75d070) returned 1 [0136.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x771d48 | out: hHeap=0x710000) returned 1 Thread: id = 102 os_tid = 0x2f8 [0121.893] GetLastError () returned 0x57 [0121.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7720d0 [0121.893] SetLastError (dwErrCode=0x57) [0121.893] IcmpCreateFile () returned 0x75d0a8 [0121.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be38 [0121.893] IcmpSendEcho2 (in: IcmpHandle=0x75d0a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5100a8c0, RequestData=0x123cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76be38) returned 0x0 [0136.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76be38 | out: hHeap=0x710000) returned 1 [0136.019] IcmpCloseHandle (IcmpHandle=0x75d0a8) returned 1 [0136.020] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7720d0 | out: hHeap=0x710000) returned 1 Thread: id = 103 os_tid = 0x66c [0121.894] GetLastError () returned 0x57 [0121.894] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772b68 [0121.895] SetLastError (dwErrCode=0x57) [0121.895] IcmpCreateFile () returned 0x75d0e0 [0121.895] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b9d8 [0121.895] IcmpSendEcho2 (in: IcmpHandle=0x75d0e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5200a8c0, RequestData=0x1250ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b9d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b9d8) returned 0x0 [0136.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b9d8 | out: hHeap=0x710000) returned 1 [0136.025] IcmpCloseHandle (IcmpHandle=0x75d0e0) returned 1 [0136.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x772b68 | out: hHeap=0x710000) returned 1 Thread: id = 104 os_tid = 0x474 [0121.896] GetLastError () returned 0x57 [0121.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772ef0 [0121.896] SetLastError (dwErrCode=0x57) [0121.896] IcmpCreateFile () returned 0x75d118 [0121.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b7f8 [0121.896] IcmpSendEcho2 (in: IcmpHandle=0x75d118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5300a8c0, RequestData=0x1264ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b7f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b7f8) returned 0x0 [0136.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b7f8 | out: hHeap=0x710000) returned 1 [0136.031] IcmpCloseHandle (IcmpHandle=0x75d118) returned 1 [0136.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x772ef0 | out: hHeap=0x710000) returned 1 Thread: id = 105 os_tid = 0xbac [0121.897] GetLastError () returned 0x57 [0121.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773278 [0121.898] SetLastError (dwErrCode=0x57) [0121.898] IcmpCreateFile () returned 0x75d7a8 [0121.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba28 [0121.898] IcmpSendEcho2 (in: IcmpHandle=0x75d7a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5400a8c0, RequestData=0x1278ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76ba28) returned 0x0 [0136.037] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76ba28 | out: hHeap=0x710000) returned 1 [0136.038] IcmpCloseHandle (IcmpHandle=0x75d7a8) returned 1 [0136.038] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773278 | out: hHeap=0x710000) returned 1 Thread: id = 106 os_tid = 0xb5c [0121.899] GetLastError () returned 0x57 [0121.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773600 [0121.899] SetLastError (dwErrCode=0x57) [0121.899] IcmpCreateFile () returned 0x75d738 [0121.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb18 [0121.899] IcmpSendEcho2 (in: IcmpHandle=0x75d738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5500a8c0, RequestData=0x128cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bb18) returned 0x0 [0136.135] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bb18 | out: hHeap=0x710000) returned 1 [0136.135] IcmpCloseHandle (IcmpHandle=0x75d738) returned 1 [0136.135] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773600 | out: hHeap=0x710000) returned 1 Thread: id = 107 os_tid = 0x8cc [0121.900] GetLastError () returned 0x57 [0121.900] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773988 [0121.900] SetLastError (dwErrCode=0x57) [0121.900] IcmpCreateFile () returned 0x75d770 [0121.900] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb68 [0121.900] IcmpSendEcho2 (in: IcmpHandle=0x75d770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5600a8c0, RequestData=0x12a0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bb68) returned 0x0 [0136.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bb68 | out: hHeap=0x710000) returned 1 [0136.188] IcmpCloseHandle (IcmpHandle=0x75d770) returned 1 [0136.189] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773988 | out: hHeap=0x710000) returned 1 Thread: id = 108 os_tid = 0xb54 [0121.901] GetLastError () returned 0x57 [0121.901] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773d10 [0121.902] SetLastError (dwErrCode=0x57) [0121.902] IcmpCreateFile () returned 0x74ef08 [0121.902] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bbb8 [0121.902] IcmpSendEcho2 (in: IcmpHandle=0x74ef08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5700a8c0, RequestData=0x12b4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bbb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bbb8) returned 0x0 [0136.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bbb8 | out: hHeap=0x710000) returned 1 [0136.194] IcmpCloseHandle (IcmpHandle=0x74ef08) returned 1 [0136.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773d10 | out: hHeap=0x710000) returned 1 Thread: id = 109 os_tid = 0xb10 [0121.903] GetLastError () returned 0x57 [0121.903] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x774098 [0121.903] SetLastError (dwErrCode=0x57) [0121.903] IcmpCreateFile () returned 0x775868 [0121.903] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bca8 [0121.903] IcmpSendEcho2 (in: IcmpHandle=0x775868, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5800a8c0, RequestData=0x12c8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bca8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bca8) returned 0x0 [0136.202] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bca8 | out: hHeap=0x710000) returned 1 [0136.202] IcmpCloseHandle (IcmpHandle=0x775868) returned 1 [0136.203] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774098 | out: hHeap=0x710000) returned 1 Thread: id = 110 os_tid = 0x810 [0121.904] GetLastError () returned 0x57 [0121.904] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770490 [0121.904] SetLastError (dwErrCode=0x57) [0121.904] IcmpCreateFile () returned 0x775ad0 [0121.904] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bcf8 [0121.904] IcmpSendEcho2 (in: IcmpHandle=0x775ad0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5900a8c0, RequestData=0x12dcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bcf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bcf8) returned 0x0 [0136.206] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bcf8 | out: hHeap=0x710000) returned 1 [0136.206] IcmpCloseHandle (IcmpHandle=0x775ad0) returned 1 [0136.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770490 | out: hHeap=0x710000) returned 1 Thread: id = 111 os_tid = 0xb28 [0121.905] GetLastError () returned 0x57 [0121.905] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770818 [0121.905] SetLastError (dwErrCode=0x57) [0121.905] IcmpCreateFile () returned 0x775b08 [0121.905] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd48 [0121.905] IcmpSendEcho2 (in: IcmpHandle=0x775b08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5a00a8c0, RequestData=0x12f0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bd48) returned 0x0 [0136.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bd48 | out: hHeap=0x710000) returned 1 [0136.210] IcmpCloseHandle (IcmpHandle=0x775b08) returned 1 [0136.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770818 | out: hHeap=0x710000) returned 1 Thread: id = 112 os_tid = 0xbb0 [0121.911] GetLastError () returned 0x57 [0121.911] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772458 [0121.912] SetLastError (dwErrCode=0x57) [0121.912] IcmpCreateFile () returned 0x7758a0 [0121.912] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd98 [0121.912] IcmpSendEcho2 (in: IcmpHandle=0x7758a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5b00a8c0, RequestData=0x1304ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bd98) returned 0x0 [0136.323] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bd98 | out: hHeap=0x710000) returned 1 [0136.323] IcmpCloseHandle (IcmpHandle=0x7758a0) returned 1 [0136.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x772458 | out: hHeap=0x710000) returned 1 Thread: id = 113 os_tid = 0xab8 [0121.913] GetLastError () returned 0x57 [0121.913] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770ba0 [0121.913] SetLastError (dwErrCode=0x57) [0121.913] IcmpCreateFile () returned 0x775b40 [0121.913] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b488 [0121.913] IcmpSendEcho2 (in: IcmpHandle=0x775b40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5c00a8c0, RequestData=0x1318ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b488, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b488) returned 0x0 [0136.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b488 | out: hHeap=0x710000) returned 1 [0136.371] IcmpCloseHandle (IcmpHandle=0x775b40) returned 1 [0136.372] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770ba0 | out: hHeap=0x710000) returned 1 Thread: id = 114 os_tid = 0x3b8 [0121.914] GetLastError () returned 0x57 [0121.914] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770f28 [0121.914] SetLastError (dwErrCode=0x57) [0121.914] IcmpCreateFile () returned 0x775b78 [0121.914] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b4d8 [0121.914] IcmpSendEcho2 (in: IcmpHandle=0x775b78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5d00a8c0, RequestData=0x132cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b4d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b4d8) returned 0x0 [0136.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b4d8 | out: hHeap=0x710000) returned 1 [0136.379] IcmpCloseHandle (IcmpHandle=0x775b78) returned 1 [0136.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770f28 | out: hHeap=0x710000) returned 1 Thread: id = 115 os_tid = 0x8c8 [0121.916] GetLastError () returned 0x57 [0121.916] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7712b0 [0121.916] SetLastError (dwErrCode=0x57) [0121.916] IcmpCreateFile () returned 0x7754b0 [0121.916] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b528 [0121.916] IcmpSendEcho2 (in: IcmpHandle=0x7754b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5e00a8c0, RequestData=0x1340ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b528, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b528) returned 0x0 [0136.388] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b528 | out: hHeap=0x710000) returned 1 [0136.388] IcmpCloseHandle (IcmpHandle=0x7754b0) returned 1 [0136.389] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7712b0 | out: hHeap=0x710000) returned 1 Thread: id = 116 os_tid = 0x4ec [0121.917] GetLastError () returned 0x57 [0121.917] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771638 [0121.917] SetLastError (dwErrCode=0x57) [0121.917] IcmpCreateFile () returned 0x7754e8 [0121.917] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b578 [0121.917] IcmpSendEcho2 (in: IcmpHandle=0x7754e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5f00a8c0, RequestData=0x1354ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b578, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b578) returned 0x0 [0136.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b578 | out: hHeap=0x710000) returned 1 [0136.397] IcmpCloseHandle (IcmpHandle=0x7754e8) returned 1 [0136.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x771638 | out: hHeap=0x710000) returned 1 Thread: id = 117 os_tid = 0x8b8 [0121.918] GetLastError () returned 0x57 [0121.918] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7719c0 [0121.918] SetLastError (dwErrCode=0x57) [0121.918] IcmpCreateFile () returned 0x775520 [0121.918] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b5c8 [0121.918] IcmpSendEcho2 (in: IcmpHandle=0x775520, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6000a8c0, RequestData=0x1368ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b5c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b5c8) returned 0x0 [0136.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b5c8 | out: hHeap=0x710000) returned 1 [0136.401] IcmpCloseHandle (IcmpHandle=0x775520) returned 1 [0136.402] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7719c0 | out: hHeap=0x710000) returned 1 Thread: id = 118 os_tid = 0x530 [0121.919] GetLastError () returned 0x57 [0121.920] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7727e0 [0121.920] SetLastError (dwErrCode=0x57) [0121.920] IcmpCreateFile () returned 0x775558 [0121.920] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b618 [0121.920] IcmpSendEcho2 (in: IcmpHandle=0x775558, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6100a8c0, RequestData=0x137cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b618, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b618) returned 0x0 [0136.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b618 | out: hHeap=0x710000) returned 1 [0136.407] IcmpCloseHandle (IcmpHandle=0x775558) returned 1 [0136.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7727e0 | out: hHeap=0x710000) returned 1 Thread: id = 119 os_tid = 0x398 [0121.921] GetLastError () returned 0x57 [0121.921] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7780f8 [0121.922] SetLastError (dwErrCode=0x57) [0121.922] IcmpCreateFile () returned 0x775590 [0121.922] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b758 [0121.922] IcmpSendEcho2 (in: IcmpHandle=0x775590, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6200a8c0, RequestData=0x1390ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b758, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b758) returned 0x0 [0136.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b758 | out: hHeap=0x710000) returned 1 [0136.412] IcmpCloseHandle (IcmpHandle=0x775590) returned 1 [0136.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7780f8 | out: hHeap=0x710000) returned 1 Thread: id = 120 os_tid = 0x39c [0121.923] GetLastError () returned 0x57 [0121.923] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x778b90 [0121.923] SetLastError (dwErrCode=0x57) [0121.923] IcmpCreateFile () returned 0x7755c8 [0121.924] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b668 [0121.924] IcmpSendEcho2 (in: IcmpHandle=0x7755c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6300a8c0, RequestData=0x13a4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b668, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b668) returned 0x0 [0136.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b668 | out: hHeap=0x710000) returned 1 [0136.418] IcmpCloseHandle (IcmpHandle=0x7755c8) returned 1 [0136.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x778b90 | out: hHeap=0x710000) returned 1 Thread: id = 121 os_tid = 0xcfc [0121.925] GetLastError () returned 0x57 [0121.925] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x778f18 [0121.925] SetLastError (dwErrCode=0x57) [0121.925] IcmpCreateFile () returned 0x775600 [0121.925] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b6b8 [0121.925] IcmpSendEcho2 (in: IcmpHandle=0x775600, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6400a8c0, RequestData=0x13b8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b6b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b6b8) returned 0x0 [0136.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b6b8 | out: hHeap=0x710000) returned 1 [0136.421] IcmpCloseHandle (IcmpHandle=0x775600) returned 1 [0136.422] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x778f18 | out: hHeap=0x710000) returned 1 Thread: id = 122 os_tid = 0xd00 [0121.926] GetLastError () returned 0x57 [0121.926] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7792a0 [0121.926] SetLastError (dwErrCode=0x57) [0121.926] IcmpCreateFile () returned 0x775638 [0121.926] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b708 [0121.926] IcmpSendEcho2 (in: IcmpHandle=0x775638, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6500a8c0, RequestData=0x13ccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b708, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b708) returned 0x0 [0136.425] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b708 | out: hHeap=0x710000) returned 1 [0136.425] IcmpCloseHandle (IcmpHandle=0x775638) returned 1 [0136.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7792a0 | out: hHeap=0x710000) returned 1 Thread: id = 123 os_tid = 0xd04 [0121.927] GetLastError () returned 0x57 [0121.927] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x779628 [0121.928] SetLastError (dwErrCode=0x57) [0121.928] IcmpCreateFile () returned 0x775670 [0121.928] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c108 [0121.928] IcmpSendEcho2 (in: IcmpHandle=0x775670, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6600a8c0, RequestData=0x13e0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c108, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c108) returned 0x0 [0136.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c108 | out: hHeap=0x710000) returned 1 [0136.475] IcmpCloseHandle (IcmpHandle=0x775670) returned 1 [0136.476] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x779628 | out: hHeap=0x710000) returned 1 Thread: id = 124 os_tid = 0xd08 [0121.929] GetLastError () returned 0x57 [0121.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x778480 [0121.929] SetLastError (dwErrCode=0x57) [0121.929] IcmpCreateFile () returned 0x7756a8 [0121.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c018 [0121.929] IcmpSendEcho2 (in: IcmpHandle=0x7756a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6700a8c0, RequestData=0x13f4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c018, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c018) returned 0x0 [0136.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c018 | out: hHeap=0x710000) returned 1 [0136.481] IcmpCloseHandle (IcmpHandle=0x7756a8) returned 1 [0136.482] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x778480 | out: hHeap=0x710000) returned 1 Thread: id = 125 os_tid = 0xd0c [0121.930] GetLastError () returned 0x57 [0121.930] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x776bc8 [0121.930] SetLastError (dwErrCode=0x57) [0121.930] IcmpCreateFile () returned 0x7756e0 [0121.930] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c158 [0121.930] IcmpSendEcho2 (in: IcmpHandle=0x7756e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6800a8c0, RequestData=0x1408ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c158, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c158) returned 0x0 [0136.485] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c158 | out: hHeap=0x710000) returned 1 [0136.485] IcmpCloseHandle (IcmpHandle=0x7756e0) returned 1 [0136.485] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x776bc8 | out: hHeap=0x710000) returned 1 Thread: id = 126 os_tid = 0xd10 [0121.932] GetLastError () returned 0x57 [0121.932] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7799b0 [0121.933] SetLastError (dwErrCode=0x57) [0121.933] IcmpCreateFile () returned 0x775718 [0121.933] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf78 [0121.933] IcmpSendEcho2 (in: IcmpHandle=0x775718, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6900a8c0, RequestData=0x141cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bf78) returned 0x0 [0136.488] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bf78 | out: hHeap=0x710000) returned 1 [0136.488] IcmpCloseHandle (IcmpHandle=0x775718) returned 1 [0136.489] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7799b0 | out: hHeap=0x710000) returned 1 Thread: id = 127 os_tid = 0xd14 [0121.934] GetLastError () returned 0x57 [0121.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x779d38 [0121.934] SetLastError (dwErrCode=0x57) [0121.934] IcmpCreateFile () returned 0x775750 [0121.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bfc8 [0121.934] IcmpSendEcho2 (in: IcmpHandle=0x775750, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6a00a8c0, RequestData=0x1430ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bfc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bfc8) returned 0x0 [0136.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bfc8 | out: hHeap=0x710000) returned 1 [0136.496] IcmpCloseHandle (IcmpHandle=0x775750) returned 1 [0136.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x779d38 | out: hHeap=0x710000) returned 1 Thread: id = 128 os_tid = 0xd28 [0121.935] GetLastError () returned 0x57 [0121.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x778808 [0121.935] SetLastError (dwErrCode=0x57) [0121.935] IcmpCreateFile () returned 0x7759f0 [0121.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c2e8 [0121.935] IcmpSendEcho2 (in: IcmpHandle=0x7759f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6b00a8c0, RequestData=0x1444ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c2e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c2e8) returned 0x0 [0136.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c2e8 | out: hHeap=0x710000) returned 1 [0136.501] IcmpCloseHandle (IcmpHandle=0x7759f0) returned 1 [0136.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x778808 | out: hHeap=0x710000) returned 1 Thread: id = 129 os_tid = 0xd2c [0121.937] GetLastError () returned 0x57 [0121.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77a0c0 [0121.937] SetLastError (dwErrCode=0x57) [0121.937] IcmpCreateFile () returned 0x775788 [0121.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c068 [0121.937] IcmpSendEcho2 (in: IcmpHandle=0x775788, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6c00a8c0, RequestData=0x1458ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c068, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c068) returned 0x0 [0136.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c068 | out: hHeap=0x710000) returned 1 [0136.505] IcmpCloseHandle (IcmpHandle=0x775788) returned 1 [0136.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x77a0c0 | out: hHeap=0x710000) returned 1 Thread: id = 130 os_tid = 0xd30 [0121.938] GetLastError () returned 0x57 [0121.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x776840 [0121.938] SetLastError (dwErrCode=0x57) [0121.938] IcmpCreateFile () returned 0x775a28 [0121.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c338 [0121.939] IcmpSendEcho2 (in: IcmpHandle=0x775a28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6d00a8c0, RequestData=0x146cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c338, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c338) returned 0x0 [0136.508] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c338 | out: hHeap=0x710000) returned 1 [0136.508] IcmpCloseHandle (IcmpHandle=0x775a28) returned 1 [0136.509] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x776840 | out: hHeap=0x710000) returned 1 Thread: id = 131 os_tid = 0xd34 [0121.940] GetLastError () returned 0x57 [0121.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x776f50 [0121.940] SetLastError (dwErrCode=0x57) [0121.940] IcmpCreateFile () returned 0x775a60 [0121.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c388 [0121.940] IcmpSendEcho2 (in: IcmpHandle=0x775a60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6e00a8c0, RequestData=0x1480ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c388, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c388) returned 0x0 [0136.512] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c388 | out: hHeap=0x710000) returned 1 [0136.512] IcmpCloseHandle (IcmpHandle=0x775a60) returned 1 [0136.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x776f50 | out: hHeap=0x710000) returned 1 Thread: id = 132 os_tid = 0xd38 [0121.941] GetLastError () returned 0x57 [0121.941] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7772d8 [0121.941] SetLastError (dwErrCode=0x57) [0121.941] IcmpCreateFile () returned 0x775a98 [0121.941] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c3d8 [0121.941] IcmpSendEcho2 (in: IcmpHandle=0x775a98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6f00a8c0, RequestData=0x1494ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c3d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c3d8) returned 0x0 [0136.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c3d8 | out: hHeap=0x710000) returned 1 [0136.516] IcmpCloseHandle (IcmpHandle=0x775a98) returned 1 [0136.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7772d8 | out: hHeap=0x710000) returned 1 Thread: id = 133 os_tid = 0xd3c [0121.942] GetLastError () returned 0x57 [0121.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x777660 [0121.943] SetLastError (dwErrCode=0x57) [0121.943] IcmpCreateFile () returned 0x7757c0 [0121.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be88 [0121.943] IcmpSendEcho2 (in: IcmpHandle=0x7757c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7000a8c0, RequestData=0x14a8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76be88) returned 0x0 [0136.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76be88 | out: hHeap=0x710000) returned 1 [0136.519] IcmpCloseHandle (IcmpHandle=0x7757c0) returned 1 [0136.520] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x777660 | out: hHeap=0x710000) returned 1 Thread: id = 134 os_tid = 0xd40 [0121.944] GetLastError () returned 0x57 [0121.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7779e8 [0121.944] SetLastError (dwErrCode=0x57) [0121.944] IcmpCreateFile () returned 0x7757f8 [0121.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bed8 [0121.944] IcmpSendEcho2 (in: IcmpHandle=0x7757f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7100a8c0, RequestData=0x14bcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bed8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bed8) returned 0x0 [0136.523] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bed8 | out: hHeap=0x710000) returned 1 [0136.523] IcmpCloseHandle (IcmpHandle=0x7757f8) returned 1 [0136.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7779e8 | out: hHeap=0x710000) returned 1 Thread: id = 135 os_tid = 0xd44 [0121.945] GetLastError () returned 0x57 [0121.945] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x777d70 [0121.945] SetLastError (dwErrCode=0x57) [0121.945] IcmpCreateFile () returned 0x775830 [0121.945] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf28 [0121.945] IcmpSendEcho2 (in: IcmpHandle=0x775830, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7200a8c0, RequestData=0x14d0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bf28) returned 0x0 [0136.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bf28 | out: hHeap=0x710000) returned 1 [0136.526] IcmpCloseHandle (IcmpHandle=0x775830) returned 1 [0136.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x777d70 | out: hHeap=0x710000) returned 1 Thread: id = 136 os_tid = 0xd48 [0121.946] GetLastError () returned 0x57 [0121.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7764b8 [0121.946] SetLastError (dwErrCode=0x57) [0121.946] IcmpCreateFile () returned 0x7758d8 [0121.947] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c0b8 [0121.947] IcmpSendEcho2 (in: IcmpHandle=0x7758d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7300a8c0, RequestData=0x14e4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c0b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c0b8) returned 0x0 [0136.533] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c0b8 | out: hHeap=0x710000) returned 1 [0136.533] IcmpCloseHandle (IcmpHandle=0x7758d8) returned 1 [0136.533] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7764b8 | out: hHeap=0x710000) returned 1 Thread: id = 137 os_tid = 0xd4c [0121.948] GetLastError () returned 0x57 [0121.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x782e48 [0121.949] SetLastError (dwErrCode=0x57) [0121.949] IcmpCreateFile () returned 0x775910 [0121.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c1a8 [0121.949] IcmpSendEcho2 (in: IcmpHandle=0x775910, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7400a8c0, RequestData=0x14f8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c1a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c1a8) returned 0x0 [0136.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c1a8 | out: hHeap=0x710000) returned 1 [0136.538] IcmpCloseHandle (IcmpHandle=0x775910) returned 1 [0136.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x782e48 | out: hHeap=0x710000) returned 1 Thread: id = 138 os_tid = 0xd50 [0121.950] GetLastError () returned 0x57 [0121.950] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x780060 [0121.950] SetLastError (dwErrCode=0x57) [0121.950] IcmpCreateFile () returned 0x775948 [0121.950] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c1f8 [0121.950] IcmpSendEcho2 (in: IcmpHandle=0x775948, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7500a8c0, RequestData=0x150cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c1f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c1f8) returned 0x0 [0136.543] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c1f8 | out: hHeap=0x710000) returned 1 [0136.543] IcmpCloseHandle (IcmpHandle=0x775948) returned 1 [0136.543] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x780060 | out: hHeap=0x710000) returned 1 Thread: id = 139 os_tid = 0xd54 [0121.951] GetLastError () returned 0x57 [0121.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7803e8 [0121.951] SetLastError (dwErrCode=0x57) [0121.951] IcmpCreateFile () returned 0x775980 [0121.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c248 [0121.951] IcmpSendEcho2 (in: IcmpHandle=0x775980, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7600a8c0, RequestData=0x1520ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c248, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c248) returned 0x0 [0136.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c248 | out: hHeap=0x710000) returned 1 [0136.549] IcmpCloseHandle (IcmpHandle=0x775980) returned 1 [0136.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7803e8 | out: hHeap=0x710000) returned 1 Thread: id = 140 os_tid = 0xd58 [0121.953] GetLastError () returned 0x57 [0121.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x780770 [0121.953] SetLastError (dwErrCode=0x57) [0121.953] IcmpCreateFile () returned 0x7759b8 [0121.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c298 [0121.953] IcmpSendEcho2 (in: IcmpHandle=0x7759b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7700a8c0, RequestData=0x1534ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c298, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c298) returned 0x0 [0136.553] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c298 | out: hHeap=0x710000) returned 1 [0136.553] IcmpCloseHandle (IcmpHandle=0x7759b8) returned 1 [0136.554] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x780770 | out: hHeap=0x710000) returned 1 Thread: id = 141 os_tid = 0xd5c [0121.954] GetLastError () returned 0x57 [0121.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x780af8 [0121.954] SetLastError (dwErrCode=0x57) [0121.954] IcmpCreateFile () returned 0x775bb0 [0121.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7840a8 [0121.954] IcmpSendEcho2 (in: IcmpHandle=0x775bb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7800a8c0, RequestData=0x1548ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7840a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7840a8) returned 0x0 [0136.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7840a8 | out: hHeap=0x710000) returned 1 [0136.649] IcmpCloseHandle (IcmpHandle=0x775bb0) returned 1 [0136.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x780af8 | out: hHeap=0x710000) returned 1 Thread: id = 142 os_tid = 0xd60 [0121.955] GetLastError () returned 0x57 [0121.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x780e80 [0121.955] SetLastError (dwErrCode=0x57) [0121.955] IcmpCreateFile () returned 0x775be8 [0121.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783f68 [0121.955] IcmpSendEcho2 (in: IcmpHandle=0x775be8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7900a8c0, RequestData=0x155cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783f68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783f68) returned 0x0 [0136.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783f68 | out: hHeap=0x710000) returned 1 [0136.657] IcmpCloseHandle (IcmpHandle=0x775be8) returned 1 [0136.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x780e80 | out: hHeap=0x710000) returned 1 Thread: id = 143 os_tid = 0xd64 [0121.957] GetLastError () returned 0x57 [0121.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x781208 [0121.957] SetLastError (dwErrCode=0x57) [0121.957] IcmpCreateFile () returned 0x775c20 [0121.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783fb8 [0121.957] IcmpSendEcho2 (in: IcmpHandle=0x775c20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7a00a8c0, RequestData=0x1570ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783fb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783fb8) returned 0x0 [0136.664] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783fb8 | out: hHeap=0x710000) returned 1 [0136.664] IcmpCloseHandle (IcmpHandle=0x775c20) returned 1 [0136.665] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x781208 | out: hHeap=0x710000) returned 1 Thread: id = 144 os_tid = 0xd68 [0121.959] GetLastError () returned 0x57 [0121.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x781590 [0121.959] SetLastError (dwErrCode=0x57) [0121.959] IcmpCreateFile () returned 0x7852d8 [0121.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784508 [0121.959] IcmpSendEcho2 (in: IcmpHandle=0x7852d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7b00a8c0, RequestData=0x1584ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784508, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784508) returned 0x0 [0136.669] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784508 | out: hHeap=0x710000) returned 1 [0136.669] IcmpCloseHandle (IcmpHandle=0x7852d8) returned 1 [0136.669] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x781590 | out: hHeap=0x710000) returned 1 Thread: id = 145 os_tid = 0xd6c [0121.960] GetLastError () returned 0x57 [0121.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x781918 [0121.960] SetLastError (dwErrCode=0x57) [0121.960] IcmpCreateFile () returned 0x7850e0 [0121.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784008 [0121.960] IcmpSendEcho2 (in: IcmpHandle=0x7850e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7c00a8c0, RequestData=0x1598ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784008, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784008) returned 0x0 [0136.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784008 | out: hHeap=0x710000) returned 1 [0136.688] IcmpCloseHandle (IcmpHandle=0x7850e0) returned 1 [0136.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x781918 | out: hHeap=0x710000) returned 1 Thread: id = 146 os_tid = 0xdd8 [0121.961] GetLastError () returned 0x57 [0121.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x781ca0 [0121.961] SetLastError (dwErrCode=0x57) [0121.961] IcmpCreateFile () returned 0x785118 [0121.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784058 [0121.962] IcmpSendEcho2 (in: IcmpHandle=0x785118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7d00a8c0, RequestData=0x15acff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784058) returned 0x0 [0136.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784058 | out: hHeap=0x710000) returned 1 [0136.695] IcmpCloseHandle (IcmpHandle=0x785118) returned 1 [0136.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x781ca0 | out: hHeap=0x710000) returned 1 Thread: id = 147 os_tid = 0xddc [0121.963] GetLastError () returned 0x57 [0121.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x782028 [0121.963] SetLastError (dwErrCode=0x57) [0121.963] IcmpCreateFile () returned 0x785150 [0121.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7840f8 [0121.963] IcmpSendEcho2 (in: IcmpHandle=0x785150, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7e00a8c0, RequestData=0x15c0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7840f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7840f8) returned 0x0 [0136.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7840f8 | out: hHeap=0x710000) returned 1 [0136.700] IcmpCloseHandle (IcmpHandle=0x785150) returned 1 [0136.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x782028 | out: hHeap=0x710000) returned 1 Thread: id = 148 os_tid = 0xde0 [0121.964] GetLastError () returned 0x57 [0121.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7823b0 [0121.964] SetLastError (dwErrCode=0x57) [0121.964] IcmpCreateFile () returned 0x785188 [0121.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784148 [0121.964] IcmpSendEcho2 (in: IcmpHandle=0x785188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7f00a8c0, RequestData=0x15d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784148) returned 0x0 [0136.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784148 | out: hHeap=0x710000) returned 1 [0136.712] IcmpCloseHandle (IcmpHandle=0x785188) returned 1 [0136.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7823b0 | out: hHeap=0x710000) returned 1 Thread: id = 149 os_tid = 0xde4 [0121.965] GetLastError () returned 0x57 [0121.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x782738 [0121.965] SetLastError (dwErrCode=0x57) [0121.965] IcmpCreateFile () returned 0x7851c0 [0121.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784198 [0121.965] IcmpSendEcho2 (in: IcmpHandle=0x7851c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8000a8c0, RequestData=0x15e8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784198) returned 0x0 [0136.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784198 | out: hHeap=0x710000) returned 1 [0136.719] IcmpCloseHandle (IcmpHandle=0x7851c0) returned 1 [0136.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x782738 | out: hHeap=0x710000) returned 1 Thread: id = 150 os_tid = 0xde8 [0122.158] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.158] ReadFile (in: hFile=0x28c, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.160] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.162] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.162] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xff8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0122.162] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xff8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xff8f828, pbKeyObject=0x0) returned 0x0 [0122.162] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xff8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xff8f500) returned 0x0 [0122.162] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.162] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xff8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xff8f500) returned 0x0 [0122.168] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.172] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.172] WriteFile (in: hFile=0x28c, lpBuffer=0xff8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xff8f830, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesWritten=0xff8f830*=0x428, lpOverlapped=0x0) returned 1 [0122.173] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.173] ReadFile (in: hFile=0x28c, lpBuffer=0x2750000, nNumberOfBytesToRead=0x67d, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xff8f61c*=0x67d, lpOverlapped=0x0) returned 1 [0122.173] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffff983, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.173] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2750000, cbInput=0x67d, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0xff8f848, pbOutput=0x2750000, pcbResult=0xff8f618) returned 0x0 [0122.173] WriteFile (in: hFile=0x28c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xff8f61c*=0x680, lpOverlapped=0x0) returned 1 [0122.174] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0122.175] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.175] WriteFile (in: hFile=0x28c, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.175] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.175] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0122.175] CloseHandle (hObject=0x28c) returned 1 [0122.177] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml.play")) returned 1 [0122.180] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 151 os_tid = 0xdec [0122.183] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.183] ReadFile (in: hFile=0x2a4, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.184] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.184] ReadFile (in: hFile=0x2a4, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.184] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.185] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.186] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0122.186] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0122.186] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x100cf500) returned 0x0 [0122.186] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.186] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x100cf500) returned 0x0 [0122.189] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.191] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.191] WriteFile (in: hFile=0x2a4, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0122.191] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.191] ReadFile (in: hFile=0x2a4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x100cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.206] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.206] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x0 | out: hKey=0x76acf0, pbIV=0x100cf848, pbOutput=0x2850000, pcbResult=0x100cf618) returned 0x0 [0122.207] WriteFile (in: hFile=0x2a4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x100cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.211] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0122.211] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.211] WriteFile (in: hFile=0x2a4, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0122.211] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.211] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xffeffbd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.211] ReadFile (in: hFile=0x2a4, lpBuffer=0x2850000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x100cf61c*=0xffff0, lpOverlapped=0x0) returned 1 [0123.311] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.311] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2850000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x100cf848, pbOutput=0x2850000, pcbResult=0x100cf618) returned 0x0 [0123.313] WriteFile (in: hFile=0x2a4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x100cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.585] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0124.585] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.585] WriteFile (in: hFile=0x2a4, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0124.585] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x6048fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.585] WriteFile (in: hFile=0x2a4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x100cf82c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x100cf82c*=0x2, lpOverlapped=0x0) returned 1 [0124.585] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0124.585] CloseHandle (hObject=0x2a4) returned 1 [0130.744] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0130.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\pptlr.cab.play")) returned 1 [0130.746] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 152 os_tid = 0xdf0 [0122.196] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.196] ReadFile (in: hFile=0x2d0, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.221] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.222] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.222] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0122.222] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0122.222] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1020f500) returned 0x0 [0122.222] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.222] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1020f500) returned 0x0 [0122.225] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.227] WriteFile (in: hFile=0x2d0, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0122.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.227] ReadFile (in: hFile=0x2d0, lpBuffer=0x2950000, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1020f61c*=0x818, lpOverlapped=0x0) returned 1 [0122.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfffff7e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.227] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2950000, cbInput=0x818, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x1020f848, pbOutput=0x2950000, pcbResult=0x1020f618) returned 0x0 [0122.227] WriteFile (in: hFile=0x2d0, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1020f61c*=0x820, lpOverlapped=0x0) returned 1 [0122.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0122.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.227] WriteFile (in: hFile=0x2d0, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.227] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0122.228] CloseHandle (hObject=0x2d0) returned 1 [0122.232] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0122.233] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 153 os_tid = 0xdf4 [0122.235] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.236] ReadFile (in: hFile=0x304, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.238] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.239] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.239] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0122.239] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0122.239] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1034f500) returned 0x0 [0122.239] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.239] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1034f500) returned 0x0 [0122.242] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.244] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.244] WriteFile (in: hFile=0x304, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0122.244] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.244] ReadFile (in: hFile=0x304, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x67e, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1034f61c*=0x67e, lpOverlapped=0x0) returned 1 [0122.244] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffff982, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.244] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2a50000, cbInput=0x67e, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x1034f848, pbOutput=0x2a50000, pcbResult=0x1034f618) returned 0x0 [0122.244] WriteFile (in: hFile=0x304, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1034f61c*=0x680, lpOverlapped=0x0) returned 1 [0122.244] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0122.244] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.244] WriteFile (in: hFile=0x304, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.244] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.244] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0122.244] CloseHandle (hObject=0x304) returned 1 [0122.245] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.246] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml.play")) returned 1 [0122.247] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 154 os_tid = 0xdf8 [0122.249] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.249] ReadFile (in: hFile=0x2fc, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.251] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.251] ReadFile (in: hFile=0x2fc, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.251] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.252] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.252] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0122.252] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0122.252] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1070f500) returned 0x0 [0122.252] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.252] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1070f500) returned 0x0 [0122.255] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.256] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.256] WriteFile (in: hFile=0x2fc, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0122.256] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.257] ReadFile (in: hFile=0x2fc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1070f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.272] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.272] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2d50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x0 | out: hKey=0x76af70, pbIV=0x1070f848, pbOutput=0x2d50000, pcbResult=0x1070f618) returned 0x0 [0122.273] WriteFile (in: hFile=0x2fc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1070f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.276] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0122.277] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.277] WriteFile (in: hFile=0x2fc, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.277] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.277] ReadFile (in: hFile=0x2fc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1070f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.334] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.334] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2d50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x0 | out: hKey=0x76af70, pbIV=0x1070f848, pbOutput=0x2d50000, pcbResult=0x1070f618) returned 0x0 [0123.335] WriteFile (in: hFile=0x2fc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1070f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.340] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0123.340] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.340] WriteFile (in: hFile=0x2fc, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.341] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.341] ReadFile (in: hFile=0x2fc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1070f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.636] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.636] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2d50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x0 | out: hKey=0x76af70, pbIV=0x1070f848, pbOutput=0x2d50000, pcbResult=0x1070f618) returned 0x0 [0124.637] WriteFile (in: hFile=0x2fc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1070f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.641] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0124.641] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.641] WriteFile (in: hFile=0x2fc, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.641] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.641] ReadFile (in: hFile=0x2fc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x658af, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1070f61c*=0x658af, lpOverlapped=0x0) returned 1 [0124.652] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfff9a751, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.652] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x2d50000, cbInput=0x658af, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x1070f848, pbOutput=0x2d50000, pcbResult=0x1070f618) returned 0x0 [0124.653] WriteFile (in: hFile=0x2fc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x658b0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1070f61c*=0x658b0, lpOverlapped=0x0) returned 1 [0124.654] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0124.654] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.654] WriteFile (in: hFile=0x2fc, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.654] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x3658b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.654] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0124.654] CloseHandle (hObject=0x2fc) returned 1 [0129.103] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0129.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\publr.cab.play")) returned 1 [0129.105] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 155 os_tid = 0xdfc [0122.250] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.262] ReadFile (in: hFile=0x4c8, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.290] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.291] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0122.291] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0122.291] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10acf500) returned 0x0 [0122.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.291] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10acf500) returned 0x0 [0122.294] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.296] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.296] WriteFile (in: hFile=0x4c8, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0122.296] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.296] ReadFile (in: hFile=0x4c8, lpBuffer=0x3050000, nNumberOfBytesToRead=0x703, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x10acf61c*=0x703, lpOverlapped=0x0) returned 1 [0122.296] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0xfffff8fd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.296] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3050000, cbInput=0x703, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x10acf848, pbOutput=0x3050000, pcbResult=0x10acf618) returned 0x0 [0122.296] WriteFile (in: hFile=0x4c8, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x10acf61c*=0x710, lpOverlapped=0x0) returned 1 [0122.296] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0122.297] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.297] WriteFile (in: hFile=0x4c8, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0122.297] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.297] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0122.297] CloseHandle (hObject=0x4c8) returned 1 [0122.298] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0019-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0122.300] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 156 os_tid = 0xe00 [0122.302] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.302] ReadFile (in: hFile=0x4d0, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.303] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.303] ReadFile (in: hFile=0x4d0, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.303] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.305] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0122.305] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0122.305] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10d4f500) returned 0x0 [0122.305] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.305] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10d4f500) returned 0x0 [0122.308] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.310] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.311] WriteFile (in: hFile=0x4d0, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0122.312] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.312] ReadFile (in: hFile=0x4d0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10d4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.332] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.332] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3250000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x0 | out: hKey=0x76b1e0, pbIV=0x10d4f848, pbOutput=0x3250000, pcbResult=0x10d4f618) returned 0x0 [0122.333] WriteFile (in: hFile=0x4d0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10d4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.337] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0122.337] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.337] WriteFile (in: hFile=0x4d0, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.337] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.337] ReadFile (in: hFile=0x4d0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10d4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.383] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.383] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3250000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x0 | out: hKey=0x76b1e0, pbIV=0x10d4f848, pbOutput=0x3250000, pcbResult=0x10d4f618) returned 0x0 [0123.385] WriteFile (in: hFile=0x4d0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10d4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.390] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0123.390] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.390] WriteFile (in: hFile=0x4d0, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.390] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.390] ReadFile (in: hFile=0x4d0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10d4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.672] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.672] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3250000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x0 | out: hKey=0x76b1e0, pbIV=0x10d4f848, pbOutput=0x3250000, pcbResult=0x10d4f618) returned 0x0 [0124.674] WriteFile (in: hFile=0x4d0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10d4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.677] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0124.677] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.677] WriteFile (in: hFile=0x4d0, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.678] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.678] ReadFile (in: hFile=0x4d0, lpBuffer=0x3250000, nNumberOfBytesToRead=0xd2ce1, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10d4f61c*=0xd2ce1, lpOverlapped=0x0) returned 1 [0124.692] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfff2d31f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.692] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x3250000, cbInput=0xd2ce1, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x10d4f848, pbOutput=0x3250000, pcbResult=0x10d4f618) returned 0x0 [0124.693] WriteFile (in: hFile=0x4d0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0xd2cf0, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10d4f61c*=0xd2cf0, lpOverlapped=0x0) returned 1 [0124.696] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0124.696] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.696] WriteFile (in: hFile=0x4d0, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.696] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x3d2cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.696] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0124.696] CloseHandle (hObject=0x4d0) returned 1 [0129.108] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0129.109] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlklr.cab.play")) returned 1 [0129.109] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 157 os_tid = 0xe04 [0122.343] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.343] ReadFile (in: hFile=0x4d8, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.345] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.345] ReadFile (in: hFile=0x4d8, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.345] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.346] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.346] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0122.346] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0122.346] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10e8f500) returned 0x0 [0122.347] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.347] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10e8f500) returned 0x0 [0122.351] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.352] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.352] WriteFile (in: hFile=0x4d8, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0122.352] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.352] ReadFile (in: hFile=0x4d8, lpBuffer=0x3350000, nNumberOfBytesToRead=0xb15, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x10e8f61c*=0xb15, lpOverlapped=0x0) returned 1 [0122.352] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffff4eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.352] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3350000, cbInput=0xb15, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0x10e8f848, pbOutput=0x3350000, pcbResult=0x10e8f618) returned 0x0 [0122.352] WriteFile (in: hFile=0x4d8, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x10e8f61c*=0xb20, lpOverlapped=0x0) returned 1 [0122.353] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0122.353] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.353] WriteFile (in: hFile=0x4d8, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.353] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.353] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0122.353] CloseHandle (hObject=0x4d8) returned 1 [0122.354] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml.play")) returned 1 [0122.355] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 158 os_tid = 0xe08 [0122.357] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.357] ReadFile (in: hFile=0x4e0, lpBuffer=0x15fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesRead=0x15fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.359] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.359] ReadFile (in: hFile=0x4e0, lpBuffer=0x15fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesRead=0x15fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.359] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.361] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x15fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0122.361] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x15fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x15fcf828, pbKeyObject=0x0) returned 0x0 [0122.361] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x15fcf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x15fcf500) returned 0x0 [0122.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.361] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x15fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x15fcf500) returned 0x0 [0122.366] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.367] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.367] WriteFile (in: hFile=0x4e0, lpBuffer=0x15fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15fcf830, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesWritten=0x15fcf830*=0x428, lpOverlapped=0x0) returned 1 [0122.367] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.368] ReadFile (in: hFile=0x4e0, lpBuffer=0x3450000, nNumberOfBytesToRead=0xf1e, lpNumberOfBytesRead=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x15fcf61c*=0xf1e, lpOverlapped=0x0) returned 1 [0122.368] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0xfffff0e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.368] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3450000, cbInput=0xf1e, pPaddingInfo=0x0, pbIV=0x15fcf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x15fcf618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0x15fcf848, pbOutput=0x3450000, pcbResult=0x15fcf618) returned 0x0 [0122.368] WriteFile (in: hFile=0x4e0, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x15fcf61c*=0xf20, lpOverlapped=0x0) returned 1 [0122.368] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15fcf60c | out: lpNewFilePointer=0x0) returned 1 [0122.368] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.368] WriteFile (in: hFile=0x4e0, lpBuffer=0x15fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15fcf83c*, lpNumberOfBytesWritten=0x15fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0122.368] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0xf20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.368] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0122.368] CloseHandle (hObject=0x4e0) returned 1 [0122.369] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0122.371] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 159 os_tid = 0xe0c [0122.374] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.374] ReadFile (in: hFile=0x4e8, lpBuffer=0x1610fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1610f85c, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesRead=0x1610f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.375] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.375] ReadFile (in: hFile=0x4e8, lpBuffer=0x1610fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1610f85c, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesRead=0x1610f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.375] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.376] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.376] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x1610f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0122.377] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x1610f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x1610f828, pbKeyObject=0x0) returned 0x0 [0122.377] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1610f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1610f500) returned 0x0 [0122.377] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.377] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1610f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1610f500) returned 0x0 [0122.380] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.381] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.381] WriteFile (in: hFile=0x4e8, lpBuffer=0x1610fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1610f830, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesWritten=0x1610f830*=0x428, lpOverlapped=0x0) returned 1 [0122.381] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.381] ReadFile (in: hFile=0x4e8, lpBuffer=0x3550000, nNumberOfBytesToRead=0xad4, lpNumberOfBytesRead=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1610f61c*=0xad4, lpOverlapped=0x0) returned 1 [0122.382] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfffff52c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.382] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3550000, cbInput=0xad4, pPaddingInfo=0x0, pbIV=0x1610f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1610f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0x1610f848, pbOutput=0x3550000, pcbResult=0x1610f618) returned 0x0 [0122.382] WriteFile (in: hFile=0x4e8, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1610f61c*=0xae0, lpOverlapped=0x0) returned 1 [0122.382] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1610f60c | out: lpNewFilePointer=0x0) returned 1 [0122.382] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.382] WriteFile (in: hFile=0x4e8, lpBuffer=0x1610f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x1610f83c*, lpNumberOfBytesWritten=0x1610f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.382] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.382] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0122.382] CloseHandle (hObject=0x4e8) returned 1 [0122.383] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0122.387] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 160 os_tid = 0xe10 [0122.385] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.385] ReadFile (in: hFile=0x4f0, lpBuffer=0x1624fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1624f85c, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesRead=0x1624f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.390] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.390] ReadFile (in: hFile=0x4f0, lpBuffer=0x1624fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1624f85c, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesRead=0x1624f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.390] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.391] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.391] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x1624f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0122.391] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x1624f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x1624f828, pbKeyObject=0x0) returned 0x0 [0122.391] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1624f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1624f500) returned 0x0 [0122.391] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.391] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1624f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1624f500) returned 0x0 [0122.395] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.396] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.396] WriteFile (in: hFile=0x4f0, lpBuffer=0x1624fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1624f830, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesWritten=0x1624f830*=0x428, lpOverlapped=0x0) returned 1 [0122.396] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.396] ReadFile (in: hFile=0x4f0, lpBuffer=0x3650000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1624f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.410] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.410] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3650000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1624f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1624f618, dwFlags=0x0 | out: hKey=0x785cd0, pbIV=0x1624f848, pbOutput=0x3650000, pcbResult=0x1624f618) returned 0x0 [0122.411] WriteFile (in: hFile=0x4f0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1624f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.415] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1624f60c | out: lpNewFilePointer=0x0) returned 1 [0122.415] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.415] WriteFile (in: hFile=0x4f0, lpBuffer=0x1624f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x1624f83c*, lpNumberOfBytesWritten=0x1624f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.415] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.415] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xffeffbcd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.415] ReadFile (in: hFile=0x4f0, lpBuffer=0x3650000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1624f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0122.447] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.447] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3650000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1624f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1624f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0x1624f848, pbOutput=0x3650000, pcbResult=0x1624f618) returned 0x0 [0122.448] WriteFile (in: hFile=0x4f0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1624f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.418] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1624f60c | out: lpNewFilePointer=0x0) returned 1 [0123.418] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.418] WriteFile (in: hFile=0x4f0, lpBuffer=0x1624f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x1624f83c*, lpNumberOfBytesWritten=0x1624f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.418] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x99ce05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.418] WriteFile (in: hFile=0x4f0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x1624f82c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1624f82c*=0xb, lpOverlapped=0x0) returned 1 [0123.419] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0123.419] CloseHandle (hObject=0x4f0) returned 1 [0132.063] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordlr.cab.play")) returned 1 [0132.066] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 161 os_tid = 0xe14 [0122.401] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.418] ReadFile (in: hFile=0x4f8, lpBuffer=0x1638fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1638f85c, lpOverlapped=0x0 | out: lpBuffer=0x1638fb34*, lpNumberOfBytesRead=0x1638f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.421] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.421] ReadFile (in: hFile=0x4f8, lpBuffer=0x1638fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1638f85c, lpOverlapped=0x0 | out: lpBuffer=0x1638fb34*, lpNumberOfBytesRead=0x1638f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.421] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.422] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.422] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1638f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0122.422] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1638f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1638f828, pbKeyObject=0x0) returned 0x0 [0122.422] BCryptExportKey (in: hKey=0x785f50, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1638f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1638f500) returned 0x0 [0122.423] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.423] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1638f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1638f500) returned 0x0 [0122.427] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.429] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.429] WriteFile (in: hFile=0x4f8, lpBuffer=0x1638fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1638f830, lpOverlapped=0x0 | out: lpBuffer=0x1638fb34*, lpNumberOfBytesWritten=0x1638f830*=0x428, lpOverlapped=0x0) returned 1 [0122.429] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.429] ReadFile (in: hFile=0x4f8, lpBuffer=0x3750000, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1638f61c*=0x83c, lpOverlapped=0x0) returned 1 [0122.429] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0xfffff7c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.429] BCryptEncrypt (in: hKey=0x785f50, pbInput=0x3750000, cbInput=0x83c, pPaddingInfo=0x0, pbIV=0x1638f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1638f618, dwFlags=0x1 | out: hKey=0x785f50, pbIV=0x1638f848, pbOutput=0x3750000, pcbResult=0x1638f618) returned 0x0 [0122.429] WriteFile (in: hFile=0x4f8, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1638f61c*=0x840, lpOverlapped=0x0) returned 1 [0122.429] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1638f60c | out: lpNewFilePointer=0x0) returned 1 [0122.429] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.430] WriteFile (in: hFile=0x4f8, lpBuffer=0x1638f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x1638f83c*, lpNumberOfBytesWritten=0x1638f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.430] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x840, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.430] BCryptDestroyKey (in: hKey=0x785f50 | out: hKey=0x785f50) returned 0x0 [0122.430] CloseHandle (hObject=0x4f8) returned 1 [0122.431] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml.play")) returned 1 [0122.433] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 162 os_tid = 0xe18 [0122.576] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.578] ReadFile (in: hFile=0x504, lpBuffer=0x164cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x164cf85c, lpOverlapped=0x0 | out: lpBuffer=0x164cfb34*, lpNumberOfBytesRead=0x164cf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.845] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.846] ReadFile (in: hFile=0x504, lpBuffer=0x164cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x164cf85c, lpOverlapped=0x0 | out: lpBuffer=0x164cfb34*, lpNumberOfBytesRead=0x164cf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.846] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.847] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.847] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x164cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0122.847] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x164cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x164cf828, pbKeyObject=0x0) returned 0x0 [0122.847] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x164cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x164cf500) returned 0x0 [0122.847] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.847] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x164cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x164cf500) returned 0x0 [0122.851] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.852] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.852] WriteFile (in: hFile=0x504, lpBuffer=0x164cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x164cf830, lpOverlapped=0x0 | out: lpBuffer=0x164cfb34*, lpNumberOfBytesWritten=0x164cf830*=0x428, lpOverlapped=0x0) returned 1 [0122.852] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.853] ReadFile (in: hFile=0x504, lpBuffer=0x3850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x164cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.906] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.906] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x164cf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x164cf618, dwFlags=0x0 | out: hKey=0x78a760, pbIV=0x164cf848, pbOutput=0x3850000, pcbResult=0x164cf618) returned 0x0 [0122.907] WriteFile (in: hFile=0x504, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x164cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.910] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x164cf60c | out: lpNewFilePointer=0x0) returned 1 [0122.911] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.911] WriteFile (in: hFile=0x504, lpBuffer=0x164cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x164cf83c*, lpNumberOfBytesWritten=0x164cf61c*=0x8, lpOverlapped=0x0) returned 1 [0122.911] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.911] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xffeffbd7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.911] ReadFile (in: hFile=0x504, lpBuffer=0x3850000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x164cf61c*=0xffff0, lpOverlapped=0x0) returned 1 [0123.468] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.468] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3850000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x164cf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x164cf618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x164cf848, pbOutput=0x3850000, pcbResult=0x164cf618) returned 0x0 [0123.469] WriteFile (in: hFile=0x504, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x164cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.572] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x164cf60c | out: lpNewFilePointer=0x0) returned 1 [0123.572] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.572] WriteFile (in: hFile=0x504, lpBuffer=0x164cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x164cf83c*, lpNumberOfBytesWritten=0x164cf61c*=0x8, lpOverlapped=0x0) returned 1 [0123.572] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0xb1e34f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.572] WriteFile (in: hFile=0x504, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x164cf82c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x164cf82c*=0x1, lpOverlapped=0x0) returned 1 [0123.572] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0123.572] CloseHandle (hObject=0x504) returned 1 [0132.569] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.cab.play")) returned 1 [0132.571] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 163 os_tid = 0xe1c [0122.592] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.594] ReadFile (in: hFile=0x50c, lpBuffer=0x1660fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1660f85c, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesRead=0x1660f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.887] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.888] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.888] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x1660f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0122.888] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x1660f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x1660f828, pbKeyObject=0x0) returned 0x0 [0122.888] BCryptExportKey (in: hKey=0x78ac50, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1660f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1660f500) returned 0x0 [0122.888] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.888] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1660f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1660f500) returned 0x0 [0122.892] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.893] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.893] WriteFile (in: hFile=0x50c, lpBuffer=0x1660fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1660f830, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesWritten=0x1660f830*=0x428, lpOverlapped=0x0) returned 1 [0122.893] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.893] ReadFile (in: hFile=0x50c, lpBuffer=0x3950000, nNumberOfBytesToRead=0x613, lpNumberOfBytesRead=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1660f61c*=0x613, lpOverlapped=0x0) returned 1 [0122.893] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0xfffff9ed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.893] BCryptEncrypt (in: hKey=0x78ac50, pbInput=0x3950000, cbInput=0x613, pPaddingInfo=0x0, pbIV=0x1660f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1660f618, dwFlags=0x1 | out: hKey=0x78ac50, pbIV=0x1660f848, pbOutput=0x3950000, pcbResult=0x1660f618) returned 0x0 [0122.893] WriteFile (in: hFile=0x50c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1660f61c*=0x620, lpOverlapped=0x0) returned 1 [0122.893] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1660f60c | out: lpNewFilePointer=0x0) returned 1 [0122.894] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.894] WriteFile (in: hFile=0x50c, lpBuffer=0x1660f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x1660f83c*, lpNumberOfBytesWritten=0x1660f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.894] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.894] BCryptDestroyKey (in: hKey=0x78ac50 | out: hKey=0x78ac50) returned 0x0 [0122.894] CloseHandle (hObject=0x50c) returned 1 [0122.895] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml.play")) returned 1 [0122.897] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 164 os_tid = 0xe88 [0122.600] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.601] ReadFile (in: hFile=0x514, lpBuffer=0x1674fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1674f85c, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesRead=0x1674f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.872] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.872] ReadFile (in: hFile=0x514, lpBuffer=0x1674fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1674f85c, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesRead=0x1674f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.872] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.873] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.873] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1674f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0122.873] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1674f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1674f828, pbKeyObject=0x0) returned 0x0 [0122.873] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1674f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1674f500) returned 0x0 [0122.875] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.875] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1674f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1674f500) returned 0x0 [0122.878] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.879] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.879] WriteFile (in: hFile=0x514, lpBuffer=0x1674fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1674f830, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesWritten=0x1674f830*=0x428, lpOverlapped=0x0) returned 1 [0122.880] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.880] ReadFile (in: hFile=0x514, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1674f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.935] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.935] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3a50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1674f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1674f618, dwFlags=0x0 | out: hKey=0x78a9d0, pbIV=0x1674f848, pbOutput=0x3a50000, pcbResult=0x1674f618) returned 0x0 [0122.936] WriteFile (in: hFile=0x514, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1674f61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.940] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1674f60c | out: lpNewFilePointer=0x0) returned 1 [0122.940] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.940] WriteFile (in: hFile=0x514, lpBuffer=0x1674f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x1674f83c*, lpNumberOfBytesWritten=0x1674f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.941] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.941] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xffeffbd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.941] ReadFile (in: hFile=0x514, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1674f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0123.592] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.593] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3a50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1674f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1674f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x1674f848, pbOutput=0x3a50000, pcbResult=0x1674f618) returned 0x0 [0123.594] WriteFile (in: hFile=0x514, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1674f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.600] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1674f60c | out: lpNewFilePointer=0x0) returned 1 [0123.600] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.600] WriteFile (in: hFile=0x514, lpBuffer=0x1674f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x1674f83c*, lpNumberOfBytesWritten=0x1674f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.600] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xd43dcd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.600] WriteFile (in: hFile=0x514, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x1674f82c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1674f82c*=0x3, lpOverlapped=0x0) returned 1 [0123.600] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0123.600] CloseHandle (hObject=0x514) returned 1 [0132.080] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.cab.play")) returned 1 [0132.083] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 165 os_tid = 0x103c [0122.602] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.602] ReadFile (in: hFile=0x51c, lpBuffer=0x1688fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1688f85c, lpOverlapped=0x0 | out: lpBuffer=0x1688fb34*, lpNumberOfBytesRead=0x1688f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.862] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.862] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x1688f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0122.862] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x1688f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x1688f828, pbKeyObject=0x0) returned 0x0 [0122.862] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1688f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1688f500) returned 0x0 [0122.862] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.862] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1688f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1688f500) returned 0x0 [0122.866] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.867] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.867] WriteFile (in: hFile=0x51c, lpBuffer=0x1688fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1688f830, lpOverlapped=0x0 | out: lpBuffer=0x1688fb34*, lpNumberOfBytesWritten=0x1688f830*=0x428, lpOverlapped=0x0) returned 1 [0122.867] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.867] ReadFile (in: hFile=0x51c, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x681, lpNumberOfBytesRead=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1688f61c*=0x681, lpOverlapped=0x0) returned 1 [0122.867] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xfffff97f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.867] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3b50000, cbInput=0x681, pPaddingInfo=0x0, pbIV=0x1688f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1688f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x1688f848, pbOutput=0x3b50000, pcbResult=0x1688f618) returned 0x0 [0122.867] WriteFile (in: hFile=0x51c, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1688f61c*=0x690, lpOverlapped=0x0) returned 1 [0122.868] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1688f60c | out: lpNewFilePointer=0x0) returned 1 [0122.868] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.868] WriteFile (in: hFile=0x51c, lpBuffer=0x1688f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x1688f83c*, lpNumberOfBytesWritten=0x1688f61c*=0x8, lpOverlapped=0x0) returned 1 [0122.868] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.868] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0122.868] CloseHandle (hObject=0x51c) returned 1 [0122.869] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0122.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml.play")) returned 1 [0122.871] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 166 os_tid = 0x1044 [0122.603] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.603] ReadFile (in: hFile=0x524, lpBuffer=0x169cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x169cf85c, lpOverlapped=0x0 | out: lpBuffer=0x169cfb34*, lpNumberOfBytesRead=0x169cf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.860] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.860] ReadFile (in: hFile=0x524, lpBuffer=0x169cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x169cf85c, lpOverlapped=0x0 | out: lpBuffer=0x169cfb34*, lpNumberOfBytesRead=0x169cf85c*=0x428, lpOverlapped=0x0) returned 1 [0122.913] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.914] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.914] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x169cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0122.915] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x169cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x169cf828, pbKeyObject=0x0) returned 0x0 [0122.915] BCryptExportKey (in: hKey=0x78ac50, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x169cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x169cf500) returned 0x0 [0122.915] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.915] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x169cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x169cf500) returned 0x0 [0122.918] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.919] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.919] WriteFile (in: hFile=0x524, lpBuffer=0x169cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x169cf830, lpOverlapped=0x0 | out: lpBuffer=0x169cfb34*, lpNumberOfBytesWritten=0x169cf830*=0x428, lpOverlapped=0x0) returned 1 [0122.919] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.920] ReadFile (in: hFile=0x524, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x169cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.952] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.952] BCryptEncrypt (in: hKey=0x78ac50, pbInput=0x3c50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x169cf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x169cf618, dwFlags=0x0 | out: hKey=0x78ac50, pbIV=0x169cf848, pbOutput=0x3c50000, pcbResult=0x169cf618) returned 0x0 [0122.954] WriteFile (in: hFile=0x524, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x169cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0122.957] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x169cf60c | out: lpNewFilePointer=0x0) returned 1 [0122.957] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.957] WriteFile (in: hFile=0x524, lpBuffer=0x169cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x169cf83c*, lpNumberOfBytesWritten=0x169cf61c*=0x8, lpOverlapped=0x0) returned 1 [0122.957] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.957] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xffeffbcd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.957] ReadFile (in: hFile=0x524, lpBuffer=0x3c50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x169cf61c*=0xffff0, lpOverlapped=0x0) returned 1 [0122.984] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.984] BCryptEncrypt (in: hKey=0x78ac50, pbInput=0x3c50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x169cf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x169cf618, dwFlags=0x1 | out: hKey=0x78ac50, pbIV=0x169cf848, pbOutput=0x3c50000, pcbResult=0x169cf618) returned 0x0 [0123.634] WriteFile (in: hFile=0x524, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x169cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.647] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x169cf60c | out: lpNewFilePointer=0x0) returned 1 [0123.647] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.648] WriteFile (in: hFile=0x524, lpBuffer=0x169cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x169cf83c*, lpNumberOfBytesWritten=0x169cf61c*=0x8, lpOverlapped=0x0) returned 1 [0123.648] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0xd366a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.648] WriteFile (in: hFile=0x524, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x169cf82c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x169cf82c*=0xb, lpOverlapped=0x0) returned 1 [0123.648] BCryptDestroyKey (in: hKey=0x78ac50 | out: hKey=0x78ac50) returned 0x0 [0123.648] CloseHandle (hObject=0x524) returned 1 [0131.767] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.769] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.cab.play")) returned 1 [0131.770] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 167 os_tid = 0x1018 [0122.989] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.989] ReadFile (in: hFile=0x52c, lpBuffer=0x16b0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16b0f85c, lpOverlapped=0x0 | out: lpBuffer=0x16b0fb34*, lpNumberOfBytesRead=0x16b0f85c*=0x428, lpOverlapped=0x0) returned 1 [0122.990] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0122.991] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0122.991] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x16b0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0122.991] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x16b0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x16b0f828, pbKeyObject=0x0) returned 0x0 [0122.991] BCryptExportKey (in: hKey=0x78aec0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x16b0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x16b0f500) returned 0x0 [0122.992] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0122.992] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x16b0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x16b0f500) returned 0x0 [0122.995] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.997] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.997] WriteFile (in: hFile=0x52c, lpBuffer=0x16b0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16b0f830, lpOverlapped=0x0 | out: lpBuffer=0x16b0fb34*, lpNumberOfBytesWritten=0x16b0f830*=0x428, lpOverlapped=0x0) returned 1 [0122.998] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.998] ReadFile (in: hFile=0x52c, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x681, lpNumberOfBytesRead=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x16b0f61c*=0x681, lpOverlapped=0x0) returned 1 [0122.998] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffff97f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.998] BCryptEncrypt (in: hKey=0x78aec0, pbInput=0x3d50000, cbInput=0x681, pPaddingInfo=0x0, pbIV=0x16b0f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x16b0f618, dwFlags=0x1 | out: hKey=0x78aec0, pbIV=0x16b0f848, pbOutput=0x3d50000, pcbResult=0x16b0f618) returned 0x0 [0122.998] WriteFile (in: hFile=0x52c, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x16b0f61c*=0x690, lpOverlapped=0x0) returned 1 [0122.999] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16b0f60c | out: lpNewFilePointer=0x0) returned 1 [0122.999] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.000] WriteFile (in: hFile=0x52c, lpBuffer=0x16b0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x16b0f83c*, lpNumberOfBytesWritten=0x16b0f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.000] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.000] BCryptDestroyKey (in: hKey=0x78aec0 | out: hKey=0x78aec0) returned 0x0 [0123.000] CloseHandle (hObject=0x52c) returned 1 [0123.001] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0123.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml.play")) returned 1 [0123.003] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 168 os_tid = 0x1010 [0123.006] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0123.007] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0123.007] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x16c4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0123.007] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x16c4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x16c4f828, pbKeyObject=0x0) returned 0x0 [0123.007] BCryptExportKey (in: hKey=0x78aec0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x16c4f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x16c4f500) returned 0x0 [0123.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0123.008] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x16c4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x16c4f500) returned 0x0 [0123.012] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.013] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.014] WriteFile (in: hFile=0x500, lpBuffer=0x16c4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16c4f830, lpOverlapped=0x0 | out: lpBuffer=0x16c4fb34*, lpNumberOfBytesWritten=0x16c4f830*=0x428, lpOverlapped=0x0) returned 1 [0123.015] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.015] ReadFile (in: hFile=0x500, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x16c4f61c*=0x400, lpOverlapped=0x0) returned 1 [0123.015] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xfffffc00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.016] BCryptEncrypt (in: hKey=0x78aec0, pbInput=0x3e50000, cbInput=0x400, pPaddingInfo=0x0, pbIV=0x16c4f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x16c4f618, dwFlags=0x1 | out: hKey=0x78aec0, pbIV=0x16c4f848, pbOutput=0x3e50000, pcbResult=0x16c4f618) returned 0x0 [0123.016] WriteFile (in: hFile=0x500, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x16c4f61c*=0x410, lpOverlapped=0x0) returned 1 [0123.016] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16c4f60c | out: lpNewFilePointer=0x0) returned 1 [0123.016] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.016] WriteFile (in: hFile=0x500, lpBuffer=0x16c4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x16c4f83c*, lpNumberOfBytesWritten=0x16c4f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.016] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.016] BCryptDestroyKey (in: hKey=0x78aec0 | out: hKey=0x78aec0) returned 0x0 [0123.016] CloseHandle (hObject=0x500) returned 1 [0123.017] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0123.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml.play")) returned 1 [0123.019] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 169 os_tid = 0x4f4 [0123.021] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.021] ReadFile (in: hFile=0x538, lpBuffer=0x16d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesRead=0x16d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.023] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.023] ReadFile (in: hFile=0x538, lpBuffer=0x16d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesRead=0x16d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.024] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0123.024] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0123.025] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x16d8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0123.025] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x16d8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x16d8f828, pbKeyObject=0x0) returned 0x0 [0123.025] BCryptExportKey (in: hKey=0x78bed0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x16d8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x16d8f500) returned 0x0 [0123.025] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0123.025] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x16d8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x16d8f500) returned 0x0 [0123.028] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.029] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.030] WriteFile (in: hFile=0x538, lpBuffer=0x16d8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16d8f830, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesWritten=0x16d8f830*=0x428, lpOverlapped=0x0) returned 1 [0123.030] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.030] ReadFile (in: hFile=0x538, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x17b3, lpNumberOfBytesRead=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x16d8f61c*=0x17b3, lpOverlapped=0x0) returned 1 [0123.030] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xffffe84d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.030] BCryptEncrypt (in: hKey=0x78bed0, pbInput=0x3f50000, cbInput=0x17b3, pPaddingInfo=0x0, pbIV=0x16d8f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x16d8f618, dwFlags=0x1 | out: hKey=0x78bed0, pbIV=0x16d8f848, pbOutput=0x3f50000, pcbResult=0x16d8f618) returned 0x0 [0123.030] WriteFile (in: hFile=0x538, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x16d8f61c*=0x17c0, lpOverlapped=0x0) returned 1 [0123.030] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16d8f60c | out: lpNewFilePointer=0x0) returned 1 [0123.031] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.031] WriteFile (in: hFile=0x538, lpBuffer=0x16d8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x16d8f83c*, lpNumberOfBytesWritten=0x16d8f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.031] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x17c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.031] BCryptDestroyKey (in: hKey=0x78bed0 | out: hKey=0x78bed0) returned 0x0 [0123.031] CloseHandle (hObject=0x538) returned 1 [0123.032] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0123.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-002c-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0123.034] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 170 os_tid = 0xa50 Thread: id = 171 os_tid = 0x7ac [0123.680] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.681] ReadFile (in: hFile=0x538, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.682] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.682] ReadFile (in: hFile=0x538, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.682] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.684] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xff8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0123.684] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xff8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xff8f828, pbKeyObject=0x0) returned 0x0 [0123.684] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xff8f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xff8f500) returned 0x0 [0123.684] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.684] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xff8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xff8f500) returned 0x0 [0123.687] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.688] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.688] WriteFile (in: hFile=0x538, lpBuffer=0xff8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xff8f830, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesWritten=0xff8f830*=0x428, lpOverlapped=0x0) returned 1 [0123.689] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.689] ReadFile (in: hFile=0x538, lpBuffer=0x2750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.704] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.704] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x2750000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x0 | out: hKey=0x785cd0, pbIV=0xff8f848, pbOutput=0x2750000, pcbResult=0xff8f618) returned 0x0 [0123.705] WriteFile (in: hFile=0x538, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.709] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0123.709] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.709] WriteFile (in: hFile=0x538, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.709] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.709] ReadFile (in: hFile=0x538, lpBuffer=0x2750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.941] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.942] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x2750000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x0 | out: hKey=0x785cd0, pbIV=0xff8f848, pbOutput=0x2750000, pcbResult=0xff8f618) returned 0x0 [0124.943] WriteFile (in: hFile=0x538, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.946] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0124.946] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.946] WriteFile (in: hFile=0x538, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.946] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.946] ReadFile (in: hFile=0x538, lpBuffer=0x2750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.097] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.097] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x2750000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x0 | out: hKey=0x785cd0, pbIV=0xff8f848, pbOutput=0x2750000, pcbResult=0xff8f618) returned 0x0 [0125.098] WriteFile (in: hFile=0x538, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.101] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0126.492] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.492] WriteFile (in: hFile=0x538, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.492] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.492] ReadFile (in: hFile=0x538, lpBuffer=0x2750000, nNumberOfBytesToRead=0xbafe2, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xff8f61c*=0xbafe2, lpOverlapped=0x0) returned 1 [0126.503] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfff4501e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.504] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x2750000, cbInput=0xbafe2, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0xff8f848, pbOutput=0x2750000, pcbResult=0xff8f618) returned 0x0 [0126.504] WriteFile (in: hFile=0x538, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xbaff0, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xff8f61c*=0xbaff0, lpOverlapped=0x0) returned 1 [0126.506] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0126.506] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.507] WriteFile (in: hFile=0x538, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.507] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x3baff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.507] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0126.507] CloseHandle (hObject=0x538) returned 1 [0130.340] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0130.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\inflr.cab.play")) returned 1 [0130.344] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 172 os_tid = 0x404 [0123.694] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.720] ReadFile (in: hFile=0x52c, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.722] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.723] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.724] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0123.724] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0123.724] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1020f500) returned 0x0 [0123.724] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.724] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1020f500) returned 0x0 [0123.727] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.729] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.729] WriteFile (in: hFile=0x52c, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0123.729] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.729] ReadFile (in: hFile=0x52c, lpBuffer=0x2950000, nNumberOfBytesToRead=0x4ce, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1020f61c*=0x4ce, lpOverlapped=0x0) returned 1 [0123.729] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffb32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.729] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x2950000, cbInput=0x4ce, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x1020f848, pbOutput=0x2950000, pcbResult=0x1020f618) returned 0x0 [0123.729] WriteFile (in: hFile=0x52c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1020f61c*=0x4d0, lpOverlapped=0x0) returned 1 [0123.730] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0123.730] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.730] WriteFile (in: hFile=0x52c, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.730] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x4d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.730] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0123.730] CloseHandle (hObject=0x52c) returned 1 [0123.732] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.733] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml.play")) returned 1 [0123.734] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 173 os_tid = 0xad4 [0123.736] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.736] ReadFile (in: hFile=0x51c, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.738] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.739] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.739] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0123.739] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0123.739] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1034f500) returned 0x0 [0123.739] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.739] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1034f500) returned 0x0 [0123.743] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.744] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.744] WriteFile (in: hFile=0x51c, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0123.744] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.744] ReadFile (in: hFile=0x51c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x703, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1034f61c*=0x703, lpOverlapped=0x0) returned 1 [0123.744] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xfffff8fd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.744] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x2a50000, cbInput=0x703, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x1034f848, pbOutput=0x2a50000, pcbResult=0x1034f618) returned 0x0 [0123.744] WriteFile (in: hFile=0x51c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1034f61c*=0x710, lpOverlapped=0x0) returned 1 [0123.744] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0123.745] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.745] WriteFile (in: hFile=0x51c, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.745] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.745] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0123.745] CloseHandle (hObject=0x51c) returned 1 [0123.746] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0044-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0123.747] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 174 os_tid = 0x1098 [0123.756] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.756] ReadFile (in: hFile=0x4e8, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0123.758] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.758] ReadFile (in: hFile=0x4e8, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0123.758] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.759] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.760] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0123.760] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0123.760] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x10acf500) returned 0x0 [0123.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.760] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x10acf500) returned 0x0 [0123.763] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.765] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.765] WriteFile (in: hFile=0x4e8, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0123.765] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.765] ReadFile (in: hFile=0x4e8, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x9ca36, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x10acf61c*=0x9ca36, lpOverlapped=0x0) returned 1 [0123.775] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfff635ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.775] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x2c50000, cbInput=0x9ca36, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x10acf848, pbOutput=0x2c50000, pcbResult=0x10acf618) returned 0x0 [0123.776] WriteFile (in: hFile=0x4e8, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x9ca40, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x10acf61c*=0x9ca40, lpOverlapped=0x0) returned 1 [0123.778] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0123.778] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.779] WriteFile (in: hFile=0x4e8, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0123.779] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x9ca40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.779] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0123.779] CloseHandle (hObject=0x4e8) returned 1 [0123.796] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.cab.play")) returned 1 [0123.830] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 175 os_tid = 0x109c [0123.799] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.799] ReadFile (in: hFile=0x4d8, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.801] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0123.802] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0123.802] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0123.802] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0123.802] BCryptExportKey (in: hKey=0x78a820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10e8f500) returned 0x0 [0123.803] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0123.803] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10e8f500) returned 0x0 [0123.807] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.809] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.809] WriteFile (in: hFile=0x4d8, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0123.809] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.810] ReadFile (in: hFile=0x4d8, lpBuffer=0x3050000, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x10e8f61c*=0x4bf, lpOverlapped=0x0) returned 1 [0123.810] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffb41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.810] BCryptEncrypt (in: hKey=0x78a820, pbInput=0x3050000, cbInput=0x4bf, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x78a820, pbIV=0x10e8f848, pbOutput=0x3050000, pcbResult=0x10e8f618) returned 0x0 [0123.810] WriteFile (in: hFile=0x4d8, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x10e8f61c*=0x4c0, lpOverlapped=0x0) returned 1 [0123.810] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0123.810] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.810] WriteFile (in: hFile=0x4d8, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.810] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x4c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.810] BCryptDestroyKey (in: hKey=0x78a820 | out: hKey=0x78a820) returned 0x0 [0123.810] CloseHandle (hObject=0x4d8) returned 1 [0123.824] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0123.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\DCFMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\dcfmui.xml.play")) returned 1 [0123.827] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 176 os_tid = 0x10a0 [0123.835] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.835] ReadFile (in: hFile=0x304, lpBuffer=0x15fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesRead=0x15fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0123.840] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.842] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.843] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x15fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0123.844] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x15fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x15fcf828, pbKeyObject=0x0) returned 0x0 [0123.844] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x15fcf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x15fcf500) returned 0x0 [0123.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.844] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x15fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x15fcf500) returned 0x0 [0123.848] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.849] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.849] WriteFile (in: hFile=0x304, lpBuffer=0x15fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15fcf830, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesWritten=0x15fcf830*=0x428, lpOverlapped=0x0) returned 1 [0123.849] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.849] ReadFile (in: hFile=0x304, lpBuffer=0x3350000, nNumberOfBytesToRead=0x710, lpNumberOfBytesRead=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x15fcf61c*=0x710, lpOverlapped=0x0) returned 1 [0123.849] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffff8f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.850] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3350000, cbInput=0x710, pPaddingInfo=0x0, pbIV=0x15fcf848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x15fcf618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x15fcf848, pbOutput=0x3350000, pcbResult=0x15fcf618) returned 0x0 [0123.850] WriteFile (in: hFile=0x304, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x15fcf61c*=0x720, lpOverlapped=0x0) returned 1 [0123.850] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15fcf60c | out: lpNewFilePointer=0x0) returned 1 [0123.850] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.850] WriteFile (in: hFile=0x304, lpBuffer=0x15fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15fcf83c*, lpNumberOfBytesWritten=0x15fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0123.850] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.850] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0123.850] CloseHandle (hObject=0x304) returned 1 [0123.851] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0090-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0090-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0123.853] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 177 os_tid = 0x4f0 [0123.855] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.855] ReadFile (in: hFile=0x28c, lpBuffer=0x1610fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1610f85c, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesRead=0x1610f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.858] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.858] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x1610f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0123.858] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x1610f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x1610f828, pbKeyObject=0x0) returned 0x0 [0123.858] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1610f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1610f500) returned 0x0 [0123.858] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.858] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1610f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1610f500) returned 0x0 [0123.862] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.863] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.863] WriteFile (in: hFile=0x28c, lpBuffer=0x1610fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1610f830, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesWritten=0x1610f830*=0x428, lpOverlapped=0x0) returned 1 [0123.863] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.863] ReadFile (in: hFile=0x28c, lpBuffer=0x3450000, nNumberOfBytesToRead=0x719, lpNumberOfBytesRead=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x1610f61c*=0x719, lpOverlapped=0x0) returned 1 [0123.863] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffff8e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.863] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3450000, cbInput=0x719, pPaddingInfo=0x0, pbIV=0x1610f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x1610f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x1610f848, pbOutput=0x3450000, pcbResult=0x1610f618) returned 0x0 [0123.863] WriteFile (in: hFile=0x28c, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x1610f61c*=0x720, lpOverlapped=0x0) returned 1 [0123.864] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1610f60c | out: lpNewFilePointer=0x0) returned 1 [0123.864] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.864] WriteFile (in: hFile=0x28c, lpBuffer=0x1610f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x1610f83c*, lpNumberOfBytesWritten=0x1610f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.864] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.864] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0123.864] CloseHandle (hObject=0x28c) returned 1 [0123.865] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.866] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml.play")) returned 1 [0123.870] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 178 os_tid = 0x102c [0123.872] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.872] ReadFile (in: hFile=0x644, lpBuffer=0x1638fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1638f85c, lpOverlapped=0x0 | out: lpBuffer=0x1638fb34*, lpNumberOfBytesRead=0x1638f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.874] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.874] ReadFile (in: hFile=0x644, lpBuffer=0x1638fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1638f85c, lpOverlapped=0x0 | out: lpBuffer=0x1638fb34*, lpNumberOfBytesRead=0x1638f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.875] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.876] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.876] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x1638f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0123.876] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x1638f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x1638f828, pbKeyObject=0x0) returned 0x0 [0123.876] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1638f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1638f500) returned 0x0 [0123.876] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.876] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1638f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1638f500) returned 0x0 [0123.879] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.881] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.881] WriteFile (in: hFile=0x644, lpBuffer=0x1638fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1638f830, lpOverlapped=0x0 | out: lpBuffer=0x1638fb34*, lpNumberOfBytesWritten=0x1638f830*=0x428, lpOverlapped=0x0) returned 1 [0123.881] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.881] ReadFile (in: hFile=0x644, lpBuffer=0x3550000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1638f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.897] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.897] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3550000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1638f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1638f618, dwFlags=0x0 | out: hKey=0x78a760, pbIV=0x1638f848, pbOutput=0x3550000, pcbResult=0x1638f618) returned 0x0 [0123.899] WriteFile (in: hFile=0x644, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1638f61c*=0x100000, lpOverlapped=0x0) returned 1 [0123.903] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1638f60c | out: lpNewFilePointer=0x0) returned 1 [0123.903] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.903] WriteFile (in: hFile=0x644, lpBuffer=0x1638f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x1638f83c*, lpNumberOfBytesWritten=0x1638f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.903] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.903] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xffeffbcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.903] ReadFile (in: hFile=0x644, lpBuffer=0x3550000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1638f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0125.102] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.102] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3550000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1638f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1638f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x1638f848, pbOutput=0x3550000, pcbResult=0x1638f618) returned 0x0 [0125.104] WriteFile (in: hFile=0x644, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1638f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.108] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1638f60c | out: lpNewFilePointer=0x0) returned 1 [0125.108] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.108] WriteFile (in: hFile=0x644, lpBuffer=0x1638f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1638f61c, lpOverlapped=0x0 | out: lpBuffer=0x1638f83c*, lpNumberOfBytesWritten=0x1638f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.108] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xcbc724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.108] WriteFile (in: hFile=0x644, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x1638f82c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1638f82c*=0xc, lpOverlapped=0x0) returned 1 [0125.109] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0125.109] CloseHandle (hObject=0x644) returned 1 [0132.665] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0132.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\onotelr.cab.play")) returned 1 [0132.667] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 179 os_tid = 0x1030 [0123.874] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.874] ReadFile (in: hFile=0x64c, lpBuffer=0x1660fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1660f85c, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesRead=0x1660f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.907] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.907] ReadFile (in: hFile=0x64c, lpBuffer=0x1660fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1660f85c, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesRead=0x1660f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.907] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.908] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.908] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1660f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0123.908] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1660f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1660f828, pbKeyObject=0x0) returned 0x0 [0123.908] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1660f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1660f500) returned 0x0 [0123.908] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.909] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1660f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1660f500) returned 0x0 [0123.912] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.913] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.913] WriteFile (in: hFile=0x64c, lpBuffer=0x1660fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1660f830, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesWritten=0x1660f830*=0x428, lpOverlapped=0x0) returned 1 [0123.913] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.913] ReadFile (in: hFile=0x64c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1660f61c*=0x87f, lpOverlapped=0x0) returned 1 [0123.913] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xfffff781, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.913] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3750000, cbInput=0x87f, pPaddingInfo=0x0, pbIV=0x1660f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1660f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x1660f848, pbOutput=0x3750000, pcbResult=0x1660f618) returned 0x0 [0123.913] WriteFile (in: hFile=0x64c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1660f61c*=0x880, lpOverlapped=0x0) returned 1 [0123.914] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1660f60c | out: lpNewFilePointer=0x0) returned 1 [0123.914] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.914] WriteFile (in: hFile=0x64c, lpBuffer=0x1660f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x1660f83c*, lpNumberOfBytesWritten=0x1660f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.914] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.914] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0123.914] CloseHandle (hObject=0x64c) returned 1 [0123.915] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0123.917] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 180 os_tid = 0x124c [0123.932] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.933] ReadFile (in: hFile=0x654, lpBuffer=0x1688fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1688f85c, lpOverlapped=0x0 | out: lpBuffer=0x1688fb34*, lpNumberOfBytesRead=0x1688f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.934] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.934] ReadFile (in: hFile=0x654, lpBuffer=0x1688fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1688f85c, lpOverlapped=0x0 | out: lpBuffer=0x1688fb34*, lpNumberOfBytesRead=0x1688f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.934] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.935] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.935] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x1688f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0123.935] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x1688f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x1688f828, pbKeyObject=0x0) returned 0x0 [0123.936] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1688f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1688f500) returned 0x0 [0123.936] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.936] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1688f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1688f500) returned 0x0 [0123.939] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.941] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.941] WriteFile (in: hFile=0x654, lpBuffer=0x1688fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1688f830, lpOverlapped=0x0 | out: lpBuffer=0x1688fb34*, lpNumberOfBytesWritten=0x1688f830*=0x428, lpOverlapped=0x0) returned 1 [0123.941] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.941] ReadFile (in: hFile=0x654, lpBuffer=0x3950000, nNumberOfBytesToRead=0xd5202, lpNumberOfBytesRead=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1688f61c*=0xd5202, lpOverlapped=0x0) returned 1 [0123.955] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0xfff2adfe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.955] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3950000, cbInput=0xd5202, pPaddingInfo=0x0, pbIV=0x1688f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1688f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x1688f848, pbOutput=0x3950000, pcbResult=0x1688f618) returned 0x0 [0123.956] WriteFile (in: hFile=0x654, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0xd5210, lpNumberOfBytesWritten=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1688f61c*=0xd5210, lpOverlapped=0x0) returned 1 [0123.959] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1688f60c | out: lpNewFilePointer=0x0) returned 1 [0123.959] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.959] WriteFile (in: hFile=0x654, lpBuffer=0x1688f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x1688f83c*, lpNumberOfBytesWritten=0x1688f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.959] SetFilePointerEx (in: hFile=0x654, liDistanceToMove=0xd5210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.959] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0123.959] CloseHandle (hObject=0x654) returned 1 [0123.997] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovelr.cab.play")) returned 1 [0123.999] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 181 os_tid = 0x660 [0123.946] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.947] ReadFile (in: hFile=0x65c, lpBuffer=0x16b0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16b0f85c, lpOverlapped=0x0 | out: lpBuffer=0x16b0fb34*, lpNumberOfBytesRead=0x16b0f85c*=0x428, lpOverlapped=0x0) returned 1 [0123.979] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0123.980] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0123.980] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x16b0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0123.980] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x16b0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x16b0f828, pbKeyObject=0x0) returned 0x0 [0123.980] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x16b0f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x16b0f500) returned 0x0 [0123.981] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0123.981] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x16b0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x16b0f500) returned 0x0 [0123.985] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.987] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.987] WriteFile (in: hFile=0x65c, lpBuffer=0x16b0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16b0f830, lpOverlapped=0x0 | out: lpBuffer=0x16b0fb34*, lpNumberOfBytesWritten=0x16b0f830*=0x428, lpOverlapped=0x0) returned 1 [0123.987] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.987] ReadFile (in: hFile=0x65c, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x466, lpNumberOfBytesRead=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x16b0f61c*=0x466, lpOverlapped=0x0) returned 1 [0123.987] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xfffffb9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.987] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3b50000, cbInput=0x466, pPaddingInfo=0x0, pbIV=0x16b0f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x16b0f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x16b0f848, pbOutput=0x3b50000, pcbResult=0x16b0f618) returned 0x0 [0123.987] WriteFile (in: hFile=0x65c, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x16b0f61c*=0x470, lpOverlapped=0x0) returned 1 [0123.988] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16b0f60c | out: lpNewFilePointer=0x0) returned 1 [0123.988] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.988] WriteFile (in: hFile=0x65c, lpBuffer=0x16b0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x16b0f83c*, lpNumberOfBytesWritten=0x16b0f61c*=0x8, lpOverlapped=0x0) returned 1 [0123.988] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.988] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0123.988] CloseHandle (hObject=0x65c) returned 1 [0123.990] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0123.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml.play")) returned 1 [0123.995] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 182 os_tid = 0xa78 [0124.002] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.002] ReadFile (in: hFile=0x664, lpBuffer=0x16c4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16c4f85c, lpOverlapped=0x0 | out: lpBuffer=0x16c4fb34*, lpNumberOfBytesRead=0x16c4f85c*=0x428, lpOverlapped=0x0) returned 1 [0124.004] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0124.004] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0124.004] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x16c4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0124.004] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x16c4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x16c4f828, pbKeyObject=0x0) returned 0x0 [0124.005] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x16c4f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x16c4f500) returned 0x0 [0124.005] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0124.005] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x16c4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x16c4f500) returned 0x0 [0124.008] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.010] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.010] WriteFile (in: hFile=0x664, lpBuffer=0x16c4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16c4f830, lpOverlapped=0x0 | out: lpBuffer=0x16c4fb34*, lpNumberOfBytesWritten=0x16c4f830*=0x428, lpOverlapped=0x0) returned 1 [0124.010] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.010] ReadFile (in: hFile=0x664, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x668, lpNumberOfBytesRead=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x16c4f61c*=0x668, lpOverlapped=0x0) returned 1 [0124.010] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xfffff998, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.010] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3d50000, cbInput=0x668, pPaddingInfo=0x0, pbIV=0x16c4f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x16c4f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x16c4f848, pbOutput=0x3d50000, pcbResult=0x16c4f618) returned 0x0 [0124.010] WriteFile (in: hFile=0x664, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x16c4f61c*=0x670, lpOverlapped=0x0) returned 1 [0124.010] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16c4f60c | out: lpNewFilePointer=0x0) returned 1 [0124.010] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.010] WriteFile (in: hFile=0x664, lpBuffer=0x16c4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x16c4f83c*, lpNumberOfBytesWritten=0x16c4f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.011] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.011] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0124.011] CloseHandle (hObject=0x664) returned 1 [0124.012] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0124.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0124.013] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 183 os_tid = 0x6f0 [0124.015] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.015] ReadFile (in: hFile=0x66c, lpBuffer=0x16d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesRead=0x16d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0124.017] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.017] ReadFile (in: hFile=0x66c, lpBuffer=0x16d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesRead=0x16d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0124.017] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0124.018] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0124.018] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x16d8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0124.018] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x16d8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x16d8f828, pbKeyObject=0x0) returned 0x0 [0124.018] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x16d8f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x16d8f500) returned 0x0 [0124.018] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0124.018] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x16d8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x16d8f500) returned 0x0 [0124.021] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.117] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.117] WriteFile (in: hFile=0x66c, lpBuffer=0x16d8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16d8f830, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesWritten=0x16d8f830*=0x428, lpOverlapped=0x0) returned 1 [0124.117] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.117] ReadFile (in: hFile=0x66c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x41ad, lpNumberOfBytesRead=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x16d8f61c*=0x41ad, lpOverlapped=0x0) returned 1 [0124.118] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffbe53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.118] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3e50000, cbInput=0x41ad, pPaddingInfo=0x0, pbIV=0x16d8f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x16d8f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x16d8f848, pbOutput=0x3e50000, pcbResult=0x16d8f618) returned 0x0 [0124.118] WriteFile (in: hFile=0x66c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x41b0, lpNumberOfBytesWritten=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x16d8f61c*=0x41b0, lpOverlapped=0x0) returned 1 [0124.118] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16d8f60c | out: lpNewFilePointer=0x0) returned 1 [0124.118] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.118] WriteFile (in: hFile=0x66c, lpBuffer=0x16d8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x16d8f83c*, lpNumberOfBytesWritten=0x16d8f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.119] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x41b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.119] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0124.119] CloseHandle (hObject=0x66c) returned 1 [0124.120] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0124.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.cab.play")) returned 1 [0124.123] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 184 os_tid = 0xbbc [0124.126] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.126] ReadFile (in: hFile=0x674, lpBuffer=0x16ecfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16ecf85c, lpOverlapped=0x0 | out: lpBuffer=0x16ecfb34*, lpNumberOfBytesRead=0x16ecf85c*=0x428, lpOverlapped=0x0) returned 1 [0124.128] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0124.129] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0124.129] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x16ecf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0124.129] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x16ecf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x16ecf828, pbKeyObject=0x0) returned 0x0 [0124.129] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x16ecf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x16ecf500) returned 0x0 [0124.130] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0124.130] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x16ecf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x16ecf500) returned 0x0 [0124.133] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.134] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.134] WriteFile (in: hFile=0x674, lpBuffer=0x16ecfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16ecf830, lpOverlapped=0x0 | out: lpBuffer=0x16ecfb34*, lpNumberOfBytesWritten=0x16ecf830*=0x428, lpOverlapped=0x0) returned 1 [0124.135] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.135] ReadFile (in: hFile=0x674, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x463, lpNumberOfBytesRead=0x16ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x16ecf61c*=0x463, lpOverlapped=0x0) returned 1 [0124.135] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xfffffb9d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.135] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3f50000, cbInput=0x463, pPaddingInfo=0x0, pbIV=0x16ecf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x16ecf618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x16ecf848, pbOutput=0x3f50000, pcbResult=0x16ecf618) returned 0x0 [0124.135] WriteFile (in: hFile=0x674, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x16ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x16ecf61c*=0x470, lpOverlapped=0x0) returned 1 [0124.135] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16ecf60c | out: lpNewFilePointer=0x0) returned 1 [0124.135] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.135] WriteFile (in: hFile=0x674, lpBuffer=0x16ecf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x16ecf83c*, lpNumberOfBytesWritten=0x16ecf61c*=0x8, lpOverlapped=0x0) returned 1 [0124.135] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.135] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0124.135] CloseHandle (hObject=0x674) returned 1 [0124.136] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0124.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\OSMMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\osmmui.xml.play")) returned 1 [0124.137] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 185 os_tid = 0x230 [0124.127] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.139] ReadFile (in: hFile=0x67c, lpBuffer=0x1700fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1700f85c, lpOverlapped=0x0 | out: lpBuffer=0x1700fb34*, lpNumberOfBytesRead=0x1700f85c*=0x428, lpOverlapped=0x0) returned 1 [0124.141] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0124.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0124.142] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x1700f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0124.142] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x1700f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x1700f828, pbKeyObject=0x0) returned 0x0 [0124.142] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1700f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1700f500) returned 0x0 [0124.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0124.142] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1700f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1700f500) returned 0x0 [0124.145] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.147] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.147] WriteFile (in: hFile=0x67c, lpBuffer=0x1700fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1700f830, lpOverlapped=0x0 | out: lpBuffer=0x1700fb34*, lpNumberOfBytesWritten=0x1700f830*=0x428, lpOverlapped=0x0) returned 1 [0124.147] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.147] ReadFile (in: hFile=0x67c, lpBuffer=0x4050000, nNumberOfBytesToRead=0x7f6, lpNumberOfBytesRead=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x1700f61c*=0x7f6, lpOverlapped=0x0) returned 1 [0124.147] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfffff80a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.147] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x4050000, cbInput=0x7f6, pPaddingInfo=0x0, pbIV=0x1700f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x1700f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x1700f848, pbOutput=0x4050000, pcbResult=0x1700f618) returned 0x0 [0124.147] WriteFile (in: hFile=0x67c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x1700f61c*=0x800, lpOverlapped=0x0) returned 1 [0124.147] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1700f60c | out: lpNewFilePointer=0x0) returned 1 [0124.147] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.147] WriteFile (in: hFile=0x67c, lpBuffer=0x1700f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x1700f83c*, lpNumberOfBytesWritten=0x1700f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.147] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.147] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0124.147] CloseHandle (hObject=0x67c) returned 1 [0124.148] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0124.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E1-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00e1-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0124.150] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 186 os_tid = 0x564 [0124.152] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.152] ReadFile (in: hFile=0x684, lpBuffer=0x1714fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1714f85c, lpOverlapped=0x0 | out: lpBuffer=0x1714fb34*, lpNumberOfBytesRead=0x1714f85c*=0x428, lpOverlapped=0x0) returned 1 [0124.154] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.154] ReadFile (in: hFile=0x684, lpBuffer=0x1714fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1714f85c, lpOverlapped=0x0 | out: lpBuffer=0x1714fb34*, lpNumberOfBytesRead=0x1714f85c*=0x428, lpOverlapped=0x0) returned 1 [0124.154] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0124.154] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0124.155] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x1714f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0124.155] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x1714f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x1714f828, pbKeyObject=0x0) returned 0x0 [0124.155] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1714f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1714f500) returned 0x0 [0124.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0124.155] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1714f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1714f500) returned 0x0 [0124.158] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.159] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.160] WriteFile (in: hFile=0x684, lpBuffer=0x1714fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1714f830, lpOverlapped=0x0 | out: lpBuffer=0x1714fb34*, lpNumberOfBytesWritten=0x1714f830*=0x428, lpOverlapped=0x0) returned 1 [0124.161] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.161] ReadFile (in: hFile=0x684, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.175] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.176] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1714f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1714f618, dwFlags=0x0 | out: hKey=0x78a9d0, pbIV=0x1714f848, pbOutput=0x4150000, pcbResult=0x1714f618) returned 0x0 [0124.177] WriteFile (in: hFile=0x684, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0124.180] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1714f60c | out: lpNewFilePointer=0x0) returned 1 [0124.180] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.181] WriteFile (in: hFile=0x684, lpBuffer=0x1714f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x1714f83c*, lpNumberOfBytesWritten=0x1714f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.181] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.181] ReadFile (in: hFile=0x684, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.165] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.165] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1714f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1714f618, dwFlags=0x0 | out: hKey=0x78a9d0, pbIV=0x1714f848, pbOutput=0x4150000, pcbResult=0x1714f618) returned 0x0 [0125.167] WriteFile (in: hFile=0x684, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.169] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1714f60c | out: lpNewFilePointer=0x0) returned 1 [0125.169] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.170] WriteFile (in: hFile=0x684, lpBuffer=0x1714f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x1714f83c*, lpNumberOfBytesWritten=0x1714f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.179] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.179] ReadFile (in: hFile=0x684, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.199] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.199] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1714f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1714f618, dwFlags=0x0 | out: hKey=0x78a9d0, pbIV=0x1714f848, pbOutput=0x4150000, pcbResult=0x1714f618) returned 0x0 [0125.200] WriteFile (in: hFile=0x684, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.203] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1714f60c | out: lpNewFilePointer=0x0) returned 1 [0125.203] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.203] WriteFile (in: hFile=0x684, lpBuffer=0x1714f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x1714f83c*, lpNumberOfBytesWritten=0x1714f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.720] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.720] ReadFile (in: hFile=0x684, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.728] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.728] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1714f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1714f618, dwFlags=0x0 | out: hKey=0x78a9d0, pbIV=0x1714f848, pbOutput=0x4150000, pcbResult=0x1714f618) returned 0x0 [0126.730] WriteFile (in: hFile=0x684, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1714f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.732] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1714f60c | out: lpNewFilePointer=0x0) returned 1 [0126.732] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.732] WriteFile (in: hFile=0x684, lpBuffer=0x1714f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x1714f83c*, lpNumberOfBytesWritten=0x1714f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.741] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.741] ReadFile (in: hFile=0x684, lpBuffer=0x4150000, nNumberOfBytesToRead=0x8e2d, lpNumberOfBytesRead=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1714f61c*=0x8e2d, lpOverlapped=0x0) returned 1 [0128.314] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xffff71d3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.315] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x4150000, cbInput=0x8e2d, pPaddingInfo=0x0, pbIV=0x1714f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1714f618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x1714f848, pbOutput=0x4150000, pcbResult=0x1714f618) returned 0x0 [0128.315] WriteFile (in: hFile=0x684, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x8e30, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1714f61c*=0x8e30, lpOverlapped=0x0) returned 1 [0128.315] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1714f60c | out: lpNewFilePointer=0x0) returned 1 [0128.315] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.315] WriteFile (in: hFile=0x684, lpBuffer=0x1714f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x1714f83c*, lpNumberOfBytesWritten=0x1714f61c*=0x8, lpOverlapped=0x0) returned 1 [0128.315] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x408e30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.315] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0128.315] CloseHandle (hObject=0x684) returned 1 [0131.246] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.cab.play")) returned 1 [0131.249] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 187 os_tid = 0x38c [0124.153] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.168] ReadFile (in: hFile=0x68c, lpBuffer=0x1728fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1728f85c, lpOverlapped=0x0 | out: lpBuffer=0x1728fb34*, lpNumberOfBytesRead=0x1728f85c*=0x428, lpOverlapped=0x0) returned 1 [0124.194] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0124.196] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0124.196] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x1728f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0124.196] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x1728f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x1728f828, pbKeyObject=0x0) returned 0x0 [0124.196] BCryptExportKey (in: hKey=0x78ac50, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1728f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1728f500) returned 0x0 [0124.196] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0124.196] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1728f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1728f500) returned 0x0 [0124.199] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.201] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.201] WriteFile (in: hFile=0x68c, lpBuffer=0x1728fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1728f830, lpOverlapped=0x0 | out: lpBuffer=0x1728fb34*, lpNumberOfBytesWritten=0x1728f830*=0x428, lpOverlapped=0x0) returned 1 [0124.201] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.201] ReadFile (in: hFile=0x68c, lpBuffer=0x4250000, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x1728f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x1728f61c*=0x5b2, lpOverlapped=0x0) returned 1 [0124.201] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0xfffffa4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.201] BCryptEncrypt (in: hKey=0x78ac50, pbInput=0x4250000, cbInput=0x5b2, pPaddingInfo=0x0, pbIV=0x1728f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x1728f618, dwFlags=0x1 | out: hKey=0x78ac50, pbIV=0x1728f848, pbOutput=0x4250000, pcbResult=0x1728f618) returned 0x0 [0124.201] WriteFile (in: hFile=0x68c, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1728f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x1728f61c*=0x5c0, lpOverlapped=0x0) returned 1 [0124.202] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1728f60c | out: lpNewFilePointer=0x0) returned 1 [0124.202] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.202] WriteFile (in: hFile=0x68c, lpBuffer=0x1728f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1728f61c, lpOverlapped=0x0 | out: lpBuffer=0x1728f83c*, lpNumberOfBytesWritten=0x1728f61c*=0x8, lpOverlapped=0x0) returned 1 [0124.202] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.202] BCryptDestroyKey (in: hKey=0x78ac50 | out: hKey=0x78ac50) returned 0x0 [0124.202] CloseHandle (hObject=0x68c) returned 1 [0124.203] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0124.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\OSMUXMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\osmuxmui.xml.play")) returned 1 [0124.206] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 188 os_tid = 0xb24 [0124.209] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.209] ReadFile (in: hFile=0x694, lpBuffer=0x173cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x173cf85c, lpOverlapped=0x0 | out: lpBuffer=0x173cfb34*, lpNumberOfBytesRead=0x173cf85c*=0x428, lpOverlapped=0x0) returned 1 [0124.211] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.211] ReadFile (in: hFile=0x694, lpBuffer=0x173cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x173cf85c, lpOverlapped=0x0 | out: lpBuffer=0x173cfb34*, lpNumberOfBytesRead=0x173cf85c*=0x428, lpOverlapped=0x0) returned 1 [0124.211] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0124.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0124.212] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x173cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0124.212] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x173cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x173cf828, pbKeyObject=0x0) returned 0x0 [0124.212] BCryptExportKey (in: hKey=0x78ac50, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x173cf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x173cf500) returned 0x0 [0124.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0124.212] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x173cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x173cf500) returned 0x0 [0124.215] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.216] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.216] WriteFile (in: hFile=0x694, lpBuffer=0x173cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x173cf830, lpOverlapped=0x0 | out: lpBuffer=0x173cfb34*, lpNumberOfBytesWritten=0x173cf830*=0x428, lpOverlapped=0x0) returned 1 [0124.217] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.217] ReadFile (in: hFile=0x694, lpBuffer=0x4350000, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x173cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x173cf61c*=0x996, lpOverlapped=0x0) returned 1 [0124.217] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffff66a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.217] BCryptEncrypt (in: hKey=0x78ac50, pbInput=0x4350000, cbInput=0x996, pPaddingInfo=0x0, pbIV=0x173cf848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x173cf618, dwFlags=0x1 | out: hKey=0x78ac50, pbIV=0x173cf848, pbOutput=0x4350000, pcbResult=0x173cf618) returned 0x0 [0124.217] WriteFile (in: hFile=0x694, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x173cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x173cf61c*=0x9a0, lpOverlapped=0x0) returned 1 [0124.217] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x173cf60c | out: lpNewFilePointer=0x0) returned 1 [0124.217] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.217] WriteFile (in: hFile=0x694, lpBuffer=0x173cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x173cf61c, lpOverlapped=0x0 | out: lpBuffer=0x173cf83c*, lpNumberOfBytesWritten=0x173cf61c*=0x8, lpOverlapped=0x0) returned 1 [0124.217] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x9a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.217] BCryptDestroyKey (in: hKey=0x78ac50 | out: hKey=0x78ac50) returned 0x0 [0124.217] CloseHandle (hObject=0x694) returned 1 [0124.218] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0124.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-00E2-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-00e2-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0124.219] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 189 os_tid = 0x67c Thread: id = 190 os_tid = 0x78c [0125.329] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.329] ReadFile (in: hFile=0x694, lpBuffer=0xe08fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe08f85c, lpOverlapped=0x0 | out: lpBuffer=0xe08fb34*, lpNumberOfBytesRead=0xe08f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.331] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.331] ReadFile (in: hFile=0x694, lpBuffer=0xe08fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe08f85c, lpOverlapped=0x0 | out: lpBuffer=0xe08fb34*, lpNumberOfBytesRead=0xe08f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.331] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0125.335] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0125.335] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xe08f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0125.335] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xe08f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xe08f828, pbKeyObject=0x0) returned 0x0 [0125.336] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xe08f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xe08f500) returned 0x0 [0125.336] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0125.336] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xe08f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xe08f500) returned 0x0 [0125.343] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.345] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.345] WriteFile (in: hFile=0x694, lpBuffer=0xe08fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe08f830, lpOverlapped=0x0 | out: lpBuffer=0xe08fb34*, lpNumberOfBytesWritten=0xe08f830*=0x428, lpOverlapped=0x0) returned 1 [0125.345] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.345] ReadFile (in: hFile=0x694, lpBuffer=0x2950000, nNumberOfBytesToRead=0x521b9, lpNumberOfBytesRead=0xe08f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xe08f61c*=0x521b9, lpOverlapped=0x0) returned 1 [0125.353] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffade47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.353] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x2950000, cbInput=0x521b9, pPaddingInfo=0x0, pbIV=0xe08f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xe08f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0xe08f848, pbOutput=0x2950000, pcbResult=0xe08f618) returned 0x0 [0125.353] WriteFile (in: hFile=0x694, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x521c0, lpNumberOfBytesWritten=0xe08f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xe08f61c*=0x521c0, lpOverlapped=0x0) returned 1 [0125.354] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe08f60c | out: lpNewFilePointer=0x0) returned 1 [0125.354] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.355] WriteFile (in: hFile=0x694, lpBuffer=0xe08f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe08f61c, lpOverlapped=0x0 | out: lpBuffer=0xe08f83c*, lpNumberOfBytesWritten=0xe08f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.355] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x521c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.355] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0125.355] CloseHandle (hObject=0x694) returned 1 [0125.365] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0126.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\branding.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\branding.xml.play")) returned 1 [0126.744] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 191 os_tid = 0x1258 [0125.349] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.349] ReadFile (in: hFile=0x67c, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.372] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.372] ReadFile (in: hFile=0x67c, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.372] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.373] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.374] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0125.374] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0125.374] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xfe4f500) returned 0x0 [0125.374] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.374] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xfe4f500) returned 0x0 [0125.378] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.379] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.379] WriteFile (in: hFile=0x67c, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0125.379] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.379] ReadFile (in: hFile=0x67c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xfe4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.395] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.395] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x2a50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x0 | out: hKey=0x78a760, pbIV=0xfe4f848, pbOutput=0x2a50000, pcbResult=0xfe4f618) returned 0x0 [0125.396] WriteFile (in: hFile=0x67c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xfe4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.399] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0125.399] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.399] WriteFile (in: hFile=0x67c, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.399] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.399] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xffeffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.399] ReadFile (in: hFile=0x67c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xfe4f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0126.749] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.749] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x2a50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0xfe4f848, pbOutput=0x2a50000, pcbResult=0xfe4f618) returned 0x0 [0126.750] WriteFile (in: hFile=0x67c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xfe4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.771] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0126.771] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.771] WriteFile (in: hFile=0x67c, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.772] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0xb2a202, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.772] WriteFile (in: hFile=0x67c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0xfe4f82c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xfe4f82c*=0xe, lpOverlapped=0x0) returned 1 [0126.772] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0126.772] CloseHandle (hObject=0x67c) returned 1 [0132.669] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0132.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officelr.cab.play")) returned 1 [0132.671] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 192 os_tid = 0x1184 [0125.402] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.402] ReadFile (in: hFile=0x66c, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.416] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.416] ReadFile (in: hFile=0x66c, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.417] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.418] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0125.418] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0125.418] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1020f500) returned 0x0 [0125.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.419] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1020f500) returned 0x0 [0125.422] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.423] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.423] WriteFile (in: hFile=0x66c, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0125.423] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.423] ReadFile (in: hFile=0x66c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x149b, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1020f61c*=0x149b, lpOverlapped=0x0) returned 1 [0125.423] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xffffeb65, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.424] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x2c50000, cbInput=0x149b, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1020f848, pbOutput=0x2c50000, pcbResult=0x1020f618) returned 0x0 [0125.424] WriteFile (in: hFile=0x66c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1020f61c*=0x14a0, lpOverlapped=0x0) returned 1 [0125.424] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0125.424] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.424] WriteFile (in: hFile=0x66c, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.424] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x14a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.424] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.424] CloseHandle (hObject=0x66c) returned 1 [0125.425] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml.play")) returned 1 [0125.427] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 193 os_tid = 0x1250 [0125.417] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.430] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.430] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0125.430] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0125.430] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1034f500) returned 0x0 [0125.430] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.430] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1034f500) returned 0x0 [0125.434] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.435] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.435] WriteFile (in: hFile=0x65c, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0125.437] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.437] ReadFile (in: hFile=0x65c, lpBuffer=0x3050000, nNumberOfBytesToRead=0x408, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1034f61c*=0x408, lpOverlapped=0x0) returned 1 [0125.437] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.437] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3050000, cbInput=0x408, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1034f848, pbOutput=0x3050000, pcbResult=0x1034f618) returned 0x0 [0125.437] WriteFile (in: hFile=0x65c, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1034f61c*=0x410, lpOverlapped=0x0) returned 1 [0125.437] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0125.437] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.437] WriteFile (in: hFile=0x65c, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.437] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.437] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.437] CloseHandle (hObject=0x65c) returned 1 [0125.438] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml.play")) returned 1 [0125.449] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 194 os_tid = 0x11b8 [0125.451] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.451] ReadFile (in: hFile=0x64c, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0125.452] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.453] ReadFile (in: hFile=0x64c, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0125.453] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.454] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.454] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0125.454] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0125.454] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10acf500) returned 0x0 [0125.454] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.454] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10acf500) returned 0x0 [0125.457] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.458] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.459] WriteFile (in: hFile=0x64c, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0125.459] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.459] ReadFile (in: hFile=0x64c, lpBuffer=0x3350000, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x10acf61c*=0x3d5c, lpOverlapped=0x0) returned 1 [0125.460] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xffffc2a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.460] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3350000, cbInput=0x3d5c, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x10acf848, pbOutput=0x3350000, pcbResult=0x10acf618) returned 0x0 [0125.460] WriteFile (in: hFile=0x64c, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x10acf61c*=0x3d60, lpOverlapped=0x0) returned 1 [0125.460] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0125.460] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.460] WriteFile (in: hFile=0x64c, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0125.460] SetFilePointerEx (in: hFile=0x64c, liDistanceToMove=0x3d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.461] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.461] CloseHandle (hObject=0x64c) returned 1 [0125.462] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OffSetLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\offsetlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\OffSetLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\offsetlr.cab.play")) returned 1 [0125.463] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 195 os_tid = 0x12a4 [0125.465] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.465] ReadFile (in: hFile=0x304, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.467] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.467] ReadFile (in: hFile=0x304, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.467] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.468] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.468] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0125.468] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0125.468] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10e8f500) returned 0x0 [0125.468] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.468] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10e8f500) returned 0x0 [0125.471] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.473] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.473] WriteFile (in: hFile=0x304, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0125.473] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.473] ReadFile (in: hFile=0x304, lpBuffer=0x3450000, nNumberOfBytesToRead=0x3906, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x10e8f61c*=0x3906, lpOverlapped=0x0) returned 1 [0125.474] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xffffc6fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.474] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3450000, cbInput=0x3906, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x10e8f848, pbOutput=0x3450000, pcbResult=0x10e8f618) returned 0x0 [0125.474] WriteFile (in: hFile=0x304, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10e8f61c*=0x3910, lpOverlapped=0x0) returned 1 [0125.474] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0125.474] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.474] WriteFile (in: hFile=0x304, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.474] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x3910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.474] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.474] CloseHandle (hObject=0x304) returned 1 [0125.476] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\pss10r.chm.play")) returned 1 [0125.477] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 196 os_tid = 0x72c [0125.480] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.480] ReadFile (in: hFile=0x4d8, lpBuffer=0x15fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesRead=0x15fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0125.481] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.481] ReadFile (in: hFile=0x4d8, lpBuffer=0x15fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesRead=0x15fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0125.481] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.482] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.482] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x15fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0125.482] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x15fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x15fcf828, pbKeyObject=0x0) returned 0x0 [0125.483] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x15fcf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x15fcf500) returned 0x0 [0125.483] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.483] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x15fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x15fcf500) returned 0x0 [0125.486] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.487] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.487] WriteFile (in: hFile=0x4d8, lpBuffer=0x15fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15fcf830, lpOverlapped=0x0 | out: lpBuffer=0x15fcfb34*, lpNumberOfBytesWritten=0x15fcf830*=0x428, lpOverlapped=0x0) returned 1 [0125.488] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.488] ReadFile (in: hFile=0x4d8, lpBuffer=0x3750000, nNumberOfBytesToRead=0x14366, lpNumberOfBytesRead=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x15fcf61c*=0x14366, lpOverlapped=0x0) returned 1 [0125.490] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffebc9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.490] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3750000, cbInput=0x14366, pPaddingInfo=0x0, pbIV=0x15fcf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x15fcf618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x15fcf848, pbOutput=0x3750000, pcbResult=0x15fcf618) returned 0x0 [0125.490] WriteFile (in: hFile=0x4d8, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x14370, lpNumberOfBytesWritten=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x15fcf61c*=0x14370, lpOverlapped=0x0) returned 1 [0125.490] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15fcf60c | out: lpNewFilePointer=0x0) returned 1 [0125.490] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.490] WriteFile (in: hFile=0x4d8, lpBuffer=0x15fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15fcf83c*, lpNumberOfBytesWritten=0x15fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0125.490] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x14370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.490] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.490] CloseHandle (hObject=0x4d8) returned 1 [0125.604] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\setup.chm.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.chm.play")) returned 1 [0125.606] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 197 os_tid = 0x1310 [0125.481] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.608] ReadFile (in: hFile=0x52c, lpBuffer=0x1610fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1610f85c, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesRead=0x1610f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.609] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.610] ReadFile (in: hFile=0x52c, lpBuffer=0x1610fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1610f85c, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesRead=0x1610f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.610] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.611] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x1610f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0125.611] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x1610f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x1610f828, pbKeyObject=0x0) returned 0x0 [0125.611] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1610f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1610f500) returned 0x0 [0125.611] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.611] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1610f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1610f500) returned 0x0 [0125.614] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.616] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.616] WriteFile (in: hFile=0x52c, lpBuffer=0x1610fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1610f830, lpOverlapped=0x0 | out: lpBuffer=0x1610fb34*, lpNumberOfBytesWritten=0x1610f830*=0x428, lpOverlapped=0x0) returned 1 [0125.616] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.616] ReadFile (in: hFile=0x52c, lpBuffer=0x3950000, nNumberOfBytesToRead=0x2123, lpNumberOfBytesRead=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1610f61c*=0x2123, lpOverlapped=0x0) returned 1 [0125.617] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xffffdedd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.617] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3950000, cbInput=0x2123, pPaddingInfo=0x0, pbIV=0x1610f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1610f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1610f848, pbOutput=0x3950000, pcbResult=0x1610f618) returned 0x0 [0125.617] WriteFile (in: hFile=0x52c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1610f61c*=0x2130, lpOverlapped=0x0) returned 1 [0125.617] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1610f60c | out: lpNewFilePointer=0x0) returned 1 [0125.617] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.617] WriteFile (in: hFile=0x52c, lpBuffer=0x1610f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1610f61c, lpOverlapped=0x0 | out: lpBuffer=0x1610f83c*, lpNumberOfBytesWritten=0x1610f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.617] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x2130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.617] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.617] CloseHandle (hObject=0x52c) returned 1 [0125.618] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0125.620] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 198 os_tid = 0x126c [0125.622] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.622] ReadFile (in: hFile=0x4bc, lpBuffer=0x1660fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1660f85c, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesRead=0x1660f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.623] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.623] ReadFile (in: hFile=0x4bc, lpBuffer=0x1660fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1660f85c, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesRead=0x1660f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.623] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.624] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.624] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x1660f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0125.625] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x1660f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x1660f828, pbKeyObject=0x0) returned 0x0 [0125.625] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1660f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1660f500) returned 0x0 [0125.625] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.625] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1660f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1660f500) returned 0x0 [0125.628] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.629] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.629] WriteFile (in: hFile=0x4bc, lpBuffer=0x1660fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1660f830, lpOverlapped=0x0 | out: lpBuffer=0x1660fb34*, lpNumberOfBytesWritten=0x1660f830*=0x428, lpOverlapped=0x0) returned 1 [0125.629] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.629] ReadFile (in: hFile=0x4bc, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1660f61c*=0x2a00, lpOverlapped=0x0) returned 1 [0125.630] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xffffd600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.630] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3b50000, cbInput=0x2a00, pPaddingInfo=0x0, pbIV=0x1660f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1660f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1660f848, pbOutput=0x3b50000, pcbResult=0x1660f618) returned 0x0 [0125.630] WriteFile (in: hFile=0x4bc, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1660f61c*=0x2a10, lpOverlapped=0x0) returned 1 [0125.630] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1660f60c | out: lpNewFilePointer=0x0) returned 1 [0125.630] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.630] WriteFile (in: hFile=0x4bc, lpBuffer=0x1660f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1660f61c, lpOverlapped=0x0 | out: lpBuffer=0x1660f83c*, lpNumberOfBytesWritten=0x1660f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.630] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x2a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.630] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.631] CloseHandle (hObject=0x4bc) returned 1 [0125.632] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0115-0409-0000-0000000ff1ce}-c\\shellui.mst.play")) returned 1 [0125.633] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 199 os_tid = 0x1288 [0125.636] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.637] ReadFile (in: hFile=0x4b4, lpBuffer=0x1688fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1688f85c, lpOverlapped=0x0 | out: lpBuffer=0x1688fb34*, lpNumberOfBytesRead=0x1688f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.640] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.642] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x1688f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0125.642] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x1688f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x1688f828, pbKeyObject=0x0) returned 0x0 [0125.642] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1688f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1688f500) returned 0x0 [0125.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.642] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1688f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1688f500) returned 0x0 [0125.647] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.649] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.649] WriteFile (in: hFile=0x4b4, lpBuffer=0x1688fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1688f830, lpOverlapped=0x0 | out: lpBuffer=0x1688fb34*, lpNumberOfBytesWritten=0x1688f830*=0x428, lpOverlapped=0x0) returned 1 [0125.649] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.649] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x1688f61c*=0x776, lpOverlapped=0x0) returned 1 [0125.649] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffff88a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.649] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3d50000, cbInput=0x776, pPaddingInfo=0x0, pbIV=0x1688f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x1688f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x1688f848, pbOutput=0x3d50000, pcbResult=0x1688f618) returned 0x0 [0125.649] WriteFile (in: hFile=0x4b4, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x1688f61c*=0x780, lpOverlapped=0x0) returned 1 [0125.649] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1688f60c | out: lpNewFilePointer=0x0) returned 1 [0125.649] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.649] WriteFile (in: hFile=0x4b4, lpBuffer=0x1688f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1688f61c, lpOverlapped=0x0 | out: lpBuffer=0x1688f83c*, lpNumberOfBytesWritten=0x1688f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.649] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.649] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.650] CloseHandle (hObject=0x4b4) returned 1 [0125.651] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64mui.xml.play")) returned 1 [0125.652] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 200 os_tid = 0x1290 [0125.654] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.655] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x16b0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0125.655] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x16b0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x16b0f828, pbKeyObject=0x0) returned 0x0 [0125.655] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x16b0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x16b0f500) returned 0x0 [0125.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.655] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x16b0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x16b0f500) returned 0x0 [0125.659] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.660] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.660] WriteFile (in: hFile=0x4ac, lpBuffer=0x16b0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16b0f830, lpOverlapped=0x0 | out: lpBuffer=0x16b0fb34*, lpNumberOfBytesWritten=0x16b0f830*=0x428, lpOverlapped=0x0) returned 1 [0125.661] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.661] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x40c, lpNumberOfBytesRead=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x16b0f61c*=0x40c, lpOverlapped=0x0) returned 1 [0125.661] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xfffffbf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.662] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3e50000, cbInput=0x40c, pPaddingInfo=0x0, pbIV=0x16b0f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x16b0f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x16b0f848, pbOutput=0x3e50000, pcbResult=0x16b0f618) returned 0x0 [0125.662] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x16b0f61c*=0x410, lpOverlapped=0x0) returned 1 [0125.662] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16b0f60c | out: lpNewFilePointer=0x0) returned 1 [0125.662] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.662] WriteFile (in: hFile=0x4ac, lpBuffer=0x16b0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x16b0f83c*, lpNumberOfBytesWritten=0x16b0f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.662] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.662] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0125.662] CloseHandle (hObject=0x4ac) returned 1 [0125.663] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Office64MUISet.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\office64muiset.xml.play")) returned 1 [0125.664] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 201 os_tid = 0x128c [0125.666] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.666] ReadFile (in: hFile=0x4a4, lpBuffer=0x16c4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16c4f85c, lpOverlapped=0x0 | out: lpBuffer=0x16c4fb34*, lpNumberOfBytesRead=0x16c4f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.668] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.668] ReadFile (in: hFile=0x4a4, lpBuffer=0x16c4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16c4f85c, lpOverlapped=0x0 | out: lpBuffer=0x16c4fb34*, lpNumberOfBytesRead=0x16c4f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.668] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.669] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.669] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x16c4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0125.669] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x16c4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x16c4f828, pbKeyObject=0x0) returned 0x0 [0125.669] BCryptExportKey (in: hKey=0x76acf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x16c4f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x16c4f500) returned 0x0 [0125.669] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.669] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x16c4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x16c4f500) returned 0x0 [0125.672] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.673] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.673] WriteFile (in: hFile=0x4a4, lpBuffer=0x16c4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16c4f830, lpOverlapped=0x0 | out: lpBuffer=0x16c4fb34*, lpNumberOfBytesWritten=0x16c4f830*=0x428, lpOverlapped=0x0) returned 1 [0125.674] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.674] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x16c4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.706] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.706] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3f50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x16c4f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x16c4f618, dwFlags=0x0 | out: hKey=0x76acf0, pbIV=0x16c4f848, pbOutput=0x3f50000, pcbResult=0x16c4f618) returned 0x0 [0125.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x16c4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.710] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16c4f60c | out: lpNewFilePointer=0x0) returned 1 [0125.710] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.710] WriteFile (in: hFile=0x4a4, lpBuffer=0x16c4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x16c4f83c*, lpNumberOfBytesWritten=0x16c4f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.711] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.711] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xf70a9, lpNumberOfBytesRead=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x16c4f61c*=0xf70a9, lpOverlapped=0x0) returned 1 [0126.802] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfff08f57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.802] BCryptEncrypt (in: hKey=0x76acf0, pbInput=0x3f50000, cbInput=0xf70a9, pPaddingInfo=0x0, pbIV=0x16c4f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x16c4f618, dwFlags=0x1 | out: hKey=0x76acf0, pbIV=0x16c4f848, pbOutput=0x3f50000, pcbResult=0x16c4f618) returned 0x0 [0126.803] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xf70b0, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x16c4f61c*=0xf70b0, lpOverlapped=0x0) returned 1 [0126.806] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16c4f60c | out: lpNewFilePointer=0x0) returned 1 [0126.806] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.806] WriteFile (in: hFile=0x4a4, lpBuffer=0x16c4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x16c4f83c*, lpNumberOfBytesWritten=0x16c4f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.806] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x1f70b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.806] BCryptDestroyKey (in: hKey=0x76acf0 | out: hKey=0x76acf0) returned 0x0 [0126.806] CloseHandle (hObject=0x4a4) returned 1 [0128.310] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0128.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\owow64lr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\OWOW64LR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\owow64lr.cab.play")) returned 1 [0128.312] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 202 os_tid = 0x1274 [0125.667] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.680] ReadFile (in: hFile=0x49c, lpBuffer=0x16d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesRead=0x16d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.682] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.682] ReadFile (in: hFile=0x49c, lpBuffer=0x16d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesRead=0x16d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.682] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.683] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x16d8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0125.683] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x16d8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x16d8f828, pbKeyObject=0x0) returned 0x0 [0125.683] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x16d8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x16d8f500) returned 0x0 [0125.684] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.684] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x16d8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x16d8f500) returned 0x0 [0125.687] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.689] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.689] WriteFile (in: hFile=0x49c, lpBuffer=0x16d8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16d8f830, lpOverlapped=0x0 | out: lpBuffer=0x16d8fb34*, lpNumberOfBytesWritten=0x16d8f830*=0x428, lpOverlapped=0x0) returned 1 [0125.689] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.690] ReadFile (in: hFile=0x49c, lpBuffer=0x4050000, nNumberOfBytesToRead=0xc32, lpNumberOfBytesRead=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x16d8f61c*=0xc32, lpOverlapped=0x0) returned 1 [0125.690] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffff3ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.690] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x4050000, cbInput=0xc32, pPaddingInfo=0x0, pbIV=0x16d8f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x16d8f618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x16d8f848, pbOutput=0x4050000, pcbResult=0x16d8f618) returned 0x0 [0125.690] WriteFile (in: hFile=0x49c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x16d8f61c*=0xc40, lpOverlapped=0x0) returned 1 [0125.690] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16d8f60c | out: lpNewFilePointer=0x0) returned 1 [0125.690] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.690] WriteFile (in: hFile=0x49c, lpBuffer=0x16d8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x16d8f83c*, lpNumberOfBytesWritten=0x16d8f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.690] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xc40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.690] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0125.690] CloseHandle (hObject=0x49c) returned 1 [0125.691] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0116-0409-1000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0116-0409-1000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0125.694] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 203 os_tid = 0x12a0 [0125.724] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.724] ReadFile (in: hFile=0x490, lpBuffer=0x16ecfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x16ecf85c, lpOverlapped=0x0 | out: lpBuffer=0x16ecfb34*, lpNumberOfBytesRead=0x16ecf85c*=0x428, lpOverlapped=0x0) returned 1 [0125.726] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.727] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x16ecf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0125.727] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x16ecf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x16ecf828, pbKeyObject=0x0) returned 0x0 [0125.727] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x16ecf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x16ecf500) returned 0x0 [0125.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.727] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x16ecf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x16ecf500) returned 0x0 [0125.731] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.732] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.732] WriteFile (in: hFile=0x490, lpBuffer=0x16ecfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x16ecf830, lpOverlapped=0x0 | out: lpBuffer=0x16ecfb34*, lpNumberOfBytesWritten=0x16ecf830*=0x428, lpOverlapped=0x0) returned 1 [0125.732] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.732] ReadFile (in: hFile=0x490, lpBuffer=0x4250000, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x16ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x16ecf61c*=0x5a9, lpOverlapped=0x0) returned 1 [0125.733] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffa57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.733] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x4250000, cbInput=0x5a9, pPaddingInfo=0x0, pbIV=0x16ecf848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x16ecf618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x16ecf848, pbOutput=0x4250000, pcbResult=0x16ecf618) returned 0x0 [0125.733] WriteFile (in: hFile=0x490, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x16ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x16ecf61c*=0x5b0, lpOverlapped=0x0) returned 1 [0125.733] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x16ecf60c | out: lpNewFilePointer=0x0) returned 1 [0125.733] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.733] WriteFile (in: hFile=0x490, lpBuffer=0x16ecf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x16ecf83c*, lpNumberOfBytesWritten=0x16ecf61c*=0x8, lpOverlapped=0x0) returned 1 [0125.733] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.733] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0125.733] CloseHandle (hObject=0x490) returned 1 [0125.734] VirtualAlloc (lpAddress=0x0, dwSize=0xc7, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.735] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.play")) returned 1 [0125.736] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 204 os_tid = 0x129c [0125.738] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.738] ReadFile (in: hFile=0x488, lpBuffer=0x1700fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1700f85c, lpOverlapped=0x0 | out: lpBuffer=0x1700fb34*, lpNumberOfBytesRead=0x1700f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.740] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.740] ReadFile (in: hFile=0x488, lpBuffer=0x1700fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1700f85c, lpOverlapped=0x0 | out: lpBuffer=0x1700fb34*, lpNumberOfBytesRead=0x1700f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.740] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.741] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.741] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x1700f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0125.741] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x1700f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x1700f828, pbKeyObject=0x0) returned 0x0 [0125.741] BCryptExportKey (in: hKey=0x76af70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1700f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1700f500) returned 0x0 [0125.741] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.741] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1700f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1700f500) returned 0x0 [0125.745] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.746] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.746] WriteFile (in: hFile=0x488, lpBuffer=0x1700fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1700f830, lpOverlapped=0x0 | out: lpBuffer=0x1700fb34*, lpNumberOfBytesWritten=0x1700f830*=0x428, lpOverlapped=0x0) returned 1 [0125.747] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.747] ReadFile (in: hFile=0x488, lpBuffer=0x4350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x1700f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.779] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.780] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x4350000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1700f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x1700f618, dwFlags=0x0 | out: hKey=0x76af70, pbIV=0x1700f848, pbOutput=0x4350000, pcbResult=0x1700f618) returned 0x0 [0125.781] WriteFile (in: hFile=0x488, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x1700f61c*=0x100000, lpOverlapped=0x0) returned 1 [0125.783] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1700f60c | out: lpNewFilePointer=0x0) returned 1 [0125.784] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.784] WriteFile (in: hFile=0x488, lpBuffer=0x1700f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x1700f83c*, lpNumberOfBytesWritten=0x1700f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.784] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.784] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0xffeffbd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.784] ReadFile (in: hFile=0x488, lpBuffer=0x4350000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x1700f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0126.856] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.857] BCryptEncrypt (in: hKey=0x76af70, pbInput=0x4350000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1700f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x1700f618, dwFlags=0x1 | out: hKey=0x76af70, pbIV=0x1700f848, pbOutput=0x4350000, pcbResult=0x1700f618) returned 0x0 [0126.858] WriteFile (in: hFile=0x488, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x1700f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.874] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1700f60c | out: lpNewFilePointer=0x0) returned 1 [0126.874] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.874] WriteFile (in: hFile=0x488, lpBuffer=0x1700f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1700f61c, lpOverlapped=0x0 | out: lpBuffer=0x1700f83c*, lpNumberOfBytesWritten=0x1700f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.875] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x525e3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.875] WriteFile (in: hFile=0x488, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1700f82c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x1700f82c*=0x2, lpOverlapped=0x0) returned 1 [0126.875] BCryptDestroyKey (in: hKey=0x76af70 | out: hKey=0x76af70) returned 0x0 [0126.875] CloseHandle (hObject=0x488) returned 1 [0131.479] VirtualAlloc (lpAddress=0x0, dwSize=0xbf, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.480] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\acclr.cab.play")) returned 1 [0131.484] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 205 os_tid = 0x12ac [0125.753] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.753] ReadFile (in: hFile=0x480, lpBuffer=0x1728fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1728f85c, lpOverlapped=0x0 | out: lpBuffer=0x1728fb34*, lpNumberOfBytesRead=0x1728f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.755] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.755] ReadFile (in: hFile=0x480, lpBuffer=0x1728fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1728f85c, lpOverlapped=0x0 | out: lpBuffer=0x1728fb34*, lpNumberOfBytesRead=0x1728f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.755] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.757] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.757] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x1728f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0125.757] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x1728f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x1728f828, pbKeyObject=0x0) returned 0x0 [0125.757] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1728f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1728f500) returned 0x0 [0125.757] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.764] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1728f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1728f500) returned 0x0 [0125.767] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.768] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.769] WriteFile (in: hFile=0x480, lpBuffer=0x1728fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1728f830, lpOverlapped=0x0 | out: lpBuffer=0x1728fb34*, lpNumberOfBytesWritten=0x1728f830*=0x428, lpOverlapped=0x0) returned 1 [0125.769] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.769] ReadFile (in: hFile=0x480, lpBuffer=0x4450000, nNumberOfBytesToRead=0x521b9, lpNumberOfBytesRead=0x1728f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x1728f61c*=0x521b9, lpOverlapped=0x0) returned 1 [0125.797] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0xfffade47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.797] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x4450000, cbInput=0x521b9, pPaddingInfo=0x0, pbIV=0x1728f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x1728f618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x1728f848, pbOutput=0x4450000, pcbResult=0x1728f618) returned 0x0 [0125.798] WriteFile (in: hFile=0x480, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x521c0, lpNumberOfBytesWritten=0x1728f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x1728f61c*=0x521c0, lpOverlapped=0x0) returned 1 [0125.799] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1728f60c | out: lpNewFilePointer=0x0) returned 1 [0125.799] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.799] WriteFile (in: hFile=0x480, lpBuffer=0x1728f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1728f61c, lpOverlapped=0x0 | out: lpBuffer=0x1728f83c*, lpNumberOfBytesWritten=0x1728f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.799] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x521c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.799] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0125.799] CloseHandle (hObject=0x480) returned 1 [0125.806] VirtualAlloc (lpAddress=0x0, dwSize=0xc5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml.play")) returned 1 [0125.808] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 206 os_tid = 0x12a8 [0125.811] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.812] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.812] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x173cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0125.812] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x173cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x173cf828, pbKeyObject=0x0) returned 0x0 [0125.812] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x173cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x173cf500) returned 0x0 [0125.812] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.812] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x173cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x173cf500) returned 0x0 [0125.815] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.817] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.817] WriteFile (in: hFile=0x494, lpBuffer=0x173cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x173cf830, lpOverlapped=0x0 | out: lpBuffer=0x173cfb34*, lpNumberOfBytesWritten=0x173cf830*=0x428, lpOverlapped=0x0) returned 1 [0125.994] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.994] ReadFile (in: hFile=0x494, lpBuffer=0x4550000, nNumberOfBytesToRead=0x408, lpNumberOfBytesRead=0x173cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x173cf61c*=0x408, lpOverlapped=0x0) returned 1 [0125.994] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.994] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x4550000, cbInput=0x408, pPaddingInfo=0x0, pbIV=0x173cf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x173cf618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x173cf848, pbOutput=0x4550000, pcbResult=0x173cf618) returned 0x0 [0125.994] WriteFile (in: hFile=0x494, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x173cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x173cf61c*=0x410, lpOverlapped=0x0) returned 1 [0125.994] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x173cf60c | out: lpNewFilePointer=0x0) returned 1 [0125.994] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.995] WriteFile (in: hFile=0x494, lpBuffer=0x173cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x173cf61c, lpOverlapped=0x0 | out: lpBuffer=0x173cf83c*, lpNumberOfBytesWritten=0x173cf61c*=0x8, lpOverlapped=0x0) returned 1 [0125.995] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.995] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0125.995] CloseHandle (hObject=0x494) returned 1 [0125.996] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml.play")) returned 1 [0125.998] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 207 os_tid = 0x1270 [0125.818] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.818] ReadFile (in: hFile=0x474, lpBuffer=0x1764fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1764f85c, lpOverlapped=0x0 | out: lpBuffer=0x1764fb34*, lpNumberOfBytesRead=0x1764f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.981] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.981] ReadFile (in: hFile=0x474, lpBuffer=0x1764fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1764f85c, lpOverlapped=0x0 | out: lpBuffer=0x1764fb34*, lpNumberOfBytesRead=0x1764f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.981] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.982] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.982] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x1764f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0125.982] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x1764f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x1764f828, pbKeyObject=0x0) returned 0x0 [0125.982] BCryptExportKey (in: hKey=0x78f330, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1764f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1764f500) returned 0x0 [0125.983] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.983] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1764f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1764f500) returned 0x0 [0125.986] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.987] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.987] WriteFile (in: hFile=0x474, lpBuffer=0x1764fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1764f830, lpOverlapped=0x0 | out: lpBuffer=0x1764fb34*, lpNumberOfBytesWritten=0x1764f830*=0x428, lpOverlapped=0x0) returned 1 [0125.987] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.987] ReadFile (in: hFile=0x474, lpBuffer=0x4650000, nNumberOfBytesToRead=0xa18, lpNumberOfBytesRead=0x1764f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x1764f61c*=0xa18, lpOverlapped=0x0) returned 1 [0125.988] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xfffff5e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.988] BCryptEncrypt (in: hKey=0x78f330, pbInput=0x4650000, cbInput=0xa18, pPaddingInfo=0x0, pbIV=0x1764f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x1764f618, dwFlags=0x1 | out: hKey=0x78f330, pbIV=0x1764f848, pbOutput=0x4650000, pcbResult=0x1764f618) returned 0x0 [0125.988] WriteFile (in: hFile=0x474, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x1764f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x1764f61c*=0xa20, lpOverlapped=0x0) returned 1 [0125.988] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1764f60c | out: lpNewFilePointer=0x0) returned 1 [0125.988] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.988] WriteFile (in: hFile=0x474, lpBuffer=0x1764f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1764f61c, lpOverlapped=0x0 | out: lpBuffer=0x1764f83c*, lpNumberOfBytesWritten=0x1764f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.988] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xa20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.988] BCryptDestroyKey (in: hKey=0x78f330 | out: hKey=0x78f330) returned 0x0 [0125.988] CloseHandle (hObject=0x474) returned 1 [0125.990] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-0117-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0125.991] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 208 os_tid = 0x1268 [0125.819] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.819] ReadFile (in: hFile=0x46c, lpBuffer=0x1778fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1778f85c, lpOverlapped=0x0 | out: lpBuffer=0x1778fb34*, lpNumberOfBytesRead=0x1778f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.953] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.953] ReadFile (in: hFile=0x46c, lpBuffer=0x1778fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1778f85c, lpOverlapped=0x0 | out: lpBuffer=0x1778fb34*, lpNumberOfBytesRead=0x1778f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.953] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.954] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.955] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x1778f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0125.955] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x1778f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x1778f828, pbKeyObject=0x0) returned 0x0 [0125.955] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1778f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1778f500) returned 0x0 [0125.955] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.955] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1778f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1778f500) returned 0x0 [0125.959] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.961] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.961] WriteFile (in: hFile=0x46c, lpBuffer=0x1778fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1778f830, lpOverlapped=0x0 | out: lpBuffer=0x1778fb34*, lpNumberOfBytesWritten=0x1778f830*=0x428, lpOverlapped=0x0) returned 1 [0125.961] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.961] ReadFile (in: hFile=0x46c, lpBuffer=0x4750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x1778f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.137] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.137] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x4750000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1778f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x1778f618, dwFlags=0x0 | out: hKey=0x78f0c0, pbIV=0x1778f848, pbOutput=0x4750000, pcbResult=0x1778f618) returned 0x0 [0126.138] WriteFile (in: hFile=0x46c, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x1778f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.141] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1778f60c | out: lpNewFilePointer=0x0) returned 1 [0126.141] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.141] WriteFile (in: hFile=0x46c, lpBuffer=0x1778f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x1778f83c*, lpNumberOfBytesWritten=0x1778f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.141] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.141] ReadFile (in: hFile=0x46c, lpBuffer=0x4750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x1778f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.166] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.166] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x4750000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1778f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x1778f618, dwFlags=0x0 | out: hKey=0x78f0c0, pbIV=0x1778f848, pbOutput=0x4750000, pcbResult=0x1778f618) returned 0x0 [0126.167] WriteFile (in: hFile=0x46c, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x1778f61c*=0x100000, lpOverlapped=0x0) returned 1 [0126.170] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1778f60c | out: lpNewFilePointer=0x0) returned 1 [0126.170] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.170] WriteFile (in: hFile=0x46c, lpBuffer=0x1778f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x1778f83c*, lpNumberOfBytesWritten=0x1778f61c*=0x8, lpOverlapped=0x0) returned 1 [0126.170] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.170] ReadFile (in: hFile=0x46c, lpBuffer=0x4750000, nNumberOfBytesToRead=0x7cdde, lpNumberOfBytesRead=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x1778f61c*=0x7cdde, lpOverlapped=0x0) returned 1 [0127.260] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfff83222, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.260] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x4750000, cbInput=0x7cdde, pPaddingInfo=0x0, pbIV=0x1778f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x1778f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0x1778f848, pbOutput=0x4750000, pcbResult=0x1778f618) returned 0x0 [0127.261] WriteFile (in: hFile=0x46c, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x7cde0, lpNumberOfBytesWritten=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x1778f61c*=0x7cde0, lpOverlapped=0x0) returned 1 [0127.262] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1778f60c | out: lpNewFilePointer=0x0) returned 1 [0127.262] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.262] WriteFile (in: hFile=0x46c, lpBuffer=0x1778f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1778f61c, lpOverlapped=0x0 | out: lpBuffer=0x1778f83c*, lpNumberOfBytesWritten=0x1778f61c*=0x8, lpOverlapped=0x0) returned 1 [0127.262] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x27cde0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.263] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0127.263] CloseHandle (hObject=0x46c) returned 1 [0129.938] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0129.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.cab" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.cab.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.cab.play")) returned 1 [0129.940] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 209 os_tid = 0x1298 [0125.821] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.821] ReadFile (in: hFile=0x464, lpBuffer=0x178cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x178cf85c, lpOverlapped=0x0 | out: lpBuffer=0x178cfb34*, lpNumberOfBytesRead=0x178cf85c*=0x428, lpOverlapped=0x0) returned 1 [0126.000] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0126.000] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0126.000] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x178cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0126.000] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x178cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x178cf828, pbKeyObject=0x0) returned 0x0 [0126.000] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x178cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x178cf500) returned 0x0 [0126.001] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0126.001] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x178cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x178cf500) returned 0x0 [0126.004] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.005] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.005] WriteFile (in: hFile=0x464, lpBuffer=0x178cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x178cf830, lpOverlapped=0x0 | out: lpBuffer=0x178cfb34*, lpNumberOfBytesWritten=0x178cf830*=0x428, lpOverlapped=0x0) returned 1 [0126.005] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.005] ReadFile (in: hFile=0x464, lpBuffer=0x4850000, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x178cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x178cf61c*=0x4cb, lpOverlapped=0x0) returned 1 [0126.005] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0xfffffb35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.005] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x4850000, cbInput=0x4cb, pPaddingInfo=0x0, pbIV=0x178cf848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x178cf618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x178cf848, pbOutput=0x4850000, pcbResult=0x178cf618) returned 0x0 [0126.005] WriteFile (in: hFile=0x464, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x178cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x178cf61c*=0x4d0, lpOverlapped=0x0) returned 1 [0126.005] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x178cf60c | out: lpNewFilePointer=0x0) returned 1 [0126.006] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.006] WriteFile (in: hFile=0x464, lpBuffer=0x178cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x178cf61c, lpOverlapped=0x0 | out: lpBuffer=0x178cf83c*, lpNumberOfBytesWritten=0x178cf61c*=0x8, lpOverlapped=0x0) returned 1 [0126.006] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x4d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.006] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0126.006] CloseHandle (hObject=0x464) returned 1 [0126.007] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0126.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\LyncMUI.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\lyncmui.xml.play")) returned 1 [0126.009] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 210 os_tid = 0x12e4 [0125.822] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.822] ReadFile (in: hFile=0x45c, lpBuffer=0x17a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x17a0fb34*, lpNumberOfBytesRead=0x17a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.823] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.824] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x17a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0125.824] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x17a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x17a0f828, pbKeyObject=0x0) returned 0x0 [0125.824] BCryptExportKey (in: hKey=0x78d0b0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x17a0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x17a0f500) returned 0x0 [0125.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.825] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x17a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x17a0f500) returned 0x0 [0125.828] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.829] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.829] WriteFile (in: hFile=0x45c, lpBuffer=0x17a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x17a0f830, lpOverlapped=0x0 | out: lpBuffer=0x17a0fb34*, lpNumberOfBytesWritten=0x17a0f830*=0x428, lpOverlapped=0x0) returned 1 [0125.829] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.829] ReadFile (in: hFile=0x45c, lpBuffer=0x4950000, nNumberOfBytesToRead=0x69a, lpNumberOfBytesRead=0x17a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x17a0f61c*=0x69a, lpOverlapped=0x0) returned 1 [0125.829] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0xfffff966, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.830] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4950000, cbInput=0x69a, pPaddingInfo=0x0, pbIV=0x17a0f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x17a0f618, dwFlags=0x1 | out: hKey=0x78d0b0, pbIV=0x17a0f848, pbOutput=0x4950000, pcbResult=0x17a0f618) returned 0x0 [0125.830] WriteFile (in: hFile=0x45c, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x17a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x17a0f61c*=0x6a0, lpOverlapped=0x0) returned 1 [0125.830] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17a0f60c | out: lpNewFilePointer=0x0) returned 1 [0125.830] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.830] WriteFile (in: hFile=0x45c, lpBuffer=0x17a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x17a0f83c*, lpNumberOfBytesWritten=0x17a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.830] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x6a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.830] BCryptDestroyKey (in: hKey=0x78d0b0 | out: hKey=0x78d0b0) returned 0x0 [0125.830] CloseHandle (hObject=0x45c) returned 1 [0125.832] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90160000-012B-0409-0000-0000000FF1CE}-C\\Setup.xml.PLAY" (normalized: "c:\\msocache\\all users\\{90160000-012b-0409-0000-0000000ff1ce}-c\\setup.xml.play")) returned 1 [0125.835] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 211 os_tid = 0x12e8 [0125.839] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.839] ReadFile (in: hFile=0x2e4, lpBuffer=0x17b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x17b4fb34*, lpNumberOfBytesRead=0x17b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.840] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.840] ReadFile (in: hFile=0x2e4, lpBuffer=0x17b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x17b4fb34*, lpNumberOfBytesRead=0x17b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0125.840] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.840] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.841] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x17b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0125.841] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x17b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x17b4f828, pbKeyObject=0x0) returned 0x0 [0125.841] BCryptExportKey (in: hKey=0x78d0b0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x17b4f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x17b4f500) returned 0x0 [0125.841] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.841] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x17b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x17b4f500) returned 0x0 [0125.844] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.845] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.845] WriteFile (in: hFile=0x2e4, lpBuffer=0x17b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x17b4f830, lpOverlapped=0x0 | out: lpBuffer=0x17b4fb34*, lpNumberOfBytesWritten=0x17b4f830*=0x428, lpOverlapped=0x0) returned 1 [0125.846] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.846] ReadFile (in: hFile=0x2e4, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x137c8, lpNumberOfBytesRead=0x17b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x17b4f61c*=0x137c8, lpOverlapped=0x0) returned 1 [0125.846] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xfffec838, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.847] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4a50000, cbInput=0x137c8, pPaddingInfo=0x0, pbIV=0x17b4f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x17b4f618, dwFlags=0x1 | out: hKey=0x78d0b0, pbIV=0x17b4f848, pbOutput=0x4a50000, pcbResult=0x17b4f618) returned 0x0 [0125.847] WriteFile (in: hFile=0x2e4, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x137d0, lpNumberOfBytesWritten=0x17b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x17b4f61c*=0x137d0, lpOverlapped=0x0) returned 1 [0125.847] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17b4f60c | out: lpNewFilePointer=0x0) returned 1 [0125.847] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.847] WriteFile (in: hFile=0x2e4, lpBuffer=0x17b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x17b4f83c*, lpNumberOfBytesWritten=0x17b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0125.847] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x137d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.847] BCryptDestroyKey (in: hKey=0x78d0b0 | out: hKey=0x78d0b0) returned 0x0 [0125.847] CloseHandle (hObject=0x2e4) returned 1 [0125.850] VirtualAlloc (lpAddress=0x0, dwSize=0x67, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.851] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\F5u84D9.bmp" (normalized: "c:\\program files\\common files\\f5u84d9.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\F5u84D9.bmp.PLAY" (normalized: "c:\\program files\\common files\\f5u84d9.bmp.play")) returned 1 [0125.862] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 212 os_tid = 0x1264 [0125.865] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.865] ReadFile (in: hFile=0x450, lpBuffer=0x17effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17eff85c, lpOverlapped=0x0 | out: lpBuffer=0x17effb34*, lpNumberOfBytesRead=0x17eff85c*=0x428, lpOverlapped=0x0) returned 1 [0125.866] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.866] ReadFile (in: hFile=0x450, lpBuffer=0x17effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17eff85c, lpOverlapped=0x0 | out: lpBuffer=0x17effb34*, lpNumberOfBytesRead=0x17eff85c*=0x428, lpOverlapped=0x0) returned 1 [0125.866] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0125.867] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0125.867] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x17eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0125.867] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x17eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x17eff828, pbKeyObject=0x0) returned 0x0 [0125.867] BCryptExportKey (in: hKey=0x78d0b0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x17eff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x17eff500) returned 0x0 [0125.867] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0125.867] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x17eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x17eff500) returned 0x0 [0125.871] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.872] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.872] WriteFile (in: hFile=0x450, lpBuffer=0x17effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x17eff830, lpOverlapped=0x0 | out: lpBuffer=0x17effb34*, lpNumberOfBytesWritten=0x17eff830*=0x428, lpOverlapped=0x0) returned 1 [0125.872] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.872] ReadFile (in: hFile=0x450, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x1676f, lpNumberOfBytesRead=0x17eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x17eff61c*=0x1676f, lpOverlapped=0x0) returned 1 [0125.874] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffe9891, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.874] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4b50000, cbInput=0x1676f, pPaddingInfo=0x0, pbIV=0x17eff848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x17eff618, dwFlags=0x1 | out: hKey=0x78d0b0, pbIV=0x17eff848, pbOutput=0x4b50000, pcbResult=0x17eff618) returned 0x0 [0125.874] WriteFile (in: hFile=0x450, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x16770, lpNumberOfBytesWritten=0x17eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x17eff61c*=0x16770, lpOverlapped=0x0) returned 1 [0125.874] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17eff60c | out: lpNewFilePointer=0x0) returned 1 [0125.874] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.874] WriteFile (in: hFile=0x450, lpBuffer=0x17eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17eff61c, lpOverlapped=0x0 | out: lpBuffer=0x17eff83c*, lpNumberOfBytesWritten=0x17eff61c*=0x8, lpOverlapped=0x0) returned 1 [0125.874] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x16770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.874] BCryptDestroyKey (in: hKey=0x78d0b0 | out: hKey=0x78d0b0) returned 0x0 [0125.874] CloseHandle (hObject=0x450) returned 1 [0125.877] VirtualAlloc (lpAddress=0x0, dwSize=0x73, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0125.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\gCH3TZQDDk2j9.png" (normalized: "c:\\program files\\common files\\gch3tzqddk2j9.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\gCH3TZQDDk2j9.png.PLAY" (normalized: "c:\\program files\\common files\\gch3tzqddk2j9.png.play")) returned 1 [0125.879] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 213 os_tid = 0x620 [0125.881] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.881] ReadFile (in: hFile=0x208, lpBuffer=0x17fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17fff85c, lpOverlapped=0x0 | out: lpBuffer=0x17fffb34*, lpNumberOfBytesRead=0x17fff85c*=0x428, lpOverlapped=0x0) returned 1 [0126.023] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.023] ReadFile (in: hFile=0x208, lpBuffer=0x17fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17fff85c, lpOverlapped=0x0 | out: lpBuffer=0x17fffb34*, lpNumberOfBytesRead=0x17fff85c*=0x428, lpOverlapped=0x0) returned 1 [0126.024] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0126.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0126.033] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x17fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0126.033] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x17fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x17fff828, pbKeyObject=0x0) returned 0x0 [0126.033] BCryptExportKey (in: hKey=0x76b1e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x17fff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x17fff500) returned 0x0 [0126.033] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0126.033] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x17fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x17fff500) returned 0x0 [0127.023] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.025] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.025] WriteFile (in: hFile=0x208, lpBuffer=0x17fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x17fff830, lpOverlapped=0x0 | out: lpBuffer=0x17fffb34*, lpNumberOfBytesWritten=0x17fff830*=0x428, lpOverlapped=0x0) returned 1 [0127.025] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.026] ReadFile (in: hFile=0x208, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x17fff61c*=0x100000, lpOverlapped=0x0) returned 1 [0127.106] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.106] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x4c50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x17fff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x17fff618, dwFlags=0x0 | out: hKey=0x76b1e0, pbIV=0x17fff848, pbOutput=0x4c50000, pcbResult=0x17fff618) returned 0x0 [0127.107] WriteFile (in: hFile=0x208, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x17fff61c*=0x100000, lpOverlapped=0x0) returned 1 [0127.111] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17fff60c | out: lpNewFilePointer=0x0) returned 1 [0127.111] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.111] WriteFile (in: hFile=0x208, lpBuffer=0x17fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x17fff83c*, lpNumberOfBytesWritten=0x17fff61c*=0x8, lpOverlapped=0x0) returned 1 [0127.111] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.111] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xffeffbc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.111] ReadFile (in: hFile=0x208, lpBuffer=0x4c50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x17fff61c*=0xffff0, lpOverlapped=0x0) returned 1 [0127.178] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.178] BCryptEncrypt (in: hKey=0x76b1e0, pbInput=0x4c50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x17fff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x17fff618, dwFlags=0x1 | out: hKey=0x76b1e0, pbIV=0x17fff848, pbOutput=0x4c50000, pcbResult=0x17fff618) returned 0x0 [0127.180] WriteFile (in: hFile=0x208, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x17fff61c*=0x100000, lpOverlapped=0x0) returned 1 [0128.700] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17fff60c | out: lpNewFilePointer=0x0) returned 1 [0128.700] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.700] WriteFile (in: hFile=0x208, lpBuffer=0x17fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x17fff83c*, lpNumberOfBytesWritten=0x17fff61c*=0x8, lpOverlapped=0x0) returned 1 [0128.700] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x5d12d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.700] WriteFile (in: hFile=0x208, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x17fff82c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x17fff82c*=0x10, lpOverlapped=0x0) returned 1 [0128.700] BCryptDestroyKey (in: hKey=0x76b1e0 | out: hKey=0x76b1e0) returned 0x0 [0128.700] CloseHandle (hObject=0x208) returned 1 [0131.487] VirtualAlloc (lpAddress=0x0, dwSize=0x99, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Filters\\VISFILT.DLL.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.play")) returned 1 [0131.489] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 214 os_tid = 0x770 [0126.352] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0xf850000 [0126.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0126.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f060c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0126.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0126.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0624, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0126.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0126.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f063c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0126.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0126.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0654, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0126.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0126.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f066c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0126.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0126.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0684, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0126.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0126.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f069c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0126.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0126.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0126.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0126.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0126.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0126.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0126.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0126.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0126.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0126.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0714, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0126.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0126.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f072c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0126.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0126.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0126.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0126.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f075c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0126.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0126.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0774, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0126.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0126.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f078c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0126.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0126.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0126.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0126.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0126.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0126.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0126.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0126.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0126.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0126.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0804, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0126.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0126.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f081c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0126.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0126.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0126.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0126.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f084c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0126.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0126.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0864, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0126.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0126.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f087c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0126.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0126.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0894, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0126.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0126.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0126.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0126.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0126.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0126.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0126.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0126.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0126.388] WaitForMultipleObjects (nCount=0x40, lpHandles=0xf850000*=0x464, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0129.151] CloseHandle (hObject=0x464) returned 1 [0129.151] CloseHandle (hObject=0x494) returned 1 [0129.151] CloseHandle (hObject=0x474) returned 1 [0129.151] CloseHandle (hObject=0x348) returned 1 [0129.151] CloseHandle (hObject=0x480) returned 1 [0129.151] CloseHandle (hObject=0x490) returned 1 [0129.151] CloseHandle (hObject=0x49c) returned 1 [0129.151] CloseHandle (hObject=0x4ac) returned 1 [0129.151] CloseHandle (hObject=0x4b4) returned 1 [0129.151] CloseHandle (hObject=0x4bc) returned 1 [0129.151] CloseHandle (hObject=0x52c) returned 1 [0129.151] CloseHandle (hObject=0x4d8) returned 1 [0129.151] CloseHandle (hObject=0x304) returned 1 [0129.152] CloseHandle (hObject=0x64c) returned 1 [0129.152] CloseHandle (hObject=0x65c) returned 1 [0129.152] CloseHandle (hObject=0x66c) returned 1 [0129.152] CloseHandle (hObject=0x694) returned 1 [0129.152] CloseHandle (hObject=0x210) returned 1 [0129.152] CloseHandle (hObject=0x214) returned 1 [0129.152] CloseHandle (hObject=0x218) returned 1 [0129.152] CloseHandle (hObject=0x21c) returned 1 [0129.152] CloseHandle (hObject=0x220) returned 1 [0129.152] CloseHandle (hObject=0x224) returned 1 [0129.152] CloseHandle (hObject=0x228) returned 1 [0129.152] CloseHandle (hObject=0x22c) returned 1 [0129.152] CloseHandle (hObject=0x230) returned 1 [0129.152] CloseHandle (hObject=0x234) returned 1 [0129.152] CloseHandle (hObject=0x238) returned 1 [0129.152] CloseHandle (hObject=0x23c) returned 1 [0129.152] CloseHandle (hObject=0x240) returned 1 [0129.152] CloseHandle (hObject=0x244) returned 1 [0129.152] CloseHandle (hObject=0x248) returned 1 [0129.152] CloseHandle (hObject=0x24c) returned 1 [0129.152] CloseHandle (hObject=0x250) returned 1 [0129.152] CloseHandle (hObject=0x254) returned 1 [0129.153] CloseHandle (hObject=0x258) returned 1 [0129.153] CloseHandle (hObject=0x25c) returned 1 [0129.153] CloseHandle (hObject=0x260) returned 1 [0129.153] CloseHandle (hObject=0x264) returned 1 [0129.153] CloseHandle (hObject=0x268) returned 1 [0129.153] CloseHandle (hObject=0x26c) returned 1 [0129.153] CloseHandle (hObject=0x270) returned 1 [0129.153] CloseHandle (hObject=0x274) returned 1 [0129.153] CloseHandle (hObject=0x278) returned 1 [0129.153] CloseHandle (hObject=0x27c) returned 1 [0129.153] CloseHandle (hObject=0x280) returned 1 [0129.153] CloseHandle (hObject=0x284) returned 1 [0129.153] CloseHandle (hObject=0x344) returned 1 [0129.153] CloseHandle (hObject=0x6a4) returned 1 [0129.153] CloseHandle (hObject=0x6a8) returned 1 [0129.153] CloseHandle (hObject=0x6ac) returned 1 [0129.153] CloseHandle (hObject=0x6b0) returned 1 [0129.153] CloseHandle (hObject=0x6b4) returned 1 [0129.153] CloseHandle (hObject=0x6b8) returned 1 [0129.153] CloseHandle (hObject=0x6bc) returned 1 [0129.153] CloseHandle (hObject=0x6c0) returned 1 [0129.154] CloseHandle (hObject=0x6c4) returned 1 [0129.154] CloseHandle (hObject=0x6c8) returned 1 [0129.154] CloseHandle (hObject=0x6cc) returned 1 [0129.154] CloseHandle (hObject=0x6d0) returned 1 [0129.154] CloseHandle (hObject=0x6d4) returned 1 [0129.154] CloseHandle (hObject=0x6d8) returned 1 [0129.154] CloseHandle (hObject=0x6dc) returned 1 [0129.154] CloseHandle (hObject=0x6e0) returned 1 [0129.154] VirtualFree (lpAddress=0xf850000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 215 os_tid = 0x133c [0127.559] GetLastError () returned 0x57 [0127.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x782ac0 [0127.559] SetLastError (dwErrCode=0x57) [0127.559] IcmpCreateFile () returned 0x7851f8 [0127.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783f18 [0127.559] IcmpSendEcho2 (in: IcmpHandle=0x7851f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8100a8c0, RequestData=0x101cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783f18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783f18) returned 0x0 [0136.723] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783f18 | out: hHeap=0x710000) returned 1 [0136.724] IcmpCloseHandle (IcmpHandle=0x7851f8) returned 1 [0136.724] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x782ac0 | out: hHeap=0x710000) returned 1 Thread: id = 216 os_tid = 0x1248 [0127.561] GetLastError () returned 0x57 [0127.561] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7831d0 [0127.561] SetLastError (dwErrCode=0x57) [0127.561] IcmpCreateFile () returned 0x785230 [0127.561] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7841e8 [0127.561] IcmpSendEcho2 (in: IcmpHandle=0x785230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8200a8c0, RequestData=0x102cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7841e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7841e8) returned 0x0 [0136.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7841e8 | out: hHeap=0x710000) returned 1 [0136.765] IcmpCloseHandle (IcmpHandle=0x785230) returned 1 [0136.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7831d0 | out: hHeap=0x710000) returned 1 Thread: id = 217 os_tid = 0x1254 [0127.562] GetLastError () returned 0x57 [0127.562] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x783558 [0127.563] SetLastError (dwErrCode=0x57) [0127.563] IcmpCreateFile () returned 0x785268 [0127.563] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784238 [0127.563] IcmpSendEcho2 (in: IcmpHandle=0x785268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8300a8c0, RequestData=0x10a8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784238) returned 0x0 [0136.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784238 | out: hHeap=0x710000) returned 1 [0136.771] IcmpCloseHandle (IcmpHandle=0x785268) returned 1 [0136.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783558 | out: hHeap=0x710000) returned 1 Thread: id = 218 os_tid = 0x1110 [0127.563] GetLastError () returned 0x57 [0127.564] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7838e0 [0127.564] SetLastError (dwErrCode=0x57) [0127.564] IcmpCreateFile () returned 0x7852a0 [0127.564] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784288 [0127.564] IcmpSendEcho2 (in: IcmpHandle=0x7852a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8400a8c0, RequestData=0x10e4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784288, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784288) returned 0x0 [0136.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784288 | out: hHeap=0x710000) returned 1 [0136.778] IcmpCloseHandle (IcmpHandle=0x7852a0) returned 1 [0136.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7838e0 | out: hHeap=0x710000) returned 1 Thread: id = 219 os_tid = 0x9e8 [0127.565] GetLastError () returned 0x57 [0127.565] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77fcd8 [0127.565] SetLastError (dwErrCode=0x57) [0127.565] IcmpCreateFile () returned 0x785310 [0127.565] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7842d8 [0127.565] IcmpSendEcho2 (in: IcmpHandle=0x785310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8500a8c0, RequestData=0x15f8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7842d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7842d8) returned 0x0 [0136.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7842d8 | out: hHeap=0x710000) returned 1 [0136.784] IcmpCloseHandle (IcmpHandle=0x785310) returned 1 [0136.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x77fcd8 | out: hHeap=0x710000) returned 1 Thread: id = 220 os_tid = 0x1220 [0127.566] GetLastError () returned 0x57 [0127.566] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75ed68 [0127.566] SetLastError (dwErrCode=0x57) [0127.566] IcmpCreateFile () returned 0x785348 [0127.566] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784328 [0127.566] IcmpSendEcho2 (in: IcmpHandle=0x785348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8600a8c0, RequestData=0x1608ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784328, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784328) returned 0x0 [0136.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784328 | out: hHeap=0x710000) returned 1 [0136.807] IcmpCloseHandle (IcmpHandle=0x785348) returned 1 [0136.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75ed68 | out: hHeap=0x710000) returned 1 Thread: id = 221 os_tid = 0x1260 [0127.567] GetLastError () returned 0x57 [0127.567] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f0f0 [0127.567] SetLastError (dwErrCode=0x57) [0127.567] IcmpCreateFile () returned 0x785380 [0127.567] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784378 [0127.567] IcmpSendEcho2 (in: IcmpHandle=0x785380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8700a8c0, RequestData=0x165cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784378, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784378) returned 0x0 [0136.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784378 | out: hHeap=0x710000) returned 1 [0136.812] IcmpCloseHandle (IcmpHandle=0x785380) returned 1 [0136.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75f0f0 | out: hHeap=0x710000) returned 1 Thread: id = 222 os_tid = 0x1188 [0127.569] GetLastError () returned 0x57 [0127.569] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e2d0 [0127.569] SetLastError (dwErrCode=0x57) [0127.569] IcmpCreateFile () returned 0x7853b8 [0127.569] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7843c8 [0127.569] IcmpSendEcho2 (in: IcmpHandle=0x7853b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8800a8c0, RequestData=0x1684ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7843c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7843c8) returned 0x0 [0136.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7843c8 | out: hHeap=0x710000) returned 1 [0136.837] IcmpCloseHandle (IcmpHandle=0x7853b8) returned 1 [0136.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75e2d0 | out: hHeap=0x710000) returned 1 Thread: id = 223 os_tid = 0x950 [0127.570] GetLastError () returned 0x57 [0127.570] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x792328 [0127.571] SetLastError (dwErrCode=0x57) [0127.571] IcmpCreateFile () returned 0x784f90 [0127.571] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784418 [0127.571] IcmpSendEcho2 (in: IcmpHandle=0x784f90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8900a8c0, RequestData=0x16acff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784418, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784418) returned 0x0 [0136.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784418 | out: hHeap=0x710000) returned 1 [0136.844] IcmpCloseHandle (IcmpHandle=0x784f90) returned 1 [0136.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x792328 | out: hHeap=0x710000) returned 1 Thread: id = 224 os_tid = 0x81c [0127.715] GetLastError () returned 0x57 [0127.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x790df8 [0127.716] SetLastError (dwErrCode=0x57) [0127.716] IcmpCreateFile () returned 0x784cf0 [0127.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784468 [0127.716] IcmpSendEcho2 (in: IcmpHandle=0x784cf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8a00a8c0, RequestData=0x16d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784468, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784468) returned 0x0 [0136.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784468 | out: hHeap=0x710000) returned 1 [0136.856] IcmpCloseHandle (IcmpHandle=0x784cf0) returned 1 [0136.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x790df8 | out: hHeap=0x710000) returned 1 Thread: id = 225 os_tid = 0xb18 [0127.723] GetLastError () returned 0x57 [0127.724] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791180 [0127.724] SetLastError (dwErrCode=0x57) [0127.724] IcmpCreateFile () returned 0x784d28 [0127.724] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7844b8 [0127.724] IcmpSendEcho2 (in: IcmpHandle=0x784d28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8b00a8c0, RequestData=0x16e4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7844b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7844b8) returned 0x0 [0136.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7844b8 | out: hHeap=0x710000) returned 1 [0136.863] IcmpCloseHandle (IcmpHandle=0x784d28) returned 1 [0136.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791180 | out: hHeap=0x710000) returned 1 Thread: id = 226 os_tid = 0xba0 [0127.726] GetLastError () returned 0x57 [0127.726] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7926b0 [0127.726] SetLastError (dwErrCode=0x57) [0127.726] IcmpCreateFile () returned 0x784fc8 [0127.726] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784558 [0127.726] IcmpSendEcho2 (in: IcmpHandle=0x784fc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8c00a8c0, RequestData=0x1724ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784558, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784558) returned 0x0 [0136.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784558 | out: hHeap=0x710000) returned 1 [0136.874] IcmpCloseHandle (IcmpHandle=0x784fc8) returned 1 [0136.875] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7926b0 | out: hHeap=0x710000) returned 1 Thread: id = 227 os_tid = 0xc74 [0127.727] GetLastError () returned 0x57 [0127.727] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x792a38 [0127.727] SetLastError (dwErrCode=0x57) [0127.799] IcmpCreateFile () returned 0x784d60 [0127.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7845a8 [0127.799] IcmpSendEcho2 (in: IcmpHandle=0x784d60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8d00a8c0, RequestData=0x1734ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7845a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7845a8) returned 0x0 [0136.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7845a8 | out: hHeap=0x710000) returned 1 [0136.879] IcmpCloseHandle (IcmpHandle=0x784d60) returned 1 [0136.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x792a38 | out: hHeap=0x710000) returned 1 Thread: id = 228 os_tid = 0xc78 [0127.801] GetLastError () returned 0x57 [0127.801] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x792dc0 [0127.801] SetLastError (dwErrCode=0x57) [0127.801] IcmpCreateFile () returned 0x784d98 [0127.801] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7845f8 [0127.801] IcmpSendEcho2 (in: IcmpHandle=0x784d98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8e00a8c0, RequestData=0x1760ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7845f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7845f8) returned 0x0 [0136.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7845f8 | out: hHeap=0x710000) returned 1 [0136.883] IcmpCloseHandle (IcmpHandle=0x784d98) returned 1 [0136.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x792dc0 | out: hHeap=0x710000) returned 1 Thread: id = 229 os_tid = 0xc7c [0127.802] GetLastError () returned 0x57 [0127.802] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793148 [0127.803] SetLastError (dwErrCode=0x57) [0127.803] IcmpCreateFile () returned 0x784dd0 [0127.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784648 [0127.803] IcmpSendEcho2 (in: IcmpHandle=0x784dd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8f00a8c0, RequestData=0x1788ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784648, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784648) returned 0x0 [0136.894] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784648 | out: hHeap=0x710000) returned 1 [0136.894] IcmpCloseHandle (IcmpHandle=0x784dd0) returned 1 [0136.895] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793148 | out: hHeap=0x710000) returned 1 Thread: id = 230 os_tid = 0xc84 [0127.804] GetLastError () returned 0x57 [0127.804] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7934d0 [0127.804] SetLastError (dwErrCode=0x57) [0127.804] IcmpCreateFile () returned 0x784e08 [0127.804] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784698 [0127.804] IcmpSendEcho2 (in: IcmpHandle=0x784e08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9000a8c0, RequestData=0x1798ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784698, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784698) returned 0x0 [0136.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784698 | out: hHeap=0x710000) returned 1 [0136.905] IcmpCloseHandle (IcmpHandle=0x784e08) returned 1 [0136.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7934d0 | out: hHeap=0x710000) returned 1 Thread: id = 231 os_tid = 0xc8c [0127.805] GetLastError () returned 0x57 [0127.805] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793858 [0127.805] SetLastError (dwErrCode=0x57) [0127.805] IcmpCreateFile () returned 0x784e40 [0127.806] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783ce8 [0127.806] IcmpSendEcho2 (in: IcmpHandle=0x784e40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9100a8c0, RequestData=0x17a8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783ce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783ce8) returned 0x0 [0136.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783ce8 | out: hHeap=0x710000) returned 1 [0136.915] IcmpCloseHandle (IcmpHandle=0x784e40) returned 1 [0136.916] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793858 | out: hHeap=0x710000) returned 1 Thread: id = 232 os_tid = 0xc94 [0127.807] GetLastError () returned 0x57 [0127.807] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793be0 [0127.807] SetLastError (dwErrCode=0x57) [0127.807] IcmpCreateFile () returned 0x784e78 [0127.807] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783d38 [0127.808] IcmpSendEcho2 (in: IcmpHandle=0x784e78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9200a8c0, RequestData=0x17b8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783d38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783d38) returned 0x0 [0136.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783d38 | out: hHeap=0x710000) returned 1 [0136.924] IcmpCloseHandle (IcmpHandle=0x784e78) returned 1 [0136.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793be0 | out: hHeap=0x710000) returned 1 Thread: id = 233 os_tid = 0xc9c [0127.809] GetLastError () returned 0x57 [0127.809] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793f68 [0127.809] SetLastError (dwErrCode=0x57) [0127.809] IcmpCreateFile () returned 0x784eb0 [0127.809] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783d88 [0127.809] IcmpSendEcho2 (in: IcmpHandle=0x784eb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9300a8c0, RequestData=0x1823ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783d88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783d88) returned 0x0 [0136.982] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783d88 | out: hHeap=0x710000) returned 1 [0136.982] IcmpCloseHandle (IcmpHandle=0x784eb0) returned 1 [0136.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793f68 | out: hHeap=0x710000) returned 1 Thread: id = 234 os_tid = 0xca4 [0127.826] GetLastError () returned 0x57 [0127.826] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x790360 [0127.826] SetLastError (dwErrCode=0x57) [0127.826] IcmpCreateFile () returned 0x784ee8 [0127.826] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783dd8 [0127.826] IcmpSendEcho2 (in: IcmpHandle=0x784ee8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9400a8c0, RequestData=0x1833ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783dd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783dd8) returned 0x0 [0136.994] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783dd8 | out: hHeap=0x710000) returned 1 [0136.995] IcmpCloseHandle (IcmpHandle=0x784ee8) returned 1 [0136.996] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x790360 | out: hHeap=0x710000) returned 1 Thread: id = 235 os_tid = 0xcac [0127.828] GetLastError () returned 0x57 [0127.828] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7906e8 [0127.828] SetLastError (dwErrCode=0x57) [0127.828] IcmpCreateFile () returned 0x784f20 [0127.828] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783e28 [0127.828] IcmpSendEcho2 (in: IcmpHandle=0x784f20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9500a8c0, RequestData=0x1843ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783e28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783e28) returned 0x0 [0137.021] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783e28 | out: hHeap=0x710000) returned 1 [0137.021] IcmpCloseHandle (IcmpHandle=0x784f20) returned 1 [0137.022] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7906e8 | out: hHeap=0x710000) returned 1 Thread: id = 236 os_tid = 0xcb4 [0127.831] GetLastError () returned 0x57 [0127.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x790a70 [0127.831] SetLastError (dwErrCode=0x57) [0127.831] IcmpCreateFile () returned 0x7850a8 [0127.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783e78 [0127.831] IcmpSendEcho2 (in: IcmpHandle=0x7850a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9600a8c0, RequestData=0x1853ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783e78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783e78) returned 0x0 [0137.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783e78 | out: hHeap=0x710000) returned 1 [0137.035] IcmpCloseHandle (IcmpHandle=0x7850a8) returned 1 [0137.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x790a70 | out: hHeap=0x710000) returned 1 Thread: id = 237 os_tid = 0xcbc [0127.832] GetLastError () returned 0x57 [0127.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791508 [0127.833] SetLastError (dwErrCode=0x57) [0127.833] IcmpCreateFile () returned 0x784f58 [0127.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783ec8 [0127.833] IcmpSendEcho2 (in: IcmpHandle=0x784f58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9700a8c0, RequestData=0x1867ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783ec8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783ec8) returned 0x0 [0137.225] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783ec8 | out: hHeap=0x710000) returned 1 [0137.225] IcmpCloseHandle (IcmpHandle=0x784f58) returned 1 [0137.225] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791508 | out: hHeap=0x710000) returned 1 Thread: id = 238 os_tid = 0xcc4 [0127.834] GetLastError () returned 0x57 [0127.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791890 [0127.834] SetLastError (dwErrCode=0x57) [0127.834] IcmpCreateFile () returned 0x785000 [0127.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784af8 [0127.834] IcmpSendEcho2 (in: IcmpHandle=0x785000, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9800a8c0, RequestData=0x187bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784af8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784af8) returned 0x0 [0137.234] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784af8 | out: hHeap=0x710000) returned 1 [0137.234] IcmpCloseHandle (IcmpHandle=0x785000) returned 1 [0137.234] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791890 | out: hHeap=0x710000) returned 1 Thread: id = 239 os_tid = 0xccc [0127.856] GetLastError () returned 0x57 [0127.856] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791c18 [0127.856] SetLastError (dwErrCode=0x57) [0127.856] IcmpCreateFile () returned 0x785038 [0127.856] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784b98 [0127.856] IcmpSendEcho2 (in: IcmpHandle=0x785038, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9900a8c0, RequestData=0x188fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784b98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784b98) returned 0x0 [0137.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784b98 | out: hHeap=0x710000) returned 1 [0137.241] IcmpCloseHandle (IcmpHandle=0x785038) returned 1 [0137.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791c18 | out: hHeap=0x710000) returned 1 Thread: id = 240 os_tid = 0xcd8 [0127.858] GetLastError () returned 0x57 [0127.859] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791fa0 [0127.859] SetLastError (dwErrCode=0x57) [0127.859] IcmpCreateFile () returned 0x785070 [0127.859] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784b48 [0127.859] IcmpSendEcho2 (in: IcmpHandle=0x785070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9a00a8c0, RequestData=0x18a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784b48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784b48) returned 0x0 [0137.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784b48 | out: hHeap=0x710000) returned 1 [0137.253] IcmpCloseHandle (IcmpHandle=0x785070) returned 1 [0137.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791fa0 | out: hHeap=0x710000) returned 1 Thread: id = 241 os_tid = 0xcf4 [0127.860] GetLastError () returned 0x57 [0127.860] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79ab40 [0127.860] SetLastError (dwErrCode=0x57) [0127.860] IcmpCreateFile () returned 0x7853f0 [0127.860] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784828 [0127.861] IcmpSendEcho2 (in: IcmpHandle=0x7853f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9b00a8c0, RequestData=0x18b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784828, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784828) returned 0x0 [0137.266] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784828 | out: hHeap=0x710000) returned 1 [0137.268] IcmpCloseHandle (IcmpHandle=0x7853f0) returned 1 [0137.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79ab40 | out: hHeap=0x710000) returned 1 Thread: id = 242 os_tid = 0x117c [0127.862] GetLastError () returned 0x57 [0127.862] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x799610 [0127.862] SetLastError (dwErrCode=0x57) [0127.862] IcmpCreateFile () returned 0x785428 [0127.862] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784c38 [0127.862] IcmpSendEcho2 (in: IcmpHandle=0x785428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9c00a8c0, RequestData=0x18cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784c38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784c38) returned 0x0 [0137.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784c38 | out: hHeap=0x710000) returned 1 [0137.318] IcmpCloseHandle (IcmpHandle=0x785428) returned 1 [0137.319] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799610 | out: hHeap=0x710000) returned 1 Thread: id = 243 os_tid = 0x119c [0127.863] GetLastError () returned 0x57 [0127.863] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x799998 [0127.863] SetLastError (dwErrCode=0x57) [0127.864] IcmpCreateFile () returned 0x785460 [0127.864] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7846e8 [0127.864] IcmpSendEcho2 (in: IcmpHandle=0x785460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9d00a8c0, RequestData=0x18dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7846e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7846e8) returned 0x0 [0137.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7846e8 | out: hHeap=0x710000) returned 1 [0137.329] IcmpCloseHandle (IcmpHandle=0x785460) returned 1 [0137.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799998 | out: hHeap=0x710000) returned 1 Thread: id = 244 os_tid = 0x1198 [0127.865] GetLastError () returned 0x57 [0127.865] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x799d20 [0127.865] SetLastError (dwErrCode=0x57) [0127.865] IcmpCreateFile () returned 0x75d1c0 [0127.865] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784738 [0127.865] IcmpSendEcho2 (in: IcmpHandle=0x75d1c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9e00a8c0, RequestData=0x18f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784738, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784738) returned 0x0 [0137.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784738 | out: hHeap=0x710000) returned 1 [0137.335] IcmpCloseHandle (IcmpHandle=0x75d1c0) returned 1 [0137.336] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799d20 | out: hHeap=0x710000) returned 1 Thread: id = 245 os_tid = 0x112c [0127.884] GetLastError () returned 0x57 [0127.884] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79a0a8 [0127.885] SetLastError (dwErrCode=0x57) [0127.885] IcmpCreateFile () returned 0x75d3f0 [0127.885] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784788 [0127.885] IcmpSendEcho2 (in: IcmpHandle=0x75d3f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9f00a8c0, RequestData=0x1907ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784788, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784788) returned 0x0 [0137.340] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784788 | out: hHeap=0x710000) returned 1 [0137.340] IcmpCloseHandle (IcmpHandle=0x75d3f0) returned 1 [0137.341] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a0a8 | out: hHeap=0x710000) returned 1 Thread: id = 246 os_tid = 0x1194 [0127.886] GetLastError () returned 0x57 [0127.886] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79a430 [0127.886] SetLastError (dwErrCode=0x57) [0127.886] IcmpCreateFile () returned 0x75d428 [0127.886] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7847d8 [0127.886] IcmpSendEcho2 (in: IcmpHandle=0x75d428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa000a8c0, RequestData=0x191bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7847d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7847d8) returned 0x0 [0137.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7847d8 | out: hHeap=0x710000) returned 1 [0137.346] IcmpCloseHandle (IcmpHandle=0x75d428) returned 1 [0137.347] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a430 | out: hHeap=0x710000) returned 1 Thread: id = 247 os_tid = 0x11a0 [0127.888] GetLastError () returned 0x57 [0127.888] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79c780 [0127.888] SetLastError (dwErrCode=0x57) [0127.888] IcmpCreateFile () returned 0x79dca8 [0127.888] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784878 [0127.888] IcmpSendEcho2 (in: IcmpHandle=0x79dca8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa100a8c0, RequestData=0x192fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784878, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784878) returned 0x0 [0137.367] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784878 | out: hHeap=0x710000) returned 1 [0137.367] IcmpCloseHandle (IcmpHandle=0x79dca8) returned 1 [0137.368] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79c780 | out: hHeap=0x710000) returned 1 Thread: id = 248 os_tid = 0x11a8 [0127.889] GetLastError () returned 0x57 [0127.889] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79bce8 [0127.890] SetLastError (dwErrCode=0x57) [0127.890] IcmpCreateFile () returned 0x79e140 [0127.890] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7849b8 [0127.890] IcmpSendEcho2 (in: IcmpHandle=0x79e140, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa200a8c0, RequestData=0x1943ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7849b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7849b8) returned 0x0 [0137.377] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7849b8 | out: hHeap=0x710000) returned 1 [0137.377] IcmpCloseHandle (IcmpHandle=0x79e140) returned 1 [0137.377] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79bce8 | out: hHeap=0x710000) returned 1 Thread: id = 249 os_tid = 0x11ac [0127.891] GetLastError () returned 0x57 [0127.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79c070 [0127.891] SetLastError (dwErrCode=0x57) [0127.891] IcmpCreateFile () returned 0x79e178 [0127.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784a08 [0127.891] IcmpSendEcho2 (in: IcmpHandle=0x79e178, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa300a8c0, RequestData=0x1957ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784a08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784a08) returned 0x0 [0137.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784a08 | out: hHeap=0x710000) returned 1 [0137.383] IcmpCloseHandle (IcmpHandle=0x79e178) returned 1 [0137.383] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79c070 | out: hHeap=0x710000) returned 1 Thread: id = 250 os_tid = 0x127c [0127.892] GetLastError () returned 0x57 [0127.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79c3f8 [0127.892] SetLastError (dwErrCode=0x57) [0127.892] IcmpCreateFile () returned 0x79e1b0 [0127.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784a58 [0127.892] IcmpSendEcho2 (in: IcmpHandle=0x79e1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa400a8c0, RequestData=0x196bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784a58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784a58) returned 0x0 [0137.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784a58 | out: hHeap=0x710000) returned 1 [0137.397] IcmpCloseHandle (IcmpHandle=0x79e1b0) returned 1 [0137.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79c3f8 | out: hHeap=0x710000) returned 1 Thread: id = 251 os_tid = 0x1154 [0127.893] GetLastError () returned 0x57 [0127.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x798b78 [0127.893] SetLastError (dwErrCode=0x57) [0127.893] IcmpCreateFile () returned 0x79e1e8 [0127.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784aa8 [0127.893] IcmpSendEcho2 (in: IcmpHandle=0x79e1e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa500a8c0, RequestData=0x197fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784aa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784aa8) returned 0x0 [0137.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784aa8 | out: hHeap=0x710000) returned 1 [0137.408] IcmpCloseHandle (IcmpHandle=0x79e1e8) returned 1 [0137.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x798b78 | out: hHeap=0x710000) returned 1 Thread: id = 252 os_tid = 0x130c [0127.894] GetLastError () returned 0x57 [0127.894] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x798f00 [0127.895] SetLastError (dwErrCode=0x57) [0127.895] IcmpCreateFile () returned 0x79e220 [0127.895] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784be8 [0127.895] IcmpSendEcho2 (in: IcmpHandle=0x79e220, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa600a8c0, RequestData=0x1993ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784be8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784be8) returned 0x0 [0137.423] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784be8 | out: hHeap=0x710000) returned 1 [0137.423] IcmpCloseHandle (IcmpHandle=0x79e220) returned 1 [0137.423] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x798f00 | out: hHeap=0x710000) returned 1 Thread: id = 253 os_tid = 0x1338 [0127.895] GetLastError () returned 0x57 [0127.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79a7b8 [0127.896] SetLastError (dwErrCode=0x57) [0127.896] IcmpCreateFile () returned 0x79e258 [0127.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7848c8 [0127.896] IcmpSendEcho2 (in: IcmpHandle=0x79e258, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa700a8c0, RequestData=0x19a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7848c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7848c8) returned 0x0 [0137.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7848c8 | out: hHeap=0x710000) returned 1 [0137.430] IcmpCloseHandle (IcmpHandle=0x79e258) returned 1 [0137.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a7b8 | out: hHeap=0x710000) returned 1 Thread: id = 254 os_tid = 0x1128 [0127.897] GetLastError () returned 0x57 [0127.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79aec8 [0127.897] SetLastError (dwErrCode=0x57) [0127.897] IcmpCreateFile () returned 0x79db90 [0127.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784918 [0127.897] IcmpSendEcho2 (in: IcmpHandle=0x79db90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa800a8c0, RequestData=0x19bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784918, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784918) returned 0x0 [0137.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784918 | out: hHeap=0x710000) returned 1 [0137.747] IcmpCloseHandle (IcmpHandle=0x79db90) returned 1 [0137.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79aec8 | out: hHeap=0x710000) returned 1 Thread: id = 255 os_tid = 0x1308 [0127.898] GetLastError () returned 0x57 [0127.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79b250 [0127.898] SetLastError (dwErrCode=0x57) [0127.898] IcmpCreateFile () returned 0x79dbc8 [0127.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784968 [0127.898] IcmpSendEcho2 (in: IcmpHandle=0x79dbc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa900a8c0, RequestData=0x19cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784968, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784968) returned 0x0 [0137.759] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784968 | out: hHeap=0x710000) returned 1 [0137.759] IcmpCloseHandle (IcmpHandle=0x79dbc8) returned 1 [0137.760] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79b250 | out: hHeap=0x710000) returned 1 Thread: id = 256 os_tid = 0x1364 [0127.899] GetLastError () returned 0x57 [0127.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79b5d8 [0127.899] SetLastError (dwErrCode=0x57) [0127.899] IcmpCreateFile () returned 0x79dc00 [0127.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e148 [0127.899] IcmpSendEcho2 (in: IcmpHandle=0x79dc00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaa00a8c0, RequestData=0x19e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e148) returned 0x0 [0137.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e148 | out: hHeap=0x710000) returned 1 [0137.770] IcmpCloseHandle (IcmpHandle=0x79dc00) returned 1 [0137.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79b5d8 | out: hHeap=0x710000) returned 1 Thread: id = 257 os_tid = 0x1334 [0127.926] GetLastError () returned 0x57 [0127.927] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79b960 [0127.927] SetLastError (dwErrCode=0x57) [0127.927] IcmpCreateFile () returned 0x79dc38 [0127.927] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e1e8 [0127.927] IcmpSendEcho2 (in: IcmpHandle=0x79dc38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xab00a8c0, RequestData=0x19f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e1e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e1e8) returned 0x0 [0137.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e1e8 | out: hHeap=0x710000) returned 1 [0137.779] IcmpCloseHandle (IcmpHandle=0x79dc38) returned 1 [0137.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79b960 | out: hHeap=0x710000) returned 1 Thread: id = 258 os_tid = 0x1324 [0127.928] GetLastError () returned 0x57 [0127.928] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x799288 [0127.928] SetLastError (dwErrCode=0x57) [0127.928] IcmpCreateFile () returned 0x79dc70 [0127.928] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e238 [0127.928] IcmpSendEcho2 (in: IcmpHandle=0x79dc70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xac00a8c0, RequestData=0x1a0bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e238) returned 0x0 [0137.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e238 | out: hHeap=0x710000) returned 1 [0137.785] IcmpCloseHandle (IcmpHandle=0x79dc70) returned 1 [0137.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799288 | out: hHeap=0x710000) returned 1 Thread: id = 259 os_tid = 0x132c [0127.929] GetLastError () returned 0x57 [0127.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79ef28 [0127.933] SetLastError (dwErrCode=0x57) [0127.933] IcmpCreateFile () returned 0x79df10 [0127.933] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a72d8 [0127.933] IcmpSendEcho2 (in: IcmpHandle=0x79df10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xad00a8c0, RequestData=0x1a1fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a72d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a72d8) returned 0x0 [0137.792] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a72d8 | out: hHeap=0x710000) returned 1 [0137.792] IcmpCloseHandle (IcmpHandle=0x79df10) returned 1 [0137.793] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79ef28 | out: hHeap=0x710000) returned 1 Thread: id = 260 os_tid = 0x1330 [0127.934] GetLastError () returned 0x57 [0127.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79f9c0 [0127.935] SetLastError (dwErrCode=0x57) [0127.935] IcmpCreateFile () returned 0x79dea0 [0127.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7468 [0127.935] IcmpSendEcho2 (in: IcmpHandle=0x79dea0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xae00a8c0, RequestData=0x1a33ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7468, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7468) returned 0x0 [0137.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7468 | out: hHeap=0x710000) returned 1 [0137.827] IcmpCloseHandle (IcmpHandle=0x79dea0) returned 1 [0137.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79f9c0 | out: hHeap=0x710000) returned 1 Thread: id = 261 os_tid = 0x1340 [0127.936] GetLastError () returned 0x57 [0127.936] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79fd48 [0127.936] SetLastError (dwErrCode=0x57) [0127.936] IcmpCreateFile () returned 0x79ded8 [0127.936] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a74b8 [0127.936] IcmpSendEcho2 (in: IcmpHandle=0x79ded8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaf00a8c0, RequestData=0x1a47ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a74b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a74b8) returned 0x0 [0137.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a74b8 | out: hHeap=0x710000) returned 1 [0137.833] IcmpCloseHandle (IcmpHandle=0x79ded8) returned 1 [0137.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79fd48 | out: hHeap=0x710000) returned 1 Thread: id = 262 os_tid = 0x1328 [0127.938] GetLastError () returned 0x57 [0127.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a00d0 [0127.938] SetLastError (dwErrCode=0x57) [0127.938] IcmpCreateFile () returned 0x79df48 [0127.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7508 [0127.938] IcmpSendEcho2 (in: IcmpHandle=0x79df48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb000a8c0, RequestData=0x1a5bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7508, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7508) returned 0x0 [0137.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7508 | out: hHeap=0x710000) returned 1 [0137.840] IcmpCloseHandle (IcmpHandle=0x79df48) returned 1 [0137.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a00d0 | out: hHeap=0x710000) returned 1 Thread: id = 263 os_tid = 0x12f8 [0127.939] GetLastError () returned 0x57 [0127.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a0458 [0127.939] SetLastError (dwErrCode=0x57) [0127.939] IcmpCreateFile () returned 0x79df80 [0127.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7558 [0127.939] IcmpSendEcho2 (in: IcmpHandle=0x79df80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb100a8c0, RequestData=0x1a6fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7558, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7558) returned 0x0 [0137.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7558 | out: hHeap=0x710000) returned 1 [0137.844] IcmpCloseHandle (IcmpHandle=0x79df80) returned 1 [0137.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a0458 | out: hHeap=0x710000) returned 1 Thread: id = 264 os_tid = 0x1300 [0127.940] GetLastError () returned 0x57 [0127.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a07e0 [0127.940] SetLastError (dwErrCode=0x57) [0127.940] IcmpCreateFile () returned 0x79dfb8 [0127.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ba8 [0127.940] IcmpSendEcho2 (in: IcmpHandle=0x79dfb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb200a8c0, RequestData=0x1a83ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6ba8) returned 0x0 [0137.848] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6ba8 | out: hHeap=0x710000) returned 1 [0137.848] IcmpCloseHandle (IcmpHandle=0x79dfb8) returned 1 [0137.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a07e0 | out: hHeap=0x710000) returned 1 Thread: id = 265 os_tid = 0x1304 [0127.942] GetLastError () returned 0x57 [0127.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a0b68 [0127.943] SetLastError (dwErrCode=0x57) [0127.943] IcmpCreateFile () returned 0x79dff0 [0127.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a73c8 [0127.943] IcmpSendEcho2 (in: IcmpHandle=0x79dff0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb300a8c0, RequestData=0x1a97ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a73c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a73c8) returned 0x0 [0137.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a73c8 | out: hHeap=0x710000) returned 1 [0137.852] IcmpCloseHandle (IcmpHandle=0x79dff0) returned 1 [0137.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a0b68 | out: hHeap=0x710000) returned 1 Thread: id = 266 os_tid = 0x1314 [0127.944] GetLastError () returned 0x57 [0127.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a0ef0 [0127.944] SetLastError (dwErrCode=0x57) [0127.944] IcmpCreateFile () returned 0x79de30 [0127.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6dd8 [0127.944] IcmpSendEcho2 (in: IcmpHandle=0x79de30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb500a8c0, RequestData=0x1aabff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6dd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6dd8) returned 0x0 [0137.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6dd8 | out: hHeap=0x710000) returned 1 [0137.856] IcmpCloseHandle (IcmpHandle=0x79de30) returned 1 [0137.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a0ef0 | out: hHeap=0x710000) returned 1 Thread: id = 267 os_tid = 0x1320 [0127.946] GetLastError () returned 0x57 [0127.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1278 [0127.946] SetLastError (dwErrCode=0x57) [0127.946] IcmpCreateFile () returned 0x79de68 [0127.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6e28 [0127.946] IcmpSendEcho2 (in: IcmpHandle=0x79de68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb600a8c0, RequestData=0x1abfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6e28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6e28) returned 0x0 [0137.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6e28 | out: hHeap=0x710000) returned 1 [0137.885] IcmpCloseHandle (IcmpHandle=0x79de68) returned 1 [0137.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1278 | out: hHeap=0x710000) returned 1 Thread: id = 268 os_tid = 0x12fc [0127.948] GetLastError () returned 0x57 [0127.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4060 [0127.948] SetLastError (dwErrCode=0x57) [0127.948] IcmpCreateFile () returned 0x79e028 [0127.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6bf8 [0127.948] IcmpSendEcho2 (in: IcmpHandle=0x79e028, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb700a8c0, RequestData=0x1ad3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6bf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6bf8) returned 0x0 [0137.960] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6bf8 | out: hHeap=0x710000) returned 1 [0137.960] IcmpCloseHandle (IcmpHandle=0x79e028) returned 1 [0137.961] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4060 | out: hHeap=0x710000) returned 1 Thread: id = 269 os_tid = 0x12f4 [0127.949] GetLastError () returned 0x57 [0127.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1600 [0127.949] SetLastError (dwErrCode=0x57) [0127.949] IcmpCreateFile () returned 0x79e060 [0127.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ce8 [0127.950] IcmpSendEcho2 (in: IcmpHandle=0x79e060, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb800a8c0, RequestData=0x1ae7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6ce8) returned 0x0 [0137.970] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6ce8 | out: hHeap=0x710000) returned 1 [0137.970] IcmpCloseHandle (IcmpHandle=0x79e060) returned 1 [0137.971] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1600 | out: hHeap=0x710000) returned 1 Thread: id = 270 os_tid = 0x86c [0127.950] GetLastError () returned 0x57 [0127.950] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1988 [0127.951] SetLastError (dwErrCode=0x57) [0127.951] IcmpCreateFile () returned 0x79e098 [0127.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6d38 [0127.951] IcmpSendEcho2 (in: IcmpHandle=0x79e098, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb900a8c0, RequestData=0x1afbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6d38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6d38) returned 0x0 [0137.977] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6d38 | out: hHeap=0x710000) returned 1 [0137.977] IcmpCloseHandle (IcmpHandle=0x79e098) returned 1 [0137.978] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1988 | out: hHeap=0x710000) returned 1 Thread: id = 271 os_tid = 0xae0 [0127.952] GetLastError () returned 0x57 [0127.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1d10 [0127.952] SetLastError (dwErrCode=0x57) [0127.952] IcmpCreateFile () returned 0x79e0d0 [0127.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6d88 [0127.952] IcmpSendEcho2 (in: IcmpHandle=0x79e0d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xba00a8c0, RequestData=0x1b0fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6d88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6d88) returned 0x0 [0137.989] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6d88 | out: hHeap=0x710000) returned 1 [0137.989] IcmpCloseHandle (IcmpHandle=0x79e0d0) returned 1 [0137.990] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1d10 | out: hHeap=0x710000) returned 1 Thread: id = 272 os_tid = 0x12c4 [0127.953] GetLastError () returned 0x57 [0127.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2098 [0127.953] SetLastError (dwErrCode=0x57) [0127.953] IcmpCreateFile () returned 0x79e108 [0127.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6e78 [0127.953] IcmpSendEcho2 (in: IcmpHandle=0x79e108, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbb00a8c0, RequestData=0x1b23ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6e78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6e78) returned 0x0 [0137.999] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6e78 | out: hHeap=0x710000) returned 1 [0137.999] IcmpCloseHandle (IcmpHandle=0x79e108) returned 1 [0137.999] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2098 | out: hHeap=0x710000) returned 1 Thread: id = 273 os_tid = 0x12c8 [0127.954] GetLastError () returned 0x57 [0127.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2420 [0127.954] SetLastError (dwErrCode=0x57) [0127.954] IcmpCreateFile () returned 0x79dce0 [0127.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ec8 [0127.954] IcmpSendEcho2 (in: IcmpHandle=0x79dce0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbc00a8c0, RequestData=0x1b37ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ec8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6ec8) returned 0x0 [0138.017] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6ec8 | out: hHeap=0x710000) returned 1 [0138.017] IcmpCloseHandle (IcmpHandle=0x79dce0) returned 1 [0138.018] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2420 | out: hHeap=0x710000) returned 1 Thread: id = 274 os_tid = 0x1068 [0127.955] GetLastError () returned 0x57 [0127.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a27a8 [0127.955] SetLastError (dwErrCode=0x57) [0127.955] IcmpCreateFile () returned 0x79dd18 [0127.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6f18 [0127.955] IcmpSendEcho2 (in: IcmpHandle=0x79dd18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbd00a8c0, RequestData=0x1b4bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6f18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6f18) returned 0x0 [0138.021] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6f18 | out: hHeap=0x710000) returned 1 [0138.021] IcmpCloseHandle (IcmpHandle=0x79dd18) returned 1 [0138.022] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a27a8 | out: hHeap=0x710000) returned 1 Thread: id = 275 os_tid = 0x1064 [0127.956] GetLastError () returned 0x57 [0127.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2b30 [0127.956] SetLastError (dwErrCode=0x57) [0127.957] IcmpCreateFile () returned 0x79dd50 [0127.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6f68 [0127.957] IcmpSendEcho2 (in: IcmpHandle=0x79dd50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbe00a8c0, RequestData=0x1b5fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6f68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6f68) returned 0x0 [0138.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6f68 | out: hHeap=0x710000) returned 1 [0138.025] IcmpCloseHandle (IcmpHandle=0x79dd50) returned 1 [0138.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2b30 | out: hHeap=0x710000) returned 1 Thread: id = 276 os_tid = 0x13f0 [0127.957] GetLastError () returned 0x57 [0127.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2eb8 [0127.958] SetLastError (dwErrCode=0x57) [0127.958] IcmpCreateFile () returned 0x79dd88 [0127.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6fb8 [0127.958] IcmpSendEcho2 (in: IcmpHandle=0x79dd88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbf00a8c0, RequestData=0x1b73ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6fb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6fb8) returned 0x0 [0138.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6fb8 | out: hHeap=0x710000) returned 1 [0138.029] IcmpCloseHandle (IcmpHandle=0x79dd88) returned 1 [0138.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2eb8 | out: hHeap=0x710000) returned 1 Thread: id = 277 os_tid = 0xb0c [0127.959] GetLastError () returned 0x57 [0127.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a3240 [0127.959] SetLastError (dwErrCode=0x57) [0127.959] IcmpCreateFile () returned 0x79ddc0 [0127.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7008 [0127.959] IcmpSendEcho2 (in: IcmpHandle=0x79ddc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc000a8c0, RequestData=0x1b87ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7008, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7008) returned 0x0 [0138.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7008 | out: hHeap=0x710000) returned 1 [0138.035] IcmpCloseHandle (IcmpHandle=0x79ddc0) returned 1 [0138.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a3240 | out: hHeap=0x710000) returned 1 Thread: id = 278 os_tid = 0x13fc [0127.960] GetLastError () returned 0x57 [0127.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a35c8 [0127.960] SetLastError (dwErrCode=0x57) [0127.963] IcmpCreateFile () returned 0x79ddf8 [0127.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7058 [0127.964] IcmpSendEcho2 (in: IcmpHandle=0x79ddf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc100a8c0, RequestData=0x1b9bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7058) returned 0x0 [0138.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7058 | out: hHeap=0x710000) returned 1 [0138.041] IcmpCloseHandle (IcmpHandle=0x79ddf8) returned 1 [0138.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a35c8 | out: hHeap=0x710000) returned 1 Thread: id = 279 os_tid = 0xdac [0130.793] VirtualAlloc (lpAddress=0x0, dwSize=0xf4, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0130.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0130.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f090c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0130.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0130.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0924, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0130.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0130.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f093c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0130.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0130.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0954, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0130.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0130.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f096c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0130.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0130.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0984, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0130.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0130.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f099c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0130.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0130.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0130.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0130.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0130.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0130.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0130.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0130.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0130.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0130.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0130.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0130.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0130.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0130.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0130.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0130.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0130.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0130.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a74, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0130.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0130.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a8c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0130.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0130.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0130.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0130.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0abc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0130.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0130.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ad4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0130.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0130.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0130.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0130.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b04, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0130.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0130.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0130.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0130.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0130.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0130.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0130.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0130.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0130.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0130.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0130.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0130.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b94, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0130.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0130.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0131.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0131.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bc4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0131.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0131.672] WaitForMultipleObjects (nCount=0x3d, lpHandles=0x700000*=0x2a4, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0133.159] CloseHandle (hObject=0x2a4) returned 1 [0133.159] CloseHandle (hObject=0x538) returned 1 [0133.159] CloseHandle (hObject=0x354) returned 1 [0133.159] CloseHandle (hObject=0x6c0) returned 1 [0133.159] CloseHandle (hObject=0x6bc) returned 1 [0133.159] CloseHandle (hObject=0x6b8) returned 1 [0133.159] CloseHandle (hObject=0x6b4) returned 1 [0133.159] CloseHandle (hObject=0x6b0) returned 1 [0133.159] CloseHandle (hObject=0x6ac) returned 1 [0133.159] CloseHandle (hObject=0x6a8) returned 1 [0133.159] CloseHandle (hObject=0x6a4) returned 1 [0133.159] CloseHandle (hObject=0x344) returned 1 [0133.159] CloseHandle (hObject=0x284) returned 1 [0133.159] CloseHandle (hObject=0x280) returned 1 [0133.160] CloseHandle (hObject=0x27c) returned 1 [0133.160] CloseHandle (hObject=0x278) returned 1 [0133.160] CloseHandle (hObject=0x274) returned 1 [0133.160] CloseHandle (hObject=0x270) returned 1 [0133.160] CloseHandle (hObject=0x26c) returned 1 [0133.160] CloseHandle (hObject=0x268) returned 1 [0133.160] CloseHandle (hObject=0x264) returned 1 [0133.160] CloseHandle (hObject=0x260) returned 1 [0133.160] CloseHandle (hObject=0x25c) returned 1 [0133.160] CloseHandle (hObject=0x258) returned 1 [0133.160] CloseHandle (hObject=0x254) returned 1 [0133.160] CloseHandle (hObject=0x250) returned 1 [0133.160] CloseHandle (hObject=0x24c) returned 1 [0133.160] CloseHandle (hObject=0x248) returned 1 [0133.160] CloseHandle (hObject=0x244) returned 1 [0133.160] CloseHandle (hObject=0x240) returned 1 [0133.160] CloseHandle (hObject=0x23c) returned 1 [0133.160] CloseHandle (hObject=0x238) returned 1 [0133.160] CloseHandle (hObject=0x234) returned 1 [0133.161] CloseHandle (hObject=0x230) returned 1 [0133.161] CloseHandle (hObject=0x22c) returned 1 [0133.161] CloseHandle (hObject=0x228) returned 1 [0133.161] CloseHandle (hObject=0x224) returned 1 [0133.161] CloseHandle (hObject=0x220) returned 1 [0133.161] CloseHandle (hObject=0x21c) returned 1 [0133.161] CloseHandle (hObject=0x218) returned 1 [0133.161] CloseHandle (hObject=0x214) returned 1 [0133.161] CloseHandle (hObject=0x210) returned 1 [0133.161] CloseHandle (hObject=0x694) returned 1 [0133.161] CloseHandle (hObject=0x66c) returned 1 [0133.161] CloseHandle (hObject=0x65c) returned 1 [0133.161] CloseHandle (hObject=0x64c) returned 1 [0133.161] CloseHandle (hObject=0x304) returned 1 [0133.161] CloseHandle (hObject=0x4d8) returned 1 [0133.161] CloseHandle (hObject=0x52c) returned 1 [0133.161] CloseHandle (hObject=0x4bc) returned 1 [0133.161] CloseHandle (hObject=0x4b4) returned 1 [0133.161] CloseHandle (hObject=0x4ac) returned 1 [0133.161] CloseHandle (hObject=0x49c) returned 1 [0133.162] CloseHandle (hObject=0x490) returned 1 [0133.162] CloseHandle (hObject=0x480) returned 1 [0133.162] CloseHandle (hObject=0x348) returned 1 [0133.162] CloseHandle (hObject=0x474) returned 1 [0133.162] CloseHandle (hObject=0x8a4) returned 1 [0133.162] CloseHandle (hObject=0x8a8) returned 1 [0133.162] CloseHandle (hObject=0x8ac) returned 1 [0133.162] CloseHandle (hObject=0x8b0) returned 1 [0133.162] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 280 os_tid = 0xd8c [0130.838] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.838] ReadFile (in: hFile=0x6dc, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0130.840] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.840] ReadFile (in: hFile=0x6dc, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0130.840] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0130.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0130.844] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xf70f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0130.844] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xf70f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xf70f828, pbKeyObject=0x0) returned 0x0 [0130.844] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xf70f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xf70f500) returned 0x0 [0130.845] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0130.845] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xf70f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xf70f500) returned 0x0 [0130.849] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.851] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.851] WriteFile (in: hFile=0x6dc, lpBuffer=0xf70fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf70f830, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesWritten=0xf70f830*=0x428, lpOverlapped=0x0) returned 1 [0130.852] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.852] ReadFile (in: hFile=0x6dc, lpBuffer=0x2950000, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xf70f61c*=0x3e00, lpOverlapped=0x0) returned 1 [0130.852] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xffffc200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.852] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x2950000, cbInput=0x3e00, pPaddingInfo=0x0, pbIV=0xf70f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xf70f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0xf70f848, pbOutput=0x2950000, pcbResult=0xf70f618) returned 0x0 [0130.852] WriteFile (in: hFile=0x6dc, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xf70f61c*=0x3e10, lpOverlapped=0x0) returned 1 [0130.853] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf70f60c | out: lpNewFilePointer=0x0) returned 1 [0130.853] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.853] WriteFile (in: hFile=0x6dc, lpBuffer=0xf70f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0xf70f83c*, lpNumberOfBytesWritten=0xf70f61c*=0x8, lpOverlapped=0x0) returned 1 [0130.853] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x3e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.853] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0130.853] CloseHandle (hObject=0x6dc) returned 1 [0130.855] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0130.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\oregres.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\oregres.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\oregres.dll.mui.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\oregres.dll.mui.play")) returned 1 [0130.857] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 281 os_tid = 0x158 [0130.859] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.860] ReadFile (in: hFile=0x46c, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.070] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.070] ReadFile (in: hFile=0x46c, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.070] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0131.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0131.072] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xf84f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0131.072] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xf84f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xf84f828, pbKeyObject=0x0) returned 0x0 [0131.072] BCryptExportKey (in: hKey=0x76b0f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xf84f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xf84f500) returned 0x0 [0131.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0131.072] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xf84f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xf84f500) returned 0x0 [0131.076] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.078] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.078] WriteFile (in: hFile=0x46c, lpBuffer=0xf84fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf84f830, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesWritten=0xf84f830*=0x428, lpOverlapped=0x0) returned 1 [0131.078] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.078] ReadFile (in: hFile=0x46c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x112a8, lpNumberOfBytesRead=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xf84f61c*=0x112a8, lpOverlapped=0x0) returned 1 [0131.118] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffeed58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.118] BCryptEncrypt (in: hKey=0x76b0f0, pbInput=0x2c50000, cbInput=0x112a8, pPaddingInfo=0x0, pbIV=0xf84f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xf84f618, dwFlags=0x1 | out: hKey=0x76b0f0, pbIV=0xf84f848, pbOutput=0x2c50000, pcbResult=0xf84f618) returned 0x0 [0131.118] WriteFile (in: hFile=0x46c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x112b0, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xf84f61c*=0x112b0, lpOverlapped=0x0) returned 1 [0131.119] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf84f60c | out: lpNewFilePointer=0x0) returned 1 [0131.119] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.119] WriteFile (in: hFile=0x46c, lpBuffer=0xf84f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0xf84f83c*, lpNumberOfBytesWritten=0xf84f61c*=0x8, lpOverlapped=0x0) returned 1 [0131.119] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x112b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.119] BCryptDestroyKey (in: hKey=0x76b0f0 | out: hKey=0x76b0f0) returned 0x0 [0131.119] CloseHandle (hObject=0x46c) returned 1 [0131.125] VirtualAlloc (lpAddress=0x0, dwSize=0x99, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0131.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxev.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXEV.DLL.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxev.dll.play")) returned 1 [0131.135] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 282 os_tid = 0x10ec [0130.861] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.861] ReadFile (in: hFile=0x6d0, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.079] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.079] ReadFile (in: hFile=0x6d0, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0131.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0131.080] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0131.080] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0131.080] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1070f500) returned 0x0 [0131.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0131.080] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1070f500) returned 0x0 [0131.084] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.085] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.085] WriteFile (in: hFile=0x6d0, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0131.086] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.086] ReadFile (in: hFile=0x6d0, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x360a8, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1070f61c*=0x360a8, lpOverlapped=0x0) returned 1 [0131.108] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0xfffc9f58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.108] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x2d50000, cbInput=0x360a8, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x1070f848, pbOutput=0x2d50000, pcbResult=0x1070f618) returned 0x0 [0131.108] WriteFile (in: hFile=0x6d0, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x360b0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1070f61c*=0x360b0, lpOverlapped=0x0) returned 1 [0131.109] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0131.109] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.109] WriteFile (in: hFile=0x6d0, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0131.109] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x360b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.109] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0131.109] CloseHandle (hObject=0x6d0) returned 1 [0131.114] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmled.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLED.EXE.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmled.exe.play")) returned 1 [0131.129] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 283 os_tid = 0xb7c [0130.890] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.890] ReadFile (in: hFile=0x6c8, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0130.892] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.892] ReadFile (in: hFile=0x6c8, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0130.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0130.894] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0130.894] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0130.894] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0130.894] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x10c0f500) returned 0x0 [0130.894] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0130.894] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x10c0f500) returned 0x0 [0130.897] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.899] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.899] WriteFile (in: hFile=0x6c8, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0131.104] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.104] ReadFile (in: hFile=0x6c8, lpBuffer=0x3050000, nNumberOfBytesToRead=0x100c8, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x10c0f61c*=0x100c8, lpOverlapped=0x0) returned 1 [0131.121] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffeff38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.122] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3050000, cbInput=0x100c8, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0x10c0f848, pbOutput=0x3050000, pcbResult=0x10c0f618) returned 0x0 [0131.122] WriteFile (in: hFile=0x6c8, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x100d0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x10c0f61c*=0x100d0, lpOverlapped=0x0) returned 1 [0131.122] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0131.122] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.122] WriteFile (in: hFile=0x6c8, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0131.122] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x100d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.122] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0131.122] CloseHandle (hObject=0x6c8) returned 1 [0131.127] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0xf850000 [0131.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmlmf.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSOXMLMF.DLL.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmlmf.dll.play")) returned 1 [0131.132] VirtualFree (lpAddress=0xf850000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 284 os_tid = 0x131c [0131.571] GetLastError () returned 0x57 [0131.571] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a3950 [0131.572] SetLastError (dwErrCode=0x57) [0131.572] IcmpCreateFile () returned 0x79e2c8 [0131.572] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a70a8 [0131.572] IcmpSendEcho2 (in: IcmpHandle=0x79e2c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc200a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a70a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a70a8) returned 0x0 [0138.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a70a8 | out: hHeap=0x710000) returned 1 [0138.046] IcmpCloseHandle (IcmpHandle=0x79e2c8) returned 1 [0138.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a3950 | out: hHeap=0x710000) returned 1 Thread: id = 285 os_tid = 0x13a8 [0131.573] GetLastError () returned 0x57 [0131.573] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a3cd8 [0131.574] SetLastError (dwErrCode=0x57) [0131.574] IcmpCreateFile () returned 0x79e300 [0131.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a70f8 [0131.574] IcmpSendEcho2 (in: IcmpHandle=0x79e300, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc300a8c0, RequestData=0xff8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a70f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a70f8) returned 0x0 [0138.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a70f8 | out: hHeap=0x710000) returned 1 [0138.053] IcmpCloseHandle (IcmpHandle=0x79e300) returned 1 [0138.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a3cd8 | out: hHeap=0x710000) returned 1 Thread: id = 286 os_tid = 0x1140 [0131.575] GetLastError () returned 0x57 [0131.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a43e8 [0131.575] SetLastError (dwErrCode=0x57) [0131.575] IcmpCreateFile () returned 0x79e290 [0131.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7148 [0131.575] IcmpSendEcho2 (in: IcmpHandle=0x79e290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc400a8c0, RequestData=0x100cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7148) returned 0x0 [0138.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7148 | out: hHeap=0x710000) returned 1 [0138.057] IcmpCloseHandle (IcmpHandle=0x79e290) returned 1 [0138.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a43e8 | out: hHeap=0x710000) returned 1 Thread: id = 287 os_tid = 0x13a4 [0131.577] GetLastError () returned 0x57 [0131.577] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4770 [0131.577] SetLastError (dwErrCode=0x57) [0131.577] IcmpCreateFile () returned 0x75d540 [0131.577] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7198 [0131.577] IcmpSendEcho2 (in: IcmpHandle=0x75d540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc500a8c0, RequestData=0x10d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7198) returned 0x0 [0138.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7198 | out: hHeap=0x710000) returned 1 [0138.064] IcmpCloseHandle (IcmpHandle=0x75d540) returned 1 [0138.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4770 | out: hHeap=0x710000) returned 1 Thread: id = 288 os_tid = 0x1398 [0131.578] GetLastError () returned 0x57 [0131.578] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4af8 [0131.578] SetLastError (dwErrCode=0x57) [0131.578] IcmpCreateFile () returned 0x75d578 [0131.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a71e8 [0131.579] IcmpSendEcho2 (in: IcmpHandle=0x75d578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc600a8c0, RequestData=0x16c4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a71e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a71e8) returned 0x0 [0138.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a71e8 | out: hHeap=0x710000) returned 1 [0138.073] IcmpCloseHandle (IcmpHandle=0x75d578) returned 1 [0138.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4af8 | out: hHeap=0x710000) returned 1 Thread: id = 289 os_tid = 0x13ec [0131.580] GetLastError () returned 0x57 [0131.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4e80 [0131.580] SetLastError (dwErrCode=0x57) [0131.580] IcmpCreateFile () returned 0x7adf10 [0131.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7238 [0131.580] IcmpSendEcho2 (in: IcmpHandle=0x7adf10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc700a8c0, RequestData=0x1778ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7238) returned 0x0 [0138.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7238 | out: hHeap=0x710000) returned 1 [0138.077] IcmpCloseHandle (IcmpHandle=0x7adf10) returned 1 [0138.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4e80 | out: hHeap=0x710000) returned 1 Thread: id = 290 os_tid = 0x13e8 [0131.581] GetLastError () returned 0x57 [0131.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5208 [0131.582] SetLastError (dwErrCode=0x57) [0131.582] IcmpCreateFile () returned 0x7adf48 [0131.582] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6c48 [0131.582] IcmpSendEcho2 (in: IcmpHandle=0x7adf48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc800a8c0, RequestData=0x1813ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6c48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6c48) returned 0x0 [0138.080] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6c48 | out: hHeap=0x710000) returned 1 [0138.080] IcmpCloseHandle (IcmpHandle=0x7adf48) returned 1 [0138.080] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5208 | out: hHeap=0x710000) returned 1 Thread: id = 291 os_tid = 0x13c8 [0131.583] GetLastError () returned 0x57 [0131.583] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5590 [0131.583] SetLastError (dwErrCode=0x57) [0131.583] IcmpCreateFile () returned 0x7adf80 [0131.583] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6c98 [0131.583] IcmpSendEcho2 (in: IcmpHandle=0x7adf80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc900a8c0, RequestData=0x1bafff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6c98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6c98) returned 0x0 [0138.181] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6c98 | out: hHeap=0x710000) returned 1 [0138.181] IcmpCloseHandle (IcmpHandle=0x7adf80) returned 1 [0138.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5590 | out: hHeap=0x710000) returned 1 Thread: id = 292 os_tid = 0x13e0 [0131.584] GetLastError () returned 0x57 [0131.585] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5918 [0131.585] SetLastError (dwErrCode=0x57) [0131.585] IcmpCreateFile () returned 0x7adfb8 [0131.585] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7288 [0131.585] IcmpSendEcho2 (in: IcmpHandle=0x7adfb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xca00a8c0, RequestData=0x1bc3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7288, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7288) returned 0x0 [0138.228] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7288 | out: hHeap=0x710000) returned 1 [0138.228] IcmpCloseHandle (IcmpHandle=0x7adfb8) returned 1 [0138.228] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5918 | out: hHeap=0x710000) returned 1 Thread: id = 293 os_tid = 0x13e4 [0131.586] GetLastError () returned 0x57 [0131.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79eba0 [0131.586] SetLastError (dwErrCode=0x57) [0131.586] IcmpCreateFile () returned 0x7adff0 [0131.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7328 [0131.586] IcmpSendEcho2 (in: IcmpHandle=0x7adff0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcb00a8c0, RequestData=0x1bd7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7328, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7328) returned 0x0 [0138.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7328 | out: hHeap=0x710000) returned 1 [0138.355] IcmpCloseHandle (IcmpHandle=0x7adff0) returned 1 [0138.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79eba0 | out: hHeap=0x710000) returned 1 Thread: id = 294 os_tid = 0x13f4 [0131.588] GetLastError () returned 0x57 [0131.588] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79f2b0 [0131.588] SetLastError (dwErrCode=0x57) [0131.588] IcmpCreateFile () returned 0x7ae028 [0131.588] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7378 [0131.588] IcmpSendEcho2 (in: IcmpHandle=0x7ae028, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcc00a8c0, RequestData=0x1bebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7378, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7378) returned 0x0 [0138.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7378 | out: hHeap=0x710000) returned 1 [0138.362] IcmpCloseHandle (IcmpHandle=0x7ae028) returned 1 [0138.362] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79f2b0 | out: hHeap=0x710000) returned 1 Thread: id = 295 os_tid = 0x13f8 [0131.589] GetLastError () returned 0x57 [0131.590] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79f638 [0131.590] SetLastError (dwErrCode=0x57) [0131.590] IcmpCreateFile () returned 0x7ae060 [0131.590] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7418 [0131.590] IcmpSendEcho2 (in: IcmpHandle=0x7ae060, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcd00a8c0, RequestData=0x1bffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7418, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7418) returned 0x0 [0138.368] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7418 | out: hHeap=0x710000) returned 1 [0138.368] IcmpCloseHandle (IcmpHandle=0x7ae060) returned 1 [0138.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79f638 | out: hHeap=0x710000) returned 1 Thread: id = 296 os_tid = 0x13d4 [0131.591] GetLastError () returned 0x57 [0131.591] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5ca0 [0131.591] SetLastError (dwErrCode=0x57) [0131.591] IcmpCreateFile () returned 0x7ae098 [0131.591] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a75a8 [0131.591] IcmpSendEcho2 (in: IcmpHandle=0x7ae098, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xce00a8c0, RequestData=0x1c13ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a75a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a75a8) returned 0x0 [0138.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a75a8 | out: hHeap=0x710000) returned 1 [0138.375] IcmpCloseHandle (IcmpHandle=0x7ae098) returned 1 [0138.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5ca0 | out: hHeap=0x710000) returned 1 Thread: id = 297 os_tid = 0x13c4 [0131.593] GetLastError () returned 0x57 [0131.593] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a6028 [0131.593] SetLastError (dwErrCode=0x57) [0131.593] IcmpCreateFile () returned 0x7ae0d0 [0131.593] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a75f8 [0131.593] IcmpSendEcho2 (in: IcmpHandle=0x7ae0d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcf00a8c0, RequestData=0x1c27ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a75f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a75f8) returned 0x0 [0138.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a75f8 | out: hHeap=0x710000) returned 1 [0138.387] IcmpCloseHandle (IcmpHandle=0x7ae0d0) returned 1 [0138.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6028 | out: hHeap=0x710000) returned 1 Thread: id = 298 os_tid = 0x784 [0131.594] GetLastError () returned 0x57 [0131.594] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a63b0 [0131.594] SetLastError (dwErrCode=0x57) [0131.594] IcmpCreateFile () returned 0x7ae108 [0131.594] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7648 [0131.595] IcmpSendEcho2 (in: IcmpHandle=0x7ae108, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd000a8c0, RequestData=0x1c3bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7648, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7648) returned 0x0 [0138.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7648 | out: hHeap=0x710000) returned 1 [0138.397] IcmpCloseHandle (IcmpHandle=0x7ae108) returned 1 [0138.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a63b0 | out: hHeap=0x710000) returned 1 Thread: id = 299 os_tid = 0x444 [0131.596] GetLastError () returned 0x57 [0131.596] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a6738 [0131.596] SetLastError (dwErrCode=0x57) [0131.596] IcmpCreateFile () returned 0x7ae140 [0131.596] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7698 [0131.596] IcmpSendEcho2 (in: IcmpHandle=0x7ae140, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd100a8c0, RequestData=0x1c4fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7698, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7698) returned 0x0 [0138.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7698 | out: hHeap=0x710000) returned 1 [0138.404] IcmpCloseHandle (IcmpHandle=0x7ae140) returned 1 [0138.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6738 | out: hHeap=0x710000) returned 1 Thread: id = 300 os_tid = 0xa10 [0131.597] GetLastError () returned 0x57 [0131.597] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755020 [0131.598] SetLastError (dwErrCode=0x57) [0131.598] IcmpCreateFile () returned 0x7ae178 [0131.598] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a76e8 [0131.598] IcmpSendEcho2 (in: IcmpHandle=0x7ae178, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd200a8c0, RequestData=0x1c63ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a76e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a76e8) returned 0x0 [0138.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a76e8 | out: hHeap=0x710000) returned 1 [0138.413] IcmpCloseHandle (IcmpHandle=0x7ae178) returned 1 [0138.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755020 | out: hHeap=0x710000) returned 1 Thread: id = 301 os_tid = 0xb14 [0131.599] GetLastError () returned 0x57 [0131.599] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7553a8 [0131.599] SetLastError (dwErrCode=0x57) [0131.599] IcmpCreateFile () returned 0x7ae1b0 [0131.599] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7738 [0131.599] IcmpSendEcho2 (in: IcmpHandle=0x7ae1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd300a8c0, RequestData=0x1c77ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7738, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7738) returned 0x0 [0138.419] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7738 | out: hHeap=0x710000) returned 1 [0138.419] IcmpCloseHandle (IcmpHandle=0x7ae1b0) returned 1 [0138.419] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7553a8 | out: hHeap=0x710000) returned 1 Thread: id = 302 os_tid = 0x7bc [0131.600] GetLastError () returned 0x57 [0131.601] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5be0 [0131.603] SetLastError (dwErrCode=0x57) [0131.603] IcmpCreateFile () returned 0x7ade30 [0131.603] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a79b8 [0131.604] IcmpSendEcho2 (in: IcmpHandle=0x7ade30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd400a8c0, RequestData=0x1c8bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a79b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a79b8) returned 0x0 [0138.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a79b8 | out: hHeap=0x710000) returned 1 [0138.486] IcmpCloseHandle (IcmpHandle=0x7ade30) returned 1 [0138.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5be0 | out: hHeap=0x710000) returned 1 Thread: id = 303 os_tid = 0xb04 [0131.605] GetLastError () returned 0x57 [0131.605] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b54d0 [0131.605] SetLastError (dwErrCode=0x57) [0131.605] IcmpCreateFile () returned 0x7ae1e8 [0131.605] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7788 [0131.605] IcmpSendEcho2 (in: IcmpHandle=0x7ae1e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd500a8c0, RequestData=0x1c9fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7788, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7788) returned 0x0 [0138.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7788 | out: hHeap=0x710000) returned 1 [0138.500] IcmpCloseHandle (IcmpHandle=0x7ae1e8) returned 1 [0138.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b54d0 | out: hHeap=0x710000) returned 1 Thread: id = 304 os_tid = 0x1354 [0131.606] GetLastError () returned 0x57 [0131.606] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5858 [0131.607] SetLastError (dwErrCode=0x57) [0131.607] IcmpCreateFile () returned 0x7ae220 [0131.607] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a77d8 [0131.607] IcmpSendEcho2 (in: IcmpHandle=0x7ae220, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd600a8c0, RequestData=0x1cb3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a77d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a77d8) returned 0x0 [0138.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a77d8 | out: hHeap=0x710000) returned 1 [0138.678] IcmpCloseHandle (IcmpHandle=0x7ae220) returned 1 [0138.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5858 | out: hHeap=0x710000) returned 1 Thread: id = 305 os_tid = 0x1318 [0131.608] GetLastError () returned 0x57 [0131.608] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5f68 [0131.608] SetLastError (dwErrCode=0x57) [0131.608] IcmpCreateFile () returned 0x7ae258 [0131.608] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7828 [0131.608] IcmpSendEcho2 (in: IcmpHandle=0x7ae258, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd700a8c0, RequestData=0x1cc7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7828, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7828) returned 0x0 [0138.740] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7828 | out: hHeap=0x710000) returned 1 [0138.740] IcmpCloseHandle (IcmpHandle=0x7ae258) returned 1 [0138.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5f68 | out: hHeap=0x710000) returned 1 Thread: id = 306 os_tid = 0x113c [0131.609] GetLastError () returned 0x57 [0131.610] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7afc88 [0131.610] SetLastError (dwErrCode=0x57) [0131.610] IcmpCreateFile () returned 0x7ae290 [0131.610] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7878 [0131.610] IcmpSendEcho2 (in: IcmpHandle=0x7ae290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd800a8c0, RequestData=0x1cdbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7878, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7878) returned 0x0 [0138.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7878 | out: hHeap=0x710000) returned 1 [0138.748] IcmpCloseHandle (IcmpHandle=0x7ae290) returned 1 [0138.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7afc88 | out: hHeap=0x710000) returned 1 Thread: id = 307 os_tid = 0x808 [0131.611] GetLastError () returned 0x57 [0131.611] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0010 [0131.611] SetLastError (dwErrCode=0x57) [0131.611] IcmpCreateFile () returned 0x7adbc8 [0131.611] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a78c8 [0131.611] IcmpSendEcho2 (in: IcmpHandle=0x7adbc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd900a8c0, RequestData=0x1cefff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a78c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a78c8) returned 0x0 [0138.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a78c8 | out: hHeap=0x710000) returned 1 [0138.756] IcmpCloseHandle (IcmpHandle=0x7adbc8) returned 1 [0138.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0010 | out: hHeap=0x710000) returned 1 Thread: id = 308 os_tid = 0x5f4 [0131.613] GetLastError () returned 0x57 [0131.613] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0398 [0131.613] SetLastError (dwErrCode=0x57) [0131.613] IcmpCreateFile () returned 0x7adc00 [0131.613] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7918 [0131.613] IcmpSendEcho2 (in: IcmpHandle=0x7adc00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xda00a8c0, RequestData=0x1d03ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7918, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7918) returned 0x0 [0138.762] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7918 | out: hHeap=0x710000) returned 1 [0138.762] IcmpCloseHandle (IcmpHandle=0x7adc00) returned 1 [0138.762] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0398 | out: hHeap=0x710000) returned 1 Thread: id = 309 os_tid = 0x121c [0131.614] GetLastError () returned 0x57 [0131.614] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0720 [0131.614] SetLastError (dwErrCode=0x57) [0131.614] IcmpCreateFile () returned 0x7adc38 [0131.615] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7968 [0131.615] IcmpSendEcho2 (in: IcmpHandle=0x7adc38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdb00a8c0, RequestData=0x1d17ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7968, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7968) returned 0x0 [0138.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7968 | out: hHeap=0x710000) returned 1 [0138.771] IcmpCloseHandle (IcmpHandle=0x7adc38) returned 1 [0138.772] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0720 | out: hHeap=0x710000) returned 1 Thread: id = 310 os_tid = 0xb9c [0131.616] GetLastError () returned 0x57 [0131.616] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0aa8 [0131.616] SetLastError (dwErrCode=0x57) [0131.616] IcmpCreateFile () returned 0x7adc70 [0131.616] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7a08 [0131.616] IcmpSendEcho2 (in: IcmpHandle=0x7adc70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdc00a8c0, RequestData=0x1d2bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7a08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7a08) returned 0x0 [0138.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7a08 | out: hHeap=0x710000) returned 1 [0138.777] IcmpCloseHandle (IcmpHandle=0x7adc70) returned 1 [0138.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0aa8 | out: hHeap=0x710000) returned 1 Thread: id = 311 os_tid = 0x1014 [0131.617] GetLastError () returned 0x57 [0131.617] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0e30 [0131.618] SetLastError (dwErrCode=0x57) [0131.618] IcmpCreateFile () returned 0x7adca8 [0131.618] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7a58 [0131.618] IcmpSendEcho2 (in: IcmpHandle=0x7adca8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdd00a8c0, RequestData=0x1d3fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7a58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7a58) returned 0x0 [0138.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7a58 | out: hHeap=0x710000) returned 1 [0138.784] IcmpCloseHandle (IcmpHandle=0x7adca8) returned 1 [0138.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0e30 | out: hHeap=0x710000) returned 1 Thread: id = 312 os_tid = 0xcf8 [0131.619] GetLastError () returned 0x57 [0131.619] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b11b8 [0131.619] SetLastError (dwErrCode=0x57) [0131.619] IcmpCreateFile () returned 0x7adce0 [0131.619] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7aa8 [0131.619] IcmpSendEcho2 (in: IcmpHandle=0x7adce0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xde00a8c0, RequestData=0x1d53ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7aa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7aa8) returned 0x0 [0138.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7aa8 | out: hHeap=0x710000) returned 1 [0138.790] IcmpCloseHandle (IcmpHandle=0x7adce0) returned 1 [0138.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b11b8 | out: hHeap=0x710000) returned 1 Thread: id = 313 os_tid = 0xe30 [0131.627] GetLastError () returned 0x57 [0131.627] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7af1f0 [0131.627] SetLastError (dwErrCode=0x57) [0131.627] IcmpCreateFile () returned 0x7add18 [0131.627] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7af8 [0131.627] IcmpSendEcho2 (in: IcmpHandle=0x7add18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdf00a8c0, RequestData=0x1d67ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7af8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7af8) returned 0x0 [0138.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7af8 | out: hHeap=0x710000) returned 1 [0138.802] IcmpCloseHandle (IcmpHandle=0x7add18) returned 1 [0138.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7af1f0 | out: hHeap=0x710000) returned 1 Thread: id = 314 os_tid = 0xe34 [0131.629] GetLastError () returned 0x57 [0131.629] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1540 [0131.629] SetLastError (dwErrCode=0x57) [0131.629] IcmpCreateFile () returned 0x7add50 [0131.629] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73db08 [0131.629] IcmpSendEcho2 (in: IcmpHandle=0x7add50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe000a8c0, RequestData=0x1d7bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73db08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73db08) returned 0x0 [0138.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73db08 | out: hHeap=0x710000) returned 1 [0138.812] IcmpCloseHandle (IcmpHandle=0x7add50) returned 1 [0138.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b1540 | out: hHeap=0x710000) returned 1 Thread: id = 315 os_tid = 0xe38 [0131.630] GetLastError () returned 0x57 [0131.630] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b18c8 [0131.631] SetLastError (dwErrCode=0x57) [0131.631] IcmpCreateFile () returned 0x7add88 [0131.631] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dba8 [0131.631] IcmpSendEcho2 (in: IcmpHandle=0x7add88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe100a8c0, RequestData=0x1d8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dba8) returned 0x0 [0138.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dba8 | out: hHeap=0x710000) returned 1 [0138.818] IcmpCloseHandle (IcmpHandle=0x7add88) returned 1 [0138.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b18c8 | out: hHeap=0x710000) returned 1 Thread: id = 316 os_tid = 0xe3c [0131.634] GetLastError () returned 0x57 [0131.634] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7af578 [0131.634] SetLastError (dwErrCode=0x57) [0131.634] IcmpCreateFile () returned 0x7addc0 [0131.634] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baf20 [0131.635] IcmpSendEcho2 (in: IcmpHandle=0x7addc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe200a8c0, RequestData=0x1da3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baf20, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baf20) returned 0x0 [0138.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baf20 | out: hHeap=0x710000) returned 1 [0138.827] IcmpCloseHandle (IcmpHandle=0x7addc0) returned 1 [0138.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7af578 | out: hHeap=0x710000) returned 1 Thread: id = 317 os_tid = 0xfc8 [0131.636] GetLastError () returned 0x57 [0131.636] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ae758 [0131.636] SetLastError (dwErrCode=0x57) [0131.636] IcmpCreateFile () returned 0x7addf8 [0131.636] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baf70 [0131.636] IcmpSendEcho2 (in: IcmpHandle=0x7addf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe300a8c0, RequestData=0x1db7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baf70, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baf70) returned 0x0 [0138.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baf70 | out: hHeap=0x710000) returned 1 [0138.871] IcmpCloseHandle (IcmpHandle=0x7addf8) returned 1 [0138.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ae758 | out: hHeap=0x710000) returned 1 Thread: id = 318 os_tid = 0xfcc [0131.637] GetLastError () returned 0x57 [0131.637] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aeae0 [0131.638] SetLastError (dwErrCode=0x57) [0131.638] IcmpCreateFile () returned 0x7ade68 [0131.638] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bafc0 [0131.638] IcmpSendEcho2 (in: IcmpHandle=0x7ade68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe400a8c0, RequestData=0x1dcbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bafc0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bafc0) returned 0x0 [0138.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bafc0 | out: hHeap=0x710000) returned 1 [0138.892] IcmpCloseHandle (IcmpHandle=0x7ade68) returned 1 [0138.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aeae0 | out: hHeap=0x710000) returned 1 Thread: id = 319 os_tid = 0xfd0 [0131.639] GetLastError () returned 0x57 [0131.639] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aee68 [0131.639] SetLastError (dwErrCode=0x57) [0131.639] IcmpCreateFile () returned 0x7adea0 [0131.639] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb010 [0131.639] IcmpSendEcho2 (in: IcmpHandle=0x7adea0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe500a8c0, RequestData=0x1ddfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb010, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb010) returned 0x0 [0138.904] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb010 | out: hHeap=0x710000) returned 1 [0138.904] IcmpCloseHandle (IcmpHandle=0x7adea0) returned 1 [0138.904] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aee68 | out: hHeap=0x710000) returned 1 Thread: id = 320 os_tid = 0xfd4 [0131.640] GetLastError () returned 0x57 [0131.641] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7af900 [0131.641] SetLastError (dwErrCode=0x57) [0131.641] IcmpCreateFile () returned 0x7aded8 [0131.641] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb060 [0131.641] IcmpSendEcho2 (in: IcmpHandle=0x7aded8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe600a8c0, RequestData=0x1df3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb060, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb060) returned 0x0 [0138.912] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb060 | out: hHeap=0x710000) returned 1 [0138.912] IcmpCloseHandle (IcmpHandle=0x7aded8) returned 1 [0138.912] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7af900 | out: hHeap=0x710000) returned 1 Thread: id = 321 os_tid = 0xfd8 [0131.642] GetLastError () returned 0x57 [0131.642] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1c50 [0131.642] SetLastError (dwErrCode=0x57) [0131.642] IcmpCreateFile () returned 0x7ae2c8 [0131.642] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb0b0 [0131.642] IcmpSendEcho2 (in: IcmpHandle=0x7ae2c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe700a8c0, RequestData=0x1e07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb0b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb0b0) returned 0x0 [0138.935] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb0b0 | out: hHeap=0x710000) returned 1 [0138.935] IcmpCloseHandle (IcmpHandle=0x7ae2c8) returned 1 [0138.936] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b1c50 | out: hHeap=0x710000) returned 1 Thread: id = 322 os_tid = 0xfdc [0131.643] GetLastError () returned 0x57 [0131.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1fd8 [0131.644] SetLastError (dwErrCode=0x57) [0131.644] IcmpCreateFile () returned 0x7ae300 [0131.644] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb100 [0131.644] IcmpSendEcho2 (in: IcmpHandle=0x7ae300, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe800a8c0, RequestData=0x1e1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb100, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb100) returned 0x0 [0138.942] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb100 | out: hHeap=0x710000) returned 1 [0138.943] IcmpCloseHandle (IcmpHandle=0x7ae300) returned 1 [0138.943] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b1fd8 | out: hHeap=0x710000) returned 1 Thread: id = 323 os_tid = 0xfe0 [0131.645] GetLastError () returned 0x57 [0131.645] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2360 [0131.645] SetLastError (dwErrCode=0x57) [0131.645] IcmpCreateFile () returned 0x7ae338 [0131.645] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb150 [0131.645] IcmpSendEcho2 (in: IcmpHandle=0x7ae338, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe900a8c0, RequestData=0x1e2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb150, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb150) returned 0x0 [0138.961] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb150 | out: hHeap=0x710000) returned 1 [0138.961] IcmpCloseHandle (IcmpHandle=0x7ae338) returned 1 [0138.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b2360 | out: hHeap=0x710000) returned 1 Thread: id = 324 os_tid = 0xfe4 [0131.646] GetLastError () returned 0x57 [0131.646] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2a70 [0131.646] SetLastError (dwErrCode=0x57) [0131.646] IcmpCreateFile () returned 0x7bd438 [0131.646] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb1a0 [0131.646] IcmpSendEcho2 (in: IcmpHandle=0x7bd438, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xea00a8c0, RequestData=0x1e43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb1a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb1a0) returned 0x0 [0138.968] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb1a0 | out: hHeap=0x710000) returned 1 [0138.968] IcmpCloseHandle (IcmpHandle=0x7bd438) returned 1 [0138.969] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b2a70 | out: hHeap=0x710000) returned 1 Thread: id = 325 os_tid = 0xfe8 [0131.647] GetLastError () returned 0x57 [0131.647] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2df8 [0131.647] SetLastError (dwErrCode=0x57) [0131.647] IcmpCreateFile () returned 0x7bd5f8 [0131.647] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bae80 [0131.647] IcmpSendEcho2 (in: IcmpHandle=0x7bd5f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xeb00a8c0, RequestData=0x1e57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bae80, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bae80) returned 0x0 [0138.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bae80 | out: hHeap=0x710000) returned 1 [0138.973] IcmpCloseHandle (IcmpHandle=0x7bd5f8) returned 1 [0138.974] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b2df8 | out: hHeap=0x710000) returned 1 Thread: id = 326 os_tid = 0xfec [0131.648] GetLastError () returned 0x57 [0131.649] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3180 [0131.649] SetLastError (dwErrCode=0x57) [0131.649] IcmpCreateFile () returned 0x7bd630 [0131.649] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baed0 [0131.649] IcmpSendEcho2 (in: IcmpHandle=0x7bd630, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xec00a8c0, RequestData=0x1e6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baed0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baed0) returned 0x0 [0139.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baed0 | out: hHeap=0x710000) returned 1 [0139.009] IcmpCloseHandle (IcmpHandle=0x7bd630) returned 1 [0139.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3180 | out: hHeap=0x710000) returned 1 Thread: id = 327 os_tid = 0xff0 [0131.650] GetLastError () returned 0x57 [0131.650] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3508 [0131.650] SetLastError (dwErrCode=0x57) [0131.650] IcmpCreateFile () returned 0x7bd668 [0131.650] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb1f0 [0131.650] IcmpSendEcho2 (in: IcmpHandle=0x7bd668, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xed00a8c0, RequestData=0x1e7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb1f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb1f0) returned 0x0 [0139.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb1f0 | out: hHeap=0x710000) returned 1 [0139.031] IcmpCloseHandle (IcmpHandle=0x7bd668) returned 1 [0139.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3508 | out: hHeap=0x710000) returned 1 Thread: id = 328 os_tid = 0xff4 [0131.651] GetLastError () returned 0x57 [0131.651] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3890 [0131.651] SetLastError (dwErrCode=0x57) [0131.651] IcmpCreateFile () returned 0x7bd6a0 [0131.651] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb240 [0131.651] IcmpSendEcho2 (in: IcmpHandle=0x7bd6a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xee00a8c0, RequestData=0x1e93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb240, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb240) returned 0x0 [0139.206] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb240 | out: hHeap=0x710000) returned 1 [0139.206] IcmpCloseHandle (IcmpHandle=0x7bd6a0) returned 1 [0139.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3890 | out: hHeap=0x710000) returned 1 Thread: id = 329 os_tid = 0xff8 [0131.652] GetLastError () returned 0x57 [0131.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3c18 [0131.653] SetLastError (dwErrCode=0x57) [0131.653] IcmpCreateFile () returned 0x7bd6d8 [0131.653] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb290 [0131.653] IcmpSendEcho2 (in: IcmpHandle=0x7bd6d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xef00a8c0, RequestData=0x1ea7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb290, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb290) returned 0x0 [0139.268] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb290 | out: hHeap=0x710000) returned 1 [0139.268] IcmpCloseHandle (IcmpHandle=0x7bd6d8) returned 1 [0139.268] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3c18 | out: hHeap=0x710000) returned 1 Thread: id = 330 os_tid = 0xffc [0131.654] GetLastError () returned 0x57 [0131.654] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3fa0 [0131.654] SetLastError (dwErrCode=0x57) [0131.654] IcmpCreateFile () returned 0x7bd710 [0131.654] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb2e0 [0131.654] IcmpSendEcho2 (in: IcmpHandle=0x7bd710, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf000a8c0, RequestData=0x1ebbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb2e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb2e0) returned 0x0 [0139.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb2e0 | out: hHeap=0x710000) returned 1 [0139.326] IcmpCloseHandle (IcmpHandle=0x7bd710) returned 1 [0139.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3fa0 | out: hHeap=0x710000) returned 1 Thread: id = 331 os_tid = 0xbf4 [0131.655] GetLastError () returned 0x57 [0131.655] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4328 [0131.655] SetLastError (dwErrCode=0x57) [0131.655] IcmpCreateFile () returned 0x7bd748 [0131.655] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb330 [0131.655] IcmpSendEcho2 (in: IcmpHandle=0x7bd748, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf100a8c0, RequestData=0x1ecfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb330, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb330) returned 0x0 [0139.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb330 | out: hHeap=0x710000) returned 1 [0139.401] IcmpCloseHandle (IcmpHandle=0x7bd748) returned 1 [0139.402] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b4328 | out: hHeap=0x710000) returned 1 Thread: id = 332 os_tid = 0x60c [0131.656] GetLastError () returned 0x57 [0131.657] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b46b0 [0131.657] SetLastError (dwErrCode=0x57) [0131.657] IcmpCreateFile () returned 0x7bd780 [0131.657] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bade0 [0131.657] IcmpSendEcho2 (in: IcmpHandle=0x7bd780, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf200a8c0, RequestData=0x1ee3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bade0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bade0) returned 0x0 [0139.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bade0 | out: hHeap=0x710000) returned 1 [0139.446] IcmpCloseHandle (IcmpHandle=0x7bd780) returned 1 [0139.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b46b0 | out: hHeap=0x710000) returned 1 Thread: id = 333 os_tid = 0x940 [0131.658] GetLastError () returned 0x57 [0131.658] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4a38 [0131.658] SetLastError (dwErrCode=0x57) [0131.658] IcmpCreateFile () returned 0x7bd7b8 [0131.658] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bae30 [0131.658] IcmpSendEcho2 (in: IcmpHandle=0x7bd7b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf300a8c0, RequestData=0x1ef7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bae30, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bae30) returned 0x0 [0139.457] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bae30 | out: hHeap=0x710000) returned 1 [0139.457] IcmpCloseHandle (IcmpHandle=0x7bd7b8) returned 1 [0139.458] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b4a38 | out: hHeap=0x710000) returned 1 Thread: id = 334 os_tid = 0x91c [0131.659] GetLastError () returned 0x57 [0131.660] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4dc0 [0131.660] SetLastError (dwErrCode=0x57) [0131.660] IcmpCreateFile () returned 0x7bd7f0 [0131.660] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba520 [0131.660] IcmpSendEcho2 (in: IcmpHandle=0x7bd7f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf400a8c0, RequestData=0x1f0bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba520, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba520) returned 0x0 [0139.460] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba520 | out: hHeap=0x710000) returned 1 [0139.460] IcmpCloseHandle (IcmpHandle=0x7bd7f0) returned 1 [0139.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b4dc0 | out: hHeap=0x710000) returned 1 Thread: id = 335 os_tid = 0x740 [0131.661] GetLastError () returned 0x57 [0131.661] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5148 [0131.661] SetLastError (dwErrCode=0x57) [0131.661] IcmpCreateFile () returned 0x7bd828 [0131.661] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba570 [0131.661] IcmpSendEcho2 (in: IcmpHandle=0x7bd828, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf500a8c0, RequestData=0x1f1fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba570, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba570) returned 0x0 [0139.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba570 | out: hHeap=0x710000) returned 1 [0139.550] IcmpCloseHandle (IcmpHandle=0x7bd828) returned 1 [0139.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5148 | out: hHeap=0x710000) returned 1 Thread: id = 336 os_tid = 0x938 [0131.662] GetLastError () returned 0x57 [0131.662] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ae3d0 [0131.662] SetLastError (dwErrCode=0x57) [0131.662] IcmpCreateFile () returned 0x7bd860 [0131.662] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba5c0 [0131.662] IcmpSendEcho2 (in: IcmpHandle=0x7bd860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf600a8c0, RequestData=0x1f33ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba5c0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba5c0) returned 0x0 [0139.556] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba5c0 | out: hHeap=0x710000) returned 1 [0139.557] IcmpCloseHandle (IcmpHandle=0x7bd860) returned 1 [0139.557] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ae3d0 | out: hHeap=0x710000) returned 1 Thread: id = 337 os_tid = 0x978 [0131.663] GetLastError () returned 0x57 [0131.663] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b26e8 [0131.663] SetLastError (dwErrCode=0x57) [0131.664] IcmpCreateFile () returned 0x7bd898 [0131.664] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba610 [0131.664] IcmpSendEcho2 (in: IcmpHandle=0x7bd898, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf700a8c0, RequestData=0x1f47ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba610, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba610) returned 0x0 [0139.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba610 | out: hHeap=0x710000) returned 1 [0139.572] IcmpCloseHandle (IcmpHandle=0x7bd898) returned 1 [0139.573] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b26e8 | out: hHeap=0x710000) returned 1 Thread: id = 338 os_tid = 0xb4c [0131.665] GetLastError () returned 0x57 [0131.665] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4d08 [0131.667] SetLastError (dwErrCode=0x57) [0131.667] IcmpCreateFile () returned 0x7bd8d0 [0131.667] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba930 [0131.667] IcmpSendEcho2 (in: IcmpHandle=0x7bd8d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf800a8c0, RequestData=0x1f5bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba930, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba930) returned 0x0 [0139.581] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba930 | out: hHeap=0x710000) returned 1 [0139.581] IcmpCloseHandle (IcmpHandle=0x7bd8d0) returned 1 [0139.581] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c4d08 | out: hHeap=0x710000) returned 1 Thread: id = 339 os_tid = 0x9bc [0131.668] GetLastError () returned 0x57 [0131.668] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c57a0 [0131.668] SetLastError (dwErrCode=0x57) [0131.668] IcmpCreateFile () returned 0x7bd978 [0131.668] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba660 [0131.668] IcmpSendEcho2 (in: IcmpHandle=0x7bd978, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf900a8c0, RequestData=0x1f6fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba660, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba660) returned 0x0 [0139.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba660 | out: hHeap=0x710000) returned 1 [0139.585] IcmpCloseHandle (IcmpHandle=0x7bd978) returned 1 [0139.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c57a0 | out: hHeap=0x710000) returned 1 Thread: id = 340 os_tid = 0xb88 [0131.669] GetLastError () returned 0x57 [0131.669] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c5090 [0131.669] SetLastError (dwErrCode=0x57) [0131.669] IcmpCreateFile () returned 0x7bd9b0 [0131.669] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba6b0 [0131.669] IcmpSendEcho2 (in: IcmpHandle=0x7bd9b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfa00a8c0, RequestData=0x1f83ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba6b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba6b0) returned 0x0 [0139.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba6b0 | out: hHeap=0x710000) returned 1 [0139.590] IcmpCloseHandle (IcmpHandle=0x7bd9b0) returned 1 [0139.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c5090 | out: hHeap=0x710000) returned 1 Thread: id = 341 os_tid = 0x664 [0131.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0131.675] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0131.675] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xf70f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0131.675] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xf70f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xf70f828, pbKeyObject=0x0) returned 0x0 [0131.675] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xf70f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xf70f500) returned 0x0 [0131.675] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0131.675] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xf70f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xf70f500) returned 0x0 [0131.678] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.680] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.680] WriteFile (in: hFile=0x6dc, lpBuffer=0xf70fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf70f830, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesWritten=0xf70f830*=0x428, lpOverlapped=0x0) returned 1 [0131.684] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.684] ReadFile (in: hFile=0x6dc, lpBuffer=0x3150000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xf70f61c*=0x285, lpOverlapped=0x0) returned 1 [0131.684] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffd7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.684] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x3150000, cbInput=0x285, pPaddingInfo=0x0, pbIV=0xf70f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xf70f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0xf70f848, pbOutput=0x3150000, pcbResult=0xf70f618) returned 0x0 [0131.684] WriteFile (in: hFile=0x6dc, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xf70f61c*=0x290, lpOverlapped=0x0) returned 1 [0131.684] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf70f60c | out: lpNewFilePointer=0x0) returned 1 [0131.684] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.684] WriteFile (in: hFile=0x6dc, lpBuffer=0xf70f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0xf70f83c*, lpNumberOfBytesWritten=0xf70f61c*=0x8, lpOverlapped=0x0) returned 1 [0131.684] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.684] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0131.685] CloseHandle (hObject=0x6dc) returned 1 [0131.685] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.play")) returned 1 [0131.687] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 342 os_tid = 0x144 [0131.824] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.824] ReadFile (in: hFile=0x6c8, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.826] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.826] ReadFile (in: hFile=0x6c8, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.826] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0131.827] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0131.828] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xf84f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0131.828] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xf84f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xf84f828, pbKeyObject=0x0) returned 0x0 [0131.828] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xf84f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xf84f500) returned 0x0 [0131.830] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0131.830] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xf84f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xf84f500) returned 0x0 [0131.833] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.835] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.835] WriteFile (in: hFile=0x6c8, lpBuffer=0xf84fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf84f830, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesWritten=0xf84f830*=0x428, lpOverlapped=0x0) returned 1 [0131.835] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.835] ReadFile (in: hFile=0x6c8, lpBuffer=0x2850000, nNumberOfBytesToRead=0x4298, lpNumberOfBytesRead=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xf84f61c*=0x4298, lpOverlapped=0x0) returned 1 [0131.836] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xffffbd68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.836] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x2850000, cbInput=0x4298, pPaddingInfo=0x0, pbIV=0xf84f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xf84f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0xf84f848, pbOutput=0x2850000, pcbResult=0xf84f618) returned 0x0 [0131.836] WriteFile (in: hFile=0x6c8, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xf84f61c*=0x42a0, lpOverlapped=0x0) returned 1 [0131.836] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf84f60c | out: lpNewFilePointer=0x0) returned 1 [0131.836] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.836] WriteFile (in: hFile=0x6c8, lpBuffer=0xf84f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0xf84f83c*, lpNumberOfBytesWritten=0xf84f61c*=0x8, lpOverlapped=0x0) returned 1 [0131.836] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x42a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.836] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0131.836] CloseHandle (hObject=0x6c8) returned 1 [0131.837] VirtualAlloc (lpAddress=0x0, dwSize=0x97, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.play")) returned 1 [0131.839] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 343 os_tid = 0xb40 [0131.842] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.842] ReadFile (in: hFile=0x200, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.934] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.934] ReadFile (in: hFile=0x200, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.934] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0131.936] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0131.936] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0131.936] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0131.936] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1070f500) returned 0x0 [0131.936] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0131.936] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1070f500) returned 0x0 [0131.949] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.951] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.951] WriteFile (in: hFile=0x200, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0131.951] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.951] ReadFile (in: hFile=0x200, lpBuffer=0x2950000, nNumberOfBytesToRead=0x5898, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1070f61c*=0x5898, lpOverlapped=0x0) returned 1 [0131.982] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xffffa768, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.982] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x2950000, cbInput=0x5898, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0x1070f848, pbOutput=0x2950000, pcbResult=0x1070f618) returned 0x0 [0131.982] WriteFile (in: hFile=0x200, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1070f61c*=0x58a0, lpOverlapped=0x0) returned 1 [0131.983] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0131.983] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.983] WriteFile (in: hFile=0x200, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0131.983] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x58a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.983] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0131.983] CloseHandle (hObject=0x200) returned 1 [0131.984] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.PLAY" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.play")) returned 1 [0131.986] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 344 os_tid = 0x48c [0131.843] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.843] ReadFile (in: hFile=0x448, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.844] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.844] ReadFile (in: hFile=0x448, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0131.844] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0131.845] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0131.845] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0131.845] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0131.845] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x10c0f500) returned 0x0 [0131.846] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0131.846] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x10c0f500) returned 0x0 [0131.849] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.851] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.851] WriteFile (in: hFile=0x448, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0131.851] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.851] ReadFile (in: hFile=0x448, lpBuffer=0x2c50000, nNumberOfBytesToRead=0xe0ee, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x10c0f61c*=0xe0ee, lpOverlapped=0x0) returned 1 [0131.852] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xffff1f12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.852] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x2c50000, cbInput=0xe0ee, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0x10c0f848, pbOutput=0x2c50000, pcbResult=0x10c0f618) returned 0x0 [0131.852] WriteFile (in: hFile=0x448, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0xe0f0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x10c0f61c*=0xe0f0, lpOverlapped=0x0) returned 1 [0131.852] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0131.852] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.852] WriteFile (in: hFile=0x448, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0131.852] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xe0f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.852] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0131.852] CloseHandle (hObject=0x448) returned 1 [0131.853] VirtualAlloc (lpAddress=0x0, dwSize=0x7b, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0131.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\rdCuc5FgRBkMF64Lt.png" (normalized: "c:\\program files\\common files\\rdcuc5fgrbkmf64lt.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\rdCuc5FgRBkMF64Lt.png.PLAY" (normalized: "c:\\program files\\common files\\rdcuc5fgrbkmf64lt.png.play")) returned 1 [0131.855] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 345 os_tid = 0xa6c [0132.070] GetLastError () returned 0x57 [0132.070] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c5418 [0132.071] SetLastError (dwErrCode=0x57) [0132.071] IcmpCreateFile () returned 0x7bd9e8 [0132.071] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba700 [0132.071] IcmpSendEcho2 (in: IcmpHandle=0x7bd9e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfb00a8c0, RequestData=0x1f97ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba700, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba700) returned 0x0 [0139.595] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba700 | out: hHeap=0x710000) returned 1 [0139.595] IcmpCloseHandle (IcmpHandle=0x7bd9e8) returned 1 [0139.596] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c5418 | out: hHeap=0x710000) returned 1 Thread: id = 346 os_tid = 0x97c [0132.072] GetLastError () returned 0x57 [0132.072] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c22a8 [0132.072] SetLastError (dwErrCode=0x57) [0132.072] IcmpCreateFile () returned 0x7bda20 [0132.072] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba750 [0132.072] IcmpSendEcho2 (in: IcmpHandle=0x7bda20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfc00a8c0, RequestData=0x1084ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba750, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba750) returned 0x0 [0139.599] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba750 | out: hHeap=0x710000) returned 1 [0139.599] IcmpCloseHandle (IcmpHandle=0x7bda20) returned 1 [0139.599] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c22a8 | out: hHeap=0x710000) returned 1 Thread: id = 347 os_tid = 0xab0 [0132.074] GetLastError () returned 0x57 [0132.074] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c2630 [0132.074] SetLastError (dwErrCode=0x57) [0132.074] IcmpCreateFile () returned 0x7bda58 [0132.074] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba7a0 [0132.074] IcmpSendEcho2 (in: IcmpHandle=0x7bda58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfd00a8c0, RequestData=0x1098ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba7a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba7a0) returned 0x0 [0139.608] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba7a0 | out: hHeap=0x710000) returned 1 [0139.609] IcmpCloseHandle (IcmpHandle=0x7bda58) returned 1 [0139.609] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c2630 | out: hHeap=0x710000) returned 1 Thread: id = 348 os_tid = 0xaf0 [0132.075] GetLastError () returned 0x57 [0132.075] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c29b8 [0132.076] SetLastError (dwErrCode=0x57) [0132.076] IcmpCreateFile () returned 0x7bda90 [0132.076] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba7f0 [0132.076] IcmpSendEcho2 (in: IcmpHandle=0x7bda90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfe00a8c0, RequestData=0x1700ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba7f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba7f0) returned 0x0 [0139.613] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba7f0 | out: hHeap=0x710000) returned 1 [0139.613] IcmpCloseHandle (IcmpHandle=0x7bda90) returned 1 [0139.614] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c29b8 | out: hHeap=0x710000) returned 1 Thread: id = 349 os_tid = 0xd1c [0132.177] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.178] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.179] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0132.179] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0132.179] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xf48f500) returned 0x0 [0132.179] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.179] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xf48f500) returned 0x0 [0132.182] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.184] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.184] WriteFile (in: hFile=0x2e8, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0132.186] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.186] ReadFile (in: hFile=0x2e8, lpBuffer=0x2850000, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xf48f61c*=0xae, lpOverlapped=0x0) returned 1 [0132.186] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.186] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x2850000, cbInput=0xae, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0xf48f848, pbOutput=0x2850000, pcbResult=0xf48f618) returned 0x0 [0132.187] WriteFile (in: hFile=0x2e8, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xf48f61c*=0xb0, lpOverlapped=0x0) returned 1 [0132.187] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0132.187] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.187] WriteFile (in: hFile=0x2e8, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.187] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.187] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0132.187] CloseHandle (hObject=0x2e8) returned 1 [0132.187] VirtualAlloc (lpAddress=0x0, dwSize=0x4d, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\desktop.ini.PLAY" (normalized: "c:\\program files\\desktop.ini.play")) returned 1 [0132.189] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 350 os_tid = 0xd20 [0132.192] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.193] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.193] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xf70f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0132.193] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xf70f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xf70f828, pbKeyObject=0x0) returned 0x0 [0132.193] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xf70f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xf70f500) returned 0x0 [0132.193] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.193] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xf70f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xf70f500) returned 0x0 [0132.199] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.202] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.202] WriteFile (in: hFile=0x6c8, lpBuffer=0xf70fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf70f830, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesWritten=0xf70f830*=0x428, lpOverlapped=0x0) returned 1 [0132.207] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.207] ReadFile (in: hFile=0x6c8, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x1c4, lpNumberOfBytesRead=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xf70f61c*=0x1c4, lpOverlapped=0x0) returned 1 [0132.207] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffffe3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.207] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x2c50000, cbInput=0x1c4, pPaddingInfo=0x0, pbIV=0xf70f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xf70f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0xf70f848, pbOutput=0x2c50000, pcbResult=0xf70f618) returned 0x0 [0132.207] WriteFile (in: hFile=0x6c8, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xf70f61c*=0x1d0, lpOverlapped=0x0) returned 1 [0132.207] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf70f60c | out: lpNewFilePointer=0x0) returned 1 [0132.207] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.207] WriteFile (in: hFile=0x6c8, lpBuffer=0xf70f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0xf70f83c*, lpNumberOfBytesWritten=0xf70f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.207] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x1d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.208] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0132.208] CloseHandle (hObject=0x6c8) returned 1 [0132.208] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.PLAY" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.play")) returned 1 [0132.211] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 351 os_tid = 0xd24 [0132.214] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.215] ReadFile (in: hFile=0x6dc, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.230] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.230] ReadFile (in: hFile=0x6dc, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.230] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf350000 [0132.248] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf350000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf350000) returned 0x0 [0132.248] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xf84f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0132.248] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xf84f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf350000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xf84f828, pbKeyObject=0x0) returned 0x0 [0132.248] BCryptExportKey (in: hKey=0x76b0f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf350000, cbOutput=0x230, pcbResult=0xf84f500, dwFlags=0x0 | out: pbOutput=0xf350000, pcbResult=0xf84f500) returned 0x0 [0132.249] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf350230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf350230) returned 0x0 [0132.249] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf350000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf350000, cbOutput=0x400, pcbResult=0xf84f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf350000, pcbResult=0xf84f500) returned 0x0 [0132.256] VirtualFree (lpAddress=0xf350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.258] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.258] WriteFile (in: hFile=0x6dc, lpBuffer=0xf84fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf84f830, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesWritten=0xf84f830*=0x428, lpOverlapped=0x0) returned 1 [0132.258] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.258] ReadFile (in: hFile=0x6dc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x2ab8, lpNumberOfBytesRead=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xf84f61c*=0x2ab8, lpOverlapped=0x0) returned 1 [0132.279] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xffffd548, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.279] BCryptEncrypt (in: hKey=0x76b0f0, pbInput=0x2d50000, cbInput=0x2ab8, pPaddingInfo=0x0, pbIV=0xf84f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xf84f618, dwFlags=0x1 | out: hKey=0x76b0f0, pbIV=0xf84f848, pbOutput=0x2d50000, pcbResult=0xf84f618) returned 0x0 [0132.279] WriteFile (in: hFile=0x6dc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xf84f61c*=0x2ac0, lpOverlapped=0x0) returned 1 [0132.280] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf84f60c | out: lpNewFilePointer=0x0) returned 1 [0132.280] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.280] WriteFile (in: hFile=0x6dc, lpBuffer=0xf84f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0xf84f83c*, lpNumberOfBytesWritten=0xf84f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.280] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x2ac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.280] BCryptDestroyKey (in: hKey=0x76b0f0 | out: hKey=0x76b0f0) returned 0x0 [0132.280] CloseHandle (hObject=0x6dc) returned 1 [0132.281] VirtualAlloc (lpAddress=0x0, dwSize=0x8b, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0132.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\bhointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\BHOINTL.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\bhointl.dll.play")) returned 1 [0132.289] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 352 os_tid = 0xd18 [0132.216] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.216] ReadFile (in: hFile=0x8b8, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.227] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.228] ReadFile (in: hFile=0x8b8, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.228] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.236] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0132.236] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0132.236] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10c0f500) returned 0x0 [0132.237] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.237] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10c0f500) returned 0x0 [0132.243] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.246] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.246] WriteFile (in: hFile=0x8b8, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0132.246] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.247] ReadFile (in: hFile=0x8b8, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x2b118, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x10c0f61c*=0x2b118, lpOverlapped=0x0) returned 1 [0132.260] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xfffd4ee8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.260] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x2e50000, cbInput=0x2b118, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0x10c0f848, pbOutput=0x2e50000, pcbResult=0x10c0f618) returned 0x0 [0132.260] WriteFile (in: hFile=0x8b8, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x2b120, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x10c0f61c*=0x2b120, lpOverlapped=0x0) returned 1 [0132.261] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0132.261] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.261] WriteFile (in: hFile=0x8b8, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.261] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x2b120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.262] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0132.262] CloseHandle (hObject=0x8b8) returned 1 [0132.262] VirtualAlloc (lpAddress=0x0, dwSize=0x91, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0132.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mapishellr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\MAPISHELLR.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mapishellr.dll.play")) returned 1 [0132.265] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 353 os_tid = 0xd90 [0132.221] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.224] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x169cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0132.224] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x169cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x169cf828, pbKeyObject=0x0) returned 0x0 [0132.224] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x169cf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x169cf500) returned 0x0 [0132.224] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.224] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x169cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x169cf500) returned 0x0 [0132.323] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.326] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.326] WriteFile (in: hFile=0x8c0, lpBuffer=0x169cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x169cf830, lpOverlapped=0x0 | out: lpBuffer=0x169cfb34*, lpNumberOfBytesWritten=0x169cf830*=0x428, lpOverlapped=0x0) returned 1 [0132.328] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.328] ReadFile (in: hFile=0x8c0, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x169cf61c*=0x54, lpOverlapped=0x0) returned 1 [0132.328] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0xffffffac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.328] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x2f50000, cbInput=0x54, pPaddingInfo=0x0, pbIV=0x169cf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x169cf618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0x169cf848, pbOutput=0x2f50000, pcbResult=0x169cf618) returned 0x0 [0132.328] WriteFile (in: hFile=0x8c0, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x169cf61c*=0x60, lpOverlapped=0x0) returned 1 [0132.328] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x169cf60c | out: lpNewFilePointer=0x0) returned 1 [0132.328] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.328] WriteFile (in: hFile=0x8c0, lpBuffer=0x169cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x169cf61c, lpOverlapped=0x0 | out: lpBuffer=0x169cf83c*, lpNumberOfBytesWritten=0x169cf61c*=0x8, lpOverlapped=0x0) returned 1 [0132.328] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.328] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0132.328] CloseHandle (hObject=0x8c0) returned 1 [0132.328] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File A.txt.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file a.txt.play")) returned 1 [0132.330] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 354 os_tid = 0xe5c [0132.333] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.334] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.334] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1714f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0132.334] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1714f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1714f828, pbKeyObject=0x0) returned 0x0 [0132.334] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1714f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1714f500) returned 0x0 [0132.335] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.335] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1714f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1714f500) returned 0x0 [0132.338] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.340] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.340] WriteFile (in: hFile=0x8c8, lpBuffer=0x1714fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1714f830, lpOverlapped=0x0 | out: lpBuffer=0x1714fb34*, lpNumberOfBytesWritten=0x1714f830*=0x428, lpOverlapped=0x0) returned 1 [0132.463] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.463] ReadFile (in: hFile=0x8c8, lpBuffer=0x3050000, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1714f61c*=0x54, lpOverlapped=0x0) returned 1 [0132.463] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0xffffffac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.463] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x3050000, cbInput=0x54, pPaddingInfo=0x0, pbIV=0x1714f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1714f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0x1714f848, pbOutput=0x3050000, pcbResult=0x1714f618) returned 0x0 [0132.463] WriteFile (in: hFile=0x8c8, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1714f61c*=0x60, lpOverlapped=0x0) returned 1 [0132.463] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1714f60c | out: lpNewFilePointer=0x0) returned 1 [0132.464] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.464] WriteFile (in: hFile=0x8c8, lpBuffer=0x1714f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1714f61c, lpOverlapped=0x0 | out: lpBuffer=0x1714f83c*, lpNumberOfBytesWritten=0x1714f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.464] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.464] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0132.464] CloseHandle (hObject=0x8c8) returned 1 [0132.464] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\Mso Example Intl Setup File B.txt.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\mso example intl setup file b.txt.play")) returned 1 [0132.466] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 355 os_tid = 0x1004 [0132.341] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.341] ReadFile (in: hFile=0x8d0, lpBuffer=0x17fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17fff85c, lpOverlapped=0x0 | out: lpBuffer=0x17fffb34*, lpNumberOfBytesRead=0x17fff85c*=0x428, lpOverlapped=0x0) returned 1 [0132.451] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.451] ReadFile (in: hFile=0x8d0, lpBuffer=0x17fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x17fff85c, lpOverlapped=0x0 | out: lpBuffer=0x17fffb34*, lpNumberOfBytesRead=0x17fff85c*=0x428, lpOverlapped=0x0) returned 1 [0132.451] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.452] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.452] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x17fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0132.453] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x17fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x17fff828, pbKeyObject=0x0) returned 0x0 [0132.453] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x17fff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x17fff500) returned 0x0 [0132.453] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.453] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x17fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x17fff500) returned 0x0 [0132.456] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.458] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.458] WriteFile (in: hFile=0x8d0, lpBuffer=0x17fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x17fff830, lpOverlapped=0x0 | out: lpBuffer=0x17fffb34*, lpNumberOfBytesWritten=0x17fff830*=0x428, lpOverlapped=0x0) returned 1 [0132.458] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.458] ReadFile (in: hFile=0x8d0, lpBuffer=0x3150000, nNumberOfBytesToRead=0xd3e, lpNumberOfBytesRead=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x17fff61c*=0xd3e, lpOverlapped=0x0) returned 1 [0132.458] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffff2c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.458] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3150000, cbInput=0xd3e, pPaddingInfo=0x0, pbIV=0x17fff848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x17fff618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x17fff848, pbOutput=0x3150000, pcbResult=0x17fff618) returned 0x0 [0132.458] WriteFile (in: hFile=0x8d0, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x17fff61c*=0xd40, lpOverlapped=0x0) returned 1 [0132.458] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17fff60c | out: lpNewFilePointer=0x0) returned 1 [0132.459] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.459] WriteFile (in: hFile=0x8d0, lpBuffer=0x17fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17fff61c, lpOverlapped=0x0 | out: lpBuffer=0x17fff83c*, lpNumberOfBytesWritten=0x17fff61c*=0x8, lpOverlapped=0x0) returned 1 [0132.459] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xd40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.459] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0132.459] CloseHandle (hObject=0x8d0) returned 1 [0132.459] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.460] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentfallback.xml.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentfallback.xml.play")) returned 1 [0132.461] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 356 os_tid = 0x5b4 [0132.343] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.343] ReadFile (in: hFile=0x8d8, lpBuffer=0x1fabfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1fabf85c, lpOverlapped=0x0 | out: lpBuffer=0x1fabfb34*, lpNumberOfBytesRead=0x1fabf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.439] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.439] ReadFile (in: hFile=0x8d8, lpBuffer=0x1fabfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1fabf85c, lpOverlapped=0x0 | out: lpBuffer=0x1fabfb34*, lpNumberOfBytesRead=0x1fabf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.439] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.440] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.441] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x1fabf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0132.441] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x1fabf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x1fabf828, pbKeyObject=0x0) returned 0x0 [0132.441] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1fabf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1fabf500) returned 0x0 [0132.441] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.441] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1fabf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1fabf500) returned 0x0 [0132.444] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.446] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.446] WriteFile (in: hFile=0x8d8, lpBuffer=0x1fabfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1fabf830, lpOverlapped=0x0 | out: lpBuffer=0x1fabfb34*, lpNumberOfBytesWritten=0x1fabf830*=0x428, lpOverlapped=0x0) returned 1 [0132.446] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.446] ReadFile (in: hFile=0x8d8, lpBuffer=0x3250000, nNumberOfBytesToRead=0xcf6, lpNumberOfBytesRead=0x1fabf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x1fabf61c*=0xcf6, lpOverlapped=0x0) returned 1 [0132.446] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xfffff30a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.446] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3250000, cbInput=0xcf6, pPaddingInfo=0x0, pbIV=0x1fabf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x1fabf618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x1fabf848, pbOutput=0x3250000, pcbResult=0x1fabf618) returned 0x0 [0132.446] WriteFile (in: hFile=0x8d8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x1fabf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x1fabf61c*=0xd00, lpOverlapped=0x0) returned 1 [0132.446] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fabf60c | out: lpNewFilePointer=0x0) returned 1 [0132.447] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.447] WriteFile (in: hFile=0x8d8, lpBuffer=0x1fabf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1fabf61c, lpOverlapped=0x0 | out: lpBuffer=0x1fabf83c*, lpNumberOfBytesWritten=0x1fabf61c*=0x8, lpOverlapped=0x0) returned 1 [0132.447] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xd00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.447] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0132.447] CloseHandle (hObject=0x8d8) returned 1 [0132.447] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\1033\\officeinventoryagentlogon.xml.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\officeinventoryagentlogon.xml.play")) returned 1 [0132.449] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 357 os_tid = 0x1074 [0132.344] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.344] ReadFile (in: hFile=0x358, lpBuffer=0x1fbffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1fbff85c, lpOverlapped=0x0 | out: lpBuffer=0x1fbffb34*, lpNumberOfBytesRead=0x1fbff85c*=0x428, lpOverlapped=0x0) returned 1 [0132.427] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.428] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x1fbff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0132.428] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x1fbff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x1fbff828, pbKeyObject=0x0) returned 0x0 [0132.428] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1fbff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1fbff500) returned 0x0 [0132.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.429] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1fbff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1fbff500) returned 0x0 [0132.432] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.433] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.434] WriteFile (in: hFile=0x358, lpBuffer=0x1fbffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1fbff830, lpOverlapped=0x0 | out: lpBuffer=0x1fbffb34*, lpNumberOfBytesWritten=0x1fbff830*=0x428, lpOverlapped=0x0) returned 1 [0132.434] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.434] ReadFile (in: hFile=0x358, lpBuffer=0x3350000, nNumberOfBytesToRead=0x53f, lpNumberOfBytesRead=0x1fbff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x1fbff61c*=0x53f, lpOverlapped=0x0) returned 1 [0132.434] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffac1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.434] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3350000, cbInput=0x53f, pPaddingInfo=0x0, pbIV=0x1fbff848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x1fbff618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x1fbff848, pbOutput=0x3350000, pcbResult=0x1fbff618) returned 0x0 [0132.434] WriteFile (in: hFile=0x358, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x1fbff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1fbff61c*=0x540, lpOverlapped=0x0) returned 1 [0132.434] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fbff60c | out: lpNewFilePointer=0x0) returned 1 [0132.434] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.434] WriteFile (in: hFile=0x358, lpBuffer=0x1fbff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1fbff61c, lpOverlapped=0x0 | out: lpBuffer=0x1fbff83c*, lpNumberOfBytesWritten=0x1fbff61c*=0x8, lpOverlapped=0x0) returned 1 [0132.434] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.434] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0132.434] CloseHandle (hObject=0x358) returned 1 [0132.435] VirtualAlloc (lpAddress=0x0, dwSize=0x89, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office16\\custom.propdesc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Custom.propdesc.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\custom.propdesc.play")) returned 1 [0132.436] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 358 os_tid = 0x1034 [0132.347] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.348] ReadFile (in: hFile=0x8e4, lpBuffer=0x1fd3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1fd3f85c, lpOverlapped=0x0 | out: lpBuffer=0x1fd3fb34*, lpNumberOfBytesRead=0x1fd3f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.415] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.415] ReadFile (in: hFile=0x8e4, lpBuffer=0x1fd3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1fd3f85c, lpOverlapped=0x0 | out: lpBuffer=0x1fd3fb34*, lpNumberOfBytesRead=0x1fd3f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.415] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.417] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.417] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x1fd3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0132.417] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x1fd3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x1fd3f828, pbKeyObject=0x0) returned 0x0 [0132.417] BCryptExportKey (in: hKey=0x76b0f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1fd3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1fd3f500) returned 0x0 [0132.417] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.417] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1fd3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1fd3f500) returned 0x0 [0132.422] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.424] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.424] WriteFile (in: hFile=0x8e4, lpBuffer=0x1fd3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1fd3f830, lpOverlapped=0x0 | out: lpBuffer=0x1fd3fb34*, lpNumberOfBytesWritten=0x1fd3f830*=0x428, lpOverlapped=0x0) returned 1 [0132.424] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.424] ReadFile (in: hFile=0x8e4, lpBuffer=0x3450000, nNumberOfBytesToRead=0x478a8, lpNumberOfBytesRead=0x1fd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x1fd3f61c*=0x478a8, lpOverlapped=0x0) returned 1 [0132.550] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xfffb8758, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.550] BCryptEncrypt (in: hKey=0x76b0f0, pbInput=0x3450000, cbInput=0x478a8, pPaddingInfo=0x0, pbIV=0x1fd3f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x1fd3f618, dwFlags=0x1 | out: hKey=0x76b0f0, pbIV=0x1fd3f848, pbOutput=0x3450000, pcbResult=0x1fd3f618) returned 0x0 [0132.550] WriteFile (in: hFile=0x8e4, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x478b0, lpNumberOfBytesWritten=0x1fd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x1fd3f61c*=0x478b0, lpOverlapped=0x0) returned 1 [0132.551] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fd3f60c | out: lpNewFilePointer=0x0) returned 1 [0132.551] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.551] WriteFile (in: hFile=0x8e4, lpBuffer=0x1fd3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1fd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x1fd3f83c*, lpNumberOfBytesWritten=0x1fd3f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.551] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x478b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.551] BCryptDestroyKey (in: hKey=0x76b0f0 | out: hKey=0x76b0f0) returned 0x0 [0132.551] CloseHandle (hObject=0x8e4) returned 1 [0132.552] VirtualAlloc (lpAddress=0x0, dwSize=0x81, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\ieawsdc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\IEAWSDC.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\ieawsdc.dll.play")) returned 1 [0132.554] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 359 os_tid = 0x1038 [0132.350] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.350] ReadFile (in: hFile=0x8ec, lpBuffer=0x1fe7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1fe7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1fe7fb34*, lpNumberOfBytesRead=0x1fe7f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.406] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.407] ReadFile (in: hFile=0x8ec, lpBuffer=0x1fe7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1fe7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1fe7fb34*, lpNumberOfBytesRead=0x1fe7f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.407] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.408] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.408] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1fe7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0132.408] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1fe7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1fe7f828, pbKeyObject=0x0) returned 0x0 [0132.408] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1fe7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1fe7f500) returned 0x0 [0132.409] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.409] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1fe7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1fe7f500) returned 0x0 [0132.413] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.414] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.414] WriteFile (in: hFile=0x8ec, lpBuffer=0x1fe7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1fe7f830, lpOverlapped=0x0 | out: lpBuffer=0x1fe7fb34*, lpNumberOfBytesWritten=0x1fe7f830*=0x428, lpOverlapped=0x0) returned 1 [0132.415] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.415] ReadFile (in: hFile=0x8ec, lpBuffer=0x3750000, nNumberOfBytesToRead=0x11f18, lpNumberOfBytesRead=0x1fe7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1fe7f61c*=0x11f18, lpOverlapped=0x0) returned 1 [0132.543] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffee0e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.543] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3750000, cbInput=0x11f18, pPaddingInfo=0x0, pbIV=0x1fe7f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1fe7f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0x1fe7f848, pbOutput=0x3750000, pcbResult=0x1fe7f618) returned 0x0 [0132.543] WriteFile (in: hFile=0x8ec, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x11f20, lpNumberOfBytesWritten=0x1fe7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1fe7f61c*=0x11f20, lpOverlapped=0x0) returned 1 [0132.544] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe7f60c | out: lpNewFilePointer=0x0) returned 1 [0132.544] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.544] WriteFile (in: hFile=0x8ec, lpBuffer=0x1fe7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1fe7f61c, lpOverlapped=0x0 | out: lpBuffer=0x1fe7f83c*, lpNumberOfBytesWritten=0x1fe7f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.544] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x11f20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.544] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0132.544] CloseHandle (hObject=0x8ec) returned 1 [0132.544] VirtualAlloc (lpAddress=0x0, dwSize=0x85, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\mapishell.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MAPISHELL.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\mapishell.dll.play")) returned 1 [0132.546] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 360 os_tid = 0x1020 [0132.578] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.580] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.580] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0132.580] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0132.580] BCryptExportKey (in: hKey=0x785cd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xf48f500) returned 0x0 [0132.581] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.581] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xf48f500) returned 0x0 [0132.584] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.586] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.586] WriteFile (in: hFile=0x8b8, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0132.959] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.959] ReadFile (in: hFile=0x8b8, lpBuffer=0x3950000, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0xf48f61c*=0x4e, lpOverlapped=0x0) returned 1 [0132.959] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xffffffb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.959] BCryptEncrypt (in: hKey=0x785cd0, pbInput=0x3950000, cbInput=0x4e, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x785cd0, pbIV=0xf48f848, pbOutput=0x3950000, pcbResult=0xf48f618) returned 0x0 [0132.959] WriteFile (in: hFile=0x8b8, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0xf48f61c*=0x50, lpOverlapped=0x0) returned 1 [0132.959] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0132.959] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.959] WriteFile (in: hFile=0x8b8, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.960] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.960] BCryptDestroyKey (in: hKey=0x785cd0 | out: hKey=0x785cd0) returned 0x0 [0132.960] CloseHandle (hObject=0x8b8) returned 1 [0133.211] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0xdf90000 [0133.213] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\Mso Example Setup File A.txt.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\mso example setup file a.txt.play")) returned 1 [0133.316] VirtualFree (lpAddress=0xdf90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 361 os_tid = 0x1024 [0132.587] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.588] ReadFile (in: hFile=0x2e8, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.795] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.795] ReadFile (in: hFile=0x2e8, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.866] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.867] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.867] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xf70f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0132.867] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xf70f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xf70f828, pbKeyObject=0x0) returned 0x0 [0132.867] BCryptExportKey (in: hKey=0x7ce0e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xf70f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xf70f500) returned 0x0 [0132.867] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.867] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xf70f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xf70f500) returned 0x0 [0132.871] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.873] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.873] WriteFile (in: hFile=0x2e8, lpBuffer=0xf70fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf70f830, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesWritten=0xf70f830*=0x428, lpOverlapped=0x0) returned 1 [0132.948] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.948] ReadFile (in: hFile=0x2e8, lpBuffer=0x2850000, nNumberOfBytesToRead=0x196c0, lpNumberOfBytesRead=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xf70f61c*=0x196c0, lpOverlapped=0x0) returned 1 [0132.967] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffe6940, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.967] BCryptEncrypt (in: hKey=0x7ce0e0, pbInput=0x2850000, cbInput=0x196c0, pPaddingInfo=0x0, pbIV=0xf70f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xf70f618, dwFlags=0x1 | out: hKey=0x7ce0e0, pbIV=0xf70f848, pbOutput=0x2850000, pcbResult=0xf70f618) returned 0x0 [0132.967] WriteFile (in: hFile=0x2e8, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x196d0, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xf70f61c*=0x196d0, lpOverlapped=0x0) returned 1 [0132.968] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf70f60c | out: lpNewFilePointer=0x0) returned 1 [0132.968] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.968] WriteFile (in: hFile=0x2e8, lpBuffer=0xf70f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0xf70f83c*, lpNumberOfBytesWritten=0xf70f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.968] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x196d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.968] BCryptDestroyKey (in: hKey=0x7ce0e0 | out: hKey=0x7ce0e0) returned 0x0 [0132.968] CloseHandle (hObject=0x2e8) returned 1 [0133.213] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x1000, flProtect=0x4) returned 0xdfa0000 [0133.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\msohev.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEV.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\msohev.dll.play")) returned 1 [0133.313] VirtualFree (lpAddress=0xdfa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 362 os_tid = 0x5a8 [0132.589] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.589] ReadFile (in: hFile=0x8f8, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.788] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.788] ReadFile (in: hFile=0x8f8, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.788] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.789] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.789] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0132.789] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0132.789] BCryptExportKey (in: hKey=0x78d5a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1048f500) returned 0x0 [0132.789] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.790] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1048f500) returned 0x0 [0132.793] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.795] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.795] WriteFile (in: hFile=0x8f8, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0132.807] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.807] ReadFile (in: hFile=0x8f8, lpBuffer=0x2950000, nNumberOfBytesToRead=0x142c0, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1048f61c*=0x142c0, lpOverlapped=0x0) returned 1 [0132.874] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0xfffebd40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.874] BCryptEncrypt (in: hKey=0x78d5a0, pbInput=0x2950000, cbInput=0x142c0, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x78d5a0, pbIV=0x1048f848, pbOutput=0x2950000, pcbResult=0x1048f618) returned 0x0 [0132.874] WriteFile (in: hFile=0x8f8, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x142d0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1048f61c*=0x142d0, lpOverlapped=0x0) returned 1 [0132.946] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0132.947] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.947] WriteFile (in: hFile=0x8f8, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.947] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x142d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.947] BCryptDestroyKey (in: hKey=0x78d5a0 | out: hKey=0x78d5a0) returned 0x0 [0132.947] CloseHandle (hObject=0x8f8) returned 1 [0133.203] VirtualAlloc (lpAddress=0x0, dwSize=0x81, flAllocationType=0x1000, flProtect=0x4) returned 0xdf60000 [0133.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\msohevi.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHEVI.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\msohevi.dll.play")) returned 1 [0133.327] VirtualFree (lpAddress=0xdf60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 363 os_tid = 0x5d0 [0132.590] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.590] ReadFile (in: hFile=0x6dc, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.779] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.779] ReadFile (in: hFile=0x6dc, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.780] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.781] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.781] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xf84f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0132.781] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xf84f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xf84f828, pbKeyObject=0x0) returned 0x0 [0132.781] BCryptExportKey (in: hKey=0x78d320, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xf84f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xf84f500) returned 0x0 [0132.782] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.782] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xf84f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xf84f500) returned 0x0 [0132.786] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.787] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.787] WriteFile (in: hFile=0x6dc, lpBuffer=0xf84fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf84f830, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesWritten=0xf84f830*=0x428, lpOverlapped=0x0) returned 1 [0132.808] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.808] ReadFile (in: hFile=0x6dc, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x168c0, lpNumberOfBytesRead=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xf84f61c*=0x168c0, lpOverlapped=0x0) returned 1 [0132.873] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffe9740, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.873] BCryptEncrypt (in: hKey=0x78d320, pbInput=0x2b50000, cbInput=0x168c0, pPaddingInfo=0x0, pbIV=0xf84f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xf84f618, dwFlags=0x1 | out: hKey=0x78d320, pbIV=0xf84f848, pbOutput=0x2b50000, pcbResult=0xf84f618) returned 0x0 [0132.873] WriteFile (in: hFile=0x6dc, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x168d0, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xf84f61c*=0x168d0, lpOverlapped=0x0) returned 1 [0132.947] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf84f60c | out: lpNewFilePointer=0x0) returned 1 [0132.947] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.947] WriteFile (in: hFile=0x6dc, lpBuffer=0xf84f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0xf84f83c*, lpNumberOfBytesWritten=0xf84f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.947] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x168d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.947] BCryptDestroyKey (in: hKey=0x78d320 | out: hKey=0x78d320) returned 0x0 [0132.947] CloseHandle (hObject=0x6dc) returned 1 [0133.205] VirtualAlloc (lpAddress=0x0, dwSize=0x83, flAllocationType=0x1000, flProtect=0x4) returned 0xdf70000 [0133.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\msohtmed.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\MSOHTMED.EXE.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\msohtmed.exe.play")) returned 1 [0133.324] VirtualFree (lpAddress=0xdf70000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 364 os_tid = 0x5c8 [0132.591] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.591] ReadFile (in: hFile=0x904, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.593] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.593] ReadFile (in: hFile=0x904, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.593] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0132.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0132.594] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0132.594] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0132.594] BCryptExportKey (in: hKey=0x78f0c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1070f500) returned 0x0 [0132.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0132.595] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1070f500) returned 0x0 [0132.598] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.600] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.600] WriteFile (in: hFile=0x904, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0132.600] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.600] ReadFile (in: hFile=0x904, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x4c0c0, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1070f61c*=0x4c0c0, lpOverlapped=0x0) returned 1 [0132.602] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xfffb3f40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.602] BCryptEncrypt (in: hKey=0x78f0c0, pbInput=0x2c50000, cbInput=0x4c0c0, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x78f0c0, pbIV=0x1070f848, pbOutput=0x2c50000, pcbResult=0x1070f618) returned 0x0 [0132.603] WriteFile (in: hFile=0x904, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x4c0d0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1070f61c*=0x4c0d0, lpOverlapped=0x0) returned 1 [0132.604] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0132.604] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.604] WriteFile (in: hFile=0x904, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.604] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x4c0d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.604] BCryptDestroyKey (in: hKey=0x78f0c0 | out: hKey=0x78f0c0) returned 0x0 [0132.604] CloseHandle (hObject=0x904) returned 1 [0132.604] VirtualAlloc (lpAddress=0x0, dwSize=0x81, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0132.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\nameext.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\NAMEEXT.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\nameext.dll.play")) returned 1 [0133.260] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 365 os_tid = 0xe64 [0132.608] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.608] ReadFile (in: hFile=0x90c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.829] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.829] ReadFile (in: hFile=0x90c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.888] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.890] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.890] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0132.890] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0132.890] BCryptExportKey (in: hKey=0x7ce840, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x10c0f500) returned 0x0 [0132.890] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.890] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x10c0f500) returned 0x0 [0132.894] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.896] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.896] WriteFile (in: hFile=0x90c, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0132.909] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.909] ReadFile (in: hFile=0x90c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x406c8, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x10c0f61c*=0x406c8, lpOverlapped=0x0) returned 1 [0132.942] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0xfffbf938, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.942] BCryptEncrypt (in: hKey=0x7ce840, pbInput=0x2d50000, cbInput=0x406c8, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x7ce840, pbIV=0x10c0f848, pbOutput=0x2d50000, pcbResult=0x10c0f618) returned 0x0 [0132.942] WriteFile (in: hFile=0x90c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x406d0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x10c0f61c*=0x406d0, lpOverlapped=0x0) returned 1 [0132.943] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0132.943] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.943] WriteFile (in: hFile=0x90c, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.943] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x406d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.943] BCryptDestroyKey (in: hKey=0x7ce840 | out: hKey=0x7ce840) returned 0x0 [0132.943] CloseHandle (hObject=0x90c) returned 1 [0133.200] VirtualAlloc (lpAddress=0x0, dwSize=0x83, flAllocationType=0x1000, flProtect=0x4) returned 0xdf50000 [0133.202] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\olkfstub.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OLKFSTUB.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\olkfstub.dll.play")) returned 1 [0133.330] VirtualFree (lpAddress=0xdf50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 366 os_tid = 0x590 [0132.609] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.609] ReadFile (in: hFile=0x918, lpBuffer=0x1624fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1624f85c, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesRead=0x1624f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.820] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.821] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.822] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1624f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0132.822] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1624f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1624f828, pbKeyObject=0x0) returned 0x0 [0132.822] BCryptExportKey (in: hKey=0x78da90, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1624f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1624f500) returned 0x0 [0132.822] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.822] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1624f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1624f500) returned 0x0 [0132.826] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.828] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.828] WriteFile (in: hFile=0x918, lpBuffer=0x1624fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1624f830, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesWritten=0x1624f830*=0x428, lpOverlapped=0x0) returned 1 [0132.954] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.954] ReadFile (in: hFile=0x918, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x572, lpNumberOfBytesRead=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1624f61c*=0x572, lpOverlapped=0x0) returned 1 [0132.954] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xfffffa8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.954] BCryptEncrypt (in: hKey=0x78da90, pbInput=0x2e50000, cbInput=0x572, pPaddingInfo=0x0, pbIV=0x1624f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1624f618, dwFlags=0x1 | out: hKey=0x78da90, pbIV=0x1624f848, pbOutput=0x2e50000, pcbResult=0x1624f618) returned 0x0 [0132.954] WriteFile (in: hFile=0x918, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1624f61c*=0x580, lpOverlapped=0x0) returned 1 [0132.955] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1624f60c | out: lpNewFilePointer=0x0) returned 1 [0132.955] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.955] WriteFile (in: hFile=0x918, lpBuffer=0x1624f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x1624f83c*, lpNumberOfBytesWritten=0x1624f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.955] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.955] BCryptDestroyKey (in: hKey=0x78da90 | out: hKey=0x78da90) returned 0x0 [0132.955] CloseHandle (hObject=0x918) returned 1 [0133.218] VirtualAlloc (lpAddress=0x0, dwSize=0x93, flAllocationType=0x1000, flProtect=0x4) returned 0xdfc0000 [0133.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnms006.inf" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnms006.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnms006.inf.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnms006.inf.play")) returned 1 [0133.304] VirtualFree (lpAddress=0xdfc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 367 os_tid = 0xe4c [0132.610] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.610] ReadFile (in: hFile=0x920, lpBuffer=0x1674fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1674f85c, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesRead=0x1674f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.853] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.853] ReadFile (in: hFile=0x920, lpBuffer=0x1674fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1674f85c, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesRead=0x1674f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.853] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.854] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.854] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x1674f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0132.854] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x1674f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x1674f828, pbKeyObject=0x0) returned 0x0 [0132.854] BCryptExportKey (in: hKey=0x7cde60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1674f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1674f500) returned 0x0 [0132.855] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.855] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1674f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1674f500) returned 0x0 [0132.858] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.859] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.860] WriteFile (in: hFile=0x920, lpBuffer=0x1674fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1674f830, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesWritten=0x1674f830*=0x428, lpOverlapped=0x0) returned 1 [0132.899] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.899] ReadFile (in: hFile=0x920, lpBuffer=0x3650000, nNumberOfBytesToRead=0x2e56, lpNumberOfBytesRead=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1674f61c*=0x2e56, lpOverlapped=0x0) returned 1 [0132.916] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0xffffd1aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.916] BCryptEncrypt (in: hKey=0x7cde60, pbInput=0x3650000, cbInput=0x2e56, pPaddingInfo=0x0, pbIV=0x1674f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1674f618, dwFlags=0x1 | out: hKey=0x7cde60, pbIV=0x1674f848, pbOutput=0x3650000, pcbResult=0x1674f618) returned 0x0 [0132.916] WriteFile (in: hFile=0x920, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x2e60, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1674f61c*=0x2e60, lpOverlapped=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1674f60c | out: lpNewFilePointer=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.917] WriteFile (in: hFile=0x920, lpBuffer=0x1674f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x1674f83c*, lpNumberOfBytesWritten=0x1674f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x2e60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.917] BCryptDestroyKey (in: hKey=0x7cde60 | out: hKey=0x7cde60) returned 0x0 [0132.917] CloseHandle (hObject=0x920) returned 1 [0132.920] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0132.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote.cat" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote.cat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote.cat.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote.cat.play")) returned 1 [0133.297] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 368 os_tid = 0x33c [0132.611] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.612] ReadFile (in: hFile=0x928, lpBuffer=0x1ffbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1ffbf85c, lpOverlapped=0x0 | out: lpBuffer=0x1ffbfb34*, lpNumberOfBytesRead=0x1ffbf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.820] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.820] ReadFile (in: hFile=0x928, lpBuffer=0x1ffbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1ffbf85c, lpOverlapped=0x0 | out: lpBuffer=0x1ffbfb34*, lpNumberOfBytesRead=0x1ffbf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.882] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.883] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.883] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1ffbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0132.883] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1ffbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1ffbf828, pbKeyObject=0x0) returned 0x0 [0132.883] BCryptExportKey (in: hKey=0x7ce5d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x1ffbf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x1ffbf500) returned 0x0 [0132.883] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.883] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x1ffbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x1ffbf500) returned 0x0 [0132.886] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.888] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.888] WriteFile (in: hFile=0x928, lpBuffer=0x1ffbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1ffbf830, lpOverlapped=0x0 | out: lpBuffer=0x1ffbfb34*, lpNumberOfBytesWritten=0x1ffbf830*=0x428, lpOverlapped=0x0) returned 1 [0132.897] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.897] ReadFile (in: hFile=0x928, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x265e, lpNumberOfBytesRead=0x1ffbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1ffbf61c*=0x265e, lpOverlapped=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xffffd9a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.917] BCryptEncrypt (in: hKey=0x7ce5d0, pbInput=0x3a50000, cbInput=0x265e, pPaddingInfo=0x0, pbIV=0x1ffbf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1ffbf618, dwFlags=0x1 | out: hKey=0x7ce5d0, pbIV=0x1ffbf848, pbOutput=0x3a50000, pcbResult=0x1ffbf618) returned 0x0 [0132.917] WriteFile (in: hFile=0x928, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x1ffbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1ffbf61c*=0x2660, lpOverlapped=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ffbf60c | out: lpNewFilePointer=0x0) returned 1 [0132.917] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.918] WriteFile (in: hFile=0x928, lpBuffer=0x1ffbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ffbf61c, lpOverlapped=0x0 | out: lpBuffer=0x1ffbf83c*, lpNumberOfBytesWritten=0x1ffbf61c*=0x8, lpOverlapped=0x0) returned 1 [0132.918] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x2660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.918] BCryptDestroyKey (in: hKey=0x7ce5d0 | out: hKey=0x7ce5d0) returned 0x0 [0132.918] CloseHandle (hObject=0x928) returned 1 [0132.926] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0xef90000 [0132.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.cat" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.cat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.cat.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.cat.play")) returned 1 [0133.293] VirtualFree (lpAddress=0xef90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 369 os_tid = 0x58c [0132.613] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.613] ReadFile (in: hFile=0x930, lpBuffer=0x200ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x200ff85c, lpOverlapped=0x0 | out: lpBuffer=0x200ffb34*, lpNumberOfBytesRead=0x200ff85c*=0x428, lpOverlapped=0x0) returned 1 [0132.799] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.801] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x200ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0132.801] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x200ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x200ff828, pbKeyObject=0x0) returned 0x0 [0132.801] BCryptExportKey (in: hKey=0x78d810, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x200ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x200ff500) returned 0x0 [0132.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.801] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x200ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x200ff500) returned 0x0 [0132.804] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.806] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.806] WriteFile (in: hFile=0x930, lpBuffer=0x200ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x200ff830, lpOverlapped=0x0 | out: lpBuffer=0x200ffb34*, lpNumberOfBytesWritten=0x200ff830*=0x428, lpOverlapped=0x0) returned 1 [0132.865] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.865] ReadFile (in: hFile=0x930, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x6fe, lpNumberOfBytesRead=0x200ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x200ff61c*=0x6fe, lpOverlapped=0x0) returned 1 [0132.865] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0xfffff902, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.865] BCryptEncrypt (in: hKey=0x78d810, pbInput=0x3b50000, cbInput=0x6fe, pPaddingInfo=0x0, pbIV=0x200ff848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x200ff618, dwFlags=0x1 | out: hKey=0x78d810, pbIV=0x200ff848, pbOutput=0x3b50000, pcbResult=0x200ff618) returned 0x0 [0132.865] WriteFile (in: hFile=0x930, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x200ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x200ff61c*=0x700, lpOverlapped=0x0) returned 1 [0132.948] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x200ff60c | out: lpNewFilePointer=0x0) returned 1 [0132.948] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.948] WriteFile (in: hFile=0x930, lpBuffer=0x200ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x200ff61c, lpOverlapped=0x0 | out: lpBuffer=0x200ff83c*, lpNumberOfBytesWritten=0x200ff61c*=0x8, lpOverlapped=0x0) returned 1 [0132.948] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.948] BCryptDestroyKey (in: hKey=0x78d810 | out: hKey=0x78d810) returned 0x0 [0132.948] CloseHandle (hObject=0x930) returned 1 [0133.215] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0xdfb0000 [0133.218] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.inf" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\prnSendToOneNote_win7.inf.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\prnsendtoonenote_win7.inf.play")) returned 1 [0133.307] VirtualFree (lpAddress=0xdfb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 370 os_tid = 0xe44 [0132.614] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.615] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.615] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2023f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0132.615] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2023f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2023f828, pbKeyObject=0x0) returned 0x0 [0132.615] BCryptExportKey (in: hKey=0x76b0f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2023f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2023f500) returned 0x0 [0132.616] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.616] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2023f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2023f500) returned 0x0 [0132.619] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.621] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.621] WriteFile (in: hFile=0x938, lpBuffer=0x2023fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2023f830, lpOverlapped=0x0 | out: lpBuffer=0x2023fb34*, lpNumberOfBytesWritten=0x2023f830*=0x428, lpOverlapped=0x0) returned 1 [0132.957] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.957] ReadFile (in: hFile=0x938, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x2023f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2023f61c*=0x168, lpOverlapped=0x0) returned 1 [0132.957] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffffe98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.957] BCryptEncrypt (in: hKey=0x76b0f0, pbInput=0x3c50000, cbInput=0x168, pPaddingInfo=0x0, pbIV=0x2023f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2023f618, dwFlags=0x1 | out: hKey=0x76b0f0, pbIV=0x2023f848, pbOutput=0x3c50000, pcbResult=0x2023f618) returned 0x0 [0132.957] WriteFile (in: hFile=0x938, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2023f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2023f61c*=0x170, lpOverlapped=0x0) returned 1 [0132.958] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2023f60c | out: lpNewFilePointer=0x0) returned 1 [0132.958] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.958] WriteFile (in: hFile=0x938, lpBuffer=0x2023f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2023f61c, lpOverlapped=0x0 | out: lpBuffer=0x2023f83c*, lpNumberOfBytesWritten=0x2023f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.958] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.958] BCryptDestroyKey (in: hKey=0x76b0f0 | out: hKey=0x76b0f0) returned 0x0 [0132.958] CloseHandle (hObject=0x938) returned 1 [0133.221] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0xdfd0000 [0133.222] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-manifest.ini.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-manifest.ini.play")) returned 1 [0133.300] VirtualFree (lpAddress=0xdfd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 371 os_tid = 0x134c [0132.623] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.624] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.624] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2037f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0132.624] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2037f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2037f828, pbKeyObject=0x0) returned 0x0 [0132.624] BCryptExportKey (in: hKey=0x78a760, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2037f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2037f500) returned 0x0 [0132.624] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.625] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2037f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2037f500) returned 0x0 [0132.628] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.630] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.630] WriteFile (in: hFile=0x940, lpBuffer=0x2037fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2037f830, lpOverlapped=0x0 | out: lpBuffer=0x2037fb34*, lpNumberOfBytesWritten=0x2037f830*=0x428, lpOverlapped=0x0) returned 1 [0132.958] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.958] ReadFile (in: hFile=0x940, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x2037f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2037f61c*=0x1fa, lpOverlapped=0x0) returned 1 [0132.958] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffe06, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.958] BCryptEncrypt (in: hKey=0x78a760, pbInput=0x3d50000, cbInput=0x1fa, pPaddingInfo=0x0, pbIV=0x2037f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2037f618, dwFlags=0x1 | out: hKey=0x78a760, pbIV=0x2037f848, pbOutput=0x3d50000, pcbResult=0x2037f618) returned 0x0 [0132.958] WriteFile (in: hFile=0x940, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2037f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2037f61c*=0x200, lpOverlapped=0x0) returned 1 [0132.958] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2037f60c | out: lpNewFilePointer=0x0) returned 1 [0132.958] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.959] WriteFile (in: hFile=0x940, lpBuffer=0x2037f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2037f61c, lpOverlapped=0x0 | out: lpBuffer=0x2037f83c*, lpNumberOfBytesWritten=0x2037f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.959] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.959] BCryptDestroyKey (in: hKey=0x78a760 | out: hKey=0x78a760) returned 0x0 [0132.959] CloseHandle (hObject=0x940) returned 1 [0133.223] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0xdfe0000 [0133.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote-pipelineconfig.xml.play")) returned 1 [0133.250] VirtualFree (lpAddress=0xdfe0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 372 os_tid = 0x10e4 [0132.632] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.632] ReadFile (in: hFile=0x948, lpBuffer=0x204bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x204bf85c, lpOverlapped=0x0 | out: lpBuffer=0x204bfb34*, lpNumberOfBytesRead=0x204bf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.852] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.852] ReadFile (in: hFile=0x948, lpBuffer=0x204bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x204bf85c, lpOverlapped=0x0 | out: lpBuffer=0x204bfb34*, lpNumberOfBytesRead=0x204bf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.899] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.901] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.901] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x204bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0132.901] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x204bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x204bf828, pbKeyObject=0x0) returned 0x0 [0132.901] BCryptExportKey (in: hKey=0x7cfac0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x204bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x204bf500) returned 0x0 [0132.901] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.901] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x204bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x204bf500) returned 0x0 [0132.906] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.907] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.907] WriteFile (in: hFile=0x948, lpBuffer=0x204bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x204bf830, lpOverlapped=0x0 | out: lpBuffer=0x204bfb34*, lpNumberOfBytesWritten=0x204bf830*=0x428, lpOverlapped=0x0) returned 1 [0132.910] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.910] ReadFile (in: hFile=0x948, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x2560, lpNumberOfBytesRead=0x204bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x204bf61c*=0x2560, lpOverlapped=0x0) returned 1 [0132.929] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xffffdaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.929] BCryptEncrypt (in: hKey=0x7cfac0, pbInput=0x3e50000, cbInput=0x2560, pPaddingInfo=0x0, pbIV=0x204bf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x204bf618, dwFlags=0x1 | out: hKey=0x7cfac0, pbIV=0x204bf848, pbOutput=0x3e50000, pcbResult=0x204bf618) returned 0x0 [0132.929] WriteFile (in: hFile=0x948, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x204bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x204bf61c*=0x2570, lpOverlapped=0x0) returned 1 [0132.929] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x204bf60c | out: lpNewFilePointer=0x0) returned 1 [0132.929] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.929] WriteFile (in: hFile=0x948, lpBuffer=0x204bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x204bf61c, lpOverlapped=0x0 | out: lpBuffer=0x204bf83c*, lpNumberOfBytesWritten=0x204bf61c*=0x8, lpOverlapped=0x0) returned 1 [0132.929] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x2570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.929] BCryptDestroyKey (in: hKey=0x7cfac0 | out: hKey=0x7cfac0) returned 0x0 [0132.929] CloseHandle (hObject=0x948) returned 1 [0132.933] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0xefa0000 [0132.934] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.gpd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.gpd.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.gpd.play")) returned 1 [0133.256] VirtualFree (lpAddress=0xefa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 373 os_tid = 0x115c [0132.633] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.634] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.634] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x205ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0132.634] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x205ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x205ff828, pbKeyObject=0x0) returned 0x0 [0132.634] BCryptExportKey (in: hKey=0x78a9d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x205ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x205ff500) returned 0x0 [0132.635] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.635] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x205ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x205ff500) returned 0x0 [0132.638] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.640] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.640] WriteFile (in: hFile=0x950, lpBuffer=0x205ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x205ff830, lpOverlapped=0x0 | out: lpBuffer=0x205ffb34*, lpNumberOfBytesWritten=0x205ff830*=0x428, lpOverlapped=0x0) returned 1 [0132.960] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.960] ReadFile (in: hFile=0x950, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x205ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x205ff61c*=0x57, lpOverlapped=0x0) returned 1 [0132.960] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0xffffffa9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.960] BCryptEncrypt (in: hKey=0x78a9d0, pbInput=0x3f50000, cbInput=0x57, pPaddingInfo=0x0, pbIV=0x205ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x205ff618, dwFlags=0x1 | out: hKey=0x78a9d0, pbIV=0x205ff848, pbOutput=0x3f50000, pcbResult=0x205ff618) returned 0x0 [0132.960] WriteFile (in: hFile=0x950, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x205ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x205ff61c*=0x60, lpOverlapped=0x0) returned 1 [0132.960] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x205ff60c | out: lpNewFilePointer=0x0) returned 1 [0132.960] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.960] WriteFile (in: hFile=0x950, lpBuffer=0x205ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x205ff61c, lpOverlapped=0x0 | out: lpBuffer=0x205ff83c*, lpNumberOfBytesWritten=0x205ff61c*=0x8, lpOverlapped=0x0) returned 1 [0132.960] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.960] BCryptDestroyKey (in: hKey=0x78a9d0 | out: hKey=0x78a9d0) returned 0x0 [0132.960] CloseHandle (hObject=0x950) returned 1 [0133.337] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0133.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNote.ini.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenote.ini.play")) returned 1 [0133.340] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 374 os_tid = 0x1104 [0132.641] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.644] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.644] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2073f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0132.644] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2073f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2073f828, pbKeyObject=0x0) returned 0x0 [0132.644] BCryptExportKey (in: hKey=0x78d0b0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2073f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2073f500) returned 0x0 [0132.644] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.644] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2073f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2073f500) returned 0x0 [0132.647] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.649] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.649] WriteFile (in: hFile=0x958, lpBuffer=0x2073fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2073f830, lpOverlapped=0x0 | out: lpBuffer=0x2073fb34*, lpNumberOfBytesWritten=0x2073f830*=0x428, lpOverlapped=0x0) returned 1 [0132.750] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.750] ReadFile (in: hFile=0x958, lpBuffer=0x4050000, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x2073f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2073f61c*=0x121, lpOverlapped=0x0) returned 1 [0132.750] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffffedf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.750] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4050000, cbInput=0x121, pPaddingInfo=0x0, pbIV=0x2073f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2073f618, dwFlags=0x1 | out: hKey=0x78d0b0, pbIV=0x2073f848, pbOutput=0x4050000, pcbResult=0x2073f618) returned 0x0 [0132.750] WriteFile (in: hFile=0x958, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2073f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2073f61c*=0x130, lpOverlapped=0x0) returned 1 [0132.809] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2073f60c | out: lpNewFilePointer=0x0) returned 1 [0132.809] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.809] WriteFile (in: hFile=0x958, lpBuffer=0x2073f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2073f61c, lpOverlapped=0x0 | out: lpBuffer=0x2073f83c*, lpNumberOfBytesWritten=0x2073f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.809] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.809] BCryptDestroyKey (in: hKey=0x78d0b0 | out: hKey=0x78d0b0) returned 0x0 [0132.809] CloseHandle (hObject=0x958) returned 1 [0132.945] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0xefb0000 [0132.946] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenotenames.gpd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OneNote\\SendToOneNoteNames.gpd.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onenote\\sendtoonenotenames.gpd.play")) returned 1 [0133.310] VirtualFree (lpAddress=0xefb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 375 os_tid = 0x125c [0132.650] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.650] ReadFile (in: hFile=0x914, lpBuffer=0x2087fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2087f85c, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesRead=0x2087f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.810] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.810] ReadFile (in: hFile=0x914, lpBuffer=0x2087fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2087f85c, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesRead=0x2087f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.810] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.811] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.811] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x2087f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0132.811] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x2087f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x2087f828, pbKeyObject=0x0) returned 0x0 [0132.811] BCryptExportKey (in: hKey=0x78d0b0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2087f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2087f500) returned 0x0 [0132.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.814] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2087f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2087f500) returned 0x0 [0132.818] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.819] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.819] WriteFile (in: hFile=0x914, lpBuffer=0x2087fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2087f830, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesWritten=0x2087f830*=0x428, lpOverlapped=0x0) returned 1 [0132.955] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.955] ReadFile (in: hFile=0x914, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2087f61c*=0x100000, lpOverlapped=0x0) returned 1 [0132.986] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.987] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x2087f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2087f618, dwFlags=0x0 | out: hKey=0x78d0b0, pbIV=0x2087f848, pbOutput=0x4150000, pcbResult=0x2087f618) returned 0x0 [0132.989] WriteFile (in: hFile=0x914, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2087f61c*=0x100000, lpOverlapped=0x0) returned 1 [0132.992] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2087f60c | out: lpNewFilePointer=0x0) returned 1 [0132.992] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.992] WriteFile (in: hFile=0x914, lpBuffer=0x2087f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x2087f83c*, lpNumberOfBytesWritten=0x2087f61c*=0x8, lpOverlapped=0x0) returned 1 [0132.992] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.992] ReadFile (in: hFile=0x914, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2087f61c*=0x100000, lpOverlapped=0x0) returned 1 [0133.083] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.083] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x2087f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2087f618, dwFlags=0x0 | out: hKey=0x78d0b0, pbIV=0x2087f848, pbOutput=0x4150000, pcbResult=0x2087f618) returned 0x0 [0133.085] WriteFile (in: hFile=0x914, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2087f61c*=0x100000, lpOverlapped=0x0) returned 1 [0133.087] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2087f60c | out: lpNewFilePointer=0x0) returned 1 [0133.087] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.087] WriteFile (in: hFile=0x914, lpBuffer=0x2087f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x2087f83c*, lpNumberOfBytesWritten=0x2087f61c*=0x8, lpOverlapped=0x0) returned 1 [0133.097] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.097] ReadFile (in: hFile=0x914, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2087f61c*=0x100000, lpOverlapped=0x0) returned 1 [0133.378] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.378] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x2087f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2087f618, dwFlags=0x0 | out: hKey=0x78d0b0, pbIV=0x2087f848, pbOutput=0x4150000, pcbResult=0x2087f618) returned 0x0 [0133.379] WriteFile (in: hFile=0x914, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2087f61c*=0x100000, lpOverlapped=0x0) returned 1 [0133.382] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2087f60c | out: lpNewFilePointer=0x0) returned 1 [0133.382] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.382] WriteFile (in: hFile=0x914, lpBuffer=0x2087f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x2087f83c*, lpNumberOfBytesWritten=0x2087f61c*=0x8, lpOverlapped=0x0) returned 1 [0133.391] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.391] ReadFile (in: hFile=0x914, lpBuffer=0x4150000, nNumberOfBytesToRead=0x130b8, lpNumberOfBytesRead=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2087f61c*=0x130b8, lpOverlapped=0x0) returned 1 [0133.391] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffecf48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.391] BCryptEncrypt (in: hKey=0x78d0b0, pbInput=0x4150000, cbInput=0x130b8, pPaddingInfo=0x0, pbIV=0x2087f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2087f618, dwFlags=0x1 | out: hKey=0x78d0b0, pbIV=0x2087f848, pbOutput=0x4150000, pcbResult=0x2087f618) returned 0x0 [0133.391] WriteFile (in: hFile=0x914, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x130c0, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2087f61c*=0x130c0, lpOverlapped=0x0) returned 1 [0133.392] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2087f60c | out: lpNewFilePointer=0x0) returned 1 [0133.392] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.392] WriteFile (in: hFile=0x914, lpBuffer=0x2087f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x2087f83c*, lpNumberOfBytesWritten=0x2087f61c*=0x8, lpOverlapped=0x0) returned 1 [0133.392] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x3130c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.392] BCryptDestroyKey (in: hKey=0x78d0b0 | out: hKey=0x78d0b0) returned 0x0 [0133.392] CloseHandle (hObject=0x914) returned 1 [0133.392] VirtualAlloc (lpAddress=0x0, dwSize=0x83, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0133.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\onfilter.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONFILTER.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onfilter.dll.play")) returned 1 [0133.394] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 376 os_tid = 0x1278 [0132.652] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.652] ReadFile (in: hFile=0x964, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.809] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.809] ReadFile (in: hFile=0x964, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0132.874] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.876] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.876] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x209bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0132.876] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x209bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x209bf828, pbKeyObject=0x0) returned 0x0 [0132.876] BCryptExportKey (in: hKey=0x7ce350, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x209bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x209bf500) returned 0x0 [0132.876] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.876] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x209bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x209bf500) returned 0x0 [0132.879] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.881] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.881] WriteFile (in: hFile=0x964, lpBuffer=0x209bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x209bf830, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesWritten=0x209bf830*=0x428, lpOverlapped=0x0) returned 1 [0132.898] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.898] ReadFile (in: hFile=0x964, lpBuffer=0x4250000, nNumberOfBytesToRead=0x194e8, lpNumberOfBytesRead=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x209bf61c*=0x194e8, lpOverlapped=0x0) returned 1 [0132.935] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffe6b18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.935] BCryptEncrypt (in: hKey=0x7ce350, pbInput=0x4250000, cbInput=0x194e8, pPaddingInfo=0x0, pbIV=0x209bf848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x209bf618, dwFlags=0x1 | out: hKey=0x7ce350, pbIV=0x209bf848, pbOutput=0x4250000, pcbResult=0x209bf618) returned 0x0 [0132.935] WriteFile (in: hFile=0x964, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x194f0, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x209bf61c*=0x194f0, lpOverlapped=0x0) returned 1 [0132.936] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x209bf60c | out: lpNewFilePointer=0x0) returned 1 [0132.936] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.936] WriteFile (in: hFile=0x964, lpBuffer=0x209bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x209bf83c*, lpNumberOfBytesWritten=0x209bf61c*=0x8, lpOverlapped=0x0) returned 1 [0132.936] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x194f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.936] BCryptDestroyKey (in: hKey=0x7ce350 | out: hKey=0x7ce350) returned 0x0 [0132.936] CloseHandle (hObject=0x964) returned 1 [0133.197] VirtualAlloc (lpAddress=0x0, dwSize=0x89, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0133.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\onlntcomlib.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\ONLNTCOMLIB.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\onlntcomlib.dll.play")) returned 1 [0133.334] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 377 os_tid = 0xe6c [0132.653] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.653] ReadFile (in: hFile=0x96c, lpBuffer=0x20affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20aff85c, lpOverlapped=0x0 | out: lpBuffer=0x20affb34*, lpNumberOfBytesRead=0x20aff85c*=0x428, lpOverlapped=0x0) returned 1 [0132.842] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.844] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x20aff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0132.844] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x20aff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x20aff828, pbKeyObject=0x0) returned 0x0 [0132.844] BCryptExportKey (in: hKey=0x7cdbf0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x20aff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x20aff500) returned 0x0 [0132.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.844] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x20aff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x20aff500) returned 0x0 [0132.849] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.851] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.851] WriteFile (in: hFile=0x96c, lpBuffer=0x20affb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20aff830, lpOverlapped=0x0 | out: lpBuffer=0x20affb34*, lpNumberOfBytesWritten=0x20aff830*=0x428, lpOverlapped=0x0) returned 1 [0132.865] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.865] ReadFile (in: hFile=0x96c, lpBuffer=0x4350000, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x20aff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x20aff61c*=0x484, lpOverlapped=0x0) returned 1 [0132.865] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffb7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.865] BCryptEncrypt (in: hKey=0x7cdbf0, pbInput=0x4350000, cbInput=0x484, pPaddingInfo=0x0, pbIV=0x20aff848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x20aff618, dwFlags=0x1 | out: hKey=0x7cdbf0, pbIV=0x20aff848, pbOutput=0x4350000, pcbResult=0x20aff618) returned 0x0 [0132.865] WriteFile (in: hFile=0x96c, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x20aff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x20aff61c*=0x490, lpOverlapped=0x0) returned 1 [0132.949] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20aff60c | out: lpNewFilePointer=0x0) returned 1 [0132.949] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.949] WriteFile (in: hFile=0x96c, lpBuffer=0x20aff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20aff61c, lpOverlapped=0x0 | out: lpBuffer=0x20aff83c*, lpNumberOfBytesWritten=0x20aff61c*=0x8, lpOverlapped=0x0) returned 1 [0132.949] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.949] BCryptDestroyKey (in: hKey=0x7cdbf0 | out: hKey=0x7cdbf0) returned 0x0 [0132.949] CloseHandle (hObject=0x96c) returned 1 [0133.209] VirtualAlloc (lpAddress=0x0, dwSize=0x93, flAllocationType=0x1000, flProtect=0x4) returned 0xdf80000 [0133.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\office16\\visiocustom.propdesc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VisioCustom.propdesc.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\visiocustom.propdesc.play")) returned 1 [0133.320] VirtualFree (lpAddress=0xdf80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 378 os_tid = 0x110c [0132.654] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.654] ReadFile (in: hFile=0x974, lpBuffer=0x20c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x20c3fb34*, lpNumberOfBytesRead=0x20c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.831] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.831] ReadFile (in: hFile=0x974, lpBuffer=0x20c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x20c3fb34*, lpNumberOfBytesRead=0x20c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0132.831] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0132.833] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0132.833] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x20c3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0132.833] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x20c3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x20c3f828, pbKeyObject=0x0) returned 0x0 [0132.833] BCryptExportKey (in: hKey=0x78dd00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x20c3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x20c3f500) returned 0x0 [0132.833] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0132.834] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x20c3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x20c3f500) returned 0x0 [0132.839] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.842] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.842] WriteFile (in: hFile=0x974, lpBuffer=0x20c3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20c3f830, lpOverlapped=0x0 | out: lpBuffer=0x20c3fb34*, lpNumberOfBytesWritten=0x20c3f830*=0x428, lpOverlapped=0x0) returned 1 [0132.949] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.949] ReadFile (in: hFile=0x974, lpBuffer=0x4450000, nNumberOfBytesToRead=0xe72b8, lpNumberOfBytesRead=0x20c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x20c3f61c*=0xe72b8, lpOverlapped=0x0) returned 1 [0133.007] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0xfff18d48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.007] BCryptEncrypt (in: hKey=0x78dd00, pbInput=0x4450000, cbInput=0xe72b8, pPaddingInfo=0x0, pbIV=0x20c3f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x20c3f618, dwFlags=0x1 | out: hKey=0x78dd00, pbIV=0x20c3f848, pbOutput=0x4450000, pcbResult=0x20c3f618) returned 0x0 [0133.008] WriteFile (in: hFile=0x974, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0xe72c0, lpNumberOfBytesWritten=0x20c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x20c3f61c*=0xe72c0, lpOverlapped=0x0) returned 1 [0133.011] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20c3f60c | out: lpNewFilePointer=0x0) returned 1 [0133.011] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.011] WriteFile (in: hFile=0x974, lpBuffer=0x20c3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x20c3f83c*, lpNumberOfBytesWritten=0x20c3f61c*=0x8, lpOverlapped=0x0) returned 1 [0133.011] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0xe72c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.011] BCryptDestroyKey (in: hKey=0x78dd00 | out: hKey=0x78dd00) returned 0x0 [0133.011] CloseHandle (hObject=0x974) returned 1 [0133.344] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0133.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VISSHE.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\visshe.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\VISSHE.DLL.PLAY" (normalized: "c:\\program files\\microsoft office\\office16\\visshe.dll.play")) returned 1 [0133.348] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 379 os_tid = 0x1114 [0133.685] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0133.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0133.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f000c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0133.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0133.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0024, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0133.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0133.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f003c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0133.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0133.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0054, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0133.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0133.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f006c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0133.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0133.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0084, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0133.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0133.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f009c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0133.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0133.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0133.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0133.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0133.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0133.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0133.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0133.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0133.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0133.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0114, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0133.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0133.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f012c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0133.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0133.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0144, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0133.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0133.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f015c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0133.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0133.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0174, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0133.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0133.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f018c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0133.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0133.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0133.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0133.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0133.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0133.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0133.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0133.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0133.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0133.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0204, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0133.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0133.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f021c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0133.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0133.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0234, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0133.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0133.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f024c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0133.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0133.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0264, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0133.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0133.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f027c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0133.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0133.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0294, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0133.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0133.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0133.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0133.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0133.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0133.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0133.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0133.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0133.723] WaitForMultipleObjects (nCount=0x40, lpHandles=0x700000*=0x370, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0135.306] CloseHandle (hObject=0x370) returned 1 [0135.306] CloseHandle (hObject=0x8b0) returned 1 [0135.306] CloseHandle (hObject=0x8ac) returned 1 [0135.306] CloseHandle (hObject=0x914) returned 1 [0135.306] CloseHandle (hObject=0x36c) returned 1 [0135.306] CloseHandle (hObject=0x474) returned 1 [0135.307] CloseHandle (hObject=0x348) returned 1 [0135.307] CloseHandle (hObject=0x480) returned 1 [0135.307] CloseHandle (hObject=0x490) returned 1 [0135.307] CloseHandle (hObject=0x49c) returned 1 [0135.307] CloseHandle (hObject=0x4ac) returned 1 [0135.307] CloseHandle (hObject=0x964) returned 1 [0135.307] CloseHandle (hObject=0x4b4) returned 1 [0135.307] CloseHandle (hObject=0x4bc) returned 1 [0135.307] CloseHandle (hObject=0x52c) returned 1 [0135.307] CloseHandle (hObject=0x920) returned 1 [0135.307] CloseHandle (hObject=0x958) returned 1 [0135.307] CloseHandle (hObject=0x904) returned 1 [0135.307] CloseHandle (hObject=0x928) returned 1 [0135.307] CloseHandle (hObject=0x4d8) returned 1 [0135.307] CloseHandle (hObject=0x304) returned 1 [0135.307] CloseHandle (hObject=0x65c) returned 1 [0135.308] CloseHandle (hObject=0x66c) returned 1 [0135.308] CloseHandle (hObject=0x694) returned 1 [0135.308] CloseHandle (hObject=0x210) returned 1 [0135.308] CloseHandle (hObject=0x214) returned 1 [0135.308] CloseHandle (hObject=0x218) returned 1 [0135.308] CloseHandle (hObject=0x21c) returned 1 [0135.308] CloseHandle (hObject=0x220) returned 1 [0135.308] CloseHandle (hObject=0x224) returned 1 [0135.308] CloseHandle (hObject=0x228) returned 1 [0135.308] CloseHandle (hObject=0x22c) returned 1 [0135.308] CloseHandle (hObject=0x230) returned 1 [0135.308] CloseHandle (hObject=0x234) returned 1 [0135.308] CloseHandle (hObject=0x238) returned 1 [0135.308] CloseHandle (hObject=0x23c) returned 1 [0135.308] CloseHandle (hObject=0x240) returned 1 [0135.309] CloseHandle (hObject=0x244) returned 1 [0135.309] CloseHandle (hObject=0x248) returned 1 [0135.309] CloseHandle (hObject=0x24c) returned 1 [0135.309] CloseHandle (hObject=0x250) returned 1 [0135.309] CloseHandle (hObject=0x254) returned 1 [0135.309] CloseHandle (hObject=0x258) returned 1 [0135.309] CloseHandle (hObject=0x25c) returned 1 [0135.309] CloseHandle (hObject=0x260) returned 1 [0135.309] CloseHandle (hObject=0x264) returned 1 [0135.309] CloseHandle (hObject=0x268) returned 1 [0135.309] CloseHandle (hObject=0x26c) returned 1 [0135.309] CloseHandle (hObject=0x270) returned 1 [0135.309] CloseHandle (hObject=0x274) returned 1 [0135.309] CloseHandle (hObject=0x278) returned 1 [0135.309] CloseHandle (hObject=0x27c) returned 1 [0135.309] CloseHandle (hObject=0x280) returned 1 [0135.310] CloseHandle (hObject=0x284) returned 1 [0135.310] CloseHandle (hObject=0x344) returned 1 [0135.310] CloseHandle (hObject=0x6a4) returned 1 [0135.310] CloseHandle (hObject=0x6a8) returned 1 [0135.310] CloseHandle (hObject=0x6ac) returned 1 [0135.310] CloseHandle (hObject=0x6b0) returned 1 [0135.310] CloseHandle (hObject=0x6b4) returned 1 [0135.310] CloseHandle (hObject=0x6b8) returned 1 [0135.310] CloseHandle (hObject=0x6bc) returned 1 [0135.310] CloseHandle (hObject=0x6c0) returned 1 [0135.310] CloseHandle (hObject=0x354) returned 1 [0135.310] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 380 os_tid = 0x1100 [0133.736] GetLastError () returned 0x57 [0133.736] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c3b60 [0133.736] SetLastError (dwErrCode=0x57) [0133.737] IcmpCreateFile () returned 0x7bd908 [0133.737] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baa70 [0133.737] IcmpSendEcho2 (in: IcmpHandle=0x7bd908, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x100a8c0, RequestData=0xed0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baa70, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baa70) returned 0x0 [0139.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baa70 | out: hHeap=0x710000) returned 1 [0139.710] IcmpCloseHandle (IcmpHandle=0x7bd908) returned 1 [0139.710] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c3b60 | out: hHeap=0x710000) returned 1 Thread: id = 381 os_tid = 0x1108 [0133.738] GetLastError () returned 0x57 [0133.738] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c3ee8 [0133.738] SetLastError (dwErrCode=0x57) [0133.738] IcmpCreateFile () returned 0x7bd940 [0133.738] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baac0 [0133.738] IcmpSendEcho2 (in: IcmpHandle=0x7bd940, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x200a8c0, RequestData=0xee4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baac0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baac0) returned 0x0 [0139.788] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baac0 | out: hHeap=0x710000) returned 1 [0139.788] IcmpCloseHandle (IcmpHandle=0x7bd940) returned 1 [0139.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c3ee8 | out: hHeap=0x710000) returned 1 Thread: id = 382 os_tid = 0x10f4 [0133.739] GetLastError () returned 0x57 [0133.740] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4270 [0133.740] SetLastError (dwErrCode=0x57) [0133.740] IcmpCreateFile () returned 0x7bdac8 [0133.740] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bab10 [0133.740] IcmpSendEcho2 (in: IcmpHandle=0x7bdac8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x300a8c0, RequestData=0xef8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bab10, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bab10) returned 0x0 [0139.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bab10 | out: hHeap=0x710000) returned 1 [0139.819] IcmpCloseHandle (IcmpHandle=0x7bdac8) returned 1 [0139.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c4270 | out: hHeap=0x710000) returned 1 Thread: id = 383 os_tid = 0x820 [0133.741] GetLastError () returned 0x57 [0133.741] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c45f8 [0133.741] SetLastError (dwErrCode=0x57) [0133.741] IcmpCreateFile () returned 0x7bd400 [0133.741] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bab60 [0133.741] IcmpSendEcho2 (in: IcmpHandle=0x7bd400, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x400a8c0, RequestData=0xf0cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bab60, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bab60) returned 0x0 [0139.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bab60 | out: hHeap=0x710000) returned 1 [0139.863] IcmpCloseHandle (IcmpHandle=0x7bd400) returned 1 [0139.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c45f8 | out: hHeap=0x710000) returned 1 Thread: id = 384 os_tid = 0xac4 [0133.742] GetLastError () returned 0x57 [0133.742] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4980 [0133.742] SetLastError (dwErrCode=0x57) [0133.742] IcmpCreateFile () returned 0x7bd470 [0133.742] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7babb0 [0133.742] IcmpSendEcho2 (in: IcmpHandle=0x7bd470, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x500a8c0, RequestData=0xf20ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7babb0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7babb0) returned 0x0 [0139.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7babb0 | out: hHeap=0x710000) returned 1 [0139.880] IcmpCloseHandle (IcmpHandle=0x7bd470) returned 1 [0139.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c4980 | out: hHeap=0x710000) returned 1 Thread: id = 385 os_tid = 0xa1c [0133.743] GetLastError () returned 0x57 [0133.743] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bdc08 [0133.743] SetLastError (dwErrCode=0x57) [0133.743] IcmpCreateFile () returned 0x7bd4a8 [0133.743] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bac00 [0133.743] IcmpSendEcho2 (in: IcmpHandle=0x7bd4a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x600a8c0, RequestData=0xf34ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bac00, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bac00) returned 0x0 [0139.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bac00 | out: hHeap=0x710000) returned 1 [0139.897] IcmpCloseHandle (IcmpHandle=0x7bd4a8) returned 1 [0139.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bdc08 | out: hHeap=0x710000) returned 1 Thread: id = 386 os_tid = 0x13ac [0133.744] GetLastError () returned 0x57 [0133.744] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bdf90 [0133.745] SetLastError (dwErrCode=0x57) [0133.745] IcmpCreateFile () returned 0x7bd4e0 [0133.745] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bac50 [0133.745] IcmpSendEcho2 (in: IcmpHandle=0x7bd4e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x700a8c0, RequestData=0xf48ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bac50, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bac50) returned 0x0 [0139.916] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bac50 | out: hHeap=0x710000) returned 1 [0139.916] IcmpCloseHandle (IcmpHandle=0x7bd4e0) returned 1 [0139.916] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bdf90 | out: hHeap=0x710000) returned 1 Thread: id = 387 os_tid = 0xdac [0133.746] GetLastError () returned 0x57 [0133.746] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7be318 [0133.746] SetLastError (dwErrCode=0x57) [0133.746] IcmpCreateFile () returned 0x7bd518 [0133.746] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baca0 [0133.746] IcmpSendEcho2 (in: IcmpHandle=0x7bd518, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x800a8c0, RequestData=0xf70ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baca0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baca0) returned 0x0 [0139.930] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baca0 | out: hHeap=0x710000) returned 1 [0139.930] IcmpCloseHandle (IcmpHandle=0x7bd518) returned 1 [0139.931] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7be318 | out: hHeap=0x710000) returned 1 Thread: id = 388 os_tid = 0x828 [0133.747] GetLastError () returned 0x57 [0133.747] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7be6a0 [0133.747] SetLastError (dwErrCode=0x57) [0133.747] IcmpCreateFile () returned 0x7bd550 [0133.747] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bacf0 [0133.747] IcmpSendEcho2 (in: IcmpHandle=0x7bd550, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x900a8c0, RequestData=0xf84ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bacf0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bacf0) returned 0x0 [0139.990] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bacf0 | out: hHeap=0x710000) returned 1 [0139.990] IcmpCloseHandle (IcmpHandle=0x7bd550) returned 1 [0139.990] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7be6a0 | out: hHeap=0x710000) returned 1 Thread: id = 389 os_tid = 0x770 [0133.748] GetLastError () returned 0x57 [0133.748] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bea28 [0133.748] SetLastError (dwErrCode=0x57) [0133.748] IcmpCreateFile () returned 0x7bd588 [0133.748] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bad40 [0133.748] IcmpSendEcho2 (in: IcmpHandle=0x7bd588, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa00a8c0, RequestData=0xfe4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bad40, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bad40) returned 0x0 [0140.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bad40 | out: hHeap=0x710000) returned 1 [0140.056] IcmpCloseHandle (IcmpHandle=0x7bd588) returned 1 [0140.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bea28 | out: hHeap=0x710000) returned 1 Thread: id = 390 os_tid = 0x1120 [0133.749] GetLastError () returned 0x57 [0133.749] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bedb0 [0133.749] SetLastError (dwErrCode=0x57) [0133.749] IcmpCreateFile () returned 0x7bd5c0 [0133.749] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bad90 [0133.749] IcmpSendEcho2 (in: IcmpHandle=0x7bd5c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb00a8c0, RequestData=0x1048ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bad90, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bad90) returned 0x0 [0140.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bad90 | out: hHeap=0x710000) returned 1 [0140.243] IcmpCloseHandle (IcmpHandle=0x7bd5c0) returned 1 [0140.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bedb0 | out: hHeap=0x710000) returned 1 Thread: id = 391 os_tid = 0x1118 [0133.750] GetLastError () returned 0x57 [0133.751] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bf138 [0133.751] SetLastError (dwErrCode=0x57) [0133.751] IcmpCreateFile () returned 0x7bdb00 [0133.751] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba3e0 [0133.751] IcmpSendEcho2 (in: IcmpHandle=0x7bdb00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc00a8c0, RequestData=0x1070ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba3e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba3e0) returned 0x0 [0140.279] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba3e0 | out: hHeap=0x710000) returned 1 [0140.279] IcmpCloseHandle (IcmpHandle=0x7bdb00) returned 1 [0140.279] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bf138 | out: hHeap=0x710000) returned 1 Thread: id = 392 os_tid = 0xda4 [0133.752] GetLastError () returned 0x57 [0133.752] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c0d78 [0133.752] SetLastError (dwErrCode=0x57) [0133.752] IcmpCreateFile () returned 0x7bdb70 [0133.752] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba430 [0133.752] IcmpSendEcho2 (in: IcmpHandle=0x7bdb70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd00a8c0, RequestData=0x10c0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba430, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba430) returned 0x0 [0140.289] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba430 | out: hHeap=0x710000) returned 1 [0140.289] IcmpCloseHandle (IcmpHandle=0x7bdb70) returned 1 [0140.290] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c0d78 | out: hHeap=0x710000) returned 1 Thread: id = 393 os_tid = 0x10f0 [0133.753] GetLastError () returned 0x57 [0133.753] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bf4c0 [0133.753] SetLastError (dwErrCode=0x57) [0133.753] IcmpCreateFile () returned 0x7bdb38 [0133.753] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba840 [0133.753] IcmpSendEcho2 (in: IcmpHandle=0x7bdb38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe00a8c0, RequestData=0x1624ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba840, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba840) returned 0x0 [0140.306] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba840 | out: hHeap=0x710000) returned 1 [0140.306] IcmpCloseHandle (IcmpHandle=0x7bdb38) returned 1 [0140.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bf4c0 | out: hHeap=0x710000) returned 1 Thread: id = 394 os_tid = 0x111c [0133.754] GetLastError () returned 0x57 [0133.754] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bf848 [0133.754] SetLastError (dwErrCode=0x57) [0133.754] IcmpCreateFile () returned 0x74ee98 [0133.754] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba890 [0133.754] IcmpSendEcho2 (in: IcmpHandle=0x74ee98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf00a8c0, RequestData=0x1638ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba890, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba890) returned 0x0 [0140.313] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba890 | out: hHeap=0x710000) returned 1 [0140.313] IcmpCloseHandle (IcmpHandle=0x74ee98) returned 1 [0140.313] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bf848 | out: hHeap=0x710000) returned 1 Thread: id = 395 os_tid = 0x1404 [0133.756] GetLastError () returned 0x57 [0133.756] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1100 [0133.756] SetLastError (dwErrCode=0x57) [0133.756] IcmpCreateFile () returned 0x74ef40 [0133.756] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba480 [0133.756] IcmpSendEcho2 (in: IcmpHandle=0x74ef40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1000a8c0, RequestData=0x164cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba480, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba480) returned 0x0 [0140.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba480 | out: hHeap=0x710000) returned 1 [0140.318] IcmpCloseHandle (IcmpHandle=0x74ef40) returned 1 [0140.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1100 | out: hHeap=0x710000) returned 1 Thread: id = 396 os_tid = 0x1408 [0133.757] GetLastError () returned 0x57 [0133.757] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c0668 [0133.757] SetLastError (dwErrCode=0x57) [0133.757] IcmpCreateFile () returned 0x74eed0 [0133.757] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba8e0 [0133.757] IcmpSendEcho2 (in: IcmpHandle=0x74eed0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1100a8c0, RequestData=0x1674ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba8e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba8e0) returned 0x0 [0140.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba8e0 | out: hHeap=0x710000) returned 1 [0140.326] IcmpCloseHandle (IcmpHandle=0x74eed0) returned 1 [0140.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c0668 | out: hHeap=0x710000) returned 1 Thread: id = 397 os_tid = 0x140c [0133.758] GetLastError () returned 0x57 [0133.758] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c09f0 [0133.758] SetLastError (dwErrCode=0x57) [0133.758] IcmpCreateFile () returned 0x74ef78 [0133.758] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba980 [0133.758] IcmpSendEcho2 (in: IcmpHandle=0x74ef78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1200a8c0, RequestData=0x169cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba980, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba980) returned 0x0 [0140.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba980 | out: hHeap=0x710000) returned 1 [0140.334] IcmpCloseHandle (IcmpHandle=0x74ef78) returned 1 [0140.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c09f0 | out: hHeap=0x710000) returned 1 Thread: id = 398 os_tid = 0x1410 [0133.759] GetLastError () returned 0x57 [0133.759] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1488 [0133.759] SetLastError (dwErrCode=0x57) [0133.760] IcmpCreateFile () returned 0x74f410 [0133.760] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba9d0 [0133.760] IcmpSendEcho2 (in: IcmpHandle=0x74f410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1300a8c0, RequestData=0x1714ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba9d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba9d0) returned 0x0 [0140.370] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba9d0 | out: hHeap=0x710000) returned 1 [0140.370] IcmpCloseHandle (IcmpHandle=0x74f410) returned 1 [0140.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1488 | out: hHeap=0x710000) returned 1 Thread: id = 399 os_tid = 0x1414 [0133.760] GetLastError () returned 0x57 [0133.761] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1810 [0133.761] SetLastError (dwErrCode=0x57) [0133.761] IcmpCreateFile () returned 0x74f448 [0133.761] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baa20 [0133.761] IcmpSendEcho2 (in: IcmpHandle=0x74f448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1400a8c0, RequestData=0x17ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baa20, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baa20) returned 0x0 [0140.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baa20 | out: hHeap=0x710000) returned 1 [0140.375] IcmpCloseHandle (IcmpHandle=0x74f448) returned 1 [0140.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1810 | out: hHeap=0x710000) returned 1 Thread: id = 400 os_tid = 0x1418 [0133.762] GetLastError () returned 0x57 [0133.762] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1b98 [0133.762] SetLastError (dwErrCode=0x57) [0133.762] IcmpCreateFile () returned 0x74f3d8 [0133.762] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba4d0 [0133.762] IcmpSendEcho2 (in: IcmpHandle=0x74f3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1500a8c0, RequestData=0x1fabff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba4d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba4d0) returned 0x0 [0140.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba4d0 | out: hHeap=0x710000) returned 1 [0140.413] IcmpCloseHandle (IcmpHandle=0x74f3d8) returned 1 [0140.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1b98 | out: hHeap=0x710000) returned 1 Thread: id = 401 os_tid = 0x141c [0133.771] GetLastError () returned 0x57 [0133.771] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1f20 [0133.771] SetLastError (dwErrCode=0x57) [0133.771] IcmpCreateFile () returned 0x75d3b8 [0133.771] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e058 [0133.771] IcmpSendEcho2 (in: IcmpHandle=0x75d3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1600a8c0, RequestData=0x1fbfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e058) returned 0x0 [0140.420] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e058 | out: hHeap=0x710000) returned 1 [0140.420] IcmpCloseHandle (IcmpHandle=0x75d3b8) returned 1 [0140.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1f20 | out: hHeap=0x710000) returned 1 Thread: id = 402 os_tid = 0x1420 [0133.796] GetLastError () returned 0x57 [0133.796] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c2d40 [0133.796] SetLastError (dwErrCode=0x57) [0133.797] IcmpCreateFile () returned 0x7d15b0 [0133.797] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dbf8 [0133.797] IcmpSendEcho2 (in: IcmpHandle=0x7d15b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1700a8c0, RequestData=0x1fd3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dbf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dbf8) returned 0x0 [0140.447] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dbf8 | out: hHeap=0x710000) returned 1 [0140.447] IcmpCloseHandle (IcmpHandle=0x7d15b0) returned 1 [0140.447] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c2d40 | out: hHeap=0x710000) returned 1 Thread: id = 403 os_tid = 0x1424 [0133.798] GetLastError () returned 0x57 [0133.798] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c30c8 [0133.798] SetLastError (dwErrCode=0x57) [0133.798] IcmpCreateFile () returned 0x7d1498 [0133.798] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc48 [0133.798] IcmpSendEcho2 (in: IcmpHandle=0x7d1498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1800a8c0, RequestData=0x1fe7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc48) returned 0x0 [0140.453] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc48 | out: hHeap=0x710000) returned 1 [0140.453] IcmpCloseHandle (IcmpHandle=0x7d1498) returned 1 [0140.454] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c30c8 | out: hHeap=0x710000) returned 1 Thread: id = 404 os_tid = 0x1428 [0133.799] GetLastError () returned 0x57 [0133.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c3450 [0133.799] SetLastError (dwErrCode=0x57) [0133.799] IcmpCreateFile () returned 0x7d14d0 [0133.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc98 [0133.799] IcmpSendEcho2 (in: IcmpHandle=0x7d14d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1900a8c0, RequestData=0x1ffbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc98) returned 0x0 [0140.460] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc98 | out: hHeap=0x710000) returned 1 [0140.460] IcmpCloseHandle (IcmpHandle=0x7d14d0) returned 1 [0140.461] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c3450 | out: hHeap=0x710000) returned 1 Thread: id = 405 os_tid = 0x142c [0133.800] GetLastError () returned 0x57 [0133.800] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c37d8 [0133.800] SetLastError (dwErrCode=0x57) [0133.800] IcmpCreateFile () returned 0x7d1508 [0133.800] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dce8 [0133.801] IcmpSendEcho2 (in: IcmpHandle=0x7d1508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1a00a8c0, RequestData=0x200fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dce8) returned 0x0 [0140.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dce8 | out: hHeap=0x710000) returned 1 [0140.602] IcmpCloseHandle (IcmpHandle=0x7d1508) returned 1 [0140.603] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c37d8 | out: hHeap=0x710000) returned 1 Thread: id = 406 os_tid = 0x1430 [0133.802] GetLastError () returned 0x57 [0133.802] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bfbd0 [0133.802] SetLastError (dwErrCode=0x57) [0133.802] IcmpCreateFile () returned 0x7d1540 [0133.802] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dd38 [0133.802] IcmpSendEcho2 (in: IcmpHandle=0x7d1540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b00a8c0, RequestData=0x2023ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dd38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dd38) returned 0x0 [0140.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dd38 | out: hHeap=0x710000) returned 1 [0140.702] IcmpCloseHandle (IcmpHandle=0x7d1540) returned 1 [0140.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bfbd0 | out: hHeap=0x710000) returned 1 Thread: id = 407 os_tid = 0x1434 [0133.803] GetLastError () returned 0x57 [0133.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bff58 [0133.803] SetLastError (dwErrCode=0x57) [0133.803] IcmpCreateFile () returned 0x7d1578 [0133.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de28 [0133.803] IcmpSendEcho2 (in: IcmpHandle=0x7d1578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1c00a8c0, RequestData=0x2037ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de28) returned 0x0 [0140.726] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de28 | out: hHeap=0x710000) returned 1 [0140.727] IcmpCloseHandle (IcmpHandle=0x7d1578) returned 1 [0140.728] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bff58 | out: hHeap=0x710000) returned 1 Thread: id = 408 os_tid = 0x1438 [0133.804] GetLastError () returned 0x57 [0133.804] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c02e0 [0133.804] SetLastError (dwErrCode=0x57) [0133.804] IcmpCreateFile () returned 0x7d15e8 [0133.804] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de78 [0133.804] IcmpSendEcho2 (in: IcmpHandle=0x7d15e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1d00a8c0, RequestData=0x204bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de78) returned 0x0 [0140.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de78 | out: hHeap=0x710000) returned 1 [0140.764] IcmpCloseHandle (IcmpHandle=0x7d15e8) returned 1 [0140.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c02e0 | out: hHeap=0x710000) returned 1 Thread: id = 409 os_tid = 0x143c [0133.805] GetLastError () returned 0x57 [0133.805] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757370 [0133.806] SetLastError (dwErrCode=0x57) [0133.806] IcmpCreateFile () returned 0x7d1620 [0133.806] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2ad8 [0133.806] IcmpSendEcho2 (in: IcmpHandle=0x7d1620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1e00a8c0, RequestData=0x205fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2ad8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2ad8) returned 0x0 [0140.788] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2ad8 | out: hHeap=0x710000) returned 1 [0140.788] IcmpCloseHandle (IcmpHandle=0x7d1620) returned 1 [0140.788] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757370 | out: hHeap=0x710000) returned 1 Thread: id = 410 os_tid = 0x1440 [0133.807] GetLastError () returned 0x57 [0133.807] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7576f8 [0133.807] SetLastError (dwErrCode=0x57) [0133.807] IcmpCreateFile () returned 0x7d1380 [0133.807] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2b28 [0133.807] IcmpSendEcho2 (in: IcmpHandle=0x7d1380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1f00a8c0, RequestData=0x2073ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2b28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2b28) returned 0x0 [0140.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2b28 | out: hHeap=0x710000) returned 1 [0140.802] IcmpCloseHandle (IcmpHandle=0x7d1380) returned 1 [0140.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7576f8 | out: hHeap=0x710000) returned 1 Thread: id = 411 os_tid = 0x1444 [0133.808] GetLastError () returned 0x57 [0133.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757a80 [0133.808] SetLastError (dwErrCode=0x57) [0133.808] IcmpCreateFile () returned 0x7d13b8 [0133.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2b78 [0133.808] IcmpSendEcho2 (in: IcmpHandle=0x7d13b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2000a8c0, RequestData=0x2087ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2b78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2b78) returned 0x0 [0140.810] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2b78 | out: hHeap=0x710000) returned 1 [0140.810] IcmpCloseHandle (IcmpHandle=0x7d13b8) returned 1 [0140.811] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757a80 | out: hHeap=0x710000) returned 1 Thread: id = 412 os_tid = 0x1448 [0133.809] GetLastError () returned 0x57 [0133.809] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757e08 [0133.809] SetLastError (dwErrCode=0x57) [0133.809] IcmpCreateFile () returned 0x7d1310 [0133.809] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2df8 [0133.809] IcmpSendEcho2 (in: IcmpHandle=0x7d1310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2100a8c0, RequestData=0x209bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2df8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2df8) returned 0x0 [0140.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2df8 | out: hHeap=0x710000) returned 1 [0140.822] IcmpCloseHandle (IcmpHandle=0x7d1310) returned 1 [0140.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757e08 | out: hHeap=0x710000) returned 1 Thread: id = 413 os_tid = 0x144c [0133.810] GetLastError () returned 0x57 [0133.810] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758190 [0133.811] SetLastError (dwErrCode=0x57) [0133.811] IcmpCreateFile () returned 0x7d1348 [0133.811] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2e48 [0133.811] IcmpSendEcho2 (in: IcmpHandle=0x7d1348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2200a8c0, RequestData=0x20afff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2e48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2e48) returned 0x0 [0140.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2e48 | out: hHeap=0x710000) returned 1 [0140.832] IcmpCloseHandle (IcmpHandle=0x7d1348) returned 1 [0140.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758190 | out: hHeap=0x710000) returned 1 Thread: id = 414 os_tid = 0x1450 [0133.812] GetLastError () returned 0x57 [0133.812] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758518 [0133.812] SetLastError (dwErrCode=0x57) [0133.812] IcmpCreateFile () returned 0x7d13f0 [0133.812] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2e98 [0133.812] IcmpSendEcho2 (in: IcmpHandle=0x7d13f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2300a8c0, RequestData=0x20c3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2e98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2e98) returned 0x0 [0140.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2e98 | out: hHeap=0x710000) returned 1 [0140.836] IcmpCloseHandle (IcmpHandle=0x7d13f0) returned 1 [0140.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758518 | out: hHeap=0x710000) returned 1 Thread: id = 415 os_tid = 0x1454 [0133.813] GetLastError () returned 0x57 [0133.813] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7588a0 [0133.813] SetLastError (dwErrCode=0x57) [0133.813] IcmpCreateFile () returned 0x7d1428 [0133.813] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2ee8 [0133.813] IcmpSendEcho2 (in: IcmpHandle=0x7d1428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2400a8c0, RequestData=0x20d7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2ee8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2ee8) returned 0x0 [0140.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2ee8 | out: hHeap=0x710000) returned 1 [0140.839] IcmpCloseHandle (IcmpHandle=0x7d1428) returned 1 [0140.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7588a0 | out: hHeap=0x710000) returned 1 Thread: id = 416 os_tid = 0x1458 [0133.814] GetLastError () returned 0x57 [0133.814] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758c28 [0133.814] SetLastError (dwErrCode=0x57) [0133.814] IcmpCreateFile () returned 0x7d1460 [0133.814] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2998 [0133.814] IcmpSendEcho2 (in: IcmpHandle=0x7d1460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2500a8c0, RequestData=0x20ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2998, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2998) returned 0x0 [0140.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2998 | out: hHeap=0x710000) returned 1 [0140.843] IcmpCloseHandle (IcmpHandle=0x7d1460) returned 1 [0140.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758c28 | out: hHeap=0x710000) returned 1 Thread: id = 417 os_tid = 0x145c [0133.815] GetLastError () returned 0x57 [0133.815] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5a40 [0133.821] SetLastError (dwErrCode=0x57) [0133.821] IcmpCreateFile () returned 0x7d12a0 [0133.821] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2da8 [0133.821] IcmpSendEcho2 (in: IcmpHandle=0x7d12a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2600a8c0, RequestData=0x20ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2da8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2da8) returned 0x0 [0140.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2da8 | out: hHeap=0x710000) returned 1 [0140.847] IcmpCloseHandle (IcmpHandle=0x7d12a0) returned 1 [0140.848] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d5a40 | out: hHeap=0x710000) returned 1 Thread: id = 418 os_tid = 0x1460 [0133.822] GetLastError () returned 0x57 [0133.822] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8f38 [0133.822] SetLastError (dwErrCode=0x57) [0133.822] IcmpCreateFile () returned 0x7d1658 [0133.822] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2a88 [0133.822] IcmpSendEcho2 (in: IcmpHandle=0x7d1658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2700a8c0, RequestData=0x2113ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2a88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2a88) returned 0x0 [0140.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2a88 | out: hHeap=0x710000) returned 1 [0140.857] IcmpCloseHandle (IcmpHandle=0x7d1658) returned 1 [0140.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8f38 | out: hHeap=0x710000) returned 1 Thread: id = 419 os_tid = 0x1464 [0133.823] GetLastError () returned 0x57 [0133.823] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d92c0 [0133.823] SetLastError (dwErrCode=0x57) [0133.823] IcmpCreateFile () returned 0x7d0f90 [0133.824] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2bc8 [0133.824] IcmpSendEcho2 (in: IcmpHandle=0x7d0f90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2800a8c0, RequestData=0x2127ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2bc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2bc8) returned 0x0 [0140.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2bc8 | out: hHeap=0x710000) returned 1 [0140.863] IcmpCloseHandle (IcmpHandle=0x7d0f90) returned 1 [0140.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d92c0 | out: hHeap=0x710000) returned 1 Thread: id = 420 os_tid = 0x1468 [0133.825] GetLastError () returned 0x57 [0133.825] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d9648 [0133.825] SetLastError (dwErrCode=0x57) [0133.825] IcmpCreateFile () returned 0x7d0fc8 [0133.825] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2c18 [0133.825] IcmpSendEcho2 (in: IcmpHandle=0x7d0fc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2900a8c0, RequestData=0x213bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2c18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2c18) returned 0x0 [0140.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2c18 | out: hHeap=0x710000) returned 1 [0140.868] IcmpCloseHandle (IcmpHandle=0x7d0fc8) returned 1 [0140.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d9648 | out: hHeap=0x710000) returned 1 Thread: id = 421 os_tid = 0x146c [0133.826] GetLastError () returned 0x57 [0133.826] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5dc8 [0133.826] SetLastError (dwErrCode=0x57) [0133.826] IcmpCreateFile () returned 0x7d12d8 [0133.826] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d29e8 [0133.826] IcmpSendEcho2 (in: IcmpHandle=0x7d12d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2a00a8c0, RequestData=0x214fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d29e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d29e8) returned 0x0 [0140.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d29e8 | out: hHeap=0x710000) returned 1 [0140.873] IcmpCloseHandle (IcmpHandle=0x7d12d8) returned 1 [0140.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d5dc8 | out: hHeap=0x710000) returned 1 Thread: id = 422 os_tid = 0x1470 [0133.827] GetLastError () returned 0x57 [0133.827] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6150 [0133.827] SetLastError (dwErrCode=0x57) [0133.827] IcmpCreateFile () returned 0x7d1000 [0133.827] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2c68 [0133.827] IcmpSendEcho2 (in: IcmpHandle=0x7d1000, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2b00a8c0, RequestData=0x2163ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2c68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2c68) returned 0x0 [0140.900] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2c68 | out: hHeap=0x710000) returned 1 [0140.900] IcmpCloseHandle (IcmpHandle=0x7d1000) returned 1 [0140.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6150 | out: hHeap=0x710000) returned 1 Thread: id = 423 os_tid = 0x1474 [0133.828] GetLastError () returned 0x57 [0133.828] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d64d8 [0133.828] SetLastError (dwErrCode=0x57) [0133.828] IcmpCreateFile () returned 0x7d1038 [0133.828] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2cb8 [0133.829] IcmpSendEcho2 (in: IcmpHandle=0x7d1038, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2c00a8c0, RequestData=0x2177ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2cb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2cb8) returned 0x0 [0140.906] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2cb8 | out: hHeap=0x710000) returned 1 [0140.906] IcmpCloseHandle (IcmpHandle=0x7d1038) returned 1 [0140.906] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d64d8 | out: hHeap=0x710000) returned 1 Thread: id = 424 os_tid = 0x1478 [0133.829] GetLastError () returned 0x57 [0133.830] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6860 [0133.830] SetLastError (dwErrCode=0x57) [0133.830] IcmpCreateFile () returned 0x7d1070 [0133.830] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2d08 [0133.830] IcmpSendEcho2 (in: IcmpHandle=0x7d1070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2d00a8c0, RequestData=0x218bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2d08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2d08) returned 0x0 [0140.909] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2d08 | out: hHeap=0x710000) returned 1 [0140.909] IcmpCloseHandle (IcmpHandle=0x7d1070) returned 1 [0140.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6860 | out: hHeap=0x710000) returned 1 Thread: id = 425 os_tid = 0x147c [0133.831] GetLastError () returned 0x57 [0133.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6be8 [0133.831] SetLastError (dwErrCode=0x57) [0133.831] IcmpCreateFile () returned 0x7d10a8 [0133.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2d58 [0133.831] IcmpSendEcho2 (in: IcmpHandle=0x7d10a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2e00a8c0, RequestData=0x219fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2d58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2d58) returned 0x0 [0140.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2d58 | out: hHeap=0x710000) returned 1 [0140.940] IcmpCloseHandle (IcmpHandle=0x7d10a8) returned 1 [0140.941] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6be8 | out: hHeap=0x710000) returned 1 Thread: id = 426 os_tid = 0x1480 [0133.832] GetLastError () returned 0x57 [0133.832] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6f70 [0133.832] SetLastError (dwErrCode=0x57) [0133.832] IcmpCreateFile () returned 0x7d10e0 [0133.832] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2a38 [0133.832] IcmpSendEcho2 (in: IcmpHandle=0x7d10e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2f00a8c0, RequestData=0x21b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2a38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2a38) returned 0x0 [0140.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2a38 | out: hHeap=0x710000) returned 1 [0140.956] IcmpCloseHandle (IcmpHandle=0x7d10e0) returned 1 [0140.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6f70 | out: hHeap=0x710000) returned 1 Thread: id = 427 os_tid = 0x1484 [0133.833] GetLastError () returned 0x57 [0133.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d72f8 [0133.834] SetLastError (dwErrCode=0x57) [0133.834] IcmpCreateFile () returned 0x7d1118 [0133.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2088 [0133.834] IcmpSendEcho2 (in: IcmpHandle=0x7d1118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3000a8c0, RequestData=0x21c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2088, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2088) returned 0x0 [0140.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2088 | out: hHeap=0x710000) returned 1 [0140.962] IcmpCloseHandle (IcmpHandle=0x7d1118) returned 1 [0140.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d72f8 | out: hHeap=0x710000) returned 1 Thread: id = 428 os_tid = 0x1488 [0133.835] GetLastError () returned 0x57 [0133.835] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7680 [0133.835] SetLastError (dwErrCode=0x57) [0133.835] IcmpCreateFile () returned 0x7d1150 [0133.835] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d20d8 [0133.835] IcmpSendEcho2 (in: IcmpHandle=0x7d1150, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3100a8c0, RequestData=0x21dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d20d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d20d8) returned 0x0 [0140.968] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x710000) returned 1 [0140.968] IcmpCloseHandle (IcmpHandle=0x7d1150) returned 1 [0140.969] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d7680 | out: hHeap=0x710000) returned 1 Thread: id = 429 os_tid = 0x148c [0133.836] GetLastError () returned 0x57 [0133.836] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7a08 [0133.836] SetLastError (dwErrCode=0x57) [0133.836] IcmpCreateFile () returned 0x7d1188 [0133.836] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2128 [0133.836] IcmpSendEcho2 (in: IcmpHandle=0x7d1188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3200a8c0, RequestData=0x21efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2128, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2128) returned 0x0 [0140.975] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2128 | out: hHeap=0x710000) returned 1 [0140.975] IcmpCloseHandle (IcmpHandle=0x7d1188) returned 1 [0140.976] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d7a08 | out: hHeap=0x710000) returned 1 Thread: id = 430 os_tid = 0x1490 [0133.837] GetLastError () returned 0x57 [0133.837] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7d90 [0133.837] SetLastError (dwErrCode=0x57) [0133.837] IcmpCreateFile () returned 0x7d11c0 [0133.837] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2178 [0133.837] IcmpSendEcho2 (in: IcmpHandle=0x7d11c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3300a8c0, RequestData=0x2203ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2178, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2178) returned 0x0 [0140.992] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2178 | out: hHeap=0x710000) returned 1 [0140.995] IcmpCloseHandle (IcmpHandle=0x7d11c0) returned 1 [0140.996] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d7d90 | out: hHeap=0x710000) returned 1 Thread: id = 431 os_tid = 0x1494 [0133.838] GetLastError () returned 0x57 [0133.838] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8118 [0133.838] SetLastError (dwErrCode=0x57) [0133.838] IcmpCreateFile () returned 0x7d11f8 [0133.839] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d21c8 [0133.839] IcmpSendEcho2 (in: IcmpHandle=0x7d11f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3400a8c0, RequestData=0x2217ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d21c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d21c8) returned 0x0 [0141.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d21c8 | out: hHeap=0x710000) returned 1 [0141.005] IcmpCloseHandle (IcmpHandle=0x7d11f8) returned 1 [0141.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8118 | out: hHeap=0x710000) returned 1 Thread: id = 432 os_tid = 0x1498 [0133.839] GetLastError () returned 0x57 [0133.840] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d84a0 [0133.840] SetLastError (dwErrCode=0x57) [0133.840] IcmpCreateFile () returned 0x7d1230 [0133.840] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2218 [0133.840] IcmpSendEcho2 (in: IcmpHandle=0x7d1230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3500a8c0, RequestData=0x222bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2218, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2218) returned 0x0 [0141.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2218 | out: hHeap=0x710000) returned 1 [0141.009] IcmpCloseHandle (IcmpHandle=0x7d1230) returned 1 [0141.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d84a0 | out: hHeap=0x710000) returned 1 Thread: id = 433 os_tid = 0x149c [0133.841] GetLastError () returned 0x57 [0133.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8828 [0133.841] SetLastError (dwErrCode=0x57) [0133.841] IcmpCreateFile () returned 0x7d1268 [0133.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2268 [0133.841] IcmpSendEcho2 (in: IcmpHandle=0x7d1268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3600a8c0, RequestData=0x223fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2268, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2268) returned 0x0 [0141.017] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2268 | out: hHeap=0x710000) returned 1 [0141.017] IcmpCloseHandle (IcmpHandle=0x7d1268) returned 1 [0141.017] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8828 | out: hHeap=0x710000) returned 1 Thread: id = 434 os_tid = 0x14a0 [0133.842] GetLastError () returned 0x57 [0133.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8bb0 [0133.842] SetLastError (dwErrCode=0x57) [0133.842] IcmpCreateFile () returned 0x7d19a0 [0133.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2678 [0133.842] IcmpSendEcho2 (in: IcmpHandle=0x7d19a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3700a8c0, RequestData=0x2253ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2678, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2678) returned 0x0 [0141.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2678 | out: hHeap=0x710000) returned 1 [0141.087] IcmpCloseHandle (IcmpHandle=0x7d19a0) returned 1 [0141.087] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8bb0 | out: hHeap=0x710000) returned 1 Thread: id = 435 os_tid = 0x14a4 [0133.843] GetLastError () returned 0x57 [0133.843] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d99d0 [0133.843] SetLastError (dwErrCode=0x57) [0133.843] IcmpCreateFile () returned 0x7d1c40 [0133.844] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d22b8 [0133.844] IcmpSendEcho2 (in: IcmpHandle=0x7d1c40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3800a8c0, RequestData=0x2267ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d22b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d22b8) returned 0x0 [0141.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d22b8 | out: hHeap=0x710000) returned 1 [0141.096] IcmpCloseHandle (IcmpHandle=0x7d1c40) returned 1 [0141.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d99d0 | out: hHeap=0x710000) returned 1 Thread: id = 436 os_tid = 0x14a8 [0133.845] GetLastError () returned 0x57 [0133.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d9d58 [0133.845] SetLastError (dwErrCode=0x57) [0133.845] IcmpCreateFile () returned 0x7d1c78 [0133.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2308 [0133.845] IcmpSendEcho2 (in: IcmpHandle=0x7d1c78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3900a8c0, RequestData=0x227bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2308, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2308) returned 0x0 [0141.115] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2308 | out: hHeap=0x710000) returned 1 [0141.115] IcmpCloseHandle (IcmpHandle=0x7d1c78) returned 1 [0141.116] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d9d58 | out: hHeap=0x710000) returned 1 Thread: id = 437 os_tid = 0x14ac [0133.846] GetLastError () returned 0x57 [0133.846] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da0e0 [0133.846] SetLastError (dwErrCode=0x57) [0133.846] IcmpCreateFile () returned 0x7d1cb0 [0133.846] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2358 [0133.846] IcmpSendEcho2 (in: IcmpHandle=0x7d1cb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3a00a8c0, RequestData=0x228fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2358, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2358) returned 0x0 [0141.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2358 | out: hHeap=0x710000) returned 1 [0141.130] IcmpCloseHandle (IcmpHandle=0x7d1cb0) returned 1 [0141.131] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7da0e0 | out: hHeap=0x710000) returned 1 Thread: id = 438 os_tid = 0x14b0 [0133.847] GetLastError () returned 0x57 [0133.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da468 [0133.847] SetLastError (dwErrCode=0x57) [0133.847] IcmpCreateFile () returned 0x7d1ce8 [0133.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d23a8 [0133.847] IcmpSendEcho2 (in: IcmpHandle=0x7d1ce8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3b00a8c0, RequestData=0x22a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d23a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d23a8) returned 0x0 [0141.147] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d23a8 | out: hHeap=0x710000) returned 1 [0141.147] IcmpCloseHandle (IcmpHandle=0x7d1ce8) returned 1 [0141.148] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7da468 | out: hHeap=0x710000) returned 1 Thread: id = 439 os_tid = 0x14b4 [0133.848] GetLastError () returned 0x57 [0133.849] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da7f0 [0133.849] SetLastError (dwErrCode=0x57) [0133.849] IcmpCreateFile () returned 0x7d1d20 [0133.849] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d23f8 [0133.849] IcmpSendEcho2 (in: IcmpHandle=0x7d1d20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3c00a8c0, RequestData=0x22b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d23f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d23f8) returned 0x0 [0141.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d23f8 | out: hHeap=0x710000) returned 1 [0141.194] IcmpCloseHandle (IcmpHandle=0x7d1d20) returned 1 [0141.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7da7f0 | out: hHeap=0x710000) returned 1 Thread: id = 440 os_tid = 0x14b8 [0133.850] GetLastError () returned 0x57 [0133.850] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dab78 [0133.850] SetLastError (dwErrCode=0x57) [0133.850] IcmpCreateFile () returned 0x7d1d58 [0133.850] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2448 [0133.850] IcmpSendEcho2 (in: IcmpHandle=0x7d1d58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3d00a8c0, RequestData=0x22cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2448, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2448) returned 0x0 [0141.221] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2448 | out: hHeap=0x710000) returned 1 [0141.222] IcmpCloseHandle (IcmpHandle=0x7d1d58) returned 1 [0141.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dab78 | out: hHeap=0x710000) returned 1 Thread: id = 441 os_tid = 0x14bc [0133.851] GetLastError () returned 0x57 [0133.851] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7daf00 [0133.851] SetLastError (dwErrCode=0x57) [0133.851] IcmpCreateFile () returned 0x7d1690 [0133.851] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2498 [0133.851] IcmpSendEcho2 (in: IcmpHandle=0x7d1690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3e00a8c0, RequestData=0x22dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2498, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2498) returned 0x0 [0141.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2498 | out: hHeap=0x710000) returned 1 [0141.259] IcmpCloseHandle (IcmpHandle=0x7d1690) returned 1 [0141.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7daf00 | out: hHeap=0x710000) returned 1 Thread: id = 442 os_tid = 0x14c0 [0133.852] GetLastError () returned 0x57 [0133.853] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db288 [0133.853] SetLastError (dwErrCode=0x57) [0133.853] IcmpCreateFile () returned 0x7d16c8 [0133.853] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d24e8 [0133.853] IcmpSendEcho2 (in: IcmpHandle=0x7d16c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3f00a8c0, RequestData=0x22f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d24e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d24e8) returned 0x0 [0141.267] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d24e8 | out: hHeap=0x710000) returned 1 [0141.268] IcmpCloseHandle (IcmpHandle=0x7d16c8) returned 1 [0141.268] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7db288 | out: hHeap=0x710000) returned 1 Thread: id = 443 os_tid = 0x14c4 [0133.854] GetLastError () returned 0x57 [0133.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db610 [0133.854] SetLastError (dwErrCode=0x57) [0133.854] IcmpCreateFile () returned 0x7d1700 [0133.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2538 [0133.854] IcmpSendEcho2 (in: IcmpHandle=0x7d1700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4000a8c0, RequestData=0x2307ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2538, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2538) returned 0x0 [0141.370] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2538 | out: hHeap=0x710000) returned 1 [0141.370] IcmpCloseHandle (IcmpHandle=0x7d1700) returned 1 [0141.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7db610 | out: hHeap=0x710000) returned 1 Thread: id = 444 os_tid = 0x14cc [0135.409] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0135.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0135.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f030c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0135.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0135.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0324, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0135.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0135.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f033c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0135.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0135.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0354, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0135.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0135.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f036c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0135.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0135.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0384, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0135.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0135.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f039c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0135.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0135.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0135.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0135.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0135.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0135.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0135.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0135.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0135.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0135.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0414, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0135.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0135.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f042c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0135.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0135.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0444, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0135.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0135.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f045c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0135.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0135.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0474, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0135.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0135.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f048c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0135.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0135.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0135.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0135.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0135.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0135.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0135.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0135.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0135.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0135.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0135.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0135.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f051c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0135.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0135.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0534, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0135.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0135.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f054c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0135.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0135.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0564, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0135.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0135.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f057c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0135.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0135.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0594, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0135.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0135.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0135.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0135.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0135.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0135.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0135.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0135.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0135.629] WaitForMultipleObjects (nCount=0x40, lpHandles=0x700000*=0x424, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0137.024] CloseHandle (hObject=0x424) returned 1 [0137.024] CloseHandle (hObject=0x42c) returned 1 [0137.024] CloseHandle (hObject=0x420) returned 1 [0137.024] CloseHandle (hObject=0x354) returned 1 [0137.024] CloseHandle (hObject=0x6c0) returned 1 [0137.024] CloseHandle (hObject=0x6bc) returned 1 [0137.024] CloseHandle (hObject=0x6b8) returned 1 [0137.025] CloseHandle (hObject=0x6b4) returned 1 [0137.025] CloseHandle (hObject=0x6b0) returned 1 [0137.025] CloseHandle (hObject=0x6ac) returned 1 [0137.025] CloseHandle (hObject=0x6a8) returned 1 [0137.025] CloseHandle (hObject=0x6a4) returned 1 [0137.025] CloseHandle (hObject=0x344) returned 1 [0137.025] CloseHandle (hObject=0x284) returned 1 [0137.025] CloseHandle (hObject=0x280) returned 1 [0137.025] CloseHandle (hObject=0x27c) returned 1 [0137.025] CloseHandle (hObject=0x278) returned 1 [0137.025] CloseHandle (hObject=0x274) returned 1 [0137.025] CloseHandle (hObject=0x270) returned 1 [0137.025] CloseHandle (hObject=0x26c) returned 1 [0137.025] CloseHandle (hObject=0x268) returned 1 [0137.025] CloseHandle (hObject=0x264) returned 1 [0137.025] CloseHandle (hObject=0x260) returned 1 [0137.025] CloseHandle (hObject=0x25c) returned 1 [0137.025] CloseHandle (hObject=0x258) returned 1 [0137.025] CloseHandle (hObject=0x254) returned 1 [0137.026] CloseHandle (hObject=0x250) returned 1 [0137.026] CloseHandle (hObject=0x24c) returned 1 [0137.026] CloseHandle (hObject=0x248) returned 1 [0137.026] CloseHandle (hObject=0x244) returned 1 [0137.026] CloseHandle (hObject=0x240) returned 1 [0137.026] CloseHandle (hObject=0x23c) returned 1 [0137.026] CloseHandle (hObject=0x238) returned 1 [0137.026] CloseHandle (hObject=0x234) returned 1 [0137.026] CloseHandle (hObject=0x230) returned 1 [0137.026] CloseHandle (hObject=0x22c) returned 1 [0137.026] CloseHandle (hObject=0x228) returned 1 [0137.026] CloseHandle (hObject=0x224) returned 1 [0137.026] CloseHandle (hObject=0x220) returned 1 [0137.026] CloseHandle (hObject=0x21c) returned 1 [0137.026] CloseHandle (hObject=0x218) returned 1 [0137.026] CloseHandle (hObject=0x214) returned 1 [0137.026] CloseHandle (hObject=0x210) returned 1 [0137.026] CloseHandle (hObject=0x694) returned 1 [0137.026] CloseHandle (hObject=0x66c) returned 1 [0137.026] CloseHandle (hObject=0x65c) returned 1 [0137.026] CloseHandle (hObject=0x304) returned 1 [0137.027] CloseHandle (hObject=0x4d8) returned 1 [0137.027] CloseHandle (hObject=0x928) returned 1 [0137.027] CloseHandle (hObject=0x3a8) returned 1 [0137.027] CloseHandle (hObject=0x3a4) returned 1 [0137.027] CloseHandle (hObject=0x3a0) returned 1 [0137.027] CloseHandle (hObject=0x39c) returned 1 [0137.027] CloseHandle (hObject=0x398) returned 1 [0137.027] CloseHandle (hObject=0x394) returned 1 [0137.027] CloseHandle (hObject=0x390) returned 1 [0137.027] CloseHandle (hObject=0x38c) returned 1 [0137.027] CloseHandle (hObject=0x388) returned 1 [0137.027] CloseHandle (hObject=0x384) returned 1 [0137.027] CloseHandle (hObject=0x380) returned 1 [0137.027] CloseHandle (hObject=0x37c) returned 1 [0137.027] CloseHandle (hObject=0xa04) returned 1 [0137.027] CloseHandle (hObject=0xa08) returned 1 [0137.027] CloseHandle (hObject=0xa0c) returned 1 [0137.027] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 445 os_tid = 0x14d0 [0135.501] GetLastError () returned 0x57 [0135.501] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db998 [0135.501] SetLastError (dwErrCode=0x57) [0135.501] IcmpCreateFile () returned 0x7d17a8 [0135.501] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2628 [0135.501] IcmpSendEcho2 (in: IcmpHandle=0x7d17a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4100a8c0, RequestData=0xb38ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2628, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2628) returned 0x0 [0141.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2628 | out: hHeap=0x710000) returned 1 [0141.477] IcmpCloseHandle (IcmpHandle=0x7d17a8) returned 1 [0141.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7db998 | out: hHeap=0x710000) returned 1 Thread: id = 446 os_tid = 0x14d4 [0135.503] GetLastError () returned 0x57 [0135.503] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dbd20 [0135.503] SetLastError (dwErrCode=0x57) [0135.503] IcmpCreateFile () returned 0x7d17e0 [0135.503] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d26c8 [0135.503] IcmpSendEcho2 (in: IcmpHandle=0x7d17e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4200a8c0, RequestData=0xb4cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d26c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d26c8) returned 0x0 [0141.530] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d26c8 | out: hHeap=0x710000) returned 1 [0141.530] IcmpCloseHandle (IcmpHandle=0x7d17e0) returned 1 [0141.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dbd20 | out: hHeap=0x710000) returned 1 Thread: id = 447 os_tid = 0x14d8 [0135.504] GetLastError () returned 0x57 [0135.505] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d4fa8 [0135.505] SetLastError (dwErrCode=0x57) [0135.505] IcmpCreateFile () returned 0x7d1818 [0135.505] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2718 [0135.505] IcmpSendEcho2 (in: IcmpHandle=0x7d1818, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4300a8c0, RequestData=0xb60ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2718, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2718) returned 0x0 [0141.623] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2718 | out: hHeap=0x710000) returned 1 [0141.623] IcmpCloseHandle (IcmpHandle=0x7d1818) returned 1 [0141.623] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d4fa8 | out: hHeap=0x710000) returned 1 Thread: id = 448 os_tid = 0x14dc [0135.506] GetLastError () returned 0x57 [0135.506] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5330 [0135.507] SetLastError (dwErrCode=0x57) [0135.507] IcmpCreateFile () returned 0x7d1850 [0135.507] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2768 [0135.507] IcmpSendEcho2 (in: IcmpHandle=0x7d1850, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4400a8c0, RequestData=0xb74ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2768, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2768) returned 0x0 [0141.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2768 | out: hHeap=0x710000) returned 1 [0141.736] IcmpCloseHandle (IcmpHandle=0x7d1850) returned 1 [0141.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d5330 | out: hHeap=0x710000) returned 1 Thread: id = 449 os_tid = 0x14e0 [0135.508] GetLastError () returned 0x57 [0135.508] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d56b8 [0135.508] SetLastError (dwErrCode=0x57) [0135.508] IcmpCreateFile () returned 0x7d1888 [0135.508] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d27b8 [0135.508] IcmpSendEcho2 (in: IcmpHandle=0x7d1888, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4500a8c0, RequestData=0xb88ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d27b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d27b8) returned 0x0 [0141.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d27b8 | out: hHeap=0x710000) returned 1 [0141.823] IcmpCloseHandle (IcmpHandle=0x7d1888) returned 1 [0141.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d56b8 | out: hHeap=0x710000) returned 1 Thread: id = 450 os_tid = 0x14e4 [0135.510] GetLastError () returned 0x57 [0135.510] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc430 [0135.510] SetLastError (dwErrCode=0x57) [0135.510] IcmpCreateFile () returned 0x7d18c0 [0135.510] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2808 [0135.510] IcmpSendEcho2 (in: IcmpHandle=0x7d18c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4600a8c0, RequestData=0xb9cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2808, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2808) returned 0x0 [0142.185] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2808 | out: hHeap=0x710000) returned 1 [0142.185] IcmpCloseHandle (IcmpHandle=0x7d18c0) returned 1 [0142.186] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dc430 | out: hHeap=0x710000) returned 1 Thread: id = 451 os_tid = 0x14e8 [0135.511] GetLastError () returned 0x57 [0135.511] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc7b8 [0135.511] SetLastError (dwErrCode=0x57) [0135.511] IcmpCreateFile () returned 0x7d18f8 [0135.511] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2858 [0135.512] IcmpSendEcho2 (in: IcmpHandle=0x7d18f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4700a8c0, RequestData=0xbb0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2858, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2858) returned 0x0 [0142.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2858 | out: hHeap=0x710000) returned 1 [0142.236] IcmpCloseHandle (IcmpHandle=0x7d18f8) returned 1 [0142.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dc7b8 | out: hHeap=0x710000) returned 1 Thread: id = 452 os_tid = 0x14ec [0135.513] GetLastError () returned 0x57 [0135.513] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dcb40 [0135.513] SetLastError (dwErrCode=0x57) [0135.513] IcmpCreateFile () returned 0x7d1930 [0135.513] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d28a8 [0135.513] IcmpSendEcho2 (in: IcmpHandle=0x7d1930, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4800a8c0, RequestData=0xbc4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d28a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d28a8) returned 0x0 [0142.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d28a8 | out: hHeap=0x710000) returned 1 [0142.269] IcmpCloseHandle (IcmpHandle=0x7d1930) returned 1 [0142.270] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dcb40 | out: hHeap=0x710000) returned 1 Thread: id = 453 os_tid = 0x14f0 [0135.514] GetLastError () returned 0x57 [0135.514] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc0a8 [0135.515] SetLastError (dwErrCode=0x57) [0135.515] IcmpCreateFile () returned 0x7d1968 [0135.515] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d28f8 [0135.515] IcmpSendEcho2 (in: IcmpHandle=0x7d1968, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4900a8c0, RequestData=0xbd8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d28f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d28f8) returned 0x0 [0142.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d28f8 | out: hHeap=0x710000) returned 1 [0142.305] IcmpCloseHandle (IcmpHandle=0x7d1968) returned 1 [0142.306] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dc0a8 | out: hHeap=0x710000) returned 1 Thread: id = 454 os_tid = 0x14f4 [0135.516] GetLastError () returned 0x57 [0135.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756c60 [0135.516] SetLastError (dwErrCode=0x57) [0135.516] IcmpCreateFile () returned 0x7d19d8 [0135.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2948 [0135.516] IcmpSendEcho2 (in: IcmpHandle=0x7d19d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4a00a8c0, RequestData=0xbecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2948, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2948) returned 0x0 [0142.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2948 | out: hHeap=0x710000) returned 1 [0142.346] IcmpCloseHandle (IcmpHandle=0x7d19d8) returned 1 [0142.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756c60 | out: hHeap=0x710000) returned 1 Thread: id = 455 os_tid = 0x14f8 [0135.518] GetLastError () returned 0x57 [0135.518] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756fe8 [0135.518] SetLastError (dwErrCode=0x57) [0135.518] IcmpCreateFile () returned 0x7d1a10 [0135.518] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d1f98 [0135.518] IcmpSendEcho2 (in: IcmpHandle=0x7d1a10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4b00a8c0, RequestData=0xc00ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d1f98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d1f98) returned 0x0 [0142.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d1f98 | out: hHeap=0x710000) returned 1 [0142.357] IcmpCloseHandle (IcmpHandle=0x7d1a10) returned 1 [0142.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756fe8 | out: hHeap=0x710000) returned 1 Thread: id = 456 os_tid = 0x14fc [0135.519] GetLastError () returned 0x57 [0135.519] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755730 [0135.520] SetLastError (dwErrCode=0x57) [0135.520] IcmpCreateFile () returned 0x7d1a48 [0135.520] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d1fe8 [0135.520] IcmpSendEcho2 (in: IcmpHandle=0x7d1a48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4c00a8c0, RequestData=0xc14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d1fe8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d1fe8) returned 0x0 [0142.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d1fe8 | out: hHeap=0x710000) returned 1 [0142.407] IcmpCloseHandle (IcmpHandle=0x7d1a48) returned 1 [0142.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755730 | out: hHeap=0x710000) returned 1 Thread: id = 457 os_tid = 0x1500 [0135.521] GetLastError () returned 0x57 [0135.521] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755ab8 [0135.521] SetLastError (dwErrCode=0x57) [0135.521] IcmpCreateFile () returned 0x7d1a80 [0135.521] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2038 [0135.521] IcmpSendEcho2 (in: IcmpHandle=0x7d1a80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4d00a8c0, RequestData=0xc28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2038, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2038) returned 0x0 [0142.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2038 | out: hHeap=0x710000) returned 1 [0142.499] IcmpCloseHandle (IcmpHandle=0x7d1a80) returned 1 [0142.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755ab8 | out: hHeap=0x710000) returned 1 Thread: id = 458 os_tid = 0x1504 [0135.523] GetLastError () returned 0x57 [0135.523] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755e40 [0135.523] SetLastError (dwErrCode=0x57) [0135.523] IcmpCreateFile () returned 0x7d1ab8 [0135.523] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2588 [0135.523] IcmpSendEcho2 (in: IcmpHandle=0x7d1ab8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4e00a8c0, RequestData=0xc3cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2588, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2588) returned 0x0 [0142.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2588 | out: hHeap=0x710000) returned 1 [0142.546] IcmpCloseHandle (IcmpHandle=0x7d1ab8) returned 1 [0142.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755e40 | out: hHeap=0x710000) returned 1 Thread: id = 459 os_tid = 0x1508 [0135.524] GetLastError () returned 0x57 [0135.524] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7561c8 [0135.524] SetLastError (dwErrCode=0x57) [0135.524] IcmpCreateFile () returned 0x7d1af0 [0135.524] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d25d8 [0135.525] IcmpSendEcho2 (in: IcmpHandle=0x7d1af0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4f00a8c0, RequestData=0xc50ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d25d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d25d8) returned 0x0 [0142.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d25d8 | out: hHeap=0x710000) returned 1 [0142.646] IcmpCloseHandle (IcmpHandle=0x7d1af0) returned 1 [0142.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7561c8 | out: hHeap=0x710000) returned 1 Thread: id = 460 os_tid = 0x150c [0135.526] GetLastError () returned 0x57 [0135.526] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756550 [0135.526] SetLastError (dwErrCode=0x57) [0135.526] IcmpCreateFile () returned 0x7d1b28 [0135.526] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7654c8 [0135.526] IcmpSendEcho2 (in: IcmpHandle=0x7d1b28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5000a8c0, RequestData=0xc64ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7654c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7654c8) returned 0x0 [0142.690] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7654c8 | out: hHeap=0x710000) returned 1 [0142.690] IcmpCloseHandle (IcmpHandle=0x7d1b28) returned 1 [0142.690] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756550 | out: hHeap=0x710000) returned 1 Thread: id = 461 os_tid = 0x1510 [0135.527] GetLastError () returned 0x57 [0135.527] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7568d8 [0135.527] SetLastError (dwErrCode=0x57) [0135.527] IcmpCreateFile () returned 0x7d1b60 [0135.528] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765568 [0135.528] IcmpSendEcho2 (in: IcmpHandle=0x7d1b60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5100a8c0, RequestData=0xc78ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765568, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765568) returned 0x0 [0142.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765568 | out: hHeap=0x710000) returned 1 [0142.702] IcmpCloseHandle (IcmpHandle=0x7d1b60) returned 1 [0142.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7568d8 | out: hHeap=0x710000) returned 1 Thread: id = 462 os_tid = 0x1514 [0135.529] GetLastError () returned 0x57 [0135.529] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749010 [0135.529] SetLastError (dwErrCode=0x57) [0135.529] IcmpCreateFile () returned 0x7d1b98 [0135.529] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7655b8 [0135.529] IcmpSendEcho2 (in: IcmpHandle=0x7d1b98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5200a8c0, RequestData=0xc8cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7655b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7655b8) returned 0x0 [0142.743] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7655b8 | out: hHeap=0x710000) returned 1 [0142.743] IcmpCloseHandle (IcmpHandle=0x7d1b98) returned 1 [0142.744] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749010 | out: hHeap=0x710000) returned 1 Thread: id = 463 os_tid = 0x1518 [0135.530] GetLastError () returned 0x57 [0135.530] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7481f0 [0135.531] SetLastError (dwErrCode=0x57) [0135.531] IcmpCreateFile () returned 0x7d1bd0 [0135.531] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765608 [0135.531] IcmpSendEcho2 (in: IcmpHandle=0x7d1bd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5300a8c0, RequestData=0xca0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765608, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765608) returned 0x0 [0142.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765608 | out: hHeap=0x710000) returned 1 [0142.791] IcmpCloseHandle (IcmpHandle=0x7d1bd0) returned 1 [0142.792] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7481f0 | out: hHeap=0x710000) returned 1 Thread: id = 464 os_tid = 0x151c [0135.532] GetLastError () returned 0x57 [0135.532] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x748578 [0135.532] SetLastError (dwErrCode=0x57) [0135.532] IcmpCreateFile () returned 0x7d1c08 [0135.532] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765658 [0135.532] IcmpSendEcho2 (in: IcmpHandle=0x7d1c08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5400a8c0, RequestData=0xcb4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765658, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765658) returned 0x0 [0142.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765658 | out: hHeap=0x710000) returned 1 [0142.807] IcmpCloseHandle (IcmpHandle=0x7d1c08) returned 1 [0142.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x748578 | out: hHeap=0x710000) returned 1 Thread: id = 465 os_tid = 0x1520 [0135.534] GetLastError () returned 0x57 [0135.534] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x748900 [0135.534] SetLastError (dwErrCode=0x57) [0135.534] IcmpCreateFile () returned 0x7d1738 [0135.534] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7656a8 [0135.534] IcmpSendEcho2 (in: IcmpHandle=0x7d1738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5500a8c0, RequestData=0xcc8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7656a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7656a8) returned 0x0 [0142.848] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7656a8 | out: hHeap=0x710000) returned 1 [0142.848] IcmpCloseHandle (IcmpHandle=0x7d1738) returned 1 [0142.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x748900 | out: hHeap=0x710000) returned 1 Thread: id = 466 os_tid = 0x1524 [0135.535] GetLastError () returned 0x57 [0135.535] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x748c88 [0135.535] SetLastError (dwErrCode=0x57) [0135.535] IcmpCreateFile () returned 0x7d1770 [0135.535] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7656f8 [0135.535] IcmpSendEcho2 (in: IcmpHandle=0x7d1770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5600a8c0, RequestData=0xcdcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7656f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7656f8) returned 0x0 [0142.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7656f8 | out: hHeap=0x710000) returned 1 [0142.892] IcmpCloseHandle (IcmpHandle=0x7d1770) returned 1 [0142.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x748c88 | out: hHeap=0x710000) returned 1 Thread: id = 467 os_tid = 0x1528 [0135.537] GetLastError () returned 0x57 [0135.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749398 [0135.537] SetLastError (dwErrCode=0x57) [0135.537] IcmpCreateFile () returned 0x7d1dc8 [0135.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765748 [0135.537] IcmpSendEcho2 (in: IcmpHandle=0x7d1dc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5700a8c0, RequestData=0xcf0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765748, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765748) returned 0x0 [0142.908] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765748 | out: hHeap=0x710000) returned 1 [0142.908] IcmpCloseHandle (IcmpHandle=0x7d1dc8) returned 1 [0142.908] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749398 | out: hHeap=0x710000) returned 1 Thread: id = 468 os_tid = 0x152c [0135.538] GetLastError () returned 0x57 [0135.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749720 [0135.539] SetLastError (dwErrCode=0x57) [0135.539] IcmpCreateFile () returned 0x7d1e00 [0135.539] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765798 [0135.539] IcmpSendEcho2 (in: IcmpHandle=0x7d1e00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5800a8c0, RequestData=0xd04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765798, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765798) returned 0x0 [0142.960] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765798 | out: hHeap=0x710000) returned 1 [0142.960] IcmpCloseHandle (IcmpHandle=0x7d1e00) returned 1 [0142.960] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749720 | out: hHeap=0x710000) returned 1 Thread: id = 469 os_tid = 0x1530 [0135.540] GetLastError () returned 0x57 [0135.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749aa8 [0135.540] SetLastError (dwErrCode=0x57) [0135.540] IcmpCreateFile () returned 0x7d1e38 [0135.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ed8 [0135.540] IcmpSendEcho2 (in: IcmpHandle=0x7d1e38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5900a8c0, RequestData=0xd18ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ed8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ed8) returned 0x0 [0142.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ed8 | out: hHeap=0x710000) returned 1 [0142.979] IcmpCloseHandle (IcmpHandle=0x7d1e38) returned 1 [0142.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749aa8 | out: hHeap=0x710000) returned 1 Thread: id = 470 os_tid = 0x1534 [0135.542] GetLastError () returned 0x57 [0135.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x749e30 [0135.542] SetLastError (dwErrCode=0x57) [0135.542] IcmpCreateFile () returned 0x7d1e70 [0135.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764f28 [0135.542] IcmpSendEcho2 (in: IcmpHandle=0x7d1e70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5a00a8c0, RequestData=0xd2cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764f28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764f28) returned 0x0 [0143.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764f28 | out: hHeap=0x710000) returned 1 [0143.019] IcmpCloseHandle (IcmpHandle=0x7d1e70) returned 1 [0143.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x749e30 | out: hHeap=0x710000) returned 1 Thread: id = 471 os_tid = 0x1538 [0135.544] GetLastError () returned 0x57 [0135.544] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x74a1b8 [0135.545] SetLastError (dwErrCode=0x57) [0135.545] IcmpCreateFile () returned 0x7d1ea8 [0135.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764f78 [0135.545] IcmpSendEcho2 (in: IcmpHandle=0x7d1ea8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5b00a8c0, RequestData=0xd40ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764f78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764f78) returned 0x0 [0143.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764f78 | out: hHeap=0x710000) returned 1 [0143.072] IcmpCloseHandle (IcmpHandle=0x7d1ea8) returned 1 [0143.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74a1b8 | out: hHeap=0x710000) returned 1 Thread: id = 472 os_tid = 0x153c [0135.546] GetLastError () returned 0x57 [0135.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x74a540 [0135.546] SetLastError (dwErrCode=0x57) [0135.546] IcmpCreateFile () returned 0x7d1ee0 [0135.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764fc8 [0135.546] IcmpSendEcho2 (in: IcmpHandle=0x7d1ee0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5c00a8c0, RequestData=0xd54ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764fc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764fc8) returned 0x0 [0143.121] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764fc8 | out: hHeap=0x710000) returned 1 [0143.122] IcmpCloseHandle (IcmpHandle=0x7d1ee0) returned 1 [0143.122] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74a540 | out: hHeap=0x710000) returned 1 Thread: id = 473 os_tid = 0x1540 [0135.547] GetLastError () returned 0x57 [0135.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x74a8c8 [0135.548] SetLastError (dwErrCode=0x57) [0135.548] IcmpCreateFile () returned 0x7d1f18 [0135.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765018 [0135.548] IcmpSendEcho2 (in: IcmpHandle=0x7d1f18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5d00a8c0, RequestData=0xd68ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765018, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765018) returned 0x0 [0143.181] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765018 | out: hHeap=0x710000) returned 1 [0143.181] IcmpCloseHandle (IcmpHandle=0x7d1f18) returned 1 [0143.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74a8c8 | out: hHeap=0x710000) returned 1 Thread: id = 474 os_tid = 0x1544 [0135.549] GetLastError () returned 0x57 [0135.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x746cc0 [0135.549] SetLastError (dwErrCode=0x57) [0135.549] IcmpCreateFile () returned 0x7d1d90 [0135.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765068 [0135.549] IcmpSendEcho2 (in: IcmpHandle=0x7d1d90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5e00a8c0, RequestData=0xd7cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765068, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765068) returned 0x0 [0143.230] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765068 | out: hHeap=0x710000) returned 1 [0143.230] IcmpCloseHandle (IcmpHandle=0x7d1d90) returned 1 [0143.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x746cc0 | out: hHeap=0x710000) returned 1 Thread: id = 475 os_tid = 0x1548 [0135.551] GetLastError () returned 0x57 [0135.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747048 [0135.551] SetLastError (dwErrCode=0x57) [0135.551] IcmpCreateFile () returned 0x74edf0 [0135.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7650b8 [0135.551] IcmpSendEcho2 (in: IcmpHandle=0x74edf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5f00a8c0, RequestData=0xd90ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7650b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7650b8) returned 0x0 [0143.255] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7650b8 | out: hHeap=0x710000) returned 1 [0143.255] IcmpCloseHandle (IcmpHandle=0x74edf0) returned 1 [0143.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747048 | out: hHeap=0x710000) returned 1 Thread: id = 476 os_tid = 0x154c [0135.559] GetLastError () returned 0x57 [0135.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7473d0 [0135.559] SetLastError (dwErrCode=0x57) [0135.559] IcmpCreateFile () returned 0x74efe8 [0135.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7649d8 [0135.559] IcmpSendEcho2 (in: IcmpHandle=0x74efe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6000a8c0, RequestData=0xda4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7649d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7649d8) returned 0x0 [0143.282] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7649d8 | out: hHeap=0x710000) returned 1 [0143.283] IcmpCloseHandle (IcmpHandle=0x74efe8) returned 1 [0143.284] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7473d0 | out: hHeap=0x710000) returned 1 Thread: id = 477 os_tid = 0x1550 [0135.563] GetLastError () returned 0x57 [0135.563] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747758 [0135.563] SetLastError (dwErrCode=0x57) [0135.563] IcmpCreateFile () returned 0x74f020 [0135.563] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764a28 [0135.563] IcmpSendEcho2 (in: IcmpHandle=0x74f020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6100a8c0, RequestData=0xdb8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764a28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764a28) returned 0x0 [0143.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764a28 | out: hHeap=0x710000) returned 1 [0143.334] IcmpCloseHandle (IcmpHandle=0x74f020) returned 1 [0143.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747758 | out: hHeap=0x710000) returned 1 Thread: id = 478 os_tid = 0x1554 [0135.564] GetLastError () returned 0x57 [0135.564] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747e68 [0135.565] SetLastError (dwErrCode=0x57) [0135.565] IcmpCreateFile () returned 0x74efb0 [0135.565] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7651f8 [0135.565] IcmpSendEcho2 (in: IcmpHandle=0x74efb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6200a8c0, RequestData=0xdccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7651f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7651f8) returned 0x0 [0143.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7651f8 | out: hHeap=0x710000) returned 1 [0143.361] IcmpCloseHandle (IcmpHandle=0x74efb0) returned 1 [0143.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747e68 | out: hHeap=0x710000) returned 1 Thread: id = 479 os_tid = 0x1558 [0135.566] GetLastError () returned 0x57 [0135.566] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x747ae0 [0135.566] SetLastError (dwErrCode=0x57) [0135.566] IcmpCreateFile () returned 0x74f058 [0135.566] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765248 [0135.566] IcmpSendEcho2 (in: IcmpHandle=0x74f058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6300a8c0, RequestData=0xde0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765248, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765248) returned 0x0 [0143.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765248 | out: hHeap=0x710000) returned 1 [0143.408] IcmpCloseHandle (IcmpHandle=0x74f058) returned 1 [0143.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x747ae0 | out: hHeap=0x710000) returned 1 Thread: id = 480 os_tid = 0x155c [0135.568] GetLastError () returned 0x57 [0135.568] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ebc28 [0135.571] SetLastError (dwErrCode=0x57) [0135.571] IcmpCreateFile () returned 0x74f090 [0135.571] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765298 [0135.571] IcmpSendEcho2 (in: IcmpHandle=0x74f090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6400a8c0, RequestData=0xdf4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765298, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765298) returned 0x0 [0143.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765298 | out: hHeap=0x710000) returned 1 [0143.540] IcmpCloseHandle (IcmpHandle=0x74f090) returned 1 [0143.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ebc28 | out: hHeap=0x710000) returned 1 Thread: id = 481 os_tid = 0x1560 [0135.572] GetLastError () returned 0x57 [0135.572] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eaa80 [0135.572] SetLastError (dwErrCode=0x57) [0135.572] IcmpCreateFile () returned 0x74f100 [0135.572] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764b68 [0135.573] IcmpSendEcho2 (in: IcmpHandle=0x74f100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6500a8c0, RequestData=0xe08ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764b68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764b68) returned 0x0 [0143.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764b68 | out: hHeap=0x710000) returned 1 [0143.861] IcmpCloseHandle (IcmpHandle=0x74f100) returned 1 [0143.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eaa80 | out: hHeap=0x710000) returned 1 Thread: id = 482 os_tid = 0x1564 [0135.574] GetLastError () returned 0x57 [0135.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eae08 [0135.574] SetLastError (dwErrCode=0x57) [0135.574] IcmpCreateFile () returned 0x74f138 [0135.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764bb8 [0135.574] IcmpSendEcho2 (in: IcmpHandle=0x74f138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6600a8c0, RequestData=0xe1cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764bb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764bb8) returned 0x0 [0143.908] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764bb8 | out: hHeap=0x710000) returned 1 [0143.908] IcmpCloseHandle (IcmpHandle=0x74f138) returned 1 [0143.909] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eae08 | out: hHeap=0x710000) returned 1 Thread: id = 483 os_tid = 0x1568 [0135.575] GetLastError () returned 0x57 [0135.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb190 [0135.576] SetLastError (dwErrCode=0x57) [0135.576] IcmpCreateFile () returned 0x74f170 [0135.576] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764c08 [0135.576] IcmpSendEcho2 (in: IcmpHandle=0x74f170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6700a8c0, RequestData=0xe30ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764c08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764c08) returned 0x0 [0144.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764c08 | out: hHeap=0x710000) returned 1 [0144.032] IcmpCloseHandle (IcmpHandle=0x74f170) returned 1 [0144.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eb190 | out: hHeap=0x710000) returned 1 Thread: id = 484 os_tid = 0x156c [0135.577] GetLastError () returned 0x57 [0135.577] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb518 [0135.577] SetLastError (dwErrCode=0x57) [0135.577] IcmpCreateFile () returned 0x74f1a8 [0135.577] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764c58 [0135.577] IcmpSendEcho2 (in: IcmpHandle=0x74f1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6800a8c0, RequestData=0xe44ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764c58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764c58) returned 0x0 [0144.148] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764c58 | out: hHeap=0x710000) returned 1 [0144.149] IcmpCloseHandle (IcmpHandle=0x74f1a8) returned 1 [0144.149] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eb518 | out: hHeap=0x710000) returned 1 Thread: id = 485 os_tid = 0x1570 [0135.578] GetLastError () returned 0x57 [0135.578] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb8a0 [0135.579] SetLastError (dwErrCode=0x57) [0135.579] IcmpCreateFile () returned 0x74f1e0 [0135.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ca8 [0135.579] IcmpSendEcho2 (in: IcmpHandle=0x74f1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6900a8c0, RequestData=0xe58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ca8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ca8) returned 0x0 [0144.204] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ca8 | out: hHeap=0x710000) returned 1 [0144.204] IcmpCloseHandle (IcmpHandle=0x74f1e0) returned 1 [0144.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eb8a0 | out: hHeap=0x710000) returned 1 Thread: id = 486 os_tid = 0x1574 [0135.580] GetLastError () returned 0x57 [0135.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ebfb0 [0135.580] SetLastError (dwErrCode=0x57) [0135.580] IcmpCreateFile () returned 0x74f218 [0135.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764cf8 [0135.580] IcmpSendEcho2 (in: IcmpHandle=0x74f218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6a00a8c0, RequestData=0xe6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764cf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764cf8) returned 0x0 [0144.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764cf8 | out: hHeap=0x710000) returned 1 [0144.326] IcmpCloseHandle (IcmpHandle=0x74f218) returned 1 [0144.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ebfb0 | out: hHeap=0x710000) returned 1 Thread: id = 487 os_tid = 0x1578 [0135.581] GetLastError () returned 0x57 [0135.582] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ec338 [0135.582] SetLastError (dwErrCode=0x57) [0135.582] IcmpCreateFile () returned 0x74f250 [0135.582] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764d48 [0135.582] IcmpSendEcho2 (in: IcmpHandle=0x74f250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6b00a8c0, RequestData=0xe80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764d48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764d48) returned 0x0 [0144.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764d48 | out: hHeap=0x710000) returned 1 [0144.375] IcmpCloseHandle (IcmpHandle=0x74f250) returned 1 [0144.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ec338 | out: hHeap=0x710000) returned 1 Thread: id = 488 os_tid = 0x157c [0135.583] GetLastError () returned 0x57 [0135.583] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ec6c0 [0135.583] SetLastError (dwErrCode=0x57) [0135.584] IcmpCreateFile () returned 0x74f368 [0135.584] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764d98 [0135.584] IcmpSendEcho2 (in: IcmpHandle=0x74f368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6c00a8c0, RequestData=0xe94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764d98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764d98) returned 0x0 [0144.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764d98 | out: hHeap=0x710000) returned 1 [0144.468] IcmpCloseHandle (IcmpHandle=0x74f368) returned 1 [0144.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ec6c0 | out: hHeap=0x710000) returned 1 Thread: id = 489 os_tid = 0x1580 [0135.585] GetLastError () returned 0x57 [0135.585] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eca48 [0135.585] SetLastError (dwErrCode=0x57) [0135.585] IcmpCreateFile () returned 0x74f3a0 [0135.585] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764de8 [0135.585] IcmpSendEcho2 (in: IcmpHandle=0x74f3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6d00a8c0, RequestData=0xea8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764de8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764de8) returned 0x0 [0144.529] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764de8 | out: hHeap=0x710000) returned 1 [0144.529] IcmpCloseHandle (IcmpHandle=0x74f3a0) returned 1 [0144.530] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eca48 | out: hHeap=0x710000) returned 1 Thread: id = 490 os_tid = 0x1584 [0135.586] GetLastError () returned 0x57 [0135.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ecdd0 [0135.587] SetLastError (dwErrCode=0x57) [0135.587] IcmpCreateFile () returned 0x74ecd8 [0135.587] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764e38 [0135.587] IcmpSendEcho2 (in: IcmpHandle=0x74ecd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6e00a8c0, RequestData=0xebcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764e38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764e38) returned 0x0 [0144.582] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764e38 | out: hHeap=0x710000) returned 1 [0144.583] IcmpCloseHandle (IcmpHandle=0x74ecd8) returned 1 [0144.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ecdd0 | out: hHeap=0x710000) returned 1 Thread: id = 491 os_tid = 0x1588 [0135.588] GetLastError () returned 0x57 [0135.588] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed158 [0135.588] SetLastError (dwErrCode=0x57) [0135.588] IcmpCreateFile () returned 0x74ed10 [0135.588] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764e88 [0135.588] IcmpSendEcho2 (in: IcmpHandle=0x74ed10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6f00a8c0, RequestData=0x231bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764e88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764e88) returned 0x0 [0144.626] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764e88 | out: hHeap=0x710000) returned 1 [0144.626] IcmpCloseHandle (IcmpHandle=0x74ed10) returned 1 [0144.627] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ed158 | out: hHeap=0x710000) returned 1 Thread: id = 492 os_tid = 0x158c [0135.614] GetLastError () returned 0x57 [0135.614] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed4e0 [0135.614] SetLastError (dwErrCode=0x57) [0135.614] IcmpCreateFile () returned 0x74ed48 [0135.614] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765108 [0135.615] IcmpSendEcho2 (in: IcmpHandle=0x74ed48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7000a8c0, RequestData=0x232fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765108, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765108) returned 0x0 [0144.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765108 | out: hHeap=0x710000) returned 1 [0144.687] IcmpCloseHandle (IcmpHandle=0x74ed48) returned 1 [0144.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ed4e0 | out: hHeap=0x710000) returned 1 Thread: id = 493 os_tid = 0x1590 [0135.616] GetLastError () returned 0x57 [0135.616] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed868 [0135.616] SetLastError (dwErrCode=0x57) [0135.616] IcmpCreateFile () returned 0x74ed80 [0135.616] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765158 [0135.617] IcmpSendEcho2 (in: IcmpHandle=0x74ed80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7100a8c0, RequestData=0x2343ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765158, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765158) returned 0x0 [0144.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765158 | out: hHeap=0x710000) returned 1 [0144.741] IcmpCloseHandle (IcmpHandle=0x74ed80) returned 1 [0144.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ed868 | out: hHeap=0x710000) returned 1 Thread: id = 494 os_tid = 0x1594 [0135.677] GetLastError () returned 0x57 [0135.677] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7edbf0 [0135.678] SetLastError (dwErrCode=0x57) [0135.678] IcmpCreateFile () returned 0x74edb8 [0135.678] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7651a8 [0135.678] IcmpSendEcho2 (in: IcmpHandle=0x74edb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7200a8c0, RequestData=0x2357ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7651a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7651a8) returned 0x0 [0144.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7651a8 | out: hHeap=0x710000) returned 1 [0144.756] IcmpCloseHandle (IcmpHandle=0x74edb8) returned 1 [0144.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7edbf0 | out: hHeap=0x710000) returned 1 Thread: id = 495 os_tid = 0x1598 [0135.679] GetLastError () returned 0x57 [0135.679] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7edf78 [0135.680] SetLastError (dwErrCode=0x57) [0135.680] IcmpCreateFile () returned 0x74ee28 [0135.680] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7648e8 [0135.680] IcmpSendEcho2 (in: IcmpHandle=0x74ee28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7300a8c0, RequestData=0xb14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7648e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7648e8) returned 0x0 [0144.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7648e8 | out: hHeap=0x710000) returned 1 [0144.763] IcmpCloseHandle (IcmpHandle=0x74ee28) returned 1 [0144.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7edf78 | out: hHeap=0x710000) returned 1 Thread: id = 496 os_tid = 0x159c [0135.681] GetLastError () returned 0x57 [0135.681] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ee300 [0135.681] SetLastError (dwErrCode=0x57) [0135.681] IcmpCreateFile () returned 0x74ee60 [0135.681] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764938 [0135.681] IcmpSendEcho2 (in: IcmpHandle=0x74ee60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7400a8c0, RequestData=0x236bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764938, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764938) returned 0x0 [0144.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764938 | out: hHeap=0x710000) returned 1 [0144.819] IcmpCloseHandle (IcmpHandle=0x74ee60) returned 1 [0144.820] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ee300 | out: hHeap=0x710000) returned 1 Thread: id = 497 os_tid = 0x15a0 [0135.683] GetLastError () returned 0x57 [0135.683] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ee688 [0135.683] SetLastError (dwErrCode=0x57) [0135.683] IcmpCreateFile () returned 0x74f0c8 [0135.683] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764988 [0135.683] IcmpSendEcho2 (in: IcmpHandle=0x74f0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7500a8c0, RequestData=0x237fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764988, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764988) returned 0x0 [0144.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764988 | out: hHeap=0x710000) returned 1 [0144.847] IcmpCloseHandle (IcmpHandle=0x74f0c8) returned 1 [0144.848] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ee688 | out: hHeap=0x710000) returned 1 Thread: id = 498 os_tid = 0x15a4 [0135.684] GetLastError () returned 0x57 [0135.685] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eea10 [0135.685] SetLastError (dwErrCode=0x57) [0135.685] IcmpCreateFile () returned 0x728ba8 [0135.685] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764a78 [0135.685] IcmpSendEcho2 (in: IcmpHandle=0x728ba8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7600a8c0, RequestData=0x2393ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764a78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764a78) returned 0x0 [0144.932] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764a78 | out: hHeap=0x710000) returned 1 [0144.932] IcmpCloseHandle (IcmpHandle=0x728ba8) returned 1 [0144.932] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eea10 | out: hHeap=0x710000) returned 1 Thread: id = 499 os_tid = 0x15a8 [0135.686] GetLastError () returned 0x57 [0135.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eed98 [0135.686] SetLastError (dwErrCode=0x57) [0135.686] IcmpCreateFile () returned 0x728c18 [0135.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ac8 [0135.686] IcmpSendEcho2 (in: IcmpHandle=0x728c18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7700a8c0, RequestData=0x23a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ac8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ac8) returned 0x0 [0144.935] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ac8 | out: hHeap=0x710000) returned 1 [0144.935] IcmpCloseHandle (IcmpHandle=0x728c18) returned 1 [0144.936] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eed98 | out: hHeap=0x710000) returned 1 Thread: id = 500 os_tid = 0x15ac [0135.688] GetLastError () returned 0x57 [0135.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef120 [0135.688] SetLastError (dwErrCode=0x57) [0135.688] IcmpCreateFile () returned 0x728cc0 [0135.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764b18 [0135.688] IcmpSendEcho2 (in: IcmpHandle=0x728cc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7800a8c0, RequestData=0x23bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764b18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764b18) returned 0x0 [0144.944] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764b18 | out: hHeap=0x710000) returned 1 [0144.944] IcmpCloseHandle (IcmpHandle=0x728cc0) returned 1 [0144.944] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ef120 | out: hHeap=0x710000) returned 1 Thread: id = 501 os_tid = 0x15b0 [0135.689] GetLastError () returned 0x57 [0135.690] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef4a8 [0135.690] SetLastError (dwErrCode=0x57) [0135.690] IcmpCreateFile () returned 0x728cf8 [0135.690] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e198 [0135.690] IcmpSendEcho2 (in: IcmpHandle=0x728cf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7900a8c0, RequestData=0x23cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e198) returned 0x0 [0144.949] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e198 | out: hHeap=0x710000) returned 1 [0144.949] IcmpCloseHandle (IcmpHandle=0x728cf8) returned 1 [0144.950] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ef4a8 | out: hHeap=0x710000) returned 1 Thread: id = 502 os_tid = 0x15b4 [0135.691] GetLastError () returned 0x57 [0135.691] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef830 [0135.691] SetLastError (dwErrCode=0x57) [0135.691] IcmpCreateFile () returned 0x728d30 [0135.691] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df18 [0135.691] IcmpSendEcho2 (in: IcmpHandle=0x728d30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7a00a8c0, RequestData=0x23e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df18) returned 0x0 [0144.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df18 | out: hHeap=0x710000) returned 1 [0144.955] IcmpCloseHandle (IcmpHandle=0x728d30) returned 1 [0144.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ef830 | out: hHeap=0x710000) returned 1 Thread: id = 503 os_tid = 0x15b8 [0135.693] GetLastError () returned 0x57 [0135.693] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7efbb8 [0135.693] SetLastError (dwErrCode=0x57) [0135.693] IcmpCreateFile () returned 0x728d68 [0135.693] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df68 [0135.694] IcmpSendEcho2 (in: IcmpHandle=0x728d68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7b00a8c0, RequestData=0x23f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df68) returned 0x0 [0145.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df68 | out: hHeap=0x710000) returned 1 [0145.050] IcmpCloseHandle (IcmpHandle=0x728d68) returned 1 [0145.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7efbb8 | out: hHeap=0x710000) returned 1 Thread: id = 504 os_tid = 0x15bc [0135.695] GetLastError () returned 0x57 [0135.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eff40 [0135.695] SetLastError (dwErrCode=0x57) [0135.695] IcmpCreateFile () returned 0x728da0 [0135.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dfb8 [0135.695] IcmpSendEcho2 (in: IcmpHandle=0x728da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7c00a8c0, RequestData=0x240bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dfb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dfb8) returned 0x0 [0145.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dfb8 | out: hHeap=0x710000) returned 1 [0145.177] IcmpCloseHandle (IcmpHandle=0x728da0) returned 1 [0145.178] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eff40 | out: hHeap=0x710000) returned 1 Thread: id = 505 os_tid = 0x15c0 [0135.696] GetLastError () returned 0x57 [0135.696] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f02c8 [0135.697] SetLastError (dwErrCode=0x57) [0135.697] IcmpCreateFile () returned 0x7286d8 [0135.697] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e008 [0135.697] IcmpSendEcho2 (in: IcmpHandle=0x7286d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7d00a8c0, RequestData=0x241fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e008, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e008) returned 0x0 [0145.624] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e008 | out: hHeap=0x710000) returned 1 [0145.624] IcmpCloseHandle (IcmpHandle=0x7286d8) returned 1 [0145.625] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f02c8 | out: hHeap=0x710000) returned 1 Thread: id = 506 os_tid = 0x15c4 [0135.698] GetLastError () returned 0x57 [0135.698] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f0650 [0135.698] SetLastError (dwErrCode=0x57) [0135.698] IcmpCreateFile () returned 0x728748 [0135.698] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c878 [0135.698] IcmpSendEcho2 (in: IcmpHandle=0x728748, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7e00a8c0, RequestData=0x2433ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c878, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c878) returned 0x0 [0145.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c878 | out: hHeap=0x710000) returned 1 [0145.632] IcmpCloseHandle (IcmpHandle=0x728748) returned 1 [0145.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f0650 | out: hHeap=0x710000) returned 1 Thread: id = 507 os_tid = 0x15c8 [0135.700] GetLastError () returned 0x57 [0135.700] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f09d8 [0135.700] SetLastError (dwErrCode=0x57) [0135.700] IcmpCreateFile () returned 0x728780 [0135.700] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c6e8 [0135.700] IcmpSendEcho2 (in: IcmpHandle=0x728780, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7f00a8c0, RequestData=0x2447ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c6e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c6e8) returned 0x0 [0145.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c6e8 | out: hHeap=0x710000) returned 1 [0145.635] IcmpCloseHandle (IcmpHandle=0x728780) returned 1 [0145.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f09d8 | out: hHeap=0x710000) returned 1 Thread: id = 508 os_tid = 0x15cc [0135.701] GetLastError () returned 0x57 [0135.701] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f0d60 [0135.701] SetLastError (dwErrCode=0x57) [0135.702] IcmpCreateFile () returned 0x728828 [0135.702] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c738 [0135.702] IcmpSendEcho2 (in: IcmpHandle=0x728828, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8000a8c0, RequestData=0x245bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c738, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c738) returned 0x0 [0145.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c738 | out: hHeap=0x710000) returned 1 [0145.641] IcmpCloseHandle (IcmpHandle=0x728828) returned 1 [0145.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f0d60 | out: hHeap=0x710000) returned 1 Thread: id = 509 os_tid = 0x15d0 [0137.038] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0137.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0137.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f060c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0137.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0137.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0624, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0137.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0137.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f063c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0137.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0137.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0654, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0137.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0137.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f066c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0137.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0137.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0684, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0137.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0137.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f069c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0137.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0137.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0137.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0137.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0137.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0137.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0137.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0137.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0137.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0137.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0714, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0137.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0137.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f072c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0137.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0137.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0137.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0137.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f075c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0137.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0137.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0774, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0137.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0137.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f078c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0137.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0137.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0137.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0137.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0137.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0137.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0137.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0137.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0137.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0137.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0804, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0137.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0137.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f081c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0137.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0137.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0137.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0137.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f084c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0137.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0137.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0864, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0137.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0137.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f087c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0137.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0137.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0894, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0137.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0137.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0137.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0137.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0137.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0137.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0137.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0137.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0137.069] WaitForMultipleObjects (nCount=0x40, lpHandles=0x700000*=0x730, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0138.489] CloseHandle (hObject=0x730) returned 1 [0138.489] CloseHandle (hObject=0xa0c) returned 1 [0138.489] CloseHandle (hObject=0xa08) returned 1 [0138.489] CloseHandle (hObject=0xa04) returned 1 [0138.489] CloseHandle (hObject=0x37c) returned 1 [0138.489] CloseHandle (hObject=0x380) returned 1 [0138.489] CloseHandle (hObject=0x384) returned 1 [0138.489] CloseHandle (hObject=0x388) returned 1 [0138.489] CloseHandle (hObject=0x38c) returned 1 [0138.489] CloseHandle (hObject=0x390) returned 1 [0138.489] CloseHandle (hObject=0x394) returned 1 [0138.489] CloseHandle (hObject=0x398) returned 1 [0138.489] CloseHandle (hObject=0x39c) returned 1 [0138.489] CloseHandle (hObject=0x3a0) returned 1 [0138.489] CloseHandle (hObject=0x3a4) returned 1 [0138.489] CloseHandle (hObject=0x3a8) returned 1 [0138.490] CloseHandle (hObject=0x928) returned 1 [0138.490] CloseHandle (hObject=0x4d8) returned 1 [0138.490] CloseHandle (hObject=0x304) returned 1 [0138.490] CloseHandle (hObject=0x65c) returned 1 [0138.490] CloseHandle (hObject=0x66c) returned 1 [0138.490] CloseHandle (hObject=0x694) returned 1 [0138.490] CloseHandle (hObject=0x210) returned 1 [0138.490] CloseHandle (hObject=0x214) returned 1 [0138.490] CloseHandle (hObject=0x218) returned 1 [0138.490] CloseHandle (hObject=0x21c) returned 1 [0138.490] CloseHandle (hObject=0x220) returned 1 [0138.490] CloseHandle (hObject=0x224) returned 1 [0138.490] CloseHandle (hObject=0x228) returned 1 [0138.490] CloseHandle (hObject=0x22c) returned 1 [0138.490] CloseHandle (hObject=0x230) returned 1 [0138.490] CloseHandle (hObject=0x234) returned 1 [0138.490] CloseHandle (hObject=0x238) returned 1 [0138.490] CloseHandle (hObject=0x23c) returned 1 [0138.490] CloseHandle (hObject=0x240) returned 1 [0138.490] CloseHandle (hObject=0x244) returned 1 [0138.490] CloseHandle (hObject=0x248) returned 1 [0138.491] CloseHandle (hObject=0x24c) returned 1 [0138.491] CloseHandle (hObject=0x250) returned 1 [0138.491] CloseHandle (hObject=0x254) returned 1 [0138.491] CloseHandle (hObject=0x258) returned 1 [0138.491] CloseHandle (hObject=0x25c) returned 1 [0138.491] CloseHandle (hObject=0x260) returned 1 [0138.491] CloseHandle (hObject=0x264) returned 1 [0138.491] CloseHandle (hObject=0x268) returned 1 [0138.491] CloseHandle (hObject=0x26c) returned 1 [0138.491] CloseHandle (hObject=0x270) returned 1 [0138.491] CloseHandle (hObject=0x274) returned 1 [0138.491] CloseHandle (hObject=0x278) returned 1 [0138.491] CloseHandle (hObject=0x27c) returned 1 [0138.491] CloseHandle (hObject=0x280) returned 1 [0138.491] CloseHandle (hObject=0x284) returned 1 [0138.491] CloseHandle (hObject=0x344) returned 1 [0138.491] CloseHandle (hObject=0x6a4) returned 1 [0138.491] CloseHandle (hObject=0x6a8) returned 1 [0138.491] CloseHandle (hObject=0x6ac) returned 1 [0138.491] CloseHandle (hObject=0x6b0) returned 1 [0138.491] CloseHandle (hObject=0x6b4) returned 1 [0138.492] CloseHandle (hObject=0x6b8) returned 1 [0138.492] CloseHandle (hObject=0x6bc) returned 1 [0138.492] CloseHandle (hObject=0x6c0) returned 1 [0138.492] CloseHandle (hObject=0x354) returned 1 [0138.492] CloseHandle (hObject=0x420) returned 1 [0138.493] CloseHandle (hObject=0x42c) returned 1 [0138.493] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 510 os_tid = 0x15d4 [0137.073] GetLastError () returned 0x57 [0137.073] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7906e8 [0137.073] SetLastError (dwErrCode=0x57) [0137.073] IcmpCreateFile () returned 0x75d7a8 [0137.073] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c788 [0137.073] IcmpSendEcho2 (in: IcmpHandle=0x75d7a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8100a8c0, RequestData=0xfdff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c788, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c788) returned 0x0 [0145.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c788 | out: hHeap=0x710000) returned 1 [0145.644] IcmpCloseHandle (IcmpHandle=0x75d7a8) returned 1 [0145.645] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7906e8 | out: hHeap=0x710000) returned 1 Thread: id = 511 os_tid = 0x15d8 [0137.074] GetLastError () returned 0x57 [0137.074] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x790a70 [0137.074] SetLastError (dwErrCode=0x57) [0137.074] IcmpCreateFile () returned 0x75d738 [0137.074] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c7d8 [0137.074] IcmpSendEcho2 (in: IcmpHandle=0x75d738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8200a8c0, RequestData=0x111ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c7d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c7d8) returned 0x0 [0145.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c7d8 | out: hHeap=0x710000) returned 1 [0145.647] IcmpCloseHandle (IcmpHandle=0x75d738) returned 1 [0145.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x790a70 | out: hHeap=0x710000) returned 1 Thread: id = 512 os_tid = 0x15dc [0137.075] GetLastError () returned 0x57 [0137.075] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x790df8 [0137.075] SetLastError (dwErrCode=0x57) [0137.076] IcmpCreateFile () returned 0x75d770 [0137.076] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c828 [0137.076] IcmpSendEcho2 (in: IcmpHandle=0x75d770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8300a8c0, RequestData=0x125ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c828, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c828) returned 0x0 [0145.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c828 | out: hHeap=0x710000) returned 1 [0145.652] IcmpCloseHandle (IcmpHandle=0x75d770) returned 1 [0145.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x790df8 | out: hHeap=0x710000) returned 1 Thread: id = 513 os_tid = 0x15e0 [0137.077] GetLastError () returned 0x57 [0137.077] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791180 [0137.077] SetLastError (dwErrCode=0x57) [0137.077] IcmpCreateFile () returned 0x75d658 [0137.077] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c8c8 [0137.077] IcmpSendEcho2 (in: IcmpHandle=0x75d658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8400a8c0, RequestData=0xb04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c8c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c8c8) returned 0x0 [0145.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c8c8 | out: hHeap=0x710000) returned 1 [0145.658] IcmpCloseHandle (IcmpHandle=0x75d658) returned 1 [0145.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791180 | out: hHeap=0x710000) returned 1 Thread: id = 514 os_tid = 0x15e4 [0137.078] GetLastError () returned 0x57 [0137.078] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x792328 [0137.078] SetLastError (dwErrCode=0x57) [0137.078] IcmpCreateFile () returned 0x75d690 [0137.078] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c918 [0137.078] IcmpSendEcho2 (in: IcmpHandle=0x75d690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8500a8c0, RequestData=0xb24ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c918, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c918) returned 0x0 [0145.670] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c918 | out: hHeap=0x710000) returned 1 [0145.670] IcmpCloseHandle (IcmpHandle=0x75d690) returned 1 [0145.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x792328 | out: hHeap=0x710000) returned 1 Thread: id = 515 os_tid = 0x15e8 [0137.079] GetLastError () returned 0x57 [0137.079] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7926b0 [0137.079] SetLastError (dwErrCode=0x57) [0137.079] IcmpCreateFile () returned 0x75d6c8 [0137.079] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c968 [0137.079] IcmpSendEcho2 (in: IcmpHandle=0x75d6c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8600a8c0, RequestData=0xf98ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c968, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c968) returned 0x0 [0145.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c968 | out: hHeap=0x710000) returned 1 [0145.674] IcmpCloseHandle (IcmpHandle=0x75d6c8) returned 1 [0145.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7926b0 | out: hHeap=0x710000) returned 1 Thread: id = 516 os_tid = 0x15ec [0137.080] GetLastError () returned 0x57 [0137.080] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x792a38 [0137.080] SetLastError (dwErrCode=0x57) [0137.080] IcmpCreateFile () returned 0x75d700 [0137.080] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c9b8 [0137.080] IcmpSendEcho2 (in: IcmpHandle=0x75d700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8700a8c0, RequestData=0x1020ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c9b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c9b8) returned 0x0 [0145.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c9b8 | out: hHeap=0x710000) returned 1 [0145.687] IcmpCloseHandle (IcmpHandle=0x75d700) returned 1 [0145.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x792a38 | out: hHeap=0x710000) returned 1 Thread: id = 517 os_tid = 0x15f0 [0137.081] GetLastError () returned 0x57 [0137.081] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x792dc0 [0137.081] SetLastError (dwErrCode=0x57) [0137.081] IcmpCreateFile () returned 0x75d070 [0137.081] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73ca08 [0137.081] IcmpSendEcho2 (in: IcmpHandle=0x75d070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8800a8c0, RequestData=0x1034ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73ca08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73ca08) returned 0x0 [0145.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73ca08 | out: hHeap=0x710000) returned 1 [0145.692] IcmpCloseHandle (IcmpHandle=0x75d070) returned 1 [0145.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x792dc0 | out: hHeap=0x710000) returned 1 Thread: id = 518 os_tid = 0x15f4 [0137.082] GetLastError () returned 0x57 [0137.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793148 [0137.082] SetLastError (dwErrCode=0x57) [0137.083] IcmpCreateFile () returned 0x75d0a8 [0137.083] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73ca58 [0137.083] IcmpSendEcho2 (in: IcmpHandle=0x75d0a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8900a8c0, RequestData=0x10acff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73ca58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73ca58) returned 0x0 [0145.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73ca58 | out: hHeap=0x710000) returned 1 [0145.694] IcmpCloseHandle (IcmpHandle=0x75d0a8) returned 1 [0145.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793148 | out: hHeap=0x710000) returned 1 Thread: id = 519 os_tid = 0x15f8 [0137.088] GetLastError () returned 0x57 [0137.088] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7934d0 [0137.088] SetLastError (dwErrCode=0x57) [0137.088] IcmpCreateFile () returned 0x75d0e0 [0137.088] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c508 [0137.088] IcmpSendEcho2 (in: IcmpHandle=0x75d0e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8a00a8c0, RequestData=0x10e8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c508, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c508) returned 0x0 [0145.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c508 | out: hHeap=0x710000) returned 1 [0145.696] IcmpCloseHandle (IcmpHandle=0x75d0e0) returned 1 [0145.697] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7934d0 | out: hHeap=0x710000) returned 1 Thread: id = 520 os_tid = 0x15fc [0137.089] GetLastError () returned 0x57 [0137.089] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793858 [0137.089] SetLastError (dwErrCode=0x57) [0137.089] IcmpCreateFile () returned 0x75d118 [0137.089] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c558 [0137.089] IcmpSendEcho2 (in: IcmpHandle=0x75d118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8b00a8c0, RequestData=0x10fcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c558, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c558) returned 0x0 [0145.699] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c558 | out: hHeap=0x710000) returned 1 [0145.699] IcmpCloseHandle (IcmpHandle=0x75d118) returned 1 [0145.699] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793858 | out: hHeap=0x710000) returned 1 Thread: id = 521 os_tid = 0x1600 [0137.090] GetLastError () returned 0x57 [0137.090] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793be0 [0137.090] SetLastError (dwErrCode=0x57) [0137.090] IcmpCreateFile () returned 0x75d188 [0137.090] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c5a8 [0137.090] IcmpSendEcho2 (in: IcmpHandle=0x75d188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8c00a8c0, RequestData=0x1110ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c5a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c5a8) returned 0x0 [0145.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c5a8 | out: hHeap=0x710000) returned 1 [0145.701] IcmpCloseHandle (IcmpHandle=0x75d188) returned 1 [0145.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793be0 | out: hHeap=0x710000) returned 1 Thread: id = 522 os_tid = 0x1604 [0137.091] GetLastError () returned 0x57 [0137.091] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x793f68 [0137.091] SetLastError (dwErrCode=0x57) [0137.091] IcmpCreateFile () returned 0x75d1f8 [0137.091] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c5f8 [0137.091] IcmpSendEcho2 (in: IcmpHandle=0x75d1f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8d00a8c0, RequestData=0x1124ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c5f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c5f8) returned 0x0 [0145.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c5f8 | out: hHeap=0x710000) returned 1 [0145.702] IcmpCloseHandle (IcmpHandle=0x75d1f8) returned 1 [0145.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x793f68 | out: hHeap=0x710000) returned 1 Thread: id = 523 os_tid = 0x1608 [0137.092] GetLastError () returned 0x57 [0137.092] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x790360 [0137.093] SetLastError (dwErrCode=0x57) [0137.093] IcmpCreateFile () returned 0x75d268 [0137.093] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c648 [0137.093] IcmpSendEcho2 (in: IcmpHandle=0x75d268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8e00a8c0, RequestData=0x1138ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c648, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c648) returned 0x0 [0145.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c648 | out: hHeap=0x710000) returned 1 [0145.705] IcmpCloseHandle (IcmpHandle=0x75d268) returned 1 [0145.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x790360 | out: hHeap=0x710000) returned 1 Thread: id = 524 os_tid = 0x160c [0137.094] GetLastError () returned 0x57 [0137.094] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e9fe8 [0137.094] SetLastError (dwErrCode=0x57) [0137.094] IcmpCreateFile () returned 0x75d2a0 [0137.094] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c698 [0137.094] IcmpSendEcho2 (in: IcmpHandle=0x75d2a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8f00a8c0, RequestData=0x114cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c698, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c698) returned 0x0 [0145.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c698 | out: hHeap=0x710000) returned 1 [0145.706] IcmpCloseHandle (IcmpHandle=0x75d2a0) returned 1 [0145.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7e9fe8 | out: hHeap=0x710000) returned 1 Thread: id = 525 os_tid = 0x1610 [0137.095] GetLastError () returned 0x57 [0137.095] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ea370 [0137.095] SetLastError (dwErrCode=0x57) [0137.095] IcmpCreateFile () returned 0x75d2d8 [0137.095] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73be78 [0137.095] IcmpSendEcho2 (in: IcmpHandle=0x75d2d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9000a8c0, RequestData=0x1160ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73be78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73be78) returned 0x0 [0145.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73be78 | out: hHeap=0x710000) returned 1 [0145.708] IcmpCloseHandle (IcmpHandle=0x75d2d8) returned 1 [0145.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ea370 | out: hHeap=0x710000) returned 1 Thread: id = 526 os_tid = 0x1614 [0137.096] GetLastError () returned 0x57 [0137.096] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ea6f8 [0137.096] SetLastError (dwErrCode=0x57) [0137.096] IcmpCreateFile () returned 0x75d310 [0137.096] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bec8 [0137.096] IcmpSendEcho2 (in: IcmpHandle=0x75d310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9100a8c0, RequestData=0x1174ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bec8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bec8) returned 0x0 [0145.710] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bec8 | out: hHeap=0x710000) returned 1 [0145.710] IcmpCloseHandle (IcmpHandle=0x75d310) returned 1 [0145.711] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ea6f8 | out: hHeap=0x710000) returned 1 Thread: id = 527 os_tid = 0x1618 [0137.097] GetLastError () returned 0x57 [0137.097] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f10e8 [0137.097] SetLastError (dwErrCode=0x57) [0137.097] IcmpCreateFile () returned 0x75d348 [0137.097] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bf18 [0137.097] IcmpSendEcho2 (in: IcmpHandle=0x75d348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9200a8c0, RequestData=0x1188ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bf18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bf18) returned 0x0 [0145.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bf18 | out: hHeap=0x710000) returned 1 [0145.712] IcmpCloseHandle (IcmpHandle=0x75d348) returned 1 [0145.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f10e8 | out: hHeap=0x710000) returned 1 Thread: id = 528 os_tid = 0x161c [0137.098] GetLastError () returned 0x57 [0137.098] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f1470 [0137.099] SetLastError (dwErrCode=0x57) [0137.099] IcmpCreateFile () returned 0x75d380 [0137.099] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bf68 [0137.099] IcmpSendEcho2 (in: IcmpHandle=0x75d380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9300a8c0, RequestData=0x119cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bf68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bf68) returned 0x0 [0145.714] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bf68 | out: hHeap=0x710000) returned 1 [0145.714] IcmpCloseHandle (IcmpHandle=0x75d380) returned 1 [0145.714] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f1470 | out: hHeap=0x710000) returned 1 Thread: id = 529 os_tid = 0x1620 [0137.099] GetLastError () returned 0x57 [0137.100] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f17f8 [0137.100] SetLastError (dwErrCode=0x57) [0137.100] IcmpCreateFile () returned 0x75d498 [0137.100] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bfb8 [0137.100] IcmpSendEcho2 (in: IcmpHandle=0x75d498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9400a8c0, RequestData=0x11b0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bfb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bfb8) returned 0x0 [0145.716] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bfb8 | out: hHeap=0x710000) returned 1 [0145.716] IcmpCloseHandle (IcmpHandle=0x75d498) returned 1 [0145.716] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f17f8 | out: hHeap=0x710000) returned 1 Thread: id = 530 os_tid = 0x1624 [0137.101] GetLastError () returned 0x57 [0137.101] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f1b80 [0137.101] SetLastError (dwErrCode=0x57) [0137.101] IcmpCreateFile () returned 0x75d508 [0137.101] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c008 [0137.101] IcmpSendEcho2 (in: IcmpHandle=0x75d508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9500a8c0, RequestData=0x11c4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c008, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c008) returned 0x0 [0145.718] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c008 | out: hHeap=0x710000) returned 1 [0145.718] IcmpCloseHandle (IcmpHandle=0x75d508) returned 1 [0145.718] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7f1b80 | out: hHeap=0x710000) returned 1 Thread: id = 531 os_tid = 0x1628 [0137.102] GetLastError () returned 0x57 [0137.102] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f478 [0137.102] SetLastError (dwErrCode=0x57) [0137.102] IcmpCreateFile () returned 0x75d620 [0137.102] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c378 [0137.102] IcmpSendEcho2 (in: IcmpHandle=0x75d620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9600a8c0, RequestData=0x11d8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c378, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c378) returned 0x0 [0145.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c378 | out: hHeap=0x710000) returned 1 [0145.720] IcmpCloseHandle (IcmpHandle=0x75d620) returned 1 [0145.721] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75f478 | out: hHeap=0x710000) returned 1 Thread: id = 532 os_tid = 0x162c [0137.103] GetLastError () returned 0x57 [0137.103] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75dbc0 [0137.103] SetLastError (dwErrCode=0x57) [0137.103] IcmpCreateFile () returned 0x7850a8 [0137.103] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c058 [0137.103] IcmpSendEcho2 (in: IcmpHandle=0x7850a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9700a8c0, RequestData=0x11ecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c058) returned 0x0 [0145.725] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c058 | out: hHeap=0x710000) returned 1 [0145.725] IcmpCloseHandle (IcmpHandle=0x7850a8) returned 1 [0145.726] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75dbc0 | out: hHeap=0x710000) returned 1 Thread: id = 533 os_tid = 0x1630 [0137.104] GetLastError () returned 0x57 [0137.104] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75df48 [0137.104] SetLastError (dwErrCode=0x57) [0137.104] IcmpCreateFile () returned 0x7850e0 [0137.104] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c0a8 [0137.104] IcmpSendEcho2 (in: IcmpHandle=0x7850e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9800a8c0, RequestData=0x1200ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c0a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c0a8) returned 0x0 [0145.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c0a8 | out: hHeap=0x710000) returned 1 [0145.729] IcmpCloseHandle (IcmpHandle=0x7850e0) returned 1 [0145.730] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75df48 | out: hHeap=0x710000) returned 1 Thread: id = 534 os_tid = 0x1634 [0137.105] GetLastError () returned 0x57 [0137.105] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e2d0 [0137.105] SetLastError (dwErrCode=0x57) [0137.105] IcmpCreateFile () returned 0x785118 [0137.105] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c0f8 [0137.106] IcmpSendEcho2 (in: IcmpHandle=0x785118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9900a8c0, RequestData=0x1214ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c0f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c0f8) returned 0x0 [0145.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c0f8 | out: hHeap=0x710000) returned 1 [0145.732] IcmpCloseHandle (IcmpHandle=0x785118) returned 1 [0145.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75e2d0 | out: hHeap=0x710000) returned 1 Thread: id = 535 os_tid = 0x1638 [0137.106] GetLastError () returned 0x57 [0137.106] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e658 [0137.107] SetLastError (dwErrCode=0x57) [0137.107] IcmpCreateFile () returned 0x785150 [0137.107] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c148 [0137.107] IcmpSendEcho2 (in: IcmpHandle=0x785150, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9a00a8c0, RequestData=0x1228ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c148) returned 0x0 [0145.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c148 | out: hHeap=0x710000) returned 1 [0145.734] IcmpCloseHandle (IcmpHandle=0x785150) returned 1 [0145.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75e658 | out: hHeap=0x710000) returned 1 Thread: id = 536 os_tid = 0x163c [0137.153] GetLastError () returned 0x57 [0137.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e9e0 [0137.153] SetLastError (dwErrCode=0x57) [0137.153] IcmpCreateFile () returned 0x785188 [0137.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c198 [0137.153] IcmpSendEcho2 (in: IcmpHandle=0x785188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9b00a8c0, RequestData=0x123cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c198) returned 0x0 [0145.737] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c198 | out: hHeap=0x710000) returned 1 [0145.737] IcmpCloseHandle (IcmpHandle=0x785188) returned 1 [0145.737] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75e9e0 | out: hHeap=0x710000) returned 1 Thread: id = 537 os_tid = 0x1640 [0137.154] GetLastError () returned 0x57 [0137.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75ed68 [0137.156] SetLastError (dwErrCode=0x57) [0137.156] IcmpCreateFile () returned 0x7851c0 [0137.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c1e8 [0137.156] IcmpSendEcho2 (in: IcmpHandle=0x7851c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9c00a8c0, RequestData=0x1250ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c1e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c1e8) returned 0x0 [0145.739] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c1e8 | out: hHeap=0x710000) returned 1 [0145.739] IcmpCloseHandle (IcmpHandle=0x7851c0) returned 1 [0145.739] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75ed68 | out: hHeap=0x710000) returned 1 Thread: id = 538 os_tid = 0x1644 [0137.158] GetLastError () returned 0x57 [0137.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f0f0 [0137.158] SetLastError (dwErrCode=0x57) [0137.158] IcmpCreateFile () returned 0x7851f8 [0137.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c238 [0137.158] IcmpSendEcho2 (in: IcmpHandle=0x7851f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9d00a8c0, RequestData=0x1264ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c238) returned 0x0 [0145.746] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c238 | out: hHeap=0x710000) returned 1 [0145.746] IcmpCloseHandle (IcmpHandle=0x7851f8) returned 1 [0145.746] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75f0f0 | out: hHeap=0x710000) returned 1 Thread: id = 539 os_tid = 0x1648 [0137.159] GetLastError () returned 0x57 [0137.159] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f800 [0137.159] SetLastError (dwErrCode=0x57) [0137.159] IcmpCreateFile () returned 0x785230 [0137.159] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c288 [0137.160] IcmpSendEcho2 (in: IcmpHandle=0x785230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9e00a8c0, RequestData=0x1278ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c288, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c288) returned 0x0 [0145.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c288 | out: hHeap=0x710000) returned 1 [0145.748] IcmpCloseHandle (IcmpHandle=0x785230) returned 1 [0145.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75f800 | out: hHeap=0x710000) returned 1 Thread: id = 540 os_tid = 0x164c [0137.161] GetLastError () returned 0x57 [0137.161] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75fb88 [0137.161] SetLastError (dwErrCode=0x57) [0137.161] IcmpCreateFile () returned 0x785268 [0137.161] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c2d8 [0137.161] IcmpSendEcho2 (in: IcmpHandle=0x785268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9f00a8c0, RequestData=0x128cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c2d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c2d8) returned 0x0 [0145.750] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c2d8 | out: hHeap=0x710000) returned 1 [0145.750] IcmpCloseHandle (IcmpHandle=0x785268) returned 1 [0145.750] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75fb88 | out: hHeap=0x710000) returned 1 Thread: id = 541 os_tid = 0x1650 [0137.162] GetLastError () returned 0x57 [0137.162] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75ff10 [0137.162] SetLastError (dwErrCode=0x57) [0137.162] IcmpCreateFile () returned 0x7852a0 [0137.163] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c328 [0137.163] IcmpSendEcho2 (in: IcmpHandle=0x7852a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa000a8c0, RequestData=0x12a0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c328, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c328) returned 0x0 [0145.752] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c328 | out: hHeap=0x710000) returned 1 [0145.752] IcmpCloseHandle (IcmpHandle=0x7852a0) returned 1 [0145.753] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75ff10 | out: hHeap=0x710000) returned 1 Thread: id = 542 os_tid = 0x1654 [0137.164] GetLastError () returned 0x57 [0137.164] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760298 [0137.164] SetLastError (dwErrCode=0x57) [0137.164] IcmpCreateFile () returned 0x7852d8 [0137.164] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c3c8 [0137.164] IcmpSendEcho2 (in: IcmpHandle=0x7852d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa100a8c0, RequestData=0x12b4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c3c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c3c8) returned 0x0 [0145.754] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c3c8 | out: hHeap=0x710000) returned 1 [0145.754] IcmpCloseHandle (IcmpHandle=0x7852d8) returned 1 [0145.755] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x760298 | out: hHeap=0x710000) returned 1 Thread: id = 543 os_tid = 0x1658 [0137.166] GetLastError () returned 0x57 [0137.166] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760620 [0137.166] SetLastError (dwErrCode=0x57) [0137.166] IcmpCreateFile () returned 0x785310 [0137.166] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c418 [0137.166] IcmpSendEcho2 (in: IcmpHandle=0x785310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa200a8c0, RequestData=0x12c8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c418, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c418) returned 0x0 [0145.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c418 | out: hHeap=0x710000) returned 1 [0145.757] IcmpCloseHandle (IcmpHandle=0x785310) returned 1 [0145.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x760620 | out: hHeap=0x710000) returned 1 Thread: id = 544 os_tid = 0x165c [0137.167] GetLastError () returned 0x57 [0137.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7609a8 [0137.167] SetLastError (dwErrCode=0x57) [0137.167] IcmpCreateFile () returned 0x785348 [0137.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c468 [0137.167] IcmpSendEcho2 (in: IcmpHandle=0x785348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa300a8c0, RequestData=0x12dcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c468, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c468) returned 0x0 [0145.759] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c468 | out: hHeap=0x710000) returned 1 [0145.759] IcmpCloseHandle (IcmpHandle=0x785348) returned 1 [0145.759] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7609a8 | out: hHeap=0x710000) returned 1 Thread: id = 545 os_tid = 0x1660 [0137.170] GetLastError () returned 0x57 [0137.170] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760d30 [0137.173] SetLastError (dwErrCode=0x57) [0137.173] IcmpCreateFile () returned 0x785380 [0137.173] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73c4b8 [0137.173] IcmpSendEcho2 (in: IcmpHandle=0x785380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa400a8c0, RequestData=0x12f0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73c4b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73c4b8) returned 0x0 [0145.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73c4b8 | out: hHeap=0x710000) returned 1 [0145.761] IcmpCloseHandle (IcmpHandle=0x785380) returned 1 [0145.762] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x760d30 | out: hHeap=0x710000) returned 1 Thread: id = 546 os_tid = 0x1664 [0137.174] GetLastError () returned 0x57 [0137.174] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7610b8 [0137.174] SetLastError (dwErrCode=0x57) [0137.174] IcmpCreateFile () returned 0x7853b8 [0137.174] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bb08 [0137.174] IcmpSendEcho2 (in: IcmpHandle=0x7853b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa500a8c0, RequestData=0x1304ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bb08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bb08) returned 0x0 [0145.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bb08 | out: hHeap=0x710000) returned 1 [0145.763] IcmpCloseHandle (IcmpHandle=0x7853b8) returned 1 [0145.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7610b8 | out: hHeap=0x710000) returned 1 Thread: id = 547 os_tid = 0x1668 [0137.175] GetLastError () returned 0x57 [0137.176] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x761440 [0137.176] SetLastError (dwErrCode=0x57) [0137.176] IcmpCreateFile () returned 0x784cf0 [0137.176] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bb58 [0137.176] IcmpSendEcho2 (in: IcmpHandle=0x784cf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa600a8c0, RequestData=0x1318ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bb58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bb58) returned 0x0 [0145.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bb58 | out: hHeap=0x710000) returned 1 [0145.765] IcmpCloseHandle (IcmpHandle=0x784cf0) returned 1 [0145.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x761440 | out: hHeap=0x710000) returned 1 Thread: id = 548 os_tid = 0x166c [0137.177] GetLastError () returned 0x57 [0137.177] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75d838 [0137.177] SetLastError (dwErrCode=0x57) [0137.177] IcmpCreateFile () returned 0x784d28 [0137.177] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bba8 [0137.177] IcmpSendEcho2 (in: IcmpHandle=0x784d28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa700a8c0, RequestData=0x132cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bba8) returned 0x0 [0145.767] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bba8 | out: hHeap=0x710000) returned 1 [0145.767] IcmpCloseHandle (IcmpHandle=0x784d28) returned 1 [0145.768] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x75d838 | out: hHeap=0x710000) returned 1 Thread: id = 549 os_tid = 0x1670 [0137.179] GetLastError () returned 0x57 [0137.179] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770098 [0137.186] SetLastError (dwErrCode=0x57) [0137.186] IcmpCreateFile () returned 0x784d60 [0137.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bbf8 [0137.189] IcmpSendEcho2 (in: IcmpHandle=0x784d60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa800a8c0, RequestData=0x1340ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bbf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bbf8) returned 0x0 [0145.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bbf8 | out: hHeap=0x710000) returned 1 [0145.769] IcmpCloseHandle (IcmpHandle=0x784d60) returned 1 [0145.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770098 | out: hHeap=0x710000) returned 1 Thread: id = 550 os_tid = 0x1674 [0137.190] GetLastError () returned 0x57 [0137.190] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76cf28 [0137.190] SetLastError (dwErrCode=0x57) [0137.190] IcmpCreateFile () returned 0x784d98 [0137.190] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bc48 [0137.190] IcmpSendEcho2 (in: IcmpHandle=0x784d98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa900a8c0, RequestData=0x1354ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bc48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bc48) returned 0x0 [0145.772] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bc48 | out: hHeap=0x710000) returned 1 [0145.772] IcmpCloseHandle (IcmpHandle=0x784d98) returned 1 [0145.772] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76cf28 | out: hHeap=0x710000) returned 1 Thread: id = 551 os_tid = 0x1678 [0137.191] GetLastError () returned 0x57 [0137.191] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76d2b0 [0137.191] SetLastError (dwErrCode=0x57) [0137.192] IcmpCreateFile () returned 0x784dd0 [0137.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bc98 [0137.192] IcmpSendEcho2 (in: IcmpHandle=0x784dd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaa00a8c0, RequestData=0x1368ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bc98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bc98) returned 0x0 [0145.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bc98 | out: hHeap=0x710000) returned 1 [0145.774] IcmpCloseHandle (IcmpHandle=0x784dd0) returned 1 [0145.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76d2b0 | out: hHeap=0x710000) returned 1 Thread: id = 552 os_tid = 0x167c [0137.193] GetLastError () returned 0x57 [0137.193] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76d638 [0137.193] SetLastError (dwErrCode=0x57) [0137.193] IcmpCreateFile () returned 0x784e08 [0137.193] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bce8 [0137.193] IcmpSendEcho2 (in: IcmpHandle=0x784e08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xab00a8c0, RequestData=0x137cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bce8) returned 0x0 [0145.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bce8 | out: hHeap=0x710000) returned 1 [0145.777] IcmpCloseHandle (IcmpHandle=0x784e08) returned 1 [0145.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76d638 | out: hHeap=0x710000) returned 1 Thread: id = 553 os_tid = 0x1680 [0137.194] GetLastError () returned 0x57 [0137.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76d9c0 [0137.194] SetLastError (dwErrCode=0x57) [0137.194] IcmpCreateFile () returned 0x784e40 [0137.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bd38 [0137.194] IcmpSendEcho2 (in: IcmpHandle=0x784e40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xac00a8c0, RequestData=0x1390ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bd38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bd38) returned 0x0 [0145.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bd38 | out: hHeap=0x710000) returned 1 [0145.779] IcmpCloseHandle (IcmpHandle=0x784e40) returned 1 [0145.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76d9c0 | out: hHeap=0x710000) returned 1 Thread: id = 554 os_tid = 0x1684 [0137.195] GetLastError () returned 0x57 [0137.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76dd48 [0137.195] SetLastError (dwErrCode=0x57) [0137.195] IcmpCreateFile () returned 0x784e78 [0137.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bd88 [0137.195] IcmpSendEcho2 (in: IcmpHandle=0x784e78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xad00a8c0, RequestData=0x13a4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bd88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bd88) returned 0x0 [0145.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bd88 | out: hHeap=0x710000) returned 1 [0145.781] IcmpCloseHandle (IcmpHandle=0x784e78) returned 1 [0145.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76dd48 | out: hHeap=0x710000) returned 1 Thread: id = 555 os_tid = 0x1688 [0137.196] GetLastError () returned 0x57 [0137.196] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76e0d0 [0137.197] SetLastError (dwErrCode=0x57) [0137.197] IcmpCreateFile () returned 0x784eb0 [0137.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73bdd8 [0137.197] IcmpSendEcho2 (in: IcmpHandle=0x784eb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xae00a8c0, RequestData=0x13b8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73bdd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73bdd8) returned 0x0 [0145.783] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73bdd8 | out: hHeap=0x710000) returned 1 [0145.783] IcmpCloseHandle (IcmpHandle=0x784eb0) returned 1 [0145.783] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76e0d0 | out: hHeap=0x710000) returned 1 Thread: id = 556 os_tid = 0x168c [0137.199] GetLastError () returned 0x57 [0137.199] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76e458 [0137.200] SetLastError (dwErrCode=0x57) [0137.200] IcmpCreateFile () returned 0x784ee8 [0137.200] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73be28 [0137.200] IcmpSendEcho2 (in: IcmpHandle=0x784ee8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaf00a8c0, RequestData=0x13ccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73be28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73be28) returned 0x0 [0145.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73be28 | out: hHeap=0x710000) returned 1 [0145.785] IcmpCloseHandle (IcmpHandle=0x784ee8) returned 1 [0145.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76e458 | out: hHeap=0x710000) returned 1 Thread: id = 557 os_tid = 0x1690 [0137.201] GetLastError () returned 0x57 [0137.201] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76e7e0 [0137.201] SetLastError (dwErrCode=0x57) [0137.201] IcmpCreateFile () returned 0x784f20 [0137.201] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784238 [0137.201] IcmpSendEcho2 (in: IcmpHandle=0x784f20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb000a8c0, RequestData=0x13e0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784238) returned 0x0 [0145.787] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784238 | out: hHeap=0x710000) returned 1 [0145.787] IcmpCloseHandle (IcmpHandle=0x784f20) returned 1 [0145.788] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76e7e0 | out: hHeap=0x710000) returned 1 Thread: id = 558 os_tid = 0x1694 [0137.202] GetLastError () returned 0x57 [0137.202] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76eb68 [0137.202] SetLastError (dwErrCode=0x57) [0137.202] IcmpCreateFile () returned 0x784f90 [0137.202] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784288 [0137.202] IcmpSendEcho2 (in: IcmpHandle=0x784f90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb100a8c0, RequestData=0x13f4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784288, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784288) returned 0x0 [0145.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784288 | out: hHeap=0x710000) returned 1 [0145.789] IcmpCloseHandle (IcmpHandle=0x784f90) returned 1 [0145.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76eb68 | out: hHeap=0x710000) returned 1 Thread: id = 559 os_tid = 0x1698 [0137.203] GetLastError () returned 0x57 [0137.203] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76eef0 [0137.203] SetLastError (dwErrCode=0x57) [0137.203] IcmpCreateFile () returned 0x784fc8 [0137.203] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7842d8 [0137.203] IcmpSendEcho2 (in: IcmpHandle=0x784fc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb200a8c0, RequestData=0x1408ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7842d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7842d8) returned 0x0 [0145.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7842d8 | out: hHeap=0x710000) returned 1 [0145.791] IcmpCloseHandle (IcmpHandle=0x784fc8) returned 1 [0145.792] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76eef0 | out: hHeap=0x710000) returned 1 Thread: id = 560 os_tid = 0x169c [0137.204] GetLastError () returned 0x57 [0137.204] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76f278 [0137.204] SetLastError (dwErrCode=0x57) [0137.204] IcmpCreateFile () returned 0x728b38 [0137.204] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784328 [0137.204] IcmpSendEcho2 (in: IcmpHandle=0x728b38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb300a8c0, RequestData=0x141cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784328, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784328) returned 0x0 [0145.794] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784328 | out: hHeap=0x710000) returned 1 [0145.794] IcmpCloseHandle (IcmpHandle=0x728b38) returned 1 [0145.794] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76f278 | out: hHeap=0x710000) returned 1 Thread: id = 561 os_tid = 0x16a0 [0137.205] GetLastError () returned 0x57 [0137.205] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76f600 [0137.205] SetLastError (dwErrCode=0x57) [0137.205] IcmpCreateFile () returned 0x7287b8 [0137.205] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784378 [0137.205] IcmpSendEcho2 (in: IcmpHandle=0x7287b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb500a8c0, RequestData=0x1430ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784378, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784378) returned 0x0 [0145.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784378 | out: hHeap=0x710000) returned 1 [0145.806] IcmpCloseHandle (IcmpHandle=0x7287b8) returned 1 [0145.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76f600 | out: hHeap=0x710000) returned 1 Thread: id = 562 os_tid = 0x16a4 [0137.206] GetLastError () returned 0x57 [0137.207] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76f988 [0137.207] SetLastError (dwErrCode=0x57) [0137.207] IcmpCreateFile () returned 0x728860 [0137.207] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7843c8 [0137.207] IcmpSendEcho2 (in: IcmpHandle=0x728860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb600a8c0, RequestData=0x1444ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7843c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7843c8) returned 0x0 [0145.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7843c8 | out: hHeap=0x710000) returned 1 [0145.808] IcmpCloseHandle (IcmpHandle=0x728860) returned 1 [0145.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76f988 | out: hHeap=0x710000) returned 1 Thread: id = 563 os_tid = 0x16a8 [0137.209] GetLastError () returned 0x57 [0137.209] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76fd10 [0137.210] SetLastError (dwErrCode=0x57) [0137.210] IcmpCreateFile () returned 0x728898 [0137.210] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784418 [0137.210] IcmpSendEcho2 (in: IcmpHandle=0x728898, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb700a8c0, RequestData=0x1458ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784418, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784418) returned 0x0 [0145.811] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784418 | out: hHeap=0x710000) returned 1 [0145.811] IcmpCloseHandle (IcmpHandle=0x728898) returned 1 [0145.811] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76fd10 | out: hHeap=0x710000) returned 1 Thread: id = 564 os_tid = 0x16ac [0137.211] GetLastError () returned 0x57 [0137.211] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770420 [0137.211] SetLastError (dwErrCode=0x57) [0137.211] IcmpCreateFile () returned 0x7288d0 [0137.211] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784468 [0137.211] IcmpSendEcho2 (in: IcmpHandle=0x7288d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb800a8c0, RequestData=0x146cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784468, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784468) returned 0x0 [0145.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784468 | out: hHeap=0x710000) returned 1 [0145.813] IcmpCloseHandle (IcmpHandle=0x7288d0) returned 1 [0145.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770420 | out: hHeap=0x710000) returned 1 Thread: id = 565 os_tid = 0x16b0 [0137.212] GetLastError () returned 0x57 [0137.212] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7707a8 [0137.212] SetLastError (dwErrCode=0x57) [0137.212] IcmpCreateFile () returned 0x728908 [0137.212] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7844b8 [0137.212] IcmpSendEcho2 (in: IcmpHandle=0x728908, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb900a8c0, RequestData=0x1480ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7844b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7844b8) returned 0x0 [0145.815] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7844b8 | out: hHeap=0x710000) returned 1 [0145.815] IcmpCloseHandle (IcmpHandle=0x728908) returned 1 [0145.815] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7707a8 | out: hHeap=0x710000) returned 1 Thread: id = 566 os_tid = 0x16b4 [0137.213] GetLastError () returned 0x57 [0137.213] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770b30 [0137.213] SetLastError (dwErrCode=0x57) [0137.213] IcmpCreateFile () returned 0x728940 [0137.213] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784508 [0137.213] IcmpSendEcho2 (in: IcmpHandle=0x728940, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xba00a8c0, RequestData=0x1494ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784508, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784508) returned 0x0 [0145.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784508 | out: hHeap=0x710000) returned 1 [0145.817] IcmpCloseHandle (IcmpHandle=0x728940) returned 1 [0145.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770b30 | out: hHeap=0x710000) returned 1 Thread: id = 567 os_tid = 0x16b8 [0137.214] GetLastError () returned 0x57 [0137.214] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770eb8 [0137.214] SetLastError (dwErrCode=0x57) [0137.214] IcmpCreateFile () returned 0x728978 [0137.214] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784558 [0137.215] IcmpSendEcho2 (in: IcmpHandle=0x728978, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbb00a8c0, RequestData=0x14a8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784558, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784558) returned 0x0 [0145.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784558 | out: hHeap=0x710000) returned 1 [0145.819] IcmpCloseHandle (IcmpHandle=0x728978) returned 1 [0145.820] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x770eb8 | out: hHeap=0x710000) returned 1 Thread: id = 568 os_tid = 0x16bc [0137.215] GetLastError () returned 0x57 [0137.215] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771240 [0137.216] SetLastError (dwErrCode=0x57) [0137.216] IcmpCreateFile () returned 0x7289b0 [0137.216] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7845a8 [0137.216] IcmpSendEcho2 (in: IcmpHandle=0x7289b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbc00a8c0, RequestData=0x14bcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7845a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7845a8) returned 0x0 [0145.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7845a8 | out: hHeap=0x710000) returned 1 [0145.821] IcmpCloseHandle (IcmpHandle=0x7289b0) returned 1 [0145.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x771240 | out: hHeap=0x710000) returned 1 Thread: id = 569 os_tid = 0x16c0 [0137.217] GetLastError () returned 0x57 [0137.217] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7715c8 [0137.217] SetLastError (dwErrCode=0x57) [0137.217] IcmpCreateFile () returned 0x728a58 [0137.217] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7845f8 [0137.217] IcmpSendEcho2 (in: IcmpHandle=0x728a58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbd00a8c0, RequestData=0x14d0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7845f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7845f8) returned 0x0 [0145.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7845f8 | out: hHeap=0x710000) returned 1 [0145.823] IcmpCloseHandle (IcmpHandle=0x728a58) returned 1 [0145.824] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7715c8 | out: hHeap=0x710000) returned 1 Thread: id = 570 os_tid = 0x16c4 [0137.218] GetLastError () returned 0x57 [0137.218] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771950 [0137.218] SetLastError (dwErrCode=0x57) [0137.218] IcmpCreateFile () returned 0x728a90 [0137.218] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784648 [0137.218] IcmpSendEcho2 (in: IcmpHandle=0x728a90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbe00a8c0, RequestData=0x14e4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784648, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784648) returned 0x0 [0145.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784648 | out: hHeap=0x710000) returned 1 [0145.825] IcmpCloseHandle (IcmpHandle=0x728a90) returned 1 [0145.826] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x771950 | out: hHeap=0x710000) returned 1 Thread: id = 571 os_tid = 0x16c8 [0137.220] GetLastError () returned 0x57 [0137.221] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771cd8 [0137.221] SetLastError (dwErrCode=0x57) [0137.221] IcmpCreateFile () returned 0x728ac8 [0137.221] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784698 [0137.221] IcmpSendEcho2 (in: IcmpHandle=0x728ac8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbf00a8c0, RequestData=0x14f8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784698, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784698) returned 0x0 [0145.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784698 | out: hHeap=0x710000) returned 1 [0145.827] IcmpCloseHandle (IcmpHandle=0x728ac8) returned 1 [0145.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x771cd8 | out: hHeap=0x710000) returned 1 Thread: id = 572 os_tid = 0x16cc [0137.222] GetLastError () returned 0x57 [0137.222] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772060 [0137.222] SetLastError (dwErrCode=0x57) [0137.222] IcmpCreateFile () returned 0x728b00 [0137.222] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783ce8 [0137.222] IcmpSendEcho2 (in: IcmpHandle=0x728b00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc000a8c0, RequestData=0x150cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783ce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783ce8) returned 0x0 [0145.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783ce8 | out: hHeap=0x710000) returned 1 [0145.830] IcmpCloseHandle (IcmpHandle=0x728b00) returned 1 [0145.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x772060 | out: hHeap=0x710000) returned 1 Thread: id = 573 os_tid = 0x16d0 [0137.223] GetLastError () returned 0x57 [0137.223] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7723e8 [0137.223] SetLastError (dwErrCode=0x57) [0137.223] IcmpCreateFile () returned 0x728e10 [0137.223] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783d38 [0137.223] IcmpSendEcho2 (in: IcmpHandle=0x728e10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc100a8c0, RequestData=0x1520ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783d38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783d38) returned 0x0 [0145.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783d38 | out: hHeap=0x710000) returned 1 [0145.833] IcmpCloseHandle (IcmpHandle=0x728e10) returned 1 [0145.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7723e8 | out: hHeap=0x710000) returned 1 Thread: id = 574 os_tid = 0x16d4 [0138.503] VirtualAlloc (lpAddress=0x0, dwSize=0xf4, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0138.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0138.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f090c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0138.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0138.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0924, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0138.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0138.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f093c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0138.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0138.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0954, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0138.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0138.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f096c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0138.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0138.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0984, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0138.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0138.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f099c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0138.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0138.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0138.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0138.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0138.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0138.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0138.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0138.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0138.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0138.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0138.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0138.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0138.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0138.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0138.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0138.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0138.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0138.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a74, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0138.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0138.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a8c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0138.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0138.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0138.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0138.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0abc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0138.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0138.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ad4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0138.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0138.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0138.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0138.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b04, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0138.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0138.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0138.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0138.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0138.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0138.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0138.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0138.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0138.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0138.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0138.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0138.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b94, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0138.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0138.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0138.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0138.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bc4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0138.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0138.534] WaitForMultipleObjects (nCount=0x3d, lpHandles=0x700000*=0x80c, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0139.936] CloseHandle (hObject=0x80c) returned 1 [0139.936] CloseHandle (hObject=0x42c) returned 1 [0139.936] CloseHandle (hObject=0x420) returned 1 [0139.936] CloseHandle (hObject=0x354) returned 1 [0139.936] CloseHandle (hObject=0x6c0) returned 1 [0139.936] CloseHandle (hObject=0x6bc) returned 1 [0139.936] CloseHandle (hObject=0x6b8) returned 1 [0139.936] CloseHandle (hObject=0x6b4) returned 1 [0139.936] CloseHandle (hObject=0x6b0) returned 1 [0139.936] CloseHandle (hObject=0x6ac) returned 1 [0139.936] CloseHandle (hObject=0x6a8) returned 1 [0139.936] CloseHandle (hObject=0x6a4) returned 1 [0139.937] CloseHandle (hObject=0x344) returned 1 [0139.937] CloseHandle (hObject=0x284) returned 1 [0139.937] CloseHandle (hObject=0x280) returned 1 [0139.937] CloseHandle (hObject=0x27c) returned 1 [0139.937] CloseHandle (hObject=0x278) returned 1 [0139.937] CloseHandle (hObject=0x274) returned 1 [0139.937] CloseHandle (hObject=0x270) returned 1 [0139.937] CloseHandle (hObject=0x26c) returned 1 [0139.937] CloseHandle (hObject=0x268) returned 1 [0139.937] CloseHandle (hObject=0x264) returned 1 [0139.937] CloseHandle (hObject=0x260) returned 1 [0139.937] CloseHandle (hObject=0x25c) returned 1 [0139.937] CloseHandle (hObject=0x258) returned 1 [0139.937] CloseHandle (hObject=0x254) returned 1 [0139.937] CloseHandle (hObject=0x250) returned 1 [0139.937] CloseHandle (hObject=0x24c) returned 1 [0139.937] CloseHandle (hObject=0x248) returned 1 [0139.937] CloseHandle (hObject=0x244) returned 1 [0139.937] CloseHandle (hObject=0x240) returned 1 [0139.937] CloseHandle (hObject=0x23c) returned 1 [0139.937] CloseHandle (hObject=0x238) returned 1 [0139.937] CloseHandle (hObject=0x234) returned 1 [0139.938] CloseHandle (hObject=0x230) returned 1 [0139.938] CloseHandle (hObject=0x22c) returned 1 [0139.938] CloseHandle (hObject=0x228) returned 1 [0139.938] CloseHandle (hObject=0x224) returned 1 [0139.938] CloseHandle (hObject=0x220) returned 1 [0139.938] CloseHandle (hObject=0x21c) returned 1 [0139.938] CloseHandle (hObject=0x218) returned 1 [0139.938] CloseHandle (hObject=0x214) returned 1 [0139.938] CloseHandle (hObject=0x210) returned 1 [0139.938] CloseHandle (hObject=0x694) returned 1 [0139.938] CloseHandle (hObject=0x66c) returned 1 [0139.938] CloseHandle (hObject=0x65c) returned 1 [0139.938] CloseHandle (hObject=0x304) returned 1 [0139.938] CloseHandle (hObject=0x4d8) returned 1 [0139.938] CloseHandle (hObject=0x928) returned 1 [0139.938] CloseHandle (hObject=0x3a8) returned 1 [0139.938] CloseHandle (hObject=0x3a4) returned 1 [0139.938] CloseHandle (hObject=0x3a0) returned 1 [0139.938] CloseHandle (hObject=0x39c) returned 1 [0139.938] CloseHandle (hObject=0x398) returned 1 [0139.938] CloseHandle (hObject=0x394) returned 1 [0139.939] CloseHandle (hObject=0x390) returned 1 [0139.939] CloseHandle (hObject=0x38c) returned 1 [0139.939] CloseHandle (hObject=0x388) returned 1 [0139.939] CloseHandle (hObject=0x384) returned 1 [0139.939] CloseHandle (hObject=0x380) returned 1 [0139.939] CloseHandle (hObject=0x37c) returned 1 [0139.939] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 575 os_tid = 0x16d8 [0138.538] GetLastError () returned 0x57 [0138.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772770 [0138.538] SetLastError (dwErrCode=0x57) [0138.538] IcmpCreateFile () returned 0x785428 [0138.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7849b8 [0138.538] IcmpSendEcho2 (in: IcmpHandle=0x785428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc200a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7849b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7849b8) returned 0x0 [0145.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7849b8 | out: hHeap=0x710000) returned 1 [0145.835] IcmpCloseHandle (IcmpHandle=0x785428) returned 1 [0145.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x772770 | out: hHeap=0x710000) returned 1 Thread: id = 576 os_tid = 0x16dc [0138.539] GetLastError () returned 0x57 [0138.539] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772af8 [0138.540] SetLastError (dwErrCode=0x57) [0138.540] IcmpCreateFile () returned 0x785460 [0138.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784a08 [0138.540] IcmpSendEcho2 (in: IcmpHandle=0x785460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc300a8c0, RequestData=0xff8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784a08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784a08) returned 0x0 [0145.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784a08 | out: hHeap=0x710000) returned 1 [0145.838] IcmpCloseHandle (IcmpHandle=0x785460) returned 1 [0145.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x772af8 | out: hHeap=0x710000) returned 1 Thread: id = 577 os_tid = 0x16e0 [0138.541] GetLastError () returned 0x57 [0138.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772e80 [0138.541] SetLastError (dwErrCode=0x57) [0138.541] IcmpCreateFile () returned 0x7853f0 [0138.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784a58 [0138.541] IcmpSendEcho2 (in: IcmpHandle=0x7853f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc400a8c0, RequestData=0x100cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784a58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784a58) returned 0x0 [0145.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784a58 | out: hHeap=0x710000) returned 1 [0145.841] IcmpCloseHandle (IcmpHandle=0x7853f0) returned 1 [0145.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x772e80 | out: hHeap=0x710000) returned 1 Thread: id = 578 os_tid = 0x16e4 [0138.542] GetLastError () returned 0x57 [0138.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773208 [0138.542] SetLastError (dwErrCode=0x57) [0138.542] IcmpCreateFile () returned 0x784f58 [0138.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784aa8 [0138.542] IcmpSendEcho2 (in: IcmpHandle=0x784f58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc500a8c0, RequestData=0x10d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784aa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784aa8) returned 0x0 [0145.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784aa8 | out: hHeap=0x710000) returned 1 [0145.843] IcmpCloseHandle (IcmpHandle=0x784f58) returned 1 [0145.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773208 | out: hHeap=0x710000) returned 1 Thread: id = 579 os_tid = 0x16e8 [0138.543] GetLastError () returned 0x57 [0138.543] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76c490 [0138.543] SetLastError (dwErrCode=0x57) [0138.543] IcmpCreateFile () returned 0x785000 [0138.543] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784af8 [0138.543] IcmpSendEcho2 (in: IcmpHandle=0x785000, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc600a8c0, RequestData=0x1534ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784af8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784af8) returned 0x0 [0145.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784af8 | out: hHeap=0x710000) returned 1 [0145.845] IcmpCloseHandle (IcmpHandle=0x785000) returned 1 [0145.846] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c490 | out: hHeap=0x710000) returned 1 Thread: id = 580 os_tid = 0x16ec [0138.544] GetLastError () returned 0x57 [0138.544] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76c818 [0138.544] SetLastError (dwErrCode=0x57) [0138.544] IcmpCreateFile () returned 0x785038 [0138.544] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784b48 [0138.544] IcmpSendEcho2 (in: IcmpHandle=0x785038, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc700a8c0, RequestData=0x1548ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784b48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784b48) returned 0x0 [0145.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784b48 | out: hHeap=0x710000) returned 1 [0145.847] IcmpCloseHandle (IcmpHandle=0x785038) returned 1 [0145.848] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c818 | out: hHeap=0x710000) returned 1 Thread: id = 581 os_tid = 0x16f0 [0138.545] GetLastError () returned 0x57 [0138.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76cba0 [0138.545] SetLastError (dwErrCode=0x57) [0138.545] IcmpCreateFile () returned 0x785070 [0138.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784b98 [0138.546] IcmpSendEcho2 (in: IcmpHandle=0x785070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc800a8c0, RequestData=0x155cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784b98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784b98) returned 0x0 [0145.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784b98 | out: hHeap=0x710000) returned 1 [0145.850] IcmpCloseHandle (IcmpHandle=0x785070) returned 1 [0145.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76cba0 | out: hHeap=0x710000) returned 1 Thread: id = 582 os_tid = 0x16f4 [0138.546] GetLastError () returned 0x57 [0138.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773590 [0138.547] SetLastError (dwErrCode=0x57) [0138.547] IcmpCreateFile () returned 0x7ae028 [0138.547] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784be8 [0138.547] IcmpSendEcho2 (in: IcmpHandle=0x7ae028, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc900a8c0, RequestData=0x1570ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784be8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784be8) returned 0x0 [0145.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784be8 | out: hHeap=0x710000) returned 1 [0145.853] IcmpCloseHandle (IcmpHandle=0x7ae028) returned 1 [0145.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773590 | out: hHeap=0x710000) returned 1 Thread: id = 583 os_tid = 0x16f8 [0138.548] GetLastError () returned 0x57 [0138.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773918 [0138.548] SetLastError (dwErrCode=0x57) [0138.548] IcmpCreateFile () returned 0x7ae060 [0138.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784c38 [0138.548] IcmpSendEcho2 (in: IcmpHandle=0x7ae060, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xca00a8c0, RequestData=0x1584ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784c38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784c38) returned 0x0 [0145.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784c38 | out: hHeap=0x710000) returned 1 [0145.855] IcmpCloseHandle (IcmpHandle=0x7ae060) returned 1 [0145.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773918 | out: hHeap=0x710000) returned 1 Thread: id = 584 os_tid = 0x16fc [0138.567] GetLastError () returned 0x57 [0138.568] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773ca0 [0138.568] SetLastError (dwErrCode=0x57) [0138.568] IcmpCreateFile () returned 0x7ae098 [0138.568] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7846e8 [0138.568] IcmpSendEcho2 (in: IcmpHandle=0x7ae098, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcb00a8c0, RequestData=0x1598ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7846e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7846e8) returned 0x0 [0145.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7846e8 | out: hHeap=0x710000) returned 1 [0145.857] IcmpCloseHandle (IcmpHandle=0x7ae098) returned 1 [0145.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x773ca0 | out: hHeap=0x710000) returned 1 Thread: id = 585 os_tid = 0x1700 [0138.569] GetLastError () returned 0x57 [0138.569] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x774028 [0138.569] SetLastError (dwErrCode=0x57) [0138.569] IcmpCreateFile () returned 0x7ae0d0 [0138.569] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784738 [0138.569] IcmpSendEcho2 (in: IcmpHandle=0x7ae0d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcc00a8c0, RequestData=0x15acff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784738, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784738) returned 0x0 [0145.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784738 | out: hHeap=0x710000) returned 1 [0145.860] IcmpCloseHandle (IcmpHandle=0x7ae0d0) returned 1 [0145.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774028 | out: hHeap=0x710000) returned 1 Thread: id = 586 os_tid = 0x1704 [0138.570] GetLastError () returned 0x57 [0138.571] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791890 [0138.571] SetLastError (dwErrCode=0x57) [0138.571] IcmpCreateFile () returned 0x7ae108 [0138.571] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784788 [0138.571] IcmpSendEcho2 (in: IcmpHandle=0x7ae108, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcd00a8c0, RequestData=0x15c0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784788, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784788) returned 0x0 [0145.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784788 | out: hHeap=0x710000) returned 1 [0145.862] IcmpCloseHandle (IcmpHandle=0x7ae108) returned 1 [0145.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791890 | out: hHeap=0x710000) returned 1 Thread: id = 587 os_tid = 0x1708 [0138.572] GetLastError () returned 0x57 [0138.572] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791c18 [0138.572] SetLastError (dwErrCode=0x57) [0138.572] IcmpCreateFile () returned 0x7ae140 [0138.572] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7847d8 [0138.572] IcmpSendEcho2 (in: IcmpHandle=0x7ae140, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xce00a8c0, RequestData=0x15d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7847d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7847d8) returned 0x0 [0145.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7847d8 | out: hHeap=0x710000) returned 1 [0145.867] IcmpCloseHandle (IcmpHandle=0x7ae140) returned 1 [0145.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791c18 | out: hHeap=0x710000) returned 1 Thread: id = 588 os_tid = 0x170c [0138.573] GetLastError () returned 0x57 [0138.573] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791fa0 [0138.573] SetLastError (dwErrCode=0x57) [0138.573] IcmpCreateFile () returned 0x7ae178 [0138.573] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784828 [0138.573] IcmpSendEcho2 (in: IcmpHandle=0x7ae178, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcf00a8c0, RequestData=0x15e8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784828, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784828) returned 0x0 [0145.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784828 | out: hHeap=0x710000) returned 1 [0145.870] IcmpCloseHandle (IcmpHandle=0x7ae178) returned 1 [0145.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791fa0 | out: hHeap=0x710000) returned 1 Thread: id = 589 os_tid = 0x1710 [0138.574] GetLastError () returned 0x57 [0138.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x791508 [0138.574] SetLastError (dwErrCode=0x57) [0138.574] IcmpCreateFile () returned 0x7ae1b0 [0138.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784878 [0138.574] IcmpSendEcho2 (in: IcmpHandle=0x7ae1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd000a8c0, RequestData=0x15fcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784878, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784878) returned 0x0 [0145.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784878 | out: hHeap=0x710000) returned 1 [0145.873] IcmpCloseHandle (IcmpHandle=0x7ae1b0) returned 1 [0145.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x791508 | out: hHeap=0x710000) returned 1 Thread: id = 590 os_tid = 0x1714 [0138.575] GetLastError () returned 0x57 [0138.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7553a8 [0138.575] SetLastError (dwErrCode=0x57) [0138.575] IcmpCreateFile () returned 0x7ae1e8 [0138.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7848c8 [0138.575] IcmpSendEcho2 (in: IcmpHandle=0x7ae1e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd100a8c0, RequestData=0x1610ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7848c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7848c8) returned 0x0 [0145.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7848c8 | out: hHeap=0x710000) returned 1 [0145.876] IcmpCloseHandle (IcmpHandle=0x7ae1e8) returned 1 [0145.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7553a8 | out: hHeap=0x710000) returned 1 Thread: id = 591 os_tid = 0x1718 [0138.576] GetLastError () returned 0x57 [0138.576] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755020 [0138.576] SetLastError (dwErrCode=0x57) [0138.576] IcmpCreateFile () returned 0x7ade30 [0138.576] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784918 [0138.577] IcmpSendEcho2 (in: IcmpHandle=0x7ade30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd200a8c0, RequestData=0x1660ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784918, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784918) returned 0x0 [0145.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784918 | out: hHeap=0x710000) returned 1 [0145.879] IcmpCloseHandle (IcmpHandle=0x7ade30) returned 1 [0145.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755020 | out: hHeap=0x710000) returned 1 Thread: id = 592 os_tid = 0x171c [0138.577] GetLastError () returned 0x57 [0138.577] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b54d0 [0138.578] SetLastError (dwErrCode=0x57) [0138.578] IcmpCreateFile () returned 0x7adf10 [0138.578] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784968 [0138.578] IcmpSendEcho2 (in: IcmpHandle=0x7adf10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd300a8c0, RequestData=0x1688ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784968, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784968) returned 0x0 [0145.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784968 | out: hHeap=0x710000) returned 1 [0145.881] IcmpCloseHandle (IcmpHandle=0x7adf10) returned 1 [0145.882] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b54d0 | out: hHeap=0x710000) returned 1 Thread: id = 593 os_tid = 0x1720 [0138.579] GetLastError () returned 0x57 [0138.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5be0 [0138.579] SetLastError (dwErrCode=0x57) [0138.579] IcmpCreateFile () returned 0x7adf48 [0138.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783d88 [0138.579] IcmpSendEcho2 (in: IcmpHandle=0x7adf48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd400a8c0, RequestData=0x16b0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783d88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783d88) returned 0x0 [0145.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783d88 | out: hHeap=0x710000) returned 1 [0145.883] IcmpCloseHandle (IcmpHandle=0x7adf48) returned 1 [0145.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5be0 | out: hHeap=0x710000) returned 1 Thread: id = 594 os_tid = 0x1724 [0138.580] GetLastError () returned 0x57 [0138.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5590 [0138.580] SetLastError (dwErrCode=0x57) [0138.580] IcmpCreateFile () returned 0x7adf80 [0138.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784198 [0138.580] IcmpSendEcho2 (in: IcmpHandle=0x7adf80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd500a8c0, RequestData=0x16c4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784198) returned 0x0 [0145.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784198 | out: hHeap=0x710000) returned 1 [0145.885] IcmpCloseHandle (IcmpHandle=0x7adf80) returned 1 [0145.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5590 | out: hHeap=0x710000) returned 1 Thread: id = 595 os_tid = 0x1728 [0138.581] GetLastError () returned 0x57 [0138.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79f638 [0138.605] SetLastError (dwErrCode=0x57) [0138.605] IcmpCreateFile () returned 0x7adfb8 [0138.609] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783dd8 [0138.611] IcmpSendEcho2 (in: IcmpHandle=0x7adfb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd600a8c0, RequestData=0x16d8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783dd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783dd8) returned 0x0 [0145.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783dd8 | out: hHeap=0x710000) returned 1 [0145.887] IcmpCloseHandle (IcmpHandle=0x7adfb8) returned 1 [0145.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79f638 | out: hHeap=0x710000) returned 1 Thread: id = 596 os_tid = 0x172c [0138.612] GetLastError () returned 0x57 [0138.612] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79f9c0 [0138.612] SetLastError (dwErrCode=0x57) [0138.612] IcmpCreateFile () returned 0x7adff0 [0138.612] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783e28 [0138.612] IcmpSendEcho2 (in: IcmpHandle=0x7adff0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd700a8c0, RequestData=0x16ecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783e28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783e28) returned 0x0 [0145.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783e28 | out: hHeap=0x710000) returned 1 [0145.889] IcmpCloseHandle (IcmpHandle=0x7adff0) returned 1 [0145.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79f9c0 | out: hHeap=0x710000) returned 1 Thread: id = 597 os_tid = 0x1730 [0138.613] GetLastError () returned 0x57 [0138.613] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79fd48 [0138.613] SetLastError (dwErrCode=0x57) [0138.613] IcmpCreateFile () returned 0x75d1c0 [0138.613] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783e78 [0138.613] IcmpSendEcho2 (in: IcmpHandle=0x75d1c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd800a8c0, RequestData=0x1728ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783e78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783e78) returned 0x0 [0145.891] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783e78 | out: hHeap=0x710000) returned 1 [0145.891] IcmpCloseHandle (IcmpHandle=0x75d1c0) returned 1 [0145.891] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79fd48 | out: hHeap=0x710000) returned 1 Thread: id = 598 os_tid = 0x1734 [0138.614] GetLastError () returned 0x57 [0138.614] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a00d0 [0138.614] SetLastError (dwErrCode=0x57) [0138.614] IcmpCreateFile () returned 0x75d3f0 [0138.614] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783ec8 [0138.615] IcmpSendEcho2 (in: IcmpHandle=0x75d3f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd900a8c0, RequestData=0x173cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783ec8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783ec8) returned 0x0 [0145.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783ec8 | out: hHeap=0x710000) returned 1 [0145.893] IcmpCloseHandle (IcmpHandle=0x75d3f0) returned 1 [0145.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a00d0 | out: hHeap=0x710000) returned 1 Thread: id = 599 os_tid = 0x1738 [0138.615] GetLastError () returned 0x57 [0138.615] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a0458 [0138.616] SetLastError (dwErrCode=0x57) [0138.616] IcmpCreateFile () returned 0x75d428 [0138.616] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783f18 [0138.616] IcmpSendEcho2 (in: IcmpHandle=0x75d428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xda00a8c0, RequestData=0x1764ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783f18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783f18) returned 0x0 [0145.895] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783f18 | out: hHeap=0x710000) returned 1 [0145.895] IcmpCloseHandle (IcmpHandle=0x75d428) returned 1 [0145.895] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a0458 | out: hHeap=0x710000) returned 1 Thread: id = 600 os_tid = 0x173c [0138.617] GetLastError () returned 0x57 [0138.617] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a07e0 [0138.617] SetLastError (dwErrCode=0x57) [0138.617] IcmpCreateFile () returned 0x75d540 [0138.617] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783f68 [0138.617] IcmpSendEcho2 (in: IcmpHandle=0x75d540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdb00a8c0, RequestData=0x1778ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783f68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783f68) returned 0x0 [0145.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783f68 | out: hHeap=0x710000) returned 1 [0145.897] IcmpCloseHandle (IcmpHandle=0x75d540) returned 1 [0145.898] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a07e0 | out: hHeap=0x710000) returned 1 Thread: id = 601 os_tid = 0x1740 [0138.618] GetLastError () returned 0x57 [0138.618] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a0b68 [0138.618] SetLastError (dwErrCode=0x57) [0138.618] IcmpCreateFile () returned 0x75d578 [0138.618] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783fb8 [0138.618] IcmpSendEcho2 (in: IcmpHandle=0x75d578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdc00a8c0, RequestData=0x178cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783fb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x783fb8) returned 0x0 [0145.899] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x783fb8 | out: hHeap=0x710000) returned 1 [0145.899] IcmpCloseHandle (IcmpHandle=0x75d578) returned 1 [0145.900] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a0b68 | out: hHeap=0x710000) returned 1 Thread: id = 602 os_tid = 0x1744 [0138.619] GetLastError () returned 0x57 [0138.619] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a0ef0 [0138.620] SetLastError (dwErrCode=0x57) [0138.620] IcmpCreateFile () returned 0x728dd8 [0138.620] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784008 [0138.620] IcmpSendEcho2 (in: IcmpHandle=0x728dd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdd00a8c0, RequestData=0x17a0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784008, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784008) returned 0x0 [0145.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784008 | out: hHeap=0x710000) returned 1 [0145.901] IcmpCloseHandle (IcmpHandle=0x728dd8) returned 1 [0145.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a0ef0 | out: hHeap=0x710000) returned 1 Thread: id = 603 os_tid = 0x1748 [0138.621] GetLastError () returned 0x57 [0138.621] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1278 [0138.621] SetLastError (dwErrCode=0x57) [0138.621] IcmpCreateFile () returned 0x728e48 [0138.621] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784058 [0138.621] IcmpSendEcho2 (in: IcmpHandle=0x728e48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xde00a8c0, RequestData=0x17b4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784058) returned 0x0 [0145.903] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784058 | out: hHeap=0x710000) returned 1 [0145.903] IcmpCloseHandle (IcmpHandle=0x728e48) returned 1 [0145.904] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1278 | out: hHeap=0x710000) returned 1 Thread: id = 604 os_tid = 0x174c [0138.622] GetLastError () returned 0x57 [0138.622] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1600 [0138.622] SetLastError (dwErrCode=0x57) [0138.622] IcmpCreateFile () returned 0x724be8 [0138.622] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7840a8 [0138.622] IcmpSendEcho2 (in: IcmpHandle=0x724be8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdf00a8c0, RequestData=0x17efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7840a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7840a8) returned 0x0 [0145.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7840a8 | out: hHeap=0x710000) returned 1 [0145.905] IcmpCloseHandle (IcmpHandle=0x724be8) returned 1 [0145.906] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1600 | out: hHeap=0x710000) returned 1 Thread: id = 605 os_tid = 0x1750 [0138.623] GetLastError () returned 0x57 [0138.623] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1988 [0138.623] SetLastError (dwErrCode=0x57) [0138.623] IcmpCreateFile () returned 0x74ef08 [0138.623] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7840f8 [0138.623] IcmpSendEcho2 (in: IcmpHandle=0x74ef08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe000a8c0, RequestData=0x1813ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7840f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7840f8) returned 0x0 [0145.907] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7840f8 | out: hHeap=0x710000) returned 1 [0145.907] IcmpCloseHandle (IcmpHandle=0x74ef08) returned 1 [0145.908] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1988 | out: hHeap=0x710000) returned 1 Thread: id = 606 os_tid = 0x1754 [0138.624] GetLastError () returned 0x57 [0138.624] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a1d10 [0138.624] SetLastError (dwErrCode=0x57) [0138.625] IcmpCreateFile () returned 0x79e1b0 [0138.625] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784148 [0138.625] IcmpSendEcho2 (in: IcmpHandle=0x79e1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe100a8c0, RequestData=0x1827ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x784148) returned 0x0 [0145.909] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784148 | out: hHeap=0x710000) returned 1 [0145.909] IcmpCloseHandle (IcmpHandle=0x79e1b0) returned 1 [0145.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a1d10 | out: hHeap=0x710000) returned 1 Thread: id = 607 os_tid = 0x1758 [0138.626] GetLastError () returned 0x57 [0138.626] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2098 [0138.626] SetLastError (dwErrCode=0x57) [0138.626] IcmpCreateFile () returned 0x79dd50 [0138.626] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7841e8 [0138.626] IcmpSendEcho2 (in: IcmpHandle=0x79dd50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe200a8c0, RequestData=0x183bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7841e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7841e8) returned 0x0 [0145.912] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7841e8 | out: hHeap=0x710000) returned 1 [0145.914] IcmpCloseHandle (IcmpHandle=0x79dd50) returned 1 [0145.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2098 | out: hHeap=0x710000) returned 1 Thread: id = 608 os_tid = 0x175c [0138.627] GetLastError () returned 0x57 [0138.627] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2420 [0138.627] SetLastError (dwErrCode=0x57) [0138.627] IcmpCreateFile () returned 0x79dd88 [0138.627] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7648 [0138.627] IcmpSendEcho2 (in: IcmpHandle=0x79dd88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe300a8c0, RequestData=0x184fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7648, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7648) returned 0x0 [0145.917] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7648 | out: hHeap=0x710000) returned 1 [0145.917] IcmpCloseHandle (IcmpHandle=0x79dd88) returned 1 [0145.917] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2420 | out: hHeap=0x710000) returned 1 Thread: id = 609 os_tid = 0x1760 [0138.631] GetLastError () returned 0x57 [0138.631] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a27a8 [0138.631] SetLastError (dwErrCode=0x57) [0138.631] IcmpCreateFile () returned 0x79ddc0 [0138.631] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7698 [0138.631] IcmpSendEcho2 (in: IcmpHandle=0x79ddc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe400a8c0, RequestData=0x1863ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7698, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7698) returned 0x0 [0145.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7698 | out: hHeap=0x710000) returned 1 [0145.919] IcmpCloseHandle (IcmpHandle=0x79ddc0) returned 1 [0145.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a27a8 | out: hHeap=0x710000) returned 1 Thread: id = 610 os_tid = 0x1764 [0138.633] GetLastError () returned 0x57 [0138.633] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2b30 [0138.633] SetLastError (dwErrCode=0x57) [0138.633] IcmpCreateFile () returned 0x79ddf8 [0138.633] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a76e8 [0138.633] IcmpSendEcho2 (in: IcmpHandle=0x79ddf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe500a8c0, RequestData=0x1877ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a76e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a76e8) returned 0x0 [0145.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a76e8 | out: hHeap=0x710000) returned 1 [0145.921] IcmpCloseHandle (IcmpHandle=0x79ddf8) returned 1 [0145.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2b30 | out: hHeap=0x710000) returned 1 Thread: id = 611 os_tid = 0x1768 [0138.634] GetLastError () returned 0x57 [0138.634] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a2eb8 [0138.634] SetLastError (dwErrCode=0x57) [0138.634] IcmpCreateFile () returned 0x79de30 [0138.634] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7738 [0138.635] IcmpSendEcho2 (in: IcmpHandle=0x79de30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe600a8c0, RequestData=0x188bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7738, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7738) returned 0x0 [0145.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7738 | out: hHeap=0x710000) returned 1 [0145.923] IcmpCloseHandle (IcmpHandle=0x79de30) returned 1 [0145.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a2eb8 | out: hHeap=0x710000) returned 1 Thread: id = 612 os_tid = 0x176c [0138.635] GetLastError () returned 0x57 [0138.635] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a3240 [0138.636] SetLastError (dwErrCode=0x57) [0138.636] IcmpCreateFile () returned 0x79de68 [0138.636] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7788 [0138.636] IcmpSendEcho2 (in: IcmpHandle=0x79de68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe700a8c0, RequestData=0x189fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7788, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7788) returned 0x0 [0145.925] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7788 | out: hHeap=0x710000) returned 1 [0145.925] IcmpCloseHandle (IcmpHandle=0x79de68) returned 1 [0145.926] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a3240 | out: hHeap=0x710000) returned 1 Thread: id = 613 os_tid = 0x1770 [0138.637] GetLastError () returned 0x57 [0138.637] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a35c8 [0138.637] SetLastError (dwErrCode=0x57) [0138.637] IcmpCreateFile () returned 0x79dea0 [0138.637] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a79b8 [0138.637] IcmpSendEcho2 (in: IcmpHandle=0x79dea0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe800a8c0, RequestData=0x18b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a79b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a79b8) returned 0x0 [0145.929] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a79b8 | out: hHeap=0x710000) returned 1 [0145.929] IcmpCloseHandle (IcmpHandle=0x79dea0) returned 1 [0145.929] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a35c8 | out: hHeap=0x710000) returned 1 Thread: id = 614 os_tid = 0x1774 [0138.638] GetLastError () returned 0x57 [0138.638] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a3950 [0138.638] SetLastError (dwErrCode=0x57) [0138.638] IcmpCreateFile () returned 0x79ded8 [0138.638] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a75a8 [0138.638] IcmpSendEcho2 (in: IcmpHandle=0x79ded8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe900a8c0, RequestData=0x18c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a75a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a75a8) returned 0x0 [0145.931] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a75a8 | out: hHeap=0x710000) returned 1 [0145.931] IcmpCloseHandle (IcmpHandle=0x79ded8) returned 1 [0145.931] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a3950 | out: hHeap=0x710000) returned 1 Thread: id = 615 os_tid = 0x1778 [0138.639] GetLastError () returned 0x57 [0138.639] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a3cd8 [0138.639] SetLastError (dwErrCode=0x57) [0138.639] IcmpCreateFile () returned 0x79df10 [0138.639] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a75f8 [0138.639] IcmpSendEcho2 (in: IcmpHandle=0x79df10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xea00a8c0, RequestData=0x18dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a75f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a75f8) returned 0x0 [0145.933] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a75f8 | out: hHeap=0x710000) returned 1 [0145.933] IcmpCloseHandle (IcmpHandle=0x79df10) returned 1 [0145.933] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a3cd8 | out: hHeap=0x710000) returned 1 Thread: id = 616 os_tid = 0x177c [0138.640] GetLastError () returned 0x57 [0138.640] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4060 [0138.640] SetLastError (dwErrCode=0x57) [0138.640] IcmpCreateFile () returned 0x79df48 [0138.640] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ce8 [0138.640] IcmpSendEcho2 (in: IcmpHandle=0x79df48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xeb00a8c0, RequestData=0x18efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6ce8) returned 0x0 [0145.935] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6ce8 | out: hHeap=0x710000) returned 1 [0145.935] IcmpCloseHandle (IcmpHandle=0x79df48) returned 1 [0145.935] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4060 | out: hHeap=0x710000) returned 1 Thread: id = 617 os_tid = 0x1780 [0138.641] GetLastError () returned 0x57 [0138.641] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a43e8 [0138.641] SetLastError (dwErrCode=0x57) [0138.641] IcmpCreateFile () returned 0x79df80 [0138.641] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6d38 [0138.641] IcmpSendEcho2 (in: IcmpHandle=0x79df80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xec00a8c0, RequestData=0x1903ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6d38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6d38) returned 0x0 [0145.937] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6d38 | out: hHeap=0x710000) returned 1 [0145.937] IcmpCloseHandle (IcmpHandle=0x79df80) returned 1 [0145.938] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a43e8 | out: hHeap=0x710000) returned 1 Thread: id = 618 os_tid = 0x1784 [0138.642] GetLastError () returned 0x57 [0138.642] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4770 [0138.643] SetLastError (dwErrCode=0x57) [0138.643] IcmpCreateFile () returned 0x79dfb8 [0138.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6d88 [0138.643] IcmpSendEcho2 (in: IcmpHandle=0x79dfb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xed00a8c0, RequestData=0x1917ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6d88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6d88) returned 0x0 [0145.939] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6d88 | out: hHeap=0x710000) returned 1 [0145.939] IcmpCloseHandle (IcmpHandle=0x79dfb8) returned 1 [0145.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4770 | out: hHeap=0x710000) returned 1 Thread: id = 619 os_tid = 0x1788 [0138.643] GetLastError () returned 0x57 [0138.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4af8 [0138.644] SetLastError (dwErrCode=0x57) [0138.644] IcmpCreateFile () returned 0x79dff0 [0138.644] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6dd8 [0138.644] IcmpSendEcho2 (in: IcmpHandle=0x79dff0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xee00a8c0, RequestData=0x192bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6dd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6dd8) returned 0x0 [0145.946] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6dd8 | out: hHeap=0x710000) returned 1 [0145.946] IcmpCloseHandle (IcmpHandle=0x79dff0) returned 1 [0145.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4af8 | out: hHeap=0x710000) returned 1 Thread: id = 620 os_tid = 0x178c [0138.645] GetLastError () returned 0x57 [0138.645] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a4e80 [0138.645] SetLastError (dwErrCode=0x57) [0138.645] IcmpCreateFile () returned 0x79e028 [0138.645] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6e28 [0138.645] IcmpSendEcho2 (in: IcmpHandle=0x79e028, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xef00a8c0, RequestData=0x193fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6e28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6e28) returned 0x0 [0145.949] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6e28 | out: hHeap=0x710000) returned 1 [0145.949] IcmpCloseHandle (IcmpHandle=0x79e028) returned 1 [0145.950] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a4e80 | out: hHeap=0x710000) returned 1 Thread: id = 621 os_tid = 0x1790 [0138.646] GetLastError () returned 0x57 [0138.646] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5208 [0138.646] SetLastError (dwErrCode=0x57) [0138.646] IcmpCreateFile () returned 0x79e060 [0138.646] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6e78 [0138.646] IcmpSendEcho2 (in: IcmpHandle=0x79e060, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf000a8c0, RequestData=0x1953ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6e78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6e78) returned 0x0 [0145.952] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6e78 | out: hHeap=0x710000) returned 1 [0145.952] IcmpCloseHandle (IcmpHandle=0x79e060) returned 1 [0145.953] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5208 | out: hHeap=0x710000) returned 1 Thread: id = 622 os_tid = 0x1794 [0138.647] GetLastError () returned 0x57 [0138.647] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5918 [0138.647] SetLastError (dwErrCode=0x57) [0138.647] IcmpCreateFile () returned 0x79e098 [0138.647] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ec8 [0138.647] IcmpSendEcho2 (in: IcmpHandle=0x79e098, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf100a8c0, RequestData=0x1967ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ec8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6ec8) returned 0x0 [0145.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6ec8 | out: hHeap=0x710000) returned 1 [0145.955] IcmpCloseHandle (IcmpHandle=0x79e098) returned 1 [0145.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5918 | out: hHeap=0x710000) returned 1 Thread: id = 623 os_tid = 0x1798 [0138.648] GetLastError () returned 0x57 [0138.648] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79eba0 [0138.648] SetLastError (dwErrCode=0x57) [0138.648] IcmpCreateFile () returned 0x79e0d0 [0138.648] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6f18 [0138.649] IcmpSendEcho2 (in: IcmpHandle=0x79e0d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf200a8c0, RequestData=0x197bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6f18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6f18) returned 0x0 [0145.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6f18 | out: hHeap=0x710000) returned 1 [0145.959] IcmpCloseHandle (IcmpHandle=0x79e0d0) returned 1 [0145.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79eba0 | out: hHeap=0x710000) returned 1 Thread: id = 624 os_tid = 0x179c [0138.649] GetLastError () returned 0x57 [0138.649] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79ef28 [0138.650] SetLastError (dwErrCode=0x57) [0138.650] IcmpCreateFile () returned 0x79e108 [0138.650] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6f68 [0138.650] IcmpSendEcho2 (in: IcmpHandle=0x79e108, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf300a8c0, RequestData=0x198fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6f68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6f68) returned 0x0 [0145.961] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6f68 | out: hHeap=0x710000) returned 1 [0145.961] IcmpCloseHandle (IcmpHandle=0x79e108) returned 1 [0145.961] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79ef28 | out: hHeap=0x710000) returned 1 Thread: id = 625 os_tid = 0x17a0 [0138.650] GetLastError () returned 0x57 [0138.651] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x79f2b0 [0138.651] SetLastError (dwErrCode=0x57) [0138.651] IcmpCreateFile () returned 0x79e140 [0138.651] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6fb8 [0138.651] IcmpSendEcho2 (in: IcmpHandle=0x79e140, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf400a8c0, RequestData=0x19a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6fb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6fb8) returned 0x0 [0145.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6fb8 | out: hHeap=0x710000) returned 1 [0145.963] IcmpCloseHandle (IcmpHandle=0x79e140) returned 1 [0145.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79f2b0 | out: hHeap=0x710000) returned 1 Thread: id = 626 os_tid = 0x17a4 [0138.652] GetLastError () returned 0x57 [0138.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a5ca0 [0138.652] SetLastError (dwErrCode=0x57) [0138.652] IcmpCreateFile () returned 0x79e178 [0138.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7008 [0138.652] IcmpSendEcho2 (in: IcmpHandle=0x79e178, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf500a8c0, RequestData=0x19b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7008, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7008) returned 0x0 [0145.965] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7008 | out: hHeap=0x710000) returned 1 [0145.965] IcmpCloseHandle (IcmpHandle=0x79e178) returned 1 [0145.965] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a5ca0 | out: hHeap=0x710000) returned 1 Thread: id = 627 os_tid = 0x17a8 [0138.657] GetLastError () returned 0x57 [0138.658] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a6028 [0138.658] SetLastError (dwErrCode=0x57) [0138.658] IcmpCreateFile () returned 0x79e1e8 [0138.658] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a70a8 [0138.658] IcmpSendEcho2 (in: IcmpHandle=0x79e1e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf600a8c0, RequestData=0x19cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a70a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a70a8) returned 0x0 [0145.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a70a8 | out: hHeap=0x710000) returned 1 [0145.967] IcmpCloseHandle (IcmpHandle=0x79e1e8) returned 1 [0145.968] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6028 | out: hHeap=0x710000) returned 1 Thread: id = 628 os_tid = 0x17ac [0138.661] GetLastError () returned 0x57 [0138.661] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a63b0 [0138.662] SetLastError (dwErrCode=0x57) [0138.662] IcmpCreateFile () returned 0x79e220 [0138.662] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a70f8 [0138.662] IcmpSendEcho2 (in: IcmpHandle=0x79e220, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf700a8c0, RequestData=0x19dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a70f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a70f8) returned 0x0 [0145.970] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a70f8 | out: hHeap=0x710000) returned 1 [0145.970] IcmpCloseHandle (IcmpHandle=0x79e220) returned 1 [0145.970] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a63b0 | out: hHeap=0x710000) returned 1 Thread: id = 629 os_tid = 0x17b0 [0138.663] GetLastError () returned 0x57 [0138.663] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a6738 [0138.663] SetLastError (dwErrCode=0x57) [0138.663] IcmpCreateFile () returned 0x79e258 [0138.663] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ba8 [0138.663] IcmpSendEcho2 (in: IcmpHandle=0x79e258, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf800a8c0, RequestData=0x19f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6ba8) returned 0x0 [0145.972] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6ba8 | out: hHeap=0x710000) returned 1 [0145.972] IcmpCloseHandle (IcmpHandle=0x79e258) returned 1 [0145.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6738 | out: hHeap=0x710000) returned 1 Thread: id = 630 os_tid = 0x17b4 [0138.664] GetLastError () returned 0x57 [0138.664] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0e98 [0138.667] SetLastError (dwErrCode=0x57) [0138.667] IcmpCreateFile () returned 0x79dc00 [0138.667] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7558 [0138.667] IcmpSendEcho2 (in: IcmpHandle=0x79dc00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf900a8c0, RequestData=0x1a07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7558, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7558) returned 0x0 [0145.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7558 | out: hHeap=0x710000) returned 1 [0145.987] IcmpCloseHandle (IcmpHandle=0x79dc00) returned 1 [0145.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c0e98 | out: hHeap=0x710000) returned 1 Thread: id = 631 os_tid = 0x17b8 [0138.668] GetLastError () returned 0x57 [0138.668] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c6a68 [0138.668] SetLastError (dwErrCode=0x57) [0138.668] IcmpCreateFile () returned 0x79db90 [0138.668] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7058 [0138.668] IcmpSendEcho2 (in: IcmpHandle=0x79db90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfa00a8c0, RequestData=0x1a1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7058) returned 0x0 [0145.995] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7058 | out: hHeap=0x710000) returned 1 [0145.995] IcmpCloseHandle (IcmpHandle=0x79db90) returned 1 [0145.996] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c6a68 | out: hHeap=0x710000) returned 1 Thread: id = 632 os_tid = 0x17bc [0138.671] GetLastError () returned 0x57 [0138.671] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c6df0 [0138.671] SetLastError (dwErrCode=0x57) [0138.671] IcmpCreateFile () returned 0x79dbc8 [0138.671] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7148 [0138.672] IcmpSendEcho2 (in: IcmpHandle=0x79dbc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfb00a8c0, RequestData=0x1a2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7148) returned 0x0 [0146.001] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7148 | out: hHeap=0x710000) returned 1 [0146.001] IcmpCloseHandle (IcmpHandle=0x79dbc8) returned 1 [0146.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c6df0 | out: hHeap=0x710000) returned 1 Thread: id = 633 os_tid = 0x17c0 [0138.672] GetLastError () returned 0x57 [0138.672] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0078 [0138.673] SetLastError (dwErrCode=0x57) [0138.673] IcmpCreateFile () returned 0x79dc38 [0138.673] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7198 [0138.673] IcmpSendEcho2 (in: IcmpHandle=0x79dc38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfc00a8c0, RequestData=0x1a43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7198) returned 0x0 [0146.004] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7198 | out: hHeap=0x710000) returned 1 [0146.005] IcmpCloseHandle (IcmpHandle=0x79dc38) returned 1 [0146.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c0078 | out: hHeap=0x710000) returned 1 Thread: id = 634 os_tid = 0x17c4 [0138.674] GetLastError () returned 0x57 [0138.674] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0400 [0138.674] SetLastError (dwErrCode=0x57) [0138.674] IcmpCreateFile () returned 0x79dc70 [0138.674] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a71e8 [0138.674] IcmpSendEcho2 (in: IcmpHandle=0x79dc70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfd00a8c0, RequestData=0x1a57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a71e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a71e8) returned 0x0 [0146.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a71e8 | out: hHeap=0x710000) returned 1 [0146.010] IcmpCloseHandle (IcmpHandle=0x79dc70) returned 1 [0146.011] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c0400 | out: hHeap=0x710000) returned 1 Thread: id = 635 os_tid = 0x17c8 [0138.675] GetLastError () returned 0x57 [0138.675] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0788 [0138.675] SetLastError (dwErrCode=0x57) [0138.675] IcmpCreateFile () returned 0x79dca8 [0138.675] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7238 [0138.675] IcmpSendEcho2 (in: IcmpHandle=0x79dca8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfe00a8c0, RequestData=0x1a6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7238) returned 0x0 [0146.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7238 | out: hHeap=0x710000) returned 1 [0146.014] IcmpCloseHandle (IcmpHandle=0x79dca8) returned 1 [0146.015] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c0788 | out: hHeap=0x710000) returned 1 Thread: id = 636 os_tid = 0x17cc [0140.079] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0140.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0140.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f000c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0140.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0140.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0024, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0140.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0140.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f003c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0140.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0140.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0054, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0140.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0140.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f006c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0140.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0140.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0084, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0140.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0140.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f009c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0140.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0140.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0140.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0140.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0140.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0140.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0140.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0140.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0140.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0140.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0114, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0140.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0140.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f012c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0140.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0140.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0144, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0140.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0140.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f015c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0140.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0140.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0174, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0140.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0140.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f018c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0140.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0140.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0140.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0140.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0140.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0140.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0140.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0140.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0140.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0140.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0204, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0140.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0140.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f021c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0140.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0140.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0234, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0140.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0140.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f024c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0140.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0140.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0264, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0140.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0140.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f027c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0140.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0140.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0294, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0140.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0140.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0140.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0140.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0140.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0140.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0140.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0140.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0140.241] WaitForMultipleObjects (nCount=0x40, lpHandles=0x700000*=0x398, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0141.673] CloseHandle (hObject=0x398) returned 1 [0141.673] CloseHandle (hObject=0x938) returned 1 [0141.673] CloseHandle (hObject=0x388) returned 1 [0141.674] CloseHandle (hObject=0x37c) returned 1 [0141.674] CloseHandle (hObject=0x380) returned 1 [0141.674] CloseHandle (hObject=0x940) returned 1 [0141.674] CloseHandle (hObject=0x8a8) returned 1 [0141.674] CloseHandle (hObject=0x38c) returned 1 [0141.674] CloseHandle (hObject=0x390) returned 1 [0141.674] CloseHandle (hObject=0x39c) returned 1 [0141.674] CloseHandle (hObject=0x3a0) returned 1 [0141.674] CloseHandle (hObject=0x3a4) returned 1 [0141.674] CloseHandle (hObject=0x3a8) returned 1 [0141.674] CloseHandle (hObject=0x928) returned 1 [0141.674] CloseHandle (hObject=0x4d8) returned 1 [0141.674] CloseHandle (hObject=0x304) returned 1 [0141.674] CloseHandle (hObject=0x65c) returned 1 [0141.674] CloseHandle (hObject=0x66c) returned 1 [0141.674] CloseHandle (hObject=0x694) returned 1 [0141.675] CloseHandle (hObject=0x210) returned 1 [0141.675] CloseHandle (hObject=0x214) returned 1 [0141.675] CloseHandle (hObject=0x218) returned 1 [0141.675] CloseHandle (hObject=0x21c) returned 1 [0141.675] CloseHandle (hObject=0x220) returned 1 [0141.675] CloseHandle (hObject=0x224) returned 1 [0141.675] CloseHandle (hObject=0x228) returned 1 [0141.675] CloseHandle (hObject=0x22c) returned 1 [0141.675] CloseHandle (hObject=0x230) returned 1 [0141.675] CloseHandle (hObject=0x234) returned 1 [0141.675] CloseHandle (hObject=0x238) returned 1 [0141.675] CloseHandle (hObject=0x23c) returned 1 [0141.675] CloseHandle (hObject=0x240) returned 1 [0141.675] CloseHandle (hObject=0x244) returned 1 [0141.675] CloseHandle (hObject=0x248) returned 1 [0141.676] CloseHandle (hObject=0x24c) returned 1 [0141.676] CloseHandle (hObject=0x250) returned 1 [0141.676] CloseHandle (hObject=0x254) returned 1 [0141.676] CloseHandle (hObject=0x258) returned 1 [0141.676] CloseHandle (hObject=0x25c) returned 1 [0141.676] CloseHandle (hObject=0x260) returned 1 [0141.676] CloseHandle (hObject=0x264) returned 1 [0141.676] CloseHandle (hObject=0x268) returned 1 [0141.676] CloseHandle (hObject=0x26c) returned 1 [0141.676] CloseHandle (hObject=0x270) returned 1 [0141.676] CloseHandle (hObject=0x274) returned 1 [0141.676] CloseHandle (hObject=0x278) returned 1 [0141.676] CloseHandle (hObject=0x27c) returned 1 [0141.676] CloseHandle (hObject=0x280) returned 1 [0141.676] CloseHandle (hObject=0x284) returned 1 [0141.676] CloseHandle (hObject=0x344) returned 1 [0141.677] CloseHandle (hObject=0x83c) returned 1 [0141.677] CloseHandle (hObject=0x838) returned 1 [0141.677] CloseHandle (hObject=0x834) returned 1 [0141.677] CloseHandle (hObject=0x830) returned 1 [0141.677] CloseHandle (hObject=0x82c) returned 1 [0141.677] CloseHandle (hObject=0x828) returned 1 [0141.677] CloseHandle (hObject=0x824) returned 1 [0141.677] CloseHandle (hObject=0x820) returned 1 [0141.677] CloseHandle (hObject=0x81c) returned 1 [0141.677] CloseHandle (hObject=0x818) returned 1 [0141.677] CloseHandle (hObject=0x814) returned 1 [0141.677] CloseHandle (hObject=0x748) returned 1 [0141.677] CloseHandle (hObject=0x744) returned 1 [0141.677] CloseHandle (hObject=0x740) returned 1 [0141.677] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 637 os_tid = 0x17d0 [0140.156] GetLastError () returned 0x57 [0140.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0b10 [0140.157] SetLastError (dwErrCode=0x57) [0140.157] IcmpCreateFile () returned 0x79dce0 [0140.157] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7af8 [0140.157] IcmpSendEcho2 (in: IcmpHandle=0x79dce0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x100a8c0, RequestData=0xed0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7af8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7af8) returned 0x0 [0146.018] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7af8 | out: hHeap=0x710000) returned 1 [0146.018] IcmpCloseHandle (IcmpHandle=0x79dce0) returned 1 [0146.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c0b10 | out: hHeap=0x710000) returned 1 Thread: id = 638 os_tid = 0x17d4 [0140.158] GetLastError () returned 0x57 [0140.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c1220 [0140.158] SetLastError (dwErrCode=0x57) [0140.158] IcmpCreateFile () returned 0x79dd18 [0140.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a77d8 [0140.158] IcmpSendEcho2 (in: IcmpHandle=0x79dd18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x200a8c0, RequestData=0xee4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a77d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a77d8) returned 0x0 [0146.023] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a77d8 | out: hHeap=0x710000) returned 1 [0146.023] IcmpCloseHandle (IcmpHandle=0x79dd18) returned 1 [0146.023] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c1220 | out: hHeap=0x710000) returned 1 Thread: id = 639 os_tid = 0x17d8 [0140.159] GetLastError () returned 0x57 [0140.159] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c15a8 [0140.159] SetLastError (dwErrCode=0x57) [0140.159] IcmpCreateFile () returned 0x79e2c8 [0140.159] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7828 [0140.159] IcmpSendEcho2 (in: IcmpHandle=0x79e2c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x300a8c0, RequestData=0xef8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7828, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7828) returned 0x0 [0146.026] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7828 | out: hHeap=0x710000) returned 1 [0146.027] IcmpCloseHandle (IcmpHandle=0x79e2c8) returned 1 [0146.027] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c15a8 | out: hHeap=0x710000) returned 1 Thread: id = 640 os_tid = 0x17dc [0140.160] GetLastError () returned 0x57 [0140.160] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c1930 [0140.160] SetLastError (dwErrCode=0x57) [0140.160] IcmpCreateFile () returned 0x79e300 [0140.160] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7878 [0140.160] IcmpSendEcho2 (in: IcmpHandle=0x79e300, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x400a8c0, RequestData=0xf0cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7878, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7878) returned 0x0 [0146.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7878 | out: hHeap=0x710000) returned 1 [0146.030] IcmpCloseHandle (IcmpHandle=0x79e300) returned 1 [0146.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c1930 | out: hHeap=0x710000) returned 1 Thread: id = 641 os_tid = 0x17e0 [0140.161] GetLastError () returned 0x57 [0140.161] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c1cb8 [0140.162] SetLastError (dwErrCode=0x57) [0140.162] IcmpCreateFile () returned 0x79e290 [0140.162] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a78c8 [0140.162] IcmpSendEcho2 (in: IcmpHandle=0x79e290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x500a8c0, RequestData=0xf20ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a78c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a78c8) returned 0x0 [0146.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a78c8 | out: hHeap=0x710000) returned 1 [0146.034] IcmpCloseHandle (IcmpHandle=0x79e290) returned 1 [0146.037] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c1cb8 | out: hHeap=0x710000) returned 1 Thread: id = 642 os_tid = 0x17e4 [0140.165] GetLastError () returned 0x57 [0140.165] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2040 [0140.165] SetLastError (dwErrCode=0x57) [0140.165] IcmpCreateFile () returned 0x7bd6a0 [0140.165] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7918 [0140.165] IcmpSendEcho2 (in: IcmpHandle=0x7bd6a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x600a8c0, RequestData=0xf34ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7918, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7918) returned 0x0 [0146.039] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7918 | out: hHeap=0x710000) returned 1 [0146.039] IcmpCloseHandle (IcmpHandle=0x7bd6a0) returned 1 [0146.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c2040 | out: hHeap=0x710000) returned 1 Thread: id = 643 os_tid = 0x17e8 [0140.166] GetLastError () returned 0x57 [0140.166] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c23c8 [0140.166] SetLastError (dwErrCode=0x57) [0140.166] IcmpCreateFile () returned 0x7bd6d8 [0140.166] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7968 [0140.166] IcmpSendEcho2 (in: IcmpHandle=0x7bd6d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x700a8c0, RequestData=0xf48ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7968, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7968) returned 0x0 [0146.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7968 | out: hHeap=0x710000) returned 1 [0146.042] IcmpCloseHandle (IcmpHandle=0x7bd6d8) returned 1 [0146.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c23c8 | out: hHeap=0x710000) returned 1 Thread: id = 644 os_tid = 0x17ec [0140.167] GetLastError () returned 0x57 [0140.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2750 [0140.167] SetLastError (dwErrCode=0x57) [0140.167] IcmpCreateFile () returned 0x7bd710 [0140.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7a08 [0140.167] IcmpSendEcho2 (in: IcmpHandle=0x7bd710, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x800a8c0, RequestData=0xf70ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7a08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7a08) returned 0x0 [0146.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7a08 | out: hHeap=0x710000) returned 1 [0146.044] IcmpCloseHandle (IcmpHandle=0x7bd710) returned 1 [0146.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c2750 | out: hHeap=0x710000) returned 1 Thread: id = 645 os_tid = 0x17f0 [0140.168] GetLastError () returned 0x57 [0140.168] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2ad8 [0140.168] SetLastError (dwErrCode=0x57) [0140.168] IcmpCreateFile () returned 0x7bd748 [0140.168] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7a58 [0140.168] IcmpSendEcho2 (in: IcmpHandle=0x7bd748, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x900a8c0, RequestData=0xf84ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7a58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7a58) returned 0x0 [0146.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7a58 | out: hHeap=0x710000) returned 1 [0146.046] IcmpCloseHandle (IcmpHandle=0x7bd748) returned 1 [0146.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c2ad8 | out: hHeap=0x710000) returned 1 Thread: id = 646 os_tid = 0x17f4 [0140.169] GetLastError () returned 0x57 [0140.169] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2e60 [0140.170] SetLastError (dwErrCode=0x57) [0140.170] IcmpCreateFile () returned 0x7bd780 [0140.172] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7aa8 [0140.172] IcmpSendEcho2 (in: IcmpHandle=0x7bd780, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa00a8c0, RequestData=0xfe4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7aa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7aa8) returned 0x0 [0146.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7aa8 | out: hHeap=0x710000) returned 1 [0146.048] IcmpCloseHandle (IcmpHandle=0x7bd780) returned 1 [0146.049] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c2e60 | out: hHeap=0x710000) returned 1 Thread: id = 647 os_tid = 0x17f8 [0140.173] GetLastError () returned 0x57 [0140.173] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c31e8 [0140.173] SetLastError (dwErrCode=0x57) [0140.173] IcmpCreateFile () returned 0x7bd7b8 [0140.173] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7288 [0140.173] IcmpSendEcho2 (in: IcmpHandle=0x7bd7b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb00a8c0, RequestData=0x1084ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7288, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7288) returned 0x0 [0146.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7288 | out: hHeap=0x710000) returned 1 [0146.050] IcmpCloseHandle (IcmpHandle=0x7bd7b8) returned 1 [0146.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c31e8 | out: hHeap=0x710000) returned 1 Thread: id = 648 os_tid = 0x17fc [0140.175] GetLastError () returned 0x57 [0140.175] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c3570 [0140.175] SetLastError (dwErrCode=0x57) [0140.175] IcmpCreateFile () returned 0x7bd7f0 [0140.175] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a72d8 [0140.175] IcmpSendEcho2 (in: IcmpHandle=0x7bd7f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc00a8c0, RequestData=0x1098ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a72d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a72d8) returned 0x0 [0146.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a72d8 | out: hHeap=0x710000) returned 1 [0146.054] IcmpCloseHandle (IcmpHandle=0x7bd7f0) returned 1 [0146.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c3570 | out: hHeap=0x710000) returned 1 Thread: id = 649 os_tid = 0x10b8 [0140.176] GetLastError () returned 0x57 [0140.176] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c38f8 [0140.176] SetLastError (dwErrCode=0x57) [0140.176] IcmpCreateFile () returned 0x7bd828 [0140.176] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7328 [0140.176] IcmpSendEcho2 (in: IcmpHandle=0x7bd828, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd00a8c0, RequestData=0x1700ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7328, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7328) returned 0x0 [0146.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7328 | out: hHeap=0x710000) returned 1 [0146.056] IcmpCloseHandle (IcmpHandle=0x7bd828) returned 1 [0146.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c38f8 | out: hHeap=0x710000) returned 1 Thread: id = 650 os_tid = 0xda0 [0140.177] GetLastError () returned 0x57 [0140.177] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c3c80 [0140.177] SetLastError (dwErrCode=0x57) [0140.178] IcmpCreateFile () returned 0x7bd860 [0140.178] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7378 [0140.178] IcmpSendEcho2 (in: IcmpHandle=0x7bd860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe00a8c0, RequestData=0x1a8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7378, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7378) returned 0x0 [0146.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7378 | out: hHeap=0x710000) returned 1 [0146.059] IcmpCloseHandle (IcmpHandle=0x7bd860) returned 1 [0146.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c3c80 | out: hHeap=0x710000) returned 1 Thread: id = 651 os_tid = 0x12b8 [0140.178] GetLastError () returned 0x57 [0140.179] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4008 [0140.179] SetLastError (dwErrCode=0x57) [0140.179] IcmpCreateFile () returned 0x7bd898 [0140.179] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a73c8 [0140.179] IcmpSendEcho2 (in: IcmpHandle=0x7bd898, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf00a8c0, RequestData=0x1aa3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a73c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a73c8) returned 0x0 [0146.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a73c8 | out: hHeap=0x710000) returned 1 [0146.061] IcmpCloseHandle (IcmpHandle=0x7bd898) returned 1 [0146.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c4008 | out: hHeap=0x710000) returned 1 Thread: id = 652 os_tid = 0x10c0 [0140.180] GetLastError () returned 0x57 [0140.180] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4390 [0140.180] SetLastError (dwErrCode=0x57) [0140.180] IcmpCreateFile () returned 0x7bd8d0 [0140.180] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7418 [0140.180] IcmpSendEcho2 (in: IcmpHandle=0x7bd8d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1000a8c0, RequestData=0x1ab7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7418, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7418) returned 0x0 [0146.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7418 | out: hHeap=0x710000) returned 1 [0146.063] IcmpCloseHandle (IcmpHandle=0x7bd8d0) returned 1 [0146.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c4390 | out: hHeap=0x710000) returned 1 Thread: id = 653 os_tid = 0x10c4 [0140.181] GetLastError () returned 0x57 [0140.181] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4718 [0140.181] SetLastError (dwErrCode=0x57) [0140.181] IcmpCreateFile () returned 0x7bd908 [0140.181] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7468 [0140.181] IcmpSendEcho2 (in: IcmpHandle=0x7bd908, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1100a8c0, RequestData=0x1acbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7468, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7468) returned 0x0 [0146.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7468 | out: hHeap=0x710000) returned 1 [0146.066] IcmpCloseHandle (IcmpHandle=0x7bd908) returned 1 [0146.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c4718 | out: hHeap=0x710000) returned 1 Thread: id = 654 os_tid = 0x10c8 [0140.182] GetLastError () returned 0x57 [0140.182] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4aa0 [0140.182] SetLastError (dwErrCode=0x57) [0140.182] IcmpCreateFile () returned 0x7bd940 [0140.182] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a74b8 [0140.183] IcmpSendEcho2 (in: IcmpHandle=0x7bd940, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1200a8c0, RequestData=0x1adfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a74b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a74b8) returned 0x0 [0146.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a74b8 | out: hHeap=0x710000) returned 1 [0146.068] IcmpCloseHandle (IcmpHandle=0x7bd940) returned 1 [0146.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c4aa0 | out: hHeap=0x710000) returned 1 Thread: id = 655 os_tid = 0x10bc [0140.183] GetLastError () returned 0x57 [0140.183] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4e28 [0140.184] SetLastError (dwErrCode=0x57) [0140.184] IcmpCreateFile () returned 0x7bd978 [0140.184] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7508 [0140.184] IcmpSendEcho2 (in: IcmpHandle=0x7bd978, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1300a8c0, RequestData=0x1af3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7508, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a7508) returned 0x0 [0146.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7508 | out: hHeap=0x710000) returned 1 [0146.071] IcmpCloseHandle (IcmpHandle=0x7bd978) returned 1 [0146.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c4e28 | out: hHeap=0x710000) returned 1 Thread: id = 656 os_tid = 0x10cc [0140.185] GetLastError () returned 0x57 [0140.185] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c51b0 [0140.185] SetLastError (dwErrCode=0x57) [0140.185] IcmpCreateFile () returned 0x7bd9b0 [0140.185] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6bf8 [0140.185] IcmpSendEcho2 (in: IcmpHandle=0x7bd9b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1400a8c0, RequestData=0x1b07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6bf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6bf8) returned 0x0 [0146.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6bf8 | out: hHeap=0x710000) returned 1 [0146.074] IcmpCloseHandle (IcmpHandle=0x7bd9b0) returned 1 [0146.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c51b0 | out: hHeap=0x710000) returned 1 Thread: id = 657 os_tid = 0x10d0 [0140.186] GetLastError () returned 0x57 [0140.186] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c5538 [0140.186] SetLastError (dwErrCode=0x57) [0140.186] IcmpCreateFile () returned 0x7bd9e8 [0140.186] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6c48 [0140.186] IcmpSendEcho2 (in: IcmpHandle=0x7bd9e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1500a8c0, RequestData=0x1b1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6c48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6c48) returned 0x0 [0146.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6c48 | out: hHeap=0x710000) returned 1 [0146.078] IcmpCloseHandle (IcmpHandle=0x7bd9e8) returned 1 [0146.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c5538 | out: hHeap=0x710000) returned 1 Thread: id = 658 os_tid = 0x10d4 [0140.187] GetLastError () returned 0x57 [0140.187] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c58c0 [0140.187] SetLastError (dwErrCode=0x57) [0140.187] IcmpCreateFile () returned 0x7bda20 [0140.187] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6c98 [0140.187] IcmpSendEcho2 (in: IcmpHandle=0x7bda20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1600a8c0, RequestData=0x1b2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6c98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7a6c98) returned 0x0 [0146.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a6c98 | out: hHeap=0x710000) returned 1 [0146.081] IcmpCloseHandle (IcmpHandle=0x7bda20) returned 1 [0146.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c58c0 | out: hHeap=0x710000) returned 1 Thread: id = 659 os_tid = 0x10dc [0140.188] GetLastError () returned 0x57 [0140.188] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c5c48 [0140.188] SetLastError (dwErrCode=0x57) [0140.188] IcmpCreateFile () returned 0x7bda58 [0140.188] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baa70 [0140.188] IcmpSendEcho2 (in: IcmpHandle=0x7bda58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1700a8c0, RequestData=0x1b43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baa70, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baa70) returned 0x0 [0146.087] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baa70 | out: hHeap=0x710000) returned 1 [0146.087] IcmpCloseHandle (IcmpHandle=0x7bda58) returned 1 [0146.087] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c5c48 | out: hHeap=0x710000) returned 1 Thread: id = 660 os_tid = 0xba8 [0140.189] GetLastError () returned 0x57 [0140.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c5fd0 [0140.189] SetLastError (dwErrCode=0x57) [0140.189] IcmpCreateFile () returned 0x7bda90 [0140.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baac0 [0140.189] IcmpSendEcho2 (in: IcmpHandle=0x7bda90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1800a8c0, RequestData=0x1b57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baac0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baac0) returned 0x0 [0146.089] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baac0 | out: hHeap=0x710000) returned 1 [0146.089] IcmpCloseHandle (IcmpHandle=0x7bda90) returned 1 [0146.090] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c5fd0 | out: hHeap=0x710000) returned 1 Thread: id = 661 os_tid = 0x10e8 [0140.190] GetLastError () returned 0x57 [0140.190] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c6358 [0140.190] SetLastError (dwErrCode=0x57) [0140.190] IcmpCreateFile () returned 0x7bdac8 [0140.191] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bab10 [0140.191] IcmpSendEcho2 (in: IcmpHandle=0x7bdac8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1900a8c0, RequestData=0x1b6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bab10, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bab10) returned 0x0 [0146.092] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bab10 | out: hHeap=0x710000) returned 1 [0146.092] IcmpCloseHandle (IcmpHandle=0x7bdac8) returned 1 [0146.092] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c6358 | out: hHeap=0x710000) returned 1 Thread: id = 662 os_tid = 0x10e0 [0140.191] GetLastError () returned 0x57 [0140.191] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c66e0 [0140.192] SetLastError (dwErrCode=0x57) [0140.192] IcmpCreateFile () returned 0x7bd400 [0140.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bab60 [0140.192] IcmpSendEcho2 (in: IcmpHandle=0x7bd400, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1a00a8c0, RequestData=0x1b7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bab60, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bab60) returned 0x0 [0146.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bab60 | out: hHeap=0x710000) returned 1 [0146.094] IcmpCloseHandle (IcmpHandle=0x7bd400) returned 1 [0146.095] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c66e0 | out: hHeap=0x710000) returned 1 Thread: id = 663 os_tid = 0x10d8 [0140.192] GetLastError () returned 0x57 [0140.193] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7c10 [0140.193] SetLastError (dwErrCode=0x57) [0140.193] IcmpCreateFile () returned 0x7bd438 [0140.193] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7babb0 [0140.193] IcmpSendEcho2 (in: IcmpHandle=0x7bd438, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b00a8c0, RequestData=0x1b93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7babb0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7babb0) returned 0x0 [0146.097] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7babb0 | out: hHeap=0x710000) returned 1 [0146.097] IcmpCloseHandle (IcmpHandle=0x7bd438) returned 1 [0146.097] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c7c10 | out: hHeap=0x710000) returned 1 Thread: id = 664 os_tid = 0x10a4 [0140.194] GetLastError () returned 0x57 [0140.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7178 [0140.194] SetLastError (dwErrCode=0x57) [0140.194] IcmpCreateFile () returned 0x7bd470 [0140.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bac00 [0140.194] IcmpSendEcho2 (in: IcmpHandle=0x7bd470, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1c00a8c0, RequestData=0x1ba7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bac00, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bac00) returned 0x0 [0146.099] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bac00 | out: hHeap=0x710000) returned 1 [0146.099] IcmpCloseHandle (IcmpHandle=0x7bd470) returned 1 [0146.100] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c7178 | out: hHeap=0x710000) returned 1 Thread: id = 665 os_tid = 0x9fc [0140.195] GetLastError () returned 0x57 [0140.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7500 [0140.196] SetLastError (dwErrCode=0x57) [0140.196] IcmpCreateFile () returned 0x7bd4a8 [0140.196] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bac50 [0140.196] IcmpSendEcho2 (in: IcmpHandle=0x7bd4a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1d00a8c0, RequestData=0x1bbbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bac50, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bac50) returned 0x0 [0146.102] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bac50 | out: hHeap=0x710000) returned 1 [0146.102] IcmpCloseHandle (IcmpHandle=0x7bd4a8) returned 1 [0146.103] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c7500 | out: hHeap=0x710000) returned 1 Thread: id = 666 os_tid = 0x10ac [0140.197] GetLastError () returned 0x57 [0140.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7888 [0140.197] SetLastError (dwErrCode=0x57) [0140.197] IcmpCreateFile () returned 0x7bd4e0 [0140.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baca0 [0140.197] IcmpSendEcho2 (in: IcmpHandle=0x7bd4e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1e00a8c0, RequestData=0x1bcfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baca0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baca0) returned 0x0 [0146.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baca0 | out: hHeap=0x710000) returned 1 [0146.105] IcmpCloseHandle (IcmpHandle=0x7bd4e0) returned 1 [0146.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c7888 | out: hHeap=0x710000) returned 1 Thread: id = 667 os_tid = 0x10b0 [0140.198] GetLastError () returned 0x57 [0140.198] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4dc0 [0140.198] SetLastError (dwErrCode=0x57) [0140.198] IcmpCreateFile () returned 0x7bd518 [0140.198] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bacf0 [0140.198] IcmpSendEcho2 (in: IcmpHandle=0x7bd518, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1f00a8c0, RequestData=0x1be3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bacf0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bacf0) returned 0x0 [0146.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bacf0 | out: hHeap=0x710000) returned 1 [0146.108] IcmpCloseHandle (IcmpHandle=0x7bd518) returned 1 [0146.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b4dc0 | out: hHeap=0x710000) returned 1 Thread: id = 668 os_tid = 0x10b4 [0140.199] GetLastError () returned 0x57 [0140.199] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5148 [0140.199] SetLastError (dwErrCode=0x57) [0140.199] IcmpCreateFile () returned 0x7bd550 [0140.199] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bad40 [0140.199] IcmpSendEcho2 (in: IcmpHandle=0x7bd550, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2000a8c0, RequestData=0x1bf7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bad40, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bad40) returned 0x0 [0146.111] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bad40 | out: hHeap=0x710000) returned 1 [0146.111] IcmpCloseHandle (IcmpHandle=0x7bd550) returned 1 [0146.111] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5148 | out: hHeap=0x710000) returned 1 Thread: id = 669 os_tid = 0x10a8 [0140.200] GetLastError () returned 0x57 [0140.200] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ae3d0 [0140.200] SetLastError (dwErrCode=0x57) [0140.200] IcmpCreateFile () returned 0x7bd588 [0140.200] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba520 [0140.200] IcmpSendEcho2 (in: IcmpHandle=0x7bd588, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2100a8c0, RequestData=0x1c0bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba520, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba520) returned 0x0 [0146.113] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba520 | out: hHeap=0x710000) returned 1 [0146.113] IcmpCloseHandle (IcmpHandle=0x7bd588) returned 1 [0146.114] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ae3d0 | out: hHeap=0x710000) returned 1 Thread: id = 670 os_tid = 0x684 [0140.201] GetLastError () returned 0x57 [0140.201] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ae758 [0140.201] SetLastError (dwErrCode=0x57) [0140.201] IcmpCreateFile () returned 0x7bd5f8 [0140.201] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba570 [0140.202] IcmpSendEcho2 (in: IcmpHandle=0x7bd5f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2200a8c0, RequestData=0x1c1fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba570, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba570) returned 0x0 [0146.117] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba570 | out: hHeap=0x710000) returned 1 [0146.117] IcmpCloseHandle (IcmpHandle=0x7bd5f8) returned 1 [0146.117] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ae758 | out: hHeap=0x710000) returned 1 Thread: id = 671 os_tid = 0xb74 [0140.203] GetLastError () returned 0x57 [0140.203] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aeae0 [0140.203] SetLastError (dwErrCode=0x57) [0140.203] IcmpCreateFile () returned 0x7bd630 [0140.203] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba5c0 [0140.203] IcmpSendEcho2 (in: IcmpHandle=0x7bd630, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2300a8c0, RequestData=0x1c33ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba5c0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba5c0) returned 0x0 [0146.119] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba5c0 | out: hHeap=0x710000) returned 1 [0146.119] IcmpCloseHandle (IcmpHandle=0x7bd630) returned 1 [0146.120] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aeae0 | out: hHeap=0x710000) returned 1 Thread: id = 672 os_tid = 0x3c8 [0140.205] GetLastError () returned 0x57 [0140.205] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aee68 [0140.205] SetLastError (dwErrCode=0x57) [0140.205] IcmpCreateFile () returned 0x7bd668 [0140.205] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba610 [0140.205] IcmpSendEcho2 (in: IcmpHandle=0x7bd668, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2400a8c0, RequestData=0x1c47ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba610, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba610) returned 0x0 [0146.121] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba610 | out: hHeap=0x710000) returned 1 [0146.121] IcmpCloseHandle (IcmpHandle=0x7bd668) returned 1 [0146.122] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aee68 | out: hHeap=0x710000) returned 1 Thread: id = 673 os_tid = 0xaa4 [0140.206] GetLastError () returned 0x57 [0140.206] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7af1f0 [0140.207] SetLastError (dwErrCode=0x57) [0140.207] IcmpCreateFile () returned 0x7ae300 [0140.207] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba660 [0140.207] IcmpSendEcho2 (in: IcmpHandle=0x7ae300, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2500a8c0, RequestData=0x1c5bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba660, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba660) returned 0x0 [0146.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba660 | out: hHeap=0x710000) returned 1 [0146.124] IcmpCloseHandle (IcmpHandle=0x7ae300) returned 1 [0146.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7af1f0 | out: hHeap=0x710000) returned 1 Thread: id = 674 os_tid = 0x674 [0140.208] GetLastError () returned 0x57 [0140.208] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7af578 [0140.208] SetLastError (dwErrCode=0x57) [0140.208] IcmpCreateFile () returned 0x7ae338 [0140.208] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba6b0 [0140.208] IcmpSendEcho2 (in: IcmpHandle=0x7ae338, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2600a8c0, RequestData=0x1c6fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba6b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba6b0) returned 0x0 [0146.126] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba6b0 | out: hHeap=0x710000) returned 1 [0146.126] IcmpCloseHandle (IcmpHandle=0x7ae338) returned 1 [0146.127] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7af578 | out: hHeap=0x710000) returned 1 Thread: id = 675 os_tid = 0x2d8 [0140.209] GetLastError () returned 0x57 [0140.210] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7af900 [0140.210] SetLastError (dwErrCode=0x57) [0140.210] IcmpCreateFile () returned 0x7ae2c8 [0140.210] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba700 [0140.210] IcmpSendEcho2 (in: IcmpHandle=0x7ae2c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2700a8c0, RequestData=0x1c83ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba700, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba700) returned 0x0 [0146.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba700 | out: hHeap=0x710000) returned 1 [0146.128] IcmpCloseHandle (IcmpHandle=0x7ae2c8) returned 1 [0146.129] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7af900 | out: hHeap=0x710000) returned 1 Thread: id = 676 os_tid = 0x538 [0140.212] GetLastError () returned 0x57 [0140.212] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7afc88 [0140.212] SetLastError (dwErrCode=0x57) [0140.212] IcmpCreateFile () returned 0x7ade68 [0140.212] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba750 [0140.212] IcmpSendEcho2 (in: IcmpHandle=0x7ade68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2800a8c0, RequestData=0x1c97ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba750, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba750) returned 0x0 [0146.131] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba750 | out: hHeap=0x710000) returned 1 [0146.131] IcmpCloseHandle (IcmpHandle=0x7ade68) returned 1 [0146.132] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7afc88 | out: hHeap=0x710000) returned 1 Thread: id = 677 os_tid = 0x4f8 [0140.213] GetLastError () returned 0x57 [0140.214] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0010 [0140.214] SetLastError (dwErrCode=0x57) [0140.214] IcmpCreateFile () returned 0x7adea0 [0140.214] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba7a0 [0140.214] IcmpSendEcho2 (in: IcmpHandle=0x7adea0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2900a8c0, RequestData=0x1cabff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba7a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba7a0) returned 0x0 [0146.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba7a0 | out: hHeap=0x710000) returned 1 [0146.134] IcmpCloseHandle (IcmpHandle=0x7adea0) returned 1 [0146.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0010 | out: hHeap=0x710000) returned 1 Thread: id = 678 os_tid = 0x128 [0140.215] GetLastError () returned 0x57 [0140.215] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0398 [0140.215] SetLastError (dwErrCode=0x57) [0140.215] IcmpCreateFile () returned 0x7aded8 [0140.215] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba7f0 [0140.216] IcmpSendEcho2 (in: IcmpHandle=0x7aded8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2a00a8c0, RequestData=0x1cbfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba7f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba7f0) returned 0x0 [0146.136] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba7f0 | out: hHeap=0x710000) returned 1 [0146.136] IcmpCloseHandle (IcmpHandle=0x7aded8) returned 1 [0146.137] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0398 | out: hHeap=0x710000) returned 1 Thread: id = 679 os_tid = 0x104c [0140.217] GetLastError () returned 0x57 [0140.217] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0720 [0140.217] SetLastError (dwErrCode=0x57) [0140.217] IcmpCreateFile () returned 0x7ae220 [0140.217] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba930 [0140.217] IcmpSendEcho2 (in: IcmpHandle=0x7ae220, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2b00a8c0, RequestData=0x1cd3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba930, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba930) returned 0x0 [0146.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba930 | out: hHeap=0x710000) returned 1 [0146.138] IcmpCloseHandle (IcmpHandle=0x7ae220) returned 1 [0146.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0720 | out: hHeap=0x710000) returned 1 Thread: id = 680 os_tid = 0x1050 [0140.218] GetLastError () returned 0x57 [0140.218] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0aa8 [0140.218] SetLastError (dwErrCode=0x57) [0140.218] IcmpCreateFile () returned 0x7ae258 [0140.218] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb100 [0140.218] IcmpSendEcho2 (in: IcmpHandle=0x7ae258, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2c00a8c0, RequestData=0x1ce7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb100, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb100) returned 0x0 [0146.141] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb100 | out: hHeap=0x710000) returned 1 [0146.141] IcmpCloseHandle (IcmpHandle=0x7ae258) returned 1 [0146.141] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0aa8 | out: hHeap=0x710000) returned 1 Thread: id = 681 os_tid = 0x1058 [0140.220] GetLastError () returned 0x57 [0140.220] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0e30 [0140.220] SetLastError (dwErrCode=0x57) [0140.220] IcmpCreateFile () returned 0x7ae290 [0140.220] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb150 [0140.220] IcmpSendEcho2 (in: IcmpHandle=0x7ae290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2d00a8c0, RequestData=0x1cfbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb150, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb150) returned 0x0 [0146.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb150 | out: hHeap=0x710000) returned 1 [0146.143] IcmpCloseHandle (IcmpHandle=0x7ae290) returned 1 [0146.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b0e30 | out: hHeap=0x710000) returned 1 Thread: id = 682 os_tid = 0x105c [0140.221] GetLastError () returned 0x57 [0140.221] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b11b8 [0140.222] SetLastError (dwErrCode=0x57) [0140.222] IcmpCreateFile () returned 0x7adbc8 [0140.222] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb1a0 [0140.222] IcmpSendEcho2 (in: IcmpHandle=0x7adbc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2e00a8c0, RequestData=0x1d0fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb1a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb1a0) returned 0x0 [0146.145] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb1a0 | out: hHeap=0x710000) returned 1 [0146.146] IcmpCloseHandle (IcmpHandle=0x7adbc8) returned 1 [0146.146] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b11b8 | out: hHeap=0x710000) returned 1 Thread: id = 683 os_tid = 0x1060 [0140.223] GetLastError () returned 0x57 [0140.223] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1540 [0140.223] SetLastError (dwErrCode=0x57) [0140.223] IcmpCreateFile () returned 0x7adc00 [0140.223] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb1f0 [0140.223] IcmpSendEcho2 (in: IcmpHandle=0x7adc00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2f00a8c0, RequestData=0x1d23ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb1f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb1f0) returned 0x0 [0146.148] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb1f0 | out: hHeap=0x710000) returned 1 [0146.148] IcmpCloseHandle (IcmpHandle=0x7adc00) returned 1 [0146.149] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b1540 | out: hHeap=0x710000) returned 1 Thread: id = 684 os_tid = 0x864 [0140.224] GetLastError () returned 0x57 [0140.225] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b18c8 [0140.225] SetLastError (dwErrCode=0x57) [0140.225] IcmpCreateFile () returned 0x7adc38 [0140.225] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb240 [0140.225] IcmpSendEcho2 (in: IcmpHandle=0x7adc38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3000a8c0, RequestData=0x1d37ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb240, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb240) returned 0x0 [0146.151] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb240 | out: hHeap=0x710000) returned 1 [0146.151] IcmpCloseHandle (IcmpHandle=0x7adc38) returned 1 [0146.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b18c8 | out: hHeap=0x710000) returned 1 Thread: id = 685 os_tid = 0xfc4 [0140.226] GetLastError () returned 0x57 [0140.226] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1c50 [0140.226] SetLastError (dwErrCode=0x57) [0140.226] IcmpCreateFile () returned 0x7adc70 [0140.226] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb290 [0140.226] IcmpSendEcho2 (in: IcmpHandle=0x7adc70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3100a8c0, RequestData=0x1d4bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb290, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb290) returned 0x0 [0146.157] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb290 | out: hHeap=0x710000) returned 1 [0146.157] IcmpCloseHandle (IcmpHandle=0x7adc70) returned 1 [0146.157] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b1c50 | out: hHeap=0x710000) returned 1 Thread: id = 686 os_tid = 0xd74 [0140.231] GetLastError () returned 0x57 [0140.231] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1fd8 [0140.231] SetLastError (dwErrCode=0x57) [0140.231] IcmpCreateFile () returned 0x7adca8 [0140.231] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb2e0 [0140.231] IcmpSendEcho2 (in: IcmpHandle=0x7adca8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3200a8c0, RequestData=0x1d5fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb2e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb2e0) returned 0x0 [0146.160] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb2e0 | out: hHeap=0x710000) returned 1 [0146.160] IcmpCloseHandle (IcmpHandle=0x7adca8) returned 1 [0146.161] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b1fd8 | out: hHeap=0x710000) returned 1 Thread: id = 687 os_tid = 0xd84 [0140.253] GetLastError () returned 0x57 [0140.253] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2360 [0140.253] SetLastError (dwErrCode=0x57) [0140.253] IcmpCreateFile () returned 0x7adce0 [0140.253] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bad90 [0140.253] IcmpSendEcho2 (in: IcmpHandle=0x7adce0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3300a8c0, RequestData=0x1d73ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bad90, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bad90) returned 0x0 [0146.164] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bad90 | out: hHeap=0x710000) returned 1 [0146.164] IcmpCloseHandle (IcmpHandle=0x7adce0) returned 1 [0146.165] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b2360 | out: hHeap=0x710000) returned 1 Thread: id = 688 os_tid = 0xd88 [0140.254] GetLastError () returned 0x57 [0140.254] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b26e8 [0140.255] SetLastError (dwErrCode=0x57) [0140.255] IcmpCreateFile () returned 0x7add18 [0140.255] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb330 [0140.255] IcmpSendEcho2 (in: IcmpHandle=0x7add18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3400a8c0, RequestData=0x1d87ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb330, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb330) returned 0x0 [0146.169] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb330 | out: hHeap=0x710000) returned 1 [0146.169] IcmpCloseHandle (IcmpHandle=0x7add18) returned 1 [0146.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b26e8 | out: hHeap=0x710000) returned 1 Thread: id = 689 os_tid = 0xd94 [0140.256] GetLastError () returned 0x57 [0140.256] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2a70 [0140.256] SetLastError (dwErrCode=0x57) [0140.256] IcmpCreateFile () returned 0x7add50 [0140.256] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bade0 [0140.256] IcmpSendEcho2 (in: IcmpHandle=0x7add50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3500a8c0, RequestData=0x1d9bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bade0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bade0) returned 0x0 [0146.173] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bade0 | out: hHeap=0x710000) returned 1 [0146.173] IcmpCloseHandle (IcmpHandle=0x7add50) returned 1 [0146.173] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b2a70 | out: hHeap=0x710000) returned 1 Thread: id = 690 os_tid = 0xdb4 [0140.257] GetLastError () returned 0x57 [0140.257] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2df8 [0140.258] SetLastError (dwErrCode=0x57) [0140.258] IcmpCreateFile () returned 0x7add88 [0140.258] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bae30 [0140.258] IcmpSendEcho2 (in: IcmpHandle=0x7add88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3600a8c0, RequestData=0x1dafff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bae30, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bae30) returned 0x0 [0146.175] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bae30 | out: hHeap=0x710000) returned 1 [0146.175] IcmpCloseHandle (IcmpHandle=0x7add88) returned 1 [0146.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b2df8 | out: hHeap=0x710000) returned 1 Thread: id = 691 os_tid = 0xd98 [0140.259] GetLastError () returned 0x57 [0140.259] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3180 [0140.259] SetLastError (dwErrCode=0x57) [0140.259] IcmpCreateFile () returned 0x7addc0 [0140.259] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bae80 [0140.259] IcmpSendEcho2 (in: IcmpHandle=0x7addc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3700a8c0, RequestData=0x1dc3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bae80, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bae80) returned 0x0 [0146.179] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bae80 | out: hHeap=0x710000) returned 1 [0146.179] IcmpCloseHandle (IcmpHandle=0x7addc0) returned 1 [0146.179] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3180 | out: hHeap=0x710000) returned 1 Thread: id = 692 os_tid = 0xd9c [0140.260] GetLastError () returned 0x57 [0140.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3508 [0140.261] SetLastError (dwErrCode=0x57) [0140.261] IcmpCreateFile () returned 0x7addf8 [0140.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baed0 [0140.261] IcmpSendEcho2 (in: IcmpHandle=0x7addf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3800a8c0, RequestData=0x1dd7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baed0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baed0) returned 0x0 [0146.181] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baed0 | out: hHeap=0x710000) returned 1 [0146.181] IcmpCloseHandle (IcmpHandle=0x7addf8) returned 1 [0146.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3508 | out: hHeap=0x710000) returned 1 Thread: id = 693 os_tid = 0xdc8 [0140.262] GetLastError () returned 0x57 [0140.262] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3890 [0140.262] SetLastError (dwErrCode=0x57) [0140.262] IcmpCreateFile () returned 0x7bd5c0 [0140.262] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baf20 [0140.262] IcmpSendEcho2 (in: IcmpHandle=0x7bd5c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3900a8c0, RequestData=0x1debff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baf20, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baf20) returned 0x0 [0146.184] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baf20 | out: hHeap=0x710000) returned 1 [0146.184] IcmpCloseHandle (IcmpHandle=0x7bd5c0) returned 1 [0146.184] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3890 | out: hHeap=0x710000) returned 1 Thread: id = 694 os_tid = 0xda8 [0140.264] GetLastError () returned 0x57 [0140.264] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3c18 [0140.264] SetLastError (dwErrCode=0x57) [0140.264] IcmpCreateFile () returned 0x78b950 [0140.264] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baf70 [0140.264] IcmpSendEcho2 (in: IcmpHandle=0x78b950, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3a00a8c0, RequestData=0x1dffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baf70, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baf70) returned 0x0 [0146.187] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baf70 | out: hHeap=0x710000) returned 1 [0146.187] IcmpCloseHandle (IcmpHandle=0x78b950) returned 1 [0146.187] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3c18 | out: hHeap=0x710000) returned 1 Thread: id = 695 os_tid = 0xdb0 [0140.265] GetLastError () returned 0x57 [0140.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3fa0 [0140.265] SetLastError (dwErrCode=0x57) [0140.265] IcmpCreateFile () returned 0x78b988 [0140.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bafc0 [0140.265] IcmpSendEcho2 (in: IcmpHandle=0x78b988, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3b00a8c0, RequestData=0x1e13ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bafc0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bafc0) returned 0x0 [0146.189] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bafc0 | out: hHeap=0x710000) returned 1 [0146.189] IcmpCloseHandle (IcmpHandle=0x78b988) returned 1 [0146.190] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b3fa0 | out: hHeap=0x710000) returned 1 Thread: id = 696 os_tid = 0xdcc [0140.267] GetLastError () returned 0x57 [0140.267] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4328 [0140.267] SetLastError (dwErrCode=0x57) [0140.267] IcmpCreateFile () returned 0x78b9c0 [0140.267] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb010 [0140.267] IcmpSendEcho2 (in: IcmpHandle=0x78b9c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3c00a8c0, RequestData=0x1e27ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb010, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb010) returned 0x0 [0146.192] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb010 | out: hHeap=0x710000) returned 1 [0146.192] IcmpCloseHandle (IcmpHandle=0x78b9c0) returned 1 [0146.193] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b4328 | out: hHeap=0x710000) returned 1 Thread: id = 697 os_tid = 0xdd0 [0140.268] GetLastError () returned 0x57 [0140.268] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b46b0 [0140.269] SetLastError (dwErrCode=0x57) [0140.269] IcmpCreateFile () returned 0x78b9f8 [0140.269] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb060 [0140.269] IcmpSendEcho2 (in: IcmpHandle=0x78b9f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3d00a8c0, RequestData=0x1e3bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb060, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb060) returned 0x0 [0146.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb060 | out: hHeap=0x710000) returned 1 [0146.195] IcmpCloseHandle (IcmpHandle=0x78b9f8) returned 1 [0146.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b46b0 | out: hHeap=0x710000) returned 1 Thread: id = 698 os_tid = 0x1114 [0140.270] GetLastError () returned 0x57 [0140.270] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4a38 [0140.270] SetLastError (dwErrCode=0x57) [0140.270] IcmpCreateFile () returned 0x78ba30 [0140.270] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7bb0b0 [0140.270] IcmpSendEcho2 (in: IcmpHandle=0x78ba30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3e00a8c0, RequestData=0x1e4fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7bb0b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7bb0b0) returned 0x0 [0146.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bb0b0 | out: hHeap=0x710000) returned 1 [0146.197] IcmpCloseHandle (IcmpHandle=0x78ba30) returned 1 [0146.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b4a38 | out: hHeap=0x710000) returned 1 Thread: id = 699 os_tid = 0xdd4 [0140.271] GetLastError () returned 0x57 [0140.271] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5858 [0140.272] SetLastError (dwErrCode=0x57) [0140.272] IcmpCreateFile () returned 0x78ba68 [0140.272] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7657e8 [0140.272] IcmpSendEcho2 (in: IcmpHandle=0x78ba68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3f00a8c0, RequestData=0x1e63ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7657e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7657e8) returned 0x0 [0146.200] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7657e8 | out: hHeap=0x710000) returned 1 [0146.200] IcmpCloseHandle (IcmpHandle=0x78ba68) returned 1 [0146.200] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5858 | out: hHeap=0x710000) returned 1 Thread: id = 700 os_tid = 0xe40 [0140.273] GetLastError () returned 0x57 [0140.273] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5f68 [0140.275] SetLastError (dwErrCode=0x57) [0140.275] IcmpCreateFile () returned 0x78baa0 [0140.275] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765838 [0140.275] IcmpSendEcho2 (in: IcmpHandle=0x78baa0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4000a8c0, RequestData=0x1e77ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765838, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765838) returned 0x0 [0146.202] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765838 | out: hHeap=0x710000) returned 1 [0146.202] IcmpCloseHandle (IcmpHandle=0x78baa0) returned 1 [0146.203] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7b5f68 | out: hHeap=0x710000) returned 1 Thread: id = 701 os_tid = 0xe50 [0141.786] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0141.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0141.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f030c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0141.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0141.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0324, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0141.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0141.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f033c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0141.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0141.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0354, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0141.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0141.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f036c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0141.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0141.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0384, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0141.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0141.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f039c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0141.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0141.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0141.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0141.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0141.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0141.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0141.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0141.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0141.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0141.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0414, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0141.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0141.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f042c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0141.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0141.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0444, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0141.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0141.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f045c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0141.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0141.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0474, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0141.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0141.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f048c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0141.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0141.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0141.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0141.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0141.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0141.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0141.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0141.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0141.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0141.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0141.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0141.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f051c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0141.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0141.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0534, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0141.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0141.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f054c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0141.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0141.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0564, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0141.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0141.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f057c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0142.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0142.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0594, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0142.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0142.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0142.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0142.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0142.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0142.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0142.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0142.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0142.006] WaitForMultipleObjects (nCount=0x40, lpHandles=0x700000*=0x920, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0143.412] CloseHandle (hObject=0x920) returned 1 [0143.412] CloseHandle (hObject=0x740) returned 1 [0143.412] CloseHandle (hObject=0x744) returned 1 [0143.412] CloseHandle (hObject=0x748) returned 1 [0143.412] CloseHandle (hObject=0x814) returned 1 [0143.412] CloseHandle (hObject=0x818) returned 1 [0143.412] CloseHandle (hObject=0x81c) returned 1 [0143.412] CloseHandle (hObject=0x820) returned 1 [0143.412] CloseHandle (hObject=0x824) returned 1 [0143.412] CloseHandle (hObject=0x828) returned 1 [0143.412] CloseHandle (hObject=0x82c) returned 1 [0143.412] CloseHandle (hObject=0x830) returned 1 [0143.412] CloseHandle (hObject=0x834) returned 1 [0143.413] CloseHandle (hObject=0x838) returned 1 [0143.413] CloseHandle (hObject=0x83c) returned 1 [0143.413] CloseHandle (hObject=0x344) returned 1 [0143.413] CloseHandle (hObject=0x284) returned 1 [0143.413] CloseHandle (hObject=0x280) returned 1 [0143.413] CloseHandle (hObject=0x27c) returned 1 [0143.413] CloseHandle (hObject=0x278) returned 1 [0143.413] CloseHandle (hObject=0x274) returned 1 [0143.413] CloseHandle (hObject=0x270) returned 1 [0143.413] CloseHandle (hObject=0x26c) returned 1 [0143.413] CloseHandle (hObject=0x268) returned 1 [0143.413] CloseHandle (hObject=0x264) returned 1 [0143.413] CloseHandle (hObject=0x260) returned 1 [0143.413] CloseHandle (hObject=0x25c) returned 1 [0143.413] CloseHandle (hObject=0x258) returned 1 [0143.413] CloseHandle (hObject=0x254) returned 1 [0143.413] CloseHandle (hObject=0x250) returned 1 [0143.413] CloseHandle (hObject=0x24c) returned 1 [0143.413] CloseHandle (hObject=0x248) returned 1 [0143.413] CloseHandle (hObject=0x244) returned 1 [0143.414] CloseHandle (hObject=0x240) returned 1 [0143.414] CloseHandle (hObject=0x23c) returned 1 [0143.414] CloseHandle (hObject=0x238) returned 1 [0143.414] CloseHandle (hObject=0x234) returned 1 [0143.414] CloseHandle (hObject=0x230) returned 1 [0143.414] CloseHandle (hObject=0x22c) returned 1 [0143.414] CloseHandle (hObject=0x228) returned 1 [0143.414] CloseHandle (hObject=0x224) returned 1 [0143.414] CloseHandle (hObject=0x220) returned 1 [0143.414] CloseHandle (hObject=0x21c) returned 1 [0143.414] CloseHandle (hObject=0x218) returned 1 [0143.414] CloseHandle (hObject=0x214) returned 1 [0143.414] CloseHandle (hObject=0x210) returned 1 [0143.414] CloseHandle (hObject=0x694) returned 1 [0143.414] CloseHandle (hObject=0x99c) returned 1 [0143.414] CloseHandle (hObject=0x998) returned 1 [0143.414] CloseHandle (hObject=0x994) returned 1 [0143.415] CloseHandle (hObject=0x990) returned 1 [0143.415] CloseHandle (hObject=0x98c) returned 1 [0143.415] CloseHandle (hObject=0x988) returned 1 [0143.415] CloseHandle (hObject=0x984) returned 1 [0143.415] CloseHandle (hObject=0x980) returned 1 [0143.415] CloseHandle (hObject=0x97c) returned 1 [0143.415] CloseHandle (hObject=0x448) returned 1 [0143.415] CloseHandle (hObject=0x394) returned 1 [0143.415] CloseHandle (hObject=0x6a4) returned 1 [0143.415] CloseHandle (hObject=0x8c0) returned 1 [0143.415] CloseHandle (hObject=0x358) returned 1 [0143.415] CloseHandle (hObject=0x8d0) returned 1 [0143.415] CloseHandle (hObject=0x8d8) returned 1 [0143.415] CloseHandle (hObject=0x8c8) returned 1 [0143.415] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 702 os_tid = 0xd80 [0141.895] GetLastError () returned 0x57 [0141.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db998 [0141.896] SetLastError (dwErrCode=0x57) [0141.896] IcmpCreateFile () returned 0x78bad8 [0141.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7652e8 [0141.896] IcmpSendEcho2 (in: IcmpHandle=0x78bad8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4100a8c0, RequestData=0xb38ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7652e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7652e8) returned 0x0 [0146.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7652e8 | out: hHeap=0x710000) returned 1 [0146.210] IcmpCloseHandle (IcmpHandle=0x78bad8) returned 1 [0146.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7db998 | out: hHeap=0x710000) returned 1 Thread: id = 703 os_tid = 0xd78 [0141.897] GetLastError () returned 0x57 [0141.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dbd20 [0141.897] SetLastError (dwErrCode=0x57) [0141.897] IcmpCreateFile () returned 0x78bb10 [0141.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765338 [0141.897] IcmpSendEcho2 (in: IcmpHandle=0x78bb10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4200a8c0, RequestData=0xb4cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765338, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765338) returned 0x0 [0146.212] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765338 | out: hHeap=0x710000) returned 1 [0146.212] IcmpCloseHandle (IcmpHandle=0x78bb10) returned 1 [0146.212] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dbd20 | out: hHeap=0x710000) returned 1 Thread: id = 704 os_tid = 0xe54 [0141.899] GetLastError () returned 0x57 [0141.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d4fa8 [0141.900] SetLastError (dwErrCode=0x57) [0141.900] IcmpCreateFile () returned 0x78bb48 [0141.900] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765388 [0141.900] IcmpSendEcho2 (in: IcmpHandle=0x78bb48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4300a8c0, RequestData=0xb60ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765388, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765388) returned 0x0 [0146.214] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765388 | out: hHeap=0x710000) returned 1 [0146.214] IcmpCloseHandle (IcmpHandle=0x78bb48) returned 1 [0146.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d4fa8 | out: hHeap=0x710000) returned 1 Thread: id = 705 os_tid = 0x11fc [0141.901] GetLastError () returned 0x57 [0141.901] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5330 [0141.901] SetLastError (dwErrCode=0x57) [0141.901] IcmpCreateFile () returned 0x78bb80 [0141.901] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7653d8 [0141.901] IcmpSendEcho2 (in: IcmpHandle=0x78bb80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4400a8c0, RequestData=0xb74ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7653d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7653d8) returned 0x0 [0146.216] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7653d8 | out: hHeap=0x710000) returned 1 [0146.216] IcmpCloseHandle (IcmpHandle=0x78bb80) returned 1 [0146.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d5330 | out: hHeap=0x710000) returned 1 Thread: id = 706 os_tid = 0x1204 [0141.902] GetLastError () returned 0x57 [0141.902] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d56b8 [0141.903] SetLastError (dwErrCode=0x57) [0141.903] IcmpCreateFile () returned 0x78bbb8 [0141.903] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765428 [0141.903] IcmpSendEcho2 (in: IcmpHandle=0x78bbb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4500a8c0, RequestData=0x1048ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765428, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765428) returned 0x0 [0146.218] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765428 | out: hHeap=0x710000) returned 1 [0146.218] IcmpCloseHandle (IcmpHandle=0x78bbb8) returned 1 [0146.219] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d56b8 | out: hHeap=0x710000) returned 1 Thread: id = 707 os_tid = 0x1200 [0141.904] GetLastError () returned 0x57 [0141.904] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5a40 [0141.904] SetLastError (dwErrCode=0x57) [0141.904] IcmpCreateFile () returned 0x78bbf0 [0141.904] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765478 [0141.904] IcmpSendEcho2 (in: IcmpHandle=0x78bbf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4600a8c0, RequestData=0x1070ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765478, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765478) returned 0x0 [0146.220] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765478 | out: hHeap=0x710000) returned 1 [0146.220] IcmpCloseHandle (IcmpHandle=0x78bbf0) returned 1 [0146.221] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d5a40 | out: hHeap=0x710000) returned 1 Thread: id = 708 os_tid = 0x11f8 [0141.906] GetLastError () returned 0x57 [0141.906] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5dc8 [0141.906] SetLastError (dwErrCode=0x57) [0141.906] IcmpCreateFile () returned 0x78bc28 [0141.906] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765518 [0141.906] IcmpSendEcho2 (in: IcmpHandle=0x78bc28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4700a8c0, RequestData=0x10c0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765518, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765518) returned 0x0 [0146.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765518 | out: hHeap=0x710000) returned 1 [0146.222] IcmpCloseHandle (IcmpHandle=0x78bc28) returned 1 [0146.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d5dc8 | out: hHeap=0x710000) returned 1 Thread: id = 709 os_tid = 0x1244 [0141.907] GetLastError () returned 0x57 [0141.907] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6150 [0141.907] SetLastError (dwErrCode=0x57) [0141.907] IcmpCreateFile () returned 0x78bc60 [0141.907] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2088 [0141.908] IcmpSendEcho2 (in: IcmpHandle=0x78bc60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4800a8c0, RequestData=0x1624ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2088, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2088) returned 0x0 [0146.225] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2088 | out: hHeap=0x710000) returned 1 [0146.225] IcmpCloseHandle (IcmpHandle=0x78bc60) returned 1 [0146.225] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6150 | out: hHeap=0x710000) returned 1 Thread: id = 710 os_tid = 0x1240 [0141.909] GetLastError () returned 0x57 [0141.909] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d64d8 [0141.909] SetLastError (dwErrCode=0x57) [0141.909] IcmpCreateFile () returned 0x78bc98 [0141.909] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d20d8 [0141.909] IcmpSendEcho2 (in: IcmpHandle=0x78bc98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4900a8c0, RequestData=0x1638ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d20d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d20d8) returned 0x0 [0146.227] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x710000) returned 1 [0146.227] IcmpCloseHandle (IcmpHandle=0x78bc98) returned 1 [0146.228] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d64d8 | out: hHeap=0x710000) returned 1 Thread: id = 711 os_tid = 0x123c [0141.910] GetLastError () returned 0x57 [0141.910] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6860 [0141.910] SetLastError (dwErrCode=0x57) [0141.911] IcmpCreateFile () returned 0x78bcd0 [0141.911] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2128 [0141.911] IcmpSendEcho2 (in: IcmpHandle=0x78bcd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4a00a8c0, RequestData=0x164cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2128, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2128) returned 0x0 [0146.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2128 | out: hHeap=0x710000) returned 1 [0146.229] IcmpCloseHandle (IcmpHandle=0x78bcd0) returned 1 [0146.230] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6860 | out: hHeap=0x710000) returned 1 Thread: id = 712 os_tid = 0x1230 [0141.912] GetLastError () returned 0x57 [0141.912] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6be8 [0141.912] SetLastError (dwErrCode=0x57) [0141.912] IcmpCreateFile () returned 0x78bd08 [0141.912] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2178 [0141.912] IcmpSendEcho2 (in: IcmpHandle=0x78bd08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4b00a8c0, RequestData=0x1674ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2178, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2178) returned 0x0 [0146.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2178 | out: hHeap=0x710000) returned 1 [0146.231] IcmpCloseHandle (IcmpHandle=0x78bd08) returned 1 [0146.232] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6be8 | out: hHeap=0x710000) returned 1 Thread: id = 713 os_tid = 0x1238 [0141.913] GetLastError () returned 0x57 [0141.913] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6f70 [0141.914] SetLastError (dwErrCode=0x57) [0141.914] IcmpCreateFile () returned 0x78bd40 [0141.931] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d21c8 [0141.931] IcmpSendEcho2 (in: IcmpHandle=0x78bd40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4c00a8c0, RequestData=0x169cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d21c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d21c8) returned 0x0 [0146.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d21c8 | out: hHeap=0x710000) returned 1 [0146.233] IcmpCloseHandle (IcmpHandle=0x78bd40) returned 1 [0146.234] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d6f70 | out: hHeap=0x710000) returned 1 Thread: id = 714 os_tid = 0x1234 [0141.933] GetLastError () returned 0x57 [0141.933] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d72f8 [0141.933] SetLastError (dwErrCode=0x57) [0141.933] IcmpCreateFile () returned 0x78bd78 [0141.933] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2218 [0141.933] IcmpSendEcho2 (in: IcmpHandle=0x78bd78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4d00a8c0, RequestData=0x1714ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2218, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2218) returned 0x0 [0146.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2218 | out: hHeap=0x710000) returned 1 [0146.236] IcmpCloseHandle (IcmpHandle=0x78bd78) returned 1 [0146.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d72f8 | out: hHeap=0x710000) returned 1 Thread: id = 715 os_tid = 0x122c [0141.935] GetLastError () returned 0x57 [0141.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7680 [0141.935] SetLastError (dwErrCode=0x57) [0141.935] IcmpCreateFile () returned 0x78bdb0 [0141.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2268 [0141.935] IcmpSendEcho2 (in: IcmpHandle=0x78bdb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4e00a8c0, RequestData=0x17ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2268, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2268) returned 0x0 [0146.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2268 | out: hHeap=0x710000) returned 1 [0146.238] IcmpCloseHandle (IcmpHandle=0x78bdb0) returned 1 [0146.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d7680 | out: hHeap=0x710000) returned 1 Thread: id = 716 os_tid = 0x1048 [0141.938] GetLastError () returned 0x57 [0141.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7a08 [0141.938] SetLastError (dwErrCode=0x57) [0141.938] IcmpCreateFile () returned 0x78bde8 [0141.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d22b8 [0141.938] IcmpSendEcho2 (in: IcmpHandle=0x78bde8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4f00a8c0, RequestData=0x1e8bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d22b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d22b8) returned 0x0 [0146.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d22b8 | out: hHeap=0x710000) returned 1 [0146.241] IcmpCloseHandle (IcmpHandle=0x78bde8) returned 1 [0146.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d7a08 | out: hHeap=0x710000) returned 1 Thread: id = 717 os_tid = 0x328 [0141.939] GetLastError () returned 0x57 [0141.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7d90 [0141.940] SetLastError (dwErrCode=0x57) [0141.940] IcmpCreateFile () returned 0x78be20 [0141.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2308 [0141.940] IcmpSendEcho2 (in: IcmpHandle=0x78be20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5000a8c0, RequestData=0x1e9fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2308, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2308) returned 0x0 [0146.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2308 | out: hHeap=0x710000) returned 1 [0146.243] IcmpCloseHandle (IcmpHandle=0x78be20) returned 1 [0146.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d7d90 | out: hHeap=0x710000) returned 1 Thread: id = 718 os_tid = 0x4ac [0141.941] GetLastError () returned 0x57 [0141.941] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8118 [0141.941] SetLastError (dwErrCode=0x57) [0141.941] IcmpCreateFile () returned 0x78be58 [0141.941] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2358 [0141.941] IcmpSendEcho2 (in: IcmpHandle=0x78be58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5100a8c0, RequestData=0x1eb3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2358, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2358) returned 0x0 [0146.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2358 | out: hHeap=0x710000) returned 1 [0146.245] IcmpCloseHandle (IcmpHandle=0x78be58) returned 1 [0146.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8118 | out: hHeap=0x710000) returned 1 Thread: id = 719 os_tid = 0xab4 [0141.942] GetLastError () returned 0x57 [0141.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d84a0 [0141.943] SetLastError (dwErrCode=0x57) [0141.943] IcmpCreateFile () returned 0x78be90 [0141.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d23a8 [0141.943] IcmpSendEcho2 (in: IcmpHandle=0x78be90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5200a8c0, RequestData=0x1ec7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d23a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d23a8) returned 0x0 [0146.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d23a8 | out: hHeap=0x710000) returned 1 [0146.248] IcmpCloseHandle (IcmpHandle=0x78be90) returned 1 [0146.249] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d84a0 | out: hHeap=0x710000) returned 1 Thread: id = 720 os_tid = 0x480 [0141.944] GetLastError () returned 0x57 [0141.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8828 [0141.944] SetLastError (dwErrCode=0x57) [0141.944] IcmpCreateFile () returned 0x78b7c8 [0141.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d23f8 [0141.944] IcmpSendEcho2 (in: IcmpHandle=0x78b7c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5300a8c0, RequestData=0x1edbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d23f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d23f8) returned 0x0 [0146.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d23f8 | out: hHeap=0x710000) returned 1 [0146.250] IcmpCloseHandle (IcmpHandle=0x78b7c8) returned 1 [0146.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8828 | out: hHeap=0x710000) returned 1 Thread: id = 721 os_tid = 0x2f8 [0141.946] GetLastError () returned 0x57 [0141.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8bb0 [0141.946] SetLastError (dwErrCode=0x57) [0141.946] IcmpCreateFile () returned 0x78b800 [0141.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2448 [0141.946] IcmpSendEcho2 (in: IcmpHandle=0x78b800, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5400a8c0, RequestData=0x1eefff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2448, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2448) returned 0x0 [0146.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2448 | out: hHeap=0x710000) returned 1 [0146.253] IcmpCloseHandle (IcmpHandle=0x78b800) returned 1 [0146.254] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8bb0 | out: hHeap=0x710000) returned 1 Thread: id = 722 os_tid = 0x66c [0141.947] GetLastError () returned 0x57 [0141.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8f38 [0141.948] SetLastError (dwErrCode=0x57) [0141.948] IcmpCreateFile () returned 0x78b838 [0141.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2498 [0141.948] IcmpSendEcho2 (in: IcmpHandle=0x78b838, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5500a8c0, RequestData=0x1f03ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2498, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2498) returned 0x0 [0146.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2498 | out: hHeap=0x710000) returned 1 [0146.256] IcmpCloseHandle (IcmpHandle=0x78b838) returned 1 [0146.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d8f38 | out: hHeap=0x710000) returned 1 Thread: id = 723 os_tid = 0x474 [0141.949] GetLastError () returned 0x57 [0141.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d92c0 [0141.949] SetLastError (dwErrCode=0x57) [0141.949] IcmpCreateFile () returned 0x78b870 [0141.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d24e8 [0141.949] IcmpSendEcho2 (in: IcmpHandle=0x78b870, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5600a8c0, RequestData=0x1f17ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d24e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d24e8) returned 0x0 [0146.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d24e8 | out: hHeap=0x710000) returned 1 [0146.259] IcmpCloseHandle (IcmpHandle=0x78b870) returned 1 [0146.260] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d92c0 | out: hHeap=0x710000) returned 1 Thread: id = 724 os_tid = 0xbac [0141.951] GetLastError () returned 0x57 [0141.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d9648 [0141.951] SetLastError (dwErrCode=0x57) [0141.951] IcmpCreateFile () returned 0x78b8a8 [0141.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2538 [0141.951] IcmpSendEcho2 (in: IcmpHandle=0x78b8a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5700a8c0, RequestData=0x1f2bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2538, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2538) returned 0x0 [0146.262] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2538 | out: hHeap=0x710000) returned 1 [0146.262] IcmpCloseHandle (IcmpHandle=0x78b8a8) returned 1 [0146.262] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d9648 | out: hHeap=0x710000) returned 1 Thread: id = 725 os_tid = 0xb5c [0141.952] GetLastError () returned 0x57 [0141.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d99d0 [0141.952] SetLastError (dwErrCode=0x57) [0141.952] IcmpCreateFile () returned 0x78b8e0 [0141.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2628 [0141.953] IcmpSendEcho2 (in: IcmpHandle=0x78b8e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5800a8c0, RequestData=0x1f3fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2628, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2628) returned 0x0 [0146.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2628 | out: hHeap=0x710000) returned 1 [0146.264] IcmpCloseHandle (IcmpHandle=0x78b8e0) returned 1 [0146.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d99d0 | out: hHeap=0x710000) returned 1 Thread: id = 726 os_tid = 0x8cc [0141.954] GetLastError () returned 0x57 [0141.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d9d58 [0141.954] SetLastError (dwErrCode=0x57) [0141.954] IcmpCreateFile () returned 0x78b918 [0141.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2678 [0141.954] IcmpSendEcho2 (in: IcmpHandle=0x78b918, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5900a8c0, RequestData=0x1f53ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2678, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2678) returned 0x0 [0146.266] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2678 | out: hHeap=0x710000) returned 1 [0146.266] IcmpCloseHandle (IcmpHandle=0x78b918) returned 1 [0146.267] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d9d58 | out: hHeap=0x710000) returned 1 Thread: id = 727 os_tid = 0xb54 [0141.955] GetLastError () returned 0x57 [0141.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da0e0 [0141.956] SetLastError (dwErrCode=0x57) [0141.956] IcmpCreateFile () returned 0x78bf38 [0141.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d26c8 [0141.956] IcmpSendEcho2 (in: IcmpHandle=0x78bf38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5a00a8c0, RequestData=0x1f67ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d26c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d26c8) returned 0x0 [0146.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d26c8 | out: hHeap=0x710000) returned 1 [0146.269] IcmpCloseHandle (IcmpHandle=0x78bf38) returned 1 [0146.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7da0e0 | out: hHeap=0x710000) returned 1 Thread: id = 728 os_tid = 0xb10 [0141.957] GetLastError () returned 0x57 [0141.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da468 [0141.957] SetLastError (dwErrCode=0x57) [0141.957] IcmpCreateFile () returned 0x78bf70 [0141.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2718 [0141.957] IcmpSendEcho2 (in: IcmpHandle=0x78bf70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5b00a8c0, RequestData=0x1f7bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2718, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2718) returned 0x0 [0146.271] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2718 | out: hHeap=0x710000) returned 1 [0146.271] IcmpCloseHandle (IcmpHandle=0x78bf70) returned 1 [0146.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7da468 | out: hHeap=0x710000) returned 1 Thread: id = 729 os_tid = 0x810 [0141.958] GetLastError () returned 0x57 [0141.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da7f0 [0141.959] SetLastError (dwErrCode=0x57) [0141.959] IcmpCreateFile () returned 0x78bfa8 [0141.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2768 [0141.959] IcmpSendEcho2 (in: IcmpHandle=0x78bfa8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5c00a8c0, RequestData=0x1f8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2768, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2768) returned 0x0 [0146.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2768 | out: hHeap=0x710000) returned 1 [0146.273] IcmpCloseHandle (IcmpHandle=0x78bfa8) returned 1 [0146.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7da7f0 | out: hHeap=0x710000) returned 1 Thread: id = 730 os_tid = 0xb28 [0141.960] GetLastError () returned 0x57 [0141.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dab78 [0141.960] SetLastError (dwErrCode=0x57) [0141.960] IcmpCreateFile () returned 0x78bfe0 [0141.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d27b8 [0141.960] IcmpSendEcho2 (in: IcmpHandle=0x78bfe0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5d00a8c0, RequestData=0x1fa3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d27b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d27b8) returned 0x0 [0146.275] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d27b8 | out: hHeap=0x710000) returned 1 [0146.275] IcmpCloseHandle (IcmpHandle=0x78bfe0) returned 1 [0146.276] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dab78 | out: hHeap=0x710000) returned 1 Thread: id = 731 os_tid = 0xbb0 [0141.962] GetLastError () returned 0x57 [0141.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7daf00 [0141.962] SetLastError (dwErrCode=0x57) [0141.962] IcmpCreateFile () returned 0x78c018 [0141.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2e98 [0141.962] IcmpSendEcho2 (in: IcmpHandle=0x78c018, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5e00a8c0, RequestData=0x1fb7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2e98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2e98) returned 0x0 [0146.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2e98 | out: hHeap=0x710000) returned 1 [0146.278] IcmpCloseHandle (IcmpHandle=0x78c018) returned 1 [0146.279] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7daf00 | out: hHeap=0x710000) returned 1 Thread: id = 732 os_tid = 0xab8 [0141.963] GetLastError () returned 0x57 [0141.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db288 [0141.963] SetLastError (dwErrCode=0x57) [0141.963] IcmpCreateFile () returned 0x78c050 [0141.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2ee8 [0141.963] IcmpSendEcho2 (in: IcmpHandle=0x78c050, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5f00a8c0, RequestData=0x1fcbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2ee8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2ee8) returned 0x0 [0146.281] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2ee8 | out: hHeap=0x710000) returned 1 [0146.281] IcmpCloseHandle (IcmpHandle=0x78c050) returned 1 [0146.281] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7db288 | out: hHeap=0x710000) returned 1 Thread: id = 733 os_tid = 0x3b8 [0141.964] GetLastError () returned 0x57 [0141.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db610 [0141.964] SetLastError (dwErrCode=0x57) [0141.964] IcmpCreateFile () returned 0x78bec8 [0141.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2998 [0141.964] IcmpSendEcho2 (in: IcmpHandle=0x78bec8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6000a8c0, RequestData=0x1fdfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2998, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2998) returned 0x0 [0146.287] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2998 | out: hHeap=0x710000) returned 1 [0146.287] IcmpCloseHandle (IcmpHandle=0x78bec8) returned 1 [0146.288] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7db610 | out: hHeap=0x710000) returned 1 Thread: id = 734 os_tid = 0x8c8 [0141.965] GetLastError () returned 0x57 [0141.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757370 [0141.966] SetLastError (dwErrCode=0x57) [0141.966] IcmpCreateFile () returned 0x78bf00 [0141.966] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d29e8 [0141.966] IcmpSendEcho2 (in: IcmpHandle=0x78bf00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6100a8c0, RequestData=0x1ff3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d29e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d29e8) returned 0x0 [0146.292] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d29e8 | out: hHeap=0x710000) returned 1 [0146.292] IcmpCloseHandle (IcmpHandle=0x78bf00) returned 1 [0146.293] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757370 | out: hHeap=0x710000) returned 1 Thread: id = 735 os_tid = 0x4ec [0141.967] GetLastError () returned 0x57 [0141.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7576f8 [0141.967] SetLastError (dwErrCode=0x57) [0141.967] IcmpCreateFile () returned 0x78b288 [0141.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2a38 [0141.967] IcmpSendEcho2 (in: IcmpHandle=0x78b288, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6200a8c0, RequestData=0x2007ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2a38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2a38) returned 0x0 [0146.296] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2a38 | out: hHeap=0x710000) returned 1 [0146.296] IcmpCloseHandle (IcmpHandle=0x78b288) returned 1 [0146.296] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7576f8 | out: hHeap=0x710000) returned 1 Thread: id = 736 os_tid = 0x8b8 [0141.968] GetLastError () returned 0x57 [0141.968] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757a80 [0141.969] SetLastError (dwErrCode=0x57) [0141.969] IcmpCreateFile () returned 0x78b2c0 [0141.969] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2a88 [0141.969] IcmpSendEcho2 (in: IcmpHandle=0x78b2c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6300a8c0, RequestData=0x201bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2a88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2a88) returned 0x0 [0146.344] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2a88 | out: hHeap=0x710000) returned 1 [0146.344] IcmpCloseHandle (IcmpHandle=0x78b2c0) returned 1 [0146.345] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757a80 | out: hHeap=0x710000) returned 1 Thread: id = 737 os_tid = 0x530 [0141.970] GetLastError () returned 0x57 [0141.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757e08 [0141.970] SetLastError (dwErrCode=0x57) [0141.970] IcmpCreateFile () returned 0x78b2f8 [0141.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2ad8 [0141.970] IcmpSendEcho2 (in: IcmpHandle=0x78b2f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6400a8c0, RequestData=0x202fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2ad8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2ad8) returned 0x0 [0146.347] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2ad8 | out: hHeap=0x710000) returned 1 [0146.347] IcmpCloseHandle (IcmpHandle=0x78b2f8) returned 1 [0146.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x757e08 | out: hHeap=0x710000) returned 1 Thread: id = 738 os_tid = 0x398 [0141.972] GetLastError () returned 0x57 [0141.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758190 [0141.972] SetLastError (dwErrCode=0x57) [0141.972] IcmpCreateFile () returned 0x78b330 [0141.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2b28 [0141.972] IcmpSendEcho2 (in: IcmpHandle=0x78b330, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6500a8c0, RequestData=0x2043ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2b28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2b28) returned 0x0 [0146.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2b28 | out: hHeap=0x710000) returned 1 [0146.353] IcmpCloseHandle (IcmpHandle=0x78b330) returned 1 [0146.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758190 | out: hHeap=0x710000) returned 1 Thread: id = 739 os_tid = 0x39c [0141.973] GetLastError () returned 0x57 [0141.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758518 [0141.974] SetLastError (dwErrCode=0x57) [0141.974] IcmpCreateFile () returned 0x78b368 [0141.974] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2b78 [0141.974] IcmpSendEcho2 (in: IcmpHandle=0x78b368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6600a8c0, RequestData=0x2057ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2b78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2b78) returned 0x0 [0146.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2b78 | out: hHeap=0x710000) returned 1 [0146.356] IcmpCloseHandle (IcmpHandle=0x78b368) returned 1 [0146.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758518 | out: hHeap=0x710000) returned 1 Thread: id = 740 os_tid = 0xcfc [0141.975] GetLastError () returned 0x57 [0141.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7588a0 [0141.975] SetLastError (dwErrCode=0x57) [0141.975] IcmpCreateFile () returned 0x78b3a0 [0141.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2bc8 [0141.975] IcmpSendEcho2 (in: IcmpHandle=0x78b3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6700a8c0, RequestData=0x206bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2bc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2bc8) returned 0x0 [0146.359] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2bc8 | out: hHeap=0x710000) returned 1 [0146.359] IcmpCloseHandle (IcmpHandle=0x78b3a0) returned 1 [0146.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7588a0 | out: hHeap=0x710000) returned 1 Thread: id = 741 os_tid = 0xd00 [0141.977] GetLastError () returned 0x57 [0141.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758c28 [0141.977] SetLastError (dwErrCode=0x57) [0141.977] IcmpCreateFile () returned 0x78b3d8 [0141.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2c18 [0141.977] IcmpSendEcho2 (in: IcmpHandle=0x78b3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6800a8c0, RequestData=0x207fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2c18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2c18) returned 0x0 [0146.362] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2c18 | out: hHeap=0x710000) returned 1 [0146.362] IcmpCloseHandle (IcmpHandle=0x78b3d8) returned 1 [0146.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758c28 | out: hHeap=0x710000) returned 1 Thread: id = 742 os_tid = 0xd04 [0141.978] GetLastError () returned 0x57 [0141.979] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1810 [0141.979] SetLastError (dwErrCode=0x57) [0141.979] IcmpCreateFile () returned 0x78b0c8 [0141.979] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2c68 [0141.979] IcmpSendEcho2 (in: IcmpHandle=0x78b0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6900a8c0, RequestData=0x2093ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2c68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2c68) returned 0x0 [0146.366] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2c68 | out: hHeap=0x710000) returned 1 [0146.366] IcmpCloseHandle (IcmpHandle=0x78b0c8) returned 1 [0146.367] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1810 | out: hHeap=0x710000) returned 1 Thread: id = 743 os_tid = 0xd08 [0141.980] GetLastError () returned 0x57 [0141.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c45f8 [0141.980] SetLastError (dwErrCode=0x57) [0141.980] IcmpCreateFile () returned 0x78b138 [0141.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2cb8 [0141.981] IcmpSendEcho2 (in: IcmpHandle=0x78b138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6a00a8c0, RequestData=0x20a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2cb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2cb8) returned 0x0 [0146.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2cb8 | out: hHeap=0x710000) returned 1 [0146.369] IcmpCloseHandle (IcmpHandle=0x78b138) returned 1 [0146.370] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c45f8 | out: hHeap=0x710000) returned 1 Thread: id = 744 os_tid = 0xd0c [0141.982] GetLastError () returned 0x57 [0141.982] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4980 [0141.982] SetLastError (dwErrCode=0x57) [0141.982] IcmpCreateFile () returned 0x78b170 [0141.982] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2d08 [0141.982] IcmpSendEcho2 (in: IcmpHandle=0x78b170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6b00a8c0, RequestData=0x20bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2d08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2d08) returned 0x0 [0146.372] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2d08 | out: hHeap=0x710000) returned 1 [0146.372] IcmpCloseHandle (IcmpHandle=0x78b170) returned 1 [0146.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c4980 | out: hHeap=0x710000) returned 1 Thread: id = 745 os_tid = 0xd10 [0141.983] GetLastError () returned 0x57 [0141.983] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bdc08 [0141.984] SetLastError (dwErrCode=0x57) [0141.984] IcmpCreateFile () returned 0x78b1a8 [0141.984] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2d58 [0141.984] IcmpSendEcho2 (in: IcmpHandle=0x78b1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6c00a8c0, RequestData=0x20cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2d58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2d58) returned 0x0 [0146.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2d58 | out: hHeap=0x710000) returned 1 [0146.375] IcmpCloseHandle (IcmpHandle=0x78b1a8) returned 1 [0146.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bdc08 | out: hHeap=0x710000) returned 1 Thread: id = 746 os_tid = 0xd14 [0141.985] GetLastError () returned 0x57 [0141.985] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bdf90 [0141.985] SetLastError (dwErrCode=0x57) [0141.985] IcmpCreateFile () returned 0x78b1e0 [0141.985] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2da8 [0141.985] IcmpSendEcho2 (in: IcmpHandle=0x78b1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6d00a8c0, RequestData=0x20e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2da8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2da8) returned 0x0 [0146.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2da8 | out: hHeap=0x710000) returned 1 [0146.404] IcmpCloseHandle (IcmpHandle=0x78b1e0) returned 1 [0146.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bdf90 | out: hHeap=0x710000) returned 1 Thread: id = 747 os_tid = 0xd28 [0141.986] GetLastError () returned 0x57 [0141.987] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7be318 [0141.987] SetLastError (dwErrCode=0x57) [0141.987] IcmpCreateFile () returned 0x78b218 [0141.987] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2df8 [0141.987] IcmpSendEcho2 (in: IcmpHandle=0x78b218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6e00a8c0, RequestData=0x20f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2df8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2df8) returned 0x0 [0146.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2df8 | out: hHeap=0x710000) returned 1 [0146.407] IcmpCloseHandle (IcmpHandle=0x78b218) returned 1 [0146.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7be318 | out: hHeap=0x710000) returned 1 Thread: id = 748 os_tid = 0xd2c [0141.988] GetLastError () returned 0x57 [0141.988] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7be6a0 [0141.988] SetLastError (dwErrCode=0x57) [0141.988] IcmpCreateFile () returned 0x78b250 [0141.988] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2e48 [0141.988] IcmpSendEcho2 (in: IcmpHandle=0x78b250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6f00a8c0, RequestData=0x210bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2e48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2e48) returned 0x0 [0146.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2e48 | out: hHeap=0x710000) returned 1 [0146.409] IcmpCloseHandle (IcmpHandle=0x78b250) returned 1 [0146.410] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7be6a0 | out: hHeap=0x710000) returned 1 Thread: id = 749 os_tid = 0xd30 [0142.135] GetLastError () returned 0x57 [0142.135] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1b98 [0142.136] SetLastError (dwErrCode=0x57) [0142.136] IcmpCreateFile () returned 0x78b100 [0142.136] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73db08 [0142.136] IcmpSendEcho2 (in: IcmpHandle=0x78b100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7000a8c0, RequestData=0x211fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73db08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73db08) returned 0x0 [0146.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73db08 | out: hHeap=0x710000) returned 1 [0146.412] IcmpCloseHandle (IcmpHandle=0x78b100) returned 1 [0146.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1b98 | out: hHeap=0x710000) returned 1 Thread: id = 750 os_tid = 0xd34 [0142.140] GetLastError () returned 0x57 [0142.140] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4270 [0142.141] SetLastError (dwErrCode=0x57) [0142.141] IcmpCreateFile () returned 0x78b410 [0142.141] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e058 [0142.141] IcmpSendEcho2 (in: IcmpHandle=0x78b410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7100a8c0, RequestData=0xb88ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e058) returned 0x0 [0146.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e058 | out: hHeap=0x710000) returned 1 [0146.415] IcmpCloseHandle (IcmpHandle=0x78b410) returned 1 [0146.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c4270 | out: hHeap=0x710000) returned 1 Thread: id = 751 os_tid = 0xd38 [0142.143] GetLastError () returned 0x57 [0142.143] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bea28 [0142.143] SetLastError (dwErrCode=0x57) [0142.143] IcmpCreateFile () returned 0x78b448 [0142.143] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e148 [0142.143] IcmpSendEcho2 (in: IcmpHandle=0x78b448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7200a8c0, RequestData=0xfd0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e148) returned 0x0 [0146.417] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e148 | out: hHeap=0x710000) returned 1 [0146.417] IcmpCloseHandle (IcmpHandle=0x78b448) returned 1 [0146.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bea28 | out: hHeap=0x710000) returned 1 Thread: id = 752 os_tid = 0xd3c [0142.147] GetLastError () returned 0x57 [0142.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bedb0 [0142.147] SetLastError (dwErrCode=0x57) [0142.148] IcmpCreateFile () returned 0x78b480 [0142.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e1e8 [0142.148] IcmpSendEcho2 (in: IcmpHandle=0x78b480, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7300a8c0, RequestData=0x2133ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e1e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e1e8) returned 0x0 [0146.420] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e1e8 | out: hHeap=0x710000) returned 1 [0146.420] IcmpCloseHandle (IcmpHandle=0x78b480) returned 1 [0146.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bedb0 | out: hHeap=0x710000) returned 1 Thread: id = 753 os_tid = 0xd40 [0142.149] GetLastError () returned 0x57 [0142.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bf138 [0142.150] SetLastError (dwErrCode=0x57) [0142.150] IcmpCreateFile () returned 0x78b4b8 [0142.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e238 [0142.151] IcmpSendEcho2 (in: IcmpHandle=0x78b4b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7400a8c0, RequestData=0x2147ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e238) returned 0x0 [0146.423] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e238 | out: hHeap=0x710000) returned 1 [0146.423] IcmpCloseHandle (IcmpHandle=0x78b4b8) returned 1 [0146.423] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bf138 | out: hHeap=0x710000) returned 1 Thread: id = 754 os_tid = 0xd44 [0142.157] GetLastError () returned 0x57 [0142.157] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bf4c0 [0142.157] SetLastError (dwErrCode=0x57) [0142.157] IcmpCreateFile () returned 0x78b4f0 [0142.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dba8 [0142.158] IcmpSendEcho2 (in: IcmpHandle=0x78b4f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7500a8c0, RequestData=0x215bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dba8) returned 0x0 [0146.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dba8 | out: hHeap=0x710000) returned 1 [0146.426] IcmpCloseHandle (IcmpHandle=0x78b4f0) returned 1 [0146.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bf4c0 | out: hHeap=0x710000) returned 1 Thread: id = 755 os_tid = 0xd48 [0142.160] GetLastError () returned 0x57 [0142.160] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bf848 [0142.161] SetLastError (dwErrCode=0x57) [0142.161] IcmpCreateFile () returned 0x78b528 [0142.161] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dbf8 [0142.161] IcmpSendEcho2 (in: IcmpHandle=0x78b528, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7600a8c0, RequestData=0x216fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dbf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dbf8) returned 0x0 [0146.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dbf8 | out: hHeap=0x710000) returned 1 [0146.430] IcmpCloseHandle (IcmpHandle=0x78b528) returned 1 [0146.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bf848 | out: hHeap=0x710000) returned 1 Thread: id = 756 os_tid = 0xd4c [0142.162] GetLastError () returned 0x57 [0142.162] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bfbd0 [0142.162] SetLastError (dwErrCode=0x57) [0142.163] IcmpCreateFile () returned 0x78b560 [0142.163] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc48 [0142.163] IcmpSendEcho2 (in: IcmpHandle=0x78b560, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7700a8c0, RequestData=0x2183ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc48) returned 0x0 [0146.432] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc48 | out: hHeap=0x710000) returned 1 [0146.432] IcmpCloseHandle (IcmpHandle=0x78b560) returned 1 [0146.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bfbd0 | out: hHeap=0x710000) returned 1 Thread: id = 757 os_tid = 0xd50 [0142.164] GetLastError () returned 0x57 [0142.164] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7bff58 [0142.164] SetLastError (dwErrCode=0x57) [0142.164] IcmpCreateFile () returned 0x78b598 [0142.164] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc98 [0142.164] IcmpSendEcho2 (in: IcmpHandle=0x78b598, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7800a8c0, RequestData=0x2197ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc98) returned 0x0 [0146.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc98 | out: hHeap=0x710000) returned 1 [0146.435] IcmpCloseHandle (IcmpHandle=0x78b598) returned 1 [0146.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bff58 | out: hHeap=0x710000) returned 1 Thread: id = 758 os_tid = 0xd54 [0142.166] GetLastError () returned 0x57 [0142.166] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c02e0 [0142.166] SetLastError (dwErrCode=0x57) [0142.166] IcmpCreateFile () returned 0x78b5d0 [0142.166] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dce8 [0142.166] IcmpSendEcho2 (in: IcmpHandle=0x78b5d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7900a8c0, RequestData=0x21abff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dce8) returned 0x0 [0146.437] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dce8 | out: hHeap=0x710000) returned 1 [0146.437] IcmpCloseHandle (IcmpHandle=0x78b5d0) returned 1 [0146.438] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c02e0 | out: hHeap=0x710000) returned 1 Thread: id = 759 os_tid = 0xd58 [0142.167] GetLastError () returned 0x57 [0142.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c0668 [0142.167] SetLastError (dwErrCode=0x57) [0142.167] IcmpCreateFile () returned 0x78b608 [0142.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dd38 [0142.167] IcmpSendEcho2 (in: IcmpHandle=0x78b608, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7a00a8c0, RequestData=0x21bfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dd38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dd38) returned 0x0 [0146.439] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dd38 | out: hHeap=0x710000) returned 1 [0146.439] IcmpCloseHandle (IcmpHandle=0x78b608) returned 1 [0146.440] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c0668 | out: hHeap=0x710000) returned 1 Thread: id = 760 os_tid = 0xd5c [0142.168] GetLastError () returned 0x57 [0142.168] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c09f0 [0142.169] SetLastError (dwErrCode=0x57) [0142.169] IcmpCreateFile () returned 0x78b640 [0142.169] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73ddd8 [0142.169] IcmpSendEcho2 (in: IcmpHandle=0x78b640, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7b00a8c0, RequestData=0x21d3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73ddd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73ddd8) returned 0x0 [0146.441] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73ddd8 | out: hHeap=0x710000) returned 1 [0146.441] IcmpCloseHandle (IcmpHandle=0x78b640) returned 1 [0146.442] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c09f0 | out: hHeap=0x710000) returned 1 Thread: id = 761 os_tid = 0xd60 [0142.170] GetLastError () returned 0x57 [0142.170] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c0d78 [0142.170] SetLastError (dwErrCode=0x57) [0142.170] IcmpCreateFile () returned 0x78b678 [0142.170] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de28 [0142.170] IcmpSendEcho2 (in: IcmpHandle=0x78b678, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7c00a8c0, RequestData=0x21e7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de28) returned 0x0 [0146.444] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de28 | out: hHeap=0x710000) returned 1 [0146.444] IcmpCloseHandle (IcmpHandle=0x78b678) returned 1 [0146.444] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c0d78 | out: hHeap=0x710000) returned 1 Thread: id = 762 os_tid = 0xd64 [0142.171] GetLastError () returned 0x57 [0142.171] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1100 [0142.172] SetLastError (dwErrCode=0x57) [0142.172] IcmpCreateFile () returned 0x78b6b0 [0142.172] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de78 [0142.172] IcmpSendEcho2 (in: IcmpHandle=0x78b6b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7d00a8c0, RequestData=0x21fbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de78) returned 0x0 [0146.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de78 | out: hHeap=0x710000) returned 1 [0146.446] IcmpCloseHandle (IcmpHandle=0x78b6b0) returned 1 [0146.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1100 | out: hHeap=0x710000) returned 1 Thread: id = 763 os_tid = 0xd68 [0142.173] GetLastError () returned 0x57 [0142.173] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1488 [0142.173] SetLastError (dwErrCode=0x57) [0142.173] IcmpCreateFile () returned 0x78b6e8 [0142.173] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba980 [0142.173] IcmpSendEcho2 (in: IcmpHandle=0x78b6e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7e00a8c0, RequestData=0x220fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba980, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba980) returned 0x0 [0146.450] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba980 | out: hHeap=0x710000) returned 1 [0146.450] IcmpCloseHandle (IcmpHandle=0x78b6e8) returned 1 [0146.450] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1488 | out: hHeap=0x710000) returned 1 Thread: id = 764 os_tid = 0xd6c [0142.174] GetLastError () returned 0x57 [0142.174] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c1f20 [0142.174] SetLastError (dwErrCode=0x57) [0142.174] IcmpCreateFile () returned 0x78b720 [0142.174] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba9d0 [0142.174] IcmpSendEcho2 (in: IcmpHandle=0x78b720, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7f00a8c0, RequestData=0x2223ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba9d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba9d0) returned 0x0 [0146.453] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba9d0 | out: hHeap=0x710000) returned 1 [0146.453] IcmpCloseHandle (IcmpHandle=0x78b720) returned 1 [0146.453] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c1f20 | out: hHeap=0x710000) returned 1 Thread: id = 765 os_tid = 0xdd8 [0142.175] GetLastError () returned 0x57 [0142.175] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c22a8 [0142.176] SetLastError (dwErrCode=0x57) [0142.176] IcmpCreateFile () returned 0x78b758 [0142.176] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7baa20 [0142.176] IcmpSendEcho2 (in: IcmpHandle=0x78b758, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8000a8c0, RequestData=0x2237ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7baa20, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7baa20) returned 0x0 [0146.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7baa20 | out: hHeap=0x710000) returned 1 [0146.456] IcmpCloseHandle (IcmpHandle=0x78b758) returned 1 [0146.456] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c22a8 | out: hHeap=0x710000) returned 1 Thread: id = 766 os_tid = 0xddc [0143.570] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0143.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0143.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f060c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0143.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0143.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0624, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0143.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0143.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f063c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0143.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0143.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0654, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0143.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0143.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f066c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0143.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0143.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0684, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0143.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0143.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f069c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0143.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0143.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0143.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0143.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0143.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0143.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0143.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0143.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0143.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0143.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0714, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0143.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0143.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f072c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0143.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0143.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0143.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0143.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f075c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0143.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0143.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0774, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0143.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0143.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f078c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0143.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0143.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0143.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0143.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0143.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0143.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0143.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0143.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0143.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0143.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0804, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0143.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0143.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f081c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0143.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0143.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0143.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0143.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f084c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0143.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0143.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0864, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0143.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0143.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f087c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0143.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0143.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0894, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0143.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0143.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0143.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0143.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0143.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0143.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0143.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0143.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0143.607] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x3e0, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0145.041] CloseHandle (hObject=0x3e0) returned 1 [0145.041] CloseHandle (hObject=0x8c8) returned 1 [0145.041] CloseHandle (hObject=0x8d8) returned 1 [0145.041] CloseHandle (hObject=0x8d0) returned 1 [0145.041] CloseHandle (hObject=0x358) returned 1 [0145.041] CloseHandle (hObject=0x8c0) returned 1 [0145.042] CloseHandle (hObject=0x6a4) returned 1 [0145.042] CloseHandle (hObject=0x394) returned 1 [0145.042] CloseHandle (hObject=0x448) returned 1 [0145.042] CloseHandle (hObject=0x97c) returned 1 [0145.042] CloseHandle (hObject=0x980) returned 1 [0145.042] CloseHandle (hObject=0x984) returned 1 [0145.042] CloseHandle (hObject=0x988) returned 1 [0145.042] CloseHandle (hObject=0x98c) returned 1 [0145.042] CloseHandle (hObject=0x990) returned 1 [0145.042] CloseHandle (hObject=0x994) returned 1 [0145.042] CloseHandle (hObject=0x998) returned 1 [0145.042] CloseHandle (hObject=0x99c) returned 1 [0145.042] CloseHandle (hObject=0x694) returned 1 [0145.042] CloseHandle (hObject=0x210) returned 1 [0145.042] CloseHandle (hObject=0x214) returned 1 [0145.043] CloseHandle (hObject=0x218) returned 1 [0145.043] CloseHandle (hObject=0x21c) returned 1 [0145.043] CloseHandle (hObject=0x220) returned 1 [0145.043] CloseHandle (hObject=0x224) returned 1 [0145.043] CloseHandle (hObject=0x228) returned 1 [0145.043] CloseHandle (hObject=0x22c) returned 1 [0145.043] CloseHandle (hObject=0x230) returned 1 [0145.043] CloseHandle (hObject=0x234) returned 1 [0145.043] CloseHandle (hObject=0x238) returned 1 [0145.043] CloseHandle (hObject=0x23c) returned 1 [0145.043] CloseHandle (hObject=0x240) returned 1 [0145.043] CloseHandle (hObject=0x244) returned 1 [0145.043] CloseHandle (hObject=0x248) returned 1 [0145.043] CloseHandle (hObject=0x24c) returned 1 [0145.043] CloseHandle (hObject=0x250) returned 1 [0145.043] CloseHandle (hObject=0x254) returned 1 [0145.044] CloseHandle (hObject=0x258) returned 1 [0145.044] CloseHandle (hObject=0x25c) returned 1 [0145.044] CloseHandle (hObject=0x260) returned 1 [0145.044] CloseHandle (hObject=0x264) returned 1 [0145.044] CloseHandle (hObject=0x268) returned 1 [0145.044] CloseHandle (hObject=0x26c) returned 1 [0145.044] CloseHandle (hObject=0x270) returned 1 [0145.044] CloseHandle (hObject=0x274) returned 1 [0145.044] CloseHandle (hObject=0x278) returned 1 [0145.044] CloseHandle (hObject=0x27c) returned 1 [0145.044] CloseHandle (hObject=0x280) returned 1 [0145.044] CloseHandle (hObject=0x284) returned 1 [0145.044] CloseHandle (hObject=0x344) returned 1 [0145.044] CloseHandle (hObject=0x83c) returned 1 [0145.044] CloseHandle (hObject=0x838) returned 1 [0145.044] CloseHandle (hObject=0x834) returned 1 [0145.044] CloseHandle (hObject=0x830) returned 1 [0145.045] CloseHandle (hObject=0x82c) returned 1 [0145.045] CloseHandle (hObject=0x828) returned 1 [0145.045] CloseHandle (hObject=0x824) returned 1 [0145.045] CloseHandle (hObject=0x820) returned 1 [0145.045] CloseHandle (hObject=0x81c) returned 1 [0145.045] CloseHandle (hObject=0x818) returned 1 [0145.045] CloseHandle (hObject=0x814) returned 1 [0145.045] CloseHandle (hObject=0x748) returned 1 [0145.045] CloseHandle (hObject=0x744) returned 1 [0145.045] CloseHandle (hObject=0x740) returned 1 [0145.045] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 767 os_tid = 0xde0 [0143.650] GetLastError () returned 0x57 [0143.650] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c2630 [0143.650] SetLastError (dwErrCode=0x57) [0143.650] IcmpCreateFile () returned 0x74f3d8 [0143.650] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba3e0 [0143.650] IcmpSendEcho2 (in: IcmpHandle=0x74f3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8100a8c0, RequestData=0xb9cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba3e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba3e0) returned 0x0 [0146.460] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba3e0 | out: hHeap=0x710000) returned 1 [0146.460] IcmpCloseHandle (IcmpHandle=0x74f3d8) returned 1 [0146.461] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c2630 | out: hHeap=0x710000) returned 1 Thread: id = 768 os_tid = 0xde4 [0143.652] GetLastError () returned 0x57 [0143.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c29b8 [0143.652] SetLastError (dwErrCode=0x57) [0143.652] IcmpCreateFile () returned 0x74f410 [0143.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba430 [0143.652] IcmpSendEcho2 (in: IcmpHandle=0x74f410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8200a8c0, RequestData=0xbb0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba430, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba430) returned 0x0 [0146.464] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba430 | out: hHeap=0x710000) returned 1 [0146.464] IcmpCloseHandle (IcmpHandle=0x74f410) returned 1 [0146.464] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c29b8 | out: hHeap=0x710000) returned 1 Thread: id = 769 os_tid = 0x133c [0143.654] GetLastError () returned 0x57 [0143.654] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c2d40 [0143.654] SetLastError (dwErrCode=0x57) [0143.654] IcmpCreateFile () returned 0x74f448 [0143.654] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba480 [0143.654] IcmpSendEcho2 (in: IcmpHandle=0x74f448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8300a8c0, RequestData=0xbc4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba480, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba480) returned 0x0 [0146.467] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba480 | out: hHeap=0x710000) returned 1 [0146.467] IcmpCloseHandle (IcmpHandle=0x74f448) returned 1 [0146.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c2d40 | out: hHeap=0x710000) returned 1 Thread: id = 770 os_tid = 0x1248 [0143.655] GetLastError () returned 0x57 [0143.655] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c30c8 [0143.655] SetLastError (dwErrCode=0x57) [0143.655] IcmpCreateFile () returned 0x74edf0 [0143.655] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba4d0 [0143.656] IcmpSendEcho2 (in: IcmpHandle=0x74edf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8400a8c0, RequestData=0xbd8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba4d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba4d0) returned 0x0 [0146.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba4d0 | out: hHeap=0x710000) returned 1 [0146.470] IcmpCloseHandle (IcmpHandle=0x74edf0) returned 1 [0146.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c30c8 | out: hHeap=0x710000) returned 1 Thread: id = 771 os_tid = 0x1254 [0143.657] GetLastError () returned 0x57 [0143.657] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c3450 [0143.657] SetLastError (dwErrCode=0x57) [0143.657] IcmpCreateFile () returned 0x74ee98 [0143.657] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba840 [0143.657] IcmpSendEcho2 (in: IcmpHandle=0x74ee98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8500a8c0, RequestData=0xbecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba840, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba840) returned 0x0 [0146.473] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba840 | out: hHeap=0x710000) returned 1 [0146.473] IcmpCloseHandle (IcmpHandle=0x74ee98) returned 1 [0146.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c3450 | out: hHeap=0x710000) returned 1 Thread: id = 772 os_tid = 0x1110 [0143.658] GetLastError () returned 0x57 [0143.658] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c37d8 [0143.659] SetLastError (dwErrCode=0x57) [0143.659] IcmpCreateFile () returned 0x74eed0 [0143.659] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba890 [0143.659] IcmpSendEcho2 (in: IcmpHandle=0x74eed0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8600a8c0, RequestData=0xc00ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba890, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba890) returned 0x0 [0146.476] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba890 | out: hHeap=0x710000) returned 1 [0146.476] IcmpCloseHandle (IcmpHandle=0x74eed0) returned 1 [0146.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c37d8 | out: hHeap=0x710000) returned 1 Thread: id = 773 os_tid = 0x9e8 [0143.660] GetLastError () returned 0x57 [0143.660] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c3b60 [0143.660] SetLastError (dwErrCode=0x57) [0143.660] IcmpCreateFile () returned 0x74ef40 [0143.660] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ba8e0 [0143.660] IcmpSendEcho2 (in: IcmpHandle=0x74ef40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8700a8c0, RequestData=0xc14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ba8e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ba8e0) returned 0x0 [0146.479] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ba8e0 | out: hHeap=0x710000) returned 1 [0146.479] IcmpCloseHandle (IcmpHandle=0x74ef40) returned 1 [0146.479] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c3b60 | out: hHeap=0x710000) returned 1 Thread: id = 774 os_tid = 0x1220 [0143.662] GetLastError () returned 0x57 [0143.662] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c3ee8 [0143.662] SetLastError (dwErrCode=0x57) [0143.662] IcmpCreateFile () returned 0x74ef78 [0143.662] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ed8 [0143.662] IcmpSendEcho2 (in: IcmpHandle=0x74ef78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8800a8c0, RequestData=0xc28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ed8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ed8) returned 0x0 [0146.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ed8 | out: hHeap=0x710000) returned 1 [0146.481] IcmpCloseHandle (IcmpHandle=0x74ef78) returned 1 [0146.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c3ee8 | out: hHeap=0x710000) returned 1 Thread: id = 775 os_tid = 0x1260 [0143.663] GetLastError () returned 0x57 [0143.663] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c57a0 [0143.664] SetLastError (dwErrCode=0x57) [0143.664] IcmpCreateFile () returned 0x74efb0 [0143.664] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764f28 [0143.664] IcmpSendEcho2 (in: IcmpHandle=0x74efb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8900a8c0, RequestData=0xc3cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764f28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764f28) returned 0x0 [0146.483] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764f28 | out: hHeap=0x710000) returned 1 [0146.483] IcmpCloseHandle (IcmpHandle=0x74efb0) returned 1 [0146.483] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c57a0 | out: hHeap=0x710000) returned 1 Thread: id = 776 os_tid = 0x1188 [0143.665] GetLastError () returned 0x57 [0143.665] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4d08 [0143.665] SetLastError (dwErrCode=0x57) [0143.665] IcmpCreateFile () returned 0x74efe8 [0143.665] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764f78 [0143.665] IcmpSendEcho2 (in: IcmpHandle=0x74efe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8a00a8c0, RequestData=0xc50ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764f78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764f78) returned 0x0 [0146.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764f78 | out: hHeap=0x710000) returned 1 [0146.484] IcmpCloseHandle (IcmpHandle=0x74efe8) returned 1 [0146.485] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c4d08 | out: hHeap=0x710000) returned 1 Thread: id = 777 os_tid = 0x950 [0143.666] GetLastError () returned 0x57 [0143.667] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c5090 [0143.667] SetLastError (dwErrCode=0x57) [0143.667] IcmpCreateFile () returned 0x74f020 [0143.667] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764fc8 [0143.667] IcmpSendEcho2 (in: IcmpHandle=0x74f020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8b00a8c0, RequestData=0xc64ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764fc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764fc8) returned 0x0 [0146.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764fc8 | out: hHeap=0x710000) returned 1 [0146.486] IcmpCloseHandle (IcmpHandle=0x74f020) returned 1 [0146.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c5090 | out: hHeap=0x710000) returned 1 Thread: id = 778 os_tid = 0x81c [0143.668] GetLastError () returned 0x57 [0143.668] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c5418 [0143.668] SetLastError (dwErrCode=0x57) [0143.668] IcmpCreateFile () returned 0x74f058 [0143.668] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765018 [0143.668] IcmpSendEcho2 (in: IcmpHandle=0x74f058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8c00a8c0, RequestData=0xc78ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765018, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765018) returned 0x0 [0146.488] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765018 | out: hHeap=0x710000) returned 1 [0146.488] IcmpCloseHandle (IcmpHandle=0x74f058) returned 1 [0146.488] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7c5418 | out: hHeap=0x710000) returned 1 Thread: id = 779 os_tid = 0xb18 [0143.670] GetLastError () returned 0x57 [0143.670] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755730 [0143.670] SetLastError (dwErrCode=0x57) [0143.670] IcmpCreateFile () returned 0x74f090 [0143.670] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765068 [0143.670] IcmpSendEcho2 (in: IcmpHandle=0x74f090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8d00a8c0, RequestData=0xc8cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765068, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765068) returned 0x0 [0146.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765068 | out: hHeap=0x710000) returned 1 [0146.492] IcmpCloseHandle (IcmpHandle=0x74f090) returned 1 [0146.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755730 | out: hHeap=0x710000) returned 1 Thread: id = 780 os_tid = 0xba0 [0143.671] GetLastError () returned 0x57 [0143.671] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755ab8 [0143.671] SetLastError (dwErrCode=0x57) [0143.671] IcmpCreateFile () returned 0x7bdb00 [0143.671] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7650b8 [0143.671] IcmpSendEcho2 (in: IcmpHandle=0x7bdb00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8e00a8c0, RequestData=0xca0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7650b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7650b8) returned 0x0 [0146.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7650b8 | out: hHeap=0x710000) returned 1 [0146.495] IcmpCloseHandle (IcmpHandle=0x7bdb00) returned 1 [0146.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755ab8 | out: hHeap=0x710000) returned 1 Thread: id = 781 os_tid = 0xc74 [0143.673] GetLastError () returned 0x57 [0143.673] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755e40 [0143.673] SetLastError (dwErrCode=0x57) [0143.673] IcmpCreateFile () returned 0x7bdb38 [0143.673] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7651f8 [0143.673] IcmpSendEcho2 (in: IcmpHandle=0x7bdb38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8f00a8c0, RequestData=0xcb4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7651f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7651f8) returned 0x0 [0146.498] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7651f8 | out: hHeap=0x710000) returned 1 [0146.498] IcmpCloseHandle (IcmpHandle=0x7bdb38) returned 1 [0146.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x755e40 | out: hHeap=0x710000) returned 1 Thread: id = 782 os_tid = 0xc78 [0143.674] GetLastError () returned 0x57 [0143.674] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7561c8 [0143.674] SetLastError (dwErrCode=0x57) [0143.674] IcmpCreateFile () returned 0x7bdb70 [0143.675] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765248 [0143.675] IcmpSendEcho2 (in: IcmpHandle=0x7bdb70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9000a8c0, RequestData=0xcc8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765248, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765248) returned 0x0 [0146.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765248 | out: hHeap=0x710000) returned 1 [0146.503] IcmpCloseHandle (IcmpHandle=0x7bdb70) returned 1 [0146.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7561c8 | out: hHeap=0x710000) returned 1 Thread: id = 783 os_tid = 0xc7c [0143.676] GetLastError () returned 0x57 [0143.676] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756550 [0143.676] SetLastError (dwErrCode=0x57) [0143.676] IcmpCreateFile () returned 0x75d3b8 [0143.676] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765298 [0143.676] IcmpSendEcho2 (in: IcmpHandle=0x75d3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9100a8c0, RequestData=0xcdcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765298, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765298) returned 0x0 [0146.507] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765298 | out: hHeap=0x710000) returned 1 [0146.507] IcmpCloseHandle (IcmpHandle=0x75d3b8) returned 1 [0146.507] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756550 | out: hHeap=0x710000) returned 1 Thread: id = 784 os_tid = 0xc84 [0143.677] GetLastError () returned 0x57 [0143.677] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7568d8 [0143.678] SetLastError (dwErrCode=0x57) [0143.678] IcmpCreateFile () returned 0x78b790 [0143.678] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7649d8 [0143.678] IcmpSendEcho2 (in: IcmpHandle=0x78b790, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9200a8c0, RequestData=0xcf0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7649d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7649d8) returned 0x0 [0146.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7649d8 | out: hHeap=0x710000) returned 1 [0146.510] IcmpCloseHandle (IcmpHandle=0x78b790) returned 1 [0146.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7568d8 | out: hHeap=0x710000) returned 1 Thread: id = 785 os_tid = 0xc8c [0143.679] GetLastError () returned 0x57 [0143.679] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756c60 [0143.679] SetLastError (dwErrCode=0x57) [0143.679] IcmpCreateFile () returned 0x7d15e8 [0143.679] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764a28 [0143.679] IcmpSendEcho2 (in: IcmpHandle=0x7d15e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9300a8c0, RequestData=0xd04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764a28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764a28) returned 0x0 [0146.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764a28 | out: hHeap=0x710000) returned 1 [0146.513] IcmpCloseHandle (IcmpHandle=0x7d15e8) returned 1 [0146.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756c60 | out: hHeap=0x710000) returned 1 Thread: id = 786 os_tid = 0xc94 [0143.680] GetLastError () returned 0x57 [0143.680] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756fe8 [0143.681] SetLastError (dwErrCode=0x57) [0143.681] IcmpCreateFile () returned 0x7d1150 [0143.681] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765608 [0143.681] IcmpSendEcho2 (in: IcmpHandle=0x7d1150, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9400a8c0, RequestData=0xd18ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765608, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765608) returned 0x0 [0146.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765608 | out: hHeap=0x710000) returned 1 [0146.516] IcmpCloseHandle (IcmpHandle=0x7d1150) returned 1 [0146.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x756fe8 | out: hHeap=0x710000) returned 1 Thread: id = 787 os_tid = 0xc9c [0143.682] GetLastError () returned 0x57 [0143.682] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dcb40 [0143.682] SetLastError (dwErrCode=0x57) [0143.682] IcmpCreateFile () returned 0x7d1188 [0143.682] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765658 [0143.682] IcmpSendEcho2 (in: IcmpHandle=0x7d1188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9500a8c0, RequestData=0xd2cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765658, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765658) returned 0x0 [0146.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765658 | out: hHeap=0x710000) returned 1 [0146.519] IcmpCloseHandle (IcmpHandle=0x7d1188) returned 1 [0146.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dcb40 | out: hHeap=0x710000) returned 1 Thread: id = 788 os_tid = 0xca4 [0143.683] GetLastError () returned 0x57 [0143.684] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc0a8 [0143.684] SetLastError (dwErrCode=0x57) [0143.684] IcmpCreateFile () returned 0x7d11c0 [0143.684] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7656a8 [0143.684] IcmpSendEcho2 (in: IcmpHandle=0x7d11c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9600a8c0, RequestData=0xd40ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7656a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7656a8) returned 0x0 [0146.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7656a8 | out: hHeap=0x710000) returned 1 [0146.522] IcmpCloseHandle (IcmpHandle=0x7d11c0) returned 1 [0146.523] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dc0a8 | out: hHeap=0x710000) returned 1 Thread: id = 789 os_tid = 0xcac [0143.685] GetLastError () returned 0x57 [0143.685] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc430 [0143.685] SetLastError (dwErrCode=0x57) [0143.685] IcmpCreateFile () returned 0x7d11f8 [0143.685] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7656f8 [0143.685] IcmpSendEcho2 (in: IcmpHandle=0x7d11f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9700a8c0, RequestData=0xd54ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7656f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7656f8) returned 0x0 [0146.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7656f8 | out: hHeap=0x710000) returned 1 [0146.524] IcmpCloseHandle (IcmpHandle=0x7d11f8) returned 1 [0146.525] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dc430 | out: hHeap=0x710000) returned 1 Thread: id = 790 os_tid = 0x14cc [0143.687] GetLastError () returned 0x57 [0143.687] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc7b8 [0143.687] SetLastError (dwErrCode=0x57) [0143.687] IcmpCreateFile () returned 0x7d1230 [0143.687] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765748 [0143.687] IcmpSendEcho2 (in: IcmpHandle=0x7d1230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9800a8c0, RequestData=0xd68ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765748, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765748) returned 0x0 [0146.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765748 | out: hHeap=0x710000) returned 1 [0146.527] IcmpCloseHandle (IcmpHandle=0x7d1230) returned 1 [0146.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dc7b8 | out: hHeap=0x710000) returned 1 Thread: id = 791 os_tid = 0xcb4 [0143.688] GetLastError () returned 0x57 [0143.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ebc28 [0143.688] SetLastError (dwErrCode=0x57) [0143.688] IcmpCreateFile () returned 0x7d1268 [0143.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765798 [0143.688] IcmpSendEcho2 (in: IcmpHandle=0x7d1268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9900a8c0, RequestData=0xd7cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765798, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765798) returned 0x0 [0146.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765798 | out: hHeap=0x710000) returned 1 [0146.532] IcmpCloseHandle (IcmpHandle=0x7d1268) returned 1 [0146.533] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ebc28 | out: hHeap=0x710000) returned 1 Thread: id = 792 os_tid = 0xcbc [0143.690] GetLastError () returned 0x57 [0143.690] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ccaa8 [0143.698] SetLastError (dwErrCode=0x57) [0143.698] IcmpCreateFile () returned 0x7d1498 [0143.698] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7654c8 [0143.699] IcmpSendEcho2 (in: IcmpHandle=0x7d1498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9a00a8c0, RequestData=0xd90ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7654c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7654c8) returned 0x0 [0146.535] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7654c8 | out: hHeap=0x710000) returned 1 [0146.535] IcmpCloseHandle (IcmpHandle=0x7d1498) returned 1 [0146.535] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ccaa8 | out: hHeap=0x710000) returned 1 Thread: id = 793 os_tid = 0xcc4 [0143.700] GetLastError () returned 0x57 [0143.700] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ce6e8 [0143.700] SetLastError (dwErrCode=0x57) [0143.700] IcmpCreateFile () returned 0x7d1038 [0143.700] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765568 [0143.700] IcmpSendEcho2 (in: IcmpHandle=0x7d1038, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9b00a8c0, RequestData=0xda4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765568, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765568) returned 0x0 [0146.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765568 | out: hHeap=0x710000) returned 1 [0146.538] IcmpCloseHandle (IcmpHandle=0x7d1038) returned 1 [0146.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ce6e8 | out: hHeap=0x710000) returned 1 Thread: id = 794 os_tid = 0xccc [0143.702] GetLastError () returned 0x57 [0143.702] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cea70 [0143.702] SetLastError (dwErrCode=0x57) [0143.702] IcmpCreateFile () returned 0x7d1070 [0143.702] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7655b8 [0143.702] IcmpSendEcho2 (in: IcmpHandle=0x7d1070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9c00a8c0, RequestData=0xdb8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7655b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7655b8) returned 0x0 [0146.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7655b8 | out: hHeap=0x710000) returned 1 [0146.541] IcmpCloseHandle (IcmpHandle=0x7d1070) returned 1 [0146.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cea70 | out: hHeap=0x710000) returned 1 Thread: id = 795 os_tid = 0xcd8 [0143.703] GetLastError () returned 0x57 [0143.703] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cedf8 [0143.703] SetLastError (dwErrCode=0x57) [0143.703] IcmpCreateFile () returned 0x7d10a8 [0143.703] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2808 [0143.704] IcmpSendEcho2 (in: IcmpHandle=0x7d10a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9d00a8c0, RequestData=0xdccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2808, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2808) returned 0x0 [0146.543] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2808 | out: hHeap=0x710000) returned 1 [0146.543] IcmpCloseHandle (IcmpHandle=0x7d10a8) returned 1 [0146.543] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cedf8 | out: hHeap=0x710000) returned 1 Thread: id = 796 os_tid = 0xcf4 [0143.705] GetLastError () returned 0x57 [0143.705] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8080 [0143.705] SetLastError (dwErrCode=0x57) [0143.705] IcmpCreateFile () returned 0x7d10e0 [0143.705] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2858 [0143.705] IcmpSendEcho2 (in: IcmpHandle=0x7d10e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9e00a8c0, RequestData=0xde0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2858, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2858) returned 0x0 [0146.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2858 | out: hHeap=0x710000) returned 1 [0146.546] IcmpCloseHandle (IcmpHandle=0x7d10e0) returned 1 [0146.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c8080 | out: hHeap=0x710000) returned 1 Thread: id = 797 os_tid = 0x117c [0143.706] GetLastError () returned 0x57 [0143.706] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8408 [0143.707] SetLastError (dwErrCode=0x57) [0143.707] IcmpCreateFile () returned 0x7d1118 [0143.707] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d28a8 [0143.707] IcmpSendEcho2 (in: IcmpHandle=0x7d1118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9f00a8c0, RequestData=0xdf4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d28a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d28a8) returned 0x0 [0146.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d28a8 | out: hHeap=0x710000) returned 1 [0146.548] IcmpCloseHandle (IcmpHandle=0x7d1118) returned 1 [0146.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c8408 | out: hHeap=0x710000) returned 1 Thread: id = 798 os_tid = 0x119c [0143.708] GetLastError () returned 0x57 [0143.708] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8790 [0143.708] SetLastError (dwErrCode=0x57) [0143.708] IcmpCreateFile () returned 0x7d12a0 [0143.708] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d28f8 [0143.708] IcmpSendEcho2 (in: IcmpHandle=0x7d12a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa000a8c0, RequestData=0x224bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d28f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d28f8) returned 0x0 [0146.551] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d28f8 | out: hHeap=0x710000) returned 1 [0146.551] IcmpCloseHandle (IcmpHandle=0x7d12a0) returned 1 [0146.551] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c8790 | out: hHeap=0x710000) returned 1 Thread: id = 799 os_tid = 0x1198 [0143.709] GetLastError () returned 0x57 [0143.710] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8b18 [0143.710] SetLastError (dwErrCode=0x57) [0143.710] IcmpCreateFile () returned 0x7d12d8 [0143.710] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2948 [0143.710] IcmpSendEcho2 (in: IcmpHandle=0x7d12d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa100a8c0, RequestData=0x225fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2948, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2948) returned 0x0 [0146.553] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2948 | out: hHeap=0x710000) returned 1 [0146.553] IcmpCloseHandle (IcmpHandle=0x7d12d8) returned 1 [0146.554] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c8b18 | out: hHeap=0x710000) returned 1 Thread: id = 800 os_tid = 0x112c [0143.711] GetLastError () returned 0x57 [0143.711] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8ea0 [0143.711] SetLastError (dwErrCode=0x57) [0143.711] IcmpCreateFile () returned 0x7d1310 [0143.711] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d1f98 [0143.711] IcmpSendEcho2 (in: IcmpHandle=0x7d1310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa200a8c0, RequestData=0x2273ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d1f98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d1f98) returned 0x0 [0146.556] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d1f98 | out: hHeap=0x710000) returned 1 [0146.556] IcmpCloseHandle (IcmpHandle=0x7d1310) returned 1 [0146.556] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c8ea0 | out: hHeap=0x710000) returned 1 Thread: id = 801 os_tid = 0x1194 [0143.713] GetLastError () returned 0x57 [0143.713] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c9228 [0143.713] SetLastError (dwErrCode=0x57) [0143.713] IcmpCreateFile () returned 0x7d1348 [0143.713] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d1fe8 [0143.713] IcmpSendEcho2 (in: IcmpHandle=0x7d1348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa300a8c0, RequestData=0x2287ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d1fe8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d1fe8) returned 0x0 [0146.562] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d1fe8 | out: hHeap=0x710000) returned 1 [0146.562] IcmpCloseHandle (IcmpHandle=0x7d1348) returned 1 [0146.562] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c9228 | out: hHeap=0x710000) returned 1 Thread: id = 802 os_tid = 0x11a0 [0143.714] GetLastError () returned 0x57 [0143.714] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c95b0 [0143.714] SetLastError (dwErrCode=0x57) [0143.714] IcmpCreateFile () returned 0x7d1380 [0143.715] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2588 [0143.715] IcmpSendEcho2 (in: IcmpHandle=0x7d1380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa400a8c0, RequestData=0x229bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2588, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2588) returned 0x0 [0146.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2588 | out: hHeap=0x710000) returned 1 [0146.572] IcmpCloseHandle (IcmpHandle=0x7d1380) returned 1 [0146.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c95b0 | out: hHeap=0x710000) returned 1 Thread: id = 803 os_tid = 0x11a8 [0143.716] GetLastError () returned 0x57 [0143.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c9938 [0143.716] SetLastError (dwErrCode=0x57) [0143.716] IcmpCreateFile () returned 0x7d13b8 [0143.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d25d8 [0143.716] IcmpSendEcho2 (in: IcmpHandle=0x7d13b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa500a8c0, RequestData=0x22afff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d25d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d25d8) returned 0x0 [0146.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d25d8 | out: hHeap=0x710000) returned 1 [0146.574] IcmpCloseHandle (IcmpHandle=0x7d13b8) returned 1 [0146.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c9938 | out: hHeap=0x710000) returned 1 Thread: id = 804 os_tid = 0x11ac [0143.717] GetLastError () returned 0x57 [0143.717] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ca3d0 [0143.718] SetLastError (dwErrCode=0x57) [0143.718] IcmpCreateFile () returned 0x7d1460 [0143.718] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d2038 [0143.718] IcmpSendEcho2 (in: IcmpHandle=0x7d1460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa600a8c0, RequestData=0x22c3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d2038, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d2038) returned 0x0 [0146.576] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d2038 | out: hHeap=0x710000) returned 1 [0146.576] IcmpCloseHandle (IcmpHandle=0x7d1460) returned 1 [0146.576] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ca3d0 | out: hHeap=0x710000) returned 1 Thread: id = 805 os_tid = 0x127c [0143.719] GetLastError () returned 0x57 [0143.719] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ca758 [0143.719] SetLastError (dwErrCode=0x57) [0143.719] IcmpCreateFile () returned 0x7d14d0 [0143.719] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad980 [0143.719] IcmpSendEcho2 (in: IcmpHandle=0x7d14d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa700a8c0, RequestData=0x22d7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad980, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad980) returned 0x0 [0146.579] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad980 | out: hHeap=0x710000) returned 1 [0146.579] IcmpCloseHandle (IcmpHandle=0x7d14d0) returned 1 [0146.580] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ca758 | out: hHeap=0x710000) returned 1 Thread: id = 806 os_tid = 0x1154 [0143.720] GetLastError () returned 0x57 [0143.721] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6caae0 [0143.721] SetLastError (dwErrCode=0x57) [0143.721] IcmpCreateFile () returned 0x7d1620 [0143.721] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad7f0 [0143.721] IcmpSendEcho2 (in: IcmpHandle=0x7d1620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa800a8c0, RequestData=0x22ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad7f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad7f0) returned 0x0 [0146.586] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad7f0 | out: hHeap=0x710000) returned 1 [0146.586] IcmpCloseHandle (IcmpHandle=0x7d1620) returned 1 [0146.586] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6caae0 | out: hHeap=0x710000) returned 1 Thread: id = 807 os_tid = 0x130c [0143.722] GetLastError () returned 0x57 [0143.722] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cae68 [0143.722] SetLastError (dwErrCode=0x57) [0143.722] IcmpCreateFile () returned 0x7d1658 [0143.722] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad840 [0143.722] IcmpSendEcho2 (in: IcmpHandle=0x7d1658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa900a8c0, RequestData=0x22ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad840, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad840) returned 0x0 [0146.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad840 | out: hHeap=0x710000) returned 1 [0146.588] IcmpCloseHandle (IcmpHandle=0x7d1658) returned 1 [0146.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cae68 | out: hHeap=0x710000) returned 1 Thread: id = 808 os_tid = 0x1338 [0143.803] GetLastError () returned 0x57 [0143.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cb1f0 [0143.803] SetLastError (dwErrCode=0x57) [0143.803] IcmpCreateFile () returned 0x7d0f90 [0143.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad890 [0143.803] IcmpSendEcho2 (in: IcmpHandle=0x7d0f90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaa00a8c0, RequestData=0x246bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad890, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad890) returned 0x0 [0146.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad890 | out: hHeap=0x710000) returned 1 [0146.590] IcmpCloseHandle (IcmpHandle=0x7d0f90) returned 1 [0146.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cb1f0 | out: hHeap=0x710000) returned 1 Thread: id = 809 os_tid = 0x1128 [0143.805] GetLastError () returned 0x57 [0143.805] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cb578 [0143.805] SetLastError (dwErrCode=0x57) [0143.805] IcmpCreateFile () returned 0x7d0fc8 [0143.805] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad8e0 [0143.805] IcmpSendEcho2 (in: IcmpHandle=0x7d0fc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xab00a8c0, RequestData=0x247bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad8e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad8e0) returned 0x0 [0146.592] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad8e0 | out: hHeap=0x710000) returned 1 [0146.592] IcmpCloseHandle (IcmpHandle=0x7d0fc8) returned 1 [0146.593] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cb578 | out: hHeap=0x710000) returned 1 Thread: id = 810 os_tid = 0x1308 [0143.806] GetLastError () returned 0x57 [0143.806] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cb900 [0143.806] SetLastError (dwErrCode=0x57) [0143.807] IcmpCreateFile () returned 0x7d1000 [0143.807] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad930 [0143.807] IcmpSendEcho2 (in: IcmpHandle=0x7d1000, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xac00a8c0, RequestData=0x248fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad930, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad930) returned 0x0 [0146.594] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad930 | out: hHeap=0x710000) returned 1 [0146.594] IcmpCloseHandle (IcmpHandle=0x7d1000) returned 1 [0146.595] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cb900 | out: hHeap=0x710000) returned 1 Thread: id = 811 os_tid = 0x1364 [0143.808] GetLastError () returned 0x57 [0143.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cbc88 [0143.808] SetLastError (dwErrCode=0x57) [0143.808] IcmpCreateFile () returned 0x7d13f0 [0143.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad9d0 [0143.808] IcmpSendEcho2 (in: IcmpHandle=0x7d13f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xad00a8c0, RequestData=0x24a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad9d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad9d0) returned 0x0 [0146.596] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad9d0 | out: hHeap=0x710000) returned 1 [0146.596] IcmpCloseHandle (IcmpHandle=0x7d13f0) returned 1 [0146.597] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cbc88 | out: hHeap=0x710000) returned 1 Thread: id = 812 os_tid = 0x1334 [0143.809] GetLastError () returned 0x57 [0143.809] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c9cc0 [0143.809] SetLastError (dwErrCode=0x57) [0143.809] IcmpCreateFile () returned 0x7d1428 [0143.809] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ada20 [0143.809] IcmpSendEcho2 (in: IcmpHandle=0x7d1428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xae00a8c0, RequestData=0x24b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ada20, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ada20) returned 0x0 [0146.599] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ada20 | out: hHeap=0x710000) returned 1 [0146.599] IcmpCloseHandle (IcmpHandle=0x7d1428) returned 1 [0146.599] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6c9cc0 | out: hHeap=0x710000) returned 1 Thread: id = 813 os_tid = 0x1324 [0143.810] GetLastError () returned 0x57 [0143.810] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ca048 [0143.811] SetLastError (dwErrCode=0x57) [0143.811] IcmpCreateFile () returned 0x7d1508 [0143.811] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ada70 [0143.811] IcmpSendEcho2 (in: IcmpHandle=0x7d1508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaf00a8c0, RequestData=0x24cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ada70, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ada70) returned 0x0 [0146.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ada70 | out: hHeap=0x710000) returned 1 [0146.602] IcmpCloseHandle (IcmpHandle=0x7d1508) returned 1 [0146.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ca048 | out: hHeap=0x710000) returned 1 Thread: id = 814 os_tid = 0x132c [0143.818] GetLastError () returned 0x57 [0143.818] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cc010 [0143.818] SetLastError (dwErrCode=0x57) [0143.818] IcmpCreateFile () returned 0x7d1540 [0143.818] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7adac0 [0143.818] IcmpSendEcho2 (in: IcmpHandle=0x7d1540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb000a8c0, RequestData=0x24dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7adac0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7adac0) returned 0x0 [0146.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7adac0 | out: hHeap=0x710000) returned 1 [0146.604] IcmpCloseHandle (IcmpHandle=0x7d1540) returned 1 [0146.605] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cc010 | out: hHeap=0x710000) returned 1 Thread: id = 815 os_tid = 0x1330 [0143.819] GetLastError () returned 0x57 [0143.819] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cc398 [0143.820] SetLastError (dwErrCode=0x57) [0143.820] IcmpCreateFile () returned 0x7d1578 [0143.820] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7adb10 [0143.820] IcmpSendEcho2 (in: IcmpHandle=0x7d1578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb100a8c0, RequestData=0x24f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7adb10, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7adb10) returned 0x0 [0146.608] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7adb10 | out: hHeap=0x710000) returned 1 [0146.608] IcmpCloseHandle (IcmpHandle=0x7d1578) returned 1 [0146.608] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cc398 | out: hHeap=0x710000) returned 1 Thread: id = 816 os_tid = 0x1340 [0143.821] GetLastError () returned 0x57 [0143.821] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cc720 [0143.821] SetLastError (dwErrCode=0x57) [0143.821] IcmpCreateFile () returned 0x7d15b0 [0143.821] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad5c0 [0143.821] IcmpSendEcho2 (in: IcmpHandle=0x7d15b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb200a8c0, RequestData=0x2507ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad5c0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad5c0) returned 0x0 [0146.610] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad5c0 | out: hHeap=0x710000) returned 1 [0146.610] IcmpCloseHandle (IcmpHandle=0x7d15b0) returned 1 [0146.611] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cc720 | out: hHeap=0x710000) returned 1 Thread: id = 817 os_tid = 0x1328 [0143.822] GetLastError () returned 0x57 [0143.822] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cce30 [0143.823] SetLastError (dwErrCode=0x57) [0143.823] IcmpCreateFile () returned 0x7d1ce8 [0143.823] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad610 [0143.823] IcmpSendEcho2 (in: IcmpHandle=0x7d1ce8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb300a8c0, RequestData=0x251bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad610, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad610) returned 0x0 [0146.612] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad610 | out: hHeap=0x710000) returned 1 [0146.612] IcmpCloseHandle (IcmpHandle=0x7d1ce8) returned 1 [0146.613] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cce30 | out: hHeap=0x710000) returned 1 Thread: id = 818 os_tid = 0x12f8 [0143.824] GetLastError () returned 0x57 [0143.824] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cd1b8 [0143.824] SetLastError (dwErrCode=0x57) [0143.824] IcmpCreateFile () returned 0x7d1af0 [0143.824] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad660 [0143.824] IcmpSendEcho2 (in: IcmpHandle=0x7d1af0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb500a8c0, RequestData=0x254fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad660, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad660) returned 0x0 [0146.615] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad660 | out: hHeap=0x710000) returned 1 [0146.615] IcmpCloseHandle (IcmpHandle=0x7d1af0) returned 1 [0146.616] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cd1b8 | out: hHeap=0x710000) returned 1 Thread: id = 819 os_tid = 0x1300 [0143.841] GetLastError () returned 0x57 [0143.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cd540 [0143.841] SetLastError (dwErrCode=0x57) [0143.841] IcmpCreateFile () returned 0x7d1d20 [0143.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad6b0 [0143.841] IcmpSendEcho2 (in: IcmpHandle=0x7d1d20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb600a8c0, RequestData=0x2563ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad6b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad6b0) returned 0x0 [0146.618] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad6b0 | out: hHeap=0x710000) returned 1 [0146.618] IcmpCloseHandle (IcmpHandle=0x7d1d20) returned 1 [0146.618] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cd540 | out: hHeap=0x710000) returned 1 Thread: id = 820 os_tid = 0x1304 [0143.843] GetLastError () returned 0x57 [0143.843] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cd8c8 [0143.843] SetLastError (dwErrCode=0x57) [0143.843] IcmpCreateFile () returned 0x7d1d58 [0143.843] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad700 [0143.843] IcmpSendEcho2 (in: IcmpHandle=0x7d1d58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb700a8c0, RequestData=0x2577ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad700, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad700) returned 0x0 [0146.620] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad700 | out: hHeap=0x710000) returned 1 [0146.620] IcmpCloseHandle (IcmpHandle=0x7d1d58) returned 1 [0146.621] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cd8c8 | out: hHeap=0x710000) returned 1 Thread: id = 821 os_tid = 0x1314 [0143.845] GetLastError () returned 0x57 [0143.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cdc50 [0143.845] SetLastError (dwErrCode=0x57) [0143.845] IcmpCreateFile () returned 0x7d1690 [0143.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad750 [0143.845] IcmpSendEcho2 (in: IcmpHandle=0x7d1690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb800a8c0, RequestData=0x258bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad750, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad750) returned 0x0 [0146.622] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad750 | out: hHeap=0x710000) returned 1 [0146.622] IcmpCloseHandle (IcmpHandle=0x7d1690) returned 1 [0146.623] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cdc50 | out: hHeap=0x710000) returned 1 Thread: id = 822 os_tid = 0x1320 [0143.846] GetLastError () returned 0x57 [0143.846] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cdfd8 [0143.847] SetLastError (dwErrCode=0x57) [0143.847] IcmpCreateFile () returned 0x7d16c8 [0143.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad7a0 [0143.847] IcmpSendEcho2 (in: IcmpHandle=0x7d16c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb900a8c0, RequestData=0x259fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad7a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad7a0) returned 0x0 [0146.625] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad7a0 | out: hHeap=0x710000) returned 1 [0146.625] IcmpCloseHandle (IcmpHandle=0x7d16c8) returned 1 [0146.625] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cdfd8 | out: hHeap=0x710000) returned 1 Thread: id = 823 os_tid = 0x12fc [0143.848] GetLastError () returned 0x57 [0143.848] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ce360 [0143.848] SetLastError (dwErrCode=0x57) [0143.848] IcmpCreateFile () returned 0x7d1700 [0143.848] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acfd0 [0143.848] IcmpSendEcho2 (in: IcmpHandle=0x7d1700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xba00a8c0, RequestData=0x25b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acfd0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acfd0) returned 0x0 [0146.627] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acfd0 | out: hHeap=0x710000) returned 1 [0146.627] IcmpCloseHandle (IcmpHandle=0x7d1700) returned 1 [0146.628] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ce360 | out: hHeap=0x710000) returned 1 Thread: id = 824 os_tid = 0x794 [0143.849] GetLastError () returned 0x57 [0143.849] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d4640 [0143.850] SetLastError (dwErrCode=0x57) [0143.850] IcmpCreateFile () returned 0x7d1738 [0143.850] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad020 [0143.850] IcmpSendEcho2 (in: IcmpHandle=0x7d1738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbb00a8c0, RequestData=0x25c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad020, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad020) returned 0x0 [0146.629] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad020 | out: hHeap=0x710000) returned 1 [0146.630] IcmpCloseHandle (IcmpHandle=0x7d1738) returned 1 [0146.630] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d4640 | out: hHeap=0x710000) returned 1 Thread: id = 825 os_tid = 0x12f4 [0143.851] GetLastError () returned 0x57 [0143.851] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d49c8 [0143.851] SetLastError (dwErrCode=0x57) [0143.851] IcmpCreateFile () returned 0x7d1770 [0143.851] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad070 [0143.851] IcmpSendEcho2 (in: IcmpHandle=0x7d1770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbc00a8c0, RequestData=0x25dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad070, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad070) returned 0x0 [0146.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad070 | out: hHeap=0x710000) returned 1 [0146.633] IcmpCloseHandle (IcmpHandle=0x7d1770) returned 1 [0146.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d49c8 | out: hHeap=0x710000) returned 1 Thread: id = 826 os_tid = 0x86c [0143.852] GetLastError () returned 0x57 [0143.852] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d4d50 [0143.853] SetLastError (dwErrCode=0x57) [0143.853] IcmpCreateFile () returned 0x7d17a8 [0143.853] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad0c0 [0143.853] IcmpSendEcho2 (in: IcmpHandle=0x7d17a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbd00a8c0, RequestData=0x25efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad0c0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad0c0) returned 0x0 [0146.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad0c0 | out: hHeap=0x710000) returned 1 [0146.635] IcmpCloseHandle (IcmpHandle=0x7d17a8) returned 1 [0146.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d4d50 | out: hHeap=0x710000) returned 1 Thread: id = 827 os_tid = 0xae0 [0143.854] GetLastError () returned 0x57 [0143.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d50d8 [0143.854] SetLastError (dwErrCode=0x57) [0143.854] IcmpCreateFile () returned 0x7d17e0 [0143.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad110 [0143.854] IcmpSendEcho2 (in: IcmpHandle=0x7d17e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbe00a8c0, RequestData=0x2603ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad110, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad110) returned 0x0 [0146.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad110 | out: hHeap=0x710000) returned 1 [0146.637] IcmpCloseHandle (IcmpHandle=0x7d17e0) returned 1 [0146.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d50d8 | out: hHeap=0x710000) returned 1 Thread: id = 828 os_tid = 0x12c4 [0143.855] GetLastError () returned 0x57 [0143.855] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d5460 [0143.855] SetLastError (dwErrCode=0x57) [0143.855] IcmpCreateFile () returned 0x7d1818 [0143.855] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad160 [0143.856] IcmpSendEcho2 (in: IcmpHandle=0x7d1818, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbf00a8c0, RequestData=0x2617ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad160, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad160) returned 0x0 [0146.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad160 | out: hHeap=0x710000) returned 1 [0146.640] IcmpCloseHandle (IcmpHandle=0x7d1818) returned 1 [0146.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d5460 | out: hHeap=0x710000) returned 1 Thread: id = 829 os_tid = 0x87c [0143.857] GetLastError () returned 0x57 [0143.857] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d57e8 [0143.857] SetLastError (dwErrCode=0x57) [0143.857] IcmpCreateFile () returned 0x7d1850 [0143.857] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad1b0 [0143.857] IcmpSendEcho2 (in: IcmpHandle=0x7d1850, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc000a8c0, RequestData=0x262bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad1b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad1b0) returned 0x0 [0146.643] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad1b0 | out: hHeap=0x710000) returned 1 [0146.643] IcmpCloseHandle (IcmpHandle=0x7d1850) returned 1 [0146.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d57e8 | out: hHeap=0x710000) returned 1 Thread: id = 830 os_tid = 0x12c8 [0143.858] GetLastError () returned 0x57 [0143.858] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d5b70 [0143.858] SetLastError (dwErrCode=0x57) [0143.859] IcmpCreateFile () returned 0x7d1888 [0143.859] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad200 [0143.859] IcmpSendEcho2 (in: IcmpHandle=0x7d1888, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc100a8c0, RequestData=0x263fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad200, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad200) returned 0x0 [0146.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad200 | out: hHeap=0x710000) returned 1 [0146.648] IcmpCloseHandle (IcmpHandle=0x7d1888) returned 1 [0146.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d5b70 | out: hHeap=0x710000) returned 1 Thread: id = 831 os_tid = 0x1064 [0145.143] VirtualAlloc (lpAddress=0x0, dwSize=0xf4, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0145.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0145.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f090c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0145.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0145.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0924, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0145.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0145.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f093c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0145.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0145.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0954, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0145.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0145.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f096c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0145.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0145.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0984, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0145.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0145.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f099c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0145.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0145.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0145.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0145.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0145.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0145.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0145.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0145.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0145.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0145.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0145.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0145.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0145.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0145.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0145.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0145.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0145.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0145.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a74, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0145.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0145.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a8c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0145.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0145.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0145.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0145.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0abc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0145.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0145.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ad4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0145.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0145.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0145.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0145.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b04, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0145.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4 [0145.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0145.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac [0145.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0145.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0145.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0145.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0145.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0145.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0145.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0145.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0145.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b94, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0145.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0145.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0145.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0145.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bc4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0145.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0145.316] WaitForMultipleObjects (nCount=0x3d, lpHandles=0x6f0000*=0x384, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0146.710] CloseHandle (hObject=0x384) returned 1 [0146.710] CloseHandle (hObject=0xa34) returned 1 [0146.710] CloseHandle (hObject=0x740) returned 1 [0146.710] CloseHandle (hObject=0x744) returned 1 [0146.710] CloseHandle (hObject=0x748) returned 1 [0146.710] CloseHandle (hObject=0x814) returned 1 [0146.711] CloseHandle (hObject=0x818) returned 1 [0146.711] CloseHandle (hObject=0x81c) returned 1 [0146.711] CloseHandle (hObject=0x820) returned 1 [0146.711] CloseHandle (hObject=0x824) returned 1 [0146.711] CloseHandle (hObject=0x828) returned 1 [0146.711] CloseHandle (hObject=0x82c) returned 1 [0146.711] CloseHandle (hObject=0x830) returned 1 [0146.711] CloseHandle (hObject=0x834) returned 1 [0146.711] CloseHandle (hObject=0x838) returned 1 [0146.711] CloseHandle (hObject=0x83c) returned 1 [0146.711] CloseHandle (hObject=0x344) returned 1 [0146.711] CloseHandle (hObject=0x284) returned 1 [0146.711] CloseHandle (hObject=0x280) returned 1 [0146.711] CloseHandle (hObject=0x27c) returned 1 [0146.711] CloseHandle (hObject=0x278) returned 1 [0146.711] CloseHandle (hObject=0x274) returned 1 [0146.711] CloseHandle (hObject=0x270) returned 1 [0146.712] CloseHandle (hObject=0x26c) returned 1 [0146.712] CloseHandle (hObject=0x268) returned 1 [0146.712] CloseHandle (hObject=0x264) returned 1 [0146.712] CloseHandle (hObject=0x260) returned 1 [0146.712] CloseHandle (hObject=0x25c) returned 1 [0146.712] CloseHandle (hObject=0x258) returned 1 [0146.712] CloseHandle (hObject=0x254) returned 1 [0146.712] CloseHandle (hObject=0x250) returned 1 [0146.712] CloseHandle (hObject=0x24c) returned 1 [0146.712] CloseHandle (hObject=0x248) returned 1 [0146.712] CloseHandle (hObject=0x244) returned 1 [0146.712] CloseHandle (hObject=0x240) returned 1 [0146.712] CloseHandle (hObject=0x23c) returned 1 [0146.712] CloseHandle (hObject=0x238) returned 1 [0146.712] CloseHandle (hObject=0x234) returned 1 [0146.712] CloseHandle (hObject=0x914) returned 1 [0146.712] CloseHandle (hObject=0x3dc) returned 1 [0146.713] CloseHandle (hObject=0xa98) returned 1 [0146.713] CloseHandle (hObject=0x3d0) returned 1 [0146.713] CloseHandle (hObject=0xa9c) returned 1 [0146.713] CloseHandle (hObject=0xaa0) returned 1 [0146.713] CloseHandle (hObject=0xaa4) returned 1 [0146.713] CloseHandle (hObject=0xaa8) returned 1 [0146.713] CloseHandle (hObject=0xaac) returned 1 [0146.713] CloseHandle (hObject=0xab0) returned 1 [0146.713] CloseHandle (hObject=0xab4) returned 1 [0146.713] CloseHandle (hObject=0xab8) returned 1 [0146.713] CloseHandle (hObject=0xabc) returned 1 [0146.713] CloseHandle (hObject=0xac0) returned 1 [0146.713] CloseHandle (hObject=0xac4) returned 1 [0146.713] CloseHandle (hObject=0xac8) returned 1 [0146.713] CloseHandle (hObject=0xacc) returned 1 [0146.713] CloseHandle (hObject=0xad0) returned 1 [0146.713] CloseHandle (hObject=0xad4) returned 1 [0146.713] CloseHandle (hObject=0xad8) returned 1 [0146.714] CloseHandle (hObject=0xadc) returned 1 [0146.714] CloseHandle (hObject=0xae0) returned 1 [0146.714] CloseHandle (hObject=0xae4) returned 1 [0146.714] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 832 os_tid = 0x13f0 [0145.195] GetLastError () returned 0x57 [0145.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d5ef8 [0145.196] SetLastError (dwErrCode=0x57) [0145.196] IcmpCreateFile () returned 0x7d18c0 [0145.196] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad250 [0145.196] IcmpSendEcho2 (in: IcmpHandle=0x7d18c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc200a8c0, RequestData=0xb14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad250, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad250) returned 0x0 [0146.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad250 | out: hHeap=0x710000) returned 1 [0146.651] IcmpCloseHandle (IcmpHandle=0x7d18c0) returned 1 [0146.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d5ef8 | out: hHeap=0x710000) returned 1 Thread: id = 833 os_tid = 0xb0c [0145.197] GetLastError () returned 0x57 [0145.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cf180 [0145.220] SetLastError (dwErrCode=0x57) [0145.220] IcmpCreateFile () returned 0x7d18f8 [0145.220] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad2a0 [0145.222] IcmpSendEcho2 (in: IcmpHandle=0x7d18f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc300a8c0, RequestData=0xe08ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad2a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad2a0) returned 0x0 [0146.655] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad2a0 | out: hHeap=0x710000) returned 1 [0146.655] IcmpCloseHandle (IcmpHandle=0x7d18f8) returned 1 [0146.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cf180 | out: hHeap=0x710000) returned 1 Thread: id = 834 os_tid = 0x13fc [0145.223] GetLastError () returned 0x57 [0145.224] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cf508 [0145.224] SetLastError (dwErrCode=0x57) [0145.224] IcmpCreateFile () returned 0x7d1930 [0145.224] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad2f0 [0145.224] IcmpSendEcho2 (in: IcmpHandle=0x7d1930, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc400a8c0, RequestData=0xe1cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad2f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad2f0) returned 0x0 [0146.659] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad2f0 | out: hHeap=0x710000) returned 1 [0146.659] IcmpCloseHandle (IcmpHandle=0x7d1930) returned 1 [0146.659] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cf508 | out: hHeap=0x710000) returned 1 Thread: id = 835 os_tid = 0x131c [0145.225] GetLastError () returned 0x57 [0145.225] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cf890 [0145.226] SetLastError (dwErrCode=0x57) [0145.226] IcmpCreateFile () returned 0x7d1968 [0145.226] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad340 [0145.226] IcmpSendEcho2 (in: IcmpHandle=0x7d1968, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc500a8c0, RequestData=0xe30ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad340, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad340) returned 0x0 [0146.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad340 | out: hHeap=0x710000) returned 1 [0146.662] IcmpCloseHandle (IcmpHandle=0x7d1968) returned 1 [0146.663] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cf890 | out: hHeap=0x710000) returned 1 Thread: id = 836 os_tid = 0x13a8 [0145.227] GetLastError () returned 0x57 [0145.227] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cfc18 [0145.227] SetLastError (dwErrCode=0x57) [0145.227] IcmpCreateFile () returned 0x7d19a0 [0145.227] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad390 [0145.227] IcmpSendEcho2 (in: IcmpHandle=0x7d19a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc600a8c0, RequestData=0xe44ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad390, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad390) returned 0x0 [0146.665] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad390 | out: hHeap=0x710000) returned 1 [0146.666] IcmpCloseHandle (IcmpHandle=0x7d19a0) returned 1 [0146.666] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cfc18 | out: hHeap=0x710000) returned 1 Thread: id = 837 os_tid = 0x1140 [0145.228] GetLastError () returned 0x57 [0145.228] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cffa0 [0145.229] SetLastError (dwErrCode=0x57) [0145.229] IcmpCreateFile () returned 0x7d19d8 [0145.229] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad3e0 [0145.229] IcmpSendEcho2 (in: IcmpHandle=0x7d19d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc700a8c0, RequestData=0xe58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad3e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad3e0) returned 0x0 [0146.669] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad3e0 | out: hHeap=0x710000) returned 1 [0146.669] IcmpCloseHandle (IcmpHandle=0x7d19d8) returned 1 [0146.669] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6cffa0 | out: hHeap=0x710000) returned 1 Thread: id = 838 os_tid = 0x13a4 [0145.230] GetLastError () returned 0x57 [0145.230] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d0328 [0145.230] SetLastError (dwErrCode=0x57) [0145.230] IcmpCreateFile () returned 0x7d1a10 [0145.230] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad430 [0145.230] IcmpSendEcho2 (in: IcmpHandle=0x7d1a10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc800a8c0, RequestData=0xe6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad430, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad430) returned 0x0 [0146.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad430 | out: hHeap=0x710000) returned 1 [0146.672] IcmpCloseHandle (IcmpHandle=0x7d1a10) returned 1 [0146.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d0328 | out: hHeap=0x710000) returned 1 Thread: id = 839 os_tid = 0x1398 [0145.232] GetLastError () returned 0x57 [0145.232] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d06b0 [0145.232] SetLastError (dwErrCode=0x57) [0145.232] IcmpCreateFile () returned 0x7d1a48 [0145.232] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad480 [0145.232] IcmpSendEcho2 (in: IcmpHandle=0x7d1a48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc900a8c0, RequestData=0xe80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad480, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad480) returned 0x0 [0146.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad480 | out: hHeap=0x710000) returned 1 [0146.675] IcmpCloseHandle (IcmpHandle=0x7d1a48) returned 1 [0146.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d06b0 | out: hHeap=0x710000) returned 1 Thread: id = 840 os_tid = 0x13ec [0145.233] GetLastError () returned 0x57 [0145.233] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d0a38 [0145.233] SetLastError (dwErrCode=0x57) [0145.233] IcmpCreateFile () returned 0x7d1a80 [0145.234] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad4d0 [0145.234] IcmpSendEcho2 (in: IcmpHandle=0x7d1a80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xca00a8c0, RequestData=0xe94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad4d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad4d0) returned 0x0 [0146.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad4d0 | out: hHeap=0x710000) returned 1 [0146.679] IcmpCloseHandle (IcmpHandle=0x7d1a80) returned 1 [0146.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d0a38 | out: hHeap=0x710000) returned 1 Thread: id = 841 os_tid = 0x13e8 [0145.235] GetLastError () returned 0x57 [0145.235] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d0dc0 [0145.235] SetLastError (dwErrCode=0x57) [0145.235] IcmpCreateFile () returned 0x7d1ab8 [0145.235] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad520 [0145.235] IcmpSendEcho2 (in: IcmpHandle=0x7d1ab8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcb00a8c0, RequestData=0xea8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad520, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad520) returned 0x0 [0146.682] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad520 | out: hHeap=0x710000) returned 1 [0146.682] IcmpCloseHandle (IcmpHandle=0x7d1ab8) returned 1 [0146.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d0dc0 | out: hHeap=0x710000) returned 1 Thread: id = 842 os_tid = 0x13c8 [0145.236] GetLastError () returned 0x57 [0145.236] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d1148 [0145.237] SetLastError (dwErrCode=0x57) [0145.237] IcmpCreateFile () returned 0x7d1b28 [0145.237] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad570 [0145.237] IcmpSendEcho2 (in: IcmpHandle=0x7d1b28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcc00a8c0, RequestData=0xebcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad570, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad570) returned 0x0 [0146.685] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad570 | out: hHeap=0x710000) returned 1 [0146.685] IcmpCloseHandle (IcmpHandle=0x7d1b28) returned 1 [0146.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d1148 | out: hHeap=0x710000) returned 1 Thread: id = 843 os_tid = 0x13e0 [0145.238] GetLastError () returned 0x57 [0145.238] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d14d0 [0145.238] SetLastError (dwErrCode=0x57) [0145.238] IcmpCreateFile () returned 0x7d1b60 [0145.238] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acbc0 [0145.238] IcmpSendEcho2 (in: IcmpHandle=0x7d1b60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcd00a8c0, RequestData=0x231bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acbc0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acbc0) returned 0x0 [0146.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acbc0 | out: hHeap=0x710000) returned 1 [0146.689] IcmpCloseHandle (IcmpHandle=0x7d1b60) returned 1 [0146.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d14d0 | out: hHeap=0x710000) returned 1 Thread: id = 844 os_tid = 0x1350 [0145.240] GetLastError () returned 0x57 [0145.240] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d1858 [0145.240] SetLastError (dwErrCode=0x57) [0145.240] IcmpCreateFile () returned 0x7d1b98 [0145.240] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acc10 [0145.240] IcmpSendEcho2 (in: IcmpHandle=0x7d1b98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xce00a8c0, RequestData=0x232fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acc10, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acc10) returned 0x0 [0146.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acc10 | out: hHeap=0x710000) returned 1 [0146.692] IcmpCloseHandle (IcmpHandle=0x7d1b98) returned 1 [0146.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d1858 | out: hHeap=0x710000) returned 1 Thread: id = 845 os_tid = 0x13b0 [0145.242] GetLastError () returned 0x57 [0145.242] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d1be0 [0145.242] SetLastError (dwErrCode=0x57) [0145.242] IcmpCreateFile () returned 0x7d1bd0 [0145.242] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acc60 [0145.242] IcmpSendEcho2 (in: IcmpHandle=0x7d1bd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcf00a8c0, RequestData=0x2343ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acc60, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acc60) returned 0x0 [0146.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acc60 | out: hHeap=0x710000) returned 1 [0146.696] IcmpCloseHandle (IcmpHandle=0x7d1bd0) returned 1 [0146.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d1be0 | out: hHeap=0x710000) returned 1 Thread: id = 846 os_tid = 0x13e4 [0145.243] GetLastError () returned 0x57 [0145.243] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d1f68 [0145.243] SetLastError (dwErrCode=0x57) [0145.243] IcmpCreateFile () returned 0x7d1c08 [0145.243] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7accb0 [0145.244] IcmpSendEcho2 (in: IcmpHandle=0x7d1c08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd000a8c0, RequestData=0x2357ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7accb0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7accb0) returned 0x0 [0146.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7accb0 | out: hHeap=0x710000) returned 1 [0146.701] IcmpCloseHandle (IcmpHandle=0x7d1c08) returned 1 [0146.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d1f68 | out: hHeap=0x710000) returned 1 Thread: id = 847 os_tid = 0x13f4 [0145.245] GetLastError () returned 0x57 [0145.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d22f0 [0145.245] SetLastError (dwErrCode=0x57) [0145.245] IcmpCreateFile () returned 0x7d1c40 [0145.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acd00 [0145.245] IcmpSendEcho2 (in: IcmpHandle=0x7d1c40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd100a8c0, RequestData=0x236bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acd00, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acd00) returned 0x0 [0146.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acd00 | out: hHeap=0x710000) returned 1 [0146.704] IcmpCloseHandle (IcmpHandle=0x7d1c40) returned 1 [0146.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d22f0 | out: hHeap=0x710000) returned 1 Thread: id = 848 os_tid = 0x13f8 [0145.246] GetLastError () returned 0x57 [0145.246] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d2678 [0145.247] SetLastError (dwErrCode=0x57) [0145.247] IcmpCreateFile () returned 0x7d1c78 [0145.247] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acd50 [0145.247] IcmpSendEcho2 (in: IcmpHandle=0x7d1c78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd200a8c0, RequestData=0x237fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acd50, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acd50) returned 0x0 [0146.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acd50 | out: hHeap=0x710000) returned 1 [0146.708] IcmpCloseHandle (IcmpHandle=0x7d1c78) returned 1 [0146.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d2678 | out: hHeap=0x710000) returned 1 Thread: id = 849 os_tid = 0x13d4 [0145.248] GetLastError () returned 0x57 [0145.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d2a00 [0145.248] SetLastError (dwErrCode=0x57) [0145.248] IcmpCreateFile () returned 0x7d1cb0 [0145.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acda0 [0145.248] IcmpSendEcho2 (in: IcmpHandle=0x7d1cb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd300a8c0, RequestData=0x2393ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acda0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acda0) returned 0x0 [0146.726] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acda0 | out: hHeap=0x710000) returned 1 [0146.726] IcmpCloseHandle (IcmpHandle=0x7d1cb0) returned 1 [0146.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d2a00 | out: hHeap=0x710000) returned 1 Thread: id = 850 os_tid = 0x13c4 [0145.250] GetLastError () returned 0x57 [0145.250] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d2d88 [0145.250] SetLastError (dwErrCode=0x57) [0145.250] IcmpCreateFile () returned 0x7d1f18 [0145.250] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acdf0 [0145.250] IcmpSendEcho2 (in: IcmpHandle=0x7d1f18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd400a8c0, RequestData=0x23a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acdf0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acdf0) returned 0x0 [0146.744] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acdf0 | out: hHeap=0x710000) returned 1 [0146.744] IcmpCloseHandle (IcmpHandle=0x7d1f18) returned 1 [0146.745] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d2d88 | out: hHeap=0x710000) returned 1 Thread: id = 851 os_tid = 0x784 [0145.251] GetLastError () returned 0x57 [0145.251] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d3110 [0145.251] SetLastError (dwErrCode=0x57) [0145.251] IcmpCreateFile () returned 0x7d1d90 [0145.251] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ace40 [0145.251] IcmpSendEcho2 (in: IcmpHandle=0x7d1d90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd500a8c0, RequestData=0x23bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ace40, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ace40) returned 0x0 [0146.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ace40 | out: hHeap=0x710000) returned 1 [0146.910] IcmpCloseHandle (IcmpHandle=0x7d1d90) returned 1 [0146.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d3110 | out: hHeap=0x710000) returned 1 Thread: id = 852 os_tid = 0x444 [0145.253] GetLastError () returned 0x57 [0145.253] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d3498 [0145.253] SetLastError (dwErrCode=0x57) [0145.253] IcmpCreateFile () returned 0x7d1dc8 [0145.253] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ace90 [0145.253] IcmpSendEcho2 (in: IcmpHandle=0x7d1dc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd600a8c0, RequestData=0x23cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ace90, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ace90) returned 0x0 [0146.912] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ace90 | out: hHeap=0x710000) returned 1 [0146.912] IcmpCloseHandle (IcmpHandle=0x7d1dc8) returned 1 [0146.913] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d3498 | out: hHeap=0x710000) returned 1 Thread: id = 853 os_tid = 0xa10 [0145.255] GetLastError () returned 0x57 [0145.255] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d3820 [0145.255] SetLastError (dwErrCode=0x57) [0145.255] IcmpCreateFile () returned 0x7d1e00 [0145.255] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acee0 [0145.255] IcmpSendEcho2 (in: IcmpHandle=0x7d1e00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd700a8c0, RequestData=0x23e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acee0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acee0) returned 0x0 [0146.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acee0 | out: hHeap=0x710000) returned 1 [0146.914] IcmpCloseHandle (IcmpHandle=0x7d1e00) returned 1 [0146.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d3820 | out: hHeap=0x710000) returned 1 Thread: id = 854 os_tid = 0xb14 [0145.256] GetLastError () returned 0x57 [0145.257] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d3ba8 [0145.257] SetLastError (dwErrCode=0x57) [0145.257] IcmpCreateFile () returned 0x7d1e38 [0145.257] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acf30 [0145.257] IcmpSendEcho2 (in: IcmpHandle=0x7d1e38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd800a8c0, RequestData=0x23f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acf30, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acf30) returned 0x0 [0146.916] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acf30 | out: hHeap=0x710000) returned 1 [0146.916] IcmpCloseHandle (IcmpHandle=0x7d1e38) returned 1 [0146.916] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d3ba8 | out: hHeap=0x710000) returned 1 Thread: id = 855 os_tid = 0x7bc [0145.258] GetLastError () returned 0x57 [0145.258] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d3f30 [0145.258] SetLastError (dwErrCode=0x57) [0145.258] IcmpCreateFile () returned 0x7d1e70 [0145.258] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acf80 [0145.258] IcmpSendEcho2 (in: IcmpHandle=0x7d1e70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd900a8c0, RequestData=0x2653ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acf80, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acf80) returned 0x0 [0146.918] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acf80 | out: hHeap=0x710000) returned 1 [0146.918] IcmpCloseHandle (IcmpHandle=0x7d1e70) returned 1 [0146.918] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d3f30 | out: hHeap=0x710000) returned 1 Thread: id = 856 os_tid = 0x15d0 [0145.259] GetLastError () returned 0x57 [0145.259] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d42b8 [0145.260] SetLastError (dwErrCode=0x57) [0145.260] IcmpCreateFile () returned 0x7d1ea8 [0145.260] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764cf8 [0145.260] IcmpSendEcho2 (in: IcmpHandle=0x7d1ea8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xda00a8c0, RequestData=0x2667ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764cf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764cf8) returned 0x0 [0146.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764cf8 | out: hHeap=0x710000) returned 1 [0146.919] IcmpCloseHandle (IcmpHandle=0x7d1ea8) returned 1 [0146.920] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d42b8 | out: hHeap=0x710000) returned 1 Thread: id = 857 os_tid = 0xb04 [0145.268] GetLastError () returned 0x57 [0145.268] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d6d18 [0145.268] SetLastError (dwErrCode=0x57) [0145.268] IcmpCreateFile () returned 0x7d1ee0 [0145.268] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765108 [0145.269] IcmpSendEcho2 (in: IcmpHandle=0x7d1ee0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdb00a8c0, RequestData=0x267bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765108, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765108) returned 0x0 [0146.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765108 | out: hHeap=0x710000) returned 1 [0146.921] IcmpCloseHandle (IcmpHandle=0x7d1ee0) returned 1 [0146.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d6d18 | out: hHeap=0x710000) returned 1 Thread: id = 858 os_tid = 0x1354 [0145.275] GetLastError () returned 0x57 [0145.275] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d7b38 [0145.276] SetLastError (dwErrCode=0x57) [0145.276] IcmpCreateFile () returned 0x74f368 [0145.276] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764d48 [0145.276] IcmpSendEcho2 (in: IcmpHandle=0x74f368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdc00a8c0, RequestData=0x268fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764d48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764d48) returned 0x0 [0146.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764d48 | out: hHeap=0x710000) returned 1 [0146.923] IcmpCloseHandle (IcmpHandle=0x74f368) returned 1 [0146.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d7b38 | out: hHeap=0x710000) returned 1 Thread: id = 859 os_tid = 0x1318 [0145.277] GetLastError () returned 0x57 [0145.277] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d6280 [0145.277] SetLastError (dwErrCode=0x57) [0145.278] IcmpCreateFile () returned 0x74f3a0 [0145.278] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764d98 [0145.278] IcmpSendEcho2 (in: IcmpHandle=0x74f3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdd00a8c0, RequestData=0x26a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764d98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764d98) returned 0x0 [0146.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764d98 | out: hHeap=0x710000) returned 1 [0146.924] IcmpCloseHandle (IcmpHandle=0x74f3a0) returned 1 [0146.925] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d6280 | out: hHeap=0x710000) returned 1 Thread: id = 860 os_tid = 0x113c [0145.279] GetLastError () returned 0x57 [0145.279] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d6608 [0145.279] SetLastError (dwErrCode=0x57) [0145.279] IcmpCreateFile () returned 0x74ecd8 [0145.279] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764de8 [0145.279] IcmpSendEcho2 (in: IcmpHandle=0x74ecd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xde00a8c0, RequestData=0x26b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764de8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764de8) returned 0x0 [0146.926] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764de8 | out: hHeap=0x710000) returned 1 [0146.926] IcmpCloseHandle (IcmpHandle=0x74ecd8) returned 1 [0146.927] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d6608 | out: hHeap=0x710000) returned 1 Thread: id = 861 os_tid = 0x808 [0145.280] GetLastError () returned 0x57 [0145.281] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d6990 [0145.281] SetLastError (dwErrCode=0x57) [0145.281] IcmpCreateFile () returned 0x74ed10 [0145.281] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764e38 [0145.281] IcmpSendEcho2 (in: IcmpHandle=0x74ed10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdf00a8c0, RequestData=0x26cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764e38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764e38) returned 0x0 [0146.929] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764e38 | out: hHeap=0x710000) returned 1 [0146.929] IcmpCloseHandle (IcmpHandle=0x74ed10) returned 1 [0146.929] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d6990 | out: hHeap=0x710000) returned 1 Thread: id = 862 os_tid = 0x5f4 [0145.282] GetLastError () returned 0x57 [0145.282] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d70a0 [0145.282] SetLastError (dwErrCode=0x57) [0145.282] IcmpCreateFile () returned 0x74ed48 [0145.282] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764e88 [0145.282] IcmpSendEcho2 (in: IcmpHandle=0x74ed48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe000a8c0, RequestData=0x26dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764e88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764e88) returned 0x0 [0146.931] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764e88 | out: hHeap=0x710000) returned 1 [0146.931] IcmpCloseHandle (IcmpHandle=0x74ed48) returned 1 [0146.931] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d70a0 | out: hHeap=0x710000) returned 1 Thread: id = 863 os_tid = 0x121c [0145.284] GetLastError () returned 0x57 [0145.284] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d7428 [0145.284] SetLastError (dwErrCode=0x57) [0145.284] IcmpCreateFile () returned 0x74ed80 [0145.284] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x765158 [0145.284] IcmpSendEcho2 (in: IcmpHandle=0x74ed80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe100a8c0, RequestData=0x26f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x765158, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x765158) returned 0x0 [0146.932] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x765158 | out: hHeap=0x710000) returned 1 [0146.932] IcmpCloseHandle (IcmpHandle=0x74ed80) returned 1 [0146.933] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d7428 | out: hHeap=0x710000) returned 1 Thread: id = 864 os_tid = 0xb9c [0145.285] GetLastError () returned 0x57 [0145.286] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6d77b0 [0145.286] SetLastError (dwErrCode=0x57) [0145.286] IcmpCreateFile () returned 0x74edb8 [0145.286] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7651a8 [0145.286] IcmpSendEcho2 (in: IcmpHandle=0x74edb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe200a8c0, RequestData=0x2707ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7651a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7651a8) returned 0x0 [0146.934] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7651a8 | out: hHeap=0x710000) returned 1 [0146.934] IcmpCloseHandle (IcmpHandle=0x74edb8) returned 1 [0146.934] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6d77b0 | out: hHeap=0x710000) returned 1 Thread: id = 865 os_tid = 0x1014 [0145.287] GetLastError () returned 0x57 [0145.288] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eaa80 [0145.288] SetLastError (dwErrCode=0x57) [0145.288] IcmpCreateFile () returned 0x74ee28 [0145.288] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7648e8 [0145.288] IcmpSendEcho2 (in: IcmpHandle=0x74ee28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe300a8c0, RequestData=0x271bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7648e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7648e8) returned 0x0 [0146.936] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7648e8 | out: hHeap=0x710000) returned 1 [0146.936] IcmpCloseHandle (IcmpHandle=0x74ee28) returned 1 [0146.936] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eaa80 | out: hHeap=0x710000) returned 1 Thread: id = 866 os_tid = 0xcf8 [0145.289] GetLastError () returned 0x57 [0145.289] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eae08 [0145.289] SetLastError (dwErrCode=0x57) [0145.289] IcmpCreateFile () returned 0x74ee60 [0145.290] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764938 [0145.290] IcmpSendEcho2 (in: IcmpHandle=0x74ee60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe400a8c0, RequestData=0x272fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764938, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764938) returned 0x0 [0146.937] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764938 | out: hHeap=0x710000) returned 1 [0146.937] IcmpCloseHandle (IcmpHandle=0x74ee60) returned 1 [0146.938] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eae08 | out: hHeap=0x710000) returned 1 Thread: id = 867 os_tid = 0xe30 [0145.291] GetLastError () returned 0x57 [0145.291] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb190 [0145.291] SetLastError (dwErrCode=0x57) [0145.291] IcmpCreateFile () returned 0x74f0c8 [0145.291] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764988 [0145.291] IcmpSendEcho2 (in: IcmpHandle=0x74f0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe500a8c0, RequestData=0x2743ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764988, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764988) returned 0x0 [0146.939] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764988 | out: hHeap=0x710000) returned 1 [0146.939] IcmpCloseHandle (IcmpHandle=0x74f0c8) returned 1 [0146.939] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eb190 | out: hHeap=0x710000) returned 1 Thread: id = 868 os_tid = 0xe34 [0145.292] GetLastError () returned 0x57 [0145.293] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ecdd0 [0145.293] SetLastError (dwErrCode=0x57) [0145.293] IcmpCreateFile () returned 0x74f138 [0145.293] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764a78 [0145.293] IcmpSendEcho2 (in: IcmpHandle=0x74f138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe600a8c0, RequestData=0x2757ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764a78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764a78) returned 0x0 [0146.945] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764a78 | out: hHeap=0x710000) returned 1 [0146.945] IcmpCloseHandle (IcmpHandle=0x74f138) returned 1 [0146.945] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ecdd0 | out: hHeap=0x710000) returned 1 Thread: id = 869 os_tid = 0xe38 [0145.294] GetLastError () returned 0x57 [0145.294] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ee688 [0145.294] SetLastError (dwErrCode=0x57) [0145.294] IcmpCreateFile () returned 0x74f100 [0145.294] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ac8 [0145.294] IcmpSendEcho2 (in: IcmpHandle=0x74f100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe700a8c0, RequestData=0x276bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ac8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ac8) returned 0x0 [0146.946] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ac8 | out: hHeap=0x710000) returned 1 [0146.946] IcmpCloseHandle (IcmpHandle=0x74f100) returned 1 [0146.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ee688 | out: hHeap=0x710000) returned 1 Thread: id = 870 os_tid = 0xfc8 [0145.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.319] ReadFile (in: hFile=0x230, lpBuffer=0x240bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x240bf85c, lpOverlapped=0x0 | out: lpBuffer=0x240bfb34*, lpNumberOfBytesRead=0x240bf85c*=0x428, lpOverlapped=0x0) returned 1 [0145.322] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.322] ReadFile (in: hFile=0x230, lpBuffer=0x240bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x240bf85c, lpOverlapped=0x0 | out: lpBuffer=0x240bfb34*, lpNumberOfBytesRead=0x240bf85c*=0x428, lpOverlapped=0x0) returned 1 [0145.322] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0145.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0145.327] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x240bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0145.327] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x240bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x240bf828, pbKeyObject=0x0) returned 0x0 [0145.328] BCryptExportKey (in: hKey=0x78c860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x240bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x240bf500) returned 0x0 [0145.328] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0145.328] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x240bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x240bf500) returned 0x0 [0145.335] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.338] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.338] WriteFile (in: hFile=0x230, lpBuffer=0x240bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x240bf830, lpOverlapped=0x0 | out: lpBuffer=0x240bfb34*, lpNumberOfBytesWritten=0x240bf830*=0x428, lpOverlapped=0x0) returned 1 [0145.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.339] ReadFile (in: hFile=0x230, lpBuffer=0x2750000, nNumberOfBytesToRead=0x13ad, lpNumberOfBytesRead=0x240bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x240bf61c*=0x13ad, lpOverlapped=0x0) returned 1 [0145.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0xffffec53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.339] BCryptEncrypt (in: hKey=0x78c860, pbInput=0x2750000, cbInput=0x13ad, pPaddingInfo=0x0, pbIV=0x240bf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x240bf618, dwFlags=0x1 | out: hKey=0x78c860, pbIV=0x240bf848, pbOutput=0x2750000, pcbResult=0x240bf618) returned 0x0 [0145.339] WriteFile (in: hFile=0x230, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x240bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x240bf61c*=0x13b0, lpOverlapped=0x0) returned 1 [0145.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x240bf60c | out: lpNewFilePointer=0x0) returned 1 [0145.340] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.340] WriteFile (in: hFile=0x230, lpBuffer=0x240bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x240bf61c, lpOverlapped=0x0 | out: lpBuffer=0x240bf83c*, lpNumberOfBytesWritten=0x240bf61c*=0x8, lpOverlapped=0x0) returned 1 [0145.340] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x13b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.340] BCryptDestroyKey (in: hKey=0x78c860 | out: hKey=0x78c860) returned 0x0 [0145.340] CloseHandle (hObject=0x230) returned 1 [0145.341] VirtualAlloc (lpAddress=0x0, dwSize=0xdd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0145.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.format.ps1xml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.format.ps1xml"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.format.ps1xml.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.format.ps1xml.play")) returned 1 [0145.344] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 871 os_tid = 0xfcc [0145.321] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.321] ReadFile (in: hFile=0x224, lpBuffer=0x2793fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2793f85c, lpOverlapped=0x0 | out: lpBuffer=0x2793fb34*, lpNumberOfBytesRead=0x2793f85c*=0x428, lpOverlapped=0x0) returned 1 [0145.350] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0145.353] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0145.353] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x2793f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0145.353] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x2793f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x2793f828, pbKeyObject=0x0) returned 0x0 [0145.353] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2793f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2793f500) returned 0x0 [0145.353] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0145.354] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2793f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2793f500) returned 0x0 [0145.359] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.362] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.362] WriteFile (in: hFile=0x224, lpBuffer=0x2793fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2793f830, lpOverlapped=0x0 | out: lpBuffer=0x2793fb34*, lpNumberOfBytesWritten=0x2793f830*=0x428, lpOverlapped=0x0) returned 1 [0145.363] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.363] ReadFile (in: hFile=0x224, lpBuffer=0x2850000, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x2793f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x2793f61c*=0x5f8, lpOverlapped=0x0) returned 1 [0145.363] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xfffffa08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.363] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2850000, cbInput=0x5f8, pPaddingInfo=0x0, pbIV=0x2793f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x2793f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2793f848, pbOutput=0x2850000, pcbResult=0x2793f618) returned 0x0 [0145.363] WriteFile (in: hFile=0x224, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2793f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x2793f61c*=0x600, lpOverlapped=0x0) returned 1 [0145.363] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2793f60c | out: lpNewFilePointer=0x0) returned 1 [0145.363] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.365] WriteFile (in: hFile=0x224, lpBuffer=0x2793f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2793f61c, lpOverlapped=0x0 | out: lpBuffer=0x2793f83c*, lpNumberOfBytesWritten=0x2793f61c*=0x8, lpOverlapped=0x0) returned 1 [0145.365] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.365] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0145.365] CloseHandle (hObject=0x224) returned 1 [0145.366] VirtualAlloc (lpAddress=0x0, dwSize=0xcb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0145.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1.play")) returned 1 [0145.369] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 872 os_tid = 0xfd0 [0145.373] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.373] ReadFile (in: hFile=0x21c, lpBuffer=0x27a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x27a7fb34*, lpNumberOfBytesRead=0x27a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0145.508] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.508] ReadFile (in: hFile=0x21c, lpBuffer=0x27a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x27a7fb34*, lpNumberOfBytesRead=0x27a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0145.508] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0145.511] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0145.511] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x27a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0145.511] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x27a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x27a7f828, pbKeyObject=0x0) returned 0x0 [0145.511] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x27a7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x27a7f500) returned 0x0 [0145.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0145.512] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x27a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x27a7f500) returned 0x0 [0145.517] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.521] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.521] WriteFile (in: hFile=0x21c, lpBuffer=0x27a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27a7f830, lpOverlapped=0x0 | out: lpBuffer=0x27a7fb34*, lpNumberOfBytesWritten=0x27a7f830*=0x428, lpOverlapped=0x0) returned 1 [0145.522] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.522] ReadFile (in: hFile=0x21c, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x27a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x27a7f61c*=0x1e74, lpOverlapped=0x0) returned 1 [0145.525] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xffffe18c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.525] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0x1e74, pPaddingInfo=0x0, pbIV=0x27a7f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x27a7f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x27a7f848, pbOutput=0x2950000, pcbResult=0x27a7f618) returned 0x0 [0145.525] WriteFile (in: hFile=0x21c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x27a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x27a7f61c*=0x1e80, lpOverlapped=0x0) returned 1 [0145.525] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27a7f60c | out: lpNewFilePointer=0x0) returned 1 [0145.525] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.525] WriteFile (in: hFile=0x21c, lpBuffer=0x27a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x27a7f83c*, lpNumberOfBytesWritten=0x27a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0145.526] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.526] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0145.526] CloseHandle (hObject=0x21c) returned 1 [0145.526] VirtualAlloc (lpAddress=0x0, dwSize=0xd9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0145.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageProviderFunctions.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packageproviderfunctions.psm1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageProviderFunctions.psm1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packageproviderfunctions.psm1.play")) returned 1 [0145.529] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 873 os_tid = 0xe3c [0145.579] GetLastError () returned 0x57 [0145.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eea10 [0145.579] SetLastError (dwErrCode=0x57) [0145.579] IcmpCreateFile () returned 0x74f170 [0145.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764b18 [0145.579] IcmpSendEcho2 (in: IcmpHandle=0x74f170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe800a8c0, RequestData=0x277fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764b18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764b18) returned 0x0 [0146.948] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764b18 | out: hHeap=0x710000) returned 1 [0146.948] IcmpCloseHandle (IcmpHandle=0x74f170) returned 1 [0146.949] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eea10 | out: hHeap=0x710000) returned 1 Thread: id = 874 os_tid = 0xfd4 [0145.581] GetLastError () returned 0x57 [0145.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eed98 [0145.581] SetLastError (dwErrCode=0x57) [0145.581] IcmpCreateFile () returned 0x74f1a8 [0145.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764b68 [0145.581] IcmpSendEcho2 (in: IcmpHandle=0x74f1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe900a8c0, RequestData=0x27bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764b68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764b68) returned 0x0 [0146.950] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764b68 | out: hHeap=0x710000) returned 1 [0146.950] IcmpCloseHandle (IcmpHandle=0x74f1a8) returned 1 [0146.950] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eed98 | out: hHeap=0x710000) returned 1 Thread: id = 875 os_tid = 0xfd8 [0145.582] GetLastError () returned 0x57 [0145.583] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef120 [0145.583] SetLastError (dwErrCode=0x57) [0145.583] IcmpCreateFile () returned 0x74f1e0 [0145.583] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764bb8 [0145.583] IcmpSendEcho2 (in: IcmpHandle=0x74f1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xea00a8c0, RequestData=0x27cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764bb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764bb8) returned 0x0 [0146.952] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764bb8 | out: hHeap=0x710000) returned 1 [0146.952] IcmpCloseHandle (IcmpHandle=0x74f1e0) returned 1 [0146.952] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ef120 | out: hHeap=0x710000) returned 1 Thread: id = 876 os_tid = 0xfdc [0145.584] GetLastError () returned 0x57 [0145.584] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef4a8 [0145.584] SetLastError (dwErrCode=0x57) [0145.584] IcmpCreateFile () returned 0x74f218 [0145.584] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764c08 [0145.584] IcmpSendEcho2 (in: IcmpHandle=0x74f218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xeb00a8c0, RequestData=0x27e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764c08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764c08) returned 0x0 [0146.953] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764c08 | out: hHeap=0x710000) returned 1 [0146.953] IcmpCloseHandle (IcmpHandle=0x74f218) returned 1 [0146.954] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ef4a8 | out: hHeap=0x710000) returned 1 Thread: id = 877 os_tid = 0xfe0 [0145.586] GetLastError () returned 0x57 [0145.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef830 [0145.586] SetLastError (dwErrCode=0x57) [0145.586] IcmpCreateFile () returned 0x74f250 [0145.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764c58 [0145.586] IcmpSendEcho2 (in: IcmpHandle=0x74f250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xec00a8c0, RequestData=0x27f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764c58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764c58) returned 0x0 [0146.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764c58 | out: hHeap=0x710000) returned 1 [0146.955] IcmpCloseHandle (IcmpHandle=0x74f250) returned 1 [0146.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ef830 | out: hHeap=0x710000) returned 1 Thread: id = 878 os_tid = 0xfe4 [0145.587] GetLastError () returned 0x57 [0145.587] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7efbb8 [0145.588] SetLastError (dwErrCode=0x57) [0145.588] IcmpCreateFile () returned 0x728ba8 [0145.588] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764ca8 [0145.588] IcmpSendEcho2 (in: IcmpHandle=0x728ba8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xed00a8c0, RequestData=0x280bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764ca8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x764ca8) returned 0x0 [0146.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764ca8 | out: hHeap=0x710000) returned 1 [0146.957] IcmpCloseHandle (IcmpHandle=0x728ba8) returned 1 [0146.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7efbb8 | out: hHeap=0x710000) returned 1 Thread: id = 879 os_tid = 0xfe8 [0145.589] GetLastError () returned 0x57 [0145.589] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eff40 [0145.589] SetLastError (dwErrCode=0x57) [0145.589] IcmpCreateFile () returned 0x728c18 [0145.589] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df18 [0145.589] IcmpSendEcho2 (in: IcmpHandle=0x728c18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xee00a8c0, RequestData=0x281fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df18) returned 0x0 [0146.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df18 | out: hHeap=0x710000) returned 1 [0146.959] IcmpCloseHandle (IcmpHandle=0x728c18) returned 1 [0146.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eff40 | out: hHeap=0x710000) returned 1 Thread: id = 880 os_tid = 0xfec [0145.590] GetLastError () returned 0x57 [0145.591] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb518 [0145.591] SetLastError (dwErrCode=0x57) [0145.591] IcmpCreateFile () returned 0x728cc0 [0145.591] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df68 [0145.591] IcmpSendEcho2 (in: IcmpHandle=0x728cc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xef00a8c0, RequestData=0x2833ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df68) returned 0x0 [0146.960] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df68 | out: hHeap=0x710000) returned 1 [0146.960] IcmpCloseHandle (IcmpHandle=0x728cc0) returned 1 [0146.961] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eb518 | out: hHeap=0x710000) returned 1 Thread: id = 881 os_tid = 0xff0 [0145.592] GetLastError () returned 0x57 [0145.592] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb8a0 [0145.592] SetLastError (dwErrCode=0x57) [0145.592] IcmpCreateFile () returned 0x728cf8 [0145.592] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dfb8 [0145.592] IcmpSendEcho2 (in: IcmpHandle=0x728cf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf000a8c0, RequestData=0x2847ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dfb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dfb8) returned 0x0 [0146.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dfb8 | out: hHeap=0x710000) returned 1 [0146.964] IcmpCloseHandle (IcmpHandle=0x728cf8) returned 1 [0146.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eb8a0 | out: hHeap=0x710000) returned 1 Thread: id = 882 os_tid = 0xff4 [0145.594] GetLastError () returned 0x57 [0145.594] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ebfb0 [0145.594] SetLastError (dwErrCode=0x57) [0145.594] IcmpCreateFile () returned 0x728d30 [0145.594] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e198 [0145.594] IcmpSendEcho2 (in: IcmpHandle=0x728d30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf100a8c0, RequestData=0x285bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e198) returned 0x0 [0146.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e198 | out: hHeap=0x710000) returned 1 [0146.967] IcmpCloseHandle (IcmpHandle=0x728d30) returned 1 [0146.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ebfb0 | out: hHeap=0x710000) returned 1 Thread: id = 883 os_tid = 0xff8 [0145.595] GetLastError () returned 0x57 [0145.595] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ec338 [0145.595] SetLastError (dwErrCode=0x57) [0145.595] IcmpCreateFile () returned 0x728d68 [0145.596] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dda38 [0145.596] IcmpSendEcho2 (in: IcmpHandle=0x728d68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf200a8c0, RequestData=0x286fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dda38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dda38) returned 0x0 [0146.970] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dda38 | out: hHeap=0x710000) returned 1 [0146.970] IcmpCloseHandle (IcmpHandle=0x728d68) returned 1 [0146.971] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ec338 | out: hHeap=0x710000) returned 1 Thread: id = 884 os_tid = 0xffc [0145.597] GetLastError () returned 0x57 [0145.597] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ec6c0 [0145.597] SetLastError (dwErrCode=0x57) [0145.597] IcmpCreateFile () returned 0x728da0 [0145.597] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddf88 [0145.597] IcmpSendEcho2 (in: IcmpHandle=0x728da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf300a8c0, RequestData=0x2883ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddf88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddf88) returned 0x0 [0146.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddf88 | out: hHeap=0x710000) returned 1 [0146.974] IcmpCloseHandle (IcmpHandle=0x728da0) returned 1 [0146.974] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ec6c0 | out: hHeap=0x710000) returned 1 Thread: id = 885 os_tid = 0xbf4 [0145.599] GetLastError () returned 0x57 [0145.599] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eca48 [0145.599] SetLastError (dwErrCode=0x57) [0145.599] IcmpCreateFile () returned 0x78caa8 [0145.599] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddee8 [0145.599] IcmpSendEcho2 (in: IcmpHandle=0x78caa8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf400a8c0, RequestData=0x2897ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddee8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddee8) returned 0x0 [0146.976] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddee8 | out: hHeap=0x710000) returned 1 [0146.976] IcmpCloseHandle (IcmpHandle=0x78caa8) returned 1 [0146.976] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7eca48 | out: hHeap=0x710000) returned 1 Thread: id = 886 os_tid = 0x60c [0145.600] GetLastError () returned 0x57 [0145.600] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed158 [0145.601] SetLastError (dwErrCode=0x57) [0145.601] IcmpCreateFile () returned 0x78ccd8 [0145.601] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd858 [0145.601] IcmpSendEcho2 (in: IcmpHandle=0x78ccd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf500a8c0, RequestData=0x28abff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd858, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd858) returned 0x0 [0146.977] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd858 | out: hHeap=0x710000) returned 1 [0146.977] IcmpCloseHandle (IcmpHandle=0x78ccd8) returned 1 [0146.978] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ed158 | out: hHeap=0x710000) returned 1 Thread: id = 887 os_tid = 0x940 [0145.602] GetLastError () returned 0x57 [0145.602] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed4e0 [0145.602] SetLastError (dwErrCode=0x57) [0145.602] IcmpCreateFile () returned 0x78cd10 [0145.602] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd8a8 [0145.602] IcmpSendEcho2 (in: IcmpHandle=0x78cd10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf600a8c0, RequestData=0x28bfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd8a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd8a8) returned 0x0 [0146.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd8a8 | out: hHeap=0x710000) returned 1 [0146.979] IcmpCloseHandle (IcmpHandle=0x78cd10) returned 1 [0146.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ed4e0 | out: hHeap=0x710000) returned 1 Thread: id = 888 os_tid = 0x91c [0145.604] GetLastError () returned 0x57 [0145.604] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed868 [0145.604] SetLastError (dwErrCode=0x57) [0145.604] IcmpCreateFile () returned 0x78cd48 [0145.604] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd8f8 [0145.604] IcmpSendEcho2 (in: IcmpHandle=0x78cd48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf700a8c0, RequestData=0x28d3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd8f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd8f8) returned 0x0 [0146.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd8f8 | out: hHeap=0x710000) returned 1 [0146.981] IcmpCloseHandle (IcmpHandle=0x78cd48) returned 1 [0146.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ed868 | out: hHeap=0x710000) returned 1 Thread: id = 889 os_tid = 0x740 [0145.608] GetLastError () returned 0x57 [0145.608] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7edbf0 [0145.608] SetLastError (dwErrCode=0x57) [0145.608] IcmpCreateFile () returned 0x78c840 [0145.609] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dddf8 [0145.609] IcmpSendEcho2 (in: IcmpHandle=0x78c840, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf800a8c0, RequestData=0x28e7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dddf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dddf8) returned 0x0 [0146.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dddf8 | out: hHeap=0x710000) returned 1 [0146.983] IcmpCloseHandle (IcmpHandle=0x78c840) returned 1 [0146.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7edbf0 | out: hHeap=0x710000) returned 1 Thread: id = 890 os_tid = 0xae4 [0145.610] GetLastError () returned 0x57 [0145.610] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7edf78 [0145.610] SetLastError (dwErrCode=0x57) [0145.610] IcmpCreateFile () returned 0x78cb18 [0145.610] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd7b8 [0145.610] IcmpSendEcho2 (in: IcmpHandle=0x78cb18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf900a8c0, RequestData=0x28fbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd7b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd7b8) returned 0x0 [0146.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd7b8 | out: hHeap=0x710000) returned 1 [0146.985] IcmpCloseHandle (IcmpHandle=0x78cb18) returned 1 [0146.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7edf78 | out: hHeap=0x710000) returned 1 Thread: id = 891 os_tid = 0x938 [0145.612] GetLastError () returned 0x57 [0145.612] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ee300 [0145.612] SetLastError (dwErrCode=0x57) [0145.612] IcmpCreateFile () returned 0x78cb50 [0145.612] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd808 [0145.612] IcmpSendEcho2 (in: IcmpHandle=0x78cb50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfa00a8c0, RequestData=0x290fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd808, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd808) returned 0x0 [0146.986] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd808 | out: hHeap=0x710000) returned 1 [0146.986] IcmpCloseHandle (IcmpHandle=0x78cb50) returned 1 [0146.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ee300 | out: hHeap=0x710000) returned 1 Thread: id = 892 os_tid = 0x978 [0145.613] GetLastError () returned 0x57 [0145.613] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6028 [0145.617] SetLastError (dwErrCode=0x57) [0145.617] IcmpCreateFile () returned 0x78cc68 [0145.617] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddad8 [0145.617] IcmpSendEcho2 (in: IcmpHandle=0x78cc68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfb00a8c0, RequestData=0x2923ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddad8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddad8) returned 0x0 [0147.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddad8 | out: hHeap=0x710000) returned 1 [0147.002] IcmpCloseHandle (IcmpHandle=0x78cc68) returned 1 [0147.003] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6028 | out: hHeap=0x710000) returned 1 Thread: id = 893 os_tid = 0xb4c [0145.618] GetLastError () returned 0x57 [0145.618] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6738 [0145.619] SetLastError (dwErrCode=0x57) [0145.619] IcmpCreateFile () returned 0x78ca00 [0145.619] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddb78 [0145.619] IcmpSendEcho2 (in: IcmpHandle=0x78ca00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfc00a8c0, RequestData=0x2937ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddb78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddb78) returned 0x0 [0147.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddb78 | out: hHeap=0x710000) returned 1 [0147.005] IcmpCloseHandle (IcmpHandle=0x78ca00) returned 1 [0147.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6738 | out: hHeap=0x710000) returned 1 Thread: id = 894 os_tid = 0x9bc [0145.620] GetLastError () returned 0x57 [0145.620] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6ac0 [0145.620] SetLastError (dwErrCode=0x57) [0145.620] IcmpCreateFile () returned 0x78ca38 [0145.620] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddbc8 [0145.620] IcmpSendEcho2 (in: IcmpHandle=0x78ca38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfd00a8c0, RequestData=0x294bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddbc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddbc8) returned 0x0 [0147.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddbc8 | out: hHeap=0x710000) returned 1 [0147.007] IcmpCloseHandle (IcmpHandle=0x78ca38) returned 1 [0147.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6ac0 | out: hHeap=0x710000) returned 1 Thread: id = 895 os_tid = 0xb88 [0145.622] GetLastError () returned 0x57 [0145.622] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6e48 [0145.622] SetLastError (dwErrCode=0x57) [0145.622] IcmpCreateFile () returned 0x78ca70 [0145.622] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddc18 [0145.622] IcmpSendEcho2 (in: IcmpHandle=0x78ca70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfe00a8c0, RequestData=0x295fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddc18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddc18) returned 0x0 [0147.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddc18 | out: hHeap=0x710000) returned 1 [0147.009] IcmpCloseHandle (IcmpHandle=0x78ca70) returned 1 [0147.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6e48 | out: hHeap=0x710000) returned 1 Thread: id = 896 os_tid = 0xa6c [0146.747] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0146.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0146.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f000c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0146.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0146.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0024, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0146.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0146.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f003c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0146.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0146.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0054, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0146.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0146.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f006c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0146.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0146.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0084, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0146.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0146.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f009c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0146.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0146.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0146.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac [0146.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0146.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4 [0146.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0146.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0146.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0146.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0146.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0114, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0146.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0146.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f012c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0146.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0146.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0144, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0146.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0146.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f015c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0146.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0146.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0174, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0146.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0146.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f018c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0146.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0146.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0146.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0146.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0146.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0146.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0146.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0146.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0146.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0146.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0204, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0146.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0146.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f021c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0146.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0146.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0234, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0146.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0146.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f024c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0146.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0146.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0264, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0146.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0146.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f027c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0146.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0146.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0294, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0146.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0146.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0146.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0146.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0146.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0146.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0146.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0146.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0146.784] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x8c8, bWaitAll=1, dwMilliseconds=0x578) returned 0x0 [0147.186] CloseHandle (hObject=0x8c8) returned 1 [0147.187] CloseHandle (hObject=0xad8) returned 1 [0147.187] CloseHandle (hObject=0xae4) returned 1 [0147.187] CloseHandle (hObject=0xae0) returned 1 [0147.187] CloseHandle (hObject=0x8d8) returned 1 [0147.187] CloseHandle (hObject=0xa2c) returned 1 [0147.187] CloseHandle (hObject=0xad4) returned 1 [0147.187] CloseHandle (hObject=0xad0) returned 1 [0147.187] CloseHandle (hObject=0xacc) returned 1 [0147.187] CloseHandle (hObject=0xac8) returned 1 [0147.187] CloseHandle (hObject=0xac4) returned 1 [0147.187] CloseHandle (hObject=0xac0) returned 1 [0147.187] CloseHandle (hObject=0xabc) returned 1 [0147.187] CloseHandle (hObject=0xab8) returned 1 [0147.187] CloseHandle (hObject=0xab4) returned 1 [0147.188] CloseHandle (hObject=0xab0) returned 1 [0147.188] CloseHandle (hObject=0xaac) returned 1 [0147.188] CloseHandle (hObject=0xaa8) returned 1 [0147.188] CloseHandle (hObject=0xaa4) returned 1 [0147.188] CloseHandle (hObject=0xaa0) returned 1 [0147.188] CloseHandle (hObject=0xa9c) returned 1 [0147.188] CloseHandle (hObject=0x3d0) returned 1 [0147.188] CloseHandle (hObject=0xa98) returned 1 [0147.188] CloseHandle (hObject=0x3dc) returned 1 [0147.188] CloseHandle (hObject=0x914) returned 1 [0147.192] CloseHandle (hObject=0x234) returned 1 [0147.193] CloseHandle (hObject=0x238) returned 1 [0147.193] CloseHandle (hObject=0x23c) returned 1 [0147.193] CloseHandle (hObject=0x240) returned 1 [0147.193] CloseHandle (hObject=0x244) returned 1 [0147.193] CloseHandle (hObject=0x248) returned 1 [0147.193] CloseHandle (hObject=0x24c) returned 1 [0147.193] CloseHandle (hObject=0x250) returned 1 [0147.193] CloseHandle (hObject=0x254) returned 1 [0147.193] CloseHandle (hObject=0x258) returned 1 [0147.193] CloseHandle (hObject=0x25c) returned 1 [0147.193] CloseHandle (hObject=0x260) returned 1 [0147.193] CloseHandle (hObject=0x264) returned 1 [0147.193] CloseHandle (hObject=0x268) returned 1 [0147.193] CloseHandle (hObject=0x26c) returned 1 [0147.193] CloseHandle (hObject=0x270) returned 1 [0147.193] CloseHandle (hObject=0x274) returned 1 [0147.193] CloseHandle (hObject=0x278) returned 1 [0147.193] CloseHandle (hObject=0x27c) returned 1 [0147.193] CloseHandle (hObject=0x280) returned 1 [0147.193] CloseHandle (hObject=0x284) returned 1 [0147.194] CloseHandle (hObject=0x344) returned 1 [0147.194] CloseHandle (hObject=0x83c) returned 1 [0147.194] CloseHandle (hObject=0x838) returned 1 [0147.194] CloseHandle (hObject=0x834) returned 1 [0147.194] CloseHandle (hObject=0x830) returned 1 [0147.194] CloseHandle (hObject=0x82c) returned 1 [0147.194] CloseHandle (hObject=0x828) returned 1 [0147.194] CloseHandle (hObject=0x824) returned 1 [0147.194] CloseHandle (hObject=0x820) returned 1 [0147.194] CloseHandle (hObject=0x81c) returned 1 [0147.194] CloseHandle (hObject=0x818) returned 1 [0147.194] CloseHandle (hObject=0x814) returned 1 [0147.194] CloseHandle (hObject=0x748) returned 1 [0147.194] CloseHandle (hObject=0x744) returned 1 [0147.194] CloseHandle (hObject=0x740) returned 1 [0147.194] CloseHandle (hObject=0xa34) returned 1 [0147.194] CloseHandle (hObject=0x384) returned 1 [0147.194] CloseHandle (hObject=0x8d0) returned 1 [0147.194] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 897 os_tid = 0x97c [0146.787] GetLastError () returned 0x57 [0146.787] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e71d0 [0146.787] SetLastError (dwErrCode=0x57) [0146.787] IcmpCreateFile () returned 0x78cae0 [0146.788] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acfd0 [0146.788] IcmpSendEcho2 (in: IcmpHandle=0x78cae0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x100a8c0, RequestData=0xfdff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acfd0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acfd0) returned 0x0 [0147.011] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acfd0 | out: hHeap=0x710000) returned 1 [0147.012] IcmpCloseHandle (IcmpHandle=0x78cae0) returned 1 [0147.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e71d0 | out: hHeap=0x710000) returned 1 Thread: id = 898 os_tid = 0xab0 [0146.789] GetLastError () returned 0x57 [0146.789] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7558 [0146.789] SetLastError (dwErrCode=0x57) [0146.790] IcmpCreateFile () returned 0x78cb88 [0146.790] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad020 [0146.790] IcmpSendEcho2 (in: IcmpHandle=0x78cb88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x200a8c0, RequestData=0x111ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad020, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad020) returned 0x0 [0147.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad020 | out: hHeap=0x710000) returned 1 [0147.014] IcmpCloseHandle (IcmpHandle=0x78cb88) returned 1 [0147.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7558 | out: hHeap=0x710000) returned 1 Thread: id = 899 os_tid = 0xaf0 [0146.791] GetLastError () returned 0x57 [0146.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e78e0 [0146.791] SetLastError (dwErrCode=0x57) [0146.791] IcmpCreateFile () returned 0x78cbc0 [0146.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad070 [0146.792] IcmpSendEcho2 (in: IcmpHandle=0x78cbc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x300a8c0, RequestData=0x125ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad070, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad070) returned 0x0 [0147.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad070 | out: hHeap=0x710000) returned 1 [0147.016] IcmpCloseHandle (IcmpHandle=0x78cbc0) returned 1 [0147.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e78e0 | out: hHeap=0x710000) returned 1 Thread: id = 900 os_tid = 0x1100 [0146.793] GetLastError () returned 0x57 [0146.793] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7c68 [0146.793] SetLastError (dwErrCode=0x57) [0146.793] IcmpCreateFile () returned 0x78cbf8 [0146.793] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad0c0 [0146.793] IcmpSendEcho2 (in: IcmpHandle=0x78cbf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x400a8c0, RequestData=0xb04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad0c0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad0c0) returned 0x0 [0147.018] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad0c0 | out: hHeap=0x710000) returned 1 [0147.018] IcmpCloseHandle (IcmpHandle=0x78cbf8) returned 1 [0147.018] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7c68 | out: hHeap=0x710000) returned 1 Thread: id = 901 os_tid = 0x1108 [0146.808] GetLastError () returned 0x57 [0146.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7ff0 [0146.808] SetLastError (dwErrCode=0x57) [0146.808] IcmpCreateFile () returned 0x78cc30 [0146.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad110 [0146.808] IcmpSendEcho2 (in: IcmpHandle=0x78cc30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x500a8c0, RequestData=0xb14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad110, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad110) returned 0x0 [0147.020] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad110 | out: hHeap=0x710000) returned 1 [0147.020] IcmpCloseHandle (IcmpHandle=0x78cc30) returned 1 [0147.021] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7ff0 | out: hHeap=0x710000) returned 1 Thread: id = 902 os_tid = 0x10f4 [0146.810] GetLastError () returned 0x57 [0146.810] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8378 [0146.811] SetLastError (dwErrCode=0x57) [0146.811] IcmpCreateFile () returned 0x78cca0 [0146.811] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad160 [0146.811] IcmpSendEcho2 (in: IcmpHandle=0x78cca0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x600a8c0, RequestData=0xb24ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad160, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad160) returned 0x0 [0147.023] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad160 | out: hHeap=0x710000) returned 1 [0147.023] IcmpCloseHandle (IcmpHandle=0x78cca0) returned 1 [0147.024] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8378 | out: hHeap=0x710000) returned 1 Thread: id = 903 os_tid = 0x820 [0146.812] GetLastError () returned 0x57 [0146.812] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8700 [0146.812] SetLastError (dwErrCode=0x57) [0146.812] IcmpCreateFile () returned 0x78cd80 [0146.813] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad1b0 [0146.813] IcmpSendEcho2 (in: IcmpHandle=0x78cd80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x700a8c0, RequestData=0xb38ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad1b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad1b0) returned 0x0 [0147.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad1b0 | out: hHeap=0x710000) returned 1 [0147.025] IcmpCloseHandle (IcmpHandle=0x78cd80) returned 1 [0147.026] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8700 | out: hHeap=0x710000) returned 1 Thread: id = 904 os_tid = 0xac4 [0146.814] GetLastError () returned 0x57 [0146.814] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8a88 [0146.814] SetLastError (dwErrCode=0x57) [0146.814] IcmpCreateFile () returned 0x78cdb8 [0146.814] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad200 [0146.814] IcmpSendEcho2 (in: IcmpHandle=0x78cdb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x800a8c0, RequestData=0xb4cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad200, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad200) returned 0x0 [0147.027] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad200 | out: hHeap=0x710000) returned 1 [0147.027] IcmpCloseHandle (IcmpHandle=0x78cdb8) returned 1 [0147.028] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8a88 | out: hHeap=0x710000) returned 1 Thread: id = 905 os_tid = 0xa1c [0146.816] GetLastError () returned 0x57 [0146.816] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8e10 [0146.816] SetLastError (dwErrCode=0x57) [0146.816] IcmpCreateFile () returned 0x78cdf0 [0146.816] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad250 [0146.816] IcmpSendEcho2 (in: IcmpHandle=0x78cdf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x900a8c0, RequestData=0xb60ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad250, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad250) returned 0x0 [0147.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad250 | out: hHeap=0x710000) returned 1 [0147.029] IcmpCloseHandle (IcmpHandle=0x78cdf0) returned 1 [0147.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8e10 | out: hHeap=0x710000) returned 1 Thread: id = 906 os_tid = 0x13ac [0146.818] GetLastError () returned 0x57 [0146.818] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2098 [0146.818] SetLastError (dwErrCode=0x57) [0146.818] IcmpCreateFile () returned 0x78ce28 [0146.818] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad2a0 [0146.818] IcmpSendEcho2 (in: IcmpHandle=0x78ce28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa00a8c0, RequestData=0xb74ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad2a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad2a0) returned 0x0 [0147.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad2a0 | out: hHeap=0x710000) returned 1 [0147.031] IcmpCloseHandle (IcmpHandle=0x78ce28) returned 1 [0147.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2098 | out: hHeap=0x710000) returned 1 Thread: id = 907 os_tid = 0xdac [0146.820] GetLastError () returned 0x57 [0146.820] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2420 [0146.820] SetLastError (dwErrCode=0x57) [0146.820] IcmpCreateFile () returned 0x78ce60 [0146.820] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad2f0 [0146.820] IcmpSendEcho2 (in: IcmpHandle=0x78ce60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb00a8c0, RequestData=0xb88ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad2f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad2f0) returned 0x0 [0147.033] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad2f0 | out: hHeap=0x710000) returned 1 [0147.033] IcmpCloseHandle (IcmpHandle=0x78ce60) returned 1 [0147.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2420 | out: hHeap=0x710000) returned 1 Thread: id = 908 os_tid = 0x16d4 [0146.822] GetLastError () returned 0x57 [0146.822] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e27a8 [0146.822] SetLastError (dwErrCode=0x57) [0146.822] IcmpCreateFile () returned 0x78ce98 [0146.822] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad340 [0146.822] IcmpSendEcho2 (in: IcmpHandle=0x78ce98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc00a8c0, RequestData=0xb9cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad340, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad340) returned 0x0 [0147.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad340 | out: hHeap=0x710000) returned 1 [0147.035] IcmpCloseHandle (IcmpHandle=0x78ce98) returned 1 [0147.036] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e27a8 | out: hHeap=0x710000) returned 1 Thread: id = 909 os_tid = 0x828 [0146.823] GetLastError () returned 0x57 [0146.824] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2b30 [0146.824] SetLastError (dwErrCode=0x57) [0146.824] IcmpCreateFile () returned 0x78c7d0 [0146.824] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad390 [0146.824] IcmpSendEcho2 (in: IcmpHandle=0x78c7d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd00a8c0, RequestData=0xbb0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad390, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad390) returned 0x0 [0147.038] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad390 | out: hHeap=0x710000) returned 1 [0147.038] IcmpCloseHandle (IcmpHandle=0x78c7d0) returned 1 [0147.038] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2b30 | out: hHeap=0x710000) returned 1 Thread: id = 910 os_tid = 0x770 [0146.825] GetLastError () returned 0x57 [0146.825] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2eb8 [0146.826] SetLastError (dwErrCode=0x57) [0146.826] IcmpCreateFile () returned 0x78c808 [0146.826] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad3e0 [0146.826] IcmpSendEcho2 (in: IcmpHandle=0x78c808, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe00a8c0, RequestData=0xbc4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad3e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad3e0) returned 0x0 [0147.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad3e0 | out: hHeap=0x710000) returned 1 [0147.040] IcmpCloseHandle (IcmpHandle=0x78c808) returned 1 [0147.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2eb8 | out: hHeap=0x710000) returned 1 Thread: id = 911 os_tid = 0x1120 [0146.827] GetLastError () returned 0x57 [0146.827] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3240 [0146.827] SetLastError (dwErrCode=0x57) [0146.827] IcmpCreateFile () returned 0x78c878 [0146.827] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad430 [0146.828] IcmpSendEcho2 (in: IcmpHandle=0x78c878, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf00a8c0, RequestData=0xbd8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad430, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad430) returned 0x0 [0147.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad430 | out: hHeap=0x710000) returned 1 [0147.042] IcmpCloseHandle (IcmpHandle=0x78c878) returned 1 [0147.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3240 | out: hHeap=0x710000) returned 1 Thread: id = 912 os_tid = 0x1118 [0146.829] GetLastError () returned 0x57 [0146.829] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e35c8 [0146.829] SetLastError (dwErrCode=0x57) [0146.829] IcmpCreateFile () returned 0x78c8b0 [0146.829] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad480 [0146.829] IcmpSendEcho2 (in: IcmpHandle=0x78c8b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1000a8c0, RequestData=0xbecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad480, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad480) returned 0x0 [0147.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad480 | out: hHeap=0x710000) returned 1 [0147.043] IcmpCloseHandle (IcmpHandle=0x78c8b0) returned 1 [0147.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e35c8 | out: hHeap=0x710000) returned 1 Thread: id = 913 os_tid = 0xda4 [0146.831] GetLastError () returned 0x57 [0146.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3950 [0146.831] SetLastError (dwErrCode=0x57) [0146.831] IcmpCreateFile () returned 0x78c8e8 [0146.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad4d0 [0146.831] IcmpSendEcho2 (in: IcmpHandle=0x78c8e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1100a8c0, RequestData=0xc00ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad4d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad4d0) returned 0x0 [0147.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad4d0 | out: hHeap=0x710000) returned 1 [0147.046] IcmpCloseHandle (IcmpHandle=0x78c8e8) returned 1 [0147.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3950 | out: hHeap=0x710000) returned 1 Thread: id = 914 os_tid = 0x10f0 [0146.833] GetLastError () returned 0x57 [0146.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3cd8 [0146.833] SetLastError (dwErrCode=0x57) [0146.833] IcmpCreateFile () returned 0x78c920 [0146.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad520 [0146.833] IcmpSendEcho2 (in: IcmpHandle=0x78c920, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1200a8c0, RequestData=0xc14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad520, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad520) returned 0x0 [0147.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad520 | out: hHeap=0x710000) returned 1 [0147.048] IcmpCloseHandle (IcmpHandle=0x78c920) returned 1 [0147.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3cd8 | out: hHeap=0x710000) returned 1 Thread: id = 915 os_tid = 0x111c [0146.834] GetLastError () returned 0x57 [0146.835] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4060 [0146.835] SetLastError (dwErrCode=0x57) [0146.835] IcmpCreateFile () returned 0x78c958 [0146.835] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad570 [0146.835] IcmpSendEcho2 (in: IcmpHandle=0x78c958, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1300a8c0, RequestData=0xc28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad570, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad570) returned 0x0 [0147.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad570 | out: hHeap=0x710000) returned 1 [0147.050] IcmpCloseHandle (IcmpHandle=0x78c958) returned 1 [0147.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4060 | out: hHeap=0x710000) returned 1 Thread: id = 916 os_tid = 0x1404 [0146.836] GetLastError () returned 0x57 [0146.836] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e43e8 [0146.837] SetLastError (dwErrCode=0x57) [0146.837] IcmpCreateFile () returned 0x78c990 [0146.837] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acbc0 [0146.837] IcmpSendEcho2 (in: IcmpHandle=0x78c990, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1400a8c0, RequestData=0xc3cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acbc0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acbc0) returned 0x0 [0147.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acbc0 | out: hHeap=0x710000) returned 1 [0147.053] IcmpCloseHandle (IcmpHandle=0x78c990) returned 1 [0147.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e43e8 | out: hHeap=0x710000) returned 1 Thread: id = 917 os_tid = 0x1408 [0146.838] GetLastError () returned 0x57 [0146.838] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4770 [0146.838] SetLastError (dwErrCode=0x57) [0146.838] IcmpCreateFile () returned 0x78c9c8 [0146.838] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acc10 [0146.838] IcmpSendEcho2 (in: IcmpHandle=0x78c9c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1500a8c0, RequestData=0xc50ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acc10, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acc10) returned 0x0 [0147.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acc10 | out: hHeap=0x710000) returned 1 [0147.056] IcmpCloseHandle (IcmpHandle=0x78c9c8) returned 1 [0147.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4770 | out: hHeap=0x710000) returned 1 Thread: id = 918 os_tid = 0x140c [0146.840] GetLastError () returned 0x57 [0146.840] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4af8 [0146.840] SetLastError (dwErrCode=0x57) [0146.840] IcmpCreateFile () returned 0x78cf40 [0146.840] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acc60 [0146.840] IcmpSendEcho2 (in: IcmpHandle=0x78cf40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1600a8c0, RequestData=0xc64ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acc60, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acc60) returned 0x0 [0147.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acc60 | out: hHeap=0x710000) returned 1 [0147.059] IcmpCloseHandle (IcmpHandle=0x78cf40) returned 1 [0147.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4af8 | out: hHeap=0x710000) returned 1 Thread: id = 919 os_tid = 0x1410 [0146.842] GetLastError () returned 0x57 [0146.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4e80 [0146.842] SetLastError (dwErrCode=0x57) [0146.842] IcmpCreateFile () returned 0x78cf78 [0146.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7accb0 [0146.842] IcmpSendEcho2 (in: IcmpHandle=0x78cf78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1700a8c0, RequestData=0xc78ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7accb0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7accb0) returned 0x0 [0147.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7accb0 | out: hHeap=0x710000) returned 1 [0147.061] IcmpCloseHandle (IcmpHandle=0x78cf78) returned 1 [0147.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4e80 | out: hHeap=0x710000) returned 1 Thread: id = 920 os_tid = 0x1414 [0146.843] GetLastError () returned 0x57 [0146.844] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5208 [0146.844] SetLastError (dwErrCode=0x57) [0146.844] IcmpCreateFile () returned 0x78cfb0 [0146.844] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acd00 [0146.844] IcmpSendEcho2 (in: IcmpHandle=0x78cfb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1800a8c0, RequestData=0xc8cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acd00, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acd00) returned 0x0 [0147.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acd00 | out: hHeap=0x710000) returned 1 [0147.066] IcmpCloseHandle (IcmpHandle=0x78cfb0) returned 1 [0147.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5208 | out: hHeap=0x710000) returned 1 Thread: id = 921 os_tid = 0x1418 [0146.845] GetLastError () returned 0x57 [0146.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5590 [0146.846] SetLastError (dwErrCode=0x57) [0146.846] IcmpCreateFile () returned 0x78cfe8 [0146.846] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acd50 [0146.846] IcmpSendEcho2 (in: IcmpHandle=0x78cfe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1900a8c0, RequestData=0xca0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acd50, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acd50) returned 0x0 [0147.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acd50 | out: hHeap=0x710000) returned 1 [0147.071] IcmpCloseHandle (IcmpHandle=0x78cfe8) returned 1 [0147.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5590 | out: hHeap=0x710000) returned 1 Thread: id = 922 os_tid = 0x141c [0146.847] GetLastError () returned 0x57 [0146.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5918 [0146.847] SetLastError (dwErrCode=0x57) [0146.847] IcmpCreateFile () returned 0x78d020 [0146.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acda0 [0146.847] IcmpSendEcho2 (in: IcmpHandle=0x78d020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1a00a8c0, RequestData=0xcb4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acda0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acda0) returned 0x0 [0147.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acda0 | out: hHeap=0x710000) returned 1 [0147.074] IcmpCloseHandle (IcmpHandle=0x78d020) returned 1 [0147.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5918 | out: hHeap=0x710000) returned 1 Thread: id = 923 os_tid = 0x1420 [0146.851] GetLastError () returned 0x57 [0146.852] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5ca0 [0146.852] SetLastError (dwErrCode=0x57) [0146.852] IcmpCreateFile () returned 0x78d058 [0146.852] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7acdf0 [0146.852] IcmpSendEcho2 (in: IcmpHandle=0x78d058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b00a8c0, RequestData=0xcc8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7acdf0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7acdf0) returned 0x0 [0147.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acdf0 | out: hHeap=0x710000) returned 1 [0147.076] IcmpCloseHandle (IcmpHandle=0x78d058) returned 1 [0147.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5ca0 | out: hHeap=0x710000) returned 1 Thread: id = 924 os_tid = 0x1424 [0146.854] GetLastError () returned 0x57 [0146.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e63b0 [0146.855] SetLastError (dwErrCode=0x57) [0146.855] IcmpCreateFile () returned 0x78ced0 [0146.855] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad7f0 [0146.855] IcmpSendEcho2 (in: IcmpHandle=0x78ced0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1c00a8c0, RequestData=0xcdcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad7f0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad7f0) returned 0x0 [0147.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad7f0 | out: hHeap=0x710000) returned 1 [0147.078] IcmpCloseHandle (IcmpHandle=0x78ced0) returned 1 [0147.079] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e63b0 | out: hHeap=0x710000) returned 1 Thread: id = 925 os_tid = 0x1428 [0146.857] GetLastError () returned 0x57 [0146.857] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed838 [0146.857] SetLastError (dwErrCode=0x57) [0146.857] IcmpCreateFile () returned 0x78cf08 [0146.857] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad840 [0146.857] IcmpSendEcho2 (in: IcmpHandle=0x78cf08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1d00a8c0, RequestData=0xcf0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad840, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad840) returned 0x0 [0147.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad840 | out: hHeap=0x710000) returned 1 [0147.081] IcmpCloseHandle (IcmpHandle=0x78cf08) returned 1 [0147.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ed838 | out: hHeap=0x710000) returned 1 Thread: id = 926 os_tid = 0x142c [0146.859] GetLastError () returned 0x57 [0146.859] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edbc0 [0146.859] SetLastError (dwErrCode=0x57) [0146.859] IcmpCreateFile () returned 0x78c300 [0146.859] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad890 [0146.859] IcmpSendEcho2 (in: IcmpHandle=0x78c300, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1e00a8c0, RequestData=0xd04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad890, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad890) returned 0x0 [0147.085] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad890 | out: hHeap=0x710000) returned 1 [0147.085] IcmpCloseHandle (IcmpHandle=0x78c300) returned 1 [0147.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6edbc0 | out: hHeap=0x710000) returned 1 Thread: id = 927 os_tid = 0x1430 [0146.861] GetLastError () returned 0x57 [0146.861] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edf48 [0146.861] SetLastError (dwErrCode=0x57) [0146.861] IcmpCreateFile () returned 0x78c338 [0146.861] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad8e0 [0146.861] IcmpSendEcho2 (in: IcmpHandle=0x78c338, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1f00a8c0, RequestData=0xd18ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad8e0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad8e0) returned 0x0 [0147.088] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad8e0 | out: hHeap=0x710000) returned 1 [0147.088] IcmpCloseHandle (IcmpHandle=0x78c338) returned 1 [0147.089] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6edf48 | out: hHeap=0x710000) returned 1 Thread: id = 928 os_tid = 0x1434 [0146.863] GetLastError () returned 0x57 [0146.863] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee2d0 [0146.863] SetLastError (dwErrCode=0x57) [0146.863] IcmpCreateFile () returned 0x78c370 [0146.863] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad930 [0146.863] IcmpSendEcho2 (in: IcmpHandle=0x78c370, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2000a8c0, RequestData=0xd2cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad930, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad930) returned 0x0 [0147.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad930 | out: hHeap=0x710000) returned 1 [0147.091] IcmpCloseHandle (IcmpHandle=0x78c370) returned 1 [0147.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee2d0 | out: hHeap=0x710000) returned 1 Thread: id = 929 os_tid = 0x1438 [0146.865] GetLastError () returned 0x57 [0146.865] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee658 [0146.865] SetLastError (dwErrCode=0x57) [0146.865] IcmpCreateFile () returned 0x78c3a8 [0146.865] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad980 [0146.865] IcmpSendEcho2 (in: IcmpHandle=0x78c3a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2100a8c0, RequestData=0xd40ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad980, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad980) returned 0x0 [0147.093] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad980 | out: hHeap=0x710000) returned 1 [0147.093] IcmpCloseHandle (IcmpHandle=0x78c3a8) returned 1 [0147.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee658 | out: hHeap=0x710000) returned 1 Thread: id = 930 os_tid = 0x143c [0146.866] GetLastError () returned 0x57 [0146.866] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee9e0 [0146.866] SetLastError (dwErrCode=0x57) [0146.866] IcmpCreateFile () returned 0x78c3e0 [0146.866] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad9d0 [0146.866] IcmpSendEcho2 (in: IcmpHandle=0x78c3e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2200a8c0, RequestData=0xd54ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad9d0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad9d0) returned 0x0 [0147.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad9d0 | out: hHeap=0x710000) returned 1 [0147.096] IcmpCloseHandle (IcmpHandle=0x78c3e0) returned 1 [0147.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee9e0 | out: hHeap=0x710000) returned 1 Thread: id = 931 os_tid = 0x1440 [0146.867] GetLastError () returned 0x57 [0146.867] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eed68 [0146.867] SetLastError (dwErrCode=0x57) [0146.867] IcmpCreateFile () returned 0x78c418 [0146.867] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ada20 [0146.867] IcmpSendEcho2 (in: IcmpHandle=0x78c418, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2300a8c0, RequestData=0xd68ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ada20, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ada20) returned 0x0 [0147.099] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ada20 | out: hHeap=0x710000) returned 1 [0147.099] IcmpCloseHandle (IcmpHandle=0x78c418) returned 1 [0147.100] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eed68 | out: hHeap=0x710000) returned 1 Thread: id = 932 os_tid = 0x1444 [0146.868] GetLastError () returned 0x57 [0146.869] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef0f0 [0146.869] SetLastError (dwErrCode=0x57) [0146.869] IcmpCreateFile () returned 0x78c450 [0146.869] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ada70 [0146.869] IcmpSendEcho2 (in: IcmpHandle=0x78c450, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2400a8c0, RequestData=0xd7cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ada70, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ada70) returned 0x0 [0147.102] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ada70 | out: hHeap=0x710000) returned 1 [0147.102] IcmpCloseHandle (IcmpHandle=0x78c450) returned 1 [0147.103] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef0f0 | out: hHeap=0x710000) returned 1 Thread: id = 933 os_tid = 0x1448 [0146.870] GetLastError () returned 0x57 [0146.870] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef478 [0146.870] SetLastError (dwErrCode=0x57) [0146.870] IcmpCreateFile () returned 0x78c488 [0146.870] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7adac0 [0146.870] IcmpSendEcho2 (in: IcmpHandle=0x78c488, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2500a8c0, RequestData=0xd90ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7adac0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7adac0) returned 0x0 [0147.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7adac0 | out: hHeap=0x710000) returned 1 [0147.105] IcmpCloseHandle (IcmpHandle=0x78c488) returned 1 [0147.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef478 | out: hHeap=0x710000) returned 1 Thread: id = 934 os_tid = 0x144c [0146.871] GetLastError () returned 0x57 [0146.871] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef800 [0146.871] SetLastError (dwErrCode=0x57) [0146.871] IcmpCreateFile () returned 0x78c4c0 [0146.871] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7adb10 [0146.871] IcmpSendEcho2 (in: IcmpHandle=0x78c4c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2600a8c0, RequestData=0xda4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7adb10, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7adb10) returned 0x0 [0147.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7adb10 | out: hHeap=0x710000) returned 1 [0147.108] IcmpCloseHandle (IcmpHandle=0x78c4c0) returned 1 [0147.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef800 | out: hHeap=0x710000) returned 1 Thread: id = 935 os_tid = 0x1450 [0146.872] GetLastError () returned 0x57 [0146.872] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6efb88 [0146.872] SetLastError (dwErrCode=0x57) [0146.872] IcmpCreateFile () returned 0x78c4f8 [0146.872] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad5c0 [0146.873] IcmpSendEcho2 (in: IcmpHandle=0x78c4f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2700a8c0, RequestData=0xdb8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad5c0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad5c0) returned 0x0 [0147.110] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad5c0 | out: hHeap=0x710000) returned 1 [0147.110] IcmpCloseHandle (IcmpHandle=0x78c4f8) returned 1 [0147.110] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6efb88 | out: hHeap=0x710000) returned 1 Thread: id = 936 os_tid = 0x1454 [0146.874] GetLastError () returned 0x57 [0146.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eff10 [0146.875] SetLastError (dwErrCode=0x57) [0146.875] IcmpCreateFile () returned 0x78c530 [0146.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad610 [0146.875] IcmpSendEcho2 (in: IcmpHandle=0x78c530, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2800a8c0, RequestData=0xdccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad610, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad610) returned 0x0 [0147.118] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad610 | out: hHeap=0x710000) returned 1 [0147.118] IcmpCloseHandle (IcmpHandle=0x78c530) returned 1 [0147.119] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eff10 | out: hHeap=0x710000) returned 1 Thread: id = 937 os_tid = 0x1458 [0146.876] GetLastError () returned 0x57 [0146.876] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9198 [0146.876] SetLastError (dwErrCode=0x57) [0146.876] IcmpCreateFile () returned 0x78c568 [0146.876] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad660 [0146.876] IcmpSendEcho2 (in: IcmpHandle=0x78c568, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2900a8c0, RequestData=0xde0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad660, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad660) returned 0x0 [0147.122] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad660 | out: hHeap=0x710000) returned 1 [0147.122] IcmpCloseHandle (IcmpHandle=0x78c568) returned 1 [0147.122] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9198 | out: hHeap=0x710000) returned 1 Thread: id = 938 os_tid = 0x145c [0146.877] GetLastError () returned 0x57 [0146.877] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9520 [0146.877] SetLastError (dwErrCode=0x57) [0146.877] IcmpCreateFile () returned 0x78c5a0 [0146.877] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad6b0 [0146.877] IcmpSendEcho2 (in: IcmpHandle=0x78c5a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2a00a8c0, RequestData=0xdf4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad6b0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad6b0) returned 0x0 [0147.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad6b0 | out: hHeap=0x710000) returned 1 [0147.124] IcmpCloseHandle (IcmpHandle=0x78c5a0) returned 1 [0147.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9520 | out: hHeap=0x710000) returned 1 Thread: id = 939 os_tid = 0x1460 [0146.878] GetLastError () returned 0x57 [0146.878] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e98a8 [0146.879] SetLastError (dwErrCode=0x57) [0146.879] IcmpCreateFile () returned 0x78c5d8 [0146.879] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad700 [0146.879] IcmpSendEcho2 (in: IcmpHandle=0x78c5d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2b00a8c0, RequestData=0xe08ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad700, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad700) returned 0x0 [0147.126] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad700 | out: hHeap=0x710000) returned 1 [0147.126] IcmpCloseHandle (IcmpHandle=0x78c5d8) returned 1 [0147.126] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e98a8 | out: hHeap=0x710000) returned 1 Thread: id = 940 os_tid = 0x1464 [0146.880] GetLastError () returned 0x57 [0146.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9c30 [0146.880] SetLastError (dwErrCode=0x57) [0146.880] IcmpCreateFile () returned 0x78c610 [0146.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad750 [0146.880] IcmpSendEcho2 (in: IcmpHandle=0x78c610, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2c00a8c0, RequestData=0xe1cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad750, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad750) returned 0x0 [0147.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad750 | out: hHeap=0x710000) returned 1 [0147.128] IcmpCloseHandle (IcmpHandle=0x78c610) returned 1 [0147.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9c30 | out: hHeap=0x710000) returned 1 Thread: id = 941 os_tid = 0x1468 [0146.881] GetLastError () returned 0x57 [0146.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9fb8 [0146.882] SetLastError (dwErrCode=0x57) [0146.882] IcmpCreateFile () returned 0x78c648 [0146.882] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ad7a0 [0146.882] IcmpSendEcho2 (in: IcmpHandle=0x78c648, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2d00a8c0, RequestData=0xe30ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ad7a0, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ad7a0) returned 0x0 [0147.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ad7a0 | out: hHeap=0x710000) returned 1 [0147.130] IcmpCloseHandle (IcmpHandle=0x78c648) returned 1 [0147.131] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9fb8 | out: hHeap=0x710000) returned 1 Thread: id = 942 os_tid = 0x146c [0146.883] GetLastError () returned 0x57 [0146.883] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea340 [0146.883] SetLastError (dwErrCode=0x57) [0146.883] IcmpCreateFile () returned 0x78c680 [0146.883] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddc68 [0146.883] IcmpSendEcho2 (in: IcmpHandle=0x78c680, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2e00a8c0, RequestData=0xe44ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddc68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddc68) returned 0x0 [0147.132] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddc68 | out: hHeap=0x710000) returned 1 [0147.132] IcmpCloseHandle (IcmpHandle=0x78c680) returned 1 [0147.133] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea340 | out: hHeap=0x710000) returned 1 Thread: id = 943 os_tid = 0x1470 [0146.884] GetLastError () returned 0x57 [0146.884] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea6c8 [0146.885] SetLastError (dwErrCode=0x57) [0146.885] IcmpCreateFile () returned 0x78c6b8 [0146.885] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddcb8 [0146.885] IcmpSendEcho2 (in: IcmpHandle=0x78c6b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2f00a8c0, RequestData=0xe58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddcb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddcb8) returned 0x0 [0147.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddcb8 | out: hHeap=0x710000) returned 1 [0147.134] IcmpCloseHandle (IcmpHandle=0x78c6b8) returned 1 [0147.135] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea6c8 | out: hHeap=0x710000) returned 1 Thread: id = 944 os_tid = 0x1474 [0146.886] GetLastError () returned 0x57 [0146.886] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eaa50 [0146.886] SetLastError (dwErrCode=0x57) [0146.886] IcmpCreateFile () returned 0x78c6f0 [0146.886] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddd08 [0146.886] IcmpSendEcho2 (in: IcmpHandle=0x78c6f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3000a8c0, RequestData=0xe6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddd08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddd08) returned 0x0 [0147.136] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddd08 | out: hHeap=0x710000) returned 1 [0147.136] IcmpCloseHandle (IcmpHandle=0x78c6f0) returned 1 [0147.137] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eaa50 | out: hHeap=0x710000) returned 1 Thread: id = 945 os_tid = 0x1478 [0146.888] GetLastError () returned 0x57 [0146.888] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eadd8 [0146.888] SetLastError (dwErrCode=0x57) [0146.888] IcmpCreateFile () returned 0x78c728 [0146.888] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddd58 [0146.888] IcmpSendEcho2 (in: IcmpHandle=0x78c728, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3100a8c0, RequestData=0xe80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddd58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddd58) returned 0x0 [0147.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddd58 | out: hHeap=0x710000) returned 1 [0147.138] IcmpCloseHandle (IcmpHandle=0x78c728) returned 1 [0147.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eadd8 | out: hHeap=0x710000) returned 1 Thread: id = 946 os_tid = 0x147c [0146.889] GetLastError () returned 0x57 [0146.889] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb160 [0146.889] SetLastError (dwErrCode=0x57) [0146.889] IcmpCreateFile () returned 0x78c760 [0146.890] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddda8 [0146.890] IcmpSendEcho2 (in: IcmpHandle=0x78c760, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3200a8c0, RequestData=0xe94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddda8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddda8) returned 0x0 [0147.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddda8 | out: hHeap=0x710000) returned 1 [0147.140] IcmpCloseHandle (IcmpHandle=0x78c760) returned 1 [0147.141] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb160 | out: hHeap=0x710000) returned 1 Thread: id = 947 os_tid = 0x1480 [0146.891] GetLastError () returned 0x57 [0146.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb4e8 [0146.891] SetLastError (dwErrCode=0x57) [0146.891] IcmpCreateFile () returned 0x78c798 [0146.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dde48 [0146.891] IcmpSendEcho2 (in: IcmpHandle=0x78c798, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3300a8c0, RequestData=0xea8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dde48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dde48) returned 0x0 [0147.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dde48 | out: hHeap=0x710000) returned 1 [0147.143] IcmpCloseHandle (IcmpHandle=0x78c798) returned 1 [0147.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb4e8 | out: hHeap=0x710000) returned 1 Thread: id = 948 os_tid = 0x1484 [0146.892] GetLastError () returned 0x57 [0146.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb870 [0146.892] SetLastError (dwErrCode=0x57) [0146.892] IcmpCreateFile () returned 0x78c0d0 [0146.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dde98 [0146.892] IcmpSendEcho2 (in: IcmpHandle=0x78c0d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3400a8c0, RequestData=0xebcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dde98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dde98) returned 0x0 [0147.145] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dde98 | out: hHeap=0x710000) returned 1 [0147.145] IcmpCloseHandle (IcmpHandle=0x78c0d0) returned 1 [0147.146] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb870 | out: hHeap=0x710000) returned 1 Thread: id = 949 os_tid = 0x1488 [0146.893] GetLastError () returned 0x57 [0146.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ebbf8 [0146.893] SetLastError (dwErrCode=0x57) [0146.893] IcmpCreateFile () returned 0x78c108 [0146.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddf38 [0146.893] IcmpSendEcho2 (in: IcmpHandle=0x78c108, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3500a8c0, RequestData=0xed0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddf38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddf38) returned 0x0 [0147.148] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddf38 | out: hHeap=0x710000) returned 1 [0147.148] IcmpCloseHandle (IcmpHandle=0x78c108) returned 1 [0147.148] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ebbf8 | out: hHeap=0x710000) returned 1 Thread: id = 950 os_tid = 0x148c [0146.894] GetLastError () returned 0x57 [0146.894] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ebf80 [0146.895] SetLastError (dwErrCode=0x57) [0146.895] IcmpCreateFile () returned 0x78c140 [0146.895] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddfd8 [0146.895] IcmpSendEcho2 (in: IcmpHandle=0x78c140, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3600a8c0, RequestData=0xee4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddfd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddfd8) returned 0x0 [0147.150] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddfd8 | out: hHeap=0x710000) returned 1 [0147.150] IcmpCloseHandle (IcmpHandle=0x78c140) returned 1 [0147.150] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ebf80 | out: hHeap=0x710000) returned 1 Thread: id = 951 os_tid = 0x1490 [0146.896] GetLastError () returned 0x57 [0146.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ec308 [0146.896] SetLastError (dwErrCode=0x57) [0146.896] IcmpCreateFile () returned 0x78c178 [0146.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7de028 [0146.896] IcmpSendEcho2 (in: IcmpHandle=0x78c178, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3700a8c0, RequestData=0xef8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7de028, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7de028) returned 0x0 [0147.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7de028 | out: hHeap=0x710000) returned 1 [0147.152] IcmpCloseHandle (IcmpHandle=0x78c178) returned 1 [0147.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ec308 | out: hHeap=0x710000) returned 1 Thread: id = 952 os_tid = 0x1494 [0146.897] GetLastError () returned 0x57 [0146.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ec690 [0146.897] SetLastError (dwErrCode=0x57) [0146.897] IcmpCreateFile () returned 0x78c1b0 [0146.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7de078 [0146.897] IcmpSendEcho2 (in: IcmpHandle=0x78c1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3800a8c0, RequestData=0xf0cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7de078, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7de078) returned 0x0 [0147.154] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7de078 | out: hHeap=0x710000) returned 1 [0147.154] IcmpCloseHandle (IcmpHandle=0x78c1b0) returned 1 [0147.155] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ec690 | out: hHeap=0x710000) returned 1 Thread: id = 953 os_tid = 0x1498 [0146.898] GetLastError () returned 0x57 [0146.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eca18 [0146.899] SetLastError (dwErrCode=0x57) [0146.899] IcmpCreateFile () returned 0x78c1e8 [0146.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7de0c8 [0146.899] IcmpSendEcho2 (in: IcmpHandle=0x78c1e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3900a8c0, RequestData=0xf20ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7de0c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7de0c8) returned 0x0 [0147.157] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7de0c8 | out: hHeap=0x710000) returned 1 [0147.157] IcmpCloseHandle (IcmpHandle=0x78c1e8) returned 1 [0147.158] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eca18 | out: hHeap=0x710000) returned 1 Thread: id = 954 os_tid = 0x149c [0146.900] GetLastError () returned 0x57 [0146.900] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ecda0 [0146.900] SetLastError (dwErrCode=0x57) [0146.900] IcmpCreateFile () returned 0x78c220 [0146.900] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7de118 [0146.900] IcmpSendEcho2 (in: IcmpHandle=0x78c220, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3a00a8c0, RequestData=0xf34ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7de118, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7de118) returned 0x0 [0147.160] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7de118 | out: hHeap=0x710000) returned 1 [0147.160] IcmpCloseHandle (IcmpHandle=0x78c220) returned 1 [0147.160] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ecda0 | out: hHeap=0x710000) returned 1 Thread: id = 955 os_tid = 0x14a0 [0146.901] GetLastError () returned 0x57 [0146.901] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed128 [0146.901] SetLastError (dwErrCode=0x57) [0146.901] IcmpCreateFile () returned 0x78c258 [0146.901] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7de168 [0146.901] IcmpSendEcho2 (in: IcmpHandle=0x78c258, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3b00a8c0, RequestData=0xf48ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7de168, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7de168) returned 0x0 [0147.163] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7de168 | out: hHeap=0x710000) returned 1 [0147.163] IcmpCloseHandle (IcmpHandle=0x78c258) returned 1 [0147.163] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ed128 | out: hHeap=0x710000) returned 1 Thread: id = 956 os_tid = 0x14a4 [0146.902] GetLastError () returned 0x57 [0146.902] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed4b0 [0146.902] SetLastError (dwErrCode=0x57) [0146.902] IcmpCreateFile () returned 0x78c290 [0146.902] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd948 [0146.902] IcmpSendEcho2 (in: IcmpHandle=0x78c290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3c00a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd948, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd948) returned 0x0 [0147.167] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd948 | out: hHeap=0x710000) returned 1 [0147.169] IcmpCloseHandle (IcmpHandle=0x78c290) returned 1 [0147.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ed4b0 | out: hHeap=0x710000) returned 1 Thread: id = 957 os_tid = 0x14a8 [0146.903] GetLastError () returned 0x57 [0146.904] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1440 [0146.904] SetLastError (dwErrCode=0x57) [0146.904] IcmpCreateFile () returned 0x78c2c8 [0146.904] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd998 [0146.904] IcmpSendEcho2 (in: IcmpHandle=0x78c2c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3d00a8c0, RequestData=0xf70ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd998, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd998) returned 0x0 [0147.172] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd998 | out: hHeap=0x710000) returned 1 [0147.172] IcmpCloseHandle (IcmpHandle=0x78c2c8) returned 1 [0147.173] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f1440 | out: hHeap=0x710000) returned 1 Thread: id = 958 os_tid = 0x14ac [0146.905] GetLastError () returned 0x57 [0146.905] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f17c8 [0146.905] SetLastError (dwErrCode=0x57) [0146.905] IcmpCreateFile () returned 0x7d1f18 [0146.905] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dd9e8 [0146.905] IcmpSendEcho2 (in: IcmpHandle=0x7d1f18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3e00a8c0, RequestData=0xf84ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dd9e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dd9e8) returned 0x0 [0147.175] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dd9e8 | out: hHeap=0x710000) returned 1 [0147.175] IcmpCloseHandle (IcmpHandle=0x7d1f18) returned 1 [0147.175] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f17c8 | out: hHeap=0x710000) returned 1 Thread: id = 959 os_tid = 0x14b0 [0146.907] GetLastError () returned 0x57 [0146.907] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1b50 [0146.907] SetLastError (dwErrCode=0x57) [0146.907] IcmpCreateFile () returned 0x7d11c0 [0146.907] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7dda88 [0146.907] IcmpSendEcho2 (in: IcmpHandle=0x7d11c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3f00a8c0, RequestData=0xf98ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7dda88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7dda88) returned 0x0 [0147.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7dda88 | out: hHeap=0x710000) returned 1 [0147.177] IcmpCloseHandle (IcmpHandle=0x7d11c0) returned 1 [0147.178] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f1b50 | out: hHeap=0x710000) returned 1 Thread: id = 960 os_tid = 0x14b4 [0146.908] GetLastError () returned 0x57 [0146.908] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0298 [0146.908] SetLastError (dwErrCode=0x57) [0146.908] IcmpCreateFile () returned 0x7d11f8 [0146.908] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7ddb28 [0146.909] IcmpSendEcho2 (in: IcmpHandle=0x7d11f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4000a8c0, RequestData=0xfd0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7ddb28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7ddb28) returned 0x0 [0147.181] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ddb28 | out: hHeap=0x710000) returned 1 [0147.181] IcmpCloseHandle (IcmpHandle=0x7d11f8) returned 1 [0147.184] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f0298 | out: hHeap=0x710000) returned 1 Thread: id = 961 os_tid = 0x14b8 [0147.204] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0147.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0147.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f030c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0147.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0147.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0324, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0147.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0147.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f033c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0147.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0147.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0354, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0147.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0147.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f036c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0147.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0147.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0384, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0147.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0147.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f039c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0147.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0147.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0147.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0147.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0147.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0147.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0147.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0147.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0147.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0147.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0414, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0147.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0147.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f042c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0147.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0147.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0444, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0147.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0147.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f045c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0147.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0147.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0474, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0147.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0147.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f048c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0147.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0147.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0147.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0147.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0147.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0147.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0147.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0147.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0147.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0147.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0147.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0147.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f051c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4 [0147.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0147.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0534, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac [0147.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0147.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f054c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0147.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0147.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0564, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0147.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0147.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f057c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0147.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0147.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0594, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0147.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0147.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0147.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0147.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0147.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0147.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0147.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0147.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0147.241] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x8d0, bWaitAll=1, dwMilliseconds=0x578) returned 0x0 [0147.706] CloseHandle (hObject=0x8d0) returned 1 [0147.706] CloseHandle (hObject=0x384) returned 1 [0147.706] CloseHandle (hObject=0xa34) returned 1 [0147.706] CloseHandle (hObject=0x740) returned 1 [0147.706] CloseHandle (hObject=0x744) returned 1 [0147.706] CloseHandle (hObject=0x748) returned 1 [0147.706] CloseHandle (hObject=0x814) returned 1 [0147.706] CloseHandle (hObject=0x818) returned 1 [0147.706] CloseHandle (hObject=0x81c) returned 1 [0147.706] CloseHandle (hObject=0x820) returned 1 [0147.706] CloseHandle (hObject=0x824) returned 1 [0147.706] CloseHandle (hObject=0x828) returned 1 [0147.707] CloseHandle (hObject=0x82c) returned 1 [0147.707] CloseHandle (hObject=0x830) returned 1 [0147.707] CloseHandle (hObject=0x834) returned 1 [0147.707] CloseHandle (hObject=0x838) returned 1 [0147.707] CloseHandle (hObject=0x83c) returned 1 [0147.707] CloseHandle (hObject=0x344) returned 1 [0147.707] CloseHandle (hObject=0x284) returned 1 [0147.707] CloseHandle (hObject=0x280) returned 1 [0147.707] CloseHandle (hObject=0x27c) returned 1 [0147.707] CloseHandle (hObject=0x278) returned 1 [0147.707] CloseHandle (hObject=0x274) returned 1 [0147.707] CloseHandle (hObject=0x270) returned 1 [0147.707] CloseHandle (hObject=0x26c) returned 1 [0147.707] CloseHandle (hObject=0x268) returned 1 [0147.707] CloseHandle (hObject=0x264) returned 1 [0147.707] CloseHandle (hObject=0x260) returned 1 [0147.707] CloseHandle (hObject=0x25c) returned 1 [0147.708] CloseHandle (hObject=0x258) returned 1 [0147.708] CloseHandle (hObject=0x254) returned 1 [0147.708] CloseHandle (hObject=0x250) returned 1 [0147.708] CloseHandle (hObject=0x24c) returned 1 [0147.708] CloseHandle (hObject=0x248) returned 1 [0147.708] CloseHandle (hObject=0x244) returned 1 [0147.708] CloseHandle (hObject=0x240) returned 1 [0147.708] CloseHandle (hObject=0x23c) returned 1 [0147.708] CloseHandle (hObject=0x238) returned 1 [0147.708] CloseHandle (hObject=0x234) returned 1 [0147.708] CloseHandle (hObject=0x914) returned 1 [0147.708] CloseHandle (hObject=0x3dc) returned 1 [0147.708] CloseHandle (hObject=0xa98) returned 1 [0147.708] CloseHandle (hObject=0x3d0) returned 1 [0147.708] CloseHandle (hObject=0xa9c) returned 1 [0147.708] CloseHandle (hObject=0xaa0) returned 1 [0147.709] CloseHandle (hObject=0xaa4) returned 1 [0147.709] CloseHandle (hObject=0xaa8) returned 1 [0147.709] CloseHandle (hObject=0xaac) returned 1 [0147.709] CloseHandle (hObject=0xab0) returned 1 [0147.709] CloseHandle (hObject=0xab4) returned 1 [0147.709] CloseHandle (hObject=0xab8) returned 1 [0147.709] CloseHandle (hObject=0xabc) returned 1 [0147.709] CloseHandle (hObject=0xac0) returned 1 [0147.709] CloseHandle (hObject=0xac4) returned 1 [0147.709] CloseHandle (hObject=0xac8) returned 1 [0147.709] CloseHandle (hObject=0xacc) returned 1 [0147.709] CloseHandle (hObject=0xad0) returned 1 [0147.709] CloseHandle (hObject=0xad4) returned 1 [0147.709] CloseHandle (hObject=0xa2c) returned 1 [0147.709] CloseHandle (hObject=0x8d8) returned 1 [0147.709] CloseHandle (hObject=0xae0) returned 1 [0147.710] CloseHandle (hObject=0xae4) returned 1 [0147.710] CloseHandle (hObject=0xad8) returned 1 [0147.710] CloseHandle (hObject=0x8c8) returned 1 [0147.710] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 962 os_tid = 0x14bc [0147.242] GetLastError () returned 0x57 [0147.243] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1440 [0147.243] SetLastError (dwErrCode=0x57) [0147.243] IcmpCreateFile () returned 0x74ef08 [0147.428] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b5f8 [0147.428] IcmpSendEcho2 (in: IcmpHandle=0x74ef08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4100a8c0, RequestData=0xfdff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b5f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b5f8) returned 0x0 [0147.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b5f8 | out: hHeap=0x710000) returned 1 [0147.701] IcmpCloseHandle (IcmpHandle=0x74ef08) returned 1 [0147.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f1440 | out: hHeap=0x710000) returned 1 Thread: id = 963 os_tid = 0x14c0 [0147.243] GetLastError () returned 0x57 [0147.243] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f17c8 [0147.244] SetLastError (dwErrCode=0x57) [0147.244] IcmpCreateFile () returned 0x74ef40 [0147.299] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73ddd8 [0147.300] IcmpSendEcho2 (in: IcmpHandle=0x74ef40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4200a8c0, RequestData=0x111ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73ddd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73ddd8) returned 0x0 [0147.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73ddd8 | out: hHeap=0x710000) returned 1 [0147.511] IcmpCloseHandle (IcmpHandle=0x74ef40) returned 1 [0147.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f17c8 | out: hHeap=0x710000) returned 1 Thread: id = 964 os_tid = 0x14c4 [0147.244] GetLastError () returned 0x57 [0147.244] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1b50 [0147.244] SetLastError (dwErrCode=0x57) [0147.244] IcmpCreateFile () returned 0x74ef78 [0147.428] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b5a8 [0147.428] IcmpSendEcho2 (in: IcmpHandle=0x74ef78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4300a8c0, RequestData=0x125ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b5a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b5a8) returned 0x0 [0147.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b5a8 | out: hHeap=0x710000) returned 1 [0147.698] IcmpCloseHandle (IcmpHandle=0x74ef78) returned 1 [0147.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f1b50 | out: hHeap=0x710000) returned 1 Thread: id = 965 os_tid = 0x14d0 [0147.244] GetLastError () returned 0x57 [0147.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0298 [0147.245] SetLastError (dwErrCode=0x57) [0147.245] IcmpCreateFile () returned 0x74efb0 [0147.427] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b558 [0147.427] IcmpSendEcho2 (in: IcmpHandle=0x74efb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4400a8c0, RequestData=0xb04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b558, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b558) returned 0x0 [0147.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b558 | out: hHeap=0x710000) returned 1 [0147.694] IcmpCloseHandle (IcmpHandle=0x74efb0) returned 1 [0147.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f0298 | out: hHeap=0x710000) returned 1 Thread: id = 966 os_tid = 0x14d4 [0147.245] GetLastError () returned 0x57 [0147.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0620 [0147.245] SetLastError (dwErrCode=0x57) [0147.245] IcmpCreateFile () returned 0x74efe8 [0147.426] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b508 [0147.426] IcmpSendEcho2 (in: IcmpHandle=0x74efe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4500a8c0, RequestData=0xb14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b508, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b508) returned 0x0 [0147.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b508 | out: hHeap=0x710000) returned 1 [0147.691] IcmpCloseHandle (IcmpHandle=0x74efe8) returned 1 [0147.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f0620 | out: hHeap=0x710000) returned 1 Thread: id = 967 os_tid = 0x14d8 [0147.245] GetLastError () returned 0x57 [0147.246] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f09a8 [0147.246] SetLastError (dwErrCode=0x57) [0147.246] IcmpCreateFile () returned 0x74f020 [0147.425] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b4b8 [0147.425] IcmpSendEcho2 (in: IcmpHandle=0x74f020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4600a8c0, RequestData=0xb24ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b4b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b4b8) returned 0x0 [0147.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b4b8 | out: hHeap=0x710000) returned 1 [0147.689] IcmpCloseHandle (IcmpHandle=0x74f020) returned 1 [0147.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f09a8 | out: hHeap=0x710000) returned 1 Thread: id = 968 os_tid = 0x14dc [0147.246] GetLastError () returned 0x57 [0147.246] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0d30 [0147.246] SetLastError (dwErrCode=0x57) [0147.246] IcmpCreateFile () returned 0x74f058 [0147.425] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b468 [0147.425] IcmpSendEcho2 (in: IcmpHandle=0x74f058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4700a8c0, RequestData=0xb38ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b468, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b468) returned 0x0 [0147.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b468 | out: hHeap=0x710000) returned 1 [0147.686] IcmpCloseHandle (IcmpHandle=0x74f058) returned 1 [0147.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f0d30 | out: hHeap=0x710000) returned 1 Thread: id = 969 os_tid = 0x17cc [0147.247] GetLastError () returned 0x57 [0147.247] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f10b8 [0147.247] SetLastError (dwErrCode=0x57) [0147.247] IcmpCreateFile () returned 0x74f090 [0147.424] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b418 [0147.424] IcmpSendEcho2 (in: IcmpHandle=0x74f090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4800a8c0, RequestData=0xb4cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b418, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b418) returned 0x0 [0147.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b418 | out: hHeap=0x710000) returned 1 [0147.684] IcmpCloseHandle (IcmpHandle=0x74f090) returned 1 [0147.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f10b8 | out: hHeap=0x710000) returned 1 Thread: id = 970 os_tid = 0x14e0 [0147.247] GetLastError () returned 0x57 [0147.247] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6738 [0147.247] SetLastError (dwErrCode=0x57) [0147.247] IcmpCreateFile () returned 0x74f0c8 [0147.423] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b3c8 [0147.423] IcmpSendEcho2 (in: IcmpHandle=0x74f0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4900a8c0, RequestData=0xb60ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b3c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b3c8) returned 0x0 [0147.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b3c8 | out: hHeap=0x710000) returned 1 [0147.678] IcmpCloseHandle (IcmpHandle=0x74f0c8) returned 1 [0147.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6738 | out: hHeap=0x710000) returned 1 Thread: id = 971 os_tid = 0x14e4 [0147.248] GetLastError () returned 0x57 [0147.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6ac0 [0147.248] SetLastError (dwErrCode=0x57) [0147.248] IcmpCreateFile () returned 0x74f100 [0147.422] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b378 [0147.422] IcmpSendEcho2 (in: IcmpHandle=0x74f100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4a00a8c0, RequestData=0xb74ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b378, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b378) returned 0x0 [0147.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b378 | out: hHeap=0x710000) returned 1 [0147.676] IcmpCloseHandle (IcmpHandle=0x74f100) returned 1 [0147.677] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6ac0 | out: hHeap=0x710000) returned 1 Thread: id = 972 os_tid = 0x14e8 [0147.248] GetLastError () returned 0x57 [0147.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6e48 [0147.248] SetLastError (dwErrCode=0x57) [0147.248] IcmpCreateFile () returned 0x74f138 [0147.421] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b328 [0147.421] IcmpSendEcho2 (in: IcmpHandle=0x74f138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4b00a8c0, RequestData=0xb88ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b328, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b328) returned 0x0 [0147.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b328 | out: hHeap=0x710000) returned 1 [0147.674] IcmpCloseHandle (IcmpHandle=0x74f138) returned 1 [0147.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6e48 | out: hHeap=0x710000) returned 1 Thread: id = 973 os_tid = 0x14ec [0147.249] GetLastError () returned 0x57 [0147.249] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e71d0 [0147.249] SetLastError (dwErrCode=0x57) [0147.249] IcmpCreateFile () returned 0x74f170 [0147.421] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bcd8 [0147.421] IcmpSendEcho2 (in: IcmpHandle=0x74f170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4c00a8c0, RequestData=0xb9cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bcd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bcd8) returned 0x0 [0147.670] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bcd8 | out: hHeap=0x710000) returned 1 [0147.672] IcmpCloseHandle (IcmpHandle=0x74f170) returned 1 [0147.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e71d0 | out: hHeap=0x710000) returned 1 Thread: id = 974 os_tid = 0x14f0 [0147.249] GetLastError () returned 0x57 [0147.249] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7558 [0147.249] SetLastError (dwErrCode=0x57) [0147.249] IcmpCreateFile () returned 0x74f1a8 [0147.420] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc88 [0147.420] IcmpSendEcho2 (in: IcmpHandle=0x74f1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4d00a8c0, RequestData=0xbb0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bc88) returned 0x0 [0147.668] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bc88 | out: hHeap=0x710000) returned 1 [0147.668] IcmpCloseHandle (IcmpHandle=0x74f1a8) returned 1 [0147.668] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7558 | out: hHeap=0x710000) returned 1 Thread: id = 975 os_tid = 0x14f4 [0147.250] GetLastError () returned 0x57 [0147.250] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e78e0 [0147.250] SetLastError (dwErrCode=0x57) [0147.250] IcmpCreateFile () returned 0x74f1e0 [0147.419] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc38 [0147.419] IcmpSendEcho2 (in: IcmpHandle=0x74f1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4e00a8c0, RequestData=0xbc4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bc38) returned 0x0 [0147.664] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bc38 | out: hHeap=0x710000) returned 1 [0147.665] IcmpCloseHandle (IcmpHandle=0x74f1e0) returned 1 [0147.665] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e78e0 | out: hHeap=0x710000) returned 1 Thread: id = 976 os_tid = 0x14f8 [0147.250] GetLastError () returned 0x57 [0147.250] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7c68 [0147.250] SetLastError (dwErrCode=0x57) [0147.250] IcmpCreateFile () returned 0x74f218 [0147.418] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bbe8 [0147.418] IcmpSendEcho2 (in: IcmpHandle=0x74f218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4f00a8c0, RequestData=0xbd8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bbe8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bbe8) returned 0x0 [0147.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bbe8 | out: hHeap=0x710000) returned 1 [0147.661] IcmpCloseHandle (IcmpHandle=0x74f218) returned 1 [0147.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7c68 | out: hHeap=0x710000) returned 1 Thread: id = 977 os_tid = 0x14fc [0147.251] GetLastError () returned 0x57 [0147.251] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7ff0 [0147.251] SetLastError (dwErrCode=0x57) [0147.251] IcmpCreateFile () returned 0x74f250 [0147.418] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb98 [0147.418] IcmpSendEcho2 (in: IcmpHandle=0x74f250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5000a8c0, RequestData=0xbecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bb98) returned 0x0 [0147.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bb98 | out: hHeap=0x710000) returned 1 [0147.656] IcmpCloseHandle (IcmpHandle=0x74f250) returned 1 [0147.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7ff0 | out: hHeap=0x710000) returned 1 Thread: id = 978 os_tid = 0xe68 [0147.251] GetLastError () returned 0x57 [0147.251] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8378 [0147.251] SetLastError (dwErrCode=0x57) [0147.251] IcmpCreateFile () returned 0x74f368 [0147.417] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb48 [0147.417] IcmpSendEcho2 (in: IcmpHandle=0x74f368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5100a8c0, RequestData=0xc00ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bb48) returned 0x0 [0147.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bb48 | out: hHeap=0x710000) returned 1 [0147.654] IcmpCloseHandle (IcmpHandle=0x74f368) returned 1 [0147.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8378 | out: hHeap=0x710000) returned 1 Thread: id = 979 os_tid = 0xe7c [0147.252] GetLastError () returned 0x57 [0147.252] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8700 [0147.252] SetLastError (dwErrCode=0x57) [0147.252] IcmpCreateFile () returned 0x74f3a0 [0147.416] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76baf8 [0147.416] IcmpSendEcho2 (in: IcmpHandle=0x74f3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5200a8c0, RequestData=0xc14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76baf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76baf8) returned 0x0 [0147.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76baf8 | out: hHeap=0x710000) returned 1 [0147.651] IcmpCloseHandle (IcmpHandle=0x74f3a0) returned 1 [0147.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8700 | out: hHeap=0x710000) returned 1 Thread: id = 980 os_tid = 0x1500 [0147.252] GetLastError () returned 0x57 [0147.252] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8a88 [0147.253] SetLastError (dwErrCode=0x57) [0147.253] IcmpCreateFile () returned 0x74ecd8 [0147.415] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76baa8 [0147.415] IcmpSendEcho2 (in: IcmpHandle=0x74ecd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5300a8c0, RequestData=0xc28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76baa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76baa8) returned 0x0 [0147.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76baa8 | out: hHeap=0x710000) returned 1 [0147.649] IcmpCloseHandle (IcmpHandle=0x74ecd8) returned 1 [0147.650] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8a88 | out: hHeap=0x710000) returned 1 Thread: id = 981 os_tid = 0x1504 [0147.253] GetLastError () returned 0x57 [0147.253] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8e10 [0147.253] SetLastError (dwErrCode=0x57) [0147.253] IcmpCreateFile () returned 0x74ed10 [0147.414] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba58 [0147.414] IcmpSendEcho2 (in: IcmpHandle=0x74ed10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5400a8c0, RequestData=0xc3cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76ba58) returned 0x0 [0147.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76ba58 | out: hHeap=0x710000) returned 1 [0147.646] IcmpCloseHandle (IcmpHandle=0x74ed10) returned 1 [0147.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8e10 | out: hHeap=0x710000) returned 1 Thread: id = 982 os_tid = 0x1508 [0147.253] GetLastError () returned 0x57 [0147.253] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2098 [0147.254] SetLastError (dwErrCode=0x57) [0147.254] IcmpCreateFile () returned 0x74ed48 [0147.413] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba08 [0147.413] IcmpSendEcho2 (in: IcmpHandle=0x74ed48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5500a8c0, RequestData=0xc50ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76ba08) returned 0x0 [0147.643] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76ba08 | out: hHeap=0x710000) returned 1 [0147.643] IcmpCloseHandle (IcmpHandle=0x74ed48) returned 1 [0147.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2098 | out: hHeap=0x710000) returned 1 Thread: id = 983 os_tid = 0x150c [0147.254] GetLastError () returned 0x57 [0147.254] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2420 [0147.254] SetLastError (dwErrCode=0x57) [0147.254] IcmpCreateFile () returned 0x74ed80 [0147.412] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b9b8 [0147.413] IcmpSendEcho2 (in: IcmpHandle=0x74ed80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5600a8c0, RequestData=0xc64ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b9b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b9b8) returned 0x0 [0147.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b9b8 | out: hHeap=0x710000) returned 1 [0147.641] IcmpCloseHandle (IcmpHandle=0x74ed80) returned 1 [0147.642] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2420 | out: hHeap=0x710000) returned 1 Thread: id = 984 os_tid = 0x1510 [0147.254] GetLastError () returned 0x57 [0147.254] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e27a8 [0147.255] SetLastError (dwErrCode=0x57) [0147.255] IcmpCreateFile () returned 0x74edb8 [0147.382] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b968 [0147.382] IcmpSendEcho2 (in: IcmpHandle=0x74edb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5700a8c0, RequestData=0xc78ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b968, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b968) returned 0x0 [0147.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b968 | out: hHeap=0x710000) returned 1 [0147.633] IcmpCloseHandle (IcmpHandle=0x74edb8) returned 1 [0147.634] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e27a8 | out: hHeap=0x710000) returned 1 Thread: id = 985 os_tid = 0x1514 [0147.255] GetLastError () returned 0x57 [0147.255] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2b30 [0147.255] SetLastError (dwErrCode=0x57) [0147.255] IcmpCreateFile () returned 0x74edf0 [0147.378] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b918 [0147.378] IcmpSendEcho2 (in: IcmpHandle=0x74edf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5800a8c0, RequestData=0xc8cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b918, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b918) returned 0x0 [0147.630] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b918 | out: hHeap=0x710000) returned 1 [0147.630] IcmpCloseHandle (IcmpHandle=0x74edf0) returned 1 [0147.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2b30 | out: hHeap=0x710000) returned 1 Thread: id = 986 os_tid = 0x1518 [0147.255] GetLastError () returned 0x57 [0147.255] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2eb8 [0147.256] SetLastError (dwErrCode=0x57) [0147.256] IcmpCreateFile () returned 0x74ee28 [0147.377] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b8c8 [0147.377] IcmpSendEcho2 (in: IcmpHandle=0x74ee28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5900a8c0, RequestData=0xca0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b8c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b8c8) returned 0x0 [0147.628] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b8c8 | out: hHeap=0x710000) returned 1 [0147.628] IcmpCloseHandle (IcmpHandle=0x74ee28) returned 1 [0147.628] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2eb8 | out: hHeap=0x710000) returned 1 Thread: id = 987 os_tid = 0x151c [0147.256] GetLastError () returned 0x57 [0147.256] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3240 [0147.256] SetLastError (dwErrCode=0x57) [0147.256] IcmpCreateFile () returned 0x74ee60 [0147.376] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b878 [0147.376] IcmpSendEcho2 (in: IcmpHandle=0x74ee60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5a00a8c0, RequestData=0xcb4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b878, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b878) returned 0x0 [0147.622] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b878 | out: hHeap=0x710000) returned 1 [0147.625] IcmpCloseHandle (IcmpHandle=0x74ee60) returned 1 [0147.625] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3240 | out: hHeap=0x710000) returned 1 Thread: id = 988 os_tid = 0x1520 [0147.256] GetLastError () returned 0x57 [0147.257] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e35c8 [0147.257] SetLastError (dwErrCode=0x57) [0147.257] IcmpCreateFile () returned 0x74ee98 [0147.375] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b828 [0147.375] IcmpSendEcho2 (in: IcmpHandle=0x74ee98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5b00a8c0, RequestData=0xcc8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b828, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b828) returned 0x0 [0147.620] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b828 | out: hHeap=0x710000) returned 1 [0147.620] IcmpCloseHandle (IcmpHandle=0x74ee98) returned 1 [0147.620] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e35c8 | out: hHeap=0x710000) returned 1 Thread: id = 989 os_tid = 0x1524 [0147.257] GetLastError () returned 0x57 [0147.257] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3950 [0147.257] SetLastError (dwErrCode=0x57) [0147.257] IcmpCreateFile () returned 0x74eed0 [0147.374] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b7d8 [0147.374] IcmpSendEcho2 (in: IcmpHandle=0x74eed0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5c00a8c0, RequestData=0xcdcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b7d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b7d8) returned 0x0 [0147.617] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b7d8 | out: hHeap=0x710000) returned 1 [0147.617] IcmpCloseHandle (IcmpHandle=0x74eed0) returned 1 [0147.618] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3950 | out: hHeap=0x710000) returned 1 Thread: id = 990 os_tid = 0x1528 [0147.257] GetLastError () returned 0x57 [0147.258] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3cd8 [0147.260] SetLastError (dwErrCode=0x57) [0147.260] IcmpCreateFile () returned 0x74f3d8 [0147.373] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf58 [0147.373] IcmpSendEcho2 (in: IcmpHandle=0x74f3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5d00a8c0, RequestData=0xcf0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bf58) returned 0x0 [0147.615] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bf58 | out: hHeap=0x710000) returned 1 [0147.615] IcmpCloseHandle (IcmpHandle=0x74f3d8) returned 1 [0147.615] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3cd8 | out: hHeap=0x710000) returned 1 Thread: id = 991 os_tid = 0x152c [0147.261] GetLastError () returned 0x57 [0147.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4060 [0147.261] SetLastError (dwErrCode=0x57) [0147.261] IcmpCreateFile () returned 0x74f410 [0147.372] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf08 [0147.372] IcmpSendEcho2 (in: IcmpHandle=0x74f410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5e00a8c0, RequestData=0xd04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bf08) returned 0x0 [0147.611] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bf08 | out: hHeap=0x710000) returned 1 [0147.613] IcmpCloseHandle (IcmpHandle=0x74f410) returned 1 [0147.613] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4060 | out: hHeap=0x710000) returned 1 Thread: id = 992 os_tid = 0x1530 [0147.261] GetLastError () returned 0x57 [0147.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e43e8 [0147.261] SetLastError (dwErrCode=0x57) [0147.261] IcmpCreateFile () returned 0x74f448 [0147.371] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76beb8 [0147.371] IcmpSendEcho2 (in: IcmpHandle=0x74f448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5f00a8c0, RequestData=0xd18ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76beb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76beb8) returned 0x0 [0147.607] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76beb8 | out: hHeap=0x710000) returned 1 [0147.607] IcmpCloseHandle (IcmpHandle=0x74f448) returned 1 [0147.608] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e43e8 | out: hHeap=0x710000) returned 1 Thread: id = 993 os_tid = 0x1534 [0147.262] GetLastError () returned 0x57 [0147.262] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4770 [0147.262] SetLastError (dwErrCode=0x57) [0147.262] IcmpCreateFile () returned 0x75d268 [0147.370] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be68 [0147.370] IcmpSendEcho2 (in: IcmpHandle=0x75d268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6000a8c0, RequestData=0xd2cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76be68) returned 0x0 [0147.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76be68 | out: hHeap=0x710000) returned 1 [0147.605] IcmpCloseHandle (IcmpHandle=0x75d268) returned 1 [0147.605] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4770 | out: hHeap=0x710000) returned 1 Thread: id = 994 os_tid = 0x1538 [0147.262] GetLastError () returned 0x57 [0147.262] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4af8 [0147.262] SetLastError (dwErrCode=0x57) [0147.262] IcmpCreateFile () returned 0x75d2a0 [0147.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be18 [0147.363] IcmpSendEcho2 (in: IcmpHandle=0x75d2a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6100a8c0, RequestData=0xd40ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76be18) returned 0x0 [0147.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76be18 | out: hHeap=0x710000) returned 1 [0147.602] IcmpCloseHandle (IcmpHandle=0x75d2a0) returned 1 [0147.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4af8 | out: hHeap=0x710000) returned 1 Thread: id = 995 os_tid = 0x153c [0147.263] GetLastError () returned 0x57 [0147.263] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4e80 [0147.263] SetLastError (dwErrCode=0x57) [0147.263] IcmpCreateFile () returned 0x75d2d8 [0147.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bdc8 [0147.362] IcmpSendEcho2 (in: IcmpHandle=0x75d2d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6200a8c0, RequestData=0xd54ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bdc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bdc8) returned 0x0 [0147.596] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bdc8 | out: hHeap=0x710000) returned 1 [0147.596] IcmpCloseHandle (IcmpHandle=0x75d2d8) returned 1 [0147.596] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4e80 | out: hHeap=0x710000) returned 1 Thread: id = 996 os_tid = 0x1540 [0147.264] GetLastError () returned 0x57 [0147.264] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5208 [0147.264] SetLastError (dwErrCode=0x57) [0147.264] IcmpCreateFile () returned 0x75d310 [0147.360] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd78 [0147.360] IcmpSendEcho2 (in: IcmpHandle=0x75d310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6300a8c0, RequestData=0xd68ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bd78) returned 0x0 [0147.593] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bd78 | out: hHeap=0x710000) returned 1 [0147.593] IcmpCloseHandle (IcmpHandle=0x75d310) returned 1 [0147.593] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5208 | out: hHeap=0x710000) returned 1 Thread: id = 997 os_tid = 0x1544 [0147.265] GetLastError () returned 0x57 [0147.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5590 [0147.265] SetLastError (dwErrCode=0x57) [0147.265] IcmpCreateFile () returned 0x75d348 [0147.359] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd28 [0147.359] IcmpSendEcho2 (in: IcmpHandle=0x75d348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6400a8c0, RequestData=0xd7cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bd28) returned 0x0 [0147.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bd28 | out: hHeap=0x710000) returned 1 [0147.590] IcmpCloseHandle (IcmpHandle=0x75d348) returned 1 [0147.591] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5590 | out: hHeap=0x710000) returned 1 Thread: id = 998 os_tid = 0x1548 [0147.265] GetLastError () returned 0x57 [0147.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5918 [0147.265] SetLastError (dwErrCode=0x57) [0147.265] IcmpCreateFile () returned 0x75d380 [0147.354] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c278 [0147.354] IcmpSendEcho2 (in: IcmpHandle=0x75d380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6500a8c0, RequestData=0xd90ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c278, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c278) returned 0x0 [0147.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c278 | out: hHeap=0x710000) returned 1 [0147.588] IcmpCloseHandle (IcmpHandle=0x75d380) returned 1 [0147.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5918 | out: hHeap=0x710000) returned 1 Thread: id = 999 os_tid = 0x154c [0147.266] GetLastError () returned 0x57 [0147.266] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5ca0 [0147.266] SetLastError (dwErrCode=0x57) [0147.266] IcmpCreateFile () returned 0x75d3b8 [0147.353] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c228 [0147.353] IcmpSendEcho2 (in: IcmpHandle=0x75d3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6600a8c0, RequestData=0xda4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c228, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c228) returned 0x0 [0147.586] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c228 | out: hHeap=0x710000) returned 1 [0147.586] IcmpCloseHandle (IcmpHandle=0x75d3b8) returned 1 [0147.586] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5ca0 | out: hHeap=0x710000) returned 1 Thread: id = 1000 os_tid = 0x1550 [0147.266] GetLastError () returned 0x57 [0147.266] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6028 [0147.267] SetLastError (dwErrCode=0x57) [0147.267] IcmpCreateFile () returned 0x75d3f0 [0147.351] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c188 [0147.351] IcmpSendEcho2 (in: IcmpHandle=0x75d3f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6700a8c0, RequestData=0xdb8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c188, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c188) returned 0x0 [0147.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c188 | out: hHeap=0x710000) returned 1 [0147.584] IcmpCloseHandle (IcmpHandle=0x75d3f0) returned 1 [0147.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6028 | out: hHeap=0x710000) returned 1 Thread: id = 1001 os_tid = 0x1554 [0147.267] GetLastError () returned 0x57 [0147.267] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e63b0 [0147.267] SetLastError (dwErrCode=0x57) [0147.267] IcmpCreateFile () returned 0x75d428 [0147.349] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c138 [0147.350] IcmpSendEcho2 (in: IcmpHandle=0x75d428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6800a8c0, RequestData=0xdccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c138, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c138) returned 0x0 [0147.582] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c138 | out: hHeap=0x710000) returned 1 [0147.582] IcmpCloseHandle (IcmpHandle=0x75d428) returned 1 [0147.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e63b0 | out: hHeap=0x710000) returned 1 Thread: id = 1002 os_tid = 0x1558 [0147.268] GetLastError () returned 0x57 [0147.268] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed838 [0147.268] SetLastError (dwErrCode=0x57) [0147.268] IcmpCreateFile () returned 0x75d498 [0147.348] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c0e8 [0147.348] IcmpSendEcho2 (in: IcmpHandle=0x75d498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6900a8c0, RequestData=0xde0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c0e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c0e8) returned 0x0 [0147.580] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c0e8 | out: hHeap=0x710000) returned 1 [0147.580] IcmpCloseHandle (IcmpHandle=0x75d498) returned 1 [0147.580] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ed838 | out: hHeap=0x710000) returned 1 Thread: id = 1003 os_tid = 0xe50 [0147.271] GetLastError () returned 0x57 [0147.271] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edbc0 [0147.272] SetLastError (dwErrCode=0x57) [0147.272] IcmpCreateFile () returned 0x75d508 [0147.347] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c098 [0147.347] IcmpSendEcho2 (in: IcmpHandle=0x75d508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6a00a8c0, RequestData=0xdf4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c098, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c098) returned 0x0 [0147.576] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c098 | out: hHeap=0x710000) returned 1 [0147.578] IcmpCloseHandle (IcmpHandle=0x75d508) returned 1 [0147.579] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6edbc0 | out: hHeap=0x710000) returned 1 Thread: id = 1004 os_tid = 0x155c [0147.272] GetLastError () returned 0x57 [0147.272] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edf48 [0147.272] SetLastError (dwErrCode=0x57) [0147.272] IcmpCreateFile () returned 0x75d540 [0147.345] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c048 [0147.346] IcmpSendEcho2 (in: IcmpHandle=0x75d540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6b00a8c0, RequestData=0xe08ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c048, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c048) returned 0x0 [0147.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c048 | out: hHeap=0x710000) returned 1 [0147.574] IcmpCloseHandle (IcmpHandle=0x75d540) returned 1 [0147.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6edf48 | out: hHeap=0x710000) returned 1 Thread: id = 1005 os_tid = 0x1560 [0147.273] GetLastError () returned 0x57 [0147.273] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee2d0 [0147.273] SetLastError (dwErrCode=0x57) [0147.273] IcmpCreateFile () returned 0x75d578 [0147.344] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bff8 [0147.344] IcmpSendEcho2 (in: IcmpHandle=0x75d578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6c00a8c0, RequestData=0xe1cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bff8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bff8) returned 0x0 [0147.570] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bff8 | out: hHeap=0x710000) returned 1 [0147.570] IcmpCloseHandle (IcmpHandle=0x75d578) returned 1 [0147.570] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee2d0 | out: hHeap=0x710000) returned 1 Thread: id = 1006 os_tid = 0x1564 [0147.274] GetLastError () returned 0x57 [0147.275] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee658 [0147.275] SetLastError (dwErrCode=0x57) [0147.275] IcmpCreateFile () returned 0x75d620 [0147.343] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bfa8 [0147.343] IcmpSendEcho2 (in: IcmpHandle=0x75d620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6d00a8c0, RequestData=0xe30ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bfa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bfa8) returned 0x0 [0147.567] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bfa8 | out: hHeap=0x710000) returned 1 [0147.567] IcmpCloseHandle (IcmpHandle=0x75d620) returned 1 [0147.568] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee658 | out: hHeap=0x710000) returned 1 Thread: id = 1007 os_tid = 0x1568 [0147.275] GetLastError () returned 0x57 [0147.276] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee9e0 [0147.276] SetLastError (dwErrCode=0x57) [0147.276] IcmpCreateFile () returned 0x75d658 [0147.341] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c1d8 [0147.341] IcmpSendEcho2 (in: IcmpHandle=0x75d658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6e00a8c0, RequestData=0xe44ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c1d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c1d8) returned 0x0 [0147.562] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c1d8 | out: hHeap=0x710000) returned 1 [0147.562] IcmpCloseHandle (IcmpHandle=0x75d658) returned 1 [0147.562] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee9e0 | out: hHeap=0x710000) returned 1 Thread: id = 1008 os_tid = 0x156c [0147.276] GetLastError () returned 0x57 [0147.276] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eed68 [0147.277] SetLastError (dwErrCode=0x57) [0147.277] IcmpCreateFile () returned 0x75d690 [0147.340] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dd38 [0147.340] IcmpSendEcho2 (in: IcmpHandle=0x75d690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6f00a8c0, RequestData=0xe58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dd38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dd38) returned 0x0 [0147.559] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dd38 | out: hHeap=0x710000) returned 1 [0147.559] IcmpCloseHandle (IcmpHandle=0x75d690) returned 1 [0147.560] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eed68 | out: hHeap=0x710000) returned 1 Thread: id = 1009 os_tid = 0x1570 [0147.277] GetLastError () returned 0x57 [0147.277] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef0f0 [0147.278] SetLastError (dwErrCode=0x57) [0147.278] IcmpCreateFile () returned 0x75d6c8 [0147.339] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dce8 [0147.339] IcmpSendEcho2 (in: IcmpHandle=0x75d6c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7000a8c0, RequestData=0xe6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dce8) returned 0x0 [0147.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dce8 | out: hHeap=0x710000) returned 1 [0147.551] IcmpCloseHandle (IcmpHandle=0x75d6c8) returned 1 [0147.551] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef0f0 | out: hHeap=0x710000) returned 1 Thread: id = 1010 os_tid = 0x1574 [0147.278] GetLastError () returned 0x57 [0147.279] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef478 [0147.279] SetLastError (dwErrCode=0x57) [0147.279] IcmpCreateFile () returned 0x75d700 [0147.337] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc98 [0147.337] IcmpSendEcho2 (in: IcmpHandle=0x75d700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7100a8c0, RequestData=0xe80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc98) returned 0x0 [0147.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc98 | out: hHeap=0x710000) returned 1 [0147.548] IcmpCloseHandle (IcmpHandle=0x75d700) returned 1 [0147.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef478 | out: hHeap=0x710000) returned 1 Thread: id = 1011 os_tid = 0x1578 [0147.279] GetLastError () returned 0x57 [0147.280] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef800 [0147.280] SetLastError (dwErrCode=0x57) [0147.280] IcmpCreateFile () returned 0x75d070 [0147.332] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dbf8 [0147.333] IcmpSendEcho2 (in: IcmpHandle=0x75d070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7200a8c0, RequestData=0xe94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dbf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dbf8) returned 0x0 [0147.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dbf8 | out: hHeap=0x710000) returned 1 [0147.546] IcmpCloseHandle (IcmpHandle=0x75d070) returned 1 [0147.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef800 | out: hHeap=0x710000) returned 1 Thread: id = 1012 os_tid = 0x157c [0147.280] GetLastError () returned 0x57 [0147.281] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6efb88 [0147.281] SetLastError (dwErrCode=0x57) [0147.281] IcmpCreateFile () returned 0x75d0a8 [0147.331] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dba8 [0147.331] IcmpSendEcho2 (in: IcmpHandle=0x75d0a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7300a8c0, RequestData=0xea8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dba8) returned 0x0 [0147.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dba8 | out: hHeap=0x710000) returned 1 [0147.544] IcmpCloseHandle (IcmpHandle=0x75d0a8) returned 1 [0147.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6efb88 | out: hHeap=0x710000) returned 1 Thread: id = 1013 os_tid = 0x1580 [0147.281] GetLastError () returned 0x57 [0147.282] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eff10 [0147.282] SetLastError (dwErrCode=0x57) [0147.282] IcmpCreateFile () returned 0x75d0e0 [0147.330] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73db08 [0147.330] IcmpSendEcho2 (in: IcmpHandle=0x75d0e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7400a8c0, RequestData=0xebcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73db08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73db08) returned 0x0 [0147.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73db08 | out: hHeap=0x710000) returned 1 [0147.540] IcmpCloseHandle (IcmpHandle=0x75d0e0) returned 1 [0147.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eff10 | out: hHeap=0x710000) returned 1 Thread: id = 1014 os_tid = 0x1584 [0147.282] GetLastError () returned 0x57 [0147.283] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9198 [0147.283] SetLastError (dwErrCode=0x57) [0147.283] IcmpCreateFile () returned 0x75d118 [0147.328] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dab8 [0147.329] IcmpSendEcho2 (in: IcmpHandle=0x75d118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7500a8c0, RequestData=0xed0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dab8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dab8) returned 0x0 [0147.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dab8 | out: hHeap=0x710000) returned 1 [0147.538] IcmpCloseHandle (IcmpHandle=0x75d118) returned 1 [0147.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9198 | out: hHeap=0x710000) returned 1 Thread: id = 1015 os_tid = 0x1588 [0147.283] GetLastError () returned 0x57 [0147.284] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9520 [0147.284] SetLastError (dwErrCode=0x57) [0147.284] IcmpCreateFile () returned 0x75d150 [0147.327] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e238 [0147.327] IcmpSendEcho2 (in: IcmpHandle=0x75d150, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7600a8c0, RequestData=0xee4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e238) returned 0x0 [0147.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e238 | out: hHeap=0x710000) returned 1 [0147.536] IcmpCloseHandle (IcmpHandle=0x75d150) returned 1 [0147.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9520 | out: hHeap=0x710000) returned 1 Thread: id = 1016 os_tid = 0x158c [0147.284] GetLastError () returned 0x57 [0147.285] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e98a8 [0147.285] SetLastError (dwErrCode=0x57) [0147.285] IcmpCreateFile () returned 0x75d188 [0147.323] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e1e8 [0147.323] IcmpSendEcho2 (in: IcmpHandle=0x75d188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7700a8c0, RequestData=0xef8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e1e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e1e8) returned 0x0 [0147.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e1e8 | out: hHeap=0x710000) returned 1 [0147.534] IcmpCloseHandle (IcmpHandle=0x75d188) returned 1 [0147.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e98a8 | out: hHeap=0x710000) returned 1 Thread: id = 1017 os_tid = 0x1590 [0147.285] GetLastError () returned 0x57 [0147.286] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9c30 [0147.286] SetLastError (dwErrCode=0x57) [0147.286] IcmpCreateFile () returned 0x75d1c0 [0147.321] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e198 [0147.321] IcmpSendEcho2 (in: IcmpHandle=0x75d1c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7800a8c0, RequestData=0xf0cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e198) returned 0x0 [0147.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e198 | out: hHeap=0x710000) returned 1 [0147.532] IcmpCloseHandle (IcmpHandle=0x75d1c0) returned 1 [0147.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9c30 | out: hHeap=0x710000) returned 1 Thread: id = 1018 os_tid = 0x1594 [0147.286] GetLastError () returned 0x57 [0147.287] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9fb8 [0147.287] SetLastError (dwErrCode=0x57) [0147.287] IcmpCreateFile () returned 0x75d1f8 [0147.319] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e148 [0147.319] IcmpSendEcho2 (in: IcmpHandle=0x75d1f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7900a8c0, RequestData=0xf20ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e148) returned 0x0 [0147.528] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e148 | out: hHeap=0x710000) returned 1 [0147.528] IcmpCloseHandle (IcmpHandle=0x75d1f8) returned 1 [0147.529] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9fb8 | out: hHeap=0x710000) returned 1 Thread: id = 1019 os_tid = 0x1598 [0147.287] GetLastError () returned 0x57 [0147.288] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea340 [0147.288] SetLastError (dwErrCode=0x57) [0147.288] IcmpCreateFile () returned 0x75d230 [0147.318] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e0f8 [0147.318] IcmpSendEcho2 (in: IcmpHandle=0x75d230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7a00a8c0, RequestData=0xf34ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e0f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e0f8) returned 0x0 [0147.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e0f8 | out: hHeap=0x710000) returned 1 [0147.526] IcmpCloseHandle (IcmpHandle=0x75d230) returned 1 [0147.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea340 | out: hHeap=0x710000) returned 1 Thread: id = 1020 os_tid = 0x159c [0147.288] GetLastError () returned 0x57 [0147.289] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea6c8 [0147.289] SetLastError (dwErrCode=0x57) [0147.289] IcmpCreateFile () returned 0x75d738 [0147.316] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e0a8 [0147.316] IcmpSendEcho2 (in: IcmpHandle=0x75d738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7b00a8c0, RequestData=0xf48ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e0a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e0a8) returned 0x0 [0147.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e0a8 | out: hHeap=0x710000) returned 1 [0147.524] IcmpCloseHandle (IcmpHandle=0x75d738) returned 1 [0147.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea6c8 | out: hHeap=0x710000) returned 1 Thread: id = 1021 os_tid = 0x15a0 [0147.293] GetLastError () returned 0x57 [0147.293] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eaa50 [0147.294] SetLastError (dwErrCode=0x57) [0147.294] IcmpCreateFile () returned 0x75d770 [0147.315] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e058 [0147.315] IcmpSendEcho2 (in: IcmpHandle=0x75d770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7c00a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e058) returned 0x0 [0147.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e058 | out: hHeap=0x710000) returned 1 [0147.522] IcmpCloseHandle (IcmpHandle=0x75d770) returned 1 [0147.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eaa50 | out: hHeap=0x710000) returned 1 Thread: id = 1022 os_tid = 0x15a4 [0147.294] GetLastError () returned 0x57 [0147.294] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eadd8 [0147.295] SetLastError (dwErrCode=0x57) [0147.295] IcmpCreateFile () returned 0x75d7a8 [0147.310] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dfb8 [0147.310] IcmpSendEcho2 (in: IcmpHandle=0x75d7a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7d00a8c0, RequestData=0xf70ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dfb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dfb8) returned 0x0 [0147.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dfb8 | out: hHeap=0x710000) returned 1 [0147.518] IcmpCloseHandle (IcmpHandle=0x75d7a8) returned 1 [0147.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eadd8 | out: hHeap=0x710000) returned 1 Thread: id = 1023 os_tid = 0x15a8 [0147.295] GetLastError () returned 0x57 [0147.295] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb160 [0147.296] SetLastError (dwErrCode=0x57) [0147.296] IcmpCreateFile () returned 0x728908 [0147.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df68 [0147.307] IcmpSendEcho2 (in: IcmpHandle=0x728908, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7e00a8c0, RequestData=0xf84ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df68) returned 0x0 [0147.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df68 | out: hHeap=0x710000) returned 1 [0147.517] IcmpCloseHandle (IcmpHandle=0x728908) returned 1 [0147.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb160 | out: hHeap=0x710000) returned 1 Thread: id = 1024 os_tid = 0x15ac [0147.296] GetLastError () returned 0x57 [0147.296] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb4e8 [0147.297] SetLastError (dwErrCode=0x57) [0147.297] IcmpCreateFile () returned 0x728940 [0147.306] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de78 [0147.306] IcmpSendEcho2 (in: IcmpHandle=0x728940, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7f00a8c0, RequestData=0xf98ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de78) returned 0x0 [0147.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de78 | out: hHeap=0x710000) returned 1 [0147.515] IcmpCloseHandle (IcmpHandle=0x728940) returned 1 [0147.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb4e8 | out: hHeap=0x710000) returned 1 Thread: id = 1025 os_tid = 0x15b0 [0147.297] GetLastError () returned 0x57 [0147.297] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb870 [0147.298] SetLastError (dwErrCode=0x57) [0147.298] IcmpCreateFile () returned 0x728978 [0147.304] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de28 [0147.304] IcmpSendEcho2 (in: IcmpHandle=0x728978, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8000a8c0, RequestData=0xfd0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de28) returned 0x0 [0147.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de28 | out: hHeap=0x710000) returned 1 [0147.513] IcmpCloseHandle (IcmpHandle=0x728978) returned 1 [0147.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb870 | out: hHeap=0x710000) returned 1 Thread: id = 1026 os_tid = 0x15b4 [0147.714] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0147.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0147.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f060c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0147.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0147.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0624, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0147.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0147.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f063c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0147.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0147.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0654, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0147.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0147.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f066c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0147.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0147.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0684, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0147.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0147.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f069c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0147.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0147.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0147.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac [0147.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0147.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4 [0147.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0147.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0147.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0147.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0147.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0714, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0147.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0147.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f072c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0147.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0147.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0147.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0147.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f075c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0147.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0147.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0774, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0147.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0147.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f078c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0147.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0147.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0147.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0147.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0147.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0147.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0147.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0147.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0147.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0147.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0804, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0147.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0147.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f081c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0147.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0147.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0147.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0147.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f084c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0147.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0147.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0864, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0147.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0147.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f087c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0147.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0147.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0894, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0147.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0147.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0147.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0147.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0147.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0147.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0147.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0147.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0147.821] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x8c8, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0149.436] CloseHandle (hObject=0x8c8) returned 1 [0149.436] CloseHandle (hObject=0xad8) returned 1 [0149.437] CloseHandle (hObject=0xae4) returned 1 [0149.437] CloseHandle (hObject=0xae0) returned 1 [0149.437] CloseHandle (hObject=0x8d8) returned 1 [0149.437] CloseHandle (hObject=0xa2c) returned 1 [0149.437] CloseHandle (hObject=0xad4) returned 1 [0149.437] CloseHandle (hObject=0xad0) returned 1 [0149.437] CloseHandle (hObject=0xacc) returned 1 [0149.437] CloseHandle (hObject=0xac8) returned 1 [0149.437] CloseHandle (hObject=0xac4) returned 1 [0149.437] CloseHandle (hObject=0xac0) returned 1 [0149.437] CloseHandle (hObject=0xabc) returned 1 [0149.437] CloseHandle (hObject=0xab8) returned 1 [0149.437] CloseHandle (hObject=0xab4) returned 1 [0149.437] CloseHandle (hObject=0xab0) returned 1 [0149.437] CloseHandle (hObject=0xaac) returned 1 [0149.437] CloseHandle (hObject=0xaa8) returned 1 [0149.437] CloseHandle (hObject=0xaa4) returned 1 [0149.437] CloseHandle (hObject=0xaa0) returned 1 [0149.438] CloseHandle (hObject=0xa9c) returned 1 [0149.438] CloseHandle (hObject=0x3d0) returned 1 [0149.438] CloseHandle (hObject=0xa98) returned 1 [0149.438] CloseHandle (hObject=0x3dc) returned 1 [0149.438] CloseHandle (hObject=0x914) returned 1 [0149.438] CloseHandle (hObject=0x234) returned 1 [0149.438] CloseHandle (hObject=0x238) returned 1 [0149.438] CloseHandle (hObject=0x23c) returned 1 [0149.438] CloseHandle (hObject=0x240) returned 1 [0149.438] CloseHandle (hObject=0x244) returned 1 [0149.438] CloseHandle (hObject=0x248) returned 1 [0149.438] CloseHandle (hObject=0x24c) returned 1 [0149.438] CloseHandle (hObject=0x250) returned 1 [0149.438] CloseHandle (hObject=0x254) returned 1 [0149.438] CloseHandle (hObject=0x258) returned 1 [0149.438] CloseHandle (hObject=0x25c) returned 1 [0149.438] CloseHandle (hObject=0x260) returned 1 [0149.438] CloseHandle (hObject=0x264) returned 1 [0149.438] CloseHandle (hObject=0x268) returned 1 [0149.439] CloseHandle (hObject=0x26c) returned 1 [0149.439] CloseHandle (hObject=0x270) returned 1 [0149.439] CloseHandle (hObject=0x274) returned 1 [0149.439] CloseHandle (hObject=0x278) returned 1 [0149.439] CloseHandle (hObject=0x27c) returned 1 [0149.439] CloseHandle (hObject=0x280) returned 1 [0149.439] CloseHandle (hObject=0x284) returned 1 [0149.439] CloseHandle (hObject=0x344) returned 1 [0149.439] CloseHandle (hObject=0x83c) returned 1 [0149.439] CloseHandle (hObject=0x838) returned 1 [0149.439] CloseHandle (hObject=0x834) returned 1 [0149.439] CloseHandle (hObject=0x830) returned 1 [0149.439] CloseHandle (hObject=0x82c) returned 1 [0149.439] CloseHandle (hObject=0x828) returned 1 [0149.439] CloseHandle (hObject=0x824) returned 1 [0149.439] CloseHandle (hObject=0x820) returned 1 [0149.439] CloseHandle (hObject=0x81c) returned 1 [0149.439] CloseHandle (hObject=0x818) returned 1 [0149.439] CloseHandle (hObject=0x814) returned 1 [0149.439] CloseHandle (hObject=0x748) returned 1 [0149.440] CloseHandle (hObject=0x744) returned 1 [0149.440] CloseHandle (hObject=0x8d0) returned 1 [0149.440] CloseHandle (hObject=0x418) returned 1 [0149.440] CloseHandle (hObject=0x338) returned 1 [0149.440] CloseHandle (hObject=0x334) returned 1 [0149.440] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1027 os_tid = 0x15b8 [0147.759] GetLastError () returned 0x57 [0147.759] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1440 [0147.759] SetLastError (dwErrCode=0x57) [0147.759] IcmpCreateFile () returned 0x7289b0 [0147.889] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b9b8 [0147.889] IcmpSendEcho2 (in: IcmpHandle=0x7289b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8100a8c0, RequestData=0xfdff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b9b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b9b8) returned 0x0 [0166.593] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b9b8 | out: hHeap=0x710000) returned 1 [0166.593] IcmpCloseHandle (IcmpHandle=0x7289b0) returned 1 [0166.594] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f1440 | out: hHeap=0x710000) returned 1 Thread: id = 1028 os_tid = 0xddc [0147.760] GetLastError () returned 0x57 [0147.760] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f17c8 [0147.760] SetLastError (dwErrCode=0x57) [0147.760] IcmpCreateFile () returned 0x728a58 [0147.823] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de28 [0147.823] IcmpSendEcho2 (in: IcmpHandle=0x728a58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8200a8c0, RequestData=0x111ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de28) returned 0x0 [0148.039] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de28 | out: hHeap=0x710000) returned 1 [0148.039] IcmpCloseHandle (IcmpHandle=0x728a58) returned 1 [0148.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f17c8 | out: hHeap=0x710000) returned 1 Thread: id = 1029 os_tid = 0x15bc [0147.761] GetLastError () returned 0x57 [0147.761] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1b50 [0147.761] SetLastError (dwErrCode=0x57) [0147.761] IcmpCreateFile () returned 0x728a90 [0147.889] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b968 [0147.889] IcmpSendEcho2 (in: IcmpHandle=0x728a90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8300a8c0, RequestData=0x125ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b968, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b968) returned 0x0 [0166.591] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b968 | out: hHeap=0x710000) returned 1 [0166.591] IcmpCloseHandle (IcmpHandle=0x728a90) returned 1 [0166.591] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f1b50 | out: hHeap=0x710000) returned 1 Thread: id = 1030 os_tid = 0x15c0 [0147.761] GetLastError () returned 0x57 [0147.761] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0298 [0147.761] SetLastError (dwErrCode=0x57) [0147.761] IcmpCreateFile () returned 0x728ac8 [0147.888] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b918 [0147.888] IcmpSendEcho2 (in: IcmpHandle=0x728ac8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8400a8c0, RequestData=0xb04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b918, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b918) returned 0x0 [0166.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b918 | out: hHeap=0x710000) returned 1 [0166.588] IcmpCloseHandle (IcmpHandle=0x728ac8) returned 1 [0166.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f0298 | out: hHeap=0x710000) returned 1 Thread: id = 1031 os_tid = 0x15c4 [0147.762] GetLastError () returned 0x57 [0147.762] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0620 [0147.762] SetLastError (dwErrCode=0x57) [0147.762] IcmpCreateFile () returned 0x728b00 [0147.887] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b8c8 [0147.887] IcmpSendEcho2 (in: IcmpHandle=0x728b00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8500a8c0, RequestData=0xb14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b8c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b8c8) returned 0x0 [0166.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b8c8 | out: hHeap=0x710000) returned 1 [0166.503] IcmpCloseHandle (IcmpHandle=0x728b00) returned 1 [0166.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f0620 | out: hHeap=0x710000) returned 1 Thread: id = 1032 os_tid = 0x15c8 [0147.762] GetLastError () returned 0x57 [0147.762] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f09a8 [0147.763] SetLastError (dwErrCode=0x57) [0147.763] IcmpCreateFile () returned 0x728b38 [0147.886] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b878 [0147.886] IcmpSendEcho2 (in: IcmpHandle=0x728b38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8600a8c0, RequestData=0xb24ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b878, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b878) returned 0x0 [0166.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b878 | out: hHeap=0x710000) returned 1 [0166.491] IcmpCloseHandle (IcmpHandle=0x728b38) returned 1 [0166.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f09a8 | out: hHeap=0x710000) returned 1 Thread: id = 1033 os_tid = 0x15cc [0147.763] GetLastError () returned 0x57 [0147.763] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0d30 [0147.763] SetLastError (dwErrCode=0x57) [0147.763] IcmpCreateFile () returned 0x728ba8 [0147.885] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b828 [0147.885] IcmpSendEcho2 (in: IcmpHandle=0x728ba8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8700a8c0, RequestData=0xb38ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b828, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b828) returned 0x0 [0166.482] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b828 | out: hHeap=0x710000) returned 1 [0166.482] IcmpCloseHandle (IcmpHandle=0x728ba8) returned 1 [0166.482] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f0d30 | out: hHeap=0x710000) returned 1 Thread: id = 1034 os_tid = 0x15d4 [0147.764] GetLastError () returned 0x57 [0147.764] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f10b8 [0147.764] SetLastError (dwErrCode=0x57) [0147.764] IcmpCreateFile () returned 0x728c18 [0147.884] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b7d8 [0147.884] IcmpSendEcho2 (in: IcmpHandle=0x728c18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8800a8c0, RequestData=0xb4cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b7d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b7d8) returned 0x0 [0166.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b7d8 | out: hHeap=0x710000) returned 1 [0166.378] IcmpCloseHandle (IcmpHandle=0x728c18) returned 1 [0166.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f10b8 | out: hHeap=0x710000) returned 1 Thread: id = 1035 os_tid = 0x15d8 [0147.764] GetLastError () returned 0x57 [0147.764] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6738 [0147.764] SetLastError (dwErrCode=0x57) [0147.764] IcmpCreateFile () returned 0x728cc0 [0147.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b788 [0147.881] IcmpSendEcho2 (in: IcmpHandle=0x728cc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8900a8c0, RequestData=0xb60ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b788, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b788) returned 0x0 [0166.158] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b788 | out: hHeap=0x710000) returned 1 [0166.158] IcmpCloseHandle (IcmpHandle=0x728cc0) returned 1 [0166.159] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6738 | out: hHeap=0x710000) returned 1 Thread: id = 1036 os_tid = 0x15dc [0147.765] GetLastError () returned 0x57 [0147.765] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6ac0 [0147.765] SetLastError (dwErrCode=0x57) [0147.765] IcmpCreateFile () returned 0x728cf8 [0147.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b738 [0147.880] IcmpSendEcho2 (in: IcmpHandle=0x728cf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8a00a8c0, RequestData=0xb74ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b738, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b738) returned 0x0 [0164.909] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b738 | out: hHeap=0x710000) returned 1 [0164.909] IcmpCloseHandle (IcmpHandle=0x728cf8) returned 1 [0164.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6ac0 | out: hHeap=0x710000) returned 1 Thread: id = 1037 os_tid = 0x15e0 [0147.765] GetLastError () returned 0x57 [0147.766] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6e48 [0147.766] SetLastError (dwErrCode=0x57) [0147.766] IcmpCreateFile () returned 0x728d30 [0147.879] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b6e8 [0147.879] IcmpSendEcho2 (in: IcmpHandle=0x728d30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8b00a8c0, RequestData=0xb88ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b6e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b6e8) returned 0x0 [0162.797] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b6e8 | out: hHeap=0x710000) returned 1 [0162.797] IcmpCloseHandle (IcmpHandle=0x728d30) returned 1 [0162.798] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6e48 | out: hHeap=0x710000) returned 1 Thread: id = 1038 os_tid = 0x15e4 [0147.766] GetLastError () returned 0x57 [0147.766] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e71d0 [0147.766] SetLastError (dwErrCode=0x57) [0147.766] IcmpCreateFile () returned 0x728d68 [0147.879] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b698 [0147.879] IcmpSendEcho2 (in: IcmpHandle=0x728d68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8c00a8c0, RequestData=0xb9cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b698, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b698) returned 0x0 [0161.179] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b698 | out: hHeap=0x710000) returned 1 [0161.179] IcmpCloseHandle (IcmpHandle=0x728d68) returned 1 [0161.180] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e71d0 | out: hHeap=0x710000) returned 1 Thread: id = 1039 os_tid = 0x15e8 [0147.767] GetLastError () returned 0x57 [0147.767] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7558 [0147.767] SetLastError (dwErrCode=0x57) [0147.767] IcmpCreateFile () returned 0x728da0 [0147.878] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b648 [0147.878] IcmpSendEcho2 (in: IcmpHandle=0x728da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8d00a8c0, RequestData=0xbb0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b648, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b648) returned 0x0 [0160.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b648 | out: hHeap=0x710000) returned 1 [0160.602] IcmpCloseHandle (IcmpHandle=0x728da0) returned 1 [0160.603] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7558 | out: hHeap=0x710000) returned 1 Thread: id = 1040 os_tid = 0x15ec [0147.767] GetLastError () returned 0x57 [0147.767] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e78e0 [0147.768] SetLastError (dwErrCode=0x57) [0147.768] IcmpCreateFile () returned 0x7286d8 [0147.877] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b5f8 [0147.877] IcmpSendEcho2 (in: IcmpHandle=0x7286d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8e00a8c0, RequestData=0xbc4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b5f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b5f8) returned 0x0 [0160.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b5f8 | out: hHeap=0x710000) returned 1 [0160.546] IcmpCloseHandle (IcmpHandle=0x7286d8) returned 1 [0160.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e78e0 | out: hHeap=0x710000) returned 1 Thread: id = 1041 os_tid = 0x15f0 [0147.768] GetLastError () returned 0x57 [0147.768] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7c68 [0147.768] SetLastError (dwErrCode=0x57) [0147.768] IcmpCreateFile () returned 0x728748 [0147.876] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b5a8 [0147.876] IcmpSendEcho2 (in: IcmpHandle=0x728748, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8f00a8c0, RequestData=0xbd8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b5a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b5a8) returned 0x0 [0160.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b5a8 | out: hHeap=0x710000) returned 1 [0160.542] IcmpCloseHandle (IcmpHandle=0x728748) returned 1 [0160.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7c68 | out: hHeap=0x710000) returned 1 Thread: id = 1042 os_tid = 0x15f4 [0147.771] GetLastError () returned 0x57 [0147.771] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7ff0 [0147.771] SetLastError (dwErrCode=0x57) [0147.771] IcmpCreateFile () returned 0x728780 [0147.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b558 [0147.875] IcmpSendEcho2 (in: IcmpHandle=0x728780, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9000a8c0, RequestData=0xbecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b558, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b558) returned 0x0 [0160.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b558 | out: hHeap=0x710000) returned 1 [0160.536] IcmpCloseHandle (IcmpHandle=0x728780) returned 1 [0160.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e7ff0 | out: hHeap=0x710000) returned 1 Thread: id = 1043 os_tid = 0x15f8 [0147.772] GetLastError () returned 0x57 [0147.772] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8378 [0147.772] SetLastError (dwErrCode=0x57) [0147.772] IcmpCreateFile () returned 0x7287b8 [0147.874] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b508 [0147.874] IcmpSendEcho2 (in: IcmpHandle=0x7287b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9100a8c0, RequestData=0xc00ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b508, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b508) returned 0x0 [0160.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b508 | out: hHeap=0x710000) returned 1 [0160.531] IcmpCloseHandle (IcmpHandle=0x7287b8) returned 1 [0160.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8378 | out: hHeap=0x710000) returned 1 Thread: id = 1044 os_tid = 0x15fc [0147.772] GetLastError () returned 0x57 [0147.772] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8700 [0147.772] SetLastError (dwErrCode=0x57) [0147.773] IcmpCreateFile () returned 0x728828 [0147.873] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b4b8 [0147.873] IcmpSendEcho2 (in: IcmpHandle=0x728828, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9200a8c0, RequestData=0xc14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b4b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b4b8) returned 0x0 [0160.525] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b4b8 | out: hHeap=0x710000) returned 1 [0160.525] IcmpCloseHandle (IcmpHandle=0x728828) returned 1 [0160.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8700 | out: hHeap=0x710000) returned 1 Thread: id = 1045 os_tid = 0x1600 [0147.773] GetLastError () returned 0x57 [0147.773] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8a88 [0147.773] SetLastError (dwErrCode=0x57) [0147.773] IcmpCreateFile () returned 0x728860 [0147.872] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b468 [0147.873] IcmpSendEcho2 (in: IcmpHandle=0x728860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9300a8c0, RequestData=0xc28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b468, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b468) returned 0x0 [0160.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b468 | out: hHeap=0x710000) returned 1 [0160.521] IcmpCloseHandle (IcmpHandle=0x728860) returned 1 [0160.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8a88 | out: hHeap=0x710000) returned 1 Thread: id = 1046 os_tid = 0x1604 [0147.774] GetLastError () returned 0x57 [0147.774] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8e10 [0147.774] SetLastError (dwErrCode=0x57) [0147.774] IcmpCreateFile () returned 0x728898 [0147.871] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b418 [0147.871] IcmpSendEcho2 (in: IcmpHandle=0x728898, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9400a8c0, RequestData=0xc3cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b418, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b418) returned 0x0 [0160.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b418 | out: hHeap=0x710000) returned 1 [0160.515] IcmpCloseHandle (IcmpHandle=0x728898) returned 1 [0160.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e8e10 | out: hHeap=0x710000) returned 1 Thread: id = 1047 os_tid = 0x1608 [0147.774] GetLastError () returned 0x57 [0147.774] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2098 [0147.775] SetLastError (dwErrCode=0x57) [0147.775] IcmpCreateFile () returned 0x7288d0 [0147.870] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b3c8 [0147.870] IcmpSendEcho2 (in: IcmpHandle=0x7288d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9500a8c0, RequestData=0xc50ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b3c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b3c8) returned 0x0 [0160.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b3c8 | out: hHeap=0x710000) returned 1 [0160.511] IcmpCloseHandle (IcmpHandle=0x7288d0) returned 1 [0160.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2098 | out: hHeap=0x710000) returned 1 Thread: id = 1048 os_tid = 0x160c [0147.775] GetLastError () returned 0x57 [0147.775] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2420 [0147.775] SetLastError (dwErrCode=0x57) [0147.775] IcmpCreateFile () returned 0x728908 [0147.869] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b378 [0147.870] IcmpSendEcho2 (in: IcmpHandle=0x728908, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9600a8c0, RequestData=0xc64ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b378, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b378) returned 0x0 [0160.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b378 | out: hHeap=0x710000) returned 1 [0160.505] IcmpCloseHandle (IcmpHandle=0x728908) returned 1 [0160.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2420 | out: hHeap=0x710000) returned 1 Thread: id = 1049 os_tid = 0x1610 [0147.776] GetLastError () returned 0x57 [0147.776] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e27a8 [0147.776] SetLastError (dwErrCode=0x57) [0147.776] IcmpCreateFile () returned 0x728940 [0147.868] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b328 [0147.869] IcmpSendEcho2 (in: IcmpHandle=0x728940, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9700a8c0, RequestData=0xc78ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b328, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76b328) returned 0x0 [0160.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76b328 | out: hHeap=0x710000) returned 1 [0160.500] IcmpCloseHandle (IcmpHandle=0x728940) returned 1 [0160.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e27a8 | out: hHeap=0x710000) returned 1 Thread: id = 1050 os_tid = 0x1614 [0147.776] GetLastError () returned 0x57 [0147.776] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2b30 [0147.777] SetLastError (dwErrCode=0x57) [0147.777] IcmpCreateFile () returned 0x728978 [0147.867] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bcd8 [0147.867] IcmpSendEcho2 (in: IcmpHandle=0x728978, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9800a8c0, RequestData=0xc8cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bcd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bcd8) returned 0x0 [0160.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bcd8 | out: hHeap=0x710000) returned 1 [0160.493] IcmpCloseHandle (IcmpHandle=0x728978) returned 1 [0160.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2b30 | out: hHeap=0x710000) returned 1 Thread: id = 1051 os_tid = 0x1618 [0147.777] GetLastError () returned 0x57 [0147.777] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2eb8 [0147.777] SetLastError (dwErrCode=0x57) [0147.777] IcmpCreateFile () returned 0x728e10 [0147.866] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c228 [0147.866] IcmpSendEcho2 (in: IcmpHandle=0x728e10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9900a8c0, RequestData=0xca0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c228, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c228) returned 0x0 [0160.441] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c228 | out: hHeap=0x710000) returned 1 [0160.441] IcmpCloseHandle (IcmpHandle=0x728e10) returned 1 [0160.441] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e2eb8 | out: hHeap=0x710000) returned 1 Thread: id = 1052 os_tid = 0x161c [0147.778] GetLastError () returned 0x57 [0147.778] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3240 [0147.778] SetLastError (dwErrCode=0x57) [0147.778] IcmpCreateFile () returned 0x728e48 [0147.865] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c1d8 [0147.865] IcmpSendEcho2 (in: IcmpHandle=0x728e48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9a00a8c0, RequestData=0xcb4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c1d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c1d8) returned 0x0 [0160.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c1d8 | out: hHeap=0x710000) returned 1 [0160.305] IcmpCloseHandle (IcmpHandle=0x728e48) returned 1 [0160.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3240 | out: hHeap=0x710000) returned 1 Thread: id = 1053 os_tid = 0x1620 [0147.778] GetLastError () returned 0x57 [0147.778] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e35c8 [0147.778] SetLastError (dwErrCode=0x57) [0147.778] IcmpCreateFile () returned 0x728dd8 [0147.864] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c188 [0147.864] IcmpSendEcho2 (in: IcmpHandle=0x728dd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9b00a8c0, RequestData=0xcc8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c188, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c188) returned 0x0 [0160.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c188 | out: hHeap=0x710000) returned 1 [0160.301] IcmpCloseHandle (IcmpHandle=0x728dd8) returned 1 [0160.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e35c8 | out: hHeap=0x710000) returned 1 Thread: id = 1054 os_tid = 0x1624 [0147.779] GetLastError () returned 0x57 [0147.779] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3950 [0147.779] SetLastError (dwErrCode=0x57) [0147.779] IcmpCreateFile () returned 0x74efb0 [0147.863] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c138 [0147.863] IcmpSendEcho2 (in: IcmpHandle=0x74efb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9c00a8c0, RequestData=0xcdcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c138, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c138) returned 0x0 [0160.293] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c138 | out: hHeap=0x710000) returned 1 [0160.293] IcmpCloseHandle (IcmpHandle=0x74efb0) returned 1 [0160.294] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3950 | out: hHeap=0x710000) returned 1 Thread: id = 1055 os_tid = 0x1628 [0147.779] GetLastError () returned 0x57 [0147.780] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3cd8 [0147.780] SetLastError (dwErrCode=0x57) [0147.780] IcmpCreateFile () returned 0x74efe8 [0147.862] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c0e8 [0147.862] IcmpSendEcho2 (in: IcmpHandle=0x74efe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9d00a8c0, RequestData=0xcf0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c0e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c0e8) returned 0x0 [0160.289] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c0e8 | out: hHeap=0x710000) returned 1 [0160.289] IcmpCloseHandle (IcmpHandle=0x74efe8) returned 1 [0160.290] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e3cd8 | out: hHeap=0x710000) returned 1 Thread: id = 1056 os_tid = 0x162c [0147.780] GetLastError () returned 0x57 [0147.780] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4060 [0147.780] SetLastError (dwErrCode=0x57) [0147.780] IcmpCreateFile () returned 0x74f020 [0147.861] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c098 [0147.861] IcmpSendEcho2 (in: IcmpHandle=0x74f020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9e00a8c0, RequestData=0xd04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c098, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c098) returned 0x0 [0160.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c098 | out: hHeap=0x710000) returned 1 [0160.285] IcmpCloseHandle (IcmpHandle=0x74f020) returned 1 [0160.286] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4060 | out: hHeap=0x710000) returned 1 Thread: id = 1057 os_tid = 0x1630 [0147.781] GetLastError () returned 0x57 [0147.781] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e43e8 [0147.781] SetLastError (dwErrCode=0x57) [0147.781] IcmpCreateFile () returned 0x74f058 [0147.858] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c048 [0147.858] IcmpSendEcho2 (in: IcmpHandle=0x74f058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9f00a8c0, RequestData=0xd18ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c048, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c048) returned 0x0 [0160.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c048 | out: hHeap=0x710000) returned 1 [0160.278] IcmpCloseHandle (IcmpHandle=0x74f058) returned 1 [0160.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e43e8 | out: hHeap=0x710000) returned 1 Thread: id = 1058 os_tid = 0x1634 [0147.781] GetLastError () returned 0x57 [0147.781] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4770 [0147.782] SetLastError (dwErrCode=0x57) [0147.782] IcmpCreateFile () returned 0x74f090 [0147.857] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bff8 [0147.857] IcmpSendEcho2 (in: IcmpHandle=0x74f090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa000a8c0, RequestData=0xd2cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bff8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bff8) returned 0x0 [0160.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bff8 | out: hHeap=0x710000) returned 1 [0160.152] IcmpCloseHandle (IcmpHandle=0x74f090) returned 1 [0160.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4770 | out: hHeap=0x710000) returned 1 Thread: id = 1059 os_tid = 0x1638 [0147.782] GetLastError () returned 0x57 [0147.782] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4af8 [0147.782] SetLastError (dwErrCode=0x57) [0147.782] IcmpCreateFile () returned 0x74f0c8 [0147.856] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bfa8 [0147.856] IcmpSendEcho2 (in: IcmpHandle=0x74f0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa100a8c0, RequestData=0xd40ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bfa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bfa8) returned 0x0 [0159.909] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bfa8 | out: hHeap=0x710000) returned 1 [0159.909] IcmpCloseHandle (IcmpHandle=0x74f0c8) returned 1 [0159.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4af8 | out: hHeap=0x710000) returned 1 Thread: id = 1060 os_tid = 0x163c [0147.783] GetLastError () returned 0x57 [0147.783] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4e80 [0147.783] SetLastError (dwErrCode=0x57) [0147.783] IcmpCreateFile () returned 0x74f100 [0147.855] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf58 [0147.855] IcmpSendEcho2 (in: IcmpHandle=0x74f100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa200a8c0, RequestData=0xd54ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bf58) returned 0x0 [0159.900] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bf58 | out: hHeap=0x710000) returned 1 [0159.900] IcmpCloseHandle (IcmpHandle=0x74f100) returned 1 [0159.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e4e80 | out: hHeap=0x710000) returned 1 Thread: id = 1061 os_tid = 0x1640 [0147.783] GetLastError () returned 0x57 [0147.783] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5208 [0147.784] SetLastError (dwErrCode=0x57) [0147.784] IcmpCreateFile () returned 0x74f138 [0147.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf08 [0147.854] IcmpSendEcho2 (in: IcmpHandle=0x74f138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa300a8c0, RequestData=0xd68ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bf08) returned 0x0 [0159.607] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bf08 | out: hHeap=0x710000) returned 1 [0159.607] IcmpCloseHandle (IcmpHandle=0x74f138) returned 1 [0159.608] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5208 | out: hHeap=0x710000) returned 1 Thread: id = 1062 os_tid = 0x1644 [0147.784] GetLastError () returned 0x57 [0147.784] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5590 [0147.784] SetLastError (dwErrCode=0x57) [0147.784] IcmpCreateFile () returned 0x74f170 [0147.853] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76beb8 [0147.853] IcmpSendEcho2 (in: IcmpHandle=0x74f170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa400a8c0, RequestData=0xd7cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76beb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76beb8) returned 0x0 [0159.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76beb8 | out: hHeap=0x710000) returned 1 [0159.600] IcmpCloseHandle (IcmpHandle=0x74f170) returned 1 [0159.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5590 | out: hHeap=0x710000) returned 1 Thread: id = 1063 os_tid = 0x1648 [0147.785] GetLastError () returned 0x57 [0147.785] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5918 [0147.785] SetLastError (dwErrCode=0x57) [0147.785] IcmpCreateFile () returned 0x74f1a8 [0147.852] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be68 [0147.852] IcmpSendEcho2 (in: IcmpHandle=0x74f1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa500a8c0, RequestData=0xd90ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76be68) returned 0x0 [0159.595] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76be68 | out: hHeap=0x710000) returned 1 [0159.596] IcmpCloseHandle (IcmpHandle=0x74f1a8) returned 1 [0159.596] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5918 | out: hHeap=0x710000) returned 1 Thread: id = 1064 os_tid = 0x164c [0147.785] GetLastError () returned 0x57 [0147.785] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5ca0 [0147.785] SetLastError (dwErrCode=0x57) [0147.785] IcmpCreateFile () returned 0x74f1e0 [0147.851] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be18 [0147.851] IcmpSendEcho2 (in: IcmpHandle=0x74f1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa600a8c0, RequestData=0xda4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76be18) returned 0x0 [0159.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76be18 | out: hHeap=0x710000) returned 1 [0159.590] IcmpCloseHandle (IcmpHandle=0x74f1e0) returned 1 [0159.591] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e5ca0 | out: hHeap=0x710000) returned 1 Thread: id = 1065 os_tid = 0x1650 [0147.786] GetLastError () returned 0x57 [0147.786] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6028 [0147.786] SetLastError (dwErrCode=0x57) [0147.786] IcmpCreateFile () returned 0x74f218 [0147.850] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bdc8 [0147.850] IcmpSendEcho2 (in: IcmpHandle=0x74f218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa700a8c0, RequestData=0xdb8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bdc8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bdc8) returned 0x0 [0159.586] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bdc8 | out: hHeap=0x710000) returned 1 [0159.586] IcmpCloseHandle (IcmpHandle=0x74f218) returned 1 [0159.587] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e6028 | out: hHeap=0x710000) returned 1 Thread: id = 1066 os_tid = 0x1654 [0147.786] GetLastError () returned 0x57 [0147.787] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e63b0 [0147.787] SetLastError (dwErrCode=0x57) [0147.787] IcmpCreateFile () returned 0x74f250 [0147.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd28 [0147.847] IcmpSendEcho2 (in: IcmpHandle=0x74f250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa800a8c0, RequestData=0xdccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bd28) returned 0x0 [0159.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bd28 | out: hHeap=0x710000) returned 1 [0159.572] IcmpCloseHandle (IcmpHandle=0x74f250) returned 1 [0159.573] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e63b0 | out: hHeap=0x710000) returned 1 Thread: id = 1067 os_tid = 0x1658 [0147.787] GetLastError () returned 0x57 [0147.787] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed838 [0147.787] SetLastError (dwErrCode=0x57) [0147.787] IcmpCreateFile () returned 0x74f368 [0147.846] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c278 [0147.846] IcmpSendEcho2 (in: IcmpHandle=0x74f368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa900a8c0, RequestData=0xde0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c278, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76c278) returned 0x0 [0159.565] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76c278 | out: hHeap=0x710000) returned 1 [0159.565] IcmpCloseHandle (IcmpHandle=0x74f368) returned 1 [0159.566] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ed838 | out: hHeap=0x710000) returned 1 Thread: id = 1068 os_tid = 0x165c [0147.788] GetLastError () returned 0x57 [0147.788] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edbc0 [0147.788] SetLastError (dwErrCode=0x57) [0147.788] IcmpCreateFile () returned 0x74f3a0 [0147.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd78 [0147.845] IcmpSendEcho2 (in: IcmpHandle=0x74f3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaa00a8c0, RequestData=0xdf4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bd78) returned 0x0 [0158.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bd78 | out: hHeap=0x710000) returned 1 [0158.910] IcmpCloseHandle (IcmpHandle=0x74f3a0) returned 1 [0158.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6edbc0 | out: hHeap=0x710000) returned 1 Thread: id = 1069 os_tid = 0x1660 [0147.788] GetLastError () returned 0x57 [0147.788] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edf48 [0147.789] SetLastError (dwErrCode=0x57) [0147.789] IcmpCreateFile () returned 0x74ecd8 [0147.844] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73ddd8 [0147.844] IcmpSendEcho2 (in: IcmpHandle=0x74ecd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xab00a8c0, RequestData=0xe08ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73ddd8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73ddd8) returned 0x0 [0158.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73ddd8 | out: hHeap=0x710000) returned 1 [0158.337] IcmpCloseHandle (IcmpHandle=0x74ecd8) returned 1 [0158.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6edf48 | out: hHeap=0x710000) returned 1 Thread: id = 1070 os_tid = 0x1664 [0147.792] GetLastError () returned 0x57 [0147.792] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee2d0 [0147.792] SetLastError (dwErrCode=0x57) [0147.792] IcmpCreateFile () returned 0x74ed10 [0147.843] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dd38 [0147.843] IcmpSendEcho2 (in: IcmpHandle=0x74ed10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xac00a8c0, RequestData=0xe1cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dd38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dd38) returned 0x0 [0157.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dd38 | out: hHeap=0x710000) returned 1 [0157.727] IcmpCloseHandle (IcmpHandle=0x74ed10) returned 1 [0157.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee2d0 | out: hHeap=0x710000) returned 1 Thread: id = 1071 os_tid = 0x1668 [0147.792] GetLastError () returned 0x57 [0147.793] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee658 [0147.793] SetLastError (dwErrCode=0x57) [0147.793] IcmpCreateFile () returned 0x74ed48 [0147.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dce8 [0147.842] IcmpSendEcho2 (in: IcmpHandle=0x74ed48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xad00a8c0, RequestData=0xe30ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dce8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dce8) returned 0x0 [0157.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dce8 | out: hHeap=0x710000) returned 1 [0157.056] IcmpCloseHandle (IcmpHandle=0x74ed48) returned 1 [0157.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee658 | out: hHeap=0x710000) returned 1 Thread: id = 1072 os_tid = 0x166c [0147.793] GetLastError () returned 0x57 [0147.793] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee9e0 [0147.793] SetLastError (dwErrCode=0x57) [0147.793] IcmpCreateFile () returned 0x74ed80 [0147.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc98 [0147.841] IcmpSendEcho2 (in: IcmpHandle=0x74ed80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xae00a8c0, RequestData=0xe44ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dc98) returned 0x0 [0156.579] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dc98 | out: hHeap=0x710000) returned 1 [0156.579] IcmpCloseHandle (IcmpHandle=0x74ed80) returned 1 [0156.580] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ee9e0 | out: hHeap=0x710000) returned 1 Thread: id = 1073 os_tid = 0x1670 [0147.794] GetLastError () returned 0x57 [0147.794] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eed68 [0147.794] SetLastError (dwErrCode=0x57) [0147.794] IcmpCreateFile () returned 0x74edb8 [0147.840] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dbf8 [0147.840] IcmpSendEcho2 (in: IcmpHandle=0x74edb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaf00a8c0, RequestData=0xe58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dbf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dbf8) returned 0x0 [0156.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dbf8 | out: hHeap=0x710000) returned 1 [0156.381] IcmpCloseHandle (IcmpHandle=0x74edb8) returned 1 [0156.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eed68 | out: hHeap=0x710000) returned 1 Thread: id = 1074 os_tid = 0x1674 [0147.794] GetLastError () returned 0x57 [0147.794] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef0f0 [0147.795] SetLastError (dwErrCode=0x57) [0147.795] IcmpCreateFile () returned 0x74edf0 [0147.839] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dba8 [0147.839] IcmpSendEcho2 (in: IcmpHandle=0x74edf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb000a8c0, RequestData=0xe6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dba8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dba8) returned 0x0 [0155.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dba8 | out: hHeap=0x710000) returned 1 [0155.940] IcmpCloseHandle (IcmpHandle=0x74edf0) returned 1 [0155.941] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef0f0 | out: hHeap=0x710000) returned 1 Thread: id = 1075 os_tid = 0x1678 [0147.795] GetLastError () returned 0x57 [0147.795] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef478 [0147.795] SetLastError (dwErrCode=0x57) [0147.795] IcmpCreateFile () returned 0x74ee28 [0147.836] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73db08 [0147.836] IcmpSendEcho2 (in: IcmpHandle=0x74ee28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb100a8c0, RequestData=0xe80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73db08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73db08) returned 0x0 [0155.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73db08 | out: hHeap=0x710000) returned 1 [0155.237] IcmpCloseHandle (IcmpHandle=0x74ee28) returned 1 [0155.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef478 | out: hHeap=0x710000) returned 1 Thread: id = 1076 os_tid = 0x167c [0147.796] GetLastError () returned 0x57 [0147.796] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef800 [0147.796] SetLastError (dwErrCode=0x57) [0147.796] IcmpCreateFile () returned 0x74ee60 [0147.835] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dab8 [0147.835] IcmpSendEcho2 (in: IcmpHandle=0x74ee60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb200a8c0, RequestData=0xe94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dab8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dab8) returned 0x0 [0154.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dab8 | out: hHeap=0x710000) returned 1 [0154.588] IcmpCloseHandle (IcmpHandle=0x74ee60) returned 1 [0154.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ef800 | out: hHeap=0x710000) returned 1 Thread: id = 1077 os_tid = 0x1680 [0147.796] GetLastError () returned 0x57 [0147.796] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6efb88 [0147.796] SetLastError (dwErrCode=0x57) [0147.796] IcmpCreateFile () returned 0x74ee98 [0147.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e238 [0147.835] IcmpSendEcho2 (in: IcmpHandle=0x74ee98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb300a8c0, RequestData=0xea8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e238, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e238) returned 0x0 [0154.028] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e238 | out: hHeap=0x710000) returned 1 [0154.028] IcmpCloseHandle (IcmpHandle=0x74ee98) returned 1 [0154.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6efb88 | out: hHeap=0x710000) returned 1 Thread: id = 1078 os_tid = 0x1684 [0147.797] GetLastError () returned 0x57 [0147.797] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eff10 [0147.797] SetLastError (dwErrCode=0x57) [0147.797] IcmpCreateFile () returned 0x74eed0 [0147.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e1e8 [0147.834] IcmpSendEcho2 (in: IcmpHandle=0x74eed0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb500a8c0, RequestData=0xebcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e1e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e1e8) returned 0x0 [0153.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e1e8 | out: hHeap=0x710000) returned 1 [0153.601] IcmpCloseHandle (IcmpHandle=0x74eed0) returned 1 [0153.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eff10 | out: hHeap=0x710000) returned 1 Thread: id = 1079 os_tid = 0x1688 [0147.798] GetLastError () returned 0x57 [0147.798] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9198 [0147.798] SetLastError (dwErrCode=0x57) [0147.798] IcmpCreateFile () returned 0x74ef08 [0147.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e198 [0147.833] IcmpSendEcho2 (in: IcmpHandle=0x74ef08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb600a8c0, RequestData=0xed0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e198, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e198) returned 0x0 [0153.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e198 | out: hHeap=0x710000) returned 1 [0153.499] IcmpCloseHandle (IcmpHandle=0x74ef08) returned 1 [0153.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9198 | out: hHeap=0x710000) returned 1 Thread: id = 1080 os_tid = 0x168c [0147.798] GetLastError () returned 0x57 [0147.798] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9520 [0147.798] SetLastError (dwErrCode=0x57) [0147.798] IcmpCreateFile () returned 0x74ef40 [0147.832] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e148 [0147.832] IcmpSendEcho2 (in: IcmpHandle=0x74ef40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb700a8c0, RequestData=0xee4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e148, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e148) returned 0x0 [0152.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e148 | out: hHeap=0x710000) returned 1 [0152.886] IcmpCloseHandle (IcmpHandle=0x74ef40) returned 1 [0152.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9520 | out: hHeap=0x710000) returned 1 Thread: id = 1081 os_tid = 0x1690 [0147.799] GetLastError () returned 0x57 [0147.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e98a8 [0147.799] SetLastError (dwErrCode=0x57) [0147.799] IcmpCreateFile () returned 0x74ef78 [0147.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e0f8 [0147.831] IcmpSendEcho2 (in: IcmpHandle=0x74ef78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb800a8c0, RequestData=0xef8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e0f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e0f8) returned 0x0 [0152.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e0f8 | out: hHeap=0x710000) returned 1 [0152.005] IcmpCloseHandle (IcmpHandle=0x74ef78) returned 1 [0152.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e98a8 | out: hHeap=0x710000) returned 1 Thread: id = 1082 os_tid = 0x1694 [0147.799] GetLastError () returned 0x57 [0147.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9c30 [0147.800] SetLastError (dwErrCode=0x57) [0147.800] IcmpCreateFile () returned 0x74f410 [0147.830] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e0a8 [0147.830] IcmpSendEcho2 (in: IcmpHandle=0x74f410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb900a8c0, RequestData=0xf0cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e0a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e0a8) returned 0x0 [0150.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e0a8 | out: hHeap=0x710000) returned 1 [0150.774] IcmpCloseHandle (IcmpHandle=0x74f410) returned 1 [0150.775] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9c30 | out: hHeap=0x710000) returned 1 Thread: id = 1083 os_tid = 0x1698 [0147.800] GetLastError () returned 0x57 [0147.800] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9fb8 [0147.800] SetLastError (dwErrCode=0x57) [0147.800] IcmpCreateFile () returned 0x74f448 [0147.829] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e058 [0147.829] IcmpSendEcho2 (in: IcmpHandle=0x74f448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xba00a8c0, RequestData=0xf20ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e058) returned 0x0 [0150.117] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e058 | out: hHeap=0x710000) returned 1 [0150.117] IcmpCloseHandle (IcmpHandle=0x74f448) returned 1 [0150.118] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9fb8 | out: hHeap=0x710000) returned 1 Thread: id = 1084 os_tid = 0x169c [0147.801] GetLastError () returned 0x57 [0147.801] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea340 [0147.801] SetLastError (dwErrCode=0x57) [0147.801] IcmpCreateFile () returned 0x74f3d8 [0147.828] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dfb8 [0147.828] IcmpSendEcho2 (in: IcmpHandle=0x74f3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbb00a8c0, RequestData=0xf34ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dfb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dfb8) returned 0x0 [0149.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dfb8 | out: hHeap=0x710000) returned 1 [0149.445] IcmpCloseHandle (IcmpHandle=0x74f3d8) returned 1 [0149.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea340 | out: hHeap=0x710000) returned 1 Thread: id = 1085 os_tid = 0x16a0 [0147.801] GetLastError () returned 0x57 [0147.801] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea6c8 [0147.802] SetLastError (dwErrCode=0x57) [0147.802] IcmpCreateFile () returned 0x75d310 [0147.825] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df68 [0147.825] IcmpSendEcho2 (in: IcmpHandle=0x75d310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbc00a8c0, RequestData=0xf48ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df68) returned 0x0 [0149.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df68 | out: hHeap=0x710000) returned 1 [0149.071] IcmpCloseHandle (IcmpHandle=0x75d310) returned 1 [0149.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea6c8 | out: hHeap=0x710000) returned 1 Thread: id = 1086 os_tid = 0x16a4 [0147.802] GetLastError () returned 0x57 [0147.802] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eaa50 [0147.802] SetLastError (dwErrCode=0x57) [0147.802] IcmpCreateFile () returned 0x75d348 [0147.824] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de78 [0147.824] IcmpSendEcho2 (in: IcmpHandle=0x75d348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbd00a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de78) returned 0x0 [0148.331] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de78 | out: hHeap=0x710000) returned 1 [0148.331] IcmpCloseHandle (IcmpHandle=0x75d348) returned 1 [0148.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eaa50 | out: hHeap=0x710000) returned 1 Thread: id = 1087 os_tid = 0x16a8 [0147.891] GetLastError () returned 0x57 [0147.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eadd8 [0147.891] SetLastError (dwErrCode=0x57) [0147.891] IcmpCreateFile () returned 0x75d428 [0147.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba08 [0147.891] IcmpSendEcho2 (in: IcmpHandle=0x75d428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbe00a8c0, RequestData=0xf70ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76ba08) returned 0x0 [0166.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76ba08 | out: hHeap=0x710000) returned 1 [0166.657] IcmpCloseHandle (IcmpHandle=0x75d428) returned 1 [0166.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eadd8 | out: hHeap=0x710000) returned 1 Thread: id = 1088 os_tid = 0x16ac [0147.895] GetLastError () returned 0x57 [0147.895] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb160 [0147.895] SetLastError (dwErrCode=0x57) [0147.895] IcmpCreateFile () returned 0x75d498 [0147.895] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba58 [0147.895] IcmpSendEcho2 (in: IcmpHandle=0x75d498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbf00a8c0, RequestData=0xf84ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76ba58) returned 0x0 [0166.754] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76ba58 | out: hHeap=0x710000) returned 1 [0166.754] IcmpCloseHandle (IcmpHandle=0x75d498) returned 1 [0166.754] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb160 | out: hHeap=0x710000) returned 1 Thread: id = 1089 os_tid = 0x16b0 [0147.897] GetLastError () returned 0x57 [0147.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb4e8 [0147.897] SetLastError (dwErrCode=0x57) [0147.898] IcmpCreateFile () returned 0x75d508 [0147.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76baa8 [0147.898] IcmpSendEcho2 (in: IcmpHandle=0x75d508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc000a8c0, RequestData=0xf98ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76baa8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76baa8) returned 0x0 [0166.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76baa8 | out: hHeap=0x710000) returned 1 [0166.776] IcmpCloseHandle (IcmpHandle=0x75d508) returned 1 [0166.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb4e8 | out: hHeap=0x710000) returned 1 Thread: id = 1090 os_tid = 0x16b4 [0147.899] GetLastError () returned 0x57 [0147.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb870 [0147.899] SetLastError (dwErrCode=0x57) [0147.899] IcmpCreateFile () returned 0x75d540 [0147.899] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76baf8 [0147.899] IcmpSendEcho2 (in: IcmpHandle=0x75d540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc100a8c0, RequestData=0xfd0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76baf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76baf8) returned 0x0 [0166.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76baf8 | out: hHeap=0x710000) returned 1 [0166.790] IcmpCloseHandle (IcmpHandle=0x75d540) returned 1 [0166.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eb870 | out: hHeap=0x710000) returned 1 Thread: id = 1091 os_tid = 0x16b8 [0148.083] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.083] ReadFile (in: hFile=0x740, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.085] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.085] ReadFile (in: hFile=0x740, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.092] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.098] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.098] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0148.098] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0148.098] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0148.099] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.099] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0148.107] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.108] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.109] WriteFile (in: hFile=0x740, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0148.109] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.109] ReadFile (in: hFile=0x740, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1377a, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x1377a, lpOverlapped=0x0) returned 1 [0148.112] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffec886, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.112] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0x1377a, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0148.112] WriteFile (in: hFile=0x740, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x13780, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x13780, lpOverlapped=0x0) returned 1 [0148.113] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0148.113] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.113] WriteFile (in: hFile=0x740, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.113] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x13780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.113] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.113] CloseHandle (hObject=0x740) returned 1 [0148.114] VirtualAlloc (lpAddress=0x0, dwSize=0xc9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PSGet.Resource.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\psget.resource.psd1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PSGet.Resource.psd1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\psget.resource.psd1.play")) returned 1 [0148.116] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1092 os_tid = 0x16bc [0148.121] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.121] ReadFile (in: hFile=0x214, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.123] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.123] ReadFile (in: hFile=0x214, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.123] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.123] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.123] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0148.123] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0148.124] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0148.124] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.124] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0148.127] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.128] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.128] WriteFile (in: hFile=0x214, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0148.128] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.128] ReadFile (in: hFile=0x214, lpBuffer=0x2850000, nNumberOfBytesToRead=0x5ac4, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xfe4f61c*=0x5ac4, lpOverlapped=0x0) returned 1 [0148.131] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xffffa53c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.132] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2850000, cbInput=0x5ac4, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xfe4f848, pbOutput=0x2850000, pcbResult=0xfe4f618) returned 0x0 [0148.132] WriteFile (in: hFile=0x214, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xfe4f61c*=0x5ad0, lpOverlapped=0x0) returned 1 [0148.132] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0148.132] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.132] WriteFile (in: hFile=0x214, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.132] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x5ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.132] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.132] CloseHandle (hObject=0x214) returned 1 [0148.133] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1.play")) returned 1 [0148.134] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1093 os_tid = 0x16c0 [0148.131] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.136] ReadFile (in: hFile=0xb20, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.137] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.137] ReadFile (in: hFile=0xb20, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.138] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.138] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.139] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xff8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0148.139] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xff8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xff8f828, pbKeyObject=0x0) returned 0x0 [0148.139] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xff8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xff8f500) returned 0x0 [0148.139] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.139] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xff8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xff8f500) returned 0x0 [0148.142] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.143] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.143] WriteFile (in: hFile=0xb20, lpBuffer=0xff8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xff8f830, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesWritten=0xff8f830*=0x428, lpOverlapped=0x0) returned 1 [0148.143] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.143] ReadFile (in: hFile=0xb20, lpBuffer=0x2950000, nNumberOfBytesToRead=0x45ce, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xff8f61c*=0x45ce, lpOverlapped=0x0) returned 1 [0148.144] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xffffba32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.144] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0x45ce, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xff8f848, pbOutput=0x2950000, pcbResult=0xff8f618) returned 0x0 [0148.144] WriteFile (in: hFile=0xb20, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xff8f61c*=0x45d0, lpOverlapped=0x0) returned 1 [0148.145] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0148.145] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.147] WriteFile (in: hFile=0xb20, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.147] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x45d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.147] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.147] CloseHandle (hObject=0xb20) returned 1 [0148.147] VirtualAlloc (lpAddress=0x0, dwSize=0xbd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml.play")) returned 1 [0148.149] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1094 os_tid = 0x16c4 [0148.137] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.138] ReadFile (in: hFile=0xb18, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0148.153] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.153] ReadFile (in: hFile=0xb18, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0148.154] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.155] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0148.156] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0148.156] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0148.156] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.157] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0148.163] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.167] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.167] WriteFile (in: hFile=0xb18, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0148.167] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.167] ReadFile (in: hFile=0xb18, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x143ce, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x100cf61c*=0x143ce, lpOverlapped=0x0) returned 1 [0148.169] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0xfffebc32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.169] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2a50000, cbInput=0x143ce, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x100cf848, pbOutput=0x2a50000, pcbResult=0x100cf618) returned 0x0 [0148.170] WriteFile (in: hFile=0xb18, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x143d0, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x100cf61c*=0x143d0, lpOverlapped=0x0) returned 1 [0148.170] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0148.170] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.170] WriteFile (in: hFile=0xb18, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0148.170] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x143d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.170] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.170] CloseHandle (hObject=0xb18) returned 1 [0148.171] VirtualAlloc (lpAddress=0x0, dwSize=0xbd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1.play")) returned 1 [0148.173] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1095 os_tid = 0x16c8 [0148.168] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.168] ReadFile (in: hFile=0xb10, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.187] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.187] ReadFile (in: hFile=0xb10, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.187] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.188] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0148.188] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0148.188] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1020f500) returned 0x0 [0148.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.188] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1020f500) returned 0x0 [0148.192] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.193] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.193] WriteFile (in: hFile=0xb10, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0148.193] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.193] ReadFile (in: hFile=0xb10, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x74ac3, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1020f61c*=0x74ac3, lpOverlapped=0x0) returned 1 [0148.202] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfff8b53d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.202] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2b50000, cbInput=0x74ac3, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1020f848, pbOutput=0x2b50000, pcbResult=0x1020f618) returned 0x0 [0148.203] WriteFile (in: hFile=0xb10, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x74ad0, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1020f61c*=0x74ad0, lpOverlapped=0x0) returned 1 [0148.204] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0148.204] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.204] WriteFile (in: hFile=0xb10, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.204] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x74ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.204] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.205] CloseHandle (hObject=0xb10) returned 1 [0148.205] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0148.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1.play")) returned 1 [0148.206] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1096 os_tid = 0x16cc [0148.197] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.208] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.208] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0148.208] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0148.208] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0148.208] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.208] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0148.216] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.217] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.217] WriteFile (in: hFile=0xb08, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0148.222] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.222] ReadFile (in: hFile=0xb08, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x2e1, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1034f61c*=0x2e1, lpOverlapped=0x0) returned 1 [0148.222] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0xfffffd1f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.222] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2c50000, cbInput=0x2e1, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1034f848, pbOutput=0x2c50000, pcbResult=0x1034f618) returned 0x0 [0148.222] WriteFile (in: hFile=0xb08, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1034f61c*=0x2f0, lpOverlapped=0x0) returned 1 [0148.222] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0148.222] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.222] WriteFile (in: hFile=0xb08, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.223] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.223] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.223] CloseHandle (hObject=0xb08) returned 1 [0148.223] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1.play")) returned 1 [0148.225] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1097 os_tid = 0x16d0 [0148.229] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.230] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.230] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0148.230] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0148.230] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0148.230] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.230] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0148.236] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.237] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.237] WriteFile (in: hFile=0xb00, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0148.242] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.242] ReadFile (in: hFile=0xb00, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1048f61c*=0xb4, lpOverlapped=0x0) returned 1 [0148.242] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xffffff4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.242] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2d50000, cbInput=0xb4, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1048f848, pbOutput=0x2d50000, pcbResult=0x1048f618) returned 0x0 [0148.242] WriteFile (in: hFile=0xb00, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1048f61c*=0xc0, lpOverlapped=0x0) returned 1 [0148.242] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0148.242] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.243] WriteFile (in: hFile=0xb00, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.243] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.243] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.243] CloseHandle (hObject=0xb00) returned 1 [0148.243] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psm1"), lpNewFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psm1.PLAY" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psm1.play")) returned 1 [0148.245] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1098 os_tid = 0x16d8 [0148.247] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.247] ReadFile (in: hFile=0xa30, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.249] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.249] ReadFile (in: hFile=0xa30, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.249] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.250] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.250] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0148.250] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0148.250] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0148.250] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.250] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0148.255] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.257] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.257] WriteFile (in: hFile=0xa30, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0148.257] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.257] ReadFile (in: hFile=0xa30, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1070f61c*=0x38d8, lpOverlapped=0x0) returned 1 [0148.258] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xffffc728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.261] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0x38d8, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1070f848, pbOutput=0x2e50000, pcbResult=0x1070f618) returned 0x0 [0148.261] WriteFile (in: hFile=0xa30, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1070f61c*=0x38e0, lpOverlapped=0x0) returned 1 [0148.261] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0148.261] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.261] WriteFile (in: hFile=0xa30, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.261] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x38e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.261] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0148.261] CloseHandle (hObject=0xa30) returned 1 [0148.262] VirtualAlloc (lpAddress=0x0, dwSize=0x87, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.262] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files (x86)\\common files\\designer\\msaddndr.olb"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\DESIGNER\\MSADDNDR.OLB.PLAY" (normalized: "c:\\program files (x86)\\common files\\designer\\msaddndr.olb.play")) returned 1 [0148.263] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1099 os_tid = 0x16dc [0148.336] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.336] ReadFile (in: hFile=0xb00, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.341] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.341] ReadFile (in: hFile=0xb00, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.341] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.344] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.344] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0148.344] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0148.344] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0148.344] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.344] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0148.350] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.356] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.356] WriteFile (in: hFile=0xb00, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0148.357] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.357] ReadFile (in: hFile=0xb00, lpBuffer=0x2750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x100000, lpOverlapped=0x0) returned 1 [0148.373] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.373] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0148.374] WriteFile (in: hFile=0xb00, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x100000, lpOverlapped=0x0) returned 1 [0148.488] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0148.488] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.488] WriteFile (in: hFile=0xb00, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.488] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.488] ReadFile (in: hFile=0xb00, lpBuffer=0x2750000, nNumberOfBytesToRead=0x32a90, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x32a90, lpOverlapped=0x0) returned 1 [0149.078] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xfffcd570, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.078] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0x32a90, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0149.078] WriteFile (in: hFile=0xb00, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x32aa0, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x32aa0, lpOverlapped=0x0) returned 1 [0149.079] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0149.079] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.079] WriteFile (in: hFile=0xb00, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.079] SetFilePointerEx (in: hFile=0xb00, liDistanceToMove=0x132aa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.079] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.079] CloseHandle (hObject=0xb00) returned 1 [0149.080] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dw\\dbghelp.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dw\\dbghelp.dll.play")) returned 1 [0149.082] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1100 os_tid = 0x16e0 [0148.365] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.491] ReadFile (in: hFile=0xb10, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.496] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.497] ReadFile (in: hFile=0xb10, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.497] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.497] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.498] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0148.498] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0148.498] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0148.498] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.498] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0148.501] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.502] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.502] WriteFile (in: hFile=0xb10, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0148.503] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.503] ReadFile (in: hFile=0xb10, lpBuffer=0x2850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xfe4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0148.520] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.520] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x0 | out: hKey=0x1a6d94c0, pbIV=0xfe4f848, pbOutput=0x2850000, pcbResult=0xfe4f618) returned 0x0 [0148.522] WriteFile (in: hFile=0xb10, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xfe4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0148.529] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0148.529] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.529] WriteFile (in: hFile=0xb10, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.529] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.529] ReadFile (in: hFile=0xb10, lpBuffer=0x2850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xfe4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.098] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.098] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x0 | out: hKey=0x1a6d94c0, pbIV=0xfe4f848, pbOutput=0x2850000, pcbResult=0xfe4f618) returned 0x0 [0149.100] WriteFile (in: hFile=0xb10, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xfe4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.103] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0149.103] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.103] WriteFile (in: hFile=0xb10, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.103] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.103] ReadFile (in: hFile=0xb10, lpBuffer=0x2850000, nNumberOfBytesToRead=0x77ad0, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xfe4f61c*=0x77ad0, lpOverlapped=0x0) returned 1 [0149.449] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfff88530, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.449] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2850000, cbInput=0x77ad0, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xfe4f848, pbOutput=0x2850000, pcbResult=0xfe4f618) returned 0x0 [0149.450] WriteFile (in: hFile=0xb10, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x77ae0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xfe4f61c*=0x77ae0, lpOverlapped=0x0) returned 1 [0149.451] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0149.451] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.451] WriteFile (in: hFile=0xb10, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.451] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x277ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.451] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0149.451] CloseHandle (hObject=0xb10) returned 1 [0149.452] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dw\\dw20.exe.play")) returned 1 [0149.453] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1101 os_tid = 0x16e4 [0148.540] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.540] ReadFile (in: hFile=0xb20, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.544] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.544] ReadFile (in: hFile=0xb20, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.545] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.545] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xff8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0148.545] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xff8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xff8f828, pbKeyObject=0x0) returned 0x0 [0148.545] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xff8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xff8f500) returned 0x0 [0148.545] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.545] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xff8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xff8f500) returned 0x0 [0148.550] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.551] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.551] WriteFile (in: hFile=0xb20, lpBuffer=0xff8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xff8f830, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesWritten=0xff8f830*=0x428, lpOverlapped=0x0) returned 1 [0148.551] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.552] ReadFile (in: hFile=0xb20, lpBuffer=0x2950000, nNumberOfBytesToRead=0x2cee8, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xff8f61c*=0x2cee8, lpOverlapped=0x0) returned 1 [0148.634] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xfffd3118, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.634] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2950000, cbInput=0x2cee8, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xff8f848, pbOutput=0x2950000, pcbResult=0xff8f618) returned 0x0 [0148.635] WriteFile (in: hFile=0xb20, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x2cef0, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xff8f61c*=0x2cef0, lpOverlapped=0x0) returned 1 [0148.635] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0148.635] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.636] WriteFile (in: hFile=0xb20, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.636] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x2cef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.636] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.636] CloseHandle (hObject=0xb20) returned 1 [0148.636] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dw\\dwtrig20.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dw\\dwtrig20.exe.play")) returned 1 [0148.638] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1102 os_tid = 0x16e8 [0148.553] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.553] ReadFile (in: hFile=0xaf8, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0148.643] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.643] ReadFile (in: hFile=0xaf8, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0148.643] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.644] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.644] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0148.644] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0148.644] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0148.644] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.644] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0148.649] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.650] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.650] WriteFile (in: hFile=0xaf8, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0148.651] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.651] ReadFile (in: hFile=0xaf8, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xfa60, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x100cf61c*=0xfa60, lpOverlapped=0x0) returned 1 [0148.654] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xffff05a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.654] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2a50000, cbInput=0xfa60, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x100cf848, pbOutput=0x2a50000, pcbResult=0x100cf618) returned 0x0 [0148.655] WriteFile (in: hFile=0xaf8, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x100cf61c*=0xfa70, lpOverlapped=0x0) returned 1 [0148.655] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0148.655] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.655] WriteFile (in: hFile=0xaf8, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0148.655] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xfa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.655] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.655] CloseHandle (hObject=0xaf8) returned 1 [0148.656] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.play")) returned 1 [0148.658] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1103 os_tid = 0x16ec [0148.652] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.652] ReadFile (in: hFile=0x740, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.660] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.660] ReadFile (in: hFile=0x740, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.660] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.661] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.661] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0148.661] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0148.661] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1020f500) returned 0x0 [0148.661] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.662] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1020f500) returned 0x0 [0148.668] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.669] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.669] WriteFile (in: hFile=0x740, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0148.672] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.672] ReadFile (in: hFile=0x740, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1020f61c*=0x9fd, lpOverlapped=0x0) returned 1 [0148.673] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffff603, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.673] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2b50000, cbInput=0x9fd, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1020f848, pbOutput=0x2b50000, pcbResult=0x1020f618) returned 0x0 [0148.673] WriteFile (in: hFile=0x740, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1020f61c*=0xa00, lpOverlapped=0x0) returned 1 [0148.673] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0148.673] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.673] WriteFile (in: hFile=0x740, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.673] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.673] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.673] CloseHandle (hObject=0x740) returned 1 [0148.674] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.cnt.play")) returned 1 [0148.675] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1104 os_tid = 0x16f0 [0148.653] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.653] ReadFile (in: hFile=0xaec, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.722] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.722] ReadFile (in: hFile=0xaec, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.722] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.724] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.725] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0148.725] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0148.725] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0148.725] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.725] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0148.732] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.733] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.733] WriteFile (in: hFile=0xaec, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0148.733] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.733] ReadFile (in: hFile=0xaec, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x84a48, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1034f61c*=0x84a48, lpOverlapped=0x0) returned 1 [0148.748] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfff7b5b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.748] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2c50000, cbInput=0x84a48, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1034f848, pbOutput=0x2c50000, pcbResult=0x1034f618) returned 0x0 [0148.749] WriteFile (in: hFile=0xaec, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1034f61c*=0x84a50, lpOverlapped=0x0) returned 1 [0148.750] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0148.751] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.751] WriteFile (in: hFile=0xaec, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.751] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x84a50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.751] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.751] CloseHandle (hObject=0xaec) returned 1 [0148.751] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0148.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.exe.play")) returned 1 [0148.753] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1105 os_tid = 0x16f4 [0148.741] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.742] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.742] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0148.742] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0148.742] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0148.743] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.743] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0148.797] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.799] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.799] WriteFile (in: hFile=0x230, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0148.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.802] ReadFile (in: hFile=0x230, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1048f61c*=0x236, lpOverlapped=0x0) returned 1 [0148.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0xfffffdca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.803] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2d50000, cbInput=0x236, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x1048f848, pbOutput=0x2d50000, pcbResult=0x1048f618) returned 0x0 [0148.803] WriteFile (in: hFile=0x230, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1048f61c*=0x240, lpOverlapped=0x0) returned 1 [0148.803] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0148.803] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.803] WriteFile (in: hFile=0x230, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.803] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.803] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0148.803] CloseHandle (hObject=0x230) returned 1 [0148.804] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.play")) returned 1 [0148.817] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1106 os_tid = 0x16f8 [0148.820] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.821] ReadFile (in: hFile=0x21c, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.822] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.823] ReadFile (in: hFile=0x21c, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.823] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.823] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.824] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0148.824] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0148.824] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0148.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.824] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0148.830] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.832] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.832] WriteFile (in: hFile=0x21c, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0148.832] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.832] ReadFile (in: hFile=0x21c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1070f61c*=0x2b0b7, lpOverlapped=0x0) returned 1 [0148.837] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffd4f49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.837] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2e50000, cbInput=0x2b0b7, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1070f848, pbOutput=0x2e50000, pcbResult=0x1070f618) returned 0x0 [0148.837] WriteFile (in: hFile=0x21c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1070f61c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0148.838] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0148.838] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.838] WriteFile (in: hFile=0x21c, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.838] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2b0c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.838] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.838] CloseHandle (hObject=0x21c) returned 1 [0148.838] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\equation\\eqnedt32.hlp.play")) returned 1 [0148.840] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1107 os_tid = 0x16fc [0148.844] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.844] ReadFile (in: hFile=0x3d4, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.846] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.847] ReadFile (in: hFile=0x3d4, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.848] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.849] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0148.849] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0148.849] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0148.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.849] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0148.855] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.857] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.857] WriteFile (in: hFile=0x3d4, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0148.857] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.857] ReadFile (in: hFile=0x3d4, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x74c0, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1084f61c*=0x74c0, lpOverlapped=0x0) returned 1 [0148.860] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xffff8b40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.860] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2f50000, cbInput=0x74c0, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1084f848, pbOutput=0x2f50000, pcbResult=0x1084f618) returned 0x0 [0148.860] WriteFile (in: hFile=0x3d4, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x74d0, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1084f61c*=0x74d0, lpOverlapped=0x0) returned 1 [0148.860] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0148.860] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.860] WriteFile (in: hFile=0x3d4, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.860] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x74d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.860] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.860] CloseHandle (hObject=0x3d4) returned 1 [0148.861] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\euro\\msoeuro.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\euro\\msoeuro.dll.play")) returned 1 [0148.862] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1108 os_tid = 0x1700 [0148.845] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.847] ReadFile (in: hFile=0x3c4, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.866] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.866] ReadFile (in: hFile=0x3c4, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.866] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.867] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.867] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1098f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0148.868] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1098f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1098f828, pbKeyObject=0x0) returned 0x0 [0148.868] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1098f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1098f500) returned 0x0 [0148.868] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.868] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1098f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1098f500) returned 0x0 [0148.874] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.875] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.875] WriteFile (in: hFile=0x3c4, lpBuffer=0x1098fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1098f830, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesWritten=0x1098f830*=0x428, lpOverlapped=0x0) returned 1 [0148.876] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.876] ReadFile (in: hFile=0x3c4, lpBuffer=0x3050000, nNumberOfBytesToRead=0x7f8d8, lpNumberOfBytesRead=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1098f61c*=0x7f8d8, lpOverlapped=0x0) returned 1 [0148.886] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfff80728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.886] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3050000, cbInput=0x7f8d8, pPaddingInfo=0x0, pbIV=0x1098f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1098f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1098f848, pbOutput=0x3050000, pcbResult=0x1098f618) returned 0x0 [0148.887] WriteFile (in: hFile=0x3c4, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x7f8e0, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1098f61c*=0x7f8e0, lpOverlapped=0x0) returned 1 [0148.889] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1098f60c | out: lpNewFilePointer=0x0) returned 1 [0148.889] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.889] WriteFile (in: hFile=0x3c4, lpBuffer=0x1098f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x1098f83c*, lpNumberOfBytesWritten=0x1098f61c*=0x8, lpOverlapped=0x0) returned 1 [0148.889] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x7f8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.889] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.889] CloseHandle (hObject=0x3c4) returned 1 [0148.892] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\epsimp32.flt.play")) returned 1 [0148.893] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1109 os_tid = 0x1704 [0148.882] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.882] ReadFile (in: hFile=0x3bc, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0148.939] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.939] ReadFile (in: hFile=0x3bc, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0148.939] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.940] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.941] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0148.941] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0148.941] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0148.941] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.941] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0148.947] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.948] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.948] WriteFile (in: hFile=0x3bc, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0148.949] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.949] ReadFile (in: hFile=0x3bc, lpBuffer=0x3150000, nNumberOfBytesToRead=0x2f8c0, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x10acf61c*=0x2f8c0, lpOverlapped=0x0) returned 1 [0148.955] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffd0740, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.955] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3150000, cbInput=0x2f8c0, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x10acf848, pbOutput=0x3150000, pcbResult=0x10acf618) returned 0x0 [0148.956] WriteFile (in: hFile=0x3bc, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x2f8d0, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x10acf61c*=0x2f8d0, lpOverlapped=0x0) returned 1 [0148.956] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0148.956] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.957] WriteFile (in: hFile=0x3bc, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0148.957] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x2f8d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.957] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0148.957] CloseHandle (hObject=0x3bc) returned 1 [0148.957] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0148.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\gifimp32.flt.play")) returned 1 [0148.959] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1110 os_tid = 0x1708 [0148.951] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.951] ReadFile (in: hFile=0x3c0, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.960] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.961] ReadFile (in: hFile=0x3c0, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.961] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.978] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.978] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0148.978] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0148.978] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0148.979] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.979] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0148.983] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.985] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.985] WriteFile (in: hFile=0x3c0, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0148.985] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.985] ReadFile (in: hFile=0x3c0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x2c8c8, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10c0f61c*=0x2c8c8, lpOverlapped=0x0) returned 1 [0149.002] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffd3738, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.002] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3250000, cbInput=0x2c8c8, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x10c0f848, pbOutput=0x3250000, pcbResult=0x10c0f618) returned 0x0 [0149.002] WriteFile (in: hFile=0x3c0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x2c8d0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10c0f61c*=0x2c8d0, lpOverlapped=0x0) returned 1 [0149.003] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0149.003] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.003] WriteFile (in: hFile=0x3c0, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.003] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x2c8d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.003] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.003] CloseHandle (hObject=0x3c0) returned 1 [0149.003] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\jpegim32.flt.play")) returned 1 [0149.005] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1111 os_tid = 0x170c [0148.953] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.953] ReadFile (in: hFile=0x3ac, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.989] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.989] ReadFile (in: hFile=0x3ac, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0148.989] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0148.990] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0148.990] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0148.990] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0148.990] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0148.990] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0148.990] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0148.998] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.999] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.000] WriteFile (in: hFile=0x3ac, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0149.000] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.000] ReadFile (in: hFile=0x3ac, lpBuffer=0x3350000, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x10d4f61c*=0x3adb, lpOverlapped=0x0) returned 1 [0149.007] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xffffc525, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.007] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3350000, cbInput=0x3adb, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x10d4f848, pbOutput=0x3350000, pcbResult=0x10d4f618) returned 0x0 [0149.007] WriteFile (in: hFile=0x3ac, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x10d4f61c*=0x3ae0, lpOverlapped=0x0) returned 1 [0149.007] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0149.007] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.007] WriteFile (in: hFile=0x3ac, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.007] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x3ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.007] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.007] CloseHandle (hObject=0x3ac) returned 1 [0149.008] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.eps.play")) returned 1 [0149.009] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1112 os_tid = 0x1710 [0149.011] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.012] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.012] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0149.012] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0149.012] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0149.012] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.012] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0149.017] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.018] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.018] WriteFile (in: hFile=0xa14, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0149.020] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.020] ReadFile (in: hFile=0xa14, lpBuffer=0x3450000, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x10e8f61c*=0x42d, lpOverlapped=0x0) returned 1 [0149.020] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xfffffbd3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.020] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3450000, cbInput=0x42d, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x10e8f848, pbOutput=0x3450000, pcbResult=0x10e8f618) returned 0x0 [0149.021] WriteFile (in: hFile=0xa14, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10e8f61c*=0x430, lpOverlapped=0x0) returned 1 [0149.021] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0149.021] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.021] WriteFile (in: hFile=0xa14, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.021] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.021] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.021] CloseHandle (hObject=0xa14) returned 1 [0149.021] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.022] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.gif.play")) returned 1 [0149.023] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1113 os_tid = 0x1714 [0149.025] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.025] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.025] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0149.025] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0149.025] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0149.026] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.026] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0149.031] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.032] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.032] WriteFile (in: hFile=0xa1c, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0149.034] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.034] ReadFile (in: hFile=0xa1c, lpBuffer=0x3550000, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x10fcf61c*=0x425, lpOverlapped=0x0) returned 1 [0149.034] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0xfffffbdb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.034] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3550000, cbInput=0x425, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x10fcf848, pbOutput=0x3550000, pcbResult=0x10fcf618) returned 0x0 [0149.034] WriteFile (in: hFile=0xa1c, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x10fcf61c*=0x430, lpOverlapped=0x0) returned 1 [0149.034] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0149.034] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.035] WriteFile (in: hFile=0xa1c, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0149.035] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.035] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.035] CloseHandle (hObject=0xa1c) returned 1 [0149.035] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.jpg.play")) returned 1 [0149.040] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1114 os_tid = 0x1718 [0149.042] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.042] ReadFile (in: hFile=0x3cc, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.044] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.045] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.045] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0149.045] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0149.045] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0149.045] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.046] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0149.050] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.051] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.051] WriteFile (in: hFile=0x3cc, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0149.052] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.052] ReadFile (in: hFile=0x3cc, lpBuffer=0x3650000, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1110f61c*=0x692, lpOverlapped=0x0) returned 1 [0149.052] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffff96e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.052] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3650000, cbInput=0x692, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1110f848, pbOutput=0x3650000, pcbResult=0x1110f618) returned 0x0 [0149.052] WriteFile (in: hFile=0x3cc, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1110f61c*=0x6a0, lpOverlapped=0x0) returned 1 [0149.052] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0149.052] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.052] WriteFile (in: hFile=0x3cc, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.052] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x6a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.052] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.052] CloseHandle (hObject=0x3cc) returned 1 [0149.053] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.png.play")) returned 1 [0149.054] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1115 os_tid = 0x171c [0149.057] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.057] ReadFile (in: hFile=0xa24, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.059] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.060] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.060] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0149.060] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0149.060] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0149.060] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.060] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0149.065] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.066] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.066] WriteFile (in: hFile=0xa24, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0149.066] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.066] ReadFile (in: hFile=0xa24, lpBuffer=0x3750000, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1124f61c*=0x566, lpOverlapped=0x0) returned 1 [0149.066] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0xfffffa9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.066] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3750000, cbInput=0x566, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1124f848, pbOutput=0x3750000, pcbResult=0x1124f618) returned 0x0 [0149.067] WriteFile (in: hFile=0xa24, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1124f61c*=0x570, lpOverlapped=0x0) returned 1 [0149.067] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0149.067] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.067] WriteFile (in: hFile=0xa24, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.067] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.067] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.067] CloseHandle (hObject=0xa24) returned 1 [0149.067] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\ms.wpg.play")) returned 1 [0149.069] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1116 os_tid = 0x1720 [0149.260] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.260] ReadFile (in: hFile=0x3c4, lpBuffer=0xf5cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf5cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf5cfb34*, lpNumberOfBytesRead=0xf5cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.261] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.261] ReadFile (in: hFile=0x3c4, lpBuffer=0xf5cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf5cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf5cfb34*, lpNumberOfBytesRead=0xf5cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.261] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.262] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.263] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0xf5cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0149.263] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0xf5cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0xf5cf828, pbKeyObject=0x0) returned 0x0 [0149.263] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf5cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf5cf500) returned 0x0 [0149.263] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.263] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf5cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf5cf500) returned 0x0 [0149.266] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.267] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.268] WriteFile (in: hFile=0x3c4, lpBuffer=0xf5cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf5cf830, lpOverlapped=0x0 | out: lpBuffer=0xf5cfb34*, lpNumberOfBytesWritten=0xf5cf830*=0x428, lpOverlapped=0x0) returned 1 [0149.268] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.268] ReadFile (in: hFile=0x3c4, lpBuffer=0x3850000, nNumberOfBytesToRead=0x112c0, lpNumberOfBytesRead=0xf5cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0xf5cf61c*=0x112c0, lpOverlapped=0x0) returned 1 [0149.270] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffeed40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.270] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3850000, cbInput=0x112c0, pPaddingInfo=0x0, pbIV=0xf5cf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0xf5cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf5cf848, pbOutput=0x3850000, pcbResult=0xf5cf618) returned 0x0 [0149.271] WriteFile (in: hFile=0x3c4, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x112d0, lpNumberOfBytesWritten=0xf5cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0xf5cf61c*=0x112d0, lpOverlapped=0x0) returned 1 [0149.271] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf5cf60c | out: lpNewFilePointer=0x0) returned 1 [0149.271] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.271] WriteFile (in: hFile=0x3c4, lpBuffer=0xf5cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf5cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf5cf83c*, lpNumberOfBytesWritten=0xf5cf61c*=0x8, lpOverlapped=0x0) returned 1 [0149.271] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x112d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.271] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.271] CloseHandle (hObject=0x3c4) returned 1 [0149.272] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.272] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\pictim32.flt.play")) returned 1 [0149.273] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1117 os_tid = 0x1724 [0149.275] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.276] ReadFile (in: hFile=0x21c, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.277] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.277] ReadFile (in: hFile=0x21c, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.278] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.278] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.278] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xff8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0149.278] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xff8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xff8f828, pbKeyObject=0x0) returned 0x0 [0149.278] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xff8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xff8f500) returned 0x0 [0149.279] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.279] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xff8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xff8f500) returned 0x0 [0149.282] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.283] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.283] WriteFile (in: hFile=0x21c, lpBuffer=0xff8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xff8f830, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesWritten=0xff8f830*=0x428, lpOverlapped=0x0) returned 1 [0149.283] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.284] ReadFile (in: hFile=0x21c, lpBuffer=0x2950000, nNumberOfBytesToRead=0x374c0, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xff8f61c*=0x374c0, lpOverlapped=0x0) returned 1 [0149.286] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc8b40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.286] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0x374c0, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xff8f848, pbOutput=0x2950000, pcbResult=0xff8f618) returned 0x0 [0149.286] WriteFile (in: hFile=0x21c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x374d0, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xff8f61c*=0x374d0, lpOverlapped=0x0) returned 1 [0149.287] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0149.287] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.287] WriteFile (in: hFile=0x21c, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.287] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x374d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.287] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.287] CloseHandle (hObject=0x21c) returned 1 [0149.287] VirtualAlloc (lpAddress=0x0, dwSize=0xa1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\png32.flt.play")) returned 1 [0149.289] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1118 os_tid = 0x1728 [0149.291] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.291] ReadFile (in: hFile=0xaec, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.293] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.293] ReadFile (in: hFile=0xaec, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.294] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.294] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.294] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0149.294] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0149.294] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0149.295] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.295] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0149.298] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.299] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.299] WriteFile (in: hFile=0xaec, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0149.299] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.299] ReadFile (in: hFile=0xaec, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x2d6c8, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x100cf61c*=0x2d6c8, lpOverlapped=0x0) returned 1 [0149.302] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffd2938, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.302] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2a50000, cbInput=0x2d6c8, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x100cf848, pbOutput=0x2a50000, pcbResult=0x100cf618) returned 0x0 [0149.302] WriteFile (in: hFile=0xaec, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x2d6d0, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x100cf61c*=0x2d6d0, lpOverlapped=0x0) returned 1 [0149.303] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0149.303] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.303] WriteFile (in: hFile=0xaec, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0149.303] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x2d6d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.303] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.303] CloseHandle (hObject=0xaec) returned 1 [0149.303] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.play")) returned 1 [0149.306] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1119 os_tid = 0x172c [0149.301] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.308] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.308] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0149.308] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0149.308] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1020f500) returned 0x0 [0149.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.309] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1020f500) returned 0x0 [0149.312] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.313] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.313] WriteFile (in: hFile=0xaf8, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0149.315] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.315] ReadFile (in: hFile=0xaf8, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x323, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1020f61c*=0x323, lpOverlapped=0x0) returned 1 [0149.316] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xfffffcdd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.316] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2b50000, cbInput=0x323, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1020f848, pbOutput=0x2b50000, pcbResult=0x1020f618) returned 0x0 [0149.316] WriteFile (in: hFile=0xaf8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1020f61c*=0x330, lpOverlapped=0x0) returned 1 [0149.316] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0149.316] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.316] WriteFile (in: hFile=0xaf8, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.316] SetFilePointerEx (in: hFile=0xaf8, liDistanceToMove=0x330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.316] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.316] CloseHandle (hObject=0xaf8) returned 1 [0149.317] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\Hx.HxC" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\hx.hxc"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\Hx.HxC.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\hx.hxc.play")) returned 1 [0149.318] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1120 os_tid = 0x1730 [0149.319] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.320] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.320] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0149.320] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0149.320] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0149.320] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.320] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0149.324] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.324] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.324] WriteFile (in: hFile=0xb30, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0149.327] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.327] ReadFile (in: hFile=0xb30, lpBuffer=0x2c50000, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1034f61c*=0xa9, lpOverlapped=0x0) returned 1 [0149.327] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xffffff57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.327] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2c50000, cbInput=0xa9, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1034f848, pbOutput=0x2c50000, pcbResult=0x1034f618) returned 0x0 [0149.327] WriteFile (in: hFile=0xb30, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1034f61c*=0xb0, lpOverlapped=0x0) returned 1 [0149.327] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0149.327] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.327] WriteFile (in: hFile=0xb30, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.327] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.327] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.327] CloseHandle (hObject=0xb30) returned 1 [0149.328] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\Hx.HxT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\hx.hxt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\Hx.HxT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\hx.hxt.play")) returned 1 [0149.329] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1121 os_tid = 0x1734 [0149.326] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.331] ReadFile (in: hFile=0x370, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.332] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.332] ReadFile (in: hFile=0x370, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.332] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.333] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.333] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0149.333] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0149.333] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0149.333] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.333] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0149.337] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.337] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.337] WriteFile (in: hFile=0x370, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0149.338] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.338] ReadFile (in: hFile=0x370, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x6ce8, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1048f61c*=0x6ce8, lpOverlapped=0x0) returned 1 [0149.339] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xffff9318, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.339] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2d50000, cbInput=0x6ce8, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1048f848, pbOutput=0x2d50000, pcbResult=0x1048f618) returned 0x0 [0149.339] WriteFile (in: hFile=0x370, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1048f61c*=0x6cf0, lpOverlapped=0x0) returned 1 [0149.339] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0149.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.340] WriteFile (in: hFile=0x370, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x6cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.340] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.340] CloseHandle (hObject=0x370) returned 1 [0149.340] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0149.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\HxRuntime.HxS" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\hxruntime.hxs"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\HxRuntime.HxS.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\hxruntime.hxs.play")) returned 1 [0149.341] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1122 os_tid = 0x1738 [0149.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.343] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0149.343] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0149.343] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0149.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.343] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0149.347] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.348] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.348] WriteFile (in: hFile=0x8ac, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0149.351] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.351] ReadFile (in: hFile=0x8ac, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1070f61c*=0x85, lpOverlapped=0x0) returned 1 [0149.351] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.351] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0x85, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1070f848, pbOutput=0x2e50000, pcbResult=0x1070f618) returned 0x0 [0149.351] WriteFile (in: hFile=0x8ac, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1070f61c*=0x90, lpOverlapped=0x0) returned 1 [0149.351] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0149.351] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.351] WriteFile (in: hFile=0x8ac, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.351] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.351] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.351] CloseHandle (hObject=0x8ac) returned 1 [0149.352] VirtualAlloc (lpAddress=0x0, dwSize=0xa1, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0149.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\Keywords.HxK" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\keywords.hxk"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\Keywords.HxK.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\keywords.hxk.play")) returned 1 [0149.353] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1123 os_tid = 0x173c [0149.349] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.355] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.355] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0149.355] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0149.355] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0149.355] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.355] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0149.359] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.360] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.360] WriteFile (in: hFile=0x410, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0149.362] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.362] ReadFile (in: hFile=0x410, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x8c, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1084f61c*=0x8c, lpOverlapped=0x0) returned 1 [0149.362] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xffffff74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.362] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2f50000, cbInput=0x8c, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1084f848, pbOutput=0x2f50000, pcbResult=0x1084f618) returned 0x0 [0149.362] WriteFile (in: hFile=0x410, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1084f61c*=0x90, lpOverlapped=0x0) returned 1 [0149.362] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0149.362] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.362] WriteFile (in: hFile=0x410, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.362] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.362] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.362] CloseHandle (hObject=0x410) returned 1 [0149.362] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\NamedUrls.HxK" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\namedurls.hxk"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\NamedUrls.HxK.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\namedurls.hxk.play")) returned 1 [0149.364] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1124 os_tid = 0x1740 [0149.365] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.366] ReadFile (in: hFile=0x408, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.367] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.367] ReadFile (in: hFile=0x408, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.367] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0149.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0149.368] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1098f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0149.368] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1098f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1098f828, pbKeyObject=0x0) returned 0x0 [0149.368] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1098f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1098f500) returned 0x0 [0149.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0149.369] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1098f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1098f500) returned 0x0 [0149.373] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.374] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.374] WriteFile (in: hFile=0x408, lpBuffer=0x1098fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1098f830, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesWritten=0x1098f830*=0x428, lpOverlapped=0x0) returned 1 [0149.374] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.374] ReadFile (in: hFile=0x408, lpBuffer=0x3050000, nNumberOfBytesToRead=0x52ce8, lpNumberOfBytesRead=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1098f61c*=0x52ce8, lpOverlapped=0x0) returned 1 [0149.378] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffad318, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.378] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3050000, cbInput=0x52ce8, pPaddingInfo=0x0, pbIV=0x1098f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1098f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1098f848, pbOutput=0x3050000, pcbResult=0x1098f618) returned 0x0 [0149.379] WriteFile (in: hFile=0x408, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x52cf0, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1098f61c*=0x52cf0, lpOverlapped=0x0) returned 1 [0149.380] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1098f60c | out: lpNewFilePointer=0x0) returned 1 [0149.380] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.380] WriteFile (in: hFile=0x408, lpBuffer=0x1098f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x1098f83c*, lpNumberOfBytesWritten=0x1098f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.380] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x52cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.380] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.380] CloseHandle (hObject=0x408) returned 1 [0149.380] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.play")) returned 1 [0149.382] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1125 os_tid = 0x1744 [0149.498] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.498] ReadFile (in: hFile=0x408, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.500] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.500] ReadFile (in: hFile=0x408, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.502] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.502] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0149.502] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0149.502] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0149.503] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.503] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0149.509] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.510] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.510] WriteFile (in: hFile=0x408, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0149.511] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.511] ReadFile (in: hFile=0x408, lpBuffer=0x3950000, nNumberOfBytesToRead=0x314f0, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x111f61c*=0x314f0, lpOverlapped=0x0) returned 1 [0149.528] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffceb10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.528] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3950000, cbInput=0x314f0, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x3950000, pcbResult=0x111f618) returned 0x0 [0149.529] WriteFile (in: hFile=0x408, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x31500, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x111f61c*=0x31500, lpOverlapped=0x0) returned 1 [0149.530] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0149.530] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.530] WriteFile (in: hFile=0x408, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.530] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x31500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.530] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.530] CloseHandle (hObject=0x408) returned 1 [0149.531] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ACEINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\aceintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ACEINTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\aceintl.dll.play")) returned 1 [0149.536] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1126 os_tid = 0x1748 [0149.513] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.513] ReadFile (in: hFile=0x8ac, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.515] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.515] ReadFile (in: hFile=0x8ac, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.515] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.516] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.516] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0149.516] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0149.516] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0149.517] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.518] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0149.524] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.525] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.525] WriteFile (in: hFile=0x8ac, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0149.525] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.526] ReadFile (in: hFile=0x8ac, lpBuffer=0x2750000, nNumberOfBytesToRead=0xd2f8, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xf48f61c*=0xd2f8, lpOverlapped=0x0) returned 1 [0149.533] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xffff2d08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.533] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2750000, cbInput=0xd2f8, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xf48f848, pbOutput=0x2750000, pcbResult=0xf48f618) returned 0x0 [0149.533] WriteFile (in: hFile=0x8ac, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xd300, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xf48f61c*=0xd300, lpOverlapped=0x0) returned 1 [0149.533] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0149.533] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.533] WriteFile (in: hFile=0x8ac, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.533] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xd300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.534] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0149.534] CloseHandle (hObject=0x8ac) returned 1 [0149.534] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0149.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\aceodbci.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ACEODBCI.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\aceodbci.dll.play")) returned 1 [0149.546] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1127 os_tid = 0x174c [0149.562] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.562] ReadFile (in: hFile=0xb30, lpBuffer=0xf5cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf5cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf5cfb34*, lpNumberOfBytesRead=0xf5cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.591] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.592] ReadFile (in: hFile=0xb30, lpBuffer=0xf5cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf5cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf5cfb34*, lpNumberOfBytesRead=0xf5cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.592] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.594] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xf5cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0149.594] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xf5cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xf5cf828, pbKeyObject=0x0) returned 0x0 [0149.594] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf5cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf5cf500) returned 0x0 [0149.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.594] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf5cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf5cf500) returned 0x0 [0149.600] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.601] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.602] WriteFile (in: hFile=0xb30, lpBuffer=0xf5cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf5cf830, lpOverlapped=0x0 | out: lpBuffer=0xf5cfb34*, lpNumberOfBytesWritten=0xf5cf830*=0x428, lpOverlapped=0x0) returned 1 [0149.602] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.602] ReadFile (in: hFile=0xb30, lpBuffer=0x2950000, nNumberOfBytesToRead=0xd0ad8, lpNumberOfBytesRead=0xf5cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xf5cf61c*=0xd0ad8, lpOverlapped=0x0) returned 1 [0149.636] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfff2f528, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.636] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0xd0ad8, pPaddingInfo=0x0, pbIV=0xf5cf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xf5cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf5cf848, pbOutput=0x2950000, pcbResult=0xf5cf618) returned 0x0 [0149.637] WriteFile (in: hFile=0xb30, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0xd0ae0, lpNumberOfBytesWritten=0xf5cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xf5cf61c*=0xd0ae0, lpOverlapped=0x0) returned 1 [0149.641] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf5cf60c | out: lpNewFilePointer=0x0) returned 1 [0149.641] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.641] WriteFile (in: hFile=0xb30, lpBuffer=0xf5cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf5cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf5cf83c*, lpNumberOfBytesWritten=0xf5cf61c*=0x8, lpOverlapped=0x0) returned 1 [0149.641] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xd0ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.641] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.641] CloseHandle (hObject=0xb30) returned 1 [0149.642] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\acewstr.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ACEWSTR.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\acewstr.dll.play")) returned 1 [0149.644] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1128 os_tid = 0x1750 [0149.609] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.609] ReadFile (in: hFile=0xaec, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.612] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.612] ReadFile (in: hFile=0xaec, lpBuffer=0xff8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xff8f85c, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesRead=0xff8f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.612] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.613] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.613] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xff8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0149.613] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xff8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xff8f828, pbKeyObject=0x0) returned 0x0 [0149.613] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xff8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xff8f500) returned 0x0 [0149.614] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.614] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xff8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xff8f500) returned 0x0 [0149.619] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.620] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.621] WriteFile (in: hFile=0xaec, lpBuffer=0xff8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xff8f830, lpOverlapped=0x0 | out: lpBuffer=0xff8fb34*, lpNumberOfBytesWritten=0xff8f830*=0x428, lpOverlapped=0x0) returned 1 [0149.621] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.621] ReadFile (in: hFile=0xaec, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.655] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.655] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2a50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x0 | out: hKey=0x1a6d94c0, pbIV=0xff8f848, pbOutput=0x2a50000, pcbResult=0xff8f618) returned 0x0 [0149.656] WriteFile (in: hFile=0xaec, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xff8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.660] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0149.660] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.660] WriteFile (in: hFile=0xaec, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.660] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.660] ReadFile (in: hFile=0xaec, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x9a3ff, lpNumberOfBytesRead=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xff8f61c*=0x9a3ff, lpOverlapped=0x0) returned 1 [0150.620] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfff65c01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.621] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2a50000, cbInput=0x9a3ff, pPaddingInfo=0x0, pbIV=0xff8f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xff8f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xff8f848, pbOutput=0x2a50000, pcbResult=0xff8f618) returned 0x0 [0150.621] WriteFile (in: hFile=0xaec, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x9a400, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xff8f61c*=0x9a400, lpOverlapped=0x0) returned 1 [0150.623] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xff8f60c | out: lpNewFilePointer=0x0) returned 1 [0150.623] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.624] WriteFile (in: hFile=0xaec, lpBuffer=0xff8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xff8f61c, lpOverlapped=0x0 | out: lpBuffer=0xff8f83c*, lpNumberOfBytesWritten=0xff8f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.624] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x19a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.624] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0150.624] CloseHandle (hObject=0xaec) returned 1 [0150.624] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\ado210.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\ado210.chm.play")) returned 1 [0150.626] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1129 os_tid = 0x1754 [0149.665] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.665] ReadFile (in: hFile=0x3c4, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.666] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.667] ReadFile (in: hFile=0x3c4, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.667] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.668] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.668] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0149.668] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0149.668] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0149.669] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.670] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0149.674] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.676] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.676] WriteFile (in: hFile=0x3c4, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0149.676] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.677] ReadFile (in: hFile=0x3c4, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x25a98, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x100cf61c*=0x25a98, lpOverlapped=0x0) returned 1 [0149.681] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffda568, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.681] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2b50000, cbInput=0x25a98, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x100cf848, pbOutput=0x2b50000, pcbResult=0x100cf618) returned 0x0 [0149.681] WriteFile (in: hFile=0x3c4, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x25aa0, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x100cf61c*=0x25aa0, lpOverlapped=0x0) returned 1 [0149.682] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0149.682] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.682] WriteFile (in: hFile=0x3c4, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0149.682] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x25aa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.682] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0149.682] CloseHandle (hObject=0x3c4) returned 1 [0149.683] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\alrtintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\ALRTINTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\alrtintl.dll.play")) returned 1 [0149.684] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1130 os_tid = 0x1758 [0149.679] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.679] ReadFile (in: hFile=0x358, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.688] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.688] ReadFile (in: hFile=0x358, lpBuffer=0x1020fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1020f85c, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesRead=0x1020f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.688] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.689] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.689] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1020f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0149.689] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1020f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1020f828, pbKeyObject=0x0) returned 0x0 [0149.689] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1020f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1020f500) returned 0x0 [0149.689] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.690] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1020f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1020f500) returned 0x0 [0149.694] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.695] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.695] WriteFile (in: hFile=0x358, lpBuffer=0x1020fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1020f830, lpOverlapped=0x0 | out: lpBuffer=0x1020fb34*, lpNumberOfBytesWritten=0x1020f830*=0x428, lpOverlapped=0x0) returned 1 [0149.696] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.696] ReadFile (in: hFile=0x358, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1020f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.724] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.724] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2c50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0x1020f848, pbOutput=0x2c50000, pcbResult=0x1020f618) returned 0x0 [0149.725] WriteFile (in: hFile=0x358, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1020f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.729] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0149.729] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.729] WriteFile (in: hFile=0x358, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.729] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.729] ReadFile (in: hFile=0x358, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x750c0, lpNumberOfBytesRead=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1020f61c*=0x750c0, lpOverlapped=0x0) returned 1 [0150.673] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfff8af40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.673] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2c50000, cbInput=0x750c0, pPaddingInfo=0x0, pbIV=0x1020f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1020f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1020f848, pbOutput=0x2c50000, pcbResult=0x1020f618) returned 0x0 [0150.674] WriteFile (in: hFile=0x358, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x750d0, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1020f61c*=0x750d0, lpOverlapped=0x0) returned 1 [0150.679] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1020f60c | out: lpNewFilePointer=0x0) returned 1 [0150.679] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.679] WriteFile (in: hFile=0x358, lpBuffer=0x1020f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1020f61c, lpOverlapped=0x0 | out: lpBuffer=0x1020f83c*, lpNumberOfBytesWritten=0x1020f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.679] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1750d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.679] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.680] CloseHandle (hObject=0x358) returned 1 [0150.680] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\msointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\msointl.dll.play")) returned 1 [0150.682] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1131 os_tid = 0x175c [0149.702] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.702] ReadFile (in: hFile=0x3cc, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.704] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.704] ReadFile (in: hFile=0x3cc, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.704] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.705] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.705] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0149.705] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0149.705] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0149.705] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.706] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0149.712] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.713] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.713] WriteFile (in: hFile=0x3cc, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0149.713] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.714] ReadFile (in: hFile=0x3cc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xa8d0, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1034f61c*=0xa8d0, lpOverlapped=0x0) returned 1 [0149.737] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xffff5730, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.737] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2d50000, cbInput=0xa8d0, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1034f848, pbOutput=0x2d50000, pcbResult=0x1034f618) returned 0x0 [0149.737] WriteFile (in: hFile=0x3cc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xa8e0, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1034f61c*=0xa8e0, lpOverlapped=0x0) returned 1 [0149.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0149.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.738] WriteFile (in: hFile=0x3cc, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xa8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.738] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.738] CloseHandle (hObject=0x3cc) returned 1 [0149.738] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\mssoapr3.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\MSSOAPR3.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\mssoapr3.dll.play")) returned 1 [0149.740] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1132 os_tid = 0x1760 [0149.743] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.743] ReadFile (in: hFile=0xa14, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.745] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.745] ReadFile (in: hFile=0xa14, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.745] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.746] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.746] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0149.746] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0149.746] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0149.747] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.747] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0149.751] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.753] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.753] WriteFile (in: hFile=0xa14, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0149.753] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.753] ReadFile (in: hFile=0xa14, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x30d0, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1048f61c*=0x30d0, lpOverlapped=0x0) returned 1 [0149.754] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xffffcf30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.754] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2e50000, cbInput=0x30d0, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1048f848, pbOutput=0x2e50000, pcbResult=0x1048f618) returned 0x0 [0149.754] WriteFile (in: hFile=0xa14, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1048f61c*=0x30e0, lpOverlapped=0x0) returned 1 [0149.754] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0149.754] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.755] WriteFile (in: hFile=0xa14, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.755] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x30e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.755] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.755] CloseHandle (hObject=0xa14) returned 1 [0149.755] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.756] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\OARPMANR.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\oarpmanr.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\OARPMANR.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\oarpmanr.dll.play")) returned 1 [0149.757] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1133 os_tid = 0x1764 [0149.760] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.760] ReadFile (in: hFile=0x3c0, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.762] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.762] ReadFile (in: hFile=0x3c0, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.762] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.763] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.763] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0149.763] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0149.763] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0149.764] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.764] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0149.768] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.770] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0149.770] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.770] ReadFile (in: hFile=0x3c0, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x3b2c0, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1070f61c*=0x3b2c0, lpOverlapped=0x0) returned 1 [0149.774] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffc4d40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.774] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2f50000, cbInput=0x3b2c0, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1070f848, pbOutput=0x2f50000, pcbResult=0x1070f618) returned 0x0 [0149.775] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x3b2d0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1070f61c*=0x3b2d0, lpOverlapped=0x0) returned 1 [0149.776] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0149.776] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.776] WriteFile (in: hFile=0x3c0, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.776] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x3b2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.776] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.776] CloseHandle (hObject=0x3c0) returned 1 [0149.776] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\OSFINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\osfintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\OSFINTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\osfintl.dll.play")) returned 1 [0149.778] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1134 os_tid = 0x1768 [0149.782] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.783] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.783] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0149.783] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0149.783] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0149.783] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.783] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0149.788] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.789] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.789] WriteFile (in: hFile=0x3f0, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0149.792] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.792] ReadFile (in: hFile=0x3f0, lpBuffer=0x3050000, nNumberOfBytesToRead=0x173, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1084f61c*=0x173, lpOverlapped=0x0) returned 1 [0149.792] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffe8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.792] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3050000, cbInput=0x173, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1084f848, pbOutput=0x3050000, pcbResult=0x1084f618) returned 0x0 [0149.792] WriteFile (in: hFile=0x3f0, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1084f61c*=0x180, lpOverlapped=0x0) returned 1 [0149.793] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0149.793] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.793] WriteFile (in: hFile=0x3f0, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.793] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.793] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0149.793] CloseHandle (hObject=0x3f0) returned 1 [0149.793] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\README.HTM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\readme.htm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\1033\\readme.htm.play")) returned 1 [0149.795] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1135 os_tid = 0x176c [0149.797] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.797] ReadFile (in: hFile=0x3f4, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.799] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.800] ReadFile (in: hFile=0x3f4, lpBuffer=0x1098fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1098f85c, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesRead=0x1098f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.800] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.800] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.801] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x1098f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0149.801] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x1098f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x1098f828, pbKeyObject=0x0) returned 0x0 [0149.801] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1098f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1098f500) returned 0x0 [0149.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.801] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1098f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1098f500) returned 0x0 [0149.804] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.813] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.813] WriteFile (in: hFile=0x3f4, lpBuffer=0x1098fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1098f830, lpOverlapped=0x0 | out: lpBuffer=0x1098fb34*, lpNumberOfBytesWritten=0x1098f830*=0x428, lpOverlapped=0x0) returned 1 [0149.813] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.813] ReadFile (in: hFile=0x3f4, lpBuffer=0x3150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x1098f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.833] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.833] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1098f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x1098f618, dwFlags=0x0 | out: hKey=0x1a6d9750, pbIV=0x1098f848, pbOutput=0x3150000, pcbResult=0x1098f618) returned 0x0 [0149.835] WriteFile (in: hFile=0x3f4, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x1098f61c*=0x100000, lpOverlapped=0x0) returned 1 [0149.838] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1098f60c | out: lpNewFilePointer=0x0) returned 1 [0149.838] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.838] WriteFile (in: hFile=0x3f4, lpBuffer=0x1098f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x1098f83c*, lpNumberOfBytesWritten=0x1098f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.838] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.838] ReadFile (in: hFile=0x3f4, lpBuffer=0x3150000, nNumberOfBytesToRead=0x9c2d0, lpNumberOfBytesRead=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x1098f61c*=0x9c2d0, lpOverlapped=0x0) returned 1 [0150.689] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfff63d30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.689] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3150000, cbInput=0x9c2d0, pPaddingInfo=0x0, pbIV=0x1098f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x1098f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x1098f848, pbOutput=0x3150000, pcbResult=0x1098f618) returned 0x0 [0150.690] WriteFile (in: hFile=0x3f4, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x9c2e0, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x1098f61c*=0x9c2e0, lpOverlapped=0x0) returned 1 [0150.692] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1098f60c | out: lpNewFilePointer=0x0) returned 1 [0150.693] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.693] WriteFile (in: hFile=0x3f4, lpBuffer=0x1098f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1098f61c, lpOverlapped=0x0 | out: lpBuffer=0x1098f83c*, lpNumberOfBytesWritten=0x1098f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.693] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x19c2e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.693] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0150.693] CloseHandle (hObject=0x3f4) returned 1 [0150.693] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACECORE.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acecore.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACECORE.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acecore.dll.play")) returned 1 [0150.695] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1136 os_tid = 0x1770 [0149.819] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.819] ReadFile (in: hFile=0x3f8, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.854] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.854] ReadFile (in: hFile=0x3f8, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.854] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.855] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.855] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0149.855] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0149.855] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0149.855] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.855] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0149.858] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.859] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.859] WriteFile (in: hFile=0x3f8, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0149.860] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.860] ReadFile (in: hFile=0x3f8, lpBuffer=0x3250000, nNumberOfBytesToRead=0x6ad00, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10acf61c*=0x6ad00, lpOverlapped=0x0) returned 1 [0149.866] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfff95300, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.866] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3250000, cbInput=0x6ad00, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x10acf848, pbOutput=0x3250000, pcbResult=0x10acf618) returned 0x0 [0149.867] WriteFile (in: hFile=0x3f8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x6ad10, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10acf61c*=0x6ad10, lpOverlapped=0x0) returned 1 [0149.868] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0149.868] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.868] WriteFile (in: hFile=0x3f8, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0149.868] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x6ad10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.868] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.868] CloseHandle (hObject=0x3f8) returned 1 [0149.868] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEDAO.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acedao.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEDAO.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acedao.dll.play")) returned 1 [0149.870] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1137 os_tid = 0x1774 [0149.862] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.863] ReadFile (in: hFile=0x3e4, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.873] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.873] ReadFile (in: hFile=0x3e4, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.873] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.874] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.874] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0149.874] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0149.874] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0149.874] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.874] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0149.878] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.879] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.879] WriteFile (in: hFile=0x3e4, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0149.879] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.879] ReadFile (in: hFile=0x3e4, lpBuffer=0x3350000, nNumberOfBytesToRead=0x98d8, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x10c0f61c*=0x98d8, lpOverlapped=0x0) returned 1 [0149.881] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xffff6728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.881] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3350000, cbInput=0x98d8, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x10c0f848, pbOutput=0x3350000, pcbResult=0x10c0f618) returned 0x0 [0149.881] WriteFile (in: hFile=0x3e4, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x98e0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x10c0f61c*=0x98e0, lpOverlapped=0x0) returned 1 [0149.881] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0149.881] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.881] WriteFile (in: hFile=0x3e4, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.881] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x98e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.882] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.882] CloseHandle (hObject=0x3e4) returned 1 [0149.882] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEERR.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceerr.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEERR.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceerr.dll.play")) returned 1 [0149.883] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1138 os_tid = 0x1778 [0149.885] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.885] ReadFile (in: hFile=0x558, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.887] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.887] ReadFile (in: hFile=0x558, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.887] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.888] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.888] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0149.888] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0149.888] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0149.888] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.888] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0149.891] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.893] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.893] WriteFile (in: hFile=0x558, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0149.893] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.893] ReadFile (in: hFile=0x558, lpBuffer=0x3450000, nNumberOfBytesToRead=0x9b2f0, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x10d4f61c*=0x9b2f0, lpOverlapped=0x0) returned 1 [0149.903] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfff64d10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.903] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3450000, cbInput=0x9b2f0, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x10d4f848, pbOutput=0x3450000, pcbResult=0x10d4f618) returned 0x0 [0149.903] WriteFile (in: hFile=0x558, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x9b300, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10d4f61c*=0x9b300, lpOverlapped=0x0) returned 1 [0149.905] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0149.905] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.905] WriteFile (in: hFile=0x558, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.905] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x9b300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.905] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.905] CloseHandle (hObject=0x558) returned 1 [0149.906] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acees.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEES.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acees.dll.play")) returned 1 [0149.907] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1139 os_tid = 0x177c [0149.897] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.897] ReadFile (in: hFile=0x560, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.910] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.910] ReadFile (in: hFile=0x560, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.910] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.911] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.911] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0149.911] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0149.911] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0149.911] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.912] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0149.915] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.916] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.917] WriteFile (in: hFile=0x560, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0149.917] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.917] ReadFile (in: hFile=0x560, lpBuffer=0x3550000, nNumberOfBytesToRead=0x2eee8, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x10e8f61c*=0x2eee8, lpOverlapped=0x0) returned 1 [0149.920] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xfffd1118, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.920] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3550000, cbInput=0x2eee8, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x10e8f848, pbOutput=0x3550000, pcbResult=0x10e8f618) returned 0x0 [0149.921] WriteFile (in: hFile=0x560, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x2eef0, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x10e8f61c*=0x2eef0, lpOverlapped=0x0) returned 1 [0149.921] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0149.921] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.921] WriteFile (in: hFile=0x560, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.921] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x2eef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.921] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.922] CloseHandle (hObject=0x560) returned 1 [0149.922] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEEXCH.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceexch.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEEXCH.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceexch.dll.play")) returned 1 [0149.923] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1140 os_tid = 0x1780 [0149.918] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.919] ReadFile (in: hFile=0x96c, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.926] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.926] ReadFile (in: hFile=0x96c, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.926] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.927] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.927] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0149.927] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0149.927] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0149.927] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.927] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0149.931] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.932] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.932] WriteFile (in: hFile=0x96c, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0149.932] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.932] ReadFile (in: hFile=0x96c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x622e0, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x10fcf61c*=0x622e0, lpOverlapped=0x0) returned 1 [0149.939] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfff9dd20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.939] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3650000, cbInput=0x622e0, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x10fcf848, pbOutput=0x3650000, pcbResult=0x10fcf618) returned 0x0 [0149.939] WriteFile (in: hFile=0x96c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x622f0, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x10fcf61c*=0x622f0, lpOverlapped=0x0) returned 1 [0149.940] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0149.940] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.940] WriteFile (in: hFile=0x96c, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0149.940] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x622f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.941] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.941] CloseHandle (hObject=0x96c) returned 1 [0149.941] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEEXCL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceexcl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEEXCL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceexcl.dll.play")) returned 1 [0149.942] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1141 os_tid = 0x1784 [0149.936] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.936] ReadFile (in: hFile=0x6dc, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.945] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.946] ReadFile (in: hFile=0x6dc, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.946] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.946] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.946] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0149.946] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0149.946] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0149.947] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.947] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0149.950] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.951] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.951] WriteFile (in: hFile=0x6dc, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0149.951] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.951] ReadFile (in: hFile=0x6dc, lpBuffer=0x3750000, nNumberOfBytesToRead=0x458f8, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1110f61c*=0x458f8, lpOverlapped=0x0) returned 1 [0149.956] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffba708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.956] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3750000, cbInput=0x458f8, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x1110f848, pbOutput=0x3750000, pcbResult=0x1110f618) returned 0x0 [0149.957] WriteFile (in: hFile=0x6dc, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x45900, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1110f61c*=0x45900, lpOverlapped=0x0) returned 1 [0149.958] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0149.958] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.958] WriteFile (in: hFile=0x6dc, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.958] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x45900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.958] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.958] CloseHandle (hObject=0x6dc) returned 1 [0149.958] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEODBC.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceodbc.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEODBC.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceodbc.dll.play")) returned 1 [0149.961] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1142 os_tid = 0x1788 [0149.960] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.960] ReadFile (in: hFile=0x948, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.964] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.964] ReadFile (in: hFile=0x948, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.964] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.965] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.965] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0149.965] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0149.965] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1124f500) returned 0x0 [0149.965] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.965] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1124f500) returned 0x0 [0149.969] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.970] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.970] WriteFile (in: hFile=0x948, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0149.970] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.970] ReadFile (in: hFile=0x948, lpBuffer=0x3850000, nNumberOfBytesToRead=0x4300, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1124f61c*=0x4300, lpOverlapped=0x0) returned 1 [0149.971] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xffffbd00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.971] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3850000, cbInput=0x4300, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x1124f848, pbOutput=0x3850000, pcbResult=0x1124f618) returned 0x0 [0149.971] WriteFile (in: hFile=0x948, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1124f61c*=0x4310, lpOverlapped=0x0) returned 1 [0149.972] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0149.972] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.972] WriteFile (in: hFile=0x948, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.972] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x4310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.972] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.972] CloseHandle (hObject=0x948) returned 1 [0149.972] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.973] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEODEXL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceodexl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEODEXL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceodexl.dll.play")) returned 1 [0149.973] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1143 os_tid = 0x178c [0149.971] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.975] ReadFile (in: hFile=0x360, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.980] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.980] ReadFile (in: hFile=0x360, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0149.981] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.981] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.981] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1138f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0149.981] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1138f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1138f828, pbKeyObject=0x0) returned 0x0 [0149.981] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1138f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1138f500) returned 0x0 [0149.982] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.982] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1138f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1138f500) returned 0x0 [0149.985] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.986] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.986] WriteFile (in: hFile=0x360, lpBuffer=0x1138fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1138f830, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesWritten=0x1138f830*=0x428, lpOverlapped=0x0) returned 1 [0149.986] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.986] ReadFile (in: hFile=0x360, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x4300, lpNumberOfBytesRead=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1138f61c*=0x4300, lpOverlapped=0x0) returned 1 [0149.987] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xffffbd00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.987] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3a50000, cbInput=0x4300, pPaddingInfo=0x0, pbIV=0x1138f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1138f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x1138f848, pbOutput=0x3a50000, pcbResult=0x1138f618) returned 0x0 [0149.987] WriteFile (in: hFile=0x360, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1138f61c*=0x4310, lpOverlapped=0x0) returned 1 [0149.987] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1138f60c | out: lpNewFilePointer=0x0) returned 1 [0149.987] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.987] WriteFile (in: hFile=0x360, lpBuffer=0x1138f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x1138f83c*, lpNumberOfBytesWritten=0x1138f61c*=0x8, lpOverlapped=0x0) returned 1 [0149.988] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x4310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.988] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0149.988] CloseHandle (hObject=0x360) returned 1 [0149.988] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0149.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEODTXT.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceodtxt.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEODTXT.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceodtxt.dll.play")) returned 1 [0149.989] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1144 os_tid = 0x1790 [0149.991] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.991] ReadFile (in: hFile=0x644, lpBuffer=0x114cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x114cf85c, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesRead=0x114cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.993] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.993] ReadFile (in: hFile=0x644, lpBuffer=0x114cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x114cf85c, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesRead=0x114cf85c*=0x428, lpOverlapped=0x0) returned 1 [0149.993] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0149.994] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0149.994] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x114cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0149.994] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x114cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x114cf828, pbKeyObject=0x0) returned 0x0 [0149.994] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x114cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x114cf500) returned 0x0 [0149.994] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0149.994] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x114cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x114cf500) returned 0x0 [0149.997] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.998] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.998] WriteFile (in: hFile=0x644, lpBuffer=0x114cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x114cf830, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesWritten=0x114cf830*=0x428, lpOverlapped=0x0) returned 1 [0149.998] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.999] ReadFile (in: hFile=0x644, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x4f8e8, lpNumberOfBytesRead=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x114cf61c*=0x4f8e8, lpOverlapped=0x0) returned 1 [0150.004] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffb0718, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.004] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3b50000, cbInput=0x4f8e8, pPaddingInfo=0x0, pbIV=0x114cf848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x114cf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x114cf848, pbOutput=0x3b50000, pcbResult=0x114cf618) returned 0x0 [0150.004] WriteFile (in: hFile=0x644, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x4f8f0, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x114cf61c*=0x4f8f0, lpOverlapped=0x0) returned 1 [0150.005] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x114cf60c | out: lpNewFilePointer=0x0) returned 1 [0150.005] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.005] WriteFile (in: hFile=0x644, lpBuffer=0x114cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x114cf83c*, lpNumberOfBytesWritten=0x114cf61c*=0x8, lpOverlapped=0x0) returned 1 [0150.005] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x4f8f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.005] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0150.005] CloseHandle (hObject=0x644) returned 1 [0150.005] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEOLEDB.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceoledb.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEOLEDB.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\aceoledb.dll.play")) returned 1 [0150.007] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1145 os_tid = 0x1794 [0150.001] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.001] ReadFile (in: hFile=0x35c, lpBuffer=0x1160fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1160f85c, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesRead=0x1160f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.010] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.010] ReadFile (in: hFile=0x35c, lpBuffer=0x1160fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1160f85c, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesRead=0x1160f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.010] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.011] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.011] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x1160f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0150.011] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x1160f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x1160f828, pbKeyObject=0x0) returned 0x0 [0150.011] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1160f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1160f500) returned 0x0 [0150.011] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.011] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1160f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1160f500) returned 0x0 [0150.014] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.015] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.015] WriteFile (in: hFile=0x35c, lpBuffer=0x1160fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1160f830, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesWritten=0x1160f830*=0x428, lpOverlapped=0x0) returned 1 [0150.016] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.016] ReadFile (in: hFile=0x35c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x27ed8, lpNumberOfBytesRead=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x1160f61c*=0x27ed8, lpOverlapped=0x0) returned 1 [0150.018] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffd8128, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.019] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3c50000, cbInput=0x27ed8, pPaddingInfo=0x0, pbIV=0x1160f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x1160f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x1160f848, pbOutput=0x3c50000, pcbResult=0x1160f618) returned 0x0 [0150.019] WriteFile (in: hFile=0x35c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x27ee0, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x1160f61c*=0x27ee0, lpOverlapped=0x0) returned 1 [0150.019] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1160f60c | out: lpNewFilePointer=0x0) returned 1 [0150.019] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.019] WriteFile (in: hFile=0x35c, lpBuffer=0x1160f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x1160f83c*, lpNumberOfBytesWritten=0x1160f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.019] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x27ee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.020] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0150.020] CloseHandle (hObject=0x35c) returned 1 [0150.020] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACETXT.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acetxt.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACETXT.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acetxt.dll.play")) returned 1 [0150.021] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1146 os_tid = 0x1798 [0150.017] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.017] ReadFile (in: hFile=0x8ec, lpBuffer=0x1174fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1174f85c, lpOverlapped=0x0 | out: lpBuffer=0x1174fb34*, lpNumberOfBytesRead=0x1174f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.026] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.026] ReadFile (in: hFile=0x8ec, lpBuffer=0x1174fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1174f85c, lpOverlapped=0x0 | out: lpBuffer=0x1174fb34*, lpNumberOfBytesRead=0x1174f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.026] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.027] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.027] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x1174f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0150.027] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x1174f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x1174f828, pbKeyObject=0x0) returned 0x0 [0150.027] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1174f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1174f500) returned 0x0 [0150.027] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.027] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1174f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1174f500) returned 0x0 [0150.030] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.031] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.031] WriteFile (in: hFile=0x8ec, lpBuffer=0x1174fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1174f830, lpOverlapped=0x0 | out: lpBuffer=0x1174fb34*, lpNumberOfBytesWritten=0x1174f830*=0x428, lpOverlapped=0x0) returned 1 [0150.032] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.032] ReadFile (in: hFile=0x8ec, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x1174f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.047] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.047] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3d50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1174f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x1174f618, dwFlags=0x0 | out: hKey=0x1a6d99d0, pbIV=0x1174f848, pbOutput=0x3d50000, pcbResult=0x1174f618) returned 0x0 [0150.048] WriteFile (in: hFile=0x8ec, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x1174f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.051] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1174f60c | out: lpNewFilePointer=0x0) returned 1 [0150.051] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.051] WriteFile (in: hFile=0x8ec, lpBuffer=0x1174f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x1174f83c*, lpNumberOfBytesWritten=0x1174f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.051] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.051] ReadFile (in: hFile=0x8ec, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x1174f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.709] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.709] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3d50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1174f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x1174f618, dwFlags=0x0 | out: hKey=0x1a6d99d0, pbIV=0x1174f848, pbOutput=0x3d50000, pcbResult=0x1174f618) returned 0x0 [0150.711] WriteFile (in: hFile=0x8ec, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x1174f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.715] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1174f60c | out: lpNewFilePointer=0x0) returned 1 [0150.716] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.716] WriteFile (in: hFile=0x8ec, lpBuffer=0x1174f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x1174f83c*, lpNumberOfBytesWritten=0x1174f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.716] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.716] ReadFile (in: hFile=0x8ec, lpBuffer=0x3d50000, nNumberOfBytesToRead=0xe8ce8, lpNumberOfBytesRead=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x1174f61c*=0xe8ce8, lpOverlapped=0x0) returned 1 [0151.911] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfff17318, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.911] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3d50000, cbInput=0xe8ce8, pPaddingInfo=0x0, pbIV=0x1174f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x1174f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x1174f848, pbOutput=0x3d50000, pcbResult=0x1174f618) returned 0x0 [0151.912] WriteFile (in: hFile=0x8ec, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0xe8cf0, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x1174f61c*=0xe8cf0, lpOverlapped=0x0) returned 1 [0151.915] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1174f60c | out: lpNewFilePointer=0x0) returned 1 [0151.915] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.915] WriteFile (in: hFile=0x8ec, lpBuffer=0x1174f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x1174f83c*, lpNumberOfBytesWritten=0x1174f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.915] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x2e8cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.915] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0151.915] CloseHandle (hObject=0x8ec) returned 1 [0151.916] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0151.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEWDAT.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acewdat.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEWDAT.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acewdat.dll.play")) returned 1 [0152.264] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1147 os_tid = 0x179c [0150.067] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.067] ReadFile (in: hFile=0x9ac, lpBuffer=0x1188fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1188f85c, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesRead=0x1188f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.070] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.070] ReadFile (in: hFile=0x9ac, lpBuffer=0x1188fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1188f85c, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesRead=0x1188f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.070] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.072] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x1188f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0150.072] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x1188f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x1188f828, pbKeyObject=0x0) returned 0x0 [0150.072] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1188f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1188f500) returned 0x0 [0150.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.072] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1188f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1188f500) returned 0x0 [0150.077] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.079] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.079] WriteFile (in: hFile=0x9ac, lpBuffer=0x1188fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1188f830, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesWritten=0x1188f830*=0x428, lpOverlapped=0x0) returned 1 [0150.079] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.079] ReadFile (in: hFile=0x9ac, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x60ae8, lpNumberOfBytesRead=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x1188f61c*=0x60ae8, lpOverlapped=0x0) returned 1 [0150.086] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0xfff9f518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.086] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3e50000, cbInput=0x60ae8, pPaddingInfo=0x0, pbIV=0x1188f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x1188f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x1188f848, pbOutput=0x3e50000, pcbResult=0x1188f618) returned 0x0 [0150.087] WriteFile (in: hFile=0x9ac, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x60af0, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x1188f61c*=0x60af0, lpOverlapped=0x0) returned 1 [0150.088] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1188f60c | out: lpNewFilePointer=0x0) returned 1 [0150.088] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.088] WriteFile (in: hFile=0x9ac, lpBuffer=0x1188f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x1188f83c*, lpNumberOfBytesWritten=0x1188f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.088] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x60af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.088] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0150.088] CloseHandle (hObject=0x9ac) returned 1 [0150.088] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEWSS.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acewss.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ACEWSS.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\acewss.dll.play")) returned 1 [0150.090] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1148 os_tid = 0x17a0 [0150.092] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.092] ReadFile (in: hFile=0x9b4, lpBuffer=0x119cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x119cf85c, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesRead=0x119cf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.094] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.094] ReadFile (in: hFile=0x9b4, lpBuffer=0x119cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x119cf85c, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesRead=0x119cf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.094] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.095] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.095] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x119cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0150.095] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x119cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x119cf828, pbKeyObject=0x0) returned 0x0 [0150.095] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x119cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x119cf500) returned 0x0 [0150.095] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.095] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x119cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x119cf500) returned 0x0 [0150.099] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.100] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.100] WriteFile (in: hFile=0x9b4, lpBuffer=0x119cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x119cf830, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesWritten=0x119cf830*=0x428, lpOverlapped=0x0) returned 1 [0150.100] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.100] ReadFile (in: hFile=0x9b4, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xaa4a8, lpNumberOfBytesRead=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x119cf61c*=0xaa4a8, lpOverlapped=0x0) returned 1 [0150.110] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfff55b58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.110] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3f50000, cbInput=0xaa4a8, pPaddingInfo=0x0, pbIV=0x119cf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x119cf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x119cf848, pbOutput=0x3f50000, pcbResult=0x119cf618) returned 0x0 [0150.110] WriteFile (in: hFile=0x9b4, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xaa4b0, lpNumberOfBytesWritten=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x119cf61c*=0xaa4b0, lpOverlapped=0x0) returned 1 [0150.112] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x119cf60c | out: lpNewFilePointer=0x0) returned 1 [0150.112] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.113] WriteFile (in: hFile=0x9b4, lpBuffer=0x119cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x119cf83c*, lpNumberOfBytesWritten=0x119cf61c*=0x8, lpOverlapped=0x0) returned 1 [0150.113] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xaa4b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.113] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0150.113] CloseHandle (hObject=0x9b4) returned 1 [0150.113] VirtualAlloc (lpAddress=0x0, dwSize=0xa1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ADAL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\adal.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\ADAL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\adal.dll.play")) returned 1 [0150.114] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1149 os_tid = 0x17a4 [0150.214] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.214] ReadFile (in: hFile=0x8ac, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.216] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.216] ReadFile (in: hFile=0x8ac, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.216] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.217] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.217] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0150.217] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0150.217] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0150.217] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.218] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0150.223] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.225] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.225] WriteFile (in: hFile=0x8ac, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0150.225] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.225] ReadFile (in: hFile=0x8ac, lpBuffer=0x4050000, nNumberOfBytesToRead=0x34c79, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0xe9f61c*=0x34c79, lpOverlapped=0x0) returned 1 [0150.229] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffcb387, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.229] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x4050000, cbInput=0x34c79, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xe9f848, pbOutput=0x4050000, pcbResult=0xe9f618) returned 0x0 [0150.230] WriteFile (in: hFile=0x8ac, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x34c80, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0xe9f61c*=0x34c80, lpOverlapped=0x0) returned 1 [0150.230] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0150.230] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.231] WriteFile (in: hFile=0x8ac, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.231] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x34c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.231] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0150.231] CloseHandle (hObject=0x8ac) returned 1 [0150.231] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.232] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\airspace.etw.man"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\airspace.etw.man.play")) returned 1 [0150.233] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1150 os_tid = 0x17a8 [0150.228] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.228] ReadFile (in: hFile=0xb10, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.236] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.236] ReadFile (in: hFile=0xb10, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.237] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.237] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.237] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0150.237] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0150.237] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0150.238] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.238] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0150.241] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.264] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.264] WriteFile (in: hFile=0xb10, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0150.265] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.265] ReadFile (in: hFile=0xb10, lpBuffer=0x2750000, nNumberOfBytesToRead=0xeca8, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0xeca8, lpOverlapped=0x0) returned 1 [0150.266] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xffff1358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.266] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2750000, cbInput=0xeca8, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0150.266] WriteFile (in: hFile=0xb10, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xecb0, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0xecb0, lpOverlapped=0x0) returned 1 [0150.267] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0150.267] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.267] WriteFile (in: hFile=0xb10, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.267] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xecb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.267] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0150.267] CloseHandle (hObject=0xb10) returned 1 [0150.267] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\AIRWER.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\airwer.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\AIRWER.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\airwer.dll.play")) returned 1 [0150.269] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1151 os_tid = 0x17ac [0150.271] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.271] ReadFile (in: hFile=0x334, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.272] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.272] ReadFile (in: hFile=0x334, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.272] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.273] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.273] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0150.275] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0150.275] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0150.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.276] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0150.279] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.280] WriteFile (in: hFile=0x334, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0150.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.280] ReadFile (in: hFile=0x334, lpBuffer=0x2850000, nNumberOfBytesToRead=0x17ef0, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xf34f61c*=0x17ef0, lpOverlapped=0x0) returned 1 [0150.282] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffe8110, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.282] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2850000, cbInput=0x17ef0, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xf34f848, pbOutput=0x2850000, pcbResult=0xf34f618) returned 0x0 [0150.282] WriteFile (in: hFile=0x334, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x17f00, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xf34f61c*=0x17f00, lpOverlapped=0x0) returned 1 [0150.282] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0150.282] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.282] WriteFile (in: hFile=0x334, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.283] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x17f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.283] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0150.283] CloseHandle (hObject=0x334) returned 1 [0150.283] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\csisyncclient.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\csisyncclient.exe.play")) returned 1 [0150.285] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1152 os_tid = 0x17b0 [0150.281] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.281] ReadFile (in: hFile=0x8d0, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.289] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.289] ReadFile (in: hFile=0x8d0, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.289] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.290] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.290] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0150.290] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0150.290] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0150.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.291] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0150.296] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.298] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.298] WriteFile (in: hFile=0x8d0, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0150.298] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.298] ReadFile (in: hFile=0x8d0, lpBuffer=0x3950000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0xf48f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.313] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.314] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3950000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x0 | out: hKey=0x1a6d9c60, pbIV=0xf48f848, pbOutput=0x3950000, pcbResult=0xf48f618) returned 0x0 [0150.315] WriteFile (in: hFile=0x8d0, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0xf48f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.318] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0150.318] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.318] WriteFile (in: hFile=0x8d0, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.318] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.318] ReadFile (in: hFile=0x8d0, lpBuffer=0x3950000, nNumberOfBytesToRead=0xb82a8, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0xf48f61c*=0xb82a8, lpOverlapped=0x0) returned 1 [0150.787] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfff47d58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.787] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3950000, cbInput=0xb82a8, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xf48f848, pbOutput=0x3950000, pcbResult=0xf48f618) returned 0x0 [0150.788] WriteFile (in: hFile=0x8d0, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0xb82b0, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0xf48f61c*=0xb82b0, lpOverlapped=0x0) returned 1 [0150.791] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0150.791] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.791] WriteFile (in: hFile=0x8d0, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.791] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x1b82b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.791] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0150.791] CloseHandle (hObject=0x8d0) returned 1 [0150.792] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\cultures\\office.odf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\cultures\\office.odf.play")) returned 1 [0150.796] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1153 os_tid = 0x17b4 [0150.328] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.328] ReadFile (in: hFile=0x814, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.331] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.331] ReadFile (in: hFile=0x814, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.331] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.332] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.332] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0150.332] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0150.332] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0150.332] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.333] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0150.336] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.337] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.337] WriteFile (in: hFile=0x814, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0150.338] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.338] ReadFile (in: hFile=0x814, lpBuffer=0x4150000, nNumberOfBytesToRead=0x43e4, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0xfe4f61c*=0x43e4, lpOverlapped=0x0) returned 1 [0150.339] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xffffbc1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.339] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4150000, cbInput=0x43e4, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xfe4f848, pbOutput=0x4150000, pcbResult=0xfe4f618) returned 0x0 [0150.339] WriteFile (in: hFile=0x814, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x43f0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0xfe4f61c*=0x43f0, lpOverlapped=0x0) returned 1 [0150.339] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0150.339] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.339] WriteFile (in: hFile=0x814, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.339] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x43f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.339] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.339] CloseHandle (hObject=0x814) returned 1 [0150.340] VirtualAlloc (lpAddress=0x0, dwSize=0xcb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\as80.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\as80.xsl.play")) returned 1 [0150.344] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1154 os_tid = 0x17b8 [0150.338] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.338] ReadFile (in: hFile=0x81c, lpBuffer=0x11b0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11b0f85c, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesRead=0x11b0f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.378] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.378] ReadFile (in: hFile=0x81c, lpBuffer=0x11b0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11b0f85c, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesRead=0x11b0f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.378] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.380] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.380] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x11b0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0150.380] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x11b0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x11b0f828, pbKeyObject=0x0) returned 0x0 [0150.380] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x11b0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x11b0f500) returned 0x0 [0150.380] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.380] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x11b0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x11b0f500) returned 0x0 [0150.384] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.385] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.386] WriteFile (in: hFile=0x81c, lpBuffer=0x11b0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11b0f830, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesWritten=0x11b0f830*=0x428, lpOverlapped=0x0) returned 1 [0150.386] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.386] ReadFile (in: hFile=0x81c, lpBuffer=0x4250000, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x11b0f61c*=0x49ba, lpOverlapped=0x0) returned 1 [0150.391] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xffffb646, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.391] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4250000, cbInput=0x49ba, pPaddingInfo=0x0, pbIV=0x11b0f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x11b0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x11b0f848, pbOutput=0x4250000, pcbResult=0x11b0f618) returned 0x0 [0150.391] WriteFile (in: hFile=0x81c, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x11b0f61c*=0x49c0, lpOverlapped=0x0) returned 1 [0150.392] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11b0f60c | out: lpNewFilePointer=0x0) returned 1 [0150.392] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.392] WriteFile (in: hFile=0x81c, lpBuffer=0x11b0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x11b0f83c*, lpNumberOfBytesWritten=0x11b0f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.392] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x49c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.392] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.392] CloseHandle (hObject=0x81c) returned 1 [0150.392] VirtualAlloc (lpAddress=0x0, dwSize=0xcb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\as90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\as90.xsl.play")) returned 1 [0150.394] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1155 os_tid = 0x17bc [0150.401] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.401] ReadFile (in: hFile=0x824, lpBuffer=0x11c4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11c4f85c, lpOverlapped=0x0 | out: lpBuffer=0x11c4fb34*, lpNumberOfBytesRead=0x11c4f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.456] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.456] ReadFile (in: hFile=0x824, lpBuffer=0x11c4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11c4f85c, lpOverlapped=0x0 | out: lpBuffer=0x11c4fb34*, lpNumberOfBytesRead=0x11c4f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.457] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.459] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x11c4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0150.459] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x11c4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x11c4f828, pbKeyObject=0x0) returned 0x0 [0150.459] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x11c4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x11c4f500) returned 0x0 [0150.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.459] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x11c4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x11c4f500) returned 0x0 [0150.463] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.465] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.465] WriteFile (in: hFile=0x824, lpBuffer=0x11c4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11c4f830, lpOverlapped=0x0 | out: lpBuffer=0x11c4fb34*, lpNumberOfBytesWritten=0x11c4f830*=0x428, lpOverlapped=0x0) returned 1 [0150.465] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.465] ReadFile (in: hFile=0x824, lpBuffer=0x4350000, nNumberOfBytesToRead=0x75ab, lpNumberOfBytesRead=0x11c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x11c4f61c*=0x75ab, lpOverlapped=0x0) returned 1 [0150.470] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xffff8a55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.470] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4350000, cbInput=0x75ab, pPaddingInfo=0x0, pbIV=0x11c4f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x11c4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x11c4f848, pbOutput=0x4350000, pcbResult=0x11c4f618) returned 0x0 [0150.470] WriteFile (in: hFile=0x824, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x11c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x11c4f61c*=0x75b0, lpOverlapped=0x0) returned 1 [0150.470] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11c4f60c | out: lpNewFilePointer=0x0) returned 1 [0150.470] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.471] WriteFile (in: hFile=0x824, lpBuffer=0x11c4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11c4f61c, lpOverlapped=0x0 | out: lpBuffer=0x11c4f83c*, lpNumberOfBytesWritten=0x11c4f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.471] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x75b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.471] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.471] CloseHandle (hObject=0x824) returned 1 [0150.471] VirtualAlloc (lpAddress=0x0, dwSize=0xd3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\db2v0801.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\db2v0801.xsl.play")) returned 1 [0150.473] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1156 os_tid = 0x17c0 [0150.457] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.469] ReadFile (in: hFile=0x82c, lpBuffer=0x11d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x11d8fb34*, lpNumberOfBytesRead=0x11d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.477] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.477] ReadFile (in: hFile=0x82c, lpBuffer=0x11d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x11d8fb34*, lpNumberOfBytesRead=0x11d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.478] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.479] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.479] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x11d8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0150.479] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x11d8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x11d8f828, pbKeyObject=0x0) returned 0x0 [0150.479] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x11d8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x11d8f500) returned 0x0 [0150.479] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.479] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x11d8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x11d8f500) returned 0x0 [0150.484] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.486] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.486] WriteFile (in: hFile=0x82c, lpBuffer=0x11d8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11d8f830, lpOverlapped=0x0 | out: lpBuffer=0x11d8fb34*, lpNumberOfBytesWritten=0x11d8f830*=0x428, lpOverlapped=0x0) returned 1 [0150.486] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.486] ReadFile (in: hFile=0x82c, lpBuffer=0x4450000, nNumberOfBytesToRead=0x7b27, lpNumberOfBytesRead=0x11d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x11d8f61c*=0x7b27, lpOverlapped=0x0) returned 1 [0150.487] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0xffff84d9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.488] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4450000, cbInput=0x7b27, pPaddingInfo=0x0, pbIV=0x11d8f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x11d8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x11d8f848, pbOutput=0x4450000, pcbResult=0x11d8f618) returned 0x0 [0150.488] WriteFile (in: hFile=0x82c, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x7b30, lpNumberOfBytesWritten=0x11d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x11d8f61c*=0x7b30, lpOverlapped=0x0) returned 1 [0150.488] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11d8f60c | out: lpNewFilePointer=0x0) returned 1 [0150.488] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.488] WriteFile (in: hFile=0x82c, lpBuffer=0x11d8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x11d8f83c*, lpNumberOfBytesWritten=0x11d8f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.488] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x7b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.488] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.488] CloseHandle (hObject=0x82c) returned 1 [0150.489] VirtualAlloc (lpAddress=0x0, dwSize=0xd3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\informix.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\informix.xsl.play")) returned 1 [0150.491] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1157 os_tid = 0x17c4 [0150.494] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.494] ReadFile (in: hFile=0x834, lpBuffer=0x11ecfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11ecf85c, lpOverlapped=0x0 | out: lpBuffer=0x11ecfb34*, lpNumberOfBytesRead=0x11ecf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.496] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.496] ReadFile (in: hFile=0x834, lpBuffer=0x11ecfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11ecf85c, lpOverlapped=0x0 | out: lpBuffer=0x11ecfb34*, lpNumberOfBytesRead=0x11ecf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.496] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.497] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.497] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x11ecf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0150.497] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x11ecf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x11ecf828, pbKeyObject=0x0) returned 0x0 [0150.497] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x11ecf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x11ecf500) returned 0x0 [0150.498] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.498] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x11ecf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x11ecf500) returned 0x0 [0150.503] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.504] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.505] WriteFile (in: hFile=0x834, lpBuffer=0x11ecfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11ecf830, lpOverlapped=0x0 | out: lpBuffer=0x11ecfb34*, lpNumberOfBytesWritten=0x11ecf830*=0x428, lpOverlapped=0x0) returned 1 [0150.505] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.505] ReadFile (in: hFile=0x834, lpBuffer=0x4550000, nNumberOfBytesToRead=0x7339, lpNumberOfBytesRead=0x11ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x11ecf61c*=0x7339, lpOverlapped=0x0) returned 1 [0150.507] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xffff8cc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.507] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4550000, cbInput=0x7339, pPaddingInfo=0x0, pbIV=0x11ecf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x11ecf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x11ecf848, pbOutput=0x4550000, pcbResult=0x11ecf618) returned 0x0 [0150.507] WriteFile (in: hFile=0x834, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x7340, lpNumberOfBytesWritten=0x11ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x11ecf61c*=0x7340, lpOverlapped=0x0) returned 1 [0150.507] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11ecf60c | out: lpNewFilePointer=0x0) returned 1 [0150.507] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.507] WriteFile (in: hFile=0x834, lpBuffer=0x11ecf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11ecf61c, lpOverlapped=0x0 | out: lpBuffer=0x11ecf83c*, lpNumberOfBytesWritten=0x11ecf61c*=0x8, lpOverlapped=0x0) returned 1 [0150.508] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x7340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.508] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.508] CloseHandle (hObject=0x834) returned 1 [0150.509] VirtualAlloc (lpAddress=0x0, dwSize=0xcd, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.510] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\msjet.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\msjet.xsl.play")) returned 1 [0150.510] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1158 os_tid = 0x17c8 [0150.513] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.513] ReadFile (in: hFile=0x83c, lpBuffer=0x1200fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1200f85c, lpOverlapped=0x0 | out: lpBuffer=0x1200fb34*, lpNumberOfBytesRead=0x1200f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.515] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.515] ReadFile (in: hFile=0x83c, lpBuffer=0x1200fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1200f85c, lpOverlapped=0x0 | out: lpBuffer=0x1200fb34*, lpNumberOfBytesRead=0x1200f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.515] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.516] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.516] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x1200f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0150.516] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x1200f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x1200f828, pbKeyObject=0x0) returned 0x0 [0150.517] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1200f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1200f500) returned 0x0 [0150.517] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.517] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1200f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1200f500) returned 0x0 [0150.521] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.522] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.522] WriteFile (in: hFile=0x83c, lpBuffer=0x1200fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1200f830, lpOverlapped=0x0 | out: lpBuffer=0x1200fb34*, lpNumberOfBytesWritten=0x1200f830*=0x428, lpOverlapped=0x0) returned 1 [0150.522] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.522] ReadFile (in: hFile=0x83c, lpBuffer=0x4650000, nNumberOfBytesToRead=0x8a2a, lpNumberOfBytesRead=0x1200f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x1200f61c*=0x8a2a, lpOverlapped=0x0) returned 1 [0150.524] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xffff75d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.524] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4650000, cbInput=0x8a2a, pPaddingInfo=0x0, pbIV=0x1200f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x1200f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1200f848, pbOutput=0x4650000, pcbResult=0x1200f618) returned 0x0 [0150.524] WriteFile (in: hFile=0x83c, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x8a30, lpNumberOfBytesWritten=0x1200f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x1200f61c*=0x8a30, lpOverlapped=0x0) returned 1 [0150.524] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1200f60c | out: lpNewFilePointer=0x0) returned 1 [0150.524] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.524] WriteFile (in: hFile=0x83c, lpBuffer=0x1200f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1200f61c, lpOverlapped=0x0 | out: lpBuffer=0x1200f83c*, lpNumberOfBytesWritten=0x1200f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.524] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x8a30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.524] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.524] CloseHandle (hObject=0x83c) returned 1 [0150.525] VirtualAlloc (lpAddress=0x0, dwSize=0xcd, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\orcl7.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\orcl7.xsl.play")) returned 1 [0150.527] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1159 os_tid = 0x17d0 [0150.514] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.523] ReadFile (in: hFile=0x284, lpBuffer=0x1214fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1214f85c, lpOverlapped=0x0 | out: lpBuffer=0x1214fb34*, lpNumberOfBytesRead=0x1214f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.530] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.530] ReadFile (in: hFile=0x284, lpBuffer=0x1214fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1214f85c, lpOverlapped=0x0 | out: lpBuffer=0x1214fb34*, lpNumberOfBytesRead=0x1214f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.531] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.532] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.532] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x1214f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0150.532] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x1214f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x1214f828, pbKeyObject=0x0) returned 0x0 [0150.532] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1214f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1214f500) returned 0x0 [0150.533] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.533] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1214f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1214f500) returned 0x0 [0150.538] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.540] WriteFile (in: hFile=0x284, lpBuffer=0x1214fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1214f830, lpOverlapped=0x0 | out: lpBuffer=0x1214fb34*, lpNumberOfBytesWritten=0x1214f830*=0x428, lpOverlapped=0x0) returned 1 [0150.540] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.540] ReadFile (in: hFile=0x284, lpBuffer=0x4750000, nNumberOfBytesToRead=0x858c, lpNumberOfBytesRead=0x1214f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x1214f61c*=0x858c, lpOverlapped=0x0) returned 1 [0150.541] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffff7a74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.541] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4750000, cbInput=0x858c, pPaddingInfo=0x0, pbIV=0x1214f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x1214f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1214f848, pbOutput=0x4750000, pcbResult=0x1214f618) returned 0x0 [0150.542] WriteFile (in: hFile=0x284, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x8590, lpNumberOfBytesWritten=0x1214f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x1214f61c*=0x8590, lpOverlapped=0x0) returned 1 [0150.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1214f60c | out: lpNewFilePointer=0x0) returned 1 [0150.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.542] WriteFile (in: hFile=0x284, lpBuffer=0x1214f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1214f61c, lpOverlapped=0x0 | out: lpBuffer=0x1214f83c*, lpNumberOfBytesWritten=0x1214f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x8590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.542] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.542] CloseHandle (hObject=0x284) returned 1 [0150.543] VirtualAlloc (lpAddress=0x0, dwSize=0xd1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sql2000.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sql2000.xsl.play")) returned 1 [0150.544] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1160 os_tid = 0x17d4 [0150.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.541] ReadFile (in: hFile=0x27c, lpBuffer=0x1228fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1228f85c, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesRead=0x1228f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.548] ReadFile (in: hFile=0x27c, lpBuffer=0x1228fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1228f85c, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesRead=0x1228f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.548] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.550] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.550] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x1228f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0150.550] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x1228f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x1228f828, pbKeyObject=0x0) returned 0x0 [0150.550] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1228f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1228f500) returned 0x0 [0150.550] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.550] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1228f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1228f500) returned 0x0 [0150.555] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.556] WriteFile (in: hFile=0x27c, lpBuffer=0x1228fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1228f830, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesWritten=0x1228f830*=0x428, lpOverlapped=0x0) returned 1 [0150.557] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.557] ReadFile (in: hFile=0x27c, lpBuffer=0x4850000, nNumberOfBytesToRead=0x7e02, lpNumberOfBytesRead=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x1228f61c*=0x7e02, lpOverlapped=0x0) returned 1 [0150.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffff81fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.559] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4850000, cbInput=0x7e02, pPaddingInfo=0x0, pbIV=0x1228f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x1228f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1228f848, pbOutput=0x4850000, pcbResult=0x1228f618) returned 0x0 [0150.559] WriteFile (in: hFile=0x27c, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x7e10, lpNumberOfBytesWritten=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x1228f61c*=0x7e10, lpOverlapped=0x0) returned 1 [0150.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1228f60c | out: lpNewFilePointer=0x0) returned 1 [0150.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.559] WriteFile (in: hFile=0x27c, lpBuffer=0x1228f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x1228f83c*, lpNumberOfBytesWritten=0x1228f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x7e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.559] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.559] CloseHandle (hObject=0x27c) returned 1 [0150.560] VirtualAlloc (lpAddress=0x0, dwSize=0xcd, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sql70.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sql70.xsl.play")) returned 1 [0150.562] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1161 os_tid = 0x17d8 [0150.564] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.564] ReadFile (in: hFile=0x274, lpBuffer=0x123cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x123cf85c, lpOverlapped=0x0 | out: lpBuffer=0x123cfb34*, lpNumberOfBytesRead=0x123cf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.568] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.568] ReadFile (in: hFile=0x274, lpBuffer=0x123cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x123cf85c, lpOverlapped=0x0 | out: lpBuffer=0x123cfb34*, lpNumberOfBytesRead=0x123cf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.569] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.570] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.570] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x123cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0150.570] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x123cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x123cf828, pbKeyObject=0x0) returned 0x0 [0150.570] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x123cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x123cf500) returned 0x0 [0150.570] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.571] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x123cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x123cf500) returned 0x0 [0150.575] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.577] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.577] WriteFile (in: hFile=0x274, lpBuffer=0x123cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x123cf830, lpOverlapped=0x0 | out: lpBuffer=0x123cfb34*, lpNumberOfBytesWritten=0x123cf830*=0x428, lpOverlapped=0x0) returned 1 [0150.577] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.577] ReadFile (in: hFile=0x274, lpBuffer=0x4950000, nNumberOfBytesToRead=0x18559, lpNumberOfBytesRead=0x123cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x123cf61c*=0x18559, lpOverlapped=0x0) returned 1 [0150.581] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xfffe7aa7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.582] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4950000, cbInput=0x18559, pPaddingInfo=0x0, pbIV=0x123cf848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x123cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x123cf848, pbOutput=0x4950000, pcbResult=0x123cf618) returned 0x0 [0150.582] WriteFile (in: hFile=0x274, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x18560, lpNumberOfBytesWritten=0x123cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x123cf61c*=0x18560, lpOverlapped=0x0) returned 1 [0150.582] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x123cf60c | out: lpNewFilePointer=0x0) returned 1 [0150.582] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.582] WriteFile (in: hFile=0x274, lpBuffer=0x123cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x123cf61c, lpOverlapped=0x0 | out: lpBuffer=0x123cf83c*, lpNumberOfBytesWritten=0x123cf61c*=0x8, lpOverlapped=0x0) returned 1 [0150.582] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x18560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.583] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.583] CloseHandle (hObject=0x274) returned 1 [0150.583] VirtualAlloc (lpAddress=0x0, dwSize=0xcd, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sql90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sql90.xsl.play")) returned 1 [0150.585] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1162 os_tid = 0x17dc [0150.568] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.580] ReadFile (in: hFile=0x26c, lpBuffer=0x1250fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1250f85c, lpOverlapped=0x0 | out: lpBuffer=0x1250fb34*, lpNumberOfBytesRead=0x1250f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.589] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.589] ReadFile (in: hFile=0x26c, lpBuffer=0x1250fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1250f85c, lpOverlapped=0x0 | out: lpBuffer=0x1250fb34*, lpNumberOfBytesRead=0x1250f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.589] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0150.590] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0150.590] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x1250f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0150.590] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x1250f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x1250f828, pbKeyObject=0x0) returned 0x0 [0150.590] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1250f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1250f500) returned 0x0 [0150.590] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0150.591] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1250f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1250f500) returned 0x0 [0150.595] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.596] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.597] WriteFile (in: hFile=0x26c, lpBuffer=0x1250fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1250f830, lpOverlapped=0x0 | out: lpBuffer=0x1250fb34*, lpNumberOfBytesWritten=0x1250f830*=0x428, lpOverlapped=0x0) returned 1 [0150.597] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.597] ReadFile (in: hFile=0x26c, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x1393e, lpNumberOfBytesRead=0x1250f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x1250f61c*=0x1393e, lpOverlapped=0x0) returned 1 [0150.600] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xfffec6c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.600] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4a50000, cbInput=0x1393e, pPaddingInfo=0x0, pbIV=0x1250f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x1250f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1250f848, pbOutput=0x4a50000, pcbResult=0x1250f618) returned 0x0 [0150.600] WriteFile (in: hFile=0x26c, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x13940, lpNumberOfBytesWritten=0x1250f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x1250f61c*=0x13940, lpOverlapped=0x0) returned 1 [0150.600] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1250f60c | out: lpNewFilePointer=0x0) returned 1 [0150.601] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.601] WriteFile (in: hFile=0x26c, lpBuffer=0x1250f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1250f61c, lpOverlapped=0x0 | out: lpBuffer=0x1250f83c*, lpNumberOfBytesWritten=0x1250f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.601] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x13940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.601] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0150.601] CloseHandle (hObject=0x26c) returned 1 [0150.601] VirtualAlloc (lpAddress=0x0, dwSize=0xcf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sqlpdw.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sqlpdw.xsl.play")) returned 1 [0150.604] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1163 os_tid = 0x17e0 [0150.739] VirtualAlloc (lpAddress=0x0, dwSize=0xf4, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0150.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0150.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f090c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0150.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0150.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0924, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0150.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0150.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f093c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0150.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0150.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0954, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0150.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0150.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f096c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0150.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0150.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0984, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0150.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0150.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f099c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0150.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0150.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0150.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0150.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0150.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0150.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0150.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0150.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0150.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0150.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0150.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0150.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0150.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0150.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0150.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0150.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0150.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0150.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a74, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0150.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0150.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a8c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0150.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0150.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0150.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0150.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0abc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0150.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0150.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ad4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0150.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0151.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0151.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0151.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b04, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0151.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0151.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0151.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0151.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0151.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0151.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0151.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0151.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0151.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0151.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0151.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0152.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b94, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0152.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0152.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0152.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0152.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bc4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0152.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0152.004] WaitForMultipleObjects (nCount=0x3d, lpHandles=0x6f0000*=0x3f4, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0153.538] CloseHandle (hObject=0x3f4) returned 1 [0153.538] CloseHandle (hObject=0x358) returned 1 [0153.538] CloseHandle (hObject=0xaec) returned 1 [0153.539] CloseHandle (hObject=0x26c) returned 1 [0153.539] CloseHandle (hObject=0x274) returned 1 [0153.539] CloseHandle (hObject=0x27c) returned 1 [0153.546] CloseHandle (hObject=0x284) returned 1 [0153.546] CloseHandle (hObject=0x83c) returned 1 [0153.546] CloseHandle (hObject=0x834) returned 1 [0153.546] CloseHandle (hObject=0x82c) returned 1 [0153.547] CloseHandle (hObject=0x824) returned 1 [0153.547] CloseHandle (hObject=0x398) returned 1 [0153.547] CloseHandle (hObject=0x938) returned 1 [0153.547] CloseHandle (hObject=0x388) returned 1 [0153.547] CloseHandle (hObject=0x37c) returned 1 [0153.547] CloseHandle (hObject=0x380) returned 1 [0153.547] CloseHandle (hObject=0x940) returned 1 [0153.547] CloseHandle (hObject=0x8a8) returned 1 [0153.547] CloseHandle (hObject=0x38c) returned 1 [0153.547] CloseHandle (hObject=0x390) returned 1 [0153.547] CloseHandle (hObject=0x39c) returned 1 [0153.547] CloseHandle (hObject=0x3a0) returned 1 [0153.547] CloseHandle (hObject=0x3a4) returned 1 [0153.547] CloseHandle (hObject=0x3a8) returned 1 [0153.547] CloseHandle (hObject=0x928) returned 1 [0153.547] CloseHandle (hObject=0x4d8) returned 1 [0153.547] CloseHandle (hObject=0x304) returned 1 [0153.547] CloseHandle (hObject=0x65c) returned 1 [0153.548] CloseHandle (hObject=0x66c) returned 1 [0153.548] CloseHandle (hObject=0x52c) returned 1 [0153.548] CloseHandle (hObject=0x6e0) returned 1 [0153.548] CloseHandle (hObject=0x568) returned 1 [0153.548] CloseHandle (hObject=0x56c) returned 1 [0153.548] CloseHandle (hObject=0x570) returned 1 [0153.548] CloseHandle (hObject=0x574) returned 1 [0153.548] CloseHandle (hObject=0x578) returned 1 [0153.548] CloseHandle (hObject=0x57c) returned 1 [0153.548] CloseHandle (hObject=0x580) returned 1 [0153.548] CloseHandle (hObject=0x584) returned 1 [0153.548] CloseHandle (hObject=0x588) returned 1 [0153.548] CloseHandle (hObject=0x790) returned 1 [0153.548] CloseHandle (hObject=0x794) returned 1 [0153.548] CloseHandle (hObject=0x798) returned 1 [0153.548] CloseHandle (hObject=0x79c) returned 1 [0153.548] CloseHandle (hObject=0x7a0) returned 1 [0153.549] CloseHandle (hObject=0x7a4) returned 1 [0153.549] CloseHandle (hObject=0x7a8) returned 1 [0153.549] CloseHandle (hObject=0x7ac) returned 1 [0153.549] CloseHandle (hObject=0x7b0) returned 1 [0153.549] CloseHandle (hObject=0x7b4) returned 1 [0153.549] CloseHandle (hObject=0x7c4) returned 1 [0153.549] CloseHandle (hObject=0x7c8) returned 1 [0153.549] CloseHandle (hObject=0x7cc) returned 1 [0153.549] CloseHandle (hObject=0x7d0) returned 1 [0153.549] CloseHandle (hObject=0x7d4) returned 1 [0153.549] CloseHandle (hObject=0x7d8) returned 1 [0153.549] CloseHandle (hObject=0x2ac) returned 1 [0153.549] CloseHandle (hObject=0x208) returned 1 [0153.549] CloseHandle (hObject=0x488) returned 1 [0153.549] CloseHandle (hObject=0x2c0) returned 1 [0153.549] CloseHandle (hObject=0x684) returned 1 [0153.549] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1164 os_tid = 0x17e4 Thread: id = 1165 os_tid = 0x17e8 [0150.799] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.799] ReadFile (in: hFile=0x814, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.801] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.801] ReadFile (in: hFile=0x814, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.802] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.803] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.804] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0150.804] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0150.804] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0150.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.804] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0150.809] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.810] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.810] WriteFile (in: hFile=0x814, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0150.811] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.811] ReadFile (in: hFile=0x814, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x76a1, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0xe9f61c*=0x76a1, lpOverlapped=0x0) returned 1 [0150.824] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xffff895f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.824] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4b50000, cbInput=0x76a1, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe9f848, pbOutput=0x4b50000, pcbResult=0xe9f618) returned 0x0 [0150.824] WriteFile (in: hFile=0x814, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x76b0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0xe9f61c*=0x76b0, lpOverlapped=0x0) returned 1 [0150.824] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0150.824] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.824] WriteFile (in: hFile=0x814, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.824] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x76b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.825] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.825] CloseHandle (hObject=0x814) returned 1 [0150.825] VirtualAlloc (lpAddress=0x0, dwSize=0xcf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sybase.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\sybase.xsl.play")) returned 1 [0150.827] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1166 os_tid = 0x17ec [0150.802] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.830] ReadFile (in: hFile=0xb10, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.832] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.833] ReadFile (in: hFile=0xb10, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.833] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.834] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.834] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0150.834] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0150.834] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0150.834] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.834] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0150.839] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.841] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.841] WriteFile (in: hFile=0xb10, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0150.841] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.842] ReadFile (in: hFile=0xb10, lpBuffer=0x2750000, nNumberOfBytesToRead=0x6c42, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x6c42, lpOverlapped=0x0) returned 1 [0150.843] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xffff93be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.843] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0x6c42, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0150.843] WriteFile (in: hFile=0xb10, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x6c50, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x6c50, lpOverlapped=0x0) returned 1 [0150.843] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0150.843] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.843] WriteFile (in: hFile=0xb10, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.843] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x6c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.843] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.843] CloseHandle (hObject=0xb10) returned 1 [0150.844] VirtualAlloc (lpAddress=0x0, dwSize=0xd5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\trdtv2r41.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\cartridges\\trdtv2r41.xsl.play")) returned 1 [0150.846] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1167 os_tid = 0x17f0 [0150.842] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.848] ReadFile (in: hFile=0x9b4, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.850] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.850] ReadFile (in: hFile=0x9b4, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.850] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.851] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.851] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0150.851] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0150.851] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf34f500) returned 0x0 [0150.852] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.852] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf34f500) returned 0x0 [0150.856] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.858] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.858] WriteFile (in: hFile=0x9b4, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0150.858] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.858] ReadFile (in: hFile=0x9b4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xf34f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.886] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.886] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0xf34f848, pbOutput=0x2850000, pcbResult=0xf34f618) returned 0x0 [0150.887] WriteFile (in: hFile=0x9b4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xf34f61c*=0x100000, lpOverlapped=0x0) returned 1 [0150.891] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0150.891] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.891] WriteFile (in: hFile=0x9b4, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.891] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.891] ReadFile (in: hFile=0x9b4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x14ac0, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xf34f61c*=0x14ac0, lpOverlapped=0x0) returned 1 [0150.898] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffeb540, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.898] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2850000, cbInput=0x14ac0, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf34f848, pbOutput=0x2850000, pcbResult=0xf34f618) returned 0x0 [0150.898] WriteFile (in: hFile=0x9b4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x14ad0, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xf34f61c*=0x14ad0, lpOverlapped=0x0) returned 1 [0150.899] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0150.899] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.899] WriteFile (in: hFile=0x9b4, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.899] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x114ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.899] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.899] CloseHandle (hObject=0x9b4) returned 1 [0150.900] VirtualAlloc (lpAddress=0x0, dwSize=0xe1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\resources\\1033\\msmdsrvi_xl.rll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\datamodel\\resources\\1033\\msmdsrvi_xl.rll.play")) returned 1 [0150.902] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1168 os_tid = 0x17f4 [0150.862] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.862] ReadFile (in: hFile=0x748, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.864] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.864] ReadFile (in: hFile=0x748, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.864] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.866] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.866] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0150.866] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0150.866] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0150.866] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.866] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0150.871] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.872] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.872] WriteFile (in: hFile=0x748, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0150.873] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.873] ReadFile (in: hFile=0x748, lpBuffer=0x2950000, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xfe4f61c*=0x3e00, lpOverlapped=0x0) returned 1 [0150.891] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xffffc200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.892] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2950000, cbInput=0x3e00, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xfe4f848, pbOutput=0x2950000, pcbResult=0xfe4f618) returned 0x0 [0150.892] WriteFile (in: hFile=0x748, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xfe4f61c*=0x3e10, lpOverlapped=0x0) returned 1 [0150.892] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0150.892] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.892] WriteFile (in: hFile=0x748, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.892] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x3e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.893] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0150.893] CloseHandle (hObject=0x748) returned 1 [0150.893] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\en-us\\oregres.dll.mui" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\en-us\\oregres.dll.mui"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\en-us\\oregres.dll.mui.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\en-us\\oregres.dll.mui.play")) returned 1 [0150.895] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1169 os_tid = 0x17f8 [0150.904] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.904] ReadFile (in: hFile=0x418, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.906] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.906] ReadFile (in: hFile=0x418, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.907] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.908] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.908] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0150.908] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0150.908] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0150.909] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.909] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0150.913] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.915] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.916] WriteFile (in: hFile=0x418, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0150.916] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.916] ReadFile (in: hFile=0x418, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x50688, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1034f61c*=0x50688, lpOverlapped=0x0) returned 1 [0150.921] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffaf978, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.921] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2b50000, cbInput=0x50688, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1034f848, pbOutput=0x2b50000, pcbResult=0x1034f618) returned 0x0 [0150.922] WriteFile (in: hFile=0x418, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x50690, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1034f61c*=0x50690, lpOverlapped=0x0) returned 1 [0150.923] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0150.923] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.923] WriteFile (in: hFile=0x418, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.923] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x50690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.923] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.923] CloseHandle (hObject=0x418) returned 1 [0150.924] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.925] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\EXPSRV.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\expsrv.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\EXPSRV.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\expsrv.dll.play")) returned 1 [0150.926] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1170 os_tid = 0x17fc [0150.907] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.907] ReadFile (in: hFile=0x644, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.931] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.931] ReadFile (in: hFile=0x644, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.931] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.932] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.932] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0150.932] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0150.932] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0150.933] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.933] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0150.938] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.939] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.939] WriteFile (in: hFile=0x644, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0150.939] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.939] ReadFile (in: hFile=0x644, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x1f8b8, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1048f61c*=0x1f8b8, lpOverlapped=0x0) returned 1 [0150.942] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffe0748, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.942] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2d50000, cbInput=0x1f8b8, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1048f848, pbOutput=0x2d50000, pcbResult=0x1048f618) returned 0x0 [0150.942] WriteFile (in: hFile=0x644, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x1f8c0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1048f61c*=0x1f8c0, lpOverlapped=0x0) returned 1 [0150.943] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0150.943] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.943] WriteFile (in: hFile=0x644, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.943] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x1f8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.943] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.943] CloseHandle (hObject=0x644) returned 1 [0150.943] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\EXP_PDF.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\exp_pdf.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\EXP_PDF.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\exp_pdf.dll.play")) returned 1 [0150.945] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1171 os_tid = 0x10b8 [0150.940] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.941] ReadFile (in: hFile=0x948, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.949] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.949] ReadFile (in: hFile=0x948, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.950] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.951] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.951] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0150.951] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0150.951] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0150.951] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.952] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0150.956] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.958] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.958] WriteFile (in: hFile=0x948, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0150.958] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.958] ReadFile (in: hFile=0x948, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x104b8, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1070f61c*=0x104b8, lpOverlapped=0x0) returned 1 [0150.960] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffefb48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.960] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0x104b8, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1070f848, pbOutput=0x2e50000, pcbResult=0x1070f618) returned 0x0 [0150.960] WriteFile (in: hFile=0x948, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x104c0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1070f61c*=0x104c0, lpOverlapped=0x0) returned 1 [0150.960] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0150.960] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.960] WriteFile (in: hFile=0x948, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.961] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x104c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.961] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.961] CloseHandle (hObject=0x948) returned 1 [0150.962] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\EXP_XPS.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\exp_xps.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\EXP_XPS.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\exp_xps.dll.play")) returned 1 [0150.964] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1172 os_tid = 0xda0 [0150.959] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.959] ReadFile (in: hFile=0x96c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.968] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.968] ReadFile (in: hFile=0x96c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0150.969] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.970] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.970] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0150.970] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0150.970] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0150.970] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.970] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0150.976] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.978] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.978] WriteFile (in: hFile=0x96c, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0150.978] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.979] ReadFile (in: hFile=0x96c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x456b0, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1084f61c*=0x456b0, lpOverlapped=0x0) returned 1 [0150.983] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffba950, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.983] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2f50000, cbInput=0x456b0, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1084f848, pbOutput=0x2f50000, pcbResult=0x1084f618) returned 0x0 [0150.983] WriteFile (in: hFile=0x96c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x456c0, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1084f61c*=0x456c0, lpOverlapped=0x0) returned 1 [0150.984] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0150.984] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.984] WriteFile (in: hFile=0x96c, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0150.984] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x456c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.985] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0150.985] CloseHandle (hObject=0x96c) returned 1 [0150.985] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0150.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\fltldr.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\fltldr.exe.play")) returned 1 [0150.987] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1173 os_tid = 0x12b8 [0150.980] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.980] ReadFile (in: hFile=0x558, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.991] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.991] ReadFile (in: hFile=0x558, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0150.991] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0150.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0150.993] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0150.993] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0150.993] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0150.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0150.993] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0150.999] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.001] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.001] WriteFile (in: hFile=0x558, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0151.001] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.001] ReadFile (in: hFile=0x558, lpBuffer=0x3050000, nNumberOfBytesToRead=0x102e, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x10acf61c*=0x102e, lpOverlapped=0x0) returned 1 [0151.001] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xffffefd2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.001] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3050000, cbInput=0x102e, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10acf848, pbOutput=0x3050000, pcbResult=0x10acf618) returned 0x0 [0151.001] WriteFile (in: hFile=0x558, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x10acf61c*=0x1030, lpOverlapped=0x0) returned 1 [0151.002] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0151.002] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.002] WriteFile (in: hFile=0x558, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.002] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x1030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.002] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0151.002] CloseHandle (hObject=0x558) returned 1 [0151.002] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\heartbeatconfig.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\heartbeatconfig.xml.play")) returned 1 [0151.004] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1174 os_tid = 0x10c0 [0151.007] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.007] ReadFile (in: hFile=0x3f8, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.009] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.009] ReadFile (in: hFile=0x3f8, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.009] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.010] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.010] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0151.010] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0151.010] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0151.010] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.010] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0151.015] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.016] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.016] WriteFile (in: hFile=0x3f8, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0151.017] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.017] ReadFile (in: hFile=0x3f8, lpBuffer=0x3250000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10c0f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.032] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.032] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3250000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0x10c0f848, pbOutput=0x3250000, pcbResult=0x10c0f618) returned 0x0 [0151.034] WriteFile (in: hFile=0x3f8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10c0f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.037] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0151.037] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.037] WriteFile (in: hFile=0x3f8, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.037] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.037] ReadFile (in: hFile=0x3f8, lpBuffer=0x3250000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10c0f61c*=0x100000, lpOverlapped=0x0) returned 1 [0152.020] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.020] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3250000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0x10c0f848, pbOutput=0x3250000, pcbResult=0x10c0f618) returned 0x0 [0152.022] WriteFile (in: hFile=0x3f8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10c0f61c*=0x100000, lpOverlapped=0x0) returned 1 [0152.025] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0152.025] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.025] WriteFile (in: hFile=0x3f8, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.025] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.025] ReadFile (in: hFile=0x3f8, lpBuffer=0x3250000, nNumberOfBytesToRead=0xabca8, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x10c0f61c*=0xabca8, lpOverlapped=0x0) returned 1 [0152.069] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfff54358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.069] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3250000, cbInput=0xabca8, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10c0f848, pbOutput=0x3250000, pcbResult=0x10c0f618) returned 0x0 [0152.070] WriteFile (in: hFile=0x3f8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0xabcb0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x10c0f61c*=0xabcb0, lpOverlapped=0x0) returned 1 [0152.072] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0152.072] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.072] WriteFile (in: hFile=0x3f8, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.072] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x2abcb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.072] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0152.072] CloseHandle (hObject=0x3f8) returned 1 [0152.197] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0xee50000 [0152.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\IACOM2.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\iacom2.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\IACOM2.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\iacom2.dll.play")) returned 1 [0152.240] VirtualFree (lpAddress=0xee50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1175 os_tid = 0x10c4 [0151.051] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.051] ReadFile (in: hFile=0x3c0, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.053] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.053] ReadFile (in: hFile=0x3c0, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.053] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.054] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.054] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0151.055] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0151.055] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0151.055] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.055] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0151.061] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.063] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.063] WriteFile (in: hFile=0x3c0, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0151.063] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.064] ReadFile (in: hFile=0x3c0, lpBuffer=0x3350000, nNumberOfBytesToRead=0x4f2d0, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x10d4f61c*=0x4f2d0, lpOverlapped=0x0) returned 1 [0151.069] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffb0d30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.070] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3350000, cbInput=0x4f2d0, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x10d4f848, pbOutput=0x3350000, pcbResult=0x10d4f618) returned 0x0 [0151.070] WriteFile (in: hFile=0x3c0, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x4f2e0, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x10d4f61c*=0x4f2e0, lpOverlapped=0x0) returned 1 [0151.071] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0151.071] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.071] WriteFile (in: hFile=0x3c0, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.071] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x4f2e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.071] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0151.072] CloseHandle (hObject=0x3c0) returned 1 [0151.072] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\liclua.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\LICLUA.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\liclua.exe.play")) returned 1 [0151.074] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1176 os_tid = 0x10c8 [0151.067] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.076] ReadFile (in: hFile=0x3cc, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.078] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.078] ReadFile (in: hFile=0x3cc, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.080] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0151.080] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0151.080] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0151.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.080] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0151.088] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.090] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.090] WriteFile (in: hFile=0x3cc, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0151.090] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.090] ReadFile (in: hFile=0x3cc, lpBuffer=0x3450000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x10e8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.105] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.105] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3450000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x0 | out: hKey=0x1a6d94c0, pbIV=0x10e8f848, pbOutput=0x3450000, pcbResult=0x10e8f618) returned 0x0 [0151.106] WriteFile (in: hFile=0x3cc, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10e8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.109] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0151.109] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.109] WriteFile (in: hFile=0x3cc, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.110] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.110] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xffeffbc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.110] ReadFile (in: hFile=0x3cc, lpBuffer=0x3450000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x10e8f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0152.087] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.087] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3450000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x10e8f848, pbOutput=0x3450000, pcbResult=0x10e8f618) returned 0x0 [0152.089] WriteFile (in: hFile=0x3cc, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10e8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0152.094] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0152.094] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.094] WriteFile (in: hFile=0x3cc, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.094] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xda54d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.094] WriteFile (in: hFile=0x3cc, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x10e8f82c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10e8f82c*=0x10, lpOverlapped=0x0) returned 1 [0152.094] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0152.094] CloseHandle (hObject=0x3cc) returned 1 [0152.265] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.266] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mso.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mso.dll.play")) returned 1 [0152.267] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1177 os_tid = 0x10bc [0151.095] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.111] ReadFile (in: hFile=0xb30, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.113] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.114] ReadFile (in: hFile=0xb30, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.114] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.115] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.115] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0151.115] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0151.115] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0151.115] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.115] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0151.121] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.123] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.123] WriteFile (in: hFile=0xb30, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0151.123] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.124] ReadFile (in: hFile=0xb30, lpBuffer=0x3550000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x10fcf61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.141] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.141] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3550000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x0 | out: hKey=0x1a6d9750, pbIV=0x10fcf848, pbOutput=0x3550000, pcbResult=0x10fcf618) returned 0x0 [0151.142] WriteFile (in: hFile=0xb30, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x10fcf61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.145] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0151.146] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.146] WriteFile (in: hFile=0xb30, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.146] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.146] ReadFile (in: hFile=0xb30, lpBuffer=0x3550000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x10fcf61c*=0x100000, lpOverlapped=0x0) returned 1 [0152.104] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.104] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3550000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x0 | out: hKey=0x1a6d9750, pbIV=0x10fcf848, pbOutput=0x3550000, pcbResult=0x10fcf618) returned 0x0 [0152.105] WriteFile (in: hFile=0xb30, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x10fcf61c*=0x100000, lpOverlapped=0x0) returned 1 [0152.108] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0152.108] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.108] WriteFile (in: hFile=0xb30, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.890] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.890] ReadFile (in: hFile=0xb30, lpBuffer=0x3550000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x10fcf61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.182] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.182] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3550000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x0 | out: hKey=0x1a6d9750, pbIV=0x10fcf848, pbOutput=0x3550000, pcbResult=0x10fcf618) returned 0x0 [0153.183] WriteFile (in: hFile=0xb30, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x10fcf61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.187] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0153.187] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.187] WriteFile (in: hFile=0xb30, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.195] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.195] ReadFile (in: hFile=0xb30, lpBuffer=0x3550000, nNumberOfBytesToRead=0x7ac0, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x10fcf61c*=0x7ac0, lpOverlapped=0x0) returned 1 [0153.195] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xffff8540, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.196] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3550000, cbInput=0x7ac0, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x10fcf848, pbOutput=0x3550000, pcbResult=0x10fcf618) returned 0x0 [0153.196] WriteFile (in: hFile=0xb30, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x7ad0, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x10fcf61c*=0x7ad0, lpOverlapped=0x0) returned 1 [0153.196] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0153.196] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.196] WriteFile (in: hFile=0xb30, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.196] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x307ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.196] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0153.196] CloseHandle (hObject=0xb30) returned 1 [0153.196] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mso40uires.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mso40uires.dll.play")) returned 1 [0153.198] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1178 os_tid = 0x10cc [0151.149] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.149] ReadFile (in: hFile=0x260, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.152] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.152] ReadFile (in: hFile=0x260, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.152] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.154] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.154] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0151.154] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0151.154] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0151.154] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.154] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0151.159] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.160] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.160] WriteFile (in: hFile=0x260, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0151.161] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.161] ReadFile (in: hFile=0x260, lpBuffer=0x3650000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1110f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.522] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.523] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3650000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x0 | out: hKey=0x1a6d9c60, pbIV=0x1110f848, pbOutput=0x3650000, pcbResult=0x1110f618) returned 0x0 [0151.525] WriteFile (in: hFile=0x260, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1110f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.528] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0151.528] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.528] WriteFile (in: hFile=0x260, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.529] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.529] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffeffbc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.529] ReadFile (in: hFile=0x260, lpBuffer=0x3650000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1110f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0152.057] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.058] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3650000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x1110f848, pbOutput=0x3650000, pcbResult=0x1110f618) returned 0x0 [0152.059] WriteFile (in: hFile=0x260, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1110f61c*=0x100000, lpOverlapped=0x0) returned 1 [0152.133] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0152.133] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.133] WriteFile (in: hFile=0x260, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.133] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x920cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.133] WriteFile (in: hFile=0x260, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1110f82c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1110f82c*=0x10, lpOverlapped=0x0) returned 1 [0152.133] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.133] CloseHandle (hObject=0x260) returned 1 [0152.200] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0xee60000 [0152.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mso99lres.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mso99lres.dll.play")) returned 1 [0152.209] VirtualFree (lpAddress=0xee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1179 os_tid = 0x10d0 [0151.167] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.167] ReadFile (in: hFile=0x258, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.480] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.480] ReadFile (in: hFile=0x258, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.647] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.648] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.648] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0151.648] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0151.648] BCryptExportKey (in: hKey=0x7ab870, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0151.648] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.648] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0151.654] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.656] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.656] WriteFile (in: hFile=0x258, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0151.656] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.656] ReadFile (in: hFile=0x258, lpBuffer=0x3750000, nNumberOfBytesToRead=0x964a8, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1124f61c*=0x964a8, lpOverlapped=0x0) returned 1 [0151.699] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xfff69b58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.699] BCryptEncrypt (in: hKey=0x7ab870, pbInput=0x3750000, cbInput=0x964a8, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x7ab870, pbIV=0x1124f848, pbOutput=0x3750000, pcbResult=0x1124f618) returned 0x0 [0151.700] WriteFile (in: hFile=0x258, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x964b0, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1124f61c*=0x964b0, lpOverlapped=0x0) returned 1 [0151.702] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0151.702] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.702] WriteFile (in: hFile=0x258, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.702] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x964b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.702] BCryptDestroyKey (in: hKey=0x7ab870 | out: hKey=0x7ab870) returned 0x0 [0151.702] CloseHandle (hObject=0x258) returned 1 [0151.703] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoicons.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoicons.exe.play")) returned 1 [0151.705] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1180 os_tid = 0x10d4 [0151.169] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.169] ReadFile (in: hFile=0x250, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.480] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.481] ReadFile (in: hFile=0x250, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.481] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.482] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.482] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x1138f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0151.482] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x1138f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x1138f828, pbKeyObject=0x0) returned 0x0 [0151.482] BCryptExportKey (in: hKey=0x7ab360, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1138f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1138f500) returned 0x0 [0151.482] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.482] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1138f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1138f500) returned 0x0 [0151.487] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.488] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.488] WriteFile (in: hFile=0x250, lpBuffer=0x1138fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1138f830, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesWritten=0x1138f830*=0x428, lpOverlapped=0x0) returned 1 [0151.489] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.489] ReadFile (in: hFile=0x250, lpBuffer=0x3850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1138f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.667] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.667] BCryptEncrypt (in: hKey=0x7ab360, pbInput=0x3850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1138f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1138f618, dwFlags=0x0 | out: hKey=0x7ab360, pbIV=0x1138f848, pbOutput=0x3850000, pcbResult=0x1138f618) returned 0x0 [0151.669] WriteFile (in: hFile=0x250, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1138f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.671] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1138f60c | out: lpNewFilePointer=0x0) returned 1 [0151.671] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.671] WriteFile (in: hFile=0x250, lpBuffer=0x1138f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x1138f83c*, lpNumberOfBytesWritten=0x1138f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.671] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.672] ReadFile (in: hFile=0x250, lpBuffer=0x3850000, nNumberOfBytesToRead=0x27ae8, lpNumberOfBytesRead=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1138f61c*=0x27ae8, lpOverlapped=0x0) returned 1 [0151.708] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0xfffd8518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.708] BCryptEncrypt (in: hKey=0x7ab360, pbInput=0x3850000, cbInput=0x27ae8, pPaddingInfo=0x0, pbIV=0x1138f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1138f618, dwFlags=0x1 | out: hKey=0x7ab360, pbIV=0x1138f848, pbOutput=0x3850000, pcbResult=0x1138f618) returned 0x0 [0151.708] WriteFile (in: hFile=0x250, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x27af0, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1138f61c*=0x27af0, lpOverlapped=0x0) returned 1 [0151.709] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1138f60c | out: lpNewFilePointer=0x0) returned 1 [0151.709] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.709] WriteFile (in: hFile=0x250, lpBuffer=0x1138f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x1138f83c*, lpNumberOfBytesWritten=0x1138f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.709] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x127af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.709] BCryptDestroyKey (in: hKey=0x7ab360 | out: hKey=0x7ab360) returned 0x0 [0151.709] CloseHandle (hObject=0x250) returned 1 [0151.710] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOIDCLIL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoidclil.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOIDCLIL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoidclil.dll.play")) returned 1 [0152.256] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1181 os_tid = 0x10dc [0151.170] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.171] ReadFile (in: hFile=0x248, lpBuffer=0x114cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x114cf85c, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesRead=0x114cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.305] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.305] ReadFile (in: hFile=0x248, lpBuffer=0x114cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x114cf85c, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesRead=0x114cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.305] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.306] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.307] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x114cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0151.307] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x114cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x114cf828, pbKeyObject=0x0) returned 0x0 [0151.307] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x114cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x114cf500) returned 0x0 [0151.307] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.307] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x114cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x114cf500) returned 0x0 [0151.313] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.314] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.314] WriteFile (in: hFile=0x248, lpBuffer=0x114cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x114cf830, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesWritten=0x114cf830*=0x428, lpOverlapped=0x0) returned 1 [0151.315] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.315] ReadFile (in: hFile=0x248, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xc88e8, lpNumberOfBytesRead=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x114cf61c*=0xc88e8, lpOverlapped=0x0) returned 1 [0151.584] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xfff37718, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.584] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x3a50000, cbInput=0xc88e8, pPaddingInfo=0x0, pbIV=0x114cf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x114cf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x114cf848, pbOutput=0x3a50000, pcbResult=0x114cf618) returned 0x0 [0151.585] WriteFile (in: hFile=0x248, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0xc88f0, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x114cf61c*=0xc88f0, lpOverlapped=0x0) returned 1 [0151.588] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x114cf60c | out: lpNewFilePointer=0x0) returned 1 [0151.588] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.588] WriteFile (in: hFile=0x248, lpBuffer=0x114cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x114cf83c*, lpNumberOfBytesWritten=0x114cf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.588] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xc88f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.588] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0151.588] CloseHandle (hObject=0x248) returned 1 [0151.589] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOIDRES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoidres.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOIDRES.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoidres.dll.play")) returned 1 [0151.591] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1182 os_tid = 0xba8 [0151.172] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.172] ReadFile (in: hFile=0x240, lpBuffer=0x1160fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1160f85c, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesRead=0x1160f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.435] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.436] ReadFile (in: hFile=0x240, lpBuffer=0x1160fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1160f85c, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesRead=0x1160f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.436] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.437] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.437] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x1160f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0151.437] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x1160f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x1160f828, pbKeyObject=0x0) returned 0x0 [0151.437] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1160f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1160f500) returned 0x0 [0151.437] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.437] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1160f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1160f500) returned 0x0 [0151.442] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.443] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.443] WriteFile (in: hFile=0x240, lpBuffer=0x1160fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1160f830, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesWritten=0x1160f830*=0x428, lpOverlapped=0x0) returned 1 [0151.444] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.444] ReadFile (in: hFile=0x240, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1160f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.630] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.630] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3b50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1160f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1160f618, dwFlags=0x0 | out: hKey=0x1a6d8fb0, pbIV=0x1160f848, pbOutput=0x3b50000, pcbResult=0x1160f618) returned 0x0 [0151.631] WriteFile (in: hFile=0x240, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1160f61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.634] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1160f60c | out: lpNewFilePointer=0x0) returned 1 [0151.634] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.634] WriteFile (in: hFile=0x240, lpBuffer=0x1160f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x1160f83c*, lpNumberOfBytesWritten=0x1160f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.634] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.634] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xffeffbc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.634] ReadFile (in: hFile=0x240, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1160f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0152.147] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.147] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3b50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1160f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1160f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x1160f848, pbOutput=0x3b50000, pcbResult=0x1160f618) returned 0x0 [0152.149] WriteFile (in: hFile=0x240, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1160f61c*=0x100000, lpOverlapped=0x0) returned 1 [0152.164] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1160f60c | out: lpNewFilePointer=0x0) returned 1 [0152.164] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.164] WriteFile (in: hFile=0x240, lpBuffer=0x1160f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x1160f83c*, lpNumberOfBytesWritten=0x1160f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.164] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x4e3e8d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.165] WriteFile (in: hFile=0x240, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1160f82c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1160f82c*=0x10, lpOverlapped=0x0) returned 1 [0152.165] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0152.165] CloseHandle (hObject=0x240) returned 1 [0152.259] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msores.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSORES.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msores.dll.play")) returned 1 [0152.261] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1183 os_tid = 0x10e8 [0151.175] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.175] ReadFile (in: hFile=0x238, lpBuffer=0x1188fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1188f85c, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesRead=0x1188f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.304] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.304] ReadFile (in: hFile=0x238, lpBuffer=0x1188fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1188f85c, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesRead=0x1188f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.564] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.565] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.565] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x1188f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0151.565] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x1188f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x1188f828, pbKeyObject=0x0) returned 0x0 [0151.565] BCryptExportKey (in: hKey=0x7ab5e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1188f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1188f500) returned 0x0 [0151.565] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.565] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1188f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1188f500) returned 0x0 [0151.569] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.570] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.570] WriteFile (in: hFile=0x238, lpBuffer=0x1188fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1188f830, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesWritten=0x1188f830*=0x428, lpOverlapped=0x0) returned 1 [0151.570] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.571] ReadFile (in: hFile=0x238, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x2c4b8, lpNumberOfBytesRead=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x1188f61c*=0x2c4b8, lpOverlapped=0x0) returned 1 [0151.688] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xfffd3b48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.688] BCryptEncrypt (in: hKey=0x7ab5e0, pbInput=0x3c50000, cbInput=0x2c4b8, pPaddingInfo=0x0, pbIV=0x1188f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x1188f618, dwFlags=0x1 | out: hKey=0x7ab5e0, pbIV=0x1188f848, pbOutput=0x3c50000, pcbResult=0x1188f618) returned 0x0 [0151.688] WriteFile (in: hFile=0x238, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x2c4c0, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x1188f61c*=0x2c4c0, lpOverlapped=0x0) returned 1 [0151.689] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1188f60c | out: lpNewFilePointer=0x0) returned 1 [0151.689] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.689] WriteFile (in: hFile=0x238, lpBuffer=0x1188f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x1188f83c*, lpNumberOfBytesWritten=0x1188f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.689] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x2c4c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.689] BCryptDestroyKey (in: hKey=0x7ab5e0 | out: hKey=0x7ab5e0) returned 0x0 [0151.689] CloseHandle (hObject=0x238) returned 1 [0151.689] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msosqm.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msosqm.exe.play")) returned 1 [0151.691] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1184 os_tid = 0x10e0 [0151.177] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.177] ReadFile (in: hFile=0x914, lpBuffer=0x119cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x119cf85c, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesRead=0x119cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.295] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.295] ReadFile (in: hFile=0x914, lpBuffer=0x119cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x119cf85c, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesRead=0x119cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.295] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.297] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.297] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x119cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0151.297] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x119cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x119cf828, pbKeyObject=0x0) returned 0x0 [0151.297] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x119cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x119cf500) returned 0x0 [0151.297] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.297] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x119cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x119cf500) returned 0x0 [0151.301] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.302] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.303] WriteFile (in: hFile=0x914, lpBuffer=0x119cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x119cf830, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesWritten=0x119cf830*=0x428, lpOverlapped=0x0) returned 1 [0151.303] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.303] ReadFile (in: hFile=0x914, lpBuffer=0x3e50000, nNumberOfBytesToRead=0xe8a8, lpNumberOfBytesRead=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x119cf61c*=0xe8a8, lpOverlapped=0x0) returned 1 [0151.571] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xffff1758, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.572] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3e50000, cbInput=0xe8a8, pPaddingInfo=0x0, pbIV=0x119cf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x119cf618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x119cf848, pbOutput=0x3e50000, pcbResult=0x119cf618) returned 0x0 [0151.572] WriteFile (in: hFile=0x914, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0xe8b0, lpNumberOfBytesWritten=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x119cf61c*=0xe8b0, lpOverlapped=0x0) returned 1 [0151.572] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x119cf60c | out: lpNewFilePointer=0x0) returned 1 [0151.572] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.572] WriteFile (in: hFile=0x914, lpBuffer=0x119cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x119cf83c*, lpNumberOfBytesWritten=0x119cf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.572] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xe8b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.573] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0151.573] CloseHandle (hObject=0x914) returned 1 [0151.573] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXEV.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoxev.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXEV.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoxev.dll.play")) returned 1 [0151.575] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1185 os_tid = 0x10d8 [0151.178] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.178] ReadFile (in: hFile=0xa98, lpBuffer=0x1264fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1264f85c, lpOverlapped=0x0 | out: lpBuffer=0x1264fb34*, lpNumberOfBytesRead=0x1264f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.395] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.395] ReadFile (in: hFile=0xa98, lpBuffer=0x1264fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1264f85c, lpOverlapped=0x0 | out: lpBuffer=0x1264fb34*, lpNumberOfBytesRead=0x1264f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.395] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.397] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.397] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x1264f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0151.397] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x1264f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x1264f828, pbKeyObject=0x0) returned 0x0 [0151.397] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1264f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1264f500) returned 0x0 [0151.397] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.397] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1264f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1264f500) returned 0x0 [0151.402] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.404] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.404] WriteFile (in: hFile=0xa98, lpBuffer=0x1264fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1264f830, lpOverlapped=0x0 | out: lpBuffer=0x1264fb34*, lpNumberOfBytesWritten=0x1264f830*=0x428, lpOverlapped=0x0) returned 1 [0151.405] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.405] ReadFile (in: hFile=0xa98, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x33aa8, lpNumberOfBytesRead=0x1264f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x1264f61c*=0x33aa8, lpOverlapped=0x0) returned 1 [0151.615] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffcc558, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.615] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3f50000, cbInput=0x33aa8, pPaddingInfo=0x0, pbIV=0x1264f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x1264f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x1264f848, pbOutput=0x3f50000, pcbResult=0x1264f618) returned 0x0 [0151.615] WriteFile (in: hFile=0xa98, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x33ab0, lpNumberOfBytesWritten=0x1264f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x1264f61c*=0x33ab0, lpOverlapped=0x0) returned 1 [0151.616] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1264f60c | out: lpNewFilePointer=0x0) returned 1 [0151.616] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.616] WriteFile (in: hFile=0xa98, lpBuffer=0x1264f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1264f61c, lpOverlapped=0x0 | out: lpBuffer=0x1264f83c*, lpNumberOfBytesWritten=0x1264f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.616] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x33ab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.616] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0151.616] CloseHandle (hObject=0xa98) returned 1 [0151.617] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoxmled.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoxmled.exe.play")) returned 1 [0151.619] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1186 os_tid = 0x10a4 [0151.180] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.180] ReadFile (in: hFile=0xa9c, lpBuffer=0x1278fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1278f85c, lpOverlapped=0x0 | out: lpBuffer=0x1278fb34*, lpNumberOfBytesRead=0x1278f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.405] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.405] ReadFile (in: hFile=0xa9c, lpBuffer=0x1278fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1278f85c, lpOverlapped=0x0 | out: lpBuffer=0x1278fb34*, lpNumberOfBytesRead=0x1278f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.405] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.407] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x1278f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0151.407] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x1278f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x1278f828, pbKeyObject=0x0) returned 0x0 [0151.407] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1278f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1278f500) returned 0x0 [0151.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.407] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1278f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1278f500) returned 0x0 [0151.412] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.413] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.413] WriteFile (in: hFile=0xa9c, lpBuffer=0x1278fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1278f830, lpOverlapped=0x0 | out: lpBuffer=0x1278fb34*, lpNumberOfBytesWritten=0x1278f830*=0x428, lpOverlapped=0x0) returned 1 [0151.414] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.414] ReadFile (in: hFile=0xa9c, lpBuffer=0x4050000, nNumberOfBytesToRead=0xd2c8, lpNumberOfBytesRead=0x1278f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x1278f61c*=0xd2c8, lpOverlapped=0x0) returned 1 [0151.429] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xffff2d38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.429] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x4050000, cbInput=0xd2c8, pPaddingInfo=0x0, pbIV=0x1278f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x1278f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x1278f848, pbOutput=0x4050000, pcbResult=0x1278f618) returned 0x0 [0151.430] WriteFile (in: hFile=0xa9c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0xd2d0, lpNumberOfBytesWritten=0x1278f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x1278f61c*=0xd2d0, lpOverlapped=0x0) returned 1 [0151.430] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1278f60c | out: lpNewFilePointer=0x0) returned 1 [0151.430] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.431] WriteFile (in: hFile=0xa9c, lpBuffer=0x1278f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1278f61c, lpOverlapped=0x0 | out: lpBuffer=0x1278f83c*, lpNumberOfBytesWritten=0x1278f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.431] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xd2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.431] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0151.431] CloseHandle (hObject=0xa9c) returned 1 [0151.431] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXMLMF.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoxmlmf.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXMLMF.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msoxmlmf.dll.play")) returned 1 [0151.433] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1187 os_tid = 0x9fc [0151.182] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.182] ReadFile (in: hFile=0xaa4, lpBuffer=0x128cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x128cf85c, lpOverlapped=0x0 | out: lpBuffer=0x128cfb34*, lpNumberOfBytesRead=0x128cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.282] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.282] ReadFile (in: hFile=0xaa4, lpBuffer=0x128cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x128cf85c, lpOverlapped=0x0 | out: lpBuffer=0x128cfb34*, lpNumberOfBytesRead=0x128cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.282] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.283] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.283] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x128cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0151.283] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x128cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x128cf828, pbKeyObject=0x0) returned 0x0 [0151.283] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x128cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x128cf500) returned 0x0 [0151.284] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.284] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x128cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x128cf500) returned 0x0 [0151.287] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.290] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.290] WriteFile (in: hFile=0xaa4, lpBuffer=0x128cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x128cf830, lpOverlapped=0x0 | out: lpBuffer=0x128cfb34*, lpNumberOfBytesWritten=0x128cf830*=0x428, lpOverlapped=0x0) returned 1 [0151.290] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.290] ReadFile (in: hFile=0xaa4, lpBuffer=0x4150000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x128cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.558] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.558] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x4150000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x128cf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x128cf618, dwFlags=0x0 | out: hKey=0x1a6d8310, pbIV=0x128cf848, pbOutput=0x4150000, pcbResult=0x128cf618) returned 0x0 [0151.560] WriteFile (in: hFile=0xaa4, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x128cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0151.562] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x128cf60c | out: lpNewFilePointer=0x0) returned 1 [0151.562] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.562] WriteFile (in: hFile=0xaa4, lpBuffer=0x128cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x128cf83c*, lpNumberOfBytesWritten=0x128cf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.563] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.563] ReadFile (in: hFile=0xaa4, lpBuffer=0x4150000, nNumberOfBytesToRead=0x16ac0, lpNumberOfBytesRead=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x128cf61c*=0x16ac0, lpOverlapped=0x0) returned 1 [0151.681] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffe9540, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.681] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x4150000, cbInput=0x16ac0, pPaddingInfo=0x0, pbIV=0x128cf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x128cf618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x128cf848, pbOutput=0x4150000, pcbResult=0x128cf618) returned 0x0 [0151.681] WriteFile (in: hFile=0xaa4, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x16ad0, lpNumberOfBytesWritten=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x128cf61c*=0x16ad0, lpOverlapped=0x0) returned 1 [0151.682] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x128cf60c | out: lpNewFilePointer=0x0) returned 1 [0151.682] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.682] WriteFile (in: hFile=0xaa4, lpBuffer=0x128cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x128cf83c*, lpNumberOfBytesWritten=0x128cf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.682] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x116ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.682] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0151.682] CloseHandle (hObject=0xaa4) returned 1 [0151.683] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.684] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msptls.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\msptls.dll.play")) returned 1 [0151.685] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1188 os_tid = 0x10ac [0151.183] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.183] ReadFile (in: hFile=0x81c, lpBuffer=0x11b0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11b0f85c, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesRead=0x11b0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.452] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.452] ReadFile (in: hFile=0x81c, lpBuffer=0x11b0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11b0f85c, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesRead=0x11b0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.452] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.454] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.454] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x11b0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0151.454] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x11b0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x11b0f828, pbKeyObject=0x0) returned 0x0 [0151.454] BCryptExportKey (in: hKey=0x7ab870, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x11b0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x11b0f500) returned 0x0 [0151.454] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.454] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x11b0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x11b0f500) returned 0x0 [0151.459] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.460] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.460] WriteFile (in: hFile=0x81c, lpBuffer=0x11b0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11b0f830, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesWritten=0x11b0f830*=0x428, lpOverlapped=0x0) returned 1 [0151.462] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.462] ReadFile (in: hFile=0x81c, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x77cb8, lpNumberOfBytesRead=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x11b0f61c*=0x77cb8, lpOverlapped=0x0) returned 1 [0151.640] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfff88348, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.640] BCryptEncrypt (in: hKey=0x7ab870, pbInput=0x4c50000, cbInput=0x77cb8, pPaddingInfo=0x0, pbIV=0x11b0f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x11b0f618, dwFlags=0x1 | out: hKey=0x7ab870, pbIV=0x11b0f848, pbOutput=0x4c50000, pcbResult=0x11b0f618) returned 0x0 [0151.641] WriteFile (in: hFile=0x81c, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x77cc0, lpNumberOfBytesWritten=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x11b0f61c*=0x77cc0, lpOverlapped=0x0) returned 1 [0151.642] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11b0f60c | out: lpNewFilePointer=0x0) returned 1 [0151.642] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.642] WriteFile (in: hFile=0x81c, lpBuffer=0x11b0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x11b0f83c*, lpNumberOfBytesWritten=0x11b0f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.642] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x77cc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.643] BCryptDestroyKey (in: hKey=0x7ab870 | out: hKey=0x7ab870) returned 0x0 [0151.643] CloseHandle (hObject=0x81c) returned 1 [0151.643] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSSOAP30.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mssoap30.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSSOAP30.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\mssoap30.dll.play")) returned 1 [0151.645] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1189 os_tid = 0x10b0 [0151.185] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.185] ReadFile (in: hFile=0xab0, lpBuffer=0x12a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x12a0fb34*, lpNumberOfBytesRead=0x12a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.384] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.384] ReadFile (in: hFile=0xab0, lpBuffer=0x12a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x12a0fb34*, lpNumberOfBytesRead=0x12a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.384] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.385] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.385] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x12a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0151.385] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x12a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x12a0f828, pbKeyObject=0x0) returned 0x0 [0151.385] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12a0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12a0f500) returned 0x0 [0151.385] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.386] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12a0f500) returned 0x0 [0151.392] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.393] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.394] WriteFile (in: hFile=0xab0, lpBuffer=0x12a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12a0f830, lpOverlapped=0x0 | out: lpBuffer=0x12a0fb34*, lpNumberOfBytesWritten=0x12a0f830*=0x428, lpOverlapped=0x0) returned 1 [0151.394] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.394] ReadFile (in: hFile=0xab0, lpBuffer=0x4250000, nNumberOfBytesToRead=0x402b, lpNumberOfBytesRead=0x12a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x12a0f61c*=0x402b, lpOverlapped=0x0) returned 1 [0151.608] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xffffbfd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.608] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x4250000, cbInput=0x402b, pPaddingInfo=0x0, pbIV=0x12a0f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x12a0f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x12a0f848, pbOutput=0x4250000, pcbResult=0x12a0f618) returned 0x0 [0151.608] WriteFile (in: hFile=0xab0, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x12a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x12a0f61c*=0x4030, lpOverlapped=0x0) returned 1 [0151.608] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12a0f60c | out: lpNewFilePointer=0x0) returned 1 [0151.608] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.608] WriteFile (in: hFile=0xab0, lpBuffer=0x12a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x12a0f83c*, lpNumberOfBytesWritten=0x12a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.609] SetFilePointerEx (in: hFile=0xab0, liDistanceToMove=0x4030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.609] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0151.609] CloseHandle (hObject=0xab0) returned 1 [0151.609] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\muauth.cab"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\muauth.cab.play")) returned 1 [0151.611] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1190 os_tid = 0x10b4 [0151.186] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.187] ReadFile (in: hFile=0xab8, lpBuffer=0x12b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x12b4fb34*, lpNumberOfBytesRead=0x12b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.374] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.374] ReadFile (in: hFile=0xab8, lpBuffer=0x12b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x12b4fb34*, lpNumberOfBytesRead=0x12b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.374] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.375] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.375] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x12b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0151.375] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x12b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x12b4f828, pbKeyObject=0x0) returned 0x0 [0151.375] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12b4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12b4f500) returned 0x0 [0151.376] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.376] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12b4f500) returned 0x0 [0151.381] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.382] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.382] WriteFile (in: hFile=0xab8, lpBuffer=0x12b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12b4f830, lpOverlapped=0x0 | out: lpBuffer=0x12b4fb34*, lpNumberOfBytesWritten=0x12b4f830*=0x428, lpOverlapped=0x0) returned 1 [0151.383] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.383] ReadFile (in: hFile=0xab8, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x5cf0, lpNumberOfBytesRead=0x12b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x12b4f61c*=0x5cf0, lpOverlapped=0x0) returned 1 [0151.593] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xffffa310, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.593] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4d50000, cbInput=0x5cf0, pPaddingInfo=0x0, pbIV=0x12b4f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x12b4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x12b4f848, pbOutput=0x4d50000, pcbResult=0x12b4f618) returned 0x0 [0151.593] WriteFile (in: hFile=0xab8, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x5d00, lpNumberOfBytesWritten=0x12b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x12b4f61c*=0x5d00, lpOverlapped=0x0) returned 1 [0151.593] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12b4f60c | out: lpNewFilePointer=0x0) returned 1 [0151.593] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.593] WriteFile (in: hFile=0xab8, lpBuffer=0x12b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x12b4f83c*, lpNumberOfBytesWritten=0x12b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.593] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x5d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.593] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0151.593] CloseHandle (hObject=0xab8) returned 1 [0151.603] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MUOPTIN.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\muoptin.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MUOPTIN.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\muoptin.dll.play")) returned 1 [0151.606] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1191 os_tid = 0x10a8 [0151.188] SetFilePointerEx (in: hFile=0xac8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.188] ReadFile (in: hFile=0xac8, lpBuffer=0x12c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x12c8fb34*, lpNumberOfBytesRead=0x12c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.360] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.361] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x12c8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0151.361] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x12c8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x12c8f828, pbKeyObject=0x0) returned 0x0 [0151.361] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12c8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12c8f500) returned 0x0 [0151.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.361] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12c8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12c8f500) returned 0x0 [0151.366] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.368] SetFilePointerEx (in: hFile=0xac8, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.368] WriteFile (in: hFile=0xac8, lpBuffer=0x12c8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12c8f830, lpOverlapped=0x0 | out: lpBuffer=0x12c8fb34*, lpNumberOfBytesWritten=0x12c8f830*=0x428, lpOverlapped=0x0) returned 1 [0151.369] SetFilePointerEx (in: hFile=0xac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.369] ReadFile (in: hFile=0xac8, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x12c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x12c8f61c*=0x5a9, lpOverlapped=0x0) returned 1 [0151.369] SetFilePointerEx (in: hFile=0xac8, liDistanceToMove=0xfffffa57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.369] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4e50000, cbInput=0x5a9, pPaddingInfo=0x0, pbIV=0x12c8f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x12c8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x12c8f848, pbOutput=0x4e50000, pcbResult=0x12c8f618) returned 0x0 [0151.369] WriteFile (in: hFile=0xac8, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x12c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x12c8f61c*=0x5b0, lpOverlapped=0x0) returned 1 [0151.369] SetFilePointerEx (in: hFile=0xac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12c8f60c | out: lpNewFilePointer=0x0) returned 1 [0151.369] SetFilePointerEx (in: hFile=0xac8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.369] WriteFile (in: hFile=0xac8, lpBuffer=0x12c8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x12c8f83c*, lpNumberOfBytesWritten=0x12c8f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.370] SetFilePointerEx (in: hFile=0xac8, liDistanceToMove=0x5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.370] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0151.370] CloseHandle (hObject=0xac8) returned 1 [0151.370] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\access.en-us\\accessmui.xml.play")) returned 1 [0151.372] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1192 os_tid = 0x684 [0151.190] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.191] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.191] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x12dcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0151.191] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x12dcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x12dcf828, pbKeyObject=0x0) returned 0x0 [0151.191] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12dcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12dcf500) returned 0x0 [0151.191] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.192] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12dcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12dcf500) returned 0x0 [0151.196] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.198] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.198] WriteFile (in: hFile=0xad0, lpBuffer=0x12dcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12dcf830, lpOverlapped=0x0 | out: lpBuffer=0x12dcfb34*, lpNumberOfBytesWritten=0x12dcf830*=0x428, lpOverlapped=0x0) returned 1 [0151.353] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.353] ReadFile (in: hFile=0xad0, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x408, lpNumberOfBytesRead=0x12dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x12dcf61c*=0x408, lpOverlapped=0x0) returned 1 [0151.353] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.354] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4f50000, cbInput=0x408, pPaddingInfo=0x0, pbIV=0x12dcf848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x12dcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x12dcf848, pbOutput=0x4f50000, pcbResult=0x12dcf618) returned 0x0 [0151.354] WriteFile (in: hFile=0xad0, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x12dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x12dcf61c*=0x410, lpOverlapped=0x0) returned 1 [0151.354] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12dcf60c | out: lpNewFilePointer=0x0) returned 1 [0151.354] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.354] WriteFile (in: hFile=0xad0, lpBuffer=0x12dcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x12dcf83c*, lpNumberOfBytesWritten=0x12dcf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.354] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.354] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0151.354] CloseHandle (hObject=0xad0) returned 1 [0151.355] VirtualAlloc (lpAddress=0x0, dwSize=0xfb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\access.en-us\\accessmuiset.xml.play")) returned 1 [0151.356] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1193 os_tid = 0xb74 [0151.200] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.200] ReadFile (in: hFile=0xa2c, lpBuffer=0x12f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x12f0fb34*, lpNumberOfBytesRead=0x12f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.339] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.339] ReadFile (in: hFile=0xa2c, lpBuffer=0x12f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x12f0fb34*, lpNumberOfBytesRead=0x12f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.339] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.340] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.340] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x12f0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0151.340] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x12f0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x12f0f828, pbKeyObject=0x0) returned 0x0 [0151.341] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12f0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12f0f500) returned 0x0 [0151.341] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.341] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12f0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12f0f500) returned 0x0 [0151.345] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.347] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.347] WriteFile (in: hFile=0xa2c, lpBuffer=0x12f0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12f0f830, lpOverlapped=0x0 | out: lpBuffer=0x12f0fb34*, lpNumberOfBytesWritten=0x12f0f830*=0x428, lpOverlapped=0x0) returned 1 [0151.347] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.347] ReadFile (in: hFile=0xa2c, lpBuffer=0x5050000, nNumberOfBytesToRead=0xa18, lpNumberOfBytesRead=0x12f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x12f0f61c*=0xa18, lpOverlapped=0x0) returned 1 [0151.347] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0xfffff5e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.347] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x5050000, cbInput=0xa18, pPaddingInfo=0x0, pbIV=0x12f0f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x12f0f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x12f0f848, pbOutput=0x5050000, pcbResult=0x12f0f618) returned 0x0 [0151.347] WriteFile (in: hFile=0xa2c, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x12f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x12f0f61c*=0xa20, lpOverlapped=0x0) returned 1 [0151.348] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12f0f60c | out: lpNewFilePointer=0x0) returned 1 [0151.348] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.348] WriteFile (in: hFile=0xa2c, lpBuffer=0x12f0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x12f0f83c*, lpNumberOfBytesWritten=0x12f0f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.348] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0xa20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.348] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0151.348] CloseHandle (hObject=0xa2c) returned 1 [0151.348] VirtualAlloc (lpAddress=0x0, dwSize=0xed, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Access.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\access.en-us\\setup.xml.play")) returned 1 [0151.350] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1194 os_tid = 0x3c8 [0151.201] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.202] ReadFile (in: hFile=0xae0, lpBuffer=0x1304fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1304f85c, lpOverlapped=0x0 | out: lpBuffer=0x1304fb34*, lpNumberOfBytesRead=0x1304f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.325] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.327] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x1304f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0151.327] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x1304f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x1304f828, pbKeyObject=0x0) returned 0x0 [0151.327] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1304f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1304f500) returned 0x0 [0151.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.327] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1304f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1304f500) returned 0x0 [0151.331] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.332] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.332] WriteFile (in: hFile=0xae0, lpBuffer=0x1304fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1304f830, lpOverlapped=0x0 | out: lpBuffer=0x1304fb34*, lpNumberOfBytesWritten=0x1304f830*=0x428, lpOverlapped=0x0) returned 1 [0151.333] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.333] ReadFile (in: hFile=0xae0, lpBuffer=0x5150000, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x1304f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x1304f61c*=0x4bf, lpOverlapped=0x0) returned 1 [0151.333] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0xfffffb41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.333] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x5150000, cbInput=0x4bf, pPaddingInfo=0x0, pbIV=0x1304f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x1304f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x1304f848, pbOutput=0x5150000, pcbResult=0x1304f618) returned 0x0 [0151.333] WriteFile (in: hFile=0xae0, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x1304f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x1304f61c*=0x4c0, lpOverlapped=0x0) returned 1 [0151.333] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1304f60c | out: lpNewFilePointer=0x0) returned 1 [0151.333] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.333] WriteFile (in: hFile=0xae0, lpBuffer=0x1304f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1304f61c, lpOverlapped=0x0 | out: lpBuffer=0x1304f83c*, lpNumberOfBytesWritten=0x1304f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.334] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x4c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.334] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0151.334] CloseHandle (hObject=0xae0) returned 1 [0151.334] VirtualAlloc (lpAddress=0x0, dwSize=0xe9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\DCF.en-us\\DCFMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\dcf.en-us\\dcfmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\DCF.en-us\\DCFMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\dcf.en-us\\dcfmui.xml.play")) returned 1 [0151.337] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1195 os_tid = 0xaa4 [0151.203] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.203] ReadFile (in: hFile=0xad8, lpBuffer=0x1318fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1318f85c, lpOverlapped=0x0 | out: lpBuffer=0x1318fb34*, lpNumberOfBytesRead=0x1318f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.465] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.467] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.467] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x1318f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0151.467] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x1318f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x1318f828, pbKeyObject=0x0) returned 0x0 [0151.467] BCryptExportKey (in: hKey=0x7ab360, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1318f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1318f500) returned 0x0 [0151.468] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.468] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1318f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1318f500) returned 0x0 [0151.472] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.474] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.474] WriteFile (in: hFile=0xad8, lpBuffer=0x1318fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1318f830, lpOverlapped=0x0 | out: lpBuffer=0x1318fb34*, lpNumberOfBytesWritten=0x1318f830*=0x428, lpOverlapped=0x0) returned 1 [0151.474] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.474] ReadFile (in: hFile=0xad8, lpBuffer=0x5250000, nNumberOfBytesToRead=0x710, lpNumberOfBytesRead=0x1318f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x1318f61c*=0x710, lpOverlapped=0x0) returned 1 [0151.474] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0xfffff8f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.475] BCryptEncrypt (in: hKey=0x7ab360, pbInput=0x5250000, cbInput=0x710, pPaddingInfo=0x0, pbIV=0x1318f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x1318f618, dwFlags=0x1 | out: hKey=0x7ab360, pbIV=0x1318f848, pbOutput=0x5250000, pcbResult=0x1318f618) returned 0x0 [0151.475] WriteFile (in: hFile=0xad8, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x1318f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x1318f61c*=0x720, lpOverlapped=0x0) returned 1 [0151.475] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1318f60c | out: lpNewFilePointer=0x0) returned 1 [0151.475] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.475] WriteFile (in: hFile=0xad8, lpBuffer=0x1318f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1318f61c, lpOverlapped=0x0 | out: lpBuffer=0x1318f83c*, lpNumberOfBytesWritten=0x1318f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.475] SetFilePointerEx (in: hFile=0xad8, liDistanceToMove=0x720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.475] BCryptDestroyKey (in: hKey=0x7ab360 | out: hKey=0x7ab360) returned 0x0 [0151.475] CloseHandle (hObject=0xad8) returned 1 [0151.476] VirtualAlloc (lpAddress=0x0, dwSize=0xe7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\DCF.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\dcf.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\DCF.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\dcf.en-us\\setup.xml.play")) returned 1 [0151.477] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1196 os_tid = 0x674 [0151.205] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.205] ReadFile (in: hFile=0x9bc, lpBuffer=0x132cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x132cf85c, lpOverlapped=0x0 | out: lpBuffer=0x132cfb34*, lpNumberOfBytesRead=0x132cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.497] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.499] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.499] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x132cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0151.499] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x132cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x132cf828, pbKeyObject=0x0) returned 0x0 [0151.499] BCryptExportKey (in: hKey=0x7ab5e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x132cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x132cf500) returned 0x0 [0151.500] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.500] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x132cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x132cf500) returned 0x0 [0151.505] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.506] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.506] WriteFile (in: hFile=0x9bc, lpBuffer=0x132cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x132cf830, lpOverlapped=0x0 | out: lpBuffer=0x132cfb34*, lpNumberOfBytesWritten=0x132cf830*=0x428, lpOverlapped=0x0) returned 1 [0151.508] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.508] ReadFile (in: hFile=0x9bc, lpBuffer=0x5350000, nNumberOfBytesToRead=0x6f4, lpNumberOfBytesRead=0x132cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x132cf61c*=0x6f4, lpOverlapped=0x0) returned 1 [0151.508] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xfffff90c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.509] BCryptEncrypt (in: hKey=0x7ab5e0, pbInput=0x5350000, cbInput=0x6f4, pPaddingInfo=0x0, pbIV=0x132cf848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x132cf618, dwFlags=0x1 | out: hKey=0x7ab5e0, pbIV=0x132cf848, pbOutput=0x5350000, pcbResult=0x132cf618) returned 0x0 [0151.509] WriteFile (in: hFile=0x9bc, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x132cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x132cf61c*=0x700, lpOverlapped=0x0) returned 1 [0151.509] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x132cf60c | out: lpNewFilePointer=0x0) returned 1 [0151.509] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.509] WriteFile (in: hFile=0x9bc, lpBuffer=0x132cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x132cf61c, lpOverlapped=0x0 | out: lpBuffer=0x132cf83c*, lpNumberOfBytesWritten=0x132cf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.509] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.509] BCryptDestroyKey (in: hKey=0x7ab5e0 | out: hKey=0x7ab5e0) returned 0x0 [0151.509] CloseHandle (hObject=0x9bc) returned 1 [0151.510] VirtualAlloc (lpAddress=0x0, dwSize=0xf1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\excel.en-us\\excelmui.xml.play")) returned 1 [0151.511] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1197 os_tid = 0x2d8 [0151.206] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.206] ReadFile (in: hFile=0x9c4, lpBuffer=0x1340fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1340f85c, lpOverlapped=0x0 | out: lpBuffer=0x1340fb34*, lpNumberOfBytesRead=0x1340f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.208] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.208] ReadFile (in: hFile=0x9c4, lpBuffer=0x1340fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1340f85c, lpOverlapped=0x0 | out: lpBuffer=0x1340fb34*, lpNumberOfBytesRead=0x1340f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.208] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.209] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x1340f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0151.209] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x1340f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x1340f828, pbKeyObject=0x0) returned 0x0 [0151.209] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1340f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1340f500) returned 0x0 [0151.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.210] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1340f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1340f500) returned 0x0 [0151.215] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.216] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.216] WriteFile (in: hFile=0x9c4, lpBuffer=0x1340fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1340f830, lpOverlapped=0x0 | out: lpBuffer=0x1340fb34*, lpNumberOfBytesWritten=0x1340f830*=0x428, lpOverlapped=0x0) returned 1 [0151.217] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.217] ReadFile (in: hFile=0x9c4, lpBuffer=0x5450000, nNumberOfBytesToRead=0x9b2, lpNumberOfBytesRead=0x1340f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x1340f61c*=0x9b2, lpOverlapped=0x0) returned 1 [0151.217] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xfffff64e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.217] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5450000, cbInput=0x9b2, pPaddingInfo=0x0, pbIV=0x1340f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x1340f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x1340f848, pbOutput=0x5450000, pcbResult=0x1340f618) returned 0x0 [0151.217] WriteFile (in: hFile=0x9c4, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x1340f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x1340f61c*=0x9c0, lpOverlapped=0x0) returned 1 [0151.217] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1340f60c | out: lpNewFilePointer=0x0) returned 1 [0151.217] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.218] WriteFile (in: hFile=0x9c4, lpBuffer=0x1340f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1340f61c, lpOverlapped=0x0 | out: lpBuffer=0x1340f83c*, lpNumberOfBytesWritten=0x1340f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.218] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x9c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.218] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0151.218] CloseHandle (hObject=0x9c4) returned 1 [0151.218] VirtualAlloc (lpAddress=0x0, dwSize=0xeb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Excel.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\excel.en-us\\setup.xml.play")) returned 1 [0151.220] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1198 os_tid = 0x538 [0151.222] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.223] ReadFile (in: hFile=0x9a4, lpBuffer=0x1354fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1354f85c, lpOverlapped=0x0 | out: lpBuffer=0x1354fb34*, lpNumberOfBytesRead=0x1354f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.540] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.541] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.542] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x1354f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0151.542] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x1354f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x1354f828, pbKeyObject=0x0) returned 0x0 [0151.542] BCryptExportKey (in: hKey=0x7a7bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1354f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1354f500) returned 0x0 [0151.542] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.542] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1354f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1354f500) returned 0x0 [0151.545] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.546] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.547] WriteFile (in: hFile=0x9a4, lpBuffer=0x1354fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1354f830, lpOverlapped=0x0 | out: lpBuffer=0x1354fb34*, lpNumberOfBytesWritten=0x1354f830*=0x428, lpOverlapped=0x0) returned 1 [0151.547] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.547] ReadFile (in: hFile=0x9a4, lpBuffer=0x5550000, nNumberOfBytesToRead=0x466, lpNumberOfBytesRead=0x1354f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x1354f61c*=0x466, lpOverlapped=0x0) returned 1 [0151.547] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xfffffb9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.547] BCryptEncrypt (in: hKey=0x7a7bb0, pbInput=0x5550000, cbInput=0x466, pPaddingInfo=0x0, pbIV=0x1354f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x1354f618, dwFlags=0x1 | out: hKey=0x7a7bb0, pbIV=0x1354f848, pbOutput=0x5550000, pcbResult=0x1354f618) returned 0x0 [0151.547] WriteFile (in: hFile=0x9a4, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x1354f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x1354f61c*=0x470, lpOverlapped=0x0) returned 1 [0151.547] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1354f60c | out: lpNewFilePointer=0x0) returned 1 [0151.547] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.547] WriteFile (in: hFile=0x9a4, lpBuffer=0x1354f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1354f61c, lpOverlapped=0x0 | out: lpBuffer=0x1354f83c*, lpNumberOfBytesWritten=0x1354f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.547] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.547] BCryptDestroyKey (in: hKey=0x7a7bb0 | out: hKey=0x7a7bb0) returned 0x0 [0151.548] CloseHandle (hObject=0x9a4) returned 1 [0151.548] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\groove.en-us\\groovemui.xml.play")) returned 1 [0151.549] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1199 os_tid = 0x4f8 [0151.224] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.224] ReadFile (in: hFile=0x9cc, lpBuffer=0x1368fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1368f85c, lpOverlapped=0x0 | out: lpBuffer=0x1368fb34*, lpNumberOfBytesRead=0x1368f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.226] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.227] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.227] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x1368f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0151.227] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x1368f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x1368f828, pbKeyObject=0x0) returned 0x0 [0151.227] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1368f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1368f500) returned 0x0 [0151.227] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.228] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1368f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1368f500) returned 0x0 [0151.232] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.234] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.234] WriteFile (in: hFile=0x9cc, lpBuffer=0x1368fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1368f830, lpOverlapped=0x0 | out: lpBuffer=0x1368fb34*, lpNumberOfBytesWritten=0x1368f830*=0x428, lpOverlapped=0x0) returned 1 [0151.234] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.234] ReadFile (in: hFile=0x9cc, lpBuffer=0x5650000, nNumberOfBytesToRead=0x668, lpNumberOfBytesRead=0x1368f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x1368f61c*=0x668, lpOverlapped=0x0) returned 1 [0151.234] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0xfffff998, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.235] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5650000, cbInput=0x668, pPaddingInfo=0x0, pbIV=0x1368f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x1368f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x1368f848, pbOutput=0x5650000, pcbResult=0x1368f618) returned 0x0 [0151.235] WriteFile (in: hFile=0x9cc, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x1368f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x1368f61c*=0x670, lpOverlapped=0x0) returned 1 [0151.235] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1368f60c | out: lpNewFilePointer=0x0) returned 1 [0151.235] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.235] WriteFile (in: hFile=0x9cc, lpBuffer=0x1368f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1368f61c, lpOverlapped=0x0 | out: lpBuffer=0x1368f83c*, lpNumberOfBytesWritten=0x1368f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.235] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.235] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0151.235] CloseHandle (hObject=0x9cc) returned 1 [0151.235] VirtualAlloc (lpAddress=0x0, dwSize=0xed, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Groove.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\groove.en-us\\setup.xml.play")) returned 1 [0151.237] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1200 os_tid = 0x128 [0151.240] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.240] ReadFile (in: hFile=0x9d4, lpBuffer=0x137cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x137cf85c, lpOverlapped=0x0 | out: lpBuffer=0x137cfb34*, lpNumberOfBytesRead=0x137cf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.242] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.243] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.243] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x137cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0151.243] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x137cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x137cf828, pbKeyObject=0x0) returned 0x0 [0151.243] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x137cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x137cf500) returned 0x0 [0151.244] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.244] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x137cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x137cf500) returned 0x0 [0151.249] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.250] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.250] WriteFile (in: hFile=0x9d4, lpBuffer=0x137cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x137cf830, lpOverlapped=0x0 | out: lpBuffer=0x137cfb34*, lpNumberOfBytesWritten=0x137cf830*=0x428, lpOverlapped=0x0) returned 1 [0151.251] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.251] ReadFile (in: hFile=0x9d4, lpBuffer=0x5750000, nNumberOfBytesToRead=0x4ce, lpNumberOfBytesRead=0x137cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x137cf61c*=0x4ce, lpOverlapped=0x0) returned 1 [0151.251] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffffb32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.251] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5750000, cbInput=0x4ce, pPaddingInfo=0x0, pbIV=0x137cf848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x137cf618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x137cf848, pbOutput=0x5750000, pcbResult=0x137cf618) returned 0x0 [0151.251] WriteFile (in: hFile=0x9d4, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x137cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x137cf61c*=0x4d0, lpOverlapped=0x0) returned 1 [0151.251] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x137cf60c | out: lpNewFilePointer=0x0) returned 1 [0151.251] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.251] WriteFile (in: hFile=0x9d4, lpBuffer=0x137cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x137cf61c, lpOverlapped=0x0 | out: lpBuffer=0x137cf83c*, lpNumberOfBytesWritten=0x137cf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.251] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x4d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.252] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0151.252] CloseHandle (hObject=0x9d4) returned 1 [0151.252] VirtualAlloc (lpAddress=0x0, dwSize=0xfd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\infopath.en-us\\infopathmui.xml.play")) returned 1 [0151.255] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1201 os_tid = 0x104c [0151.262] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.263] ReadFile (in: hFile=0x9dc, lpBuffer=0x1390fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1390f85c, lpOverlapped=0x0 | out: lpBuffer=0x1390fb34*, lpNumberOfBytesRead=0x1390f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.264] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0151.265] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0151.266] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x1390f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0151.266] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x1390f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x1390f828, pbKeyObject=0x0) returned 0x0 [0151.266] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1390f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1390f500) returned 0x0 [0151.266] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0151.267] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1390f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1390f500) returned 0x0 [0151.274] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.276] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.276] WriteFile (in: hFile=0x9dc, lpBuffer=0x1390fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1390f830, lpOverlapped=0x0 | out: lpBuffer=0x1390fb34*, lpNumberOfBytesWritten=0x1390f830*=0x428, lpOverlapped=0x0) returned 1 [0151.276] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.276] ReadFile (in: hFile=0x9dc, lpBuffer=0x5850000, nNumberOfBytesToRead=0x703, lpNumberOfBytesRead=0x1390f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x1390f61c*=0x703, lpOverlapped=0x0) returned 1 [0151.277] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xfffff8fd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.277] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5850000, cbInput=0x703, pPaddingInfo=0x0, pbIV=0x1390f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x1390f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x1390f848, pbOutput=0x5850000, pcbResult=0x1390f618) returned 0x0 [0151.277] WriteFile (in: hFile=0x9dc, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x1390f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x1390f61c*=0x710, lpOverlapped=0x0) returned 1 [0151.278] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1390f60c | out: lpNewFilePointer=0x0) returned 1 [0151.278] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.278] WriteFile (in: hFile=0x9dc, lpBuffer=0x1390f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1390f61c, lpOverlapped=0x0 | out: lpBuffer=0x1390f83c*, lpNumberOfBytesWritten=0x1390f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.278] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.278] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0151.278] CloseHandle (hObject=0x9dc) returned 1 [0151.278] VirtualAlloc (lpAddress=0x0, dwSize=0xf1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0151.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\infopath.en-us\\setup.xml.play")) returned 1 [0151.280] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1202 os_tid = 0x1050 [0151.712] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.712] ReadFile (in: hFile=0x9ec, lpBuffer=0x13a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x13a4fb34*, lpNumberOfBytesRead=0x13a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.716] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0151.717] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0151.717] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x13a4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0151.717] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x13a4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x13a4f828, pbKeyObject=0x0) returned 0x0 [0151.717] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x13a4f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x13a4f500) returned 0x0 [0151.717] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0151.718] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x13a4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x13a4f500) returned 0x0 [0151.721] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.722] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.722] WriteFile (in: hFile=0x9ec, lpBuffer=0x13a4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13a4f830, lpOverlapped=0x0 | out: lpBuffer=0x13a4fb34*, lpNumberOfBytesWritten=0x13a4f830*=0x428, lpOverlapped=0x0) returned 1 [0151.723] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.723] ReadFile (in: hFile=0x9ec, lpBuffer=0x5950000, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x13a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x13a4f61c*=0x4cb, lpOverlapped=0x0) returned 1 [0151.723] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffffb35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.723] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5950000, cbInput=0x4cb, pPaddingInfo=0x0, pbIV=0x13a4f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x13a4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x13a4f848, pbOutput=0x5950000, pcbResult=0x13a4f618) returned 0x0 [0151.723] WriteFile (in: hFile=0x9ec, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x13a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x13a4f61c*=0x4d0, lpOverlapped=0x0) returned 1 [0151.723] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13a4f60c | out: lpNewFilePointer=0x0) returned 1 [0151.723] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.723] WriteFile (in: hFile=0x9ec, lpBuffer=0x13a4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x13a4f83c*, lpNumberOfBytesWritten=0x13a4f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.723] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x4d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.723] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0151.723] CloseHandle (hObject=0x9ec) returned 1 [0151.724] VirtualAlloc (lpAddress=0x0, dwSize=0xed, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0151.724] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Lync.en-us\\LyncMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\lync.en-us\\lyncmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Lync.en-us\\LyncMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\lync.en-us\\lyncmui.xml.play")) returned 1 [0151.725] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1203 os_tid = 0x1058 [0151.727] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.727] ReadFile (in: hFile=0x9f4, lpBuffer=0x13b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x13b8fb34*, lpNumberOfBytesRead=0x13b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.729] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0151.729] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0151.729] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x13b8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0151.729] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x13b8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x13b8f828, pbKeyObject=0x0) returned 0x0 [0151.729] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x13b8f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x13b8f500) returned 0x0 [0151.730] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0151.730] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x13b8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x13b8f500) returned 0x0 [0151.734] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.736] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.736] WriteFile (in: hFile=0x9f4, lpBuffer=0x13b8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13b8f830, lpOverlapped=0x0 | out: lpBuffer=0x13b8fb34*, lpNumberOfBytesWritten=0x13b8f830*=0x428, lpOverlapped=0x0) returned 1 [0151.736] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.736] ReadFile (in: hFile=0x9f4, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x69a, lpNumberOfBytesRead=0x13b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x13b8f61c*=0x69a, lpOverlapped=0x0) returned 1 [0151.736] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0xfffff966, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.736] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5a50000, cbInput=0x69a, pPaddingInfo=0x0, pbIV=0x13b8f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x13b8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x13b8f848, pbOutput=0x5a50000, pcbResult=0x13b8f618) returned 0x0 [0151.736] WriteFile (in: hFile=0x9f4, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x13b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x13b8f61c*=0x6a0, lpOverlapped=0x0) returned 1 [0151.737] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13b8f60c | out: lpNewFilePointer=0x0) returned 1 [0151.737] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.737] WriteFile (in: hFile=0x9f4, lpBuffer=0x13b8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x13b8f83c*, lpNumberOfBytesWritten=0x13b8f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.737] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x6a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.737] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0151.737] CloseHandle (hObject=0x9f4) returned 1 [0151.737] VirtualAlloc (lpAddress=0x0, dwSize=0xe9, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0151.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Lync.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\lync.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Lync.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\lync.en-us\\setup.xml.play")) returned 1 [0151.739] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1204 os_tid = 0x105c [0151.741] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.741] ReadFile (in: hFile=0x9e8, lpBuffer=0x13ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x13ccfb34*, lpNumberOfBytesRead=0x13ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.743] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.743] ReadFile (in: hFile=0x9e8, lpBuffer=0x13ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x13ccfb34*, lpNumberOfBytesRead=0x13ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0151.743] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0151.744] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0151.744] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x13ccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0151.745] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x13ccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x13ccf828, pbKeyObject=0x0) returned 0x0 [0151.745] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x13ccf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x13ccf500) returned 0x0 [0151.745] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0151.745] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x13ccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x13ccf500) returned 0x0 [0151.748] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.749] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.750] WriteFile (in: hFile=0x9e8, lpBuffer=0x13ccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13ccf830, lpOverlapped=0x0 | out: lpBuffer=0x13ccfb34*, lpNumberOfBytesWritten=0x13ccf830*=0x428, lpOverlapped=0x0) returned 1 [0151.750] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.750] ReadFile (in: hFile=0x9e8, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x3ec0, lpNumberOfBytesRead=0x13ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x13ccf61c*=0x3ec0, lpOverlapped=0x0) returned 1 [0151.751] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xffffc140, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.751] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5b50000, cbInput=0x3ec0, pPaddingInfo=0x0, pbIV=0x13ccf848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x13ccf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x13ccf848, pbOutput=0x5b50000, pcbResult=0x13ccf618) returned 0x0 [0151.751] WriteFile (in: hFile=0x9e8, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x3ed0, lpNumberOfBytesWritten=0x13ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x13ccf61c*=0x3ed0, lpOverlapped=0x0) returned 1 [0151.751] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13ccf60c | out: lpNewFilePointer=0x0) returned 1 [0151.751] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.751] WriteFile (in: hFile=0x9e8, lpBuffer=0x13ccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x13ccf83c*, lpNumberOfBytesWritten=0x13ccf61c*=0x8, lpOverlapped=0x0) returned 1 [0151.751] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x3ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.752] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0151.752] CloseHandle (hObject=0x9e8) returned 1 [0151.752] VirtualAlloc (lpAddress=0x0, dwSize=0xf3, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0151.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.dll.play")) returned 1 [0151.754] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1205 os_tid = 0x1060 [0151.806] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.806] ReadFile (in: hFile=0xa00, lpBuffer=0x13e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x13e0fb34*, lpNumberOfBytesRead=0x13e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.821] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.822] ReadFile (in: hFile=0xa00, lpBuffer=0x13e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x13e0fb34*, lpNumberOfBytesRead=0x13e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.822] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0151.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0151.824] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x13e0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0151.824] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x13e0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x13e0f828, pbKeyObject=0x0) returned 0x0 [0151.824] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x13e0f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x13e0f500) returned 0x0 [0151.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0151.824] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x13e0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x13e0f500) returned 0x0 [0151.829] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.830] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.830] WriteFile (in: hFile=0xa00, lpBuffer=0x13e0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13e0f830, lpOverlapped=0x0 | out: lpBuffer=0x13e0fb34*, lpNumberOfBytesWritten=0x13e0f830*=0x428, lpOverlapped=0x0) returned 1 [0151.831] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.831] ReadFile (in: hFile=0xa00, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x521b9, lpNumberOfBytesRead=0x13e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x13e0f61c*=0x521b9, lpOverlapped=0x0) returned 1 [0151.849] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffade47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.849] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5c50000, cbInput=0x521b9, pPaddingInfo=0x0, pbIV=0x13e0f848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x13e0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x13e0f848, pbOutput=0x5c50000, pcbResult=0x13e0f618) returned 0x0 [0151.849] WriteFile (in: hFile=0xa00, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x521c0, lpNumberOfBytesWritten=0x13e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x13e0f61c*=0x521c0, lpOverlapped=0x0) returned 1 [0151.850] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13e0f60c | out: lpNewFilePointer=0x0) returned 1 [0151.850] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.850] WriteFile (in: hFile=0xa00, lpBuffer=0x13e0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x13e0f83c*, lpNumberOfBytesWritten=0x13e0f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.851] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x521c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.851] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0151.851] CloseHandle (hObject=0xa00) returned 1 [0151.851] VirtualAlloc (lpAddress=0x0, dwSize=0xf3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0151.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.xml.play")) returned 1 [0151.856] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1206 os_tid = 0x864 [0151.808] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.808] ReadFile (in: hFile=0x958, lpBuffer=0x13f4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13f4f85c, lpOverlapped=0x0 | out: lpBuffer=0x13f4fb34*, lpNumberOfBytesRead=0x13f4f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.834] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.834] ReadFile (in: hFile=0x958, lpBuffer=0x13f4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13f4f85c, lpOverlapped=0x0 | out: lpBuffer=0x13f4fb34*, lpNumberOfBytesRead=0x13f4f85c*=0x428, lpOverlapped=0x0) returned 1 [0151.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0151.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0151.839] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x13f4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0151.839] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x13f4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x13f4f828, pbKeyObject=0x0) returned 0x0 [0151.839] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x13f4f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x13f4f500) returned 0x0 [0151.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0151.839] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x13f4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x13f4f500) returned 0x0 [0151.842] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.844] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.844] WriteFile (in: hFile=0x958, lpBuffer=0x13f4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13f4f830, lpOverlapped=0x0 | out: lpBuffer=0x13f4fb34*, lpNumberOfBytesWritten=0x13f4f830*=0x428, lpOverlapped=0x0) returned 1 [0151.844] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.844] ReadFile (in: hFile=0x958, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x149b, lpNumberOfBytesRead=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x13f4f61c*=0x149b, lpOverlapped=0x0) returned 1 [0151.844] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xffffeb65, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.844] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5d50000, cbInput=0x149b, pPaddingInfo=0x0, pbIV=0x13f4f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x13f4f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x13f4f848, pbOutput=0x5d50000, pcbResult=0x13f4f618) returned 0x0 [0151.844] WriteFile (in: hFile=0x958, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x13f4f61c*=0x14a0, lpOverlapped=0x0) returned 1 [0151.845] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13f4f60c | out: lpNewFilePointer=0x0) returned 1 [0151.845] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.845] WriteFile (in: hFile=0x958, lpBuffer=0x13f4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x13f4f83c*, lpNumberOfBytesWritten=0x13f4f61c*=0x8, lpOverlapped=0x0) returned 1 [0151.845] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x14a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.845] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0151.845] CloseHandle (hObject=0x958) returned 1 [0151.846] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0151.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\officemui.xml.play")) returned 1 [0151.853] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1207 os_tid = 0xfc4 [0151.918] GetLastError () returned 0x57 [0151.918] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9c30 [0151.918] SetLastError (dwErrCode=0x57) [0151.918] IcmpCreateFile () returned 0x75d310 [0151.918] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb48 [0151.918] IcmpSendEcho2 (in: IcmpHandle=0x75d310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc200a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bb48) returned 0x0 [0166.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bb48 | out: hHeap=0x710000) returned 1 [0166.959] IcmpCloseHandle (IcmpHandle=0x75d310) returned 1 [0166.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9c30 | out: hHeap=0x710000) returned 1 Thread: id = 1208 os_tid = 0xd74 [0151.920] GetLastError () returned 0x57 [0151.920] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9fb8 [0151.920] SetLastError (dwErrCode=0x57) [0151.920] IcmpCreateFile () returned 0x75d348 [0151.920] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb98 [0151.920] IcmpSendEcho2 (in: IcmpHandle=0x75d348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc300a8c0, RequestData=0xff8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bb98) returned 0x0 [0167.052] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bb98 | out: hHeap=0x710000) returned 1 [0167.052] IcmpCloseHandle (IcmpHandle=0x75d348) returned 1 [0167.052] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e9fb8 | out: hHeap=0x710000) returned 1 Thread: id = 1209 os_tid = 0xd84 [0151.921] GetLastError () returned 0x57 [0151.921] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea340 [0151.922] SetLastError (dwErrCode=0x57) [0151.922] IcmpCreateFile () returned 0x75d3b8 [0151.922] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bbe8 [0151.922] IcmpSendEcho2 (in: IcmpHandle=0x75d3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc400a8c0, RequestData=0x1020ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bbe8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bbe8) returned 0x0 [0167.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bbe8 | out: hHeap=0x710000) returned 1 [0167.060] IcmpCloseHandle (IcmpHandle=0x75d3b8) returned 1 [0167.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea340 | out: hHeap=0x710000) returned 1 Thread: id = 1210 os_tid = 0xd88 [0151.923] GetLastError () returned 0x57 [0151.923] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea6c8 [0151.923] SetLastError (dwErrCode=0x57) [0151.923] IcmpCreateFile () returned 0x75d3f0 [0151.923] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc38 [0151.923] IcmpSendEcho2 (in: IcmpHandle=0x75d3f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc500a8c0, RequestData=0x1098ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bc38) returned 0x0 [0167.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bc38 | out: hHeap=0x710000) returned 1 [0167.065] IcmpCloseHandle (IcmpHandle=0x75d3f0) returned 1 [0167.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ea6c8 | out: hHeap=0x710000) returned 1 Thread: id = 1211 os_tid = 0xd94 [0151.924] GetLastError () returned 0x57 [0151.924] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eaa50 [0151.924] SetLastError (dwErrCode=0x57) [0151.924] IcmpCreateFile () returned 0x75d578 [0151.925] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc88 [0151.925] IcmpSendEcho2 (in: IcmpHandle=0x75d578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc600a8c0, RequestData=0x11c4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x76bc88) returned 0x0 [0167.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x76bc88 | out: hHeap=0x710000) returned 1 [0167.086] IcmpCloseHandle (IcmpHandle=0x75d578) returned 1 [0167.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eaa50 | out: hHeap=0x710000) returned 1 Thread: id = 1212 os_tid = 0xdb4 [0151.926] GetLastError () returned 0x57 [0151.926] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ebbf8 [0151.926] SetLastError (dwErrCode=0x57) [0151.926] IcmpCreateFile () returned 0x75d620 [0151.926] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de28 [0151.926] IcmpSendEcho2 (in: IcmpHandle=0x75d620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc700a8c0, RequestData=0x11d8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de28) returned 0x0 [0167.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de28 | out: hHeap=0x710000) returned 1 [0167.182] IcmpCloseHandle (IcmpHandle=0x75d620) returned 1 [0167.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ebbf8 | out: hHeap=0x710000) returned 1 Thread: id = 1213 os_tid = 0xd98 [0151.927] GetLastError () returned 0x57 [0151.927] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ebf80 [0151.927] SetLastError (dwErrCode=0x57) [0151.927] IcmpCreateFile () returned 0x75d658 [0151.927] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de78 [0151.927] IcmpSendEcho2 (in: IcmpHandle=0x75d658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc800a8c0, RequestData=0x11ecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73de78) returned 0x0 [0168.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73de78 | out: hHeap=0x710000) returned 1 [0168.248] IcmpCloseHandle (IcmpHandle=0x75d658) returned 1 [0168.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ebf80 | out: hHeap=0x710000) returned 1 Thread: id = 1214 os_tid = 0xd9c [0151.929] GetLastError () returned 0x57 [0151.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ec308 [0151.929] SetLastError (dwErrCode=0x57) [0151.929] IcmpCreateFile () returned 0x75d690 [0151.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df68 [0151.929] IcmpSendEcho2 (in: IcmpHandle=0x75d690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc900a8c0, RequestData=0x1200ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73df68) returned 0x0 [0168.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73df68 | out: hHeap=0x710000) returned 1 [0168.845] IcmpCloseHandle (IcmpHandle=0x75d690) returned 1 [0168.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ec308 | out: hHeap=0x710000) returned 1 Thread: id = 1215 os_tid = 0xdc8 [0151.930] GetLastError () returned 0x57 [0151.930] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ec690 [0151.931] SetLastError (dwErrCode=0x57) [0151.931] IcmpCreateFile () returned 0x75d6c8 [0151.931] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dfb8 [0151.931] IcmpSendEcho2 (in: IcmpHandle=0x75d6c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xca00a8c0, RequestData=0x1214ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dfb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73dfb8) returned 0x0 [0169.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73dfb8 | out: hHeap=0x710000) returned 1 [0169.914] IcmpCloseHandle (IcmpHandle=0x75d6c8) returned 1 [0169.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ec690 | out: hHeap=0x710000) returned 1 Thread: id = 1216 os_tid = 0xda8 [0151.932] GetLastError () returned 0x57 [0151.932] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eca18 [0151.932] SetLastError (dwErrCode=0x57) [0151.932] IcmpCreateFile () returned 0x75d700 [0151.932] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e058 [0151.932] IcmpSendEcho2 (in: IcmpHandle=0x75d700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcb00a8c0, RequestData=0x1228ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e058, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e058) returned 0x0 [0169.946] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e058 | out: hHeap=0x710000) returned 1 [0169.946] IcmpCloseHandle (IcmpHandle=0x75d700) returned 1 [0169.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6eca18 | out: hHeap=0x710000) returned 1 Thread: id = 1217 os_tid = 0xdb0 [0151.933] GetLastError () returned 0x57 [0151.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ecda0 [0151.934] SetLastError (dwErrCode=0x57) [0151.934] IcmpCreateFile () returned 0x75d070 [0151.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e0a8 [0151.934] IcmpSendEcho2 (in: IcmpHandle=0x75d070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcc00a8c0, RequestData=0x123cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e0a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x73e0a8) returned 0x0 [0170.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x73e0a8 | out: hHeap=0x710000) returned 1 [0170.061] IcmpCloseHandle (IcmpHandle=0x75d070) returned 1 [0170.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ecda0 | out: hHeap=0x710000) returned 1 Thread: id = 1218 os_tid = 0xdcc [0151.935] GetLastError () returned 0x57 [0151.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed128 [0151.935] SetLastError (dwErrCode=0x57) [0151.935] IcmpCreateFile () returned 0x75d0a8 [0151.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfed8 [0151.935] IcmpSendEcho2 (in: IcmpHandle=0x75d0a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcd00a8c0, RequestData=0x1250ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfed8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfed8) returned 0x0 [0171.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfed8 | out: hHeap=0x710000) returned 1 [0171.239] IcmpCloseHandle (IcmpHandle=0x75d0a8) returned 1 [0171.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ed128 | out: hHeap=0x710000) returned 1 Thread: id = 1219 os_tid = 0xdd0 [0151.937] GetLastError () returned 0x57 [0151.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed4b0 [0151.937] SetLastError (dwErrCode=0x57) [0151.937] IcmpCreateFile () returned 0x75d0e0 [0151.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfd98 [0151.937] IcmpSendEcho2 (in: IcmpHandle=0x75d0e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xce00a8c0, RequestData=0x1408ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfd98, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfd98) returned 0x0 [0174.155] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfd98 | out: hHeap=0x710000) returned 1 [0174.155] IcmpCloseHandle (IcmpHandle=0x75d0e0) returned 1 [0174.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6ed4b0 | out: hHeap=0x710000) returned 1 Thread: id = 1220 os_tid = 0x1114 [0151.938] GetLastError () returned 0x57 [0151.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f17c8 [0151.938] SetLastError (dwErrCode=0x57) [0151.938] IcmpCreateFile () returned 0x75d118 [0151.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfde8 [0151.939] IcmpSendEcho2 (in: IcmpHandle=0x75d118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcf00a8c0, RequestData=0x141cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfde8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfde8) returned 0x0 [0174.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfde8 | out: hHeap=0x710000) returned 1 [0174.600] IcmpCloseHandle (IcmpHandle=0x75d118) returned 1 [0174.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6f17c8 | out: hHeap=0x710000) returned 1 Thread: id = 1221 os_tid = 0xdd4 [0151.940] GetLastError () returned 0x57 [0151.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a97e8 [0151.940] SetLastError (dwErrCode=0x57) [0151.940] IcmpCreateFile () returned 0x75d188 [0151.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf618 [0151.940] IcmpSendEcho2 (in: IcmpHandle=0x75d188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd000a8c0, RequestData=0x1430ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf618, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf618) returned 0x0 [0175.385] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf618 | out: hHeap=0x710000) returned 1 [0175.385] IcmpCloseHandle (IcmpHandle=0x75d188) returned 1 [0175.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a97e8 | out: hHeap=0x710000) returned 1 Thread: id = 1222 os_tid = 0xe40 [0151.941] GetLastError () returned 0x57 [0151.941] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ab428 [0151.942] SetLastError (dwErrCode=0x57) [0151.942] IcmpCreateFile () returned 0x75d1c0 [0151.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfa78 [0151.942] IcmpSendEcho2 (in: IcmpHandle=0x75d1c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd100a8c0, RequestData=0x1444ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfa78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfa78) returned 0x0 [0176.616] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfa78 | out: hHeap=0x710000) returned 1 [0176.616] IcmpCloseHandle (IcmpHandle=0x75d1c0) returned 1 [0176.616] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ab428 | out: hHeap=0x710000) returned 1 Thread: id = 1223 os_tid = 0xd80 [0151.943] GetLastError () returned 0x57 [0151.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a9b70 [0151.943] SetLastError (dwErrCode=0x57) [0151.943] IcmpCreateFile () returned 0x75d1f8 [0151.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf668 [0151.943] IcmpSendEcho2 (in: IcmpHandle=0x75d1f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd200a8c0, RequestData=0x1458ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf668, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf668) returned 0x0 [0176.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf668 | out: hHeap=0x710000) returned 1 [0176.865] IcmpCloseHandle (IcmpHandle=0x75d1f8) returned 1 [0176.866] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a9b70 | out: hHeap=0x710000) returned 1 Thread: id = 1224 os_tid = 0xd78 [0151.944] GetLastError () returned 0x57 [0151.945] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ab7b0 [0151.945] SetLastError (dwErrCode=0x57) [0151.945] IcmpCreateFile () returned 0x75d230 [0151.945] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfac8 [0151.945] IcmpSendEcho2 (in: IcmpHandle=0x75d230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd300a8c0, RequestData=0x146cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfac8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfac8) returned 0x0 [0177.228] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfac8 | out: hHeap=0x710000) returned 1 [0177.228] IcmpCloseHandle (IcmpHandle=0x75d230) returned 1 [0177.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ab7b0 | out: hHeap=0x710000) returned 1 Thread: id = 1225 os_tid = 0xe54 [0151.946] GetLastError () returned 0x57 [0151.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a7ba8 [0151.946] SetLastError (dwErrCode=0x57) [0151.946] IcmpCreateFile () returned 0x75d268 [0151.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfb18 [0151.946] IcmpSendEcho2 (in: IcmpHandle=0x75d268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd400a8c0, RequestData=0x1480ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfb18, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfb18) returned 0x0 [0178.218] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfb18 | out: hHeap=0x710000) returned 1 [0178.218] IcmpCloseHandle (IcmpHandle=0x75d268) returned 1 [0178.219] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7ba8 | out: hHeap=0x710000) returned 1 Thread: id = 1226 os_tid = 0x11fc [0151.948] GetLastError () returned 0x57 [0151.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a7f30 [0151.948] SetLastError (dwErrCode=0x57) [0151.948] IcmpCreateFile () returned 0x75d2a0 [0151.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfb68 [0151.948] IcmpSendEcho2 (in: IcmpHandle=0x75d2a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd500a8c0, RequestData=0x1494ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfb68, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfb68) returned 0x0 [0178.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfb68 | out: hHeap=0x710000) returned 1 [0178.355] IcmpCloseHandle (IcmpHandle=0x75d2a0) returned 1 [0178.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a7f30 | out: hHeap=0x710000) returned 1 Thread: id = 1227 os_tid = 0x1204 [0151.949] GetLastError () returned 0x57 [0151.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a82b8 [0151.949] SetLastError (dwErrCode=0x57) [0151.949] IcmpCreateFile () returned 0x75d2d8 [0151.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfbb8 [0151.949] IcmpSendEcho2 (in: IcmpHandle=0x75d2d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd600a8c0, RequestData=0x14a8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfbb8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfbb8) returned 0x0 [0178.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfbb8 | out: hHeap=0x710000) returned 1 [0178.387] IcmpCloseHandle (IcmpHandle=0x75d2d8) returned 1 [0178.388] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a82b8 | out: hHeap=0x710000) returned 1 Thread: id = 1228 os_tid = 0x1200 [0151.951] GetLastError () returned 0x57 [0151.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a8640 [0151.951] SetLastError (dwErrCode=0x57) [0151.951] IcmpCreateFile () returned 0x75d738 [0151.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfc08 [0151.951] IcmpSendEcho2 (in: IcmpHandle=0x75d738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd700a8c0, RequestData=0x14bcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfc08, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfc08) returned 0x0 [0178.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfc08 | out: hHeap=0x710000) returned 1 [0178.860] IcmpCloseHandle (IcmpHandle=0x75d738) returned 1 [0178.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a8640 | out: hHeap=0x710000) returned 1 Thread: id = 1229 os_tid = 0x11f8 [0151.952] GetLastError () returned 0x57 [0151.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a89c8 [0151.952] SetLastError (dwErrCode=0x57) [0151.952] IcmpCreateFile () returned 0x75d770 [0151.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfc58 [0151.953] IcmpSendEcho2 (in: IcmpHandle=0x75d770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd800a8c0, RequestData=0x14d0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfc58, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfc58) returned 0x0 [0179.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfc58 | out: hHeap=0x710000) returned 1 [0179.532] IcmpCloseHandle (IcmpHandle=0x75d770) returned 1 [0179.533] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a89c8 | out: hHeap=0x710000) returned 1 Thread: id = 1230 os_tid = 0x1244 [0151.954] GetLastError () returned 0x57 [0151.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a8d50 [0151.954] SetLastError (dwErrCode=0x57) [0151.954] IcmpCreateFile () returned 0x75d7a8 [0151.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf7f8 [0151.954] IcmpSendEcho2 (in: IcmpHandle=0x75d7a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd900a8c0, RequestData=0x14e4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf7f8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf7f8) returned 0x0 [0180.795] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf7f8 | out: hHeap=0x710000) returned 1 [0180.795] IcmpCloseHandle (IcmpHandle=0x75d7a8) returned 1 [0180.796] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a8d50 | out: hHeap=0x710000) returned 1 Thread: id = 1231 os_tid = 0x1240 [0151.955] GetLastError () returned 0x57 [0151.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a90d8 [0151.956] SetLastError (dwErrCode=0x57) [0151.956] IcmpCreateFile () returned 0x74f410 [0151.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf848 [0151.956] IcmpSendEcho2 (in: IcmpHandle=0x74f410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xda00a8c0, RequestData=0x14f8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf848, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf848) returned 0x0 [0181.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf848 | out: hHeap=0x710000) returned 1 [0181.921] IcmpCloseHandle (IcmpHandle=0x74f410) returned 1 [0181.922] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a90d8 | out: hHeap=0x710000) returned 1 Thread: id = 1232 os_tid = 0x123c [0151.957] GetLastError () returned 0x57 [0151.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a9460 [0151.957] SetLastError (dwErrCode=0x57) [0151.957] IcmpCreateFile () returned 0x74f448 [0151.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf898 [0151.957] IcmpSendEcho2 (in: IcmpHandle=0x74f448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdb00a8c0, RequestData=0x150cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf898, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf898) returned 0x0 [0184.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf898 | out: hHeap=0x710000) returned 1 [0184.222] IcmpCloseHandle (IcmpHandle=0x74f448) returned 1 [0184.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a9460 | out: hHeap=0x710000) returned 1 Thread: id = 1233 os_tid = 0x1230 [0151.958] GetLastError () returned 0x57 [0151.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a9ef8 [0151.959] SetLastError (dwErrCode=0x57) [0151.959] IcmpCreateFile () returned 0x74f3d8 [0151.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf8e8 [0151.959] IcmpSendEcho2 (in: IcmpHandle=0x74f3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdc00a8c0, RequestData=0x1520ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf8e8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf8e8) returned 0x0 [0186.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf8e8 | out: hHeap=0x710000) returned 1 [0186.741] IcmpCloseHandle (IcmpHandle=0x74f3d8) returned 1 [0186.742] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7a9ef8 | out: hHeap=0x710000) returned 1 Thread: id = 1234 os_tid = 0x1238 [0151.960] GetLastError () returned 0x57 [0151.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aa280 [0151.960] SetLastError (dwErrCode=0x57) [0151.960] IcmpCreateFile () returned 0x728a58 [0151.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf938 [0151.960] IcmpSendEcho2 (in: IcmpHandle=0x728a58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdd00a8c0, RequestData=0x1534ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf938, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf938) returned 0x0 [0187.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf938 | out: hHeap=0x710000) returned 1 [0187.369] IcmpCloseHandle (IcmpHandle=0x728a58) returned 1 [0187.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aa280 | out: hHeap=0x710000) returned 1 Thread: id = 1235 os_tid = 0x1234 [0151.962] GetLastError () returned 0x57 [0151.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aa608 [0151.962] SetLastError (dwErrCode=0x57) [0151.962] IcmpCreateFile () returned 0x724be8 [0151.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf988 [0151.962] IcmpSendEcho2 (in: IcmpHandle=0x724be8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xde00a8c0, RequestData=0x1548ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf988, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf988) returned 0x0 [0187.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf988 | out: hHeap=0x710000) returned 1 [0187.789] IcmpCloseHandle (IcmpHandle=0x724be8) returned 1 [0187.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aa608 | out: hHeap=0x710000) returned 1 Thread: id = 1236 os_tid = 0x122c [0151.963] GetLastError () returned 0x57 [0151.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aa990 [0151.963] SetLastError (dwErrCode=0x57) [0151.964] IcmpCreateFile () returned 0x76a428 [0151.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf7a8 [0151.964] IcmpSendEcho2 (in: IcmpHandle=0x76a428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdf00a8c0, RequestData=0x155cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf7a8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf7a8) returned 0x0 [0189.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf7a8 | out: hHeap=0x710000) returned 1 [0189.086] IcmpCloseHandle (IcmpHandle=0x76a428) returned 1 [0189.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aa990 | out: hHeap=0x710000) returned 1 Thread: id = 1237 os_tid = 0x1048 [0151.965] GetLastError () returned 0x57 [0151.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aad18 [0151.965] SetLastError (dwErrCode=0x57) [0151.965] IcmpCreateFile () returned 0x76a738 [0151.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf9d8 [0151.965] IcmpSendEcho2 (in: IcmpHandle=0x76a738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe000a8c0, RequestData=0x1570ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf9d8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf9d8) returned 0x0 [0190.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf9d8 | out: hHeap=0x710000) returned 1 [0190.025] IcmpCloseHandle (IcmpHandle=0x76a738) returned 1 [0190.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7aad18 | out: hHeap=0x710000) returned 1 Thread: id = 1238 os_tid = 0x328 [0151.966] GetLastError () returned 0x57 [0151.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ab0a0 [0151.967] SetLastError (dwErrCode=0x57) [0151.967] IcmpCreateFile () returned 0x76a770 [0151.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfa28 [0151.967] IcmpSendEcho2 (in: IcmpHandle=0x76a770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe100a8c0, RequestData=0x1584ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfa28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfa28) returned 0x0 [0190.136] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfa28 | out: hHeap=0x710000) returned 1 [0190.136] IcmpCloseHandle (IcmpHandle=0x76a770) returned 1 [0190.137] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ab0a0 | out: hHeap=0x710000) returned 1 Thread: id = 1239 os_tid = 0x4ac [0151.968] GetLastError () returned 0x57 [0151.968] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78db68 [0151.968] SetLastError (dwErrCode=0x57) [0151.968] IcmpCreateFile () returned 0x76a690 [0151.968] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfca8 [0151.968] IcmpSendEcho2 (in: IcmpHandle=0x76a690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe200a8c0, RequestData=0x1598ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfca8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfca8) returned 0x0 [0190.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfca8 | out: hHeap=0x710000) returned 1 [0190.215] IcmpCloseHandle (IcmpHandle=0x76a690) returned 1 [0190.216] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78db68 | out: hHeap=0x710000) returned 1 Thread: id = 1240 os_tid = 0xab4 [0151.970] GetLastError () returned 0x57 [0151.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78ed10 [0151.970] SetLastError (dwErrCode=0x57) [0151.970] IcmpCreateFile () returned 0x76a230 [0151.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfcf8 [0151.970] IcmpSendEcho2 (in: IcmpHandle=0x76a230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe300a8c0, RequestData=0x15acff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfcf8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfcf8) returned 0x0 [0190.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfcf8 | out: hHeap=0x710000) returned 1 [0190.237] IcmpCloseHandle (IcmpHandle=0x76a230) returned 1 [0190.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78ed10 | out: hHeap=0x710000) returned 1 Thread: id = 1241 os_tid = 0x480 [0151.971] GetLastError () returned 0x57 [0151.971] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78d0d0 [0151.971] SetLastError (dwErrCode=0x57) [0151.971] IcmpCreateFile () returned 0x76a268 [0151.971] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfd48 [0151.971] IcmpSendEcho2 (in: IcmpHandle=0x76a268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe400a8c0, RequestData=0x15c0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfd48, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfd48) returned 0x0 [0190.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfd48 | out: hHeap=0x710000) returned 1 [0190.877] IcmpCloseHandle (IcmpHandle=0x76a268) returned 1 [0190.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78d0d0 | out: hHeap=0x710000) returned 1 Thread: id = 1242 os_tid = 0x2f8 [0151.973] GetLastError () returned 0x57 [0151.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78d458 [0151.973] SetLastError (dwErrCode=0x57) [0151.973] IcmpCreateFile () returned 0x76a2a0 [0151.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfe38 [0151.973] IcmpSendEcho2 (in: IcmpHandle=0x76a2a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe500a8c0, RequestData=0x15d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfe38, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfe38) returned 0x0 [0191.161] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfe38 | out: hHeap=0x710000) returned 1 [0191.161] IcmpCloseHandle (IcmpHandle=0x76a2a0) returned 1 [0191.162] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78d458 | out: hHeap=0x710000) returned 1 Thread: id = 1243 os_tid = 0x66c [0151.977] GetLastError () returned 0x57 [0151.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78d7e0 [0151.977] SetLastError (dwErrCode=0x57) [0151.977] IcmpCreateFile () returned 0x76a2d8 [0151.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfe88 [0151.977] IcmpSendEcho2 (in: IcmpHandle=0x76a2d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe600a8c0, RequestData=0x15e8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfe88, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cfe88) returned 0x0 [0191.624] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cfe88 | out: hHeap=0x710000) returned 1 [0191.624] IcmpCloseHandle (IcmpHandle=0x76a2d8) returned 1 [0191.625] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78d7e0 | out: hHeap=0x710000) returned 1 Thread: id = 1244 os_tid = 0x474 [0151.978] GetLastError () returned 0x57 [0151.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78def0 [0151.979] SetLastError (dwErrCode=0x57) [0151.979] IcmpCreateFile () returned 0x76a310 [0151.979] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cff28 [0151.979] IcmpSendEcho2 (in: IcmpHandle=0x76a310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe700a8c0, RequestData=0x15fcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cff28, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cff28) returned 0x0 [0192.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cff28 | out: hHeap=0x710000) returned 1 [0192.885] IcmpCloseHandle (IcmpHandle=0x76a310) returned 1 [0192.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78def0 | out: hHeap=0x710000) returned 1 Thread: id = 1245 os_tid = 0xbac [0151.980] GetLastError () returned 0x57 [0151.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78e278 [0151.980] SetLastError (dwErrCode=0x57) [0151.980] IcmpCreateFile () returned 0x76a348 [0151.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cff78 [0151.980] IcmpSendEcho2 (in: IcmpHandle=0x76a348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe800a8c0, RequestData=0x1610ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cff78, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cff78) returned 0x0 [0195.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cff78 | out: hHeap=0x710000) returned 1 [0195.770] IcmpCloseHandle (IcmpHandle=0x76a348) returned 1 [0195.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78e278 | out: hHeap=0x710000) returned 1 Thread: id = 1246 os_tid = 0xb5c [0151.981] GetLastError () returned 0x57 [0151.981] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78e600 [0151.981] SetLastError (dwErrCode=0x57) [0151.982] IcmpCreateFile () returned 0x76a380 [0151.982] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf5c8 [0151.982] IcmpSendEcho2 (in: IcmpHandle=0x76a380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe900a8c0, RequestData=0x1624ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf5c8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf5c8) returned 0x0 [0197.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf5c8 | out: hHeap=0x710000) returned 1 [0197.140] IcmpCloseHandle (IcmpHandle=0x76a380) returned 1 [0197.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78e600 | out: hHeap=0x710000) returned 1 Thread: id = 1247 os_tid = 0xb54 [0152.166] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0152.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0152.169] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0152.169] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0152.169] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xe9f500) returned 0x0 [0152.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0152.169] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xe9f500) returned 0x0 [0152.174] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.176] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.176] WriteFile (in: hFile=0x9e8, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0152.185] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.186] ReadFile (in: hFile=0x9e8, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x408, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0xe9f61c*=0x408, lpOverlapped=0x0) returned 1 [0152.186] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.186] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x5e50000, cbInput=0x408, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xe9f848, pbOutput=0x5e50000, pcbResult=0xe9f618) returned 0x0 [0152.186] WriteFile (in: hFile=0x9e8, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0xe9f61c*=0x410, lpOverlapped=0x0) returned 1 [0152.187] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0152.187] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.187] WriteFile (in: hFile=0x9e8, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.187] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.187] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.187] CloseHandle (hObject=0x9e8) returned 1 [0152.195] VirtualAlloc (lpAddress=0x0, dwSize=0xfb, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0152.196] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\officemuiset.xml.play")) returned 1 [0152.204] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1248 os_tid = 0xb10 [0152.269] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.269] ReadFile (in: hFile=0x9ec, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.271] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.271] ReadFile (in: hFile=0x9ec, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.271] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.272] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.272] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0152.272] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0152.273] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0152.273] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.273] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0152.277] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.278] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x9ec, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0152.278] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.278] ReadFile (in: hFile=0x9ec, lpBuffer=0x2750000, nNumberOfBytesToRead=0x32ac0, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x32ac0, lpOverlapped=0x0) returned 1 [0152.284] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffcd540, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.284] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2750000, cbInput=0x32ac0, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0152.284] WriteFile (in: hFile=0x9ec, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x32ad0, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x32ad0, lpOverlapped=0x0) returned 1 [0152.285] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0152.285] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.285] WriteFile (in: hFile=0x9ec, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.285] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x32ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.285] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.285] CloseHandle (hObject=0x9ec) returned 1 [0152.286] VirtualAlloc (lpAddress=0x0, dwSize=0xf3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\osetupui.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\osetupui.dll.play")) returned 1 [0152.287] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1249 os_tid = 0x810 [0152.281] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.282] ReadFile (in: hFile=0x258, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.291] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.291] ReadFile (in: hFile=0x258, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.291] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.293] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.293] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0152.293] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0152.293] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf0cf500) returned 0x0 [0152.293] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.294] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf0cf500) returned 0x0 [0152.298] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.299] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.299] WriteFile (in: hFile=0x258, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0152.300] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.300] ReadFile (in: hFile=0x258, lpBuffer=0x2850000, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xf0cf61c*=0x3854, lpOverlapped=0x0) returned 1 [0152.300] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffc7ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.301] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2850000, cbInput=0x3854, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xf0cf848, pbOutput=0x2850000, pcbResult=0xf0cf618) returned 0x0 [0152.301] WriteFile (in: hFile=0x258, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xf0cf61c*=0x3860, lpOverlapped=0x0) returned 1 [0152.301] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0152.301] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.301] WriteFile (in: hFile=0x258, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.301] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x3860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.301] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.301] CloseHandle (hObject=0x258) returned 1 [0152.301] VirtualAlloc (lpAddress=0x0, dwSize=0xef, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10o.chm.play")) returned 1 [0152.303] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1250 os_tid = 0xb28 [0152.305] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.305] ReadFile (in: hFile=0xaa4, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.307] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.307] ReadFile (in: hFile=0xaa4, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.308] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.308] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0152.308] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0152.308] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0152.308] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.308] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0152.312] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.314] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.314] WriteFile (in: hFile=0xaa4, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0152.314] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.315] ReadFile (in: hFile=0xaa4, lpBuffer=0x2950000, nNumberOfBytesToRead=0x3906, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xf48f61c*=0x3906, lpOverlapped=0x0) returned 1 [0152.316] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xffffc6fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.316] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2950000, cbInput=0x3906, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xf48f848, pbOutput=0x2950000, pcbResult=0xf48f618) returned 0x0 [0152.316] WriteFile (in: hFile=0xaa4, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xf48f61c*=0x3910, lpOverlapped=0x0) returned 1 [0152.316] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0152.316] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.316] WriteFile (in: hFile=0xaa4, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.316] SetFilePointerEx (in: hFile=0xaa4, liDistanceToMove=0x3910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.316] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.316] CloseHandle (hObject=0xaa4) returned 1 [0152.317] VirtualAlloc (lpAddress=0x0, dwSize=0xef, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10r.chm.play")) returned 1 [0152.320] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1251 os_tid = 0xbb0 [0152.315] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.322] ReadFile (in: hFile=0xa98, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.325] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.325] ReadFile (in: hFile=0xa98, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.325] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.327] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0152.327] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0152.327] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0152.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.327] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0152.333] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.335] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.335] WriteFile (in: hFile=0xa98, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0152.336] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.336] ReadFile (in: hFile=0xa98, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x14366, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xfe4f61c*=0x14366, lpOverlapped=0x0) returned 1 [0152.338] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffebc9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.338] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2a50000, cbInput=0x14366, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xfe4f848, pbOutput=0x2a50000, pcbResult=0xfe4f618) returned 0x0 [0152.338] WriteFile (in: hFile=0xa98, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x14370, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xfe4f61c*=0x14370, lpOverlapped=0x0) returned 1 [0152.338] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0152.339] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.339] WriteFile (in: hFile=0xa98, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.339] SetFilePointerEx (in: hFile=0xa98, liDistanceToMove=0x14370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.339] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.339] CloseHandle (hObject=0xa98) returned 1 [0152.339] VirtualAlloc (lpAddress=0x0, dwSize=0xed, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.chm.play")) returned 1 [0152.342] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1252 os_tid = 0xab8 [0152.337] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.345] ReadFile (in: hFile=0xab8, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.346] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.347] ReadFile (in: hFile=0xab8, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.347] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.348] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.348] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0152.348] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0152.348] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0152.348] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.349] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0152.355] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.356] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.356] WriteFile (in: hFile=0xab8, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0152.357] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.357] ReadFile (in: hFile=0xab8, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x2123, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1034f61c*=0x2123, lpOverlapped=0x0) returned 1 [0152.359] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xffffdedd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.359] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2b50000, cbInput=0x2123, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x1034f848, pbOutput=0x2b50000, pcbResult=0x1034f618) returned 0x0 [0152.359] WriteFile (in: hFile=0xab8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1034f61c*=0x2130, lpOverlapped=0x0) returned 1 [0152.359] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0152.359] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.360] WriteFile (in: hFile=0xab8, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.360] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x2130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.360] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.360] CloseHandle (hObject=0xab8) returned 1 [0152.360] VirtualAlloc (lpAddress=0x0, dwSize=0xed, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.xml.play")) returned 1 [0152.363] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1253 os_tid = 0x3b8 [0152.366] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.367] ReadFile (in: hFile=0x914, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.369] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.371] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.371] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0152.371] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0152.371] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0152.371] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.371] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0152.375] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.377] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.377] WriteFile (in: hFile=0x914, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0152.377] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.377] ReadFile (in: hFile=0x914, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1048f61c*=0x776, lpOverlapped=0x0) returned 1 [0152.377] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffff88a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.378] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2c50000, cbInput=0x776, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x1048f848, pbOutput=0x2c50000, pcbResult=0x1048f618) returned 0x0 [0152.378] WriteFile (in: hFile=0x914, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1048f61c*=0x780, lpOverlapped=0x0) returned 1 [0152.378] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0152.378] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.378] WriteFile (in: hFile=0x914, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.378] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.378] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.378] CloseHandle (hObject=0x914) returned 1 [0152.378] VirtualAlloc (lpAddress=0x0, dwSize=0xfd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.en-us\\Office64MUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.en-us\\office64mui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.en-us\\Office64MUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.en-us\\office64mui.xml.play")) returned 1 [0152.380] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1254 os_tid = 0x8c8 [0152.383] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.384] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.384] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0152.384] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0152.384] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0152.384] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.384] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0152.387] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.389] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.389] WriteFile (in: hFile=0x9bc, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0152.391] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.391] ReadFile (in: hFile=0x9bc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x40c, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1070f61c*=0x40c, lpOverlapped=0x0) returned 1 [0152.391] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xfffffbf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.391] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2d50000, cbInput=0x40c, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x1070f848, pbOutput=0x2d50000, pcbResult=0x1070f618) returned 0x0 [0152.391] WriteFile (in: hFile=0x9bc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1070f61c*=0x410, lpOverlapped=0x0) returned 1 [0152.391] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0152.391] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.391] WriteFile (in: hFile=0x9bc, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.391] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.391] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.391] CloseHandle (hObject=0x9bc) returned 1 [0152.392] VirtualAlloc (lpAddress=0x0, dwSize=0x103, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.en-us\\Office64MUISet.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.en-us\\office64muiset.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.en-us\\Office64MUISet.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.en-us\\office64muiset.xml.play")) returned 1 [0152.393] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1255 os_tid = 0x4ec [0152.397] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.397] ReadFile (in: hFile=0xa9c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.403] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.403] ReadFile (in: hFile=0xa9c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.403] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.404] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.404] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0152.404] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0152.404] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0152.404] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.405] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0152.408] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.410] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.410] WriteFile (in: hFile=0xa9c, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0152.410] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.410] ReadFile (in: hFile=0xa9c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xc32, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1084f61c*=0xc32, lpOverlapped=0x0) returned 1 [0152.410] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xfffff3ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.410] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2e50000, cbInput=0xc32, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x1084f848, pbOutput=0x2e50000, pcbResult=0x1084f618) returned 0x0 [0152.410] WriteFile (in: hFile=0xa9c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1084f61c*=0xc40, lpOverlapped=0x0) returned 1 [0152.411] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0152.411] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.411] WriteFile (in: hFile=0xa9c, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.411] SetFilePointerEx (in: hFile=0xa9c, liDistanceToMove=0xc40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.411] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.411] CloseHandle (hObject=0xa9c) returned 1 [0152.412] VirtualAlloc (lpAddress=0x0, dwSize=0xf1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.en-us\\setup.xml.play")) returned 1 [0152.414] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1256 os_tid = 0x8b8 [0152.416] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.416] ReadFile (in: hFile=0xad0, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.433] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.433] ReadFile (in: hFile=0xad0, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.433] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.434] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.434] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0152.434] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0152.434] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0152.434] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.434] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0152.438] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.440] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.440] WriteFile (in: hFile=0xad0, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0152.440] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.440] ReadFile (in: hFile=0xad0, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x1380, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x10acf61c*=0x1380, lpOverlapped=0x0) returned 1 [0152.440] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0xffffec80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.440] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2f50000, cbInput=0x1380, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x10acf848, pbOutput=0x2f50000, pcbResult=0x10acf618) returned 0x0 [0152.441] WriteFile (in: hFile=0xad0, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x10acf61c*=0x1390, lpOverlapped=0x0) returned 1 [0152.441] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0152.441] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.441] WriteFile (in: hFile=0xad0, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.441] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.441] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.441] CloseHandle (hObject=0xad0) returned 1 [0152.441] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.WW\\Office64WW.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.ww\\office64ww.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office64.WW\\Office64WW.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\office64.ww\\office64ww.xml.play")) returned 1 [0152.443] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1257 os_tid = 0x530 [0152.445] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.445] ReadFile (in: hFile=0xae0, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.512] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0152.512] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0152.512] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0152.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.512] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0152.518] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.520] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.520] WriteFile (in: hFile=0xae0, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0152.520] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.521] ReadFile (in: hFile=0xae0, lpBuffer=0x3050000, nNumberOfBytesToRead=0x719, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x10d4f61c*=0x719, lpOverlapped=0x0) returned 1 [0152.521] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0xfffff8e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.521] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3050000, cbInput=0x719, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x10d4f848, pbOutput=0x3050000, pcbResult=0x10d4f618) returned 0x0 [0152.521] WriteFile (in: hFile=0xae0, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x10d4f61c*=0x720, lpOverlapped=0x0) returned 1 [0152.521] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0152.521] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.521] WriteFile (in: hFile=0xae0, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.521] SetFilePointerEx (in: hFile=0xae0, liDistanceToMove=0x720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.521] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0152.521] CloseHandle (hObject=0xae0) returned 1 [0152.522] VirtualAlloc (lpAddress=0x0, dwSize=0xf9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\onenote.en-us\\onenotemui.xml.play")) returned 1 [0152.524] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1258 os_tid = 0x398 [0152.447] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.447] ReadFile (in: hFile=0x9d4, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.449] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.449] ReadFile (in: hFile=0x9d4, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.449] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.450] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.450] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0152.450] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0152.450] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0152.450] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.451] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0152.454] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.455] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.455] WriteFile (in: hFile=0x9d4, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0152.455] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.455] ReadFile (in: hFile=0x9d4, lpBuffer=0x3150000, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x1124f61c*=0x87f, lpOverlapped=0x0) returned 1 [0152.456] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffff781, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.456] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3150000, cbInput=0x87f, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x1124f848, pbOutput=0x3150000, pcbResult=0x1124f618) returned 0x0 [0152.456] WriteFile (in: hFile=0x9d4, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x1124f61c*=0x880, lpOverlapped=0x0) returned 1 [0152.456] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0152.456] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.456] WriteFile (in: hFile=0x9d4, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.456] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.456] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.456] CloseHandle (hObject=0x9d4) returned 1 [0152.456] VirtualAlloc (lpAddress=0x0, dwSize=0xef, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\onenote.en-us\\setup.xml.play")) returned 1 [0152.458] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1259 os_tid = 0x39c [0152.460] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.460] ReadFile (in: hFile=0xac4, lpBuffer=0x1188fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1188f85c, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesRead=0x1188f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.586] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.586] ReadFile (in: hFile=0xac4, lpBuffer=0x1188fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1188f85c, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesRead=0x1188f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.586] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.587] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.588] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x1188f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0152.588] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x1188f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x1188f828, pbKeyObject=0x0) returned 0x0 [0152.588] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1188f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1188f500) returned 0x0 [0152.588] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.588] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1188f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1188f500) returned 0x0 [0152.593] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.594] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.594] WriteFile (in: hFile=0xac4, lpBuffer=0x1188fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1188f830, lpOverlapped=0x0 | out: lpBuffer=0x1188fb34*, lpNumberOfBytesWritten=0x1188f830*=0x428, lpOverlapped=0x0) returned 1 [0152.800] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.800] ReadFile (in: hFile=0xac4, lpBuffer=0x3350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x1188f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.106] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.106] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3350000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1188f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x1188f618, dwFlags=0x0 | out: hKey=0x1a6d8080, pbIV=0x1188f848, pbOutput=0x3350000, pcbResult=0x1188f618) returned 0x0 [0153.108] WriteFile (in: hFile=0xac4, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1188f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.110] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1188f60c | out: lpNewFilePointer=0x0) returned 1 [0153.110] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.110] WriteFile (in: hFile=0xac4, lpBuffer=0x1188f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x1188f83c*, lpNumberOfBytesWritten=0x1188f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.110] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.111] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xffeffbd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.111] ReadFile (in: hFile=0xac4, lpBuffer=0x3350000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x1188f61c*=0xffff0, lpOverlapped=0x0) returned 1 [0153.159] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.159] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3350000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1188f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x1188f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1188f848, pbOutput=0x3350000, pcbResult=0x1188f618) returned 0x0 [0153.161] WriteFile (in: hFile=0xac4, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1188f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.167] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1188f60c | out: lpNewFilePointer=0x0) returned 1 [0153.167] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.167] WriteFile (in: hFile=0xac4, lpBuffer=0x1188f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1188f61c, lpOverlapped=0x0 | out: lpBuffer=0x1188f83c*, lpNumberOfBytesWritten=0x1188f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.167] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x960ab8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.168] WriteFile (in: hFile=0xac4, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1188f82c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1188f82c*=0x8, lpOverlapped=0x0) returned 1 [0153.168] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.168] CloseHandle (hObject=0xac4) returned 1 [0153.168] VirtualAlloc (lpAddress=0x0, dwSize=0xd5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.170] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osetup.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSETUP.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osetup.dll.play")) returned 1 [0153.171] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1260 os_tid = 0xcfc [0152.461] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.462] ReadFile (in: hFile=0x558, lpBuffer=0x119cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x119cf85c, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesRead=0x119cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.642] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.643] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.643] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x119cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0152.643] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x119cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x119cf828, pbKeyObject=0x0) returned 0x0 [0152.643] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x119cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x119cf500) returned 0x0 [0152.643] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.644] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x119cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x119cf500) returned 0x0 [0152.647] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.648] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.648] WriteFile (in: hFile=0x558, lpBuffer=0x119cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x119cf830, lpOverlapped=0x0 | out: lpBuffer=0x119cfb34*, lpNumberOfBytesWritten=0x119cf830*=0x428, lpOverlapped=0x0) returned 1 [0152.774] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.774] ReadFile (in: hFile=0x558, lpBuffer=0x3750000, nNumberOfBytesToRead=0x463, lpNumberOfBytesRead=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x119cf61c*=0x463, lpOverlapped=0x0) returned 1 [0152.774] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffffb9d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.774] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3750000, cbInput=0x463, pPaddingInfo=0x0, pbIV=0x119cf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x119cf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x119cf848, pbOutput=0x3750000, pcbResult=0x119cf618) returned 0x0 [0152.774] WriteFile (in: hFile=0x558, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x119cf61c*=0x470, lpOverlapped=0x0) returned 1 [0152.775] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x119cf60c | out: lpNewFilePointer=0x0) returned 1 [0152.775] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.775] WriteFile (in: hFile=0x558, lpBuffer=0x119cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x119cf61c, lpOverlapped=0x0 | out: lpBuffer=0x119cf83c*, lpNumberOfBytesWritten=0x119cf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.775] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.775] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0152.775] CloseHandle (hObject=0x558) returned 1 [0152.775] VirtualAlloc (lpAddress=0x0, dwSize=0xe9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.776] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSM.en-us\\OSMMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osm.en-us\\osmmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSM.en-us\\OSMMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osm.en-us\\osmmui.xml.play")) returned 1 [0152.776] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1261 os_tid = 0xd00 [0152.463] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.463] ReadFile (in: hFile=0x948, lpBuffer=0x11b0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11b0f85c, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesRead=0x11b0f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.578] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.579] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.579] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x11b0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0152.579] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x11b0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x11b0f828, pbKeyObject=0x0) returned 0x0 [0152.579] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x11b0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x11b0f500) returned 0x0 [0152.580] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.580] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x11b0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x11b0f500) returned 0x0 [0152.584] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.586] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.586] WriteFile (in: hFile=0x948, lpBuffer=0x11b0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11b0f830, lpOverlapped=0x0 | out: lpBuffer=0x11b0fb34*, lpNumberOfBytesWritten=0x11b0f830*=0x428, lpOverlapped=0x0) returned 1 [0152.823] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.823] ReadFile (in: hFile=0x948, lpBuffer=0x3950000, nNumberOfBytesToRead=0x7f6, lpNumberOfBytesRead=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x11b0f61c*=0x7f6, lpOverlapped=0x0) returned 1 [0152.823] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffff80a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.823] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3950000, cbInput=0x7f6, pPaddingInfo=0x0, pbIV=0x11b0f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x11b0f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x11b0f848, pbOutput=0x3950000, pcbResult=0x11b0f618) returned 0x0 [0152.823] WriteFile (in: hFile=0x948, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x11b0f61c*=0x800, lpOverlapped=0x0) returned 1 [0152.823] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11b0f60c | out: lpNewFilePointer=0x0) returned 1 [0152.823] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.823] WriteFile (in: hFile=0x948, lpBuffer=0x11b0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11b0f61c, lpOverlapped=0x0 | out: lpBuffer=0x11b0f83c*, lpNumberOfBytesWritten=0x11b0f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.823] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.823] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.823] CloseHandle (hObject=0x948) returned 1 [0152.824] VirtualAlloc (lpAddress=0x0, dwSize=0xe7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSM.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osm.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSM.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osm.en-us\\setup.xml.play")) returned 1 [0152.826] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1262 os_tid = 0xd04 [0152.464] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.464] ReadFile (in: hFile=0x418, lpBuffer=0x1264fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1264f85c, lpOverlapped=0x0 | out: lpBuffer=0x1264fb34*, lpNumberOfBytesRead=0x1264f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.569] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.570] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.571] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1264f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0152.571] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1264f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1264f828, pbKeyObject=0x0) returned 0x0 [0152.571] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1264f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1264f500) returned 0x0 [0152.571] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.571] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1264f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1264f500) returned 0x0 [0152.576] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.578] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.578] WriteFile (in: hFile=0x418, lpBuffer=0x1264fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1264f830, lpOverlapped=0x0 | out: lpBuffer=0x1264fb34*, lpNumberOfBytesWritten=0x1264f830*=0x428, lpOverlapped=0x0) returned 1 [0152.828] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.828] ReadFile (in: hFile=0x418, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x1264f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1264f61c*=0x5b2, lpOverlapped=0x0) returned 1 [0152.828] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffa4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.828] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3a50000, cbInput=0x5b2, pPaddingInfo=0x0, pbIV=0x1264f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1264f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x1264f848, pbOutput=0x3a50000, pcbResult=0x1264f618) returned 0x0 [0152.828] WriteFile (in: hFile=0x418, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1264f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1264f61c*=0x5c0, lpOverlapped=0x0) returned 1 [0152.829] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1264f60c | out: lpNewFilePointer=0x0) returned 1 [0152.829] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.829] WriteFile (in: hFile=0x418, lpBuffer=0x1264f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1264f61c, lpOverlapped=0x0 | out: lpBuffer=0x1264f83c*, lpNumberOfBytesWritten=0x1264f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.829] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.829] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0152.829] CloseHandle (hObject=0x418) returned 1 [0152.829] VirtualAlloc (lpAddress=0x0, dwSize=0xf1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSMUX.en-us\\OSMUXMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osmux.en-us\\osmuxmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSMUX.en-us\\OSMUXMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osmux.en-us\\osmuxmui.xml.play")) returned 1 [0152.831] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1263 os_tid = 0xd08 [0152.466] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.466] ReadFile (in: hFile=0x748, lpBuffer=0x1278fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1278f85c, lpOverlapped=0x0 | out: lpBuffer=0x1278fb34*, lpNumberOfBytesRead=0x1278f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.635] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.635] ReadFile (in: hFile=0x748, lpBuffer=0x1278fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1278f85c, lpOverlapped=0x0 | out: lpBuffer=0x1278fb34*, lpNumberOfBytesRead=0x1278f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.636] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.636] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.636] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x1278f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0152.636] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x1278f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x1278f828, pbKeyObject=0x0) returned 0x0 [0152.637] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1278f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1278f500) returned 0x0 [0152.637] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.637] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1278f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1278f500) returned 0x0 [0152.640] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.642] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.642] WriteFile (in: hFile=0x748, lpBuffer=0x1278fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1278f830, lpOverlapped=0x0 | out: lpBuffer=0x1278fb34*, lpNumberOfBytesWritten=0x1278f830*=0x428, lpOverlapped=0x0) returned 1 [0152.778] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.778] ReadFile (in: hFile=0x748, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x1278f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x1278f61c*=0x996, lpOverlapped=0x0) returned 1 [0152.778] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffff66a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.778] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3c50000, cbInput=0x996, pPaddingInfo=0x0, pbIV=0x1278f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x1278f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x1278f848, pbOutput=0x3c50000, pcbResult=0x1278f618) returned 0x0 [0152.778] WriteFile (in: hFile=0x748, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x1278f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x1278f61c*=0x9a0, lpOverlapped=0x0) returned 1 [0152.779] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1278f60c | out: lpNewFilePointer=0x0) returned 1 [0152.779] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.780] WriteFile (in: hFile=0x748, lpBuffer=0x1278f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1278f61c, lpOverlapped=0x0 | out: lpBuffer=0x1278f83c*, lpNumberOfBytesWritten=0x1278f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.780] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x9a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.780] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0152.780] CloseHandle (hObject=0x748) returned 1 [0152.780] VirtualAlloc (lpAddress=0x0, dwSize=0xeb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSMUX.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osmux.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\OSMUX.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\osmux.en-us\\setup.xml.play")) returned 1 [0152.784] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1264 os_tid = 0xd0c [0152.467] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.467] ReadFile (in: hFile=0x958, lpBuffer=0x128cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x128cf85c, lpOverlapped=0x0 | out: lpBuffer=0x128cfb34*, lpNumberOfBytesRead=0x128cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.625] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.625] ReadFile (in: hFile=0x958, lpBuffer=0x128cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x128cf85c, lpOverlapped=0x0 | out: lpBuffer=0x128cfb34*, lpNumberOfBytesRead=0x128cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.625] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.626] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.626] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x128cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0152.626] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x128cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x128cf828, pbKeyObject=0x0) returned 0x0 [0152.626] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x128cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x128cf500) returned 0x0 [0152.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.627] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x128cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x128cf500) returned 0x0 [0152.634] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.635] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.635] WriteFile (in: hFile=0x958, lpBuffer=0x128cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x128cf830, lpOverlapped=0x0 | out: lpBuffer=0x128cfb34*, lpNumberOfBytesWritten=0x128cf830*=0x428, lpOverlapped=0x0) returned 1 [0152.786] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.786] ReadFile (in: hFile=0x958, lpBuffer=0x3e50000, nNumberOfBytesToRead=0xb15, lpNumberOfBytesRead=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x128cf61c*=0xb15, lpOverlapped=0x0) returned 1 [0152.786] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffff4eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.786] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x3e50000, cbInput=0xb15, pPaddingInfo=0x0, pbIV=0x128cf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x128cf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x128cf848, pbOutput=0x3e50000, pcbResult=0x128cf618) returned 0x0 [0152.786] WriteFile (in: hFile=0x958, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x128cf61c*=0xb20, lpOverlapped=0x0) returned 1 [0152.787] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x128cf60c | out: lpNewFilePointer=0x0) returned 1 [0152.787] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.787] WriteFile (in: hFile=0x958, lpBuffer=0x128cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x128cf61c, lpOverlapped=0x0 | out: lpBuffer=0x128cf83c*, lpNumberOfBytesWritten=0x128cf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.787] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.787] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0152.787] CloseHandle (hObject=0x958) returned 1 [0152.787] VirtualAlloc (lpAddress=0x0, dwSize=0xf9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\outlook.en-us\\outlookmui.xml.play")) returned 1 [0152.789] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1265 os_tid = 0xd10 [0152.469] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.469] ReadFile (in: hFile=0x814, lpBuffer=0x12a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x12a0fb34*, lpNumberOfBytesRead=0x12a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.616] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.616] ReadFile (in: hFile=0x814, lpBuffer=0x12a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x12a0fb34*, lpNumberOfBytesRead=0x12a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.616] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.617] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.617] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x12a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0152.617] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x12a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x12a0f828, pbKeyObject=0x0) returned 0x0 [0152.617] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12a0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12a0f500) returned 0x0 [0152.617] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.618] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12a0f500) returned 0x0 [0152.623] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.624] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.624] WriteFile (in: hFile=0x814, lpBuffer=0x12a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12a0f830, lpOverlapped=0x0 | out: lpBuffer=0x12a0fb34*, lpNumberOfBytesWritten=0x12a0f830*=0x428, lpOverlapped=0x0) returned 1 [0152.791] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.791] ReadFile (in: hFile=0x814, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xf1e, lpNumberOfBytesRead=0x12a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x12a0f61c*=0xf1e, lpOverlapped=0x0) returned 1 [0152.791] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffff0e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.791] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3f50000, cbInput=0xf1e, pPaddingInfo=0x0, pbIV=0x12a0f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x12a0f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x12a0f848, pbOutput=0x3f50000, pcbResult=0x12a0f618) returned 0x0 [0152.791] WriteFile (in: hFile=0x814, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x12a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x12a0f61c*=0xf20, lpOverlapped=0x0) returned 1 [0152.791] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12a0f60c | out: lpNewFilePointer=0x0) returned 1 [0152.791] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.791] WriteFile (in: hFile=0x814, lpBuffer=0x12a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x12a0f83c*, lpNumberOfBytesWritten=0x12a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.791] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xf20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.791] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0152.791] CloseHandle (hObject=0x814) returned 1 [0152.792] VirtualAlloc (lpAddress=0x0, dwSize=0xef, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\outlook.en-us\\setup.xml.play")) returned 1 [0152.793] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1266 os_tid = 0xd14 [0152.470] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.470] ReadFile (in: hFile=0xa00, lpBuffer=0x12b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x12b4fb34*, lpNumberOfBytesRead=0x12b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.700] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.700] ReadFile (in: hFile=0xa00, lpBuffer=0x12b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x12b4fb34*, lpNumberOfBytesRead=0x12b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.700] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.701] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.701] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x12b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0152.701] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x12b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x12b4f828, pbKeyObject=0x0) returned 0x0 [0152.701] BCryptExportKey (in: hKey=0x77ef00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12b4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12b4f500) returned 0x0 [0152.701] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.701] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12b4f500) returned 0x0 [0152.705] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.706] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.706] WriteFile (in: hFile=0xa00, lpBuffer=0x12b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12b4f830, lpOverlapped=0x0 | out: lpBuffer=0x12b4fb34*, lpNumberOfBytesWritten=0x12b4f830*=0x428, lpOverlapped=0x0) returned 1 [0152.744] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.744] ReadFile (in: hFile=0xa00, lpBuffer=0x4050000, nNumberOfBytesToRead=0x902bb, lpNumberOfBytesRead=0x12b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x12b4f61c*=0x902bb, lpOverlapped=0x0) returned 1 [0153.062] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfff6fd45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.062] BCryptEncrypt (in: hKey=0x77ef00, pbInput=0x4050000, cbInput=0x902bb, pPaddingInfo=0x0, pbIV=0x12b4f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x12b4f618, dwFlags=0x1 | out: hKey=0x77ef00, pbIV=0x12b4f848, pbOutput=0x4050000, pcbResult=0x12b4f618) returned 0x0 [0153.063] WriteFile (in: hFile=0xa00, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x12b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x12b4f61c*=0x902c0, lpOverlapped=0x0) returned 1 [0153.065] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12b4f60c | out: lpNewFilePointer=0x0) returned 1 [0153.065] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.065] WriteFile (in: hFile=0xa00, lpBuffer=0x12b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x12b4f83c*, lpNumberOfBytesWritten=0x12b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.065] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x902c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.065] BCryptDestroyKey (in: hKey=0x77ef00 | out: hKey=0x77ef00) returned 0x0 [0153.065] CloseHandle (hObject=0xa00) returned 1 [0153.065] VirtualAlloc (lpAddress=0x0, dwSize=0xf1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.play")) returned 1 [0153.067] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1267 os_tid = 0xd28 [0152.472] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.472] ReadFile (in: hFile=0x734, lpBuffer=0x12c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x12c8fb34*, lpNumberOfBytesRead=0x12c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.473] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.474] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x12c8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0152.474] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x12c8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x12c8f828, pbKeyObject=0x0) returned 0x0 [0152.474] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12c8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12c8f500) returned 0x0 [0152.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.474] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12c8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12c8f500) returned 0x0 [0152.478] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.480] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.480] WriteFile (in: hFile=0x734, lpBuffer=0x12c8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12c8f830, lpOverlapped=0x0 | out: lpBuffer=0x12c8fb34*, lpNumberOfBytesWritten=0x12c8f830*=0x428, lpOverlapped=0x0) returned 1 [0152.481] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.481] ReadFile (in: hFile=0x734, lpBuffer=0x4150000, nNumberOfBytesToRead=0x67d, lpNumberOfBytesRead=0x12c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x12c8f61c*=0x67d, lpOverlapped=0x0) returned 1 [0152.481] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffff983, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.481] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x4150000, cbInput=0x67d, pPaddingInfo=0x0, pbIV=0x12c8f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x12c8f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x12c8f848, pbOutput=0x4150000, pcbResult=0x12c8f618) returned 0x0 [0152.481] WriteFile (in: hFile=0x734, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x12c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x12c8f61c*=0x680, lpOverlapped=0x0) returned 1 [0152.482] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12c8f60c | out: lpNewFilePointer=0x0) returned 1 [0152.482] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.482] WriteFile (in: hFile=0x734, lpBuffer=0x12c8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x12c8f83c*, lpNumberOfBytesWritten=0x12c8f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.482] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.483] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0152.483] CloseHandle (hObject=0x734) returned 1 [0152.483] VirtualAlloc (lpAddress=0x0, dwSize=0x105, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.play")) returned 1 [0152.486] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1268 os_tid = 0xd2c [0152.490] SetFilePointerEx (in: hFile=0x73c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.490] ReadFile (in: hFile=0x73c, lpBuffer=0x12dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x12dcfb34*, lpNumberOfBytesRead=0x12dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.691] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.692] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.692] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x12dcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0152.692] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x12dcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x12dcf828, pbKeyObject=0x0) returned 0x0 [0152.692] BCryptExportKey (in: hKey=0x77ec80, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12dcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12dcf500) returned 0x0 [0152.693] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.693] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12dcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12dcf500) returned 0x0 [0152.697] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.698] SetFilePointerEx (in: hFile=0x73c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.699] WriteFile (in: hFile=0x73c, lpBuffer=0x12dcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12dcf830, lpOverlapped=0x0 | out: lpBuffer=0x12dcfb34*, lpNumberOfBytesWritten=0x12dcf830*=0x428, lpOverlapped=0x0) returned 1 [0152.747] SetFilePointerEx (in: hFile=0x73c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.747] ReadFile (in: hFile=0x73c, lpBuffer=0x4250000, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x12dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x12dcf61c*=0x818, lpOverlapped=0x0) returned 1 [0152.747] SetFilePointerEx (in: hFile=0x73c, liDistanceToMove=0xfffff7e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.747] BCryptEncrypt (in: hKey=0x77ec80, pbInput=0x4250000, cbInput=0x818, pPaddingInfo=0x0, pbIV=0x12dcf848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x12dcf618, dwFlags=0x1 | out: hKey=0x77ec80, pbIV=0x12dcf848, pbOutput=0x4250000, pcbResult=0x12dcf618) returned 0x0 [0152.747] WriteFile (in: hFile=0x73c, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x12dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x12dcf61c*=0x820, lpOverlapped=0x0) returned 1 [0152.748] SetFilePointerEx (in: hFile=0x73c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12dcf60c | out: lpNewFilePointer=0x0) returned 1 [0152.748] SetFilePointerEx (in: hFile=0x73c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.748] WriteFile (in: hFile=0x73c, lpBuffer=0x12dcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x12dcf83c*, lpNumberOfBytesWritten=0x12dcf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.748] SetFilePointerEx (in: hFile=0x73c, liDistanceToMove=0x820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.748] BCryptDestroyKey (in: hKey=0x77ec80 | out: hKey=0x77ec80) returned 0x0 [0152.748] CloseHandle (hObject=0x73c) returned 1 [0152.748] VirtualAlloc (lpAddress=0x0, dwSize=0xf5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.749] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\powerpoint.en-us\\setup.xml.play")) returned 1 [0152.750] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1269 os_tid = 0xd30 [0152.491] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.492] ReadFile (in: hFile=0x840, lpBuffer=0x12f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x12f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x12f0fb34*, lpNumberOfBytesRead=0x12f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.685] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.686] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x12f0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0152.686] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x12f0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x12f0f828, pbKeyObject=0x0) returned 0x0 [0152.686] BCryptExportKey (in: hKey=0x77e9f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x12f0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x12f0f500) returned 0x0 [0152.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.687] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x12f0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x12f0f500) returned 0x0 [0152.690] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.691] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.691] WriteFile (in: hFile=0x840, lpBuffer=0x12f0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x12f0f830, lpOverlapped=0x0 | out: lpBuffer=0x12f0fb34*, lpNumberOfBytesWritten=0x12f0f830*=0x428, lpOverlapped=0x0) returned 1 [0152.752] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.752] ReadFile (in: hFile=0x840, lpBuffer=0x4350000, nNumberOfBytesToRead=0x613, lpNumberOfBytesRead=0x12f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x12f0f61c*=0x613, lpOverlapped=0x0) returned 1 [0152.752] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffff9ed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.752] BCryptEncrypt (in: hKey=0x77e9f0, pbInput=0x4350000, cbInput=0x613, pPaddingInfo=0x0, pbIV=0x12f0f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x12f0f618, dwFlags=0x1 | out: hKey=0x77e9f0, pbIV=0x12f0f848, pbOutput=0x4350000, pcbResult=0x12f0f618) returned 0x0 [0152.752] WriteFile (in: hFile=0x840, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x12f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x12f0f61c*=0x620, lpOverlapped=0x0) returned 1 [0152.752] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12f0f60c | out: lpNewFilePointer=0x0) returned 1 [0152.752] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.753] WriteFile (in: hFile=0x840, lpBuffer=0x12f0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x12f0f83c*, lpNumberOfBytesWritten=0x12f0f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.753] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.753] BCryptDestroyKey (in: hKey=0x77e9f0 | out: hKey=0x77e9f0) returned 0x0 [0152.753] CloseHandle (hObject=0x840) returned 1 [0152.753] VirtualAlloc (lpAddress=0x0, dwSize=0xe5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proof.en\\Proof.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.en\\proof.xml.play")) returned 1 [0152.754] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1270 os_tid = 0xd34 [0152.493] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.493] ReadFile (in: hFile=0x848, lpBuffer=0x1304fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1304f85c, lpOverlapped=0x0 | out: lpBuffer=0x1304fb34*, lpNumberOfBytesRead=0x1304f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.596] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.597] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.597] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x1304f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0152.597] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x1304f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x1304f828, pbKeyObject=0x0) returned 0x0 [0152.597] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1304f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1304f500) returned 0x0 [0152.597] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.597] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1304f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1304f500) returned 0x0 [0152.602] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.615] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.616] WriteFile (in: hFile=0x848, lpBuffer=0x1304fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1304f830, lpOverlapped=0x0 | out: lpBuffer=0x1304fb34*, lpNumberOfBytesWritten=0x1304f830*=0x428, lpOverlapped=0x0) returned 1 [0152.795] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.795] ReadFile (in: hFile=0x848, lpBuffer=0x4450000, nNumberOfBytesToRead=0x681, lpNumberOfBytesRead=0x1304f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x1304f61c*=0x681, lpOverlapped=0x0) returned 1 [0152.795] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0xfffff97f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.795] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x4450000, cbInput=0x681, pPaddingInfo=0x0, pbIV=0x1304f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x1304f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x1304f848, pbOutput=0x4450000, pcbResult=0x1304f618) returned 0x0 [0152.795] WriteFile (in: hFile=0x848, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x1304f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x1304f61c*=0x690, lpOverlapped=0x0) returned 1 [0152.795] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1304f60c | out: lpNewFilePointer=0x0) returned 1 [0152.795] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.795] WriteFile (in: hFile=0x848, lpBuffer=0x1304f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1304f61c, lpOverlapped=0x0 | out: lpBuffer=0x1304f83c*, lpNumberOfBytesWritten=0x1304f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.796] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0x690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.796] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0152.796] CloseHandle (hObject=0x848) returned 1 [0152.796] VirtualAlloc (lpAddress=0x0, dwSize=0xe5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proof.es\\Proof.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.es\\proof.xml.play")) returned 1 [0152.797] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1271 os_tid = 0xd38 [0152.494] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.494] ReadFile (in: hFile=0x850, lpBuffer=0x1318fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1318f85c, lpOverlapped=0x0 | out: lpBuffer=0x1318fb34*, lpNumberOfBytesRead=0x1318f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.679] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.679] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.680] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x1318f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0152.680] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x1318f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x1318f828, pbKeyObject=0x0) returned 0x0 [0152.680] BCryptExportKey (in: hKey=0x77f190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1318f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1318f500) returned 0x0 [0152.680] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.680] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1318f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1318f500) returned 0x0 [0152.683] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.685] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.685] WriteFile (in: hFile=0x850, lpBuffer=0x1318fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1318f830, lpOverlapped=0x0 | out: lpBuffer=0x1318fb34*, lpNumberOfBytesWritten=0x1318f830*=0x428, lpOverlapped=0x0) returned 1 [0152.756] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.756] ReadFile (in: hFile=0x850, lpBuffer=0x4550000, nNumberOfBytesToRead=0x681, lpNumberOfBytesRead=0x1318f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x1318f61c*=0x681, lpOverlapped=0x0) returned 1 [0152.756] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0xfffff97f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.756] BCryptEncrypt (in: hKey=0x77f190, pbInput=0x4550000, cbInput=0x681, pPaddingInfo=0x0, pbIV=0x1318f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x1318f618, dwFlags=0x1 | out: hKey=0x77f190, pbIV=0x1318f848, pbOutput=0x4550000, pcbResult=0x1318f618) returned 0x0 [0152.756] WriteFile (in: hFile=0x850, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x1318f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x1318f61c*=0x690, lpOverlapped=0x0) returned 1 [0152.756] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1318f60c | out: lpNewFilePointer=0x0) returned 1 [0152.757] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.757] WriteFile (in: hFile=0x850, lpBuffer=0x1318f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1318f61c, lpOverlapped=0x0 | out: lpBuffer=0x1318f83c*, lpNumberOfBytesWritten=0x1318f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.757] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.757] BCryptDestroyKey (in: hKey=0x77f190 | out: hKey=0x77f190) returned 0x0 [0152.757] CloseHandle (hObject=0x850) returned 1 [0152.757] VirtualAlloc (lpAddress=0x0, dwSize=0xe5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.758] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proof.fr\\Proof.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proof.fr\\proof.xml.play")) returned 1 [0152.758] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1272 os_tid = 0xd3c [0152.495] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.496] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.496] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x132cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0152.496] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x132cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x132cf828, pbKeyObject=0x0) returned 0x0 [0152.497] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x132cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x132cf500) returned 0x0 [0152.497] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.497] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x132cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x132cf500) returned 0x0 [0152.502] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.503] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.503] WriteFile (in: hFile=0x858, lpBuffer=0x132cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x132cf830, lpOverlapped=0x0 | out: lpBuffer=0x132cfb34*, lpNumberOfBytesWritten=0x132cf830*=0x428, lpOverlapped=0x0) returned 1 [0152.678] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.678] ReadFile (in: hFile=0x858, lpBuffer=0x4650000, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x132cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x132cf61c*=0x400, lpOverlapped=0x0) returned 1 [0152.678] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xfffffc00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.678] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4650000, cbInput=0x400, pPaddingInfo=0x0, pbIV=0x132cf848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x132cf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x132cf848, pbOutput=0x4650000, pcbResult=0x132cf618) returned 0x0 [0152.678] WriteFile (in: hFile=0x858, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x132cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x132cf61c*=0x410, lpOverlapped=0x0) returned 1 [0152.761] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x132cf60c | out: lpNewFilePointer=0x0) returned 1 [0152.761] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.761] WriteFile (in: hFile=0x858, lpBuffer=0x132cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x132cf61c, lpOverlapped=0x0 | out: lpBuffer=0x132cf83c*, lpNumberOfBytesWritten=0x132cf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.761] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.761] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0152.761] CloseHandle (hObject=0x858) returned 1 [0152.761] VirtualAlloc (lpAddress=0x0, dwSize=0xf7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proofing.en-us\\proofing.xml.play")) returned 1 [0152.762] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1273 os_tid = 0xd40 [0152.504] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.505] ReadFile (in: hFile=0x860, lpBuffer=0x1340fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1340f85c, lpOverlapped=0x0 | out: lpBuffer=0x1340fb34*, lpNumberOfBytesRead=0x1340f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.677] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.677] ReadFile (in: hFile=0x860, lpBuffer=0x1340fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1340f85c, lpOverlapped=0x0 | out: lpBuffer=0x1340fb34*, lpNumberOfBytesRead=0x1340f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.804] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.805] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.805] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x1340f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0152.806] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x1340f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x1340f828, pbKeyObject=0x0) returned 0x0 [0152.806] BCryptExportKey (in: hKey=0x77f190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1340f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1340f500) returned 0x0 [0152.806] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.806] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1340f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1340f500) returned 0x0 [0152.809] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.810] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.810] WriteFile (in: hFile=0x860, lpBuffer=0x1340fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1340f830, lpOverlapped=0x0 | out: lpBuffer=0x1340fb34*, lpNumberOfBytesWritten=0x1340f830*=0x428, lpOverlapped=0x0) returned 1 [0152.811] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.811] ReadFile (in: hFile=0x860, lpBuffer=0x4750000, nNumberOfBytesToRead=0x17b3, lpNumberOfBytesRead=0x1340f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x1340f61c*=0x17b3, lpOverlapped=0x0) returned 1 [0152.811] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xffffe84d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.811] BCryptEncrypt (in: hKey=0x77f190, pbInput=0x4750000, cbInput=0x17b3, pPaddingInfo=0x0, pbIV=0x1340f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x1340f618, dwFlags=0x1 | out: hKey=0x77f190, pbIV=0x1340f848, pbOutput=0x4750000, pcbResult=0x1340f618) returned 0x0 [0152.811] WriteFile (in: hFile=0x860, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x1340f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x1340f61c*=0x17c0, lpOverlapped=0x0) returned 1 [0152.811] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1340f60c | out: lpNewFilePointer=0x0) returned 1 [0152.811] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.811] WriteFile (in: hFile=0x860, lpBuffer=0x1340f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1340f61c, lpOverlapped=0x0 | out: lpBuffer=0x1340f83c*, lpNumberOfBytesWritten=0x1340f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.811] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x17c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.811] BCryptDestroyKey (in: hKey=0x77f190 | out: hKey=0x77f190) returned 0x0 [0152.811] CloseHandle (hObject=0x860) returned 1 [0152.812] VirtualAlloc (lpAddress=0x0, dwSize=0xf1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proofing.en-us\\setup.xml.play")) returned 1 [0152.813] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1274 os_tid = 0xd44 [0152.506] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.506] ReadFile (in: hFile=0x868, lpBuffer=0x1354fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1354f85c, lpOverlapped=0x0 | out: lpBuffer=0x1354fb34*, lpNumberOfBytesRead=0x1354f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.667] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.667] ReadFile (in: hFile=0x868, lpBuffer=0x1354fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1354f85c, lpOverlapped=0x0 | out: lpBuffer=0x1354fb34*, lpNumberOfBytesRead=0x1354f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.667] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.668] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.668] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x1354f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0152.668] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x1354f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x1354f828, pbKeyObject=0x0) returned 0x0 [0152.668] BCryptExportKey (in: hKey=0x77e770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1354f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1354f500) returned 0x0 [0152.668] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.668] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1354f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1354f500) returned 0x0 [0152.675] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.677] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.677] WriteFile (in: hFile=0x868, lpBuffer=0x1354fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1354f830, lpOverlapped=0x0 | out: lpBuffer=0x1354fb34*, lpNumberOfBytesWritten=0x1354f830*=0x428, lpOverlapped=0x0) returned 1 [0152.765] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.765] ReadFile (in: hFile=0x868, lpBuffer=0x4850000, nNumberOfBytesToRead=0x42d4, lpNumberOfBytesRead=0x1354f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x1354f61c*=0x42d4, lpOverlapped=0x0) returned 1 [0153.035] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xffffbd2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.035] BCryptEncrypt (in: hKey=0x77e770, pbInput=0x4850000, cbInput=0x42d4, pPaddingInfo=0x0, pbIV=0x1354f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x1354f618, dwFlags=0x1 | out: hKey=0x77e770, pbIV=0x1354f848, pbOutput=0x4850000, pcbResult=0x1354f618) returned 0x0 [0153.036] WriteFile (in: hFile=0x868, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x1354f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x1354f61c*=0x42e0, lpOverlapped=0x0) returned 1 [0153.036] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1354f60c | out: lpNewFilePointer=0x0) returned 1 [0153.036] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.036] WriteFile (in: hFile=0x868, lpBuffer=0x1354f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1354f61c, lpOverlapped=0x0 | out: lpBuffer=0x1354f83c*, lpNumberOfBytesWritten=0x1354f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.036] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x42e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.036] BCryptDestroyKey (in: hKey=0x77e770 | out: hKey=0x77e770) returned 0x0 [0153.036] CloseHandle (hObject=0x868) returned 1 [0153.036] VirtualAlloc (lpAddress=0x0, dwSize=0xeb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PROPLUS\\ProPlusWW.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proplus\\proplusww.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PROPLUS\\ProPlusWW.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proplus\\proplusww.xml.play")) returned 1 [0153.038] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1275 os_tid = 0xd48 [0152.507] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.507] ReadFile (in: hFile=0x870, lpBuffer=0x1368fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1368f85c, lpOverlapped=0x0 | out: lpBuffer=0x1368fb34*, lpNumberOfBytesRead=0x1368f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.661] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.661] ReadFile (in: hFile=0x870, lpBuffer=0x1368fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1368f85c, lpOverlapped=0x0 | out: lpBuffer=0x1368fb34*, lpNumberOfBytesRead=0x1368f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.661] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.661] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.662] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x1368f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0152.662] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x1368f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x1368f828, pbKeyObject=0x0) returned 0x0 [0152.662] BCryptExportKey (in: hKey=0x77dfd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1368f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1368f500) returned 0x0 [0152.662] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.663] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1368f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1368f500) returned 0x0 [0152.666] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.667] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.667] WriteFile (in: hFile=0x870, lpBuffer=0x1368fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1368f830, lpOverlapped=0x0 | out: lpBuffer=0x1368fb34*, lpNumberOfBytesWritten=0x1368f830*=0x428, lpOverlapped=0x0) returned 1 [0152.765] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.765] ReadFile (in: hFile=0x870, lpBuffer=0x4950000, nNumberOfBytesToRead=0x6c86, lpNumberOfBytesRead=0x1368f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x1368f61c*=0x6c86, lpOverlapped=0x0) returned 1 [0153.030] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xffff937a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.030] BCryptEncrypt (in: hKey=0x77dfd0, pbInput=0x4950000, cbInput=0x6c86, pPaddingInfo=0x0, pbIV=0x1368f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x1368f618, dwFlags=0x1 | out: hKey=0x77dfd0, pbIV=0x1368f848, pbOutput=0x4950000, pcbResult=0x1368f618) returned 0x0 [0153.030] WriteFile (in: hFile=0x870, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x1368f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x1368f61c*=0x6c90, lpOverlapped=0x0) returned 1 [0153.030] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1368f60c | out: lpNewFilePointer=0x0) returned 1 [0153.030] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.030] WriteFile (in: hFile=0x870, lpBuffer=0x1368f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1368f61c, lpOverlapped=0x0 | out: lpBuffer=0x1368f83c*, lpNumberOfBytesWritten=0x1368f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.030] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0x6c90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.030] BCryptDestroyKey (in: hKey=0x77dfd0 | out: hKey=0x77dfd0) returned 0x0 [0153.030] CloseHandle (hObject=0x870) returned 1 [0153.031] VirtualAlloc (lpAddress=0x0, dwSize=0xe3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PROPLUS\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proplus\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\PROPLUS\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\proplus\\setup.xml.play")) returned 1 [0153.033] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1276 os_tid = 0xd4c [0152.509] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.509] ReadFile (in: hFile=0x878, lpBuffer=0x137cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x137cf85c, lpOverlapped=0x0 | out: lpBuffer=0x137cfb34*, lpNumberOfBytesRead=0x137cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.655] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.656] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.656] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x137cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0152.656] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x137cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x137cf828, pbKeyObject=0x0) returned 0x0 [0152.656] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x137cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x137cf500) returned 0x0 [0152.656] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.656] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x137cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x137cf500) returned 0x0 [0152.659] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.660] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.660] WriteFile (in: hFile=0x878, lpBuffer=0x137cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x137cf830, lpOverlapped=0x0 | out: lpBuffer=0x137cfb34*, lpNumberOfBytesWritten=0x137cf830*=0x428, lpOverlapped=0x0) returned 1 [0152.766] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.766] ReadFile (in: hFile=0x878, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x67e, lpNumberOfBytesRead=0x137cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x137cf61c*=0x67e, lpOverlapped=0x0) returned 1 [0152.766] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0xfffff982, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.766] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4a50000, cbInput=0x67e, pPaddingInfo=0x0, pbIV=0x137cf848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x137cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x137cf848, pbOutput=0x4a50000, pcbResult=0x137cf618) returned 0x0 [0152.766] WriteFile (in: hFile=0x878, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x137cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x137cf61c*=0x680, lpOverlapped=0x0) returned 1 [0152.766] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x137cf60c | out: lpNewFilePointer=0x0) returned 1 [0152.766] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.766] WriteFile (in: hFile=0x878, lpBuffer=0x137cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x137cf61c, lpOverlapped=0x0 | out: lpBuffer=0x137cf83c*, lpNumberOfBytesWritten=0x137cf61c*=0x8, lpOverlapped=0x0) returned 1 [0152.766] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.766] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0152.766] CloseHandle (hObject=0x878) returned 1 [0152.767] VirtualAlloc (lpAddress=0x0, dwSize=0x101, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\publisher.en-us\\publishermui.xml.play")) returned 1 [0152.768] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1277 os_tid = 0xd50 [0152.510] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.526] ReadFile (in: hFile=0x87c, lpBuffer=0x1390fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1390f85c, lpOverlapped=0x0 | out: lpBuffer=0x1390fb34*, lpNumberOfBytesRead=0x1390f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.649] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.649] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.650] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x1390f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0152.650] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x1390f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x1390f828, pbKeyObject=0x0) returned 0x0 [0152.650] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1390f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1390f500) returned 0x0 [0152.650] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.650] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1390f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1390f500) returned 0x0 [0152.653] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.654] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.655] WriteFile (in: hFile=0x87c, lpBuffer=0x1390fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1390f830, lpOverlapped=0x0 | out: lpBuffer=0x1390fb34*, lpNumberOfBytesWritten=0x1390f830*=0x428, lpOverlapped=0x0) returned 1 [0152.770] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.770] ReadFile (in: hFile=0x87c, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x703, lpNumberOfBytesRead=0x1390f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x1390f61c*=0x703, lpOverlapped=0x0) returned 1 [0152.770] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffff8fd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.770] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x4b50000, cbInput=0x703, pPaddingInfo=0x0, pbIV=0x1390f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x1390f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x1390f848, pbOutput=0x4b50000, pcbResult=0x1390f618) returned 0x0 [0152.770] WriteFile (in: hFile=0x87c, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x1390f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x1390f61c*=0x710, lpOverlapped=0x0) returned 1 [0152.771] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1390f60c | out: lpNewFilePointer=0x0) returned 1 [0152.771] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.771] WriteFile (in: hFile=0x87c, lpBuffer=0x1390f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1390f61c, lpOverlapped=0x0 | out: lpBuffer=0x1390f83c*, lpNumberOfBytesWritten=0x1390f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.771] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.771] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0152.771] CloseHandle (hObject=0x87c) returned 1 [0152.771] VirtualAlloc (lpAddress=0x0, dwSize=0xf3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.772] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\publisher.en-us\\setup.xml.play")) returned 1 [0152.772] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1278 os_tid = 0xd54 [0152.528] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.528] ReadFile (in: hFile=0x884, lpBuffer=0x13a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x13a4fb34*, lpNumberOfBytesRead=0x13a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.850] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.850] ReadFile (in: hFile=0x884, lpBuffer=0x13a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x13a4fb34*, lpNumberOfBytesRead=0x13a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.850] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.850] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.851] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x13a4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0152.851] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x13a4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x13a4f828, pbKeyObject=0x0) returned 0x0 [0152.851] BCryptExportKey (in: hKey=0x77b9e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x13a4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x13a4f500) returned 0x0 [0152.851] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.851] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x13a4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x13a4f500) returned 0x0 [0152.854] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.855] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.856] WriteFile (in: hFile=0x884, lpBuffer=0x13a4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13a4f830, lpOverlapped=0x0 | out: lpBuffer=0x13a4fb34*, lpNumberOfBytesWritten=0x13a4f830*=0x428, lpOverlapped=0x0) returned 1 [0152.856] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.856] ReadFile (in: hFile=0x884, lpBuffer=0x4c50000, nNumberOfBytesToRead=0xad4, lpNumberOfBytesRead=0x13a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x13a4f61c*=0xad4, lpOverlapped=0x0) returned 1 [0152.856] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xfffff52c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.856] BCryptEncrypt (in: hKey=0x77b9e0, pbInput=0x4c50000, cbInput=0xad4, pPaddingInfo=0x0, pbIV=0x13a4f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x13a4f618, dwFlags=0x1 | out: hKey=0x77b9e0, pbIV=0x13a4f848, pbOutput=0x4c50000, pcbResult=0x13a4f618) returned 0x0 [0152.856] WriteFile (in: hFile=0x884, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x13a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x13a4f61c*=0xae0, lpOverlapped=0x0) returned 1 [0152.856] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13a4f60c | out: lpNewFilePointer=0x0) returned 1 [0152.856] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.856] WriteFile (in: hFile=0x884, lpBuffer=0x13a4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x13a4f83c*, lpNumberOfBytesWritten=0x13a4f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.856] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.856] BCryptDestroyKey (in: hKey=0x77b9e0 | out: hKey=0x77b9e0) returned 0x0 [0152.857] CloseHandle (hObject=0x884) returned 1 [0152.857] VirtualAlloc (lpAddress=0x0, dwSize=0xe9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Word.en-us\\SETUP.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\word.en-us\\setup.xml.play")) returned 1 [0152.859] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1279 os_tid = 0xd58 [0152.708] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.708] ReadFile (in: hFile=0x88c, lpBuffer=0x13b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x13b8fb34*, lpNumberOfBytesRead=0x13b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.861] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.861] ReadFile (in: hFile=0x88c, lpBuffer=0x13b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x13b8fb34*, lpNumberOfBytesRead=0x13b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.862] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.862] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x13b8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0152.862] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x13b8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x13b8f828, pbKeyObject=0x0) returned 0x0 [0152.862] BCryptExportKey (in: hKey=0x77b9e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x13b8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x13b8f500) returned 0x0 [0152.862] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.862] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x13b8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x13b8f500) returned 0x0 [0152.865] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.867] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.867] WriteFile (in: hFile=0x88c, lpBuffer=0x13b8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13b8f830, lpOverlapped=0x0 | out: lpBuffer=0x13b8fb34*, lpNumberOfBytesWritten=0x13b8f830*=0x428, lpOverlapped=0x0) returned 1 [0152.867] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.867] ReadFile (in: hFile=0x88c, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x13b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x13b8f61c*=0x83c, lpOverlapped=0x0) returned 1 [0152.867] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0xfffff7c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.867] BCryptEncrypt (in: hKey=0x77b9e0, pbInput=0x4d50000, cbInput=0x83c, pPaddingInfo=0x0, pbIV=0x13b8f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x13b8f618, dwFlags=0x1 | out: hKey=0x77b9e0, pbIV=0x13b8f848, pbOutput=0x4d50000, pcbResult=0x13b8f618) returned 0x0 [0152.867] WriteFile (in: hFile=0x88c, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x13b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x13b8f61c*=0x840, lpOverlapped=0x0) returned 1 [0152.867] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13b8f60c | out: lpNewFilePointer=0x0) returned 1 [0152.867] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.867] WriteFile (in: hFile=0x88c, lpBuffer=0x13b8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x13b8f83c*, lpNumberOfBytesWritten=0x13b8f61c*=0x8, lpOverlapped=0x0) returned 1 [0152.868] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0x840, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.868] BCryptDestroyKey (in: hKey=0x77b9e0 | out: hKey=0x77b9e0) returned 0x0 [0152.868] CloseHandle (hObject=0x88c) returned 1 [0152.868] VirtualAlloc (lpAddress=0x0, dwSize=0xed, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0152.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Word.en-us\\WordMUI.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\office setup controller\\word.en-us\\wordmui.xml.play")) returned 1 [0152.869] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1280 os_tid = 0xd5c [0152.709] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.709] ReadFile (in: hFile=0xac0, lpBuffer=0x13ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x13ccfb34*, lpNumberOfBytesRead=0x13ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.861] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.861] ReadFile (in: hFile=0xac0, lpBuffer=0x13ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x13ccfb34*, lpNumberOfBytesRead=0x13ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.041] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.042] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.042] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x13ccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0153.042] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x13ccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x13ccf828, pbKeyObject=0x0) returned 0x0 [0153.042] BCryptExportKey (in: hKey=0x77bc60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x13ccf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x13ccf500) returned 0x0 [0153.043] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.043] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x13ccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x13ccf500) returned 0x0 [0153.048] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.049] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.049] WriteFile (in: hFile=0xac0, lpBuffer=0x13ccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13ccf830, lpOverlapped=0x0 | out: lpBuffer=0x13ccfb34*, lpNumberOfBytesWritten=0x13ccf830*=0x428, lpOverlapped=0x0) returned 1 [0153.050] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.050] ReadFile (in: hFile=0xac0, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x26a8, lpNumberOfBytesRead=0x13ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x13ccf61c*=0x26a8, lpOverlapped=0x0) returned 1 [0153.115] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xffffd958, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.115] BCryptEncrypt (in: hKey=0x77bc60, pbInput=0x4e50000, cbInput=0x26a8, pPaddingInfo=0x0, pbIV=0x13ccf848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x13ccf618, dwFlags=0x1 | out: hKey=0x77bc60, pbIV=0x13ccf848, pbOutput=0x4e50000, pcbResult=0x13ccf618) returned 0x0 [0153.115] WriteFile (in: hFile=0xac0, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x13ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x13ccf61c*=0x26b0, lpOverlapped=0x0) returned 1 [0153.115] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13ccf60c | out: lpNewFilePointer=0x0) returned 1 [0153.116] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.116] WriteFile (in: hFile=0xac0, lpBuffer=0x13ccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x13ccf83c*, lpNumberOfBytesWritten=0x13ccf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.116] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x26b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.116] BCryptDestroyKey (in: hKey=0x77bc60 | out: hKey=0x77bc60) returned 0x0 [0153.116] CloseHandle (hObject=0xac0) returned 1 [0153.116] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\OFFREL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\offrel.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\OFFREL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\offrel.dll.play")) returned 1 [0153.117] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1281 os_tid = 0xd60 [0152.711] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.711] ReadFile (in: hFile=0x894, lpBuffer=0x13e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x13e0fb34*, lpNumberOfBytesRead=0x13e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.849] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.849] ReadFile (in: hFile=0x894, lpBuffer=0x13e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x13e0fb34*, lpNumberOfBytesRead=0x13e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.050] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.051] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.051] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x13e0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0153.051] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x13e0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x13e0f828, pbKeyObject=0x0) returned 0x0 [0153.051] BCryptExportKey (in: hKey=0x77bef0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x13e0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x13e0f500) returned 0x0 [0153.052] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.052] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x13e0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x13e0f500) returned 0x0 [0153.056] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.058] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.058] WriteFile (in: hFile=0x894, lpBuffer=0x13e0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13e0f830, lpOverlapped=0x0 | out: lpBuffer=0x13e0fb34*, lpNumberOfBytesWritten=0x13e0f830*=0x428, lpOverlapped=0x0) returned 1 [0153.058] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.058] ReadFile (in: hFile=0x894, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x46e8, lpNumberOfBytesRead=0x13e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x13e0f61c*=0x46e8, lpOverlapped=0x0) returned 1 [0153.119] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xffffb918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.120] BCryptEncrypt (in: hKey=0x77bef0, pbInput=0x4f50000, cbInput=0x46e8, pPaddingInfo=0x0, pbIV=0x13e0f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x13e0f618, dwFlags=0x1 | out: hKey=0x77bef0, pbIV=0x13e0f848, pbOutput=0x4f50000, pcbResult=0x13e0f618) returned 0x0 [0153.120] WriteFile (in: hFile=0x894, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x46f0, lpNumberOfBytesWritten=0x13e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x13e0f61c*=0x46f0, lpOverlapped=0x0) returned 1 [0153.120] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13e0f60c | out: lpNewFilePointer=0x0) returned 1 [0153.120] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.120] WriteFile (in: hFile=0x894, lpBuffer=0x13e0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x13e0f83c*, lpNumberOfBytesWritten=0x13e0f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.120] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x46f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.120] BCryptDestroyKey (in: hKey=0x77bef0 | out: hKey=0x77bef0) returned 0x0 [0153.120] CloseHandle (hObject=0x894) returned 1 [0153.120] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\OPTINPS.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\optinps.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\OPTINPS.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\optinps.dll.play")) returned 1 [0153.122] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1282 os_tid = 0xd64 [0152.712] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.712] ReadFile (in: hFile=0x89c, lpBuffer=0x13f4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13f4f85c, lpOverlapped=0x0 | out: lpBuffer=0x13f4fb34*, lpNumberOfBytesRead=0x13f4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.836] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.836] ReadFile (in: hFile=0x89c, lpBuffer=0x13f4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x13f4f85c, lpOverlapped=0x0 | out: lpBuffer=0x13f4fb34*, lpNumberOfBytesRead=0x13f4f85c*=0x428, lpOverlapped=0x0) returned 1 [0152.836] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.837] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.837] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x13f4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0152.837] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x13f4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x13f4f828, pbKeyObject=0x0) returned 0x0 [0152.837] BCryptExportKey (in: hKey=0x77b750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x13f4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x13f4f500) returned 0x0 [0152.838] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.838] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x13f4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x13f4f500) returned 0x0 [0152.841] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.842] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.842] WriteFile (in: hFile=0x89c, lpBuffer=0x13f4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x13f4f830, lpOverlapped=0x0 | out: lpBuffer=0x13f4fb34*, lpNumberOfBytesWritten=0x13f4f830*=0x428, lpOverlapped=0x0) returned 1 [0152.843] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.843] ReadFile (in: hFile=0x89c, lpBuffer=0x5050000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x13f4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.081] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.081] BCryptEncrypt (in: hKey=0x77b750, pbInput=0x5050000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x13f4f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x13f4f618, dwFlags=0x0 | out: hKey=0x77b750, pbIV=0x13f4f848, pbOutput=0x5050000, pcbResult=0x13f4f618) returned 0x0 [0153.083] WriteFile (in: hFile=0x89c, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x13f4f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.086] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13f4f60c | out: lpNewFilePointer=0x0) returned 1 [0153.086] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.086] WriteFile (in: hFile=0x89c, lpBuffer=0x13f4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x13f4f83c*, lpNumberOfBytesWritten=0x13f4f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.086] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.086] ReadFile (in: hFile=0x89c, lpBuffer=0x5050000, nNumberOfBytesToRead=0xa0ca8, lpNumberOfBytesRead=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x13f4f61c*=0xa0ca8, lpOverlapped=0x0) returned 1 [0153.131] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfff5f358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.131] BCryptEncrypt (in: hKey=0x77b750, pbInput=0x5050000, cbInput=0xa0ca8, pPaddingInfo=0x0, pbIV=0x13f4f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x13f4f618, dwFlags=0x1 | out: hKey=0x77b750, pbIV=0x13f4f848, pbOutput=0x5050000, pcbResult=0x13f4f618) returned 0x0 [0153.132] WriteFile (in: hFile=0x89c, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0xa0cb0, lpNumberOfBytesWritten=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x13f4f61c*=0xa0cb0, lpOverlapped=0x0) returned 1 [0153.134] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13f4f60c | out: lpNewFilePointer=0x0) returned 1 [0153.134] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.134] WriteFile (in: hFile=0x89c, lpBuffer=0x13f4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13f4f61c, lpOverlapped=0x0 | out: lpBuffer=0x13f4f83c*, lpNumberOfBytesWritten=0x13f4f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.134] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x1a0cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.134] BCryptDestroyKey (in: hKey=0x77b750 | out: hKey=0x77b750) returned 0x0 [0153.134] CloseHandle (hObject=0x89c) returned 1 [0153.134] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\riched20.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\RICHED20.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\riched20.dll.play")) returned 1 [0153.136] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1283 os_tid = 0xd68 [0152.713] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.713] ReadFile (in: hFile=0x4f0, lpBuffer=0x164cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x164cf85c, lpOverlapped=0x0 | out: lpBuffer=0x164cfb34*, lpNumberOfBytesRead=0x164cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.871] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.871] ReadFile (in: hFile=0x4f0, lpBuffer=0x164cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x164cf85c, lpOverlapped=0x0 | out: lpBuffer=0x164cfb34*, lpNumberOfBytesRead=0x164cf85c*=0x428, lpOverlapped=0x0) returned 1 [0152.871] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0152.872] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0152.872] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x164cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0152.872] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x164cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x164cf828, pbKeyObject=0x0) returned 0x0 [0152.872] BCryptExportKey (in: hKey=0x77b9e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x164cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x164cf500) returned 0x0 [0152.872] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0152.872] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x164cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x164cf500) returned 0x0 [0152.876] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.877] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.877] WriteFile (in: hFile=0x4f0, lpBuffer=0x164cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x164cf830, lpOverlapped=0x0 | out: lpBuffer=0x164cfb34*, lpNumberOfBytesWritten=0x164cf830*=0x428, lpOverlapped=0x0) returned 1 [0152.877] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.877] ReadFile (in: hFile=0x4f0, lpBuffer=0x5150000, nNumberOfBytesToRead=0x3c98, lpNumberOfBytesRead=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x164cf61c*=0x3c98, lpOverlapped=0x0) returned 1 [0153.069] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xffffc368, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.069] BCryptEncrypt (in: hKey=0x77b9e0, pbInput=0x5150000, cbInput=0x3c98, pPaddingInfo=0x0, pbIV=0x164cf848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x164cf618, dwFlags=0x1 | out: hKey=0x77b9e0, pbIV=0x164cf848, pbOutput=0x5150000, pcbResult=0x164cf618) returned 0x0 [0153.069] WriteFile (in: hFile=0x4f0, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x164cf61c*=0x3ca0, lpOverlapped=0x0) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x164cf60c | out: lpNewFilePointer=0x0) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.070] WriteFile (in: hFile=0x4f0, lpBuffer=0x164cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x164cf61c, lpOverlapped=0x0 | out: lpBuffer=0x164cf83c*, lpNumberOfBytesWritten=0x164cf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x3ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.070] BCryptDestroyKey (in: hKey=0x77b9e0 | out: hKey=0x77b9e0) returned 0x0 [0153.070] CloseHandle (hObject=0x4f0) returned 1 [0153.070] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\VBAJET32.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\vbajet32.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\VBAJET32.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\vbajet32.dll.play")) returned 1 [0153.113] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1284 os_tid = 0x8cc [0152.719] GetLastError () returned 0x57 [0152.719] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78e988 [0152.719] SetLastError (dwErrCode=0x57) [0152.720] IcmpCreateFile () returned 0x76a4d0 [0152.720] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf6b8 [0152.720] IcmpSendEcho2 (in: IcmpHandle=0x76a4d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xea00a8c0, RequestData=0x1638ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf6b8, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf6b8) returned 0x0 [0197.926] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf6b8 | out: hHeap=0x710000) returned 1 [0197.927] IcmpCloseHandle (IcmpHandle=0x76a4d0) returned 1 [0197.928] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78e988 | out: hHeap=0x710000) returned 1 Thread: id = 1285 os_tid = 0xd6c [0152.721] GetLastError () returned 0x57 [0152.721] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e98a8 [0152.721] SetLastError (dwErrCode=0x57) [0152.721] IcmpCreateFile () returned 0x76a508 [0152.721] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf708 [0152.721] IcmpSendEcho2 (in: IcmpHandle=0x76a508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xeb00a8c0, RequestData=0x1660ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf708, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf708) returned 0x0 [0200.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf708 | out: hHeap=0x710000) returned 1 [0200.338] IcmpCloseHandle (IcmpHandle=0x76a508) returned 1 [0200.339] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x1a6e98a8 | out: hHeap=0x710000) returned 1 Thread: id = 1286 os_tid = 0xdd8 [0152.723] GetLastError () returned 0x57 [0152.723] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758c28 [0152.724] SetLastError (dwErrCode=0x57) [0152.724] IcmpCreateFile () returned 0x76a3b8 [0152.724] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf758 [0152.724] IcmpSendEcho2 (in: IcmpHandle=0x76a3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xec00a8c0, RequestData=0x1674ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf758, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7cf758) returned 0x0 [0201.603] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cf758 | out: hHeap=0x710000) returned 1 [0201.603] IcmpCloseHandle (IcmpHandle=0x76a3b8) returned 1 [0201.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x758c28 | out: hHeap=0x710000) returned 1 Thread: id = 1287 os_tid = 0xde0 [0152.725] GetLastError () returned 0x57 [0152.725] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7553a8 [0152.725] SetLastError (dwErrCode=0x57) [0152.725] IcmpCreateFile () returned 0x76a3f0 [0152.725] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0108 [0152.725] IcmpSendEcho2 (in: IcmpHandle=0x76a3f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xed00a8c0, RequestData=0x1688ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0108, ReplySize=0x44, Timeout=0x2bc | out: ReplyBuffer=0x7d0108) returned 0x0 [0202.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7d0108 | out: hHeap=0x710000) returned 1 [0202.386] IcmpCloseHandle (IcmpHandle=0x76a3f0) returned 1 [0202.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7553a8 | out: hHeap=0x710000) returned 1 Thread: id = 1288 os_tid = 0xde4 [0152.726] GetLastError () returned 0x57 [0152.726] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755730 [0152.726] SetLastError (dwErrCode=0x57) [0152.726] IcmpCreateFile () returned 0x76a460 [0152.726] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0158 [0152.726] IcmpSendEcho2 (IcmpHandle=0x76a460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xee00a8c0, RequestData=0x169cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0158, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1289 os_tid = 0x133c [0152.727] GetLastError () returned 0x57 [0152.727] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755ab8 [0152.728] SetLastError (dwErrCode=0x57) [0152.728] IcmpCreateFile () returned 0x76a498 [0152.728] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d01a8 [0152.728] IcmpSendEcho2 (IcmpHandle=0x76a498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xef00a8c0, RequestData=0x16b0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d01a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1290 os_tid = 0x1248 [0152.729] GetLastError () returned 0x57 [0152.729] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755e40 [0152.729] SetLastError (dwErrCode=0x57) [0152.729] IcmpCreateFile () returned 0x76a540 [0152.729] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d01f8 [0152.729] IcmpSendEcho2 (IcmpHandle=0x76a540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf000a8c0, RequestData=0x16c4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d01f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1291 os_tid = 0x1254 [0152.730] GetLastError () returned 0x57 [0152.730] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7561c8 [0152.730] SetLastError (dwErrCode=0x57) [0152.730] IcmpCreateFile () returned 0x76a578 [0152.730] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0248 [0152.730] IcmpSendEcho2 (IcmpHandle=0x76a578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf100a8c0, RequestData=0x16d8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0248, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1292 os_tid = 0x1110 [0152.731] GetLastError () returned 0x57 [0152.731] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756550 [0152.731] SetLastError (dwErrCode=0x57) [0152.731] IcmpCreateFile () returned 0x76a5b0 [0152.731] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0298 [0152.731] IcmpSendEcho2 (IcmpHandle=0x76a5b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf200a8c0, RequestData=0x16ecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0298, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1293 os_tid = 0x9e8 [0152.732] GetLastError () returned 0x57 [0152.732] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7568d8 [0152.733] SetLastError (dwErrCode=0x57) [0152.733] IcmpCreateFile () returned 0x76a5e8 [0152.733] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d02e8 [0152.733] IcmpSendEcho2 (IcmpHandle=0x76a5e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf300a8c0, RequestData=0x1700ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d02e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1294 os_tid = 0x1220 [0152.734] GetLastError () returned 0x57 [0152.734] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756c60 [0152.734] SetLastError (dwErrCode=0x57) [0152.734] IcmpCreateFile () returned 0x76a620 [0152.734] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0338 [0152.734] IcmpSendEcho2 (IcmpHandle=0x76a620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf400a8c0, RequestData=0x1714ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0338, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1295 os_tid = 0x1260 [0152.735] GetLastError () returned 0x57 [0152.735] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x756fe8 [0152.735] SetLastError (dwErrCode=0x57) [0152.735] IcmpCreateFile () returned 0x76a658 [0152.735] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0388 [0152.735] IcmpSendEcho2 (IcmpHandle=0x76a658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf500a8c0, RequestData=0x1728ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0388, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1296 os_tid = 0x1188 [0152.736] GetLastError () returned 0x57 [0152.736] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757370 [0152.736] SetLastError (dwErrCode=0x57) [0152.736] IcmpCreateFile () returned 0x76a6c8 [0152.736] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d03d8 [0152.736] IcmpSendEcho2 (IcmpHandle=0x76a6c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf600a8c0, RequestData=0x173cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d03d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1297 os_tid = 0x950 [0152.737] GetLastError () returned 0x57 [0152.737] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7576f8 [0152.737] SetLastError (dwErrCode=0x57) [0152.738] IcmpCreateFile () returned 0x76a700 [0152.738] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0428 [0152.738] IcmpSendEcho2 (IcmpHandle=0x76a700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf700a8c0, RequestData=0x1764ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0428, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1298 os_tid = 0x81c [0152.833] GetLastError () returned 0x57 [0152.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757a80 [0152.833] SetLastError (dwErrCode=0x57) [0152.833] IcmpCreateFile () returned 0x76a7a8 [0152.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0518 [0152.833] IcmpSendEcho2 (IcmpHandle=0x76a7a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf800a8c0, RequestData=0x1778ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0518, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1299 os_tid = 0xb18 [0152.834] GetLastError () returned 0x57 [0152.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x757e08 [0152.834] SetLastError (dwErrCode=0x57) [0152.835] IcmpCreateFile () returned 0x76a7e0 [0152.835] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cffc8 [0152.835] IcmpSendEcho2 (IcmpHandle=0x76a7e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf900a8c0, RequestData=0x178cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cffc8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1300 os_tid = 0xba0 [0152.878] GetLastError () returned 0x57 [0152.878] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758190 [0152.878] SetLastError (dwErrCode=0x57) [0152.878] IcmpCreateFile () returned 0x76a118 [0152.878] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0018 [0152.878] IcmpSendEcho2 (IcmpHandle=0x76a118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfa00a8c0, RequestData=0x17a0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0018, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1301 os_tid = 0xc74 [0152.879] GetLastError () returned 0x57 [0152.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x758518 [0152.880] SetLastError (dwErrCode=0x57) [0152.880] IcmpCreateFile () returned 0x76a150 [0152.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0068 [0152.880] IcmpSendEcho2 (IcmpHandle=0x76a150, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfb00a8c0, RequestData=0x17b4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0068, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1302 os_tid = 0xc78 [0152.881] GetLastError () returned 0x57 [0152.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7588a0 [0152.881] SetLastError (dwErrCode=0x57) [0152.881] IcmpCreateFile () returned 0x76a188 [0152.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d00b8 [0152.881] IcmpSendEcho2 (IcmpHandle=0x76a188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfc00a8c0, RequestData=0x17efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d00b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1303 os_tid = 0xc7c [0152.882] GetLastError () returned 0x57 [0152.882] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x755020 [0152.882] SetLastError (dwErrCode=0x57) [0152.882] IcmpCreateFile () returned 0x76a1c0 [0152.882] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d0478 [0152.882] IcmpSendEcho2 (IcmpHandle=0x76a1c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfd00a8c0, RequestData=0x17ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d0478, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1304 os_tid = 0xc84 [0152.883] GetLastError () returned 0x57 [0152.883] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75d838 [0152.884] SetLastError (dwErrCode=0x57) [0152.884] IcmpCreateFile () returned 0x76a1f8 [0152.884] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7d04c8 [0152.884] IcmpSendEcho2 (IcmpHandle=0x76a1f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfe00a8c0, RequestData=0x1813ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7d04c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1305 os_tid = 0xc8c [0153.139] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.139] ReadFile (in: hFile=0x3cc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.201] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.201] ReadFile (in: hFile=0x3cc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.201] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.202] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.202] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0153.202] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0153.202] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0153.202] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.202] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0153.206] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.207] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.207] WriteFile (in: hFile=0x3cc, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0153.207] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.207] ReadFile (in: hFile=0x3cc, lpBuffer=0x5250000, nNumberOfBytesToRead=0x222d8, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0xe9f61c*=0x222d8, lpOverlapped=0x0) returned 1 [0153.237] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffddd28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.238] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5250000, cbInput=0x222d8, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xe9f848, pbOutput=0x5250000, pcbResult=0xe9f618) returned 0x0 [0153.238] WriteFile (in: hFile=0x3cc, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x222e0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0xe9f61c*=0x222e0, lpOverlapped=0x0) returned 1 [0153.239] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0153.239] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.239] WriteFile (in: hFile=0x3cc, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.239] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x222e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.239] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.239] CloseHandle (hObject=0x3cc) returned 1 [0153.240] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\WISC30.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\wisc30.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\WISC30.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\wisc30.dll.play")) returned 1 [0153.241] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1306 os_tid = 0xc94 [0153.141] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.141] ReadFile (in: hFile=0x3f8, lpBuffer=0xf30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf30f85c, lpOverlapped=0x0 | out: lpBuffer=0xf30fb34*, lpNumberOfBytesRead=0xf30f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.200] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.200] ReadFile (in: hFile=0x3f8, lpBuffer=0xf30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf30f85c, lpOverlapped=0x0 | out: lpBuffer=0xf30fb34*, lpNumberOfBytesRead=0xf30f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.227] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.228] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0xf30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0153.228] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0xf30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0xf30f828, pbKeyObject=0x0) returned 0x0 [0153.228] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf30f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf30f500) returned 0x0 [0153.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.228] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf30f500) returned 0x0 [0153.233] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.234] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.234] WriteFile (in: hFile=0x3f8, lpBuffer=0xf30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf30f830, lpOverlapped=0x0 | out: lpBuffer=0xf30fb34*, lpNumberOfBytesWritten=0xf30f830*=0x428, lpOverlapped=0x0) returned 1 [0153.234] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.234] ReadFile (in: hFile=0x3f8, lpBuffer=0x3650000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0xf30f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.258] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.259] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3650000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xf30f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0xf30f618, dwFlags=0x0 | out: hKey=0x1a6d8590, pbIV=0xf30f848, pbOutput=0x3650000, pcbResult=0xf30f618) returned 0x0 [0153.260] WriteFile (in: hFile=0x3f8, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0xf30f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.262] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf30f60c | out: lpNewFilePointer=0x0) returned 1 [0153.263] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.263] WriteFile (in: hFile=0x3f8, lpBuffer=0xf30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0xf30f83c*, lpNumberOfBytesWritten=0xf30f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.263] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.263] ReadFile (in: hFile=0x3f8, lpBuffer=0x3650000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0xf30f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.338] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.338] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3650000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xf30f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0xf30f618, dwFlags=0x0 | out: hKey=0x1a6d8590, pbIV=0xf30f848, pbOutput=0x3650000, pcbResult=0xf30f618) returned 0x0 [0153.339] WriteFile (in: hFile=0x3f8, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0xf30f61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.525] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf30f60c | out: lpNewFilePointer=0x0) returned 1 [0153.526] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.526] WriteFile (in: hFile=0x3f8, lpBuffer=0xf30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0xf30f83c*, lpNumberOfBytesWritten=0xf30f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.536] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.537] ReadFile (in: hFile=0x3f8, lpBuffer=0x3650000, nNumberOfBytesToRead=0x274d0, lpNumberOfBytesRead=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0xf30f61c*=0x274d0, lpOverlapped=0x0) returned 1 [0153.540] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffd8b30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.540] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3650000, cbInput=0x274d0, pPaddingInfo=0x0, pbIV=0xf30f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0xf30f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0xf30f848, pbOutput=0x3650000, pcbResult=0xf30f618) returned 0x0 [0153.540] WriteFile (in: hFile=0x3f8, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x274e0, lpNumberOfBytesWritten=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0xf30f61c*=0x274e0, lpOverlapped=0x0) returned 1 [0153.541] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf30f60c | out: lpNewFilePointer=0x0) returned 1 [0153.541] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.541] WriteFile (in: hFile=0x3f8, lpBuffer=0xf30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf30f61c, lpOverlapped=0x0 | out: lpBuffer=0xf30f83c*, lpNumberOfBytesWritten=0xf30f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.541] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x2274e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.541] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0153.541] CloseHandle (hObject=0x3f8) returned 1 [0153.542] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\WXPNSE.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\wxpnse.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\WXPNSE.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office16\\wxpnse.dll.play")) returned 1 [0153.544] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1307 os_tid = 0xc9c [0153.142] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.142] ReadFile (in: hFile=0x29c, lpBuffer=0x110cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x110cf85c, lpOverlapped=0x0 | out: lpBuffer=0x110cfb34*, lpNumberOfBytesRead=0x110cf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.208] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.209] ReadFile (in: hFile=0x29c, lpBuffer=0x110cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x110cf85c, lpOverlapped=0x0 | out: lpBuffer=0x110cfb34*, lpNumberOfBytesRead=0x110cf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.273] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.275] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x110cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0153.275] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x110cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x110cf828, pbKeyObject=0x0) returned 0x0 [0153.275] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x110cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x110cf500) returned 0x0 [0153.276] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.276] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x110cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x110cf500) returned 0x0 [0153.279] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.281] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.282] WriteFile (in: hFile=0x29c, lpBuffer=0x110cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x110cf830, lpOverlapped=0x0 | out: lpBuffer=0x110cfb34*, lpNumberOfBytesWritten=0x110cf830*=0x428, lpOverlapped=0x0) returned 1 [0153.282] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.282] ReadFile (in: hFile=0x29c, lpBuffer=0x5350000, nNumberOfBytesToRead=0x854b0, lpNumberOfBytesRead=0x110cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x110cf61c*=0x854b0, lpOverlapped=0x0) returned 1 [0153.345] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfff7ab50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.345] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5350000, cbInput=0x854b0, pPaddingInfo=0x0, pbIV=0x110cf848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x110cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x110cf848, pbOutput=0x5350000, pcbResult=0x110cf618) returned 0x0 [0153.345] WriteFile (in: hFile=0x29c, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x854c0, lpNumberOfBytesWritten=0x110cf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x110cf61c*=0x854c0, lpOverlapped=0x0) returned 1 [0153.347] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x110cf60c | out: lpNewFilePointer=0x0) returned 1 [0153.347] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.347] WriteFile (in: hFile=0x29c, lpBuffer=0x110cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x110cf61c, lpOverlapped=0x0 | out: lpBuffer=0x110cf83c*, lpNumberOfBytesWritten=0x110cf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.347] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x854c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.347] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.347] CloseHandle (hObject=0x29c) returned 1 [0153.347] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mslid.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mslid.dll.play")) returned 1 [0153.349] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1308 os_tid = 0xca4 [0153.143] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.143] ReadFile (in: hFile=0x4a4, lpBuffer=0x1148fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1148f85c, lpOverlapped=0x0 | out: lpBuffer=0x1148fb34*, lpNumberOfBytesRead=0x1148f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.209] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.209] ReadFile (in: hFile=0x4a4, lpBuffer=0x1148fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1148f85c, lpOverlapped=0x0 | out: lpBuffer=0x1148fb34*, lpNumberOfBytesRead=0x1148f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.319] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.320] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.321] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x1148f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0153.321] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x1148f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x1148f828, pbKeyObject=0x0) returned 0x0 [0153.321] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1148f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1148f500) returned 0x0 [0153.321] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.321] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1148f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1148f500) returned 0x0 [0153.324] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.325] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.325] WriteFile (in: hFile=0x4a4, lpBuffer=0x1148fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1148f830, lpOverlapped=0x0 | out: lpBuffer=0x1148fb34*, lpNumberOfBytesWritten=0x1148f830*=0x428, lpOverlapped=0x0) returned 1 [0153.327] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.327] ReadFile (in: hFile=0x4a4, lpBuffer=0x5450000, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x1148f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x1148f61c*=0x6c67b, lpOverlapped=0x0) returned 1 [0153.373] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfff93985, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.373] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5450000, cbInput=0x6c67b, pPaddingInfo=0x0, pbIV=0x1148f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x1148f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x1148f848, pbOutput=0x5450000, pcbResult=0x1148f618) returned 0x0 [0153.374] WriteFile (in: hFile=0x4a4, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x1148f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x1148f61c*=0x6c680, lpOverlapped=0x0) returned 1 [0153.375] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1148f60c | out: lpNewFilePointer=0x0) returned 1 [0153.375] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.375] WriteFile (in: hFile=0x4a4, lpBuffer=0x1148f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1148f61c, lpOverlapped=0x0 | out: lpBuffer=0x1148f83c*, lpNumberOfBytesWritten=0x1148f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.375] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x6c680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.375] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0153.375] CloseHandle (hObject=0x4a4) returned 1 [0153.381] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0153.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mswds_en.lex.play")) returned 1 [0153.384] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1309 os_tid = 0xcac [0153.173] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.173] ReadFile (in: hFile=0x7bc, lpBuffer=0x1823fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1823f85c, lpOverlapped=0x0 | out: lpBuffer=0x1823fb34*, lpNumberOfBytesRead=0x1823f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.209] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.209] ReadFile (in: hFile=0x7bc, lpBuffer=0x1823fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1823f85c, lpOverlapped=0x0 | out: lpBuffer=0x1823fb34*, lpNumberOfBytesRead=0x1823f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.209] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.210] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x1823f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0153.210] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x1823f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x1823f828, pbKeyObject=0x0) returned 0x0 [0153.210] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1823f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1823f500) returned 0x0 [0153.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.210] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1823f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1823f500) returned 0x0 [0153.214] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.215] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.215] WriteFile (in: hFile=0x7bc, lpBuffer=0x1823fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1823f830, lpOverlapped=0x0 | out: lpBuffer=0x1823fb34*, lpNumberOfBytesWritten=0x1823f830*=0x428, lpOverlapped=0x0) returned 1 [0153.215] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.215] ReadFile (in: hFile=0x7bc, lpBuffer=0x5550000, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x1823f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x1823f61c*=0x60983, lpOverlapped=0x0) returned 1 [0153.245] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xfff9f67d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.245] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5550000, cbInput=0x60983, pPaddingInfo=0x0, pbIV=0x1823f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x1823f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x1823f848, pbOutput=0x5550000, pcbResult=0x1823f618) returned 0x0 [0153.245] WriteFile (in: hFile=0x7bc, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x1823f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x1823f61c*=0x60990, lpOverlapped=0x0) returned 1 [0153.247] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1823f60c | out: lpNewFilePointer=0x0) returned 1 [0153.247] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.247] WriteFile (in: hFile=0x7bc, lpBuffer=0x1823f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1823f61c, lpOverlapped=0x0 | out: lpBuffer=0x1823f83c*, lpNumberOfBytesWritten=0x1823f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.247] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x60990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.247] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0153.247] CloseHandle (hObject=0x7bc) returned 1 [0153.247] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mswds_es.lex.play")) returned 1 [0153.249] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1310 os_tid = 0x14cc [0153.219] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.219] ReadFile (in: hFile=0x5d0, lpBuffer=0x1833fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1833f85c, lpOverlapped=0x0 | out: lpBuffer=0x1833fb34*, lpNumberOfBytesRead=0x1833f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.307] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.307] ReadFile (in: hFile=0x5d0, lpBuffer=0x1833fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1833f85c, lpOverlapped=0x0 | out: lpBuffer=0x1833fb34*, lpNumberOfBytesRead=0x1833f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.308] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.308] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x1833f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0153.308] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x1833f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x1833f828, pbKeyObject=0x0) returned 0x0 [0153.308] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1833f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1833f500) returned 0x0 [0153.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.309] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1833f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1833f500) returned 0x0 [0153.312] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.313] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.313] WriteFile (in: hFile=0x5d0, lpBuffer=0x1833fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1833f830, lpOverlapped=0x0 | out: lpBuffer=0x1833fb34*, lpNumberOfBytesWritten=0x1833f830*=0x428, lpOverlapped=0x0) returned 1 [0153.314] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.314] ReadFile (in: hFile=0x5d0, lpBuffer=0x5650000, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x1833f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x1833f61c*=0x482ef, lpOverlapped=0x0) returned 1 [0153.368] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xfffb7d11, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.368] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x5650000, cbInput=0x482ef, pPaddingInfo=0x0, pbIV=0x1833f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x1833f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x1833f848, pbOutput=0x5650000, pcbResult=0x1833f618) returned 0x0 [0153.368] WriteFile (in: hFile=0x5d0, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x1833f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x1833f61c*=0x482f0, lpOverlapped=0x0) returned 1 [0153.369] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1833f60c | out: lpNewFilePointer=0x0) returned 1 [0153.369] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.369] WriteFile (in: hFile=0x5d0, lpBuffer=0x1833f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1833f61c, lpOverlapped=0x0 | out: lpBuffer=0x1833f83c*, lpNumberOfBytesWritten=0x1833f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.369] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x482f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.369] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0153.369] CloseHandle (hObject=0x5d0) returned 1 [0153.369] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\mswds_fr.lex.play")) returned 1 [0153.382] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1311 os_tid = 0xcb4 [0153.220] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.220] ReadFile (in: hFile=0x7e4, lpBuffer=0x1843fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1843f85c, lpOverlapped=0x0 | out: lpBuffer=0x1843fb34*, lpNumberOfBytesRead=0x1843f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.300] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.300] ReadFile (in: hFile=0x7e4, lpBuffer=0x1843fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1843f85c, lpOverlapped=0x0 | out: lpBuffer=0x1843fb34*, lpNumberOfBytesRead=0x1843f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.301] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.302] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x1843f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0153.302] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x1843f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x1843f828, pbKeyObject=0x0) returned 0x0 [0153.302] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1843f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1843f500) returned 0x0 [0153.302] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.302] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1843f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1843f500) returned 0x0 [0153.305] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.306] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.306] WriteFile (in: hFile=0x7e4, lpBuffer=0x1843fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1843f830, lpOverlapped=0x0 | out: lpBuffer=0x1843fb34*, lpNumberOfBytesWritten=0x1843f830*=0x428, lpOverlapped=0x0) returned 1 [0153.307] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.307] ReadFile (in: hFile=0x7e4, lpBuffer=0x5750000, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x1843f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x1843f61c*=0x2cc7, lpOverlapped=0x0) returned 1 [0153.362] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xffffd339, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.362] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x5750000, cbInput=0x2cc7, pPaddingInfo=0x0, pbIV=0x1843f848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x1843f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x1843f848, pbOutput=0x5750000, pcbResult=0x1843f618) returned 0x0 [0153.362] WriteFile (in: hFile=0x7e4, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x1843f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x1843f61c*=0x2cd0, lpOverlapped=0x0) returned 1 [0153.362] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1843f60c | out: lpNewFilePointer=0x0) returned 1 [0153.362] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.362] WriteFile (in: hFile=0x7e4, lpBuffer=0x1843f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1843f61c, lpOverlapped=0x0 | out: lpBuffer=0x1843f83c*, lpNumberOfBytesWritten=0x1843f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.362] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x2cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.362] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0153.362] CloseHandle (hObject=0x7e4) returned 1 [0153.363] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.play")) returned 1 [0153.364] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1312 os_tid = 0xcbc [0153.222] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.222] ReadFile (in: hFile=0x7ec, lpBuffer=0x1853fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1853f85c, lpOverlapped=0x0 | out: lpBuffer=0x1853fb34*, lpNumberOfBytesRead=0x1853f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.225] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.225] ReadFile (in: hFile=0x7ec, lpBuffer=0x1853fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1853f85c, lpOverlapped=0x0 | out: lpBuffer=0x1853fb34*, lpNumberOfBytesRead=0x1853f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.291] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.293] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.293] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x1853f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0153.293] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x1853f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x1853f828, pbKeyObject=0x0) returned 0x0 [0153.293] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1853f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1853f500) returned 0x0 [0153.293] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.293] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1853f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1853f500) returned 0x0 [0153.298] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.299] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.299] WriteFile (in: hFile=0x7ec, lpBuffer=0x1853fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1853f830, lpOverlapped=0x0 | out: lpBuffer=0x1853fb34*, lpNumberOfBytesWritten=0x1853f830*=0x428, lpOverlapped=0x0) returned 1 [0153.300] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.300] ReadFile (in: hFile=0x7ec, lpBuffer=0x5850000, nNumberOfBytesToRead=0x46c0, lpNumberOfBytesRead=0x1853f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x1853f61c*=0x46c0, lpOverlapped=0x0) returned 1 [0153.358] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0xffffb940, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.358] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5850000, cbInput=0x46c0, pPaddingInfo=0x0, pbIV=0x1853f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x1853f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x1853f848, pbOutput=0x5850000, pcbResult=0x1853f618) returned 0x0 [0153.358] WriteFile (in: hFile=0x7ec, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x46d0, lpNumberOfBytesWritten=0x1853f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x1853f61c*=0x46d0, lpOverlapped=0x0) returned 1 [0153.358] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1853f60c | out: lpNewFilePointer=0x0) returned 1 [0153.358] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.358] WriteFile (in: hFile=0x7ec, lpBuffer=0x1853f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1853f61c, lpOverlapped=0x0 | out: lpBuffer=0x1853f83c*, lpNumberOfBytesWritten=0x1853f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.359] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0x46d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.359] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0153.359] CloseHandle (hObject=0x7ec) returned 1 [0153.359] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.play")) returned 1 [0153.360] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1313 os_tid = 0xcc4 [0153.225] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.225] ReadFile (in: hFile=0x260, lpBuffer=0x1867fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1867f85c, lpOverlapped=0x0 | out: lpBuffer=0x1867fb34*, lpNumberOfBytesRead=0x1867f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.290] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.291] ReadFile (in: hFile=0x260, lpBuffer=0x1867fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1867f85c, lpOverlapped=0x0 | out: lpBuffer=0x1867fb34*, lpNumberOfBytesRead=0x1867f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.350] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.351] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.351] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x1867f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0153.351] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x1867f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x1867f828, pbKeyObject=0x0) returned 0x0 [0153.351] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1867f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1867f500) returned 0x0 [0153.352] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.352] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1867f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1867f500) returned 0x0 [0153.355] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.356] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.356] WriteFile (in: hFile=0x260, lpBuffer=0x1867fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1867f830, lpOverlapped=0x0 | out: lpBuffer=0x1867fb34*, lpNumberOfBytesWritten=0x1867f830*=0x428, lpOverlapped=0x0) returned 1 [0153.357] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.357] ReadFile (in: hFile=0x260, lpBuffer=0x5950000, nNumberOfBytesToRead=0x156c0, lpNumberOfBytesRead=0x1867f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x1867f61c*=0x156c0, lpOverlapped=0x0) returned 1 [0153.376] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffea940, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.376] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5950000, cbInput=0x156c0, pPaddingInfo=0x0, pbIV=0x1867f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x1867f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1867f848, pbOutput=0x5950000, pcbResult=0x1867f618) returned 0x0 [0153.376] WriteFile (in: hFile=0x260, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x156d0, lpNumberOfBytesWritten=0x1867f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x1867f61c*=0x156d0, lpOverlapped=0x0) returned 1 [0153.377] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1867f60c | out: lpNewFilePointer=0x0) returned 1 [0153.377] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.377] WriteFile (in: hFile=0x260, lpBuffer=0x1867f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1867f61c, lpOverlapped=0x0 | out: lpBuffer=0x1867f83c*, lpNumberOfBytesWritten=0x1867f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.377] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x156d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.377] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.377] CloseHandle (hObject=0x260) returned 1 [0153.377] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0153.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fbiblio.dll.play")) returned 1 [0153.378] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1314 os_tid = 0xccc [0153.226] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.227] ReadFile (in: hFile=0x7f4, lpBuffer=0x187bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x187bf85c, lpOverlapped=0x0 | out: lpBuffer=0x187bfb34*, lpNumberOfBytesRead=0x187bf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.387] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.387] ReadFile (in: hFile=0x7f4, lpBuffer=0x187bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x187bf85c, lpOverlapped=0x0 | out: lpBuffer=0x187bfb34*, lpNumberOfBytesRead=0x187bf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.388] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.389] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.389] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x187bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0153.389] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x187bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x187bf828, pbKeyObject=0x0) returned 0x0 [0153.389] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x187bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x187bf500) returned 0x0 [0153.389] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.389] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x187bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x187bf500) returned 0x0 [0153.393] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.393] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.394] WriteFile (in: hFile=0x7f4, lpBuffer=0x187bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x187bf830, lpOverlapped=0x0 | out: lpBuffer=0x187bfb34*, lpNumberOfBytesWritten=0x187bf830*=0x428, lpOverlapped=0x0) returned 1 [0153.394] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.394] ReadFile (in: hFile=0x7f4, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x136c0, lpNumberOfBytesRead=0x187bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x187bf61c*=0x136c0, lpOverlapped=0x0) returned 1 [0153.395] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffec940, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.396] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5a50000, cbInput=0x136c0, pPaddingInfo=0x0, pbIV=0x187bf848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x187bf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x187bf848, pbOutput=0x5a50000, pcbResult=0x187bf618) returned 0x0 [0153.396] WriteFile (in: hFile=0x7f4, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x136d0, lpNumberOfBytesWritten=0x187bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x187bf61c*=0x136d0, lpOverlapped=0x0) returned 1 [0153.396] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x187bf60c | out: lpNewFilePointer=0x0) returned 1 [0153.396] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.396] WriteFile (in: hFile=0x7f4, lpBuffer=0x187bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x187bf61c, lpOverlapped=0x0 | out: lpBuffer=0x187bf83c*, lpNumberOfBytesWritten=0x187bf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.396] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x136d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.396] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.396] CloseHandle (hObject=0x7f4) returned 1 [0153.397] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fdate.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fdate.dll.play")) returned 1 [0153.398] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1315 os_tid = 0xcd8 [0153.387] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.394] ReadFile (in: hFile=0x7fc, lpBuffer=0x188ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x188ff85c, lpOverlapped=0x0 | out: lpBuffer=0x188ffb34*, lpNumberOfBytesRead=0x188ff85c*=0x428, lpOverlapped=0x0) returned 1 [0153.400] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.400] ReadFile (in: hFile=0x7fc, lpBuffer=0x188ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x188ff85c, lpOverlapped=0x0 | out: lpBuffer=0x188ffb34*, lpNumberOfBytesRead=0x188ff85c*=0x428, lpOverlapped=0x0) returned 1 [0153.400] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.401] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.401] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x188ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0153.401] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x188ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x188ff828, pbKeyObject=0x0) returned 0x0 [0153.401] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x188ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x188ff500) returned 0x0 [0153.401] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.402] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x188ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x188ff500) returned 0x0 [0153.405] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.406] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.406] WriteFile (in: hFile=0x7fc, lpBuffer=0x188ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x188ff830, lpOverlapped=0x0 | out: lpBuffer=0x188ffb34*, lpNumberOfBytesWritten=0x188ff830*=0x428, lpOverlapped=0x0) returned 1 [0153.406] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.406] ReadFile (in: hFile=0x7fc, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x26ec0, lpNumberOfBytesRead=0x188ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x188ff61c*=0x26ec0, lpOverlapped=0x0) returned 1 [0153.409] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0xfffd9140, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.409] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5b50000, cbInput=0x26ec0, pPaddingInfo=0x0, pbIV=0x188ff848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x188ff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x188ff848, pbOutput=0x5b50000, pcbResult=0x188ff618) returned 0x0 [0153.409] WriteFile (in: hFile=0x7fc, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x26ed0, lpNumberOfBytesWritten=0x188ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x188ff61c*=0x26ed0, lpOverlapped=0x0) returned 1 [0153.410] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x188ff60c | out: lpNewFilePointer=0x0) returned 1 [0153.410] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.410] WriteFile (in: hFile=0x7fc, lpBuffer=0x188ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x188ff61c, lpOverlapped=0x0 | out: lpBuffer=0x188ff83c*, lpNumberOfBytesWritten=0x188ff61c*=0x8, lpOverlapped=0x0) returned 1 [0153.410] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0x26ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.410] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.410] CloseHandle (hObject=0x7fc) returned 1 [0153.410] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.411] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fperson.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fperson.dll.play")) returned 1 [0153.411] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1316 os_tid = 0xcf4 [0153.408] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.408] ReadFile (in: hFile=0x808, lpBuffer=0x18a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x18a3fb34*, lpNumberOfBytesRead=0x18a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.417] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.418] ReadFile (in: hFile=0x808, lpBuffer=0x18a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x18a3fb34*, lpNumberOfBytesRead=0x18a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.418] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.418] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x18a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0153.418] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x18a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x18a3f828, pbKeyObject=0x0) returned 0x0 [0153.419] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x18a3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x18a3f500) returned 0x0 [0153.419] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.419] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x18a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x18a3f500) returned 0x0 [0153.423] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.424] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.424] WriteFile (in: hFile=0x808, lpBuffer=0x18a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x18a3f830, lpOverlapped=0x0 | out: lpBuffer=0x18a3fb34*, lpNumberOfBytesWritten=0x18a3f830*=0x428, lpOverlapped=0x0) returned 1 [0153.424] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.424] ReadFile (in: hFile=0x808, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x22cc0, lpNumberOfBytesRead=0x18a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x18a3f61c*=0x22cc0, lpOverlapped=0x0) returned 1 [0153.426] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffdd340, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.426] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5c50000, cbInput=0x22cc0, pPaddingInfo=0x0, pbIV=0x18a3f848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x18a3f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x18a3f848, pbOutput=0x5c50000, pcbResult=0x18a3f618) returned 0x0 [0153.426] WriteFile (in: hFile=0x808, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x22cd0, lpNumberOfBytesWritten=0x18a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x18a3f61c*=0x22cd0, lpOverlapped=0x0) returned 1 [0153.427] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18a3f60c | out: lpNewFilePointer=0x0) returned 1 [0153.427] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.427] WriteFile (in: hFile=0x808, lpBuffer=0x18a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x18a3f83c*, lpNumberOfBytesWritten=0x18a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.427] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x22cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.427] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.427] CloseHandle (hObject=0x808) returned 1 [0153.427] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fplace.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fplace.dll.play")) returned 1 [0153.429] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1317 os_tid = 0x117c [0153.425] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.425] ReadFile (in: hFile=0xa0c, lpBuffer=0x18b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x18b7fb34*, lpNumberOfBytesRead=0x18b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.433] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.433] ReadFile (in: hFile=0xa0c, lpBuffer=0x18b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x18b7fb34*, lpNumberOfBytesRead=0x18b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.433] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.434] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.434] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x18b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0153.434] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x18b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x18b7f828, pbKeyObject=0x0) returned 0x0 [0153.434] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x18b7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x18b7f500) returned 0x0 [0153.434] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.434] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x18b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x18b7f500) returned 0x0 [0153.438] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.439] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.439] WriteFile (in: hFile=0xa0c, lpBuffer=0x18b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x18b7f830, lpOverlapped=0x0 | out: lpBuffer=0x18b7fb34*, lpNumberOfBytesWritten=0x18b7f830*=0x428, lpOverlapped=0x0) returned 1 [0153.439] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.439] ReadFile (in: hFile=0xa0c, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x1eec0, lpNumberOfBytesRead=0x18b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x18b7f61c*=0x1eec0, lpOverlapped=0x0) returned 1 [0153.442] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0xfffe1140, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.442] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5d50000, cbInput=0x1eec0, pPaddingInfo=0x0, pbIV=0x18b7f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x18b7f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x18b7f848, pbOutput=0x5d50000, pcbResult=0x18b7f618) returned 0x0 [0153.442] WriteFile (in: hFile=0xa0c, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x1eed0, lpNumberOfBytesWritten=0x18b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x18b7f61c*=0x1eed0, lpOverlapped=0x0) returned 1 [0153.442] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f60c | out: lpNewFilePointer=0x0) returned 1 [0153.442] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.442] WriteFile (in: hFile=0xa0c, lpBuffer=0x18b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x18b7f83c*, lpNumberOfBytesWritten=0x18b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.443] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x1eed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.443] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.443] CloseHandle (hObject=0xa0c) returned 1 [0153.443] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fstock.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\fstock.dll.play")) returned 1 [0153.444] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1318 os_tid = 0x119c [0153.440] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.440] ReadFile (in: hFile=0xa04, lpBuffer=0x18cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x18cbfb34*, lpNumberOfBytesRead=0x18cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.447] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.447] ReadFile (in: hFile=0xa04, lpBuffer=0x18cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x18cbfb34*, lpNumberOfBytesRead=0x18cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.447] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.448] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.448] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x18cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0153.448] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x18cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x18cbf828, pbKeyObject=0x0) returned 0x0 [0153.448] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x18cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x18cbf500) returned 0x0 [0153.448] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.448] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x18cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x18cbf500) returned 0x0 [0153.461] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.465] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.466] WriteFile (in: hFile=0xa04, lpBuffer=0x18cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x18cbf830, lpOverlapped=0x0 | out: lpBuffer=0x18cbfb34*, lpNumberOfBytesWritten=0x18cbf830*=0x428, lpOverlapped=0x0) returned 1 [0153.466] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.466] ReadFile (in: hFile=0xa04, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x2e8c0, lpNumberOfBytesRead=0x18cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x18cbf61c*=0x2e8c0, lpOverlapped=0x0) returned 1 [0153.472] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffd1740, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.472] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5e50000, cbInput=0x2e8c0, pPaddingInfo=0x0, pbIV=0x18cbf848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x18cbf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x18cbf848, pbOutput=0x5e50000, pcbResult=0x18cbf618) returned 0x0 [0153.472] WriteFile (in: hFile=0xa04, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x2e8d0, lpNumberOfBytesWritten=0x18cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x18cbf61c*=0x2e8d0, lpOverlapped=0x0) returned 1 [0153.473] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cbf60c | out: lpNewFilePointer=0x0) returned 1 [0153.473] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.474] WriteFile (in: hFile=0xa04, lpBuffer=0x18cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x18cbf83c*, lpNumberOfBytesWritten=0x18cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.474] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x2e8d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.474] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.474] CloseHandle (hObject=0xa04) returned 1 [0153.474] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\ietag.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\ietag.dll.play")) returned 1 [0153.477] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1319 os_tid = 0x1198 [0153.480] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.480] ReadFile (in: hFile=0x594, lpBuffer=0x18dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18dff85c, lpOverlapped=0x0 | out: lpBuffer=0x18dffb34*, lpNumberOfBytesRead=0x18dff85c*=0x428, lpOverlapped=0x0) returned 1 [0153.482] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.482] ReadFile (in: hFile=0x594, lpBuffer=0x18dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x18dff85c, lpOverlapped=0x0 | out: lpBuffer=0x18dffb34*, lpNumberOfBytesRead=0x18dff85c*=0x428, lpOverlapped=0x0) returned 1 [0153.483] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0153.483] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0153.484] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x18dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0153.484] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x18dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x18dff828, pbKeyObject=0x0) returned 0x0 [0153.484] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x18dff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x18dff500) returned 0x0 [0153.484] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0153.484] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x18dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x18dff500) returned 0x0 [0153.487] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.488] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.488] WriteFile (in: hFile=0x594, lpBuffer=0x18dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x18dff830, lpOverlapped=0x0 | out: lpBuffer=0x18dffb34*, lpNumberOfBytesWritten=0x18dff830*=0x428, lpOverlapped=0x0) returned 1 [0153.489] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.489] ReadFile (in: hFile=0x594, lpBuffer=0x3250000, nNumberOfBytesToRead=0x134c0, lpNumberOfBytesRead=0x18dff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x18dff61c*=0x134c0, lpOverlapped=0x0) returned 1 [0153.490] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffecb40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.490] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3250000, cbInput=0x134c0, pPaddingInfo=0x0, pbIV=0x18dff848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x18dff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x18dff848, pbOutput=0x3250000, pcbResult=0x18dff618) returned 0x0 [0153.490] WriteFile (in: hFile=0x594, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x134d0, lpNumberOfBytesWritten=0x18dff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x18dff61c*=0x134d0, lpOverlapped=0x0) returned 1 [0153.491] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18dff60c | out: lpNewFilePointer=0x0) returned 1 [0153.491] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.491] WriteFile (in: hFile=0x594, lpBuffer=0x18dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18dff61c, lpOverlapped=0x0 | out: lpBuffer=0x18dff83c*, lpNumberOfBytesWritten=0x18dff61c*=0x8, lpOverlapped=0x0) returned 1 [0153.491] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x134d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.491] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.491] CloseHandle (hObject=0x594) returned 1 [0153.491] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\imcontact.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\imcontact.dll.play")) returned 1 [0153.493] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1320 os_tid = 0x112c [0153.614] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.615] ReadFile (in: hFile=0xa04, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.616] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.617] ReadFile (in: hFile=0xa04, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.617] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.618] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.618] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0153.618] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0153.618] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0153.618] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.618] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0153.623] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.625] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.625] WriteFile (in: hFile=0xa04, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0153.626] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.626] ReadFile (in: hFile=0xa04, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0xe9f61c*=0x22d6, lpOverlapped=0x0) returned 1 [0153.629] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xffffdd2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.629] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5f50000, cbInput=0x22d6, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xe9f848, pbOutput=0x5f50000, pcbResult=0xe9f618) returned 0x0 [0153.629] WriteFile (in: hFile=0xa04, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0xe9f61c*=0x22e0, lpOverlapped=0x0) returned 1 [0153.629] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0153.629] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.629] WriteFile (in: hFile=0xa04, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.629] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x22e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.629] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.629] CloseHandle (hObject=0xa04) returned 1 [0153.630] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.play")) returned 1 [0153.632] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1321 os_tid = 0x1194 [0153.628] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.634] ReadFile (in: hFile=0x2c0, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.636] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.637] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.637] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0153.637] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0153.637] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0153.637] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.637] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0153.643] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.645] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.645] WriteFile (in: hFile=0x2c0, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0153.645] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.645] ReadFile (in: hFile=0x2c0, lpBuffer=0x2750000, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x734, lpOverlapped=0x0) returned 1 [0153.645] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffff8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.645] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2750000, cbInput=0x734, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0153.645] WriteFile (in: hFile=0x2c0, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x740, lpOverlapped=0x0) returned 1 [0153.646] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0153.646] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.646] WriteFile (in: hFile=0x2c0, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.646] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.646] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.646] CloseHandle (hObject=0x2c0) returned 1 [0153.646] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.play")) returned 1 [0153.648] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1322 os_tid = 0x11a0 [0153.650] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.650] ReadFile (in: hFile=0x208, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.651] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.651] ReadFile (in: hFile=0x208, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.652] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.652] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.653] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0153.653] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0153.653] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0153.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.653] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0153.656] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.657] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.657] WriteFile (in: hFile=0x208, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0153.658] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.658] ReadFile (in: hFile=0x208, lpBuffer=0x2850000, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xed0f61c*=0x2174, lpOverlapped=0x0) returned 1 [0153.658] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xffffde8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.659] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2850000, cbInput=0x2174, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xed0f848, pbOutput=0x2850000, pcbResult=0xed0f618) returned 0x0 [0153.659] WriteFile (in: hFile=0x208, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xed0f61c*=0x2180, lpOverlapped=0x0) returned 1 [0153.659] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0153.659] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.659] WriteFile (in: hFile=0x208, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.659] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.659] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.659] CloseHandle (hObject=0x208) returned 1 [0153.659] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.play")) returned 1 [0153.660] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1323 os_tid = 0x11a8 [0153.664] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.664] ReadFile (in: hFile=0x5a0, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.667] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.667] ReadFile (in: hFile=0x5a0, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.668] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.670] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.670] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0153.670] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0153.670] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0153.670] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.670] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0153.676] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.677] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.678] WriteFile (in: hFile=0x5a0, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0153.678] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.678] ReadFile (in: hFile=0x5a0, lpBuffer=0x2950000, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xee4f61c*=0x377ef, lpOverlapped=0x0) returned 1 [0153.683] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0xfffc8811, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.683] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2950000, cbInput=0x377ef, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xee4f848, pbOutput=0x2950000, pcbResult=0xee4f618) returned 0x0 [0153.684] WriteFile (in: hFile=0x5a0, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xee4f61c*=0x377f0, lpOverlapped=0x0) returned 1 [0153.686] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0153.686] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.686] WriteFile (in: hFile=0x5a0, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.686] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x377f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.686] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.686] CloseHandle (hObject=0x5a0) returned 1 [0153.686] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.688] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.play")) returned 1 [0153.689] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1324 os_tid = 0x11ac [0153.691] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.692] ReadFile (in: hFile=0x59c, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.693] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.693] ReadFile (in: hFile=0x59c, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.693] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.694] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0153.694] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0153.694] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0153.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.694] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0153.698] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.699] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.699] WriteFile (in: hFile=0x59c, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0153.699] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.700] ReadFile (in: hFile=0x59c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x180c0, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xef8f61c*=0x180c0, lpOverlapped=0x0) returned 1 [0153.701] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffe7f40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.701] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2a50000, cbInput=0x180c0, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xef8f848, pbOutput=0x2a50000, pcbResult=0xef8f618) returned 0x0 [0153.701] WriteFile (in: hFile=0x59c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x180d0, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xef8f61c*=0x180d0, lpOverlapped=0x0) returned 1 [0153.702] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0153.702] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.702] WriteFile (in: hFile=0x59c, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.702] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x180d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.702] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.702] CloseHandle (hObject=0x59c) returned 1 [0153.702] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\metconv.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\metconv.dll.play")) returned 1 [0153.704] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1325 os_tid = 0x127c [0153.706] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.706] ReadFile (in: hFile=0x7d0, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.707] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.707] ReadFile (in: hFile=0x7d0, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.707] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.708] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.708] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0153.708] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0153.708] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0153.709] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.709] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0153.712] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.713] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.713] WriteFile (in: hFile=0x7d0, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0153.780] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.780] ReadFile (in: hFile=0x7d0, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xf0cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.793] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.793] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2b50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x0 | out: hKey=0x1a6d8080, pbIV=0xf0cf848, pbOutput=0x2b50000, pcbResult=0xf0cf618) returned 0x0 [0153.795] WriteFile (in: hFile=0x7d0, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xf0cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0153.798] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0153.799] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.799] WriteFile (in: hFile=0x7d0, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.799] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.799] ReadFile (in: hFile=0x7d0, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x20eb8, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xf0cf61c*=0x20eb8, lpOverlapped=0x0) returned 1 [0153.800] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfffdf148, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.801] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2b50000, cbInput=0x20eb8, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf0cf848, pbOutput=0x2b50000, pcbResult=0xf0cf618) returned 0x0 [0153.801] WriteFile (in: hFile=0x7d0, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x20ec0, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xf0cf61c*=0x20ec0, lpOverlapped=0x0) returned 1 [0153.801] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0153.801] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.801] WriteFile (in: hFile=0x7d0, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.802] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x120ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.802] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.802] CloseHandle (hObject=0x7d0) returned 1 [0153.802] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\metconv.txt.play")) returned 1 [0153.804] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1326 os_tid = 0x1154 [0153.806] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.806] ReadFile (in: hFile=0x7c8, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.808] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.808] ReadFile (in: hFile=0x7c8, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.808] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.809] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.809] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0153.809] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0153.809] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0153.809] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.809] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0153.814] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.816] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.816] WriteFile (in: hFile=0x7c8, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0153.816] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.816] ReadFile (in: hFile=0x7c8, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x3dac0, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xf34f61c*=0x3dac0, lpOverlapped=0x0) returned 1 [0153.828] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffc2540, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.828] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2c50000, cbInput=0x3dac0, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf34f848, pbOutput=0x2c50000, pcbResult=0xf34f618) returned 0x0 [0153.829] WriteFile (in: hFile=0x7c8, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x3dad0, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xf34f61c*=0x3dad0, lpOverlapped=0x0) returned 1 [0153.830] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0153.830] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.830] WriteFile (in: hFile=0x7c8, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.830] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x3dad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.830] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.830] CloseHandle (hObject=0x7c8) returned 1 [0153.830] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\mofl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\mofl.dll.play")) returned 1 [0153.832] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1327 os_tid = 0x130c [0153.835] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.835] ReadFile (in: hFile=0x7b4, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.837] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.837] ReadFile (in: hFile=0x7b4, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.839] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0153.839] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0153.839] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0153.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.839] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0153.844] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.846] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.846] WriteFile (in: hFile=0x7b4, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0153.846] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.846] ReadFile (in: hFile=0x7b4, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xf48f61c*=0x3574, lpOverlapped=0x0) returned 1 [0153.847] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xffffca8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.847] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2d50000, cbInput=0x3574, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf48f848, pbOutput=0x2d50000, pcbResult=0xf48f618) returned 0x0 [0153.847] WriteFile (in: hFile=0x7b4, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xf48f61c*=0x3580, lpOverlapped=0x0) returned 1 [0153.847] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0153.848] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.848] WriteFile (in: hFile=0x7b4, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.848] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x3580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.848] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.848] CloseHandle (hObject=0x7b4) returned 1 [0153.848] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\smart tag\\mstag.tlb.play")) returned 1 [0153.850] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1328 os_tid = 0x1338 [0153.837] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.847] ReadFile (in: hFile=0x7ac, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.854] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.854] ReadFile (in: hFile=0x7ac, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.854] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.855] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.855] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0153.855] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0153.855] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0153.856] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.856] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0153.862] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.864] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.864] WriteFile (in: hFile=0x7ac, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0153.865] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.865] ReadFile (in: hFile=0x7ac, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x318b0, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xfe4f61c*=0x318b0, lpOverlapped=0x0) returned 1 [0153.872] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffce750, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.872] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2e50000, cbInput=0x318b0, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xfe4f848, pbOutput=0x2e50000, pcbResult=0xfe4f618) returned 0x0 [0153.872] WriteFile (in: hFile=0x7ac, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x318c0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xfe4f61c*=0x318c0, lpOverlapped=0x0) returned 1 [0153.873] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0153.873] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.873] WriteFile (in: hFile=0x7ac, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.873] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x318c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.873] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.873] CloseHandle (hObject=0x7ac) returned 1 [0153.874] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0153.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\source engine\\ose.exe.play")) returned 1 [0153.875] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1329 os_tid = 0x1308 [0153.865] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.866] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.867] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0153.867] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0153.867] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0153.867] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.867] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0153.881] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.882] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.882] WriteFile (in: hFile=0x7a4, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.885] ReadFile (in: hFile=0x7a4, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x100cf61c*=0x285, lpOverlapped=0x0) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0xfffffd7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.885] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2f50000, cbInput=0x285, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x100cf848, pbOutput=0x2f50000, pcbResult=0x100cf618) returned 0x0 [0153.885] WriteFile (in: hFile=0x7a4, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x100cf61c*=0x290, lpOverlapped=0x0) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.885] WriteFile (in: hFile=0x7a4, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.885] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0153.885] CloseHandle (hObject=0x7a4) returned 1 [0153.886] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\desktop.ini.play")) returned 1 [0153.887] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1330 os_tid = 0x1364 [0153.891] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.891] ReadFile (in: hFile=0x79c, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.893] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.893] ReadFile (in: hFile=0x79c, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.893] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.894] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.894] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0153.894] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0153.894] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0153.894] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.894] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0153.899] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.900] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.901] WriteFile (in: hFile=0x79c, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0153.901] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.901] ReadFile (in: hFile=0x79c, lpBuffer=0x3050000, nNumberOfBytesToRead=0x1eac0, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1034f61c*=0x1eac0, lpOverlapped=0x0) returned 1 [0153.903] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffe1540, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.903] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3050000, cbInput=0x1eac0, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1034f848, pbOutput=0x3050000, pcbResult=0x1034f618) returned 0x0 [0153.903] WriteFile (in: hFile=0x79c, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1ead0, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1034f61c*=0x1ead0, lpOverlapped=0x0) returned 1 [0153.905] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0153.905] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.905] WriteFile (in: hFile=0x79c, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.905] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x1ead0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.905] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.905] CloseHandle (hObject=0x79c) returned 1 [0153.905] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\msconv97.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\msconv97.dll.play")) returned 1 [0153.913] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1331 os_tid = 0x1334 [0153.901] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.902] ReadFile (in: hFile=0x794, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.916] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.917] ReadFile (in: hFile=0x794, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.917] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.918] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0153.918] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0153.918] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0153.918] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.918] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0153.923] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.924] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.924] WriteFile (in: hFile=0x794, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0153.925] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.925] ReadFile (in: hFile=0x794, lpBuffer=0x3150000, nNumberOfBytesToRead=0x8ab0, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x1048f61c*=0x8ab0, lpOverlapped=0x0) returned 1 [0153.926] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0xffff7550, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.926] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3150000, cbInput=0x8ab0, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1048f848, pbOutput=0x3150000, pcbResult=0x1048f618) returned 0x0 [0153.926] WriteFile (in: hFile=0x794, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x8ac0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x1048f61c*=0x8ac0, lpOverlapped=0x0) returned 1 [0153.926] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0153.926] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.926] WriteFile (in: hFile=0x794, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.927] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x8ac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.927] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.927] CloseHandle (hObject=0x794) returned 1 [0153.927] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\recovr32.cnv.play")) returned 1 [0153.928] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1332 os_tid = 0x1324 [0153.925] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.931] ReadFile (in: hFile=0x588, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.933] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.933] ReadFile (in: hFile=0x588, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.933] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.934] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.934] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0153.934] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0153.934] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0153.934] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.934] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0153.939] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.940] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.940] WriteFile (in: hFile=0x588, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0153.944] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.944] ReadFile (in: hFile=0x588, lpBuffer=0x3250000, nNumberOfBytesToRead=0x3ec8, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x1070f61c*=0x3ec8, lpOverlapped=0x0) returned 1 [0153.945] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0xffffc138, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.945] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3250000, cbInput=0x3ec8, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1070f848, pbOutput=0x3250000, pcbResult=0x1070f618) returned 0x0 [0153.945] WriteFile (in: hFile=0x588, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x3ed0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x1070f61c*=0x3ed0, lpOverlapped=0x0) returned 1 [0153.945] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0153.945] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.945] WriteFile (in: hFile=0x588, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.946] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x3ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.946] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.946] CloseHandle (hObject=0x588) returned 1 [0153.946] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\WPEQU532.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wpequ532.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\WPEQU532.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wpequ532.dll.play")) returned 1 [0153.948] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1333 os_tid = 0x132c [0153.950] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.950] ReadFile (in: hFile=0x580, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.952] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.952] ReadFile (in: hFile=0x580, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0153.952] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.953] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.953] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0153.954] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0153.954] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0153.954] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.954] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0153.958] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.960] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.960] WriteFile (in: hFile=0x580, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0153.960] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.960] ReadFile (in: hFile=0x580, lpBuffer=0x3350000, nNumberOfBytesToRead=0x2e0b8, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x1084f61c*=0x2e0b8, lpOverlapped=0x0) returned 1 [0153.963] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0xfffd1f48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.963] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3350000, cbInput=0x2e0b8, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1084f848, pbOutput=0x3350000, pcbResult=0x1084f618) returned 0x0 [0153.963] WriteFile (in: hFile=0x580, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x2e0c0, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1084f61c*=0x2e0c0, lpOverlapped=0x0) returned 1 [0153.964] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0153.964] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.964] WriteFile (in: hFile=0x580, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0153.964] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x2e0c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.964] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.964] CloseHandle (hObject=0x580) returned 1 [0153.964] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wpft532.cnv.play")) returned 1 [0153.966] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1334 os_tid = 0x1330 [0153.961] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.961] ReadFile (in: hFile=0x578, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.973] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.973] ReadFile (in: hFile=0x578, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0153.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0153.974] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0153.974] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0153.974] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0153.974] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0153.974] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0153.974] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0153.979] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.980] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.980] WriteFile (in: hFile=0x578, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0153.981] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.981] ReadFile (in: hFile=0x578, lpBuffer=0x3450000, nNumberOfBytesToRead=0x3acc0, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x10acf61c*=0x3acc0, lpOverlapped=0x0) returned 1 [0153.985] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffc5340, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.985] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3450000, cbInput=0x3acc0, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10acf848, pbOutput=0x3450000, pcbResult=0x10acf618) returned 0x0 [0153.985] WriteFile (in: hFile=0x578, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x3acd0, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10acf61c*=0x3acd0, lpOverlapped=0x0) returned 1 [0153.986] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0153.986] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.986] WriteFile (in: hFile=0x578, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0153.986] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x3acd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.986] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0153.986] CloseHandle (hObject=0x578) returned 1 [0153.987] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0153.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\wpft632.cnv.play")) returned 1 [0153.988] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1335 os_tid = 0x1340 [0154.034] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.035] ReadFile (in: hFile=0x578, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.036] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.037] ReadFile (in: hFile=0x578, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.037] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.040] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.040] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0154.040] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0154.040] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0154.041] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.041] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0154.046] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.047] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.048] WriteFile (in: hFile=0x578, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0154.048] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.048] ReadFile (in: hFile=0x578, lpBuffer=0x3550000, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0xe9f61c*=0xe58e, lpOverlapped=0x0) returned 1 [0154.050] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xffff1a72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.050] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3550000, cbInput=0xe58e, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xe9f848, pbOutput=0x3550000, pcbResult=0xe9f618) returned 0x0 [0154.050] WriteFile (in: hFile=0x578, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0xe9f61c*=0xe590, lpOverlapped=0x0) returned 1 [0154.051] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0154.051] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.051] WriteFile (in: hFile=0x578, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.051] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xe590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.051] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.051] CloseHandle (hObject=0x578) returned 1 [0154.051] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0154.052] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.elm.play")) returned 1 [0154.053] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1336 os_tid = 0x1328 [0154.048] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.055] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.055] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0154.055] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0154.055] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0154.056] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.056] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0154.061] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.062] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.062] WriteFile (in: hFile=0x588, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0154.065] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.065] ReadFile (in: hFile=0x588, lpBuffer=0x2750000, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x22b, lpOverlapped=0x0) returned 1 [0154.065] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0xfffffdd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.065] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2750000, cbInput=0x22b, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0154.065] WriteFile (in: hFile=0x588, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x230, lpOverlapped=0x0) returned 1 [0154.065] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0154.066] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.066] WriteFile (in: hFile=0x588, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.066] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.066] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.066] CloseHandle (hObject=0x588) returned 1 [0154.066] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.inf.play")) returned 1 [0154.069] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1337 os_tid = 0x12f8 [0154.071] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.072] ReadFile (in: hFile=0x79c, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.073] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.074] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.074] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0154.074] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0154.074] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0154.075] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.075] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0154.080] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.081] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.081] WriteFile (in: hFile=0x79c, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0154.082] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.082] ReadFile (in: hFile=0x79c, lpBuffer=0x2850000, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xebcf61c*=0x621, lpOverlapped=0x0) returned 1 [0154.082] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffff9df, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.082] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2850000, cbInput=0x621, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xebcf848, pbOutput=0x2850000, pcbResult=0xebcf618) returned 0x0 [0154.082] WriteFile (in: hFile=0x79c, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xebcf61c*=0x630, lpOverlapped=0x0) returned 1 [0154.082] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0154.082] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.082] WriteFile (in: hFile=0x79c, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0154.082] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.082] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.082] CloseHandle (hObject=0x79c) returned 1 [0154.083] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\preview.gif.play")) returned 1 [0154.084] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1338 os_tid = 0x1300 [0154.088] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.088] ReadFile (in: hFile=0x7ac, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.093] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.093] ReadFile (in: hFile=0x7ac, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.093] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.094] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.094] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0154.094] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0154.094] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0154.095] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.095] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0154.099] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.101] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.101] WriteFile (in: hFile=0x7ac, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0154.102] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.102] ReadFile (in: hFile=0x7ac, lpBuffer=0x2950000, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xed0f61c*=0x6292, lpOverlapped=0x0) returned 1 [0154.103] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xffff9d6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.103] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2950000, cbInput=0x6292, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xed0f848, pbOutput=0x2950000, pcbResult=0xed0f618) returned 0x0 [0154.103] WriteFile (in: hFile=0x7ac, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xed0f61c*=0x62a0, lpOverlapped=0x0) returned 1 [0154.103] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0154.103] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.103] WriteFile (in: hFile=0x7ac, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.103] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x62a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.103] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.103] CloseHandle (hObject=0x7ac) returned 1 [0154.104] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png.play")) returned 1 [0154.106] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1339 os_tid = 0x1304 [0154.102] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.108] ReadFile (in: hFile=0x7c8, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.110] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.110] ReadFile (in: hFile=0x7c8, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.110] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.111] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.111] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0154.111] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0154.111] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0154.112] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.112] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0154.117] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.118] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.118] WriteFile (in: hFile=0x7c8, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0154.119] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.119] ReadFile (in: hFile=0x7c8, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xee4f61c*=0x10fc7, lpOverlapped=0x0) returned 1 [0154.121] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffef039, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.121] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2a50000, cbInput=0x10fc7, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xee4f848, pbOutput=0x2a50000, pcbResult=0xee4f618) returned 0x0 [0154.121] WriteFile (in: hFile=0x7c8, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xee4f61c*=0x10fd0, lpOverlapped=0x0) returned 1 [0154.121] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0154.121] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.121] WriteFile (in: hFile=0x7c8, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.121] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x10fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.121] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.121] CloseHandle (hObject=0x7c8) returned 1 [0154.122] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\arctic.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\arctic.elm.play")) returned 1 [0154.123] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1340 os_tid = 0x1314 [0154.120] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.126] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.126] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0154.126] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0154.126] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0154.126] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.127] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0154.131] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.132] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.133] WriteFile (in: hFile=0x59c, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0154.151] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.151] ReadFile (in: hFile=0x59c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xef8f61c*=0x201, lpOverlapped=0x0) returned 1 [0154.151] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffdff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.151] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2b50000, cbInput=0x201, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xef8f848, pbOutput=0x2b50000, pcbResult=0xef8f618) returned 0x0 [0154.151] WriteFile (in: hFile=0x59c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xef8f61c*=0x210, lpOverlapped=0x0) returned 1 [0154.152] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0154.152] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.152] WriteFile (in: hFile=0x59c, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.152] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.152] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.152] CloseHandle (hObject=0x59c) returned 1 [0154.152] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.153] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\arctic.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\arctic.inf.play")) returned 1 [0154.161] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1341 os_tid = 0x1320 [0154.135] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.135] ReadFile (in: hFile=0x208, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.137] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.137] ReadFile (in: hFile=0x208, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.137] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.139] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.139] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0154.139] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0154.139] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0154.139] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.139] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0154.144] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.146] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.146] WriteFile (in: hFile=0x208, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0154.146] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.146] ReadFile (in: hFile=0x208, lpBuffer=0x2c50000, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xf34f61c*=0xba9, lpOverlapped=0x0) returned 1 [0154.146] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffff457, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.146] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2c50000, cbInput=0xba9, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xf34f848, pbOutput=0x2c50000, pcbResult=0xf34f618) returned 0x0 [0154.146] WriteFile (in: hFile=0x208, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xf34f61c*=0xbb0, lpOverlapped=0x0) returned 1 [0154.147] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0154.147] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.147] WriteFile (in: hFile=0x208, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.147] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xbb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.147] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0154.147] CloseHandle (hObject=0x208) returned 1 [0154.147] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\preview.gif.play")) returned 1 [0154.149] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1342 os_tid = 0x12fc [0154.159] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.163] ReadFile (in: hFile=0xa04, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.165] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.165] ReadFile (in: hFile=0xa04, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.165] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.166] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.166] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0154.166] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0154.166] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0154.167] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.167] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0154.172] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.173] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.174] WriteFile (in: hFile=0xa04, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0154.174] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.174] ReadFile (in: hFile=0xa04, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xf48f61c*=0x4d44, lpOverlapped=0x0) returned 1 [0154.175] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xffffb2bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.175] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2d50000, cbInput=0x4d44, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf48f848, pbOutput=0x2d50000, pcbResult=0xf48f618) returned 0x0 [0154.175] WriteFile (in: hFile=0xa04, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xf48f61c*=0x4d50, lpOverlapped=0x0) returned 1 [0154.175] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0154.176] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.176] WriteFile (in: hFile=0xa04, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.176] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x4d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.176] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.176] CloseHandle (hObject=0xa04) returned 1 [0154.176] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.177] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\arctic\\thmbnail.png.play")) returned 1 [0154.178] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1343 os_tid = 0x794 [0154.175] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.180] ReadFile (in: hFile=0x52c, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.182] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.182] ReadFile (in: hFile=0x52c, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.182] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.183] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0154.183] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0154.183] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0154.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.183] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0154.188] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.189] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.190] WriteFile (in: hFile=0x52c, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0154.190] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.190] ReadFile (in: hFile=0x52c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xfe4f61c*=0x189be, lpOverlapped=0x0) returned 1 [0154.192] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffe7642, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.192] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2e50000, cbInput=0x189be, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xfe4f848, pbOutput=0x2e50000, pcbResult=0xfe4f618) returned 0x0 [0154.193] WriteFile (in: hFile=0x52c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xfe4f61c*=0x189c0, lpOverlapped=0x0) returned 1 [0154.193] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0154.193] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.193] WriteFile (in: hFile=0x52c, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.193] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x189c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.193] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.194] CloseHandle (hObject=0x52c) returned 1 [0154.194] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\axis.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\axis.elm.play")) returned 1 [0154.196] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1344 os_tid = 0x12f4 [0154.198] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.199] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0154.199] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0154.199] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0154.200] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.200] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0154.257] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.258] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.258] WriteFile (in: hFile=0x65c, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.261] ReadFile (in: hFile=0x65c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x100cf61c*=0x211, lpOverlapped=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xfffffdef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.261] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2f50000, cbInput=0x211, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x100cf848, pbOutput=0x2f50000, pcbResult=0x100cf618) returned 0x0 [0154.261] WriteFile (in: hFile=0x65c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x100cf61c*=0x220, lpOverlapped=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.261] WriteFile (in: hFile=0x65c, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.261] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.261] CloseHandle (hObject=0x65c) returned 1 [0154.262] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\axis.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\axis.inf.play")) returned 1 [0154.264] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1345 os_tid = 0x86c [0154.266] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.266] ReadFile (in: hFile=0x4d8, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.268] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.268] ReadFile (in: hFile=0x4d8, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.268] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.269] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.269] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0154.269] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0154.269] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0154.269] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.269] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0154.274] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.276] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.276] WriteFile (in: hFile=0x4d8, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0154.276] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.276] ReadFile (in: hFile=0x4d8, lpBuffer=0x3050000, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1034f61c*=0xb20, lpOverlapped=0x0) returned 1 [0154.276] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffff4e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.276] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3050000, cbInput=0xb20, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1034f848, pbOutput=0x3050000, pcbResult=0x1034f618) returned 0x0 [0154.276] WriteFile (in: hFile=0x4d8, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1034f61c*=0xb30, lpOverlapped=0x0) returned 1 [0154.277] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0154.277] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.277] WriteFile (in: hFile=0x4d8, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.277] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xb30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.277] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.277] CloseHandle (hObject=0x4d8) returned 1 [0154.277] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\preview.gif.play")) returned 1 [0154.281] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1346 os_tid = 0xae0 [0154.288] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.288] ReadFile (in: hFile=0x3a8, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.289] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.290] ReadFile (in: hFile=0x3a8, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.290] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.291] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0154.291] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0154.291] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0154.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.291] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0154.297] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.299] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.299] WriteFile (in: hFile=0x3a8, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0154.300] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.300] ReadFile (in: hFile=0x3a8, lpBuffer=0x3150000, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x1048f61c*=0x8864, lpOverlapped=0x0) returned 1 [0154.301] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xffff779c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.301] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3150000, cbInput=0x8864, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1048f848, pbOutput=0x3150000, pcbResult=0x1048f618) returned 0x0 [0154.301] WriteFile (in: hFile=0x3a8, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x1048f61c*=0x8870, lpOverlapped=0x0) returned 1 [0154.302] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0154.302] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.302] WriteFile (in: hFile=0x3a8, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.302] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x8870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.302] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.302] CloseHandle (hObject=0x3a8) returned 1 [0154.302] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\axis\\thmbnail.png.play")) returned 1 [0154.304] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1347 os_tid = 0x12c4 [0154.301] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.301] ReadFile (in: hFile=0x3a0, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.308] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.308] ReadFile (in: hFile=0x3a0, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.308] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.309] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0154.309] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0154.309] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0154.310] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.310] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0154.314] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.316] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.316] WriteFile (in: hFile=0x3a0, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0154.317] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.317] ReadFile (in: hFile=0x3a0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x1070f61c*=0x10db7, lpOverlapped=0x0) returned 1 [0154.319] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffef249, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.319] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3250000, cbInput=0x10db7, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1070f848, pbOutput=0x3250000, pcbResult=0x1070f618) returned 0x0 [0154.319] WriteFile (in: hFile=0x3a0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x1070f61c*=0x10dc0, lpOverlapped=0x0) returned 1 [0154.319] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0154.319] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.319] WriteFile (in: hFile=0x3a0, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.320] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x10dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.320] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.320] CloseHandle (hObject=0x3a0) returned 1 [0154.320] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0154.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\blends.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\blends.elm.play")) returned 1 [0154.322] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1348 os_tid = 0x87c [0154.317] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.324] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.324] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0154.324] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0154.324] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0154.324] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.324] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0154.329] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.331] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.331] WriteFile (in: hFile=0x390, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0154.333] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.333] ReadFile (in: hFile=0x390, lpBuffer=0x3350000, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x1084f61c*=0x216, lpOverlapped=0x0) returned 1 [0154.334] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.334] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3350000, cbInput=0x216, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1084f848, pbOutput=0x3350000, pcbResult=0x1084f618) returned 0x0 [0154.334] WriteFile (in: hFile=0x390, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1084f61c*=0x220, lpOverlapped=0x0) returned 1 [0154.334] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0154.334] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.334] WriteFile (in: hFile=0x390, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.334] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.334] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.334] CloseHandle (hObject=0x390) returned 1 [0154.334] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\blends.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\blends.inf.play")) returned 1 [0154.336] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1349 os_tid = 0x12c8 [0154.339] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.339] ReadFile (in: hFile=0x940, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.340] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.340] ReadFile (in: hFile=0x940, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.341] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.342] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0154.342] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0154.342] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0154.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.342] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0154.347] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.349] WriteFile (in: hFile=0x940, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.349] ReadFile (in: hFile=0x940, lpBuffer=0x3450000, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x10acf61c*=0x885, lpOverlapped=0x0) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffff77b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.349] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3450000, cbInput=0x885, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10acf848, pbOutput=0x3450000, pcbResult=0x10acf618) returned 0x0 [0154.349] WriteFile (in: hFile=0x940, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x10acf61c*=0x890, lpOverlapped=0x0) returned 1 [0154.350] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0154.350] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.350] WriteFile (in: hFile=0x940, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0154.350] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.350] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.350] CloseHandle (hObject=0x940) returned 1 [0154.350] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\preview.gif.play")) returned 1 [0154.353] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1350 os_tid = 0x13f0 [0154.356] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.356] ReadFile (in: hFile=0x37c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.358] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.358] ReadFile (in: hFile=0x37c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.358] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.359] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.360] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0154.360] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0154.360] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0154.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.360] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0154.365] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.366] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.366] WriteFile (in: hFile=0x37c, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0154.367] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.367] ReadFile (in: hFile=0x37c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x10c0f61c*=0x5093, lpOverlapped=0x0) returned 1 [0154.368] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xffffaf6d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.368] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3650000, cbInput=0x5093, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10c0f848, pbOutput=0x3650000, pcbResult=0x10c0f618) returned 0x0 [0154.368] WriteFile (in: hFile=0x37c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x10c0f61c*=0x50a0, lpOverlapped=0x0) returned 1 [0154.368] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0154.368] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.368] WriteFile (in: hFile=0x37c, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.368] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x50a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.368] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.368] CloseHandle (hObject=0x37c) returned 1 [0154.369] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blends\\thmbnail.png.play")) returned 1 [0154.370] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1351 os_tid = 0xb0c [0154.373] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.373] ReadFile (in: hFile=0x938, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.375] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.375] ReadFile (in: hFile=0x938, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.375] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.376] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.376] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0154.376] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0154.376] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0154.376] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.376] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0154.381] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.382] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.382] WriteFile (in: hFile=0x938, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0154.383] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.383] ReadFile (in: hFile=0x938, lpBuffer=0x3750000, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x10d4f61c*=0xc2ba, lpOverlapped=0x0) returned 1 [0154.384] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xffff3d46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.384] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3750000, cbInput=0xc2ba, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10d4f848, pbOutput=0x3750000, pcbResult=0x10d4f618) returned 0x0 [0154.384] WriteFile (in: hFile=0x938, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x10d4f61c*=0xc2c0, lpOverlapped=0x0) returned 1 [0154.385] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0154.385] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.385] WriteFile (in: hFile=0x938, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.385] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xc2c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.385] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.385] CloseHandle (hObject=0x938) returned 1 [0154.385] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\bluecalm.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\bluecalm.elm.play")) returned 1 [0154.387] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1352 os_tid = 0x13fc [0154.405] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.407] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0154.407] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0154.407] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0154.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.407] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0154.412] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.413] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.414] WriteFile (in: hFile=0x824, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0154.416] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.416] ReadFile (in: hFile=0x824, lpBuffer=0x3850000, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x10e8f61c*=0x227, lpOverlapped=0x0) returned 1 [0154.416] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xfffffdd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.416] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3850000, cbInput=0x227, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10e8f848, pbOutput=0x3850000, pcbResult=0x10e8f618) returned 0x0 [0154.417] WriteFile (in: hFile=0x824, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x10e8f61c*=0x230, lpOverlapped=0x0) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.417] WriteFile (in: hFile=0x824, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.417] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.417] CloseHandle (hObject=0x824) returned 1 [0154.417] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\bluecalm.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\bluecalm.inf.play")) returned 1 [0154.422] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1353 os_tid = 0x131c [0154.424] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.424] ReadFile (in: hFile=0x834, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.426] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.428] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0154.428] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0154.428] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0154.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.428] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0154.433] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.434] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.434] WriteFile (in: hFile=0x834, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0154.436] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.436] ReadFile (in: hFile=0x834, lpBuffer=0x3950000, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x10fcf61c*=0x618, lpOverlapped=0x0) returned 1 [0154.436] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffff9e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.436] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3950000, cbInput=0x618, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10fcf848, pbOutput=0x3950000, pcbResult=0x10fcf618) returned 0x0 [0154.436] WriteFile (in: hFile=0x834, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x10fcf61c*=0x620, lpOverlapped=0x0) returned 1 [0154.436] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0154.436] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.436] WriteFile (in: hFile=0x834, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0154.436] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.436] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.436] CloseHandle (hObject=0x834) returned 1 [0154.437] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\preview.gif.play")) returned 1 [0154.439] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1354 os_tid = 0x13a8 [0154.441] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.441] ReadFile (in: hFile=0x284, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.455] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.455] ReadFile (in: hFile=0x284, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.455] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.456] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.456] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0154.457] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0154.457] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0154.457] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.457] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0154.462] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.464] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.464] WriteFile (in: hFile=0x284, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0154.464] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.464] ReadFile (in: hFile=0x284, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1110f61c*=0x80f1, lpOverlapped=0x0) returned 1 [0154.467] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffff7f0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.467] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x3a50000, cbInput=0x80f1, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x1110f848, pbOutput=0x3a50000, pcbResult=0x1110f618) returned 0x0 [0154.467] WriteFile (in: hFile=0x284, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1110f61c*=0x8100, lpOverlapped=0x0) returned 1 [0154.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0154.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.468] WriteFile (in: hFile=0x284, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x8100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.468] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0154.468] CloseHandle (hObject=0x284) returned 1 [0154.468] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\bluecalm\\thmbnail.png.play")) returned 1 [0154.470] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1355 os_tid = 0x1140 [0154.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.443] ReadFile (in: hFile=0x27c, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.445] ReadFile (in: hFile=0x27c, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.446] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.447] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.447] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0154.447] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0154.447] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1124f500) returned 0x0 [0154.447] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.448] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1124f500) returned 0x0 [0154.453] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.454] WriteFile (in: hFile=0x27c, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0154.455] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.455] ReadFile (in: hFile=0x27c, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1124f61c*=0xda86, lpOverlapped=0x0) returned 1 [0154.465] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffff257a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.466] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3b50000, cbInput=0xda86, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1124f848, pbOutput=0x3b50000, pcbResult=0x1124f618) returned 0x0 [0154.466] WriteFile (in: hFile=0x27c, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1124f61c*=0xda90, lpOverlapped=0x0) returned 1 [0154.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0154.467] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.467] WriteFile (in: hFile=0x27c, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.467] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xda90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.467] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.467] CloseHandle (hObject=0x27c) returned 1 [0154.473] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\blueprnt.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\blueprnt.elm.play")) returned 1 [0154.474] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1356 os_tid = 0x13a4 [0154.445] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.528] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.528] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x1138f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0154.528] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x1138f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x1138f828, pbKeyObject=0x0) returned 0x0 [0154.528] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1138f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1138f500) returned 0x0 [0154.528] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.528] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1138f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1138f500) returned 0x0 [0154.532] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.534] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.534] WriteFile (in: hFile=0x26c, lpBuffer=0x1138fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1138f830, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesWritten=0x1138f830*=0x428, lpOverlapped=0x0) returned 1 [0154.536] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.536] ReadFile (in: hFile=0x26c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x1138f61c*=0x225, lpOverlapped=0x0) returned 1 [0154.536] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xfffffddb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.537] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3c50000, cbInput=0x225, pPaddingInfo=0x0, pbIV=0x1138f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x1138f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1138f848, pbOutput=0x3c50000, pcbResult=0x1138f618) returned 0x0 [0154.537] WriteFile (in: hFile=0x26c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x1138f61c*=0x230, lpOverlapped=0x0) returned 1 [0154.537] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1138f60c | out: lpNewFilePointer=0x0) returned 1 [0154.537] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.537] WriteFile (in: hFile=0x26c, lpBuffer=0x1138f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x1138f83c*, lpNumberOfBytesWritten=0x1138f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.537] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.537] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.537] CloseHandle (hObject=0x26c) returned 1 [0154.537] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\blueprnt.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\blueprnt.inf.play")) returned 1 [0154.541] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1357 os_tid = 0x1398 [0154.543] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.543] ReadFile (in: hFile=0x358, lpBuffer=0x114cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x114cf85c, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesRead=0x114cf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.545] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.546] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.546] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x114cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0154.546] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x114cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x114cf828, pbKeyObject=0x0) returned 0x0 [0154.546] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x114cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x114cf500) returned 0x0 [0154.546] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.547] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x114cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x114cf500) returned 0x0 [0154.580] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.582] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.582] WriteFile (in: hFile=0x358, lpBuffer=0x114cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x114cf830, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesWritten=0x114cf830*=0x428, lpOverlapped=0x0) returned 1 [0154.582] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.582] ReadFile (in: hFile=0x358, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x114cf61c*=0x785, lpOverlapped=0x0) returned 1 [0154.582] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffff87b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.582] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3d50000, cbInput=0x785, pPaddingInfo=0x0, pbIV=0x114cf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x114cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x114cf848, pbOutput=0x3d50000, pcbResult=0x114cf618) returned 0x0 [0154.582] WriteFile (in: hFile=0x358, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x114cf61c*=0x790, lpOverlapped=0x0) returned 1 [0154.583] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x114cf60c | out: lpNewFilePointer=0x0) returned 1 [0154.583] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.583] WriteFile (in: hFile=0x358, lpBuffer=0x114cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x114cf83c*, lpNumberOfBytesWritten=0x114cf61c*=0x8, lpOverlapped=0x0) returned 1 [0154.583] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.583] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.583] CloseHandle (hObject=0x358) returned 1 [0154.583] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\preview.gif.play")) returned 1 [0154.585] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1358 os_tid = 0x13ec [0154.723] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.723] ReadFile (in: hFile=0x284, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.725] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.725] ReadFile (in: hFile=0x284, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.725] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.726] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.727] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0154.727] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0154.727] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0154.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.727] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0154.731] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.733] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.733] WriteFile (in: hFile=0x284, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0154.734] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.734] ReadFile (in: hFile=0x284, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0xe9f61c*=0x6b0f, lpOverlapped=0x0) returned 1 [0154.750] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffff94f1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.750] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3e50000, cbInput=0x6b0f, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xe9f848, pbOutput=0x3e50000, pcbResult=0xe9f618) returned 0x0 [0154.750] WriteFile (in: hFile=0x284, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0xe9f61c*=0x6b10, lpOverlapped=0x0) returned 1 [0154.750] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0154.751] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.751] WriteFile (in: hFile=0x284, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.751] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x6b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.751] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.751] CloseHandle (hObject=0x284) returned 1 [0154.751] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0154.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\blueprnt\\thmbnail.png.play")) returned 1 [0154.755] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1359 os_tid = 0x13e8 [0154.734] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.735] ReadFile (in: hFile=0x834, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.743] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.743] ReadFile (in: hFile=0x834, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.743] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0154.744] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0154.744] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0154.744] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0154.744] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0154.744] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0154.745] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0154.748] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.749] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.749] WriteFile (in: hFile=0x834, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0154.749] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.750] ReadFile (in: hFile=0x834, lpBuffer=0x2750000, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0xeafa, lpOverlapped=0x0) returned 1 [0154.759] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xffff1506, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.759] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x2750000, cbInput=0xeafa, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0154.759] WriteFile (in: hFile=0x834, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0xeb00, lpOverlapped=0x0) returned 1 [0154.759] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0154.759] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.759] WriteFile (in: hFile=0x834, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.759] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xeb00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.759] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0154.759] CloseHandle (hObject=0x834) returned 1 [0154.759] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0154.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\boldstri.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\boldstri.elm.play")) returned 1 [0154.761] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1360 os_tid = 0x13c8 [0154.736] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.737] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.737] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0154.738] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0154.738] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xea8f500) returned 0x0 [0154.739] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.739] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xea8f500) returned 0x0 [0154.742] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.764] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.764] WriteFile (in: hFile=0x938, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0154.765] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.765] ReadFile (in: hFile=0x938, lpBuffer=0x2850000, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xea8f61c*=0x254, lpOverlapped=0x0) returned 1 [0154.766] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffffdac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.766] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2850000, cbInput=0x254, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xea8f848, pbOutput=0x2850000, pcbResult=0xea8f618) returned 0x0 [0154.766] WriteFile (in: hFile=0x938, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xea8f61c*=0x260, lpOverlapped=0x0) returned 1 [0154.766] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0154.766] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.766] WriteFile (in: hFile=0x938, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.766] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.766] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0154.766] CloseHandle (hObject=0x938) returned 1 [0154.766] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\boldstri.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\boldstri.inf.play")) returned 1 [0154.769] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1361 os_tid = 0x13e0 [0154.771] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.771] ReadFile (in: hFile=0x940, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.773] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.773] ReadFile (in: hFile=0x940, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.773] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.774] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.774] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0154.774] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0154.774] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0154.774] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.774] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0154.777] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.778] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.779] WriteFile (in: hFile=0x940, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0154.779] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.779] ReadFile (in: hFile=0x940, lpBuffer=0x2950000, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xebcf61c*=0xd97, lpOverlapped=0x0) returned 1 [0154.779] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffff269, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.779] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2950000, cbInput=0xd97, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xebcf848, pbOutput=0x2950000, pcbResult=0xebcf618) returned 0x0 [0154.779] WriteFile (in: hFile=0x940, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xebcf61c*=0xda0, lpOverlapped=0x0) returned 1 [0154.779] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0154.779] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.780] WriteFile (in: hFile=0x940, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0154.780] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xda0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.780] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.780] CloseHandle (hObject=0x940) returned 1 [0154.780] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\preview.gif.play")) returned 1 [0154.781] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1362 os_tid = 0x1350 [0154.783] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.783] ReadFile (in: hFile=0x3a0, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.813] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.813] ReadFile (in: hFile=0x3a0, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.814] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.815] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0154.815] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0154.815] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0154.815] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.815] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0154.829] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.830] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.830] WriteFile (in: hFile=0x3a0, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0154.831] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.831] ReadFile (in: hFile=0x3a0, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xed0f61c*=0x7c5d, lpOverlapped=0x0) returned 1 [0154.842] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xffff83a3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.842] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2a50000, cbInput=0x7c5d, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xed0f848, pbOutput=0x2a50000, pcbResult=0xed0f618) returned 0x0 [0154.842] WriteFile (in: hFile=0x3a0, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xed0f61c*=0x7c60, lpOverlapped=0x0) returned 1 [0154.843] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0154.843] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.843] WriteFile (in: hFile=0x3a0, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.843] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x7c60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.843] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.843] CloseHandle (hObject=0x3a0) returned 1 [0154.843] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\boldstri\\thmbnail.png.play")) returned 1 [0154.845] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1363 os_tid = 0x13b0 [0154.785] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.785] ReadFile (in: hFile=0x4d8, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.813] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.813] ReadFile (in: hFile=0x4d8, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.833] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.834] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.834] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0154.834] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0154.834] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0154.835] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.835] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0154.839] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.841] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.841] WriteFile (in: hFile=0x4d8, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0154.841] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.841] ReadFile (in: hFile=0x4d8, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xee4f61c*=0x1a537, lpOverlapped=0x0) returned 1 [0154.848] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffe5ac9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.848] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2b50000, cbInput=0x1a537, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xee4f848, pbOutput=0x2b50000, pcbResult=0xee4f618) returned 0x0 [0154.848] WriteFile (in: hFile=0x4d8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xee4f61c*=0x1a540, lpOverlapped=0x0) returned 1 [0154.848] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0154.848] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.848] WriteFile (in: hFile=0x4d8, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.849] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x1a540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.849] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0154.849] CloseHandle (hObject=0x4d8) returned 1 [0154.849] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\breeze.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\breeze.elm.play")) returned 1 [0154.852] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1364 os_tid = 0x13e4 [0154.786] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.787] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.787] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0154.787] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0154.787] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0154.788] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.788] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0154.791] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.792] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.792] WriteFile (in: hFile=0x52c, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0154.794] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.794] ReadFile (in: hFile=0x52c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xef8f61c*=0x1c2, lpOverlapped=0x0) returned 1 [0154.794] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffe3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.794] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2c50000, cbInput=0x1c2, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xef8f848, pbOutput=0x2c50000, pcbResult=0xef8f618) returned 0x0 [0154.794] WriteFile (in: hFile=0x52c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xef8f61c*=0x1d0, lpOverlapped=0x0) returned 1 [0154.794] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0154.794] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.795] WriteFile (in: hFile=0x52c, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.795] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.795] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.795] CloseHandle (hObject=0x52c) returned 1 [0154.795] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\breeze.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\breeze.inf.play")) returned 1 [0154.796] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1365 os_tid = 0x13f4 [0154.798] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.799] ReadFile (in: hFile=0x59c, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.800] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.800] ReadFile (in: hFile=0x59c, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0154.800] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.801] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0154.801] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0154.801] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0154.802] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.802] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0154.805] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.806] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.806] WriteFile (in: hFile=0x59c, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0154.807] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.807] ReadFile (in: hFile=0x59c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xf0cf61c*=0xaa2, lpOverlapped=0x0) returned 1 [0154.807] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffff55e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.807] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2d50000, cbInput=0xaa2, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf0cf848, pbOutput=0x2d50000, pcbResult=0xf0cf618) returned 0x0 [0154.807] WriteFile (in: hFile=0x59c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xf0cf61c*=0xab0, lpOverlapped=0x0) returned 1 [0154.807] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0154.807] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.807] WriteFile (in: hFile=0x59c, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0154.807] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.807] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.808] CloseHandle (hObject=0x59c) returned 1 [0154.808] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\preview.gif.play")) returned 1 [0154.809] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1366 os_tid = 0x13f8 [0154.812] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.812] ReadFile (in: hFile=0x7c8, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.856] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.856] ReadFile (in: hFile=0x7c8, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.856] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.857] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.857] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0154.857] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0154.857] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0154.857] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.858] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0154.862] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.864] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.864] WriteFile (in: hFile=0x7c8, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0154.864] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.864] ReadFile (in: hFile=0x7c8, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xf34f61c*=0xa90c, lpOverlapped=0x0) returned 1 [0154.866] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xffff56f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.866] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2e50000, cbInput=0xa90c, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf34f848, pbOutput=0x2e50000, pcbResult=0xf34f618) returned 0x0 [0154.866] WriteFile (in: hFile=0x7c8, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xf34f61c*=0xa910, lpOverlapped=0x0) returned 1 [0154.867] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0154.867] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.867] WriteFile (in: hFile=0x7c8, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.867] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xa910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.867] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0154.867] CloseHandle (hObject=0x7c8) returned 1 [0154.867] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0154.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\breeze\\thmbnail.png.play")) returned 1 [0154.869] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1367 os_tid = 0x1064 [0154.855] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.865] ReadFile (in: hFile=0x79c, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.874] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.874] ReadFile (in: hFile=0x79c, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0154.874] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0154.880] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0154.880] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0154.880] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0154.880] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0154.880] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0154.880] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0154.885] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.886] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.887] WriteFile (in: hFile=0x79c, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0154.887] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.887] ReadFile (in: hFile=0x79c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xf48f61c*=0xaec9, lpOverlapped=0x0) returned 1 [0154.889] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xffff5137, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.889] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2f50000, cbInput=0xaec9, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xf48f848, pbOutput=0x2f50000, pcbResult=0xf48f618) returned 0x0 [0154.889] WriteFile (in: hFile=0x79c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xf48f61c*=0xaed0, lpOverlapped=0x0) returned 1 [0154.889] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0154.889] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.889] WriteFile (in: hFile=0x79c, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0154.890] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xaed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.890] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0154.890] CloseHandle (hObject=0x79c) returned 1 [0154.890] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0154.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\canyon.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\canyon.elm.play")) returned 1 [0154.892] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1368 os_tid = 0x13d4 [0154.872] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0154.873] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0154.873] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0154.873] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0154.873] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0154.873] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0154.873] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0154.888] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.028] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.029] WriteFile (in: hFile=0x578, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0155.031] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.031] ReadFile (in: hFile=0x578, lpBuffer=0x3050000, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xfe4f61c*=0x1d1, lpOverlapped=0x0) returned 1 [0155.031] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffffe2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.031] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3050000, cbInput=0x1d1, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xfe4f848, pbOutput=0x3050000, pcbResult=0xfe4f618) returned 0x0 [0155.031] WriteFile (in: hFile=0x578, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xfe4f61c*=0x1e0, lpOverlapped=0x0) returned 1 [0155.031] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0155.031] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.031] WriteFile (in: hFile=0x578, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.032] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x1e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.032] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.032] CloseHandle (hObject=0x578) returned 1 [0155.032] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\canyon.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\canyon.inf.play")) returned 1 [0155.034] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1369 os_tid = 0x13c4 [0155.036] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.037] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.037] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0155.037] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0155.037] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0155.038] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.038] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0155.041] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.043] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.043] WriteFile (in: hFile=0x56c, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0155.045] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.045] ReadFile (in: hFile=0x56c, lpBuffer=0x3150000, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x100cf61c*=0x3b1, lpOverlapped=0x0) returned 1 [0155.046] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xfffffc4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.046] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3150000, cbInput=0x3b1, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x100cf848, pbOutput=0x3150000, pcbResult=0x100cf618) returned 0x0 [0155.046] WriteFile (in: hFile=0x56c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x100cf61c*=0x3c0, lpOverlapped=0x0) returned 1 [0155.046] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0155.046] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.046] WriteFile (in: hFile=0x56c, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.046] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.046] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.046] CloseHandle (hObject=0x56c) returned 1 [0155.046] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\preview.gif.play")) returned 1 [0155.049] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1370 os_tid = 0x784 [0155.051] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.052] ReadFile (in: hFile=0x8a8, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.053] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.053] ReadFile (in: hFile=0x8a8, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.053] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.054] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.054] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0155.054] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0155.054] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0155.054] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.054] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0155.057] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.058] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.059] WriteFile (in: hFile=0x8a8, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0155.060] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.060] ReadFile (in: hFile=0x8a8, lpBuffer=0x3250000, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x1034f61c*=0x7f5f, lpOverlapped=0x0) returned 1 [0155.060] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0xffff80a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.060] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3250000, cbInput=0x7f5f, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1034f848, pbOutput=0x3250000, pcbResult=0x1034f618) returned 0x0 [0155.060] WriteFile (in: hFile=0x8a8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x1034f61c*=0x7f60, lpOverlapped=0x0) returned 1 [0155.061] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0155.061] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.061] WriteFile (in: hFile=0x8a8, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.061] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0x7f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.061] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.061] CloseHandle (hObject=0x8a8) returned 1 [0155.061] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\canyon\\thmbnail.png.play")) returned 1 [0155.063] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1371 os_tid = 0x444 [0155.065] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.065] ReadFile (in: hFile=0x594, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.066] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.067] ReadFile (in: hFile=0x594, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.067] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.067] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.067] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0155.067] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0155.067] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0155.068] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.068] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0155.071] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.072] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.072] WriteFile (in: hFile=0x594, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0155.072] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.072] ReadFile (in: hFile=0x594, lpBuffer=0x3350000, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x1048f61c*=0xe1ba, lpOverlapped=0x0) returned 1 [0155.074] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xffff1e46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.074] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3350000, cbInput=0xe1ba, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1048f848, pbOutput=0x3350000, pcbResult=0x1048f618) returned 0x0 [0155.074] WriteFile (in: hFile=0x594, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1048f61c*=0xe1c0, lpOverlapped=0x0) returned 1 [0155.074] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0155.074] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.074] WriteFile (in: hFile=0x594, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.074] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xe1c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.074] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.075] CloseHandle (hObject=0x594) returned 1 [0155.075] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\capsules.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\capsules.elm.play")) returned 1 [0155.076] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1372 os_tid = 0xa10 [0155.078] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.079] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.079] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0155.079] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0155.079] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0155.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.080] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0155.083] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.084] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.084] WriteFile (in: hFile=0x808, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0155.086] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.086] ReadFile (in: hFile=0x808, lpBuffer=0x3450000, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x1070f61c*=0x1f5, lpOverlapped=0x0) returned 1 [0155.086] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffffe0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.086] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3450000, cbInput=0x1f5, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1070f848, pbOutput=0x3450000, pcbResult=0x1070f618) returned 0x0 [0155.086] WriteFile (in: hFile=0x808, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x1070f61c*=0x200, lpOverlapped=0x0) returned 1 [0155.086] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0155.087] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.087] WriteFile (in: hFile=0x808, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.087] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.087] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.087] CloseHandle (hObject=0x808) returned 1 [0155.087] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.088] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\capsules.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\capsules.inf.play")) returned 1 [0155.090] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1373 os_tid = 0xb14 [0155.091] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.092] ReadFile (in: hFile=0x7f4, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.093] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.094] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.094] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0155.094] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0155.094] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0155.094] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.094] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0155.097] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.100] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.100] WriteFile (in: hFile=0x7f4, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0155.100] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.100] ReadFile (in: hFile=0x7f4, lpBuffer=0x3550000, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1084f61c*=0x7fc, lpOverlapped=0x0) returned 1 [0155.101] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffff804, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.101] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3550000, cbInput=0x7fc, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1084f848, pbOutput=0x3550000, pcbResult=0x1084f618) returned 0x0 [0155.101] WriteFile (in: hFile=0x7f4, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1084f61c*=0x800, lpOverlapped=0x0) returned 1 [0155.101] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0155.101] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.101] WriteFile (in: hFile=0x7f4, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.102] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.102] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.102] CloseHandle (hObject=0x7f4) returned 1 [0155.102] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.103] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\preview.gif.play")) returned 1 [0155.105] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1374 os_tid = 0x7bc [0155.108] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.109] ReadFile (in: hFile=0x5d0, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.112] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.112] ReadFile (in: hFile=0x5d0, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.112] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.114] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.114] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0155.114] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0155.114] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0155.114] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.114] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0155.117] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.118] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.118] WriteFile (in: hFile=0x5d0, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0155.119] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.119] ReadFile (in: hFile=0x5d0, lpBuffer=0x3650000, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x10acf61c*=0x74e5, lpOverlapped=0x0) returned 1 [0155.120] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xffff8b1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.120] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3650000, cbInput=0x74e5, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10acf848, pbOutput=0x3650000, pcbResult=0x10acf618) returned 0x0 [0155.120] WriteFile (in: hFile=0x5d0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x10acf61c*=0x74f0, lpOverlapped=0x0) returned 1 [0155.120] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0155.120] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.120] WriteFile (in: hFile=0x5d0, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.120] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x74f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.120] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.120] CloseHandle (hObject=0x5d0) returned 1 [0155.120] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\capsules\\thmbnail.png.play")) returned 1 [0155.122] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1375 os_tid = 0x15d0 [0155.119] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.123] ReadFile (in: hFile=0x7e4, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.124] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.125] ReadFile (in: hFile=0x7e4, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.125] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.125] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.127] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0155.127] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0155.127] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0155.127] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.127] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0155.132] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.133] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.133] WriteFile (in: hFile=0x7e4, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0155.133] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.133] ReadFile (in: hFile=0x7e4, lpBuffer=0x3750000, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x10c0f61c*=0xba44, lpOverlapped=0x0) returned 1 [0155.134] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xffff45bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.134] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3750000, cbInput=0xba44, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10c0f848, pbOutput=0x3750000, pcbResult=0x10c0f618) returned 0x0 [0155.134] WriteFile (in: hFile=0x7e4, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x10c0f61c*=0xba50, lpOverlapped=0x0) returned 1 [0155.135] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0155.135] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.135] WriteFile (in: hFile=0x7e4, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.135] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xba50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.135] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.135] CloseHandle (hObject=0x7e4) returned 1 [0155.135] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\cascade.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\cascade.elm.play")) returned 1 [0155.137] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1376 os_tid = 0xb04 [0155.138] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.139] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.139] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0155.139] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0155.139] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0155.140] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.140] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0155.144] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.146] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.146] WriteFile (in: hFile=0x29c, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0155.148] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.148] ReadFile (in: hFile=0x29c, lpBuffer=0x3850000, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x10d4f61c*=0x262, lpOverlapped=0x0) returned 1 [0155.148] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffffd9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.148] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3850000, cbInput=0x262, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10d4f848, pbOutput=0x3850000, pcbResult=0x10d4f618) returned 0x0 [0155.148] WriteFile (in: hFile=0x29c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x10d4f61c*=0x270, lpOverlapped=0x0) returned 1 [0155.149] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0155.149] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.149] WriteFile (in: hFile=0x29c, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.149] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.149] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.149] CloseHandle (hObject=0x29c) returned 1 [0155.149] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\cascade.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\cascade.inf.play")) returned 1 [0155.150] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1377 os_tid = 0x1354 [0155.152] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.153] ReadFile (in: hFile=0x3cc, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.154] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.155] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0155.155] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0155.155] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0155.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.156] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0155.159] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.160] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.160] WriteFile (in: hFile=0x3cc, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0155.161] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.161] ReadFile (in: hFile=0x3cc, lpBuffer=0x3950000, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x10e8f61c*=0x553, lpOverlapped=0x0) returned 1 [0155.161] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffaad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.161] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3950000, cbInput=0x553, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10e8f848, pbOutput=0x3950000, pcbResult=0x10e8f618) returned 0x0 [0155.161] WriteFile (in: hFile=0x3cc, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x10e8f61c*=0x560, lpOverlapped=0x0) returned 1 [0155.161] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0155.161] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.161] WriteFile (in: hFile=0x3cc, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.161] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.162] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.162] CloseHandle (hObject=0x3cc) returned 1 [0155.162] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\preview.gif.play")) returned 1 [0155.165] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1378 os_tid = 0x1318 [0155.167] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.167] ReadFile (in: hFile=0xac4, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.168] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.168] ReadFile (in: hFile=0xac4, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.168] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.169] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0155.169] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0155.169] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0155.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.170] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0155.173] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.174] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.174] WriteFile (in: hFile=0xac4, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0155.175] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.175] ReadFile (in: hFile=0xac4, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x10fcf61c*=0x4f93, lpOverlapped=0x0) returned 1 [0155.176] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xffffb06d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.176] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3a50000, cbInput=0x4f93, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10fcf848, pbOutput=0x3a50000, pcbResult=0x10fcf618) returned 0x0 [0155.176] WriteFile (in: hFile=0xac4, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x10fcf61c*=0x4fa0, lpOverlapped=0x0) returned 1 [0155.177] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0155.177] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.177] WriteFile (in: hFile=0xac4, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.177] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x4fa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.177] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.177] CloseHandle (hObject=0xac4) returned 1 [0155.177] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\cascade\\thmbnail.png.play")) returned 1 [0155.179] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1379 os_tid = 0x113c [0155.182] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.182] ReadFile (in: hFile=0x894, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.184] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.185] ReadFile (in: hFile=0x894, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.186] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0155.187] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0155.187] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0155.187] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0155.187] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0155.187] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0155.187] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0155.191] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.192] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.192] WriteFile (in: hFile=0x894, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0155.193] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.193] ReadFile (in: hFile=0x894, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1110f61c*=0xd613, lpOverlapped=0x0) returned 1 [0155.194] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xffff29ed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.194] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3b50000, cbInput=0xd613, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1110f848, pbOutput=0x3b50000, pcbResult=0x1110f618) returned 0x0 [0155.194] WriteFile (in: hFile=0x894, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1110f61c*=0xd620, lpOverlapped=0x0) returned 1 [0155.195] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0155.195] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.195] WriteFile (in: hFile=0x894, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.195] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xd620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.195] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.195] CloseHandle (hObject=0x894) returned 1 [0155.195] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.196] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\compass.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\compass.elm.play")) returned 1 [0155.197] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1380 os_tid = 0x808 [0155.239] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0155.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0155.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f000c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0155.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0155.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0024, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0155.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0155.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f003c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0155.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0155.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0054, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0155.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0155.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f006c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0155.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0155.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0084, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0155.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0155.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f009c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0155.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0155.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0155.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0155.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0155.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0155.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0155.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0155.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0155.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0155.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0114, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0155.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0155.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f012c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0155.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0155.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0144, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0155.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0155.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f015c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0155.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0155.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0174, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0155.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0155.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f018c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0155.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0155.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0155.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0155.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0155.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0155.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0155.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0155.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0155.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0155.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0204, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0155.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0155.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f021c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0155.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0155.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0234, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0155.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0155.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f024c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0155.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0155.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0264, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34 [0155.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0155.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f027c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0155.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0155.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0294, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0155.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0155.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0155.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0155.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0155.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0155.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c [0155.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0155.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0155.281] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x990, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0157.062] CloseHandle (hObject=0x990) returned 1 [0157.062] CloseHandle (hObject=0x984) returned 1 [0157.062] CloseHandle (hObject=0x5e4) returned 1 [0157.062] CloseHandle (hObject=0x5e8) returned 1 [0157.062] CloseHandle (hObject=0x5ec) returned 1 [0157.062] CloseHandle (hObject=0x5f0) returned 1 [0157.062] CloseHandle (hObject=0x5f4) returned 1 [0157.062] CloseHandle (hObject=0x5f8) returned 1 [0157.062] CloseHandle (hObject=0x5fc) returned 1 [0157.062] CloseHandle (hObject=0x600) returned 1 [0157.062] CloseHandle (hObject=0x604) returned 1 [0157.062] CloseHandle (hObject=0x608) returned 1 [0157.062] CloseHandle (hObject=0x60c) returned 1 [0157.062] CloseHandle (hObject=0x610) returned 1 [0157.063] CloseHandle (hObject=0x614) returned 1 [0157.063] CloseHandle (hObject=0x618) returned 1 [0157.063] CloseHandle (hObject=0x5d4) returned 1 [0157.063] CloseHandle (hObject=0x61c) returned 1 [0157.063] CloseHandle (hObject=0x620) returned 1 [0157.063] CloseHandle (hObject=0x624) returned 1 [0157.063] CloseHandle (hObject=0x62c) returned 1 [0157.063] CloseHandle (hObject=0x634) returned 1 [0157.063] CloseHandle (hObject=0x638) returned 1 [0157.063] CloseHandle (hObject=0x63c) returned 1 [0157.063] CloseHandle (hObject=0x450) returned 1 [0157.063] CloseHandle (hObject=0x34c) returned 1 [0157.063] CloseHandle (hObject=0x6e4) returned 1 [0157.063] CloseHandle (hObject=0x6e8) returned 1 [0157.063] CloseHandle (hObject=0x6ec) returned 1 [0157.063] CloseHandle (hObject=0x6f0) returned 1 [0157.063] CloseHandle (hObject=0x6f4) returned 1 [0157.063] CloseHandle (hObject=0x628) returned 1 [0157.063] CloseHandle (hObject=0x6f8) returned 1 [0157.063] CloseHandle (hObject=0x6fc) returned 1 [0157.063] CloseHandle (hObject=0x700) returned 1 [0157.064] CloseHandle (hObject=0x708) returned 1 [0157.064] CloseHandle (hObject=0x70c) returned 1 [0157.064] CloseHandle (hObject=0x710) returned 1 [0157.064] CloseHandle (hObject=0x714) returned 1 [0157.064] CloseHandle (hObject=0x718) returned 1 [0157.064] CloseHandle (hObject=0x71c) returned 1 [0157.064] CloseHandle (hObject=0x720) returned 1 [0157.064] CloseHandle (hObject=0x704) returned 1 [0157.064] CloseHandle (hObject=0x724) returned 1 [0157.064] CloseHandle (hObject=0x728) returned 1 [0157.064] CloseHandle (hObject=0x72c) returned 1 [0157.064] CloseHandle (hObject=0x424) returned 1 [0157.064] CloseHandle (hObject=0xa48) returned 1 [0157.064] CloseHandle (hObject=0xa44) returned 1 [0157.064] CloseHandle (hObject=0xa40) returned 1 [0157.064] CloseHandle (hObject=0xa3c) returned 1 [0157.064] CloseHandle (hObject=0xb34) returned 1 [0157.064] CloseHandle (hObject=0xb38) returned 1 [0157.064] CloseHandle (hObject=0xb3c) returned 1 [0157.064] CloseHandle (hObject=0xb40) returned 1 [0157.065] CloseHandle (hObject=0xb44) returned 1 [0157.065] CloseHandle (hObject=0xb48) returned 1 [0157.065] CloseHandle (hObject=0xb4c) returned 1 [0157.065] CloseHandle (hObject=0xb50) returned 1 [0157.065] CloseHandle (hObject=0xb54) returned 1 [0157.065] CloseHandle (hObject=0xb58) returned 1 [0157.065] CloseHandle (hObject=0xb5c) returned 1 [0157.065] CloseHandle (hObject=0xb60) returned 1 [0157.065] CloseHandle (hObject=0xb64) returned 1 [0157.065] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1381 os_tid = 0x5f4 [0155.337] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.343] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0155.344] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0155.344] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0155.344] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.344] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0155.349] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.351] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.351] WriteFile (in: hFile=0xac4, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0155.354] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.354] ReadFile (in: hFile=0xac4, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0xe9f61c*=0x1e6, lpOverlapped=0x0) returned 1 [0155.354] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffe1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.354] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3f50000, cbInput=0x1e6, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xe9f848, pbOutput=0x3f50000, pcbResult=0xe9f618) returned 0x0 [0155.354] WriteFile (in: hFile=0xac4, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0xe9f61c*=0x1f0, lpOverlapped=0x0) returned 1 [0155.354] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0155.354] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.354] WriteFile (in: hFile=0xac4, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.354] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x1f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.354] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.354] CloseHandle (hObject=0xac4) returned 1 [0155.354] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\compass.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\compass.inf.play")) returned 1 [0155.423] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1382 os_tid = 0x121c [0155.357] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.357] ReadFile (in: hFile=0x3cc, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.359] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0155.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0155.360] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0155.360] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0155.360] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x111f500) returned 0x0 [0155.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0155.361] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x111f500) returned 0x0 [0155.366] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.367] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.367] WriteFile (in: hFile=0x3cc, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0155.368] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.368] ReadFile (in: hFile=0x3cc, lpBuffer=0x2750000, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x50d, lpOverlapped=0x0) returned 1 [0155.368] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffaf3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.368] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2750000, cbInput=0x50d, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0155.368] WriteFile (in: hFile=0x3cc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x510, lpOverlapped=0x0) returned 1 [0155.369] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0155.369] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.369] WriteFile (in: hFile=0x3cc, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.369] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.369] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.369] CloseHandle (hObject=0x3cc) returned 1 [0155.411] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x17be0000 [0155.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\preview.gif.play")) returned 1 [0155.420] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1383 os_tid = 0xb9c [0155.369] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.371] ReadFile (in: hFile=0x7e4, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.372] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.373] ReadFile (in: hFile=0x7e4, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.373] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0155.374] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0155.374] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0155.374] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0155.374] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xea8f500) returned 0x0 [0155.374] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0155.375] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xea8f500) returned 0x0 [0155.381] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.383] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.383] WriteFile (in: hFile=0x7e4, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0155.387] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.387] ReadFile (in: hFile=0x7e4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xea8f61c*=0x505f, lpOverlapped=0x0) returned 1 [0155.388] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xffffafa1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.388] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2850000, cbInput=0x505f, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xea8f848, pbOutput=0x2850000, pcbResult=0xea8f618) returned 0x0 [0155.388] WriteFile (in: hFile=0x7e4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xea8f61c*=0x5060, lpOverlapped=0x0) returned 1 [0155.389] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0155.389] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.389] WriteFile (in: hFile=0x7e4, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.389] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x5060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.389] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.389] CloseHandle (hObject=0x7e4) returned 1 [0155.407] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0155.408] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\compass\\thmbnail.png.play")) returned 1 [0155.414] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1384 os_tid = 0x1014 [0155.388] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.389] ReadFile (in: hFile=0x7f4, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.391] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.391] ReadFile (in: hFile=0x7f4, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.391] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0155.393] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0155.393] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0155.393] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0155.393] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xebcf500) returned 0x0 [0155.393] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0155.393] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xebcf500) returned 0x0 [0155.398] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.400] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.400] WriteFile (in: hFile=0x7f4, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0155.401] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.401] ReadFile (in: hFile=0x7f4, lpBuffer=0x2950000, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xebcf61c*=0xb1d8, lpOverlapped=0x0) returned 1 [0155.403] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xffff4e28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.403] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2950000, cbInput=0xb1d8, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xebcf848, pbOutput=0x2950000, pcbResult=0xebcf618) returned 0x0 [0155.404] WriteFile (in: hFile=0x7f4, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xebcf61c*=0xb1e0, lpOverlapped=0x0) returned 1 [0155.404] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0155.404] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.404] WriteFile (in: hFile=0x7f4, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.404] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xb1e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.404] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.404] CloseHandle (hObject=0x7f4) returned 1 [0155.404] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0155.406] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\concrete.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\concrete.elm.play")) returned 1 [0155.417] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1385 os_tid = 0xcf8 [0155.402] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0155.455] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0155.459] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0155.459] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0155.459] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xed0f500) returned 0x0 [0155.460] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0155.460] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xed0f500) returned 0x0 [0155.464] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.468] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.468] WriteFile (in: hFile=0x594, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0155.475] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.475] ReadFile (in: hFile=0x594, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xed0f61c*=0x1e0, lpOverlapped=0x0) returned 1 [0155.475] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffffe20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.475] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2a50000, cbInput=0x1e0, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xed0f848, pbOutput=0x2a50000, pcbResult=0xed0f618) returned 0x0 [0155.475] WriteFile (in: hFile=0x594, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xed0f61c*=0x1f0, lpOverlapped=0x0) returned 1 [0155.476] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0155.476] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.476] WriteFile (in: hFile=0x594, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.476] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x1f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.476] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.476] CloseHandle (hObject=0x594) returned 1 [0155.476] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\concrete.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\concrete.inf.play")) returned 1 [0155.481] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1386 os_tid = 0xe30 [0155.484] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.485] ReadFile (in: hFile=0x56c, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.486] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.488] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.488] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0155.488] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0155.488] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xee4f500) returned 0x0 [0155.489] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.489] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xee4f500) returned 0x0 [0155.494] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.495] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.495] WriteFile (in: hFile=0x56c, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0155.496] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.496] ReadFile (in: hFile=0x56c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xee4f61c*=0x507, lpOverlapped=0x0) returned 1 [0155.496] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xfffffaf9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.496] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2b50000, cbInput=0x507, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xee4f848, pbOutput=0x2b50000, pcbResult=0xee4f618) returned 0x0 [0155.496] WriteFile (in: hFile=0x56c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xee4f61c*=0x510, lpOverlapped=0x0) returned 1 [0155.496] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0155.496] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.497] WriteFile (in: hFile=0x56c, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.497] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.497] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.497] CloseHandle (hObject=0x56c) returned 1 [0155.497] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\preview.gif.play")) returned 1 [0155.499] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1387 os_tid = 0xe34 [0155.502] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.502] ReadFile (in: hFile=0x79c, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.504] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.504] ReadFile (in: hFile=0x79c, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.504] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.506] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.506] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0155.506] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0155.506] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xef8f500) returned 0x0 [0155.506] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.506] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xef8f500) returned 0x0 [0155.511] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.513] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.513] WriteFile (in: hFile=0x79c, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0155.514] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.514] ReadFile (in: hFile=0x79c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xef8f61c*=0x6fb3, lpOverlapped=0x0) returned 1 [0155.515] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xffff904d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.515] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2c50000, cbInput=0x6fb3, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xef8f848, pbOutput=0x2c50000, pcbResult=0xef8f618) returned 0x0 [0155.515] WriteFile (in: hFile=0x79c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xef8f61c*=0x6fc0, lpOverlapped=0x0) returned 1 [0155.515] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0155.516] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.516] WriteFile (in: hFile=0x79c, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.516] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x6fc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.516] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.516] CloseHandle (hObject=0x79c) returned 1 [0155.516] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\concrete\\thmbnail.png.play")) returned 1 [0155.518] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1388 os_tid = 0xe38 [0155.522] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.522] ReadFile (in: hFile=0x4d8, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.524] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.525] ReadFile (in: hFile=0x4d8, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.525] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.527] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.527] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0155.527] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0155.527] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf0cf500) returned 0x0 [0155.527] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.527] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf0cf500) returned 0x0 [0155.532] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.534] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.535] WriteFile (in: hFile=0x4d8, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0155.535] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.535] ReadFile (in: hFile=0x4d8, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xf0cf61c*=0x116dc, lpOverlapped=0x0) returned 1 [0155.538] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffee924, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.538] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2d50000, cbInput=0x116dc, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf0cf848, pbOutput=0x2d50000, pcbResult=0xf0cf618) returned 0x0 [0155.538] WriteFile (in: hFile=0x4d8, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xf0cf61c*=0x116e0, lpOverlapped=0x0) returned 1 [0155.539] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0155.539] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.539] WriteFile (in: hFile=0x4d8, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.539] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x116e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.539] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.539] CloseHandle (hObject=0x4d8) returned 1 [0155.539] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0155.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\deepblue.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\deepblue.elm.play")) returned 1 [0155.541] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1389 os_tid = 0xe3c [0155.536] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.545] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.545] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0155.545] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0155.545] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf34f500) returned 0x0 [0155.545] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.546] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf34f500) returned 0x0 [0155.550] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.568] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.568] WriteFile (in: hFile=0x59c, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0155.571] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.571] ReadFile (in: hFile=0x59c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xf34f61c*=0x239, lpOverlapped=0x0) returned 1 [0155.571] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffdc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.571] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2e50000, cbInput=0x239, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf34f848, pbOutput=0x2e50000, pcbResult=0xf34f618) returned 0x0 [0155.571] WriteFile (in: hFile=0x59c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xf34f61c*=0x240, lpOverlapped=0x0) returned 1 [0155.572] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0155.572] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.572] WriteFile (in: hFile=0x59c, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.572] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.572] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.572] CloseHandle (hObject=0x59c) returned 1 [0155.572] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\deepblue.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\deepblue.inf.play")) returned 1 [0155.578] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1390 os_tid = 0xfd4 [0155.581] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.581] ReadFile (in: hFile=0x940, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.583] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.583] ReadFile (in: hFile=0x940, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.583] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.585] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0155.585] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0155.585] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0155.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.585] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0155.590] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.592] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.592] WriteFile (in: hFile=0x940, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0155.593] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.593] ReadFile (in: hFile=0x940, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xf48f61c*=0xf75, lpOverlapped=0x0) returned 1 [0155.593] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffff08b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.593] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2f50000, cbInput=0xf75, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xf48f848, pbOutput=0x2f50000, pcbResult=0xf48f618) returned 0x0 [0155.593] WriteFile (in: hFile=0x940, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xf48f61c*=0xf80, lpOverlapped=0x0) returned 1 [0155.593] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0155.593] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.593] WriteFile (in: hFile=0x940, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.593] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xf80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.594] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.594] CloseHandle (hObject=0x940) returned 1 [0155.594] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\preview.gif.play")) returned 1 [0155.596] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1391 os_tid = 0xfd8 [0155.599] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.599] ReadFile (in: hFile=0x834, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.601] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.601] ReadFile (in: hFile=0x834, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.601] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.602] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0155.602] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0155.602] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0155.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.603] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0155.607] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.609] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.610] WriteFile (in: hFile=0x834, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0155.610] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.610] ReadFile (in: hFile=0x834, lpBuffer=0x3050000, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xfe4f61c*=0x81fd, lpOverlapped=0x0) returned 1 [0155.611] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xffff7e03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.612] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3050000, cbInput=0x81fd, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xfe4f848, pbOutput=0x3050000, pcbResult=0xfe4f618) returned 0x0 [0155.612] WriteFile (in: hFile=0x834, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xfe4f61c*=0x8200, lpOverlapped=0x0) returned 1 [0155.612] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0155.612] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.612] WriteFile (in: hFile=0x834, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.612] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x8200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.612] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.612] CloseHandle (hObject=0x834) returned 1 [0155.613] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\deepblue\\thmbnail.png.play")) returned 1 [0155.615] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1392 os_tid = 0xfdc [0155.611] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.617] ReadFile (in: hFile=0x6e0, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.618] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.618] ReadFile (in: hFile=0x6e0, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0155.618] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.619] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.619] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0155.619] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0155.619] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0155.620] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.620] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0155.623] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.625] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.625] WriteFile (in: hFile=0x6e0, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0155.625] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.625] ReadFile (in: hFile=0x6e0, lpBuffer=0x3150000, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x100cf61c*=0xb0ce, lpOverlapped=0x0) returned 1 [0155.627] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0xffff4f32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.628] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3150000, cbInput=0xb0ce, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x100cf848, pbOutput=0x3150000, pcbResult=0x100cf618) returned 0x0 [0155.628] WriteFile (in: hFile=0x6e0, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x100cf61c*=0xb0d0, lpOverlapped=0x0) returned 1 [0155.628] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0155.628] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.628] WriteFile (in: hFile=0x6e0, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.628] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0xb0d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.628] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.628] CloseHandle (hObject=0x6e0) returned 1 [0155.628] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0155.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\echo.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\echo.elm.play")) returned 1 [0155.631] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1393 os_tid = 0xfe0 [0155.626] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.633] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.634] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0155.634] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0155.634] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0155.634] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.634] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0155.639] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.640] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.641] WriteFile (in: hFile=0x358, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0155.643] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.643] ReadFile (in: hFile=0x358, lpBuffer=0x3250000, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x1034f61c*=0x1f7, lpOverlapped=0x0) returned 1 [0155.643] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffe09, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.643] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3250000, cbInput=0x1f7, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1034f848, pbOutput=0x3250000, pcbResult=0x1034f618) returned 0x0 [0155.643] WriteFile (in: hFile=0x358, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x1034f61c*=0x200, lpOverlapped=0x0) returned 1 [0155.644] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0155.644] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.644] WriteFile (in: hFile=0x358, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.644] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.644] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.644] CloseHandle (hObject=0x358) returned 1 [0155.644] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\echo.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\echo.inf.play")) returned 1 [0155.646] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1394 os_tid = 0xfe4 [0155.649] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.649] ReadFile (in: hFile=0x4f0, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.651] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.652] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.652] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0155.652] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0155.652] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0155.652] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.653] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0155.658] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.659] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.659] WriteFile (in: hFile=0x4f0, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0155.660] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.660] ReadFile (in: hFile=0x4f0, lpBuffer=0x3350000, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x1048f61c*=0x5ad, lpOverlapped=0x0) returned 1 [0155.660] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffa53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.660] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3350000, cbInput=0x5ad, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1048f848, pbOutput=0x3350000, pcbResult=0x1048f618) returned 0x0 [0155.660] WriteFile (in: hFile=0x4f0, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x1048f61c*=0x5b0, lpOverlapped=0x0) returned 1 [0155.660] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0155.661] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.661] WriteFile (in: hFile=0x4f0, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.661] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.661] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.661] CloseHandle (hObject=0x4f0) returned 1 [0155.661] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\preview.gif.play")) returned 1 [0155.680] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1395 os_tid = 0xfe8 [0155.682] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.682] ReadFile (in: hFile=0x868, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.684] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.684] ReadFile (in: hFile=0x868, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.684] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.685] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.685] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0155.685] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0155.685] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0155.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.686] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0155.691] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.693] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.693] WriteFile (in: hFile=0x868, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0155.693] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.693] ReadFile (in: hFile=0x868, lpBuffer=0x3450000, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x1070f61c*=0x6212, lpOverlapped=0x0) returned 1 [0155.694] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xffff9dee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.694] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3450000, cbInput=0x6212, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1070f848, pbOutput=0x3450000, pcbResult=0x1070f618) returned 0x0 [0155.695] WriteFile (in: hFile=0x868, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x1070f61c*=0x6220, lpOverlapped=0x0) returned 1 [0155.695] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0155.695] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.695] WriteFile (in: hFile=0x868, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.695] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x6220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.695] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.695] CloseHandle (hObject=0x868) returned 1 [0155.695] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.697] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\echo\\thmbnail.png.play")) returned 1 [0155.698] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1396 os_tid = 0xfec [0155.700] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.700] ReadFile (in: hFile=0x97c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.702] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.702] ReadFile (in: hFile=0x97c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.702] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.704] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.704] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0155.704] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0155.704] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0155.704] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.704] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0155.709] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.711] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.711] WriteFile (in: hFile=0x97c, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0155.712] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.712] ReadFile (in: hFile=0x97c, lpBuffer=0x3550000, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1084f61c*=0x1cf31, lpOverlapped=0x0) returned 1 [0155.715] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0xfffe30cf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.715] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3550000, cbInput=0x1cf31, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1084f848, pbOutput=0x3550000, pcbResult=0x1084f618) returned 0x0 [0155.715] WriteFile (in: hFile=0x97c, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1084f61c*=0x1cf40, lpOverlapped=0x0) returned 1 [0155.716] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0155.716] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.716] WriteFile (in: hFile=0x97c, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.716] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x1cf40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.716] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.716] CloseHandle (hObject=0x97c) returned 1 [0155.716] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0155.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\eclipse.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\eclipse.elm.play")) returned 1 [0155.718] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1397 os_tid = 0xff0 [0155.713] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.721] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.721] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0155.721] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0155.721] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0155.722] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.722] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0155.727] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.729] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.729] WriteFile (in: hFile=0x748, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0155.732] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.732] ReadFile (in: hFile=0x748, lpBuffer=0x3650000, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x10acf61c*=0x253, lpOverlapped=0x0) returned 1 [0155.732] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffffdad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.732] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3650000, cbInput=0x253, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10acf848, pbOutput=0x3650000, pcbResult=0x10acf618) returned 0x0 [0155.733] WriteFile (in: hFile=0x748, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x10acf61c*=0x260, lpOverlapped=0x0) returned 1 [0155.733] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0155.733] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.733] WriteFile (in: hFile=0x748, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.733] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.733] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.733] CloseHandle (hObject=0x748) returned 1 [0155.733] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.735] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\eclipse.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\eclipse.inf.play")) returned 1 [0155.736] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1398 os_tid = 0xff4 [0155.738] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.738] ReadFile (in: hFile=0x87c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.740] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.742] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.742] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0155.742] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0155.742] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0155.742] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.742] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0155.746] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.748] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.748] WriteFile (in: hFile=0x87c, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0155.748] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.748] ReadFile (in: hFile=0x87c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x10c0f61c*=0x543, lpOverlapped=0x0) returned 1 [0155.748] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffffabd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.748] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3750000, cbInput=0x543, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10c0f848, pbOutput=0x3750000, pcbResult=0x10c0f618) returned 0x0 [0155.749] WriteFile (in: hFile=0x87c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x10c0f61c*=0x550, lpOverlapped=0x0) returned 1 [0155.749] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0155.749] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.749] WriteFile (in: hFile=0x87c, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.749] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.749] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.749] CloseHandle (hObject=0x87c) returned 1 [0155.749] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\preview.gif.play")) returned 1 [0155.753] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1399 os_tid = 0xff8 [0155.757] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.757] ReadFile (in: hFile=0x858, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.758] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.758] ReadFile (in: hFile=0x858, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.758] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.760] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0155.760] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0155.760] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0155.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.761] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0155.766] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.768] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.768] WriteFile (in: hFile=0x858, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0155.768] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.769] ReadFile (in: hFile=0x858, lpBuffer=0x3850000, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x10d4f61c*=0x7e93, lpOverlapped=0x0) returned 1 [0155.770] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xffff816d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.770] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3850000, cbInput=0x7e93, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10d4f848, pbOutput=0x3850000, pcbResult=0x10d4f618) returned 0x0 [0155.770] WriteFile (in: hFile=0x858, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x10d4f61c*=0x7ea0, lpOverlapped=0x0) returned 1 [0155.770] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0155.770] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.770] WriteFile (in: hFile=0x858, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.770] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x7ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.770] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.770] CloseHandle (hObject=0x858) returned 1 [0155.771] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.772] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\eclipse\\thmbnail.png.play")) returned 1 [0155.773] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1400 os_tid = 0xffc [0155.776] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.776] ReadFile (in: hFile=0x840, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.779] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.779] ReadFile (in: hFile=0x840, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.779] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.780] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.780] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0155.780] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0155.780] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0155.781] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.781] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0155.786] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.788] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.788] WriteFile (in: hFile=0x840, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0155.789] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.789] ReadFile (in: hFile=0x840, lpBuffer=0x3950000, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x10e8f61c*=0xb8f8, lpOverlapped=0x0) returned 1 [0155.790] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xffff4708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.790] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3950000, cbInput=0xb8f8, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10e8f848, pbOutput=0x3950000, pcbResult=0x10e8f618) returned 0x0 [0155.790] WriteFile (in: hFile=0x840, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x10e8f61c*=0xb900, lpOverlapped=0x0) returned 1 [0155.791] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0155.791] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.791] WriteFile (in: hFile=0x840, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.791] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xb900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.791] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.791] CloseHandle (hObject=0x840) returned 1 [0155.791] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\edge.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\edge.elm.play")) returned 1 [0155.794] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1401 os_tid = 0xbf4 [0155.789] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.797] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.797] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0155.797] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0155.797] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0155.798] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.798] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0155.803] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.805] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.805] WriteFile (in: hFile=0x5a4, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0155.808] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.808] ReadFile (in: hFile=0x5a4, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x10fcf61c*=0x211, lpOverlapped=0x0) returned 1 [0155.808] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0xfffffdef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.808] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3a50000, cbInput=0x211, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x10fcf848, pbOutput=0x3a50000, pcbResult=0x10fcf618) returned 0x0 [0155.808] WriteFile (in: hFile=0x5a4, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x10fcf61c*=0x220, lpOverlapped=0x0) returned 1 [0155.808] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0155.808] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.808] WriteFile (in: hFile=0x5a4, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.808] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0x220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.808] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.809] CloseHandle (hObject=0x5a4) returned 1 [0155.809] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\edge.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\edge.inf.play")) returned 1 [0155.810] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1402 os_tid = 0x60c [0155.813] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.813] ReadFile (in: hFile=0x5ac, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.815] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.816] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.826] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0155.826] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0155.826] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0155.826] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.826] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0155.831] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.833] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.834] WriteFile (in: hFile=0x5ac, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0155.834] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.834] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1110f61c*=0x543, lpOverlapped=0x0) returned 1 [0155.834] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0xfffffabd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.834] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3b50000, cbInput=0x543, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1110f848, pbOutput=0x3b50000, pcbResult=0x1110f618) returned 0x0 [0155.834] WriteFile (in: hFile=0x5ac, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1110f61c*=0x550, lpOverlapped=0x0) returned 1 [0155.835] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0155.835] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.835] WriteFile (in: hFile=0x5ac, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.835] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.835] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.835] CloseHandle (hObject=0x5ac) returned 1 [0155.835] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\preview.gif.play")) returned 1 [0155.839] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1403 os_tid = 0x940 [0155.842] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.842] ReadFile (in: hFile=0x5b4, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.844] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.844] ReadFile (in: hFile=0x5b4, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.845] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.846] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.846] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0155.846] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0155.846] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0155.846] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.846] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0155.852] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.854] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.854] WriteFile (in: hFile=0x5b4, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0155.854] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.854] ReadFile (in: hFile=0x5b4, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x1124f61c*=0x6722, lpOverlapped=0x0) returned 1 [0155.855] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xffff98de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.855] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3c50000, cbInput=0x6722, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1124f848, pbOutput=0x3c50000, pcbResult=0x1124f618) returned 0x0 [0155.855] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x1124f61c*=0x6730, lpOverlapped=0x0) returned 1 [0155.856] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0155.856] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.856] WriteFile (in: hFile=0x5b4, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.856] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x6730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.856] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.856] CloseHandle (hObject=0x5b4) returned 1 [0155.856] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.857] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\edge\\thmbnail.png.play")) returned 1 [0155.858] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1404 os_tid = 0x91c [0155.861] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.861] ReadFile (in: hFile=0x5bc, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.863] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.863] ReadFile (in: hFile=0x5bc, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.864] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.865] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.865] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x1138f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0155.865] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x1138f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x1138f828, pbKeyObject=0x0) returned 0x0 [0155.865] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1138f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1138f500) returned 0x0 [0155.865] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.865] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1138f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1138f500) returned 0x0 [0155.870] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.872] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.872] WriteFile (in: hFile=0x5bc, lpBuffer=0x1138fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1138f830, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesWritten=0x1138f830*=0x428, lpOverlapped=0x0) returned 1 [0155.873] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.873] ReadFile (in: hFile=0x5bc, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x1138f61c*=0x12dee, lpOverlapped=0x0) returned 1 [0155.876] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xfffed212, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.876] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3d50000, cbInput=0x12dee, pPaddingInfo=0x0, pbIV=0x1138f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x1138f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1138f848, pbOutput=0x3d50000, pcbResult=0x1138f618) returned 0x0 [0155.876] WriteFile (in: hFile=0x5bc, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x1138f61c*=0x12df0, lpOverlapped=0x0) returned 1 [0155.876] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1138f60c | out: lpNewFilePointer=0x0) returned 1 [0155.876] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.876] WriteFile (in: hFile=0x5bc, lpBuffer=0x1138f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x1138f83c*, lpNumberOfBytesWritten=0x1138f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.876] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x12df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.876] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.876] CloseHandle (hObject=0x5bc) returned 1 [0155.876] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0155.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\evrgreen.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\evrgreen.elm.play")) returned 1 [0155.878] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1405 os_tid = 0x740 [0155.874] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.882] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.883] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x114cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0155.883] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x114cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x114cf828, pbKeyObject=0x0) returned 0x0 [0155.883] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x114cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x114cf500) returned 0x0 [0155.883] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.883] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x114cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x114cf500) returned 0x0 [0155.888] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.890] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.890] WriteFile (in: hFile=0x5c4, lpBuffer=0x114cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x114cf830, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesWritten=0x114cf830*=0x428, lpOverlapped=0x0) returned 1 [0155.893] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.893] ReadFile (in: hFile=0x5c4, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x114cf61c*=0x223, lpOverlapped=0x0) returned 1 [0155.893] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xfffffddd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.893] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3e50000, cbInput=0x223, pPaddingInfo=0x0, pbIV=0x114cf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x114cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x114cf848, pbOutput=0x3e50000, pcbResult=0x114cf618) returned 0x0 [0155.893] WriteFile (in: hFile=0x5c4, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x114cf61c*=0x230, lpOverlapped=0x0) returned 1 [0155.894] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x114cf60c | out: lpNewFilePointer=0x0) returned 1 [0155.894] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.894] WriteFile (in: hFile=0x5c4, lpBuffer=0x114cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x114cf83c*, lpNumberOfBytesWritten=0x114cf61c*=0x8, lpOverlapped=0x0) returned 1 [0155.894] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.894] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.894] CloseHandle (hObject=0x5c4) returned 1 [0155.894] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\evrgreen.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\evrgreen.inf.play")) returned 1 [0155.898] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1406 os_tid = 0xae4 [0155.901] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.901] ReadFile (in: hFile=0x5cc, lpBuffer=0x1160fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1160f85c, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesRead=0x1160f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.903] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.904] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.904] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x1160f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0155.904] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x1160f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x1160f828, pbKeyObject=0x0) returned 0x0 [0155.905] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1160f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1160f500) returned 0x0 [0155.905] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.905] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1160f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1160f500) returned 0x0 [0155.910] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.912] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.912] WriteFile (in: hFile=0x5cc, lpBuffer=0x1160fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1160f830, lpOverlapped=0x0 | out: lpBuffer=0x1160fb34*, lpNumberOfBytesWritten=0x1160f830*=0x428, lpOverlapped=0x0) returned 1 [0155.912] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.912] ReadFile (in: hFile=0x5cc, lpBuffer=0x4050000, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x1160f61c*=0x54a, lpOverlapped=0x0) returned 1 [0155.912] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xfffffab6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.912] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4050000, cbInput=0x54a, pPaddingInfo=0x0, pbIV=0x1160f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x1160f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1160f848, pbOutput=0x4050000, pcbResult=0x1160f618) returned 0x0 [0155.912] WriteFile (in: hFile=0x5cc, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x1160f61c*=0x550, lpOverlapped=0x0) returned 1 [0155.913] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1160f60c | out: lpNewFilePointer=0x0) returned 1 [0155.913] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.913] WriteFile (in: hFile=0x5cc, lpBuffer=0x1160f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1160f61c, lpOverlapped=0x0 | out: lpBuffer=0x1160f83c*, lpNumberOfBytesWritten=0x1160f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.913] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.913] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.913] CloseHandle (hObject=0x5cc) returned 1 [0155.913] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\preview.gif.play")) returned 1 [0155.915] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1407 os_tid = 0x938 [0155.918] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.918] ReadFile (in: hFile=0x5dc, lpBuffer=0x1174fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1174f85c, lpOverlapped=0x0 | out: lpBuffer=0x1174fb34*, lpNumberOfBytesRead=0x1174f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.920] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.920] ReadFile (in: hFile=0x5dc, lpBuffer=0x1174fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1174f85c, lpOverlapped=0x0 | out: lpBuffer=0x1174fb34*, lpNumberOfBytesRead=0x1174f85c*=0x428, lpOverlapped=0x0) returned 1 [0155.920] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0155.921] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0155.921] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x1174f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0155.921] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x1174f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x1174f828, pbKeyObject=0x0) returned 0x0 [0155.921] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1174f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1174f500) returned 0x0 [0155.922] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0155.922] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1174f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1174f500) returned 0x0 [0155.927] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.929] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.929] WriteFile (in: hFile=0x5dc, lpBuffer=0x1174fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1174f830, lpOverlapped=0x0 | out: lpBuffer=0x1174fb34*, lpNumberOfBytesWritten=0x1174f830*=0x428, lpOverlapped=0x0) returned 1 [0155.929] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.930] ReadFile (in: hFile=0x5dc, lpBuffer=0x4150000, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1174f61c*=0x7eb1, lpOverlapped=0x0) returned 1 [0155.931] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xffff814f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.931] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4150000, cbInput=0x7eb1, pPaddingInfo=0x0, pbIV=0x1174f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1174f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x1174f848, pbOutput=0x4150000, pcbResult=0x1174f618) returned 0x0 [0155.931] WriteFile (in: hFile=0x5dc, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1174f61c*=0x7ec0, lpOverlapped=0x0) returned 1 [0155.931] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1174f60c | out: lpNewFilePointer=0x0) returned 1 [0155.931] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.931] WriteFile (in: hFile=0x5dc, lpBuffer=0x1174f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1174f61c, lpOverlapped=0x0 | out: lpBuffer=0x1174f83c*, lpNumberOfBytesWritten=0x1174f61c*=0x8, lpOverlapped=0x0) returned 1 [0155.931] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x7ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.931] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0155.931] CloseHandle (hObject=0x5dc) returned 1 [0155.932] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0155.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\evrgreen\\thmbnail.png.play")) returned 1 [0155.934] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1408 os_tid = 0x978 [0155.944] GetLastError () returned 0x57 [0155.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75df48 [0155.944] SetLastError (dwErrCode=0x57) [0155.944] IcmpCreateFile () returned 0x76a888 [0155.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dab8 [0155.944] IcmpSendEcho2 (IcmpHandle=0x76a888, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x100a8c0, RequestData=0xe80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dab8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1409 os_tid = 0xb4c [0155.945] GetLastError () returned 0x57 [0155.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e2d0 [0155.946] SetLastError (dwErrCode=0x57) [0155.946] IcmpCreateFile () returned 0x76a818 [0155.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73db08 [0155.946] IcmpSendEcho2 (IcmpHandle=0x76a818, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x200a8c0, RequestData=0x1188ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73db08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1410 os_tid = 0x9bc [0155.947] GetLastError () returned 0x57 [0155.947] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e658 [0155.947] SetLastError (dwErrCode=0x57) [0155.947] IcmpCreateFile () returned 0x76a850 [0155.947] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dba8 [0155.947] IcmpSendEcho2 (IcmpHandle=0x76a850, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x300a8c0, RequestData=0x119cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dba8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1411 os_tid = 0xb88 [0155.948] GetLastError () returned 0x57 [0155.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75e9e0 [0155.949] SetLastError (dwErrCode=0x57) [0155.949] IcmpCreateFile () returned 0x74edf0 [0155.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e0f8 [0155.949] IcmpSendEcho2 (IcmpHandle=0x74edf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x400a8c0, RequestData=0x11b0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e0f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1412 os_tid = 0x97c [0155.950] GetLastError () returned 0x57 [0155.950] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75ed68 [0155.950] SetLastError (dwErrCode=0x57) [0155.950] IcmpCreateFile () returned 0x74ee28 [0155.950] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e148 [0155.950] IcmpSendEcho2 (IcmpHandle=0x74ee28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x500a8c0, RequestData=0x1264ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e148, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1413 os_tid = 0xab0 [0155.951] GetLastError () returned 0x57 [0155.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f0f0 [0155.952] SetLastError (dwErrCode=0x57) [0155.952] IcmpCreateFile () returned 0x74ee60 [0155.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e198 [0155.952] IcmpSendEcho2 (IcmpHandle=0x74ee60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x600a8c0, RequestData=0x1278ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e198, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1414 os_tid = 0xaf0 [0155.953] GetLastError () returned 0x57 [0155.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f478 [0155.953] SetLastError (dwErrCode=0x57) [0155.953] IcmpCreateFile () returned 0x74ee98 [0155.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e1e8 [0155.953] IcmpSendEcho2 (IcmpHandle=0x74ee98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x700a8c0, RequestData=0x128cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e1e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1415 os_tid = 0x1100 [0155.954] GetLastError () returned 0x57 [0155.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75f800 [0155.955] SetLastError (dwErrCode=0x57) [0155.955] IcmpCreateFile () returned 0x74eed0 [0155.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e238 [0155.955] IcmpSendEcho2 (IcmpHandle=0x74eed0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x800a8c0, RequestData=0x12a0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e238, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1416 os_tid = 0x1108 [0155.956] GetLastError () returned 0x57 [0155.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75fb88 [0155.956] SetLastError (dwErrCode=0x57) [0155.956] IcmpCreateFile () returned 0x74ef08 [0155.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763b58 [0155.956] IcmpSendEcho2 (IcmpHandle=0x74ef08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x900a8c0, RequestData=0x12b4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763b58, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1417 os_tid = 0x10f4 [0155.958] GetLastError () returned 0x57 [0155.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75ff10 [0155.958] SetLastError (dwErrCode=0x57) [0155.958] IcmpCreateFile () returned 0x74ef40 [0155.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763ce8 [0155.958] IcmpSendEcho2 (IcmpHandle=0x74ef40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa00a8c0, RequestData=0x12c8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763ce8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1418 os_tid = 0x820 [0155.959] GetLastError () returned 0x57 [0155.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760298 [0155.959] SetLastError (dwErrCode=0x57) [0155.959] IcmpCreateFile () returned 0x74ef78 [0155.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763d38 [0155.959] IcmpSendEcho2 (IcmpHandle=0x74ef78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb00a8c0, RequestData=0x12dcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763d38, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1419 os_tid = 0xac4 [0155.961] GetLastError () returned 0x57 [0155.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760620 [0155.961] SetLastError (dwErrCode=0x57) [0155.961] IcmpCreateFile () returned 0x74a240 [0155.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763478 [0155.961] IcmpSendEcho2 (IcmpHandle=0x74a240, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc00a8c0, RequestData=0x12f0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763478, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1420 os_tid = 0xa1c [0155.962] GetLastError () returned 0x57 [0155.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7609a8 [0155.962] SetLastError (dwErrCode=0x57) [0155.962] IcmpCreateFile () returned 0x74a0b8 [0155.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763658 [0155.962] IcmpSendEcho2 (IcmpHandle=0x74a0b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd00a8c0, RequestData=0x1304ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763658, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1421 os_tid = 0x13ac [0155.964] GetLastError () returned 0x57 [0155.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x760d30 [0155.964] SetLastError (dwErrCode=0x57) [0155.964] IcmpCreateFile () returned 0x74a0f0 [0155.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7636a8 [0155.964] IcmpSendEcho2 (IcmpHandle=0x74a0f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe00a8c0, RequestData=0x1318ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7636a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1422 os_tid = 0xdac [0155.965] GetLastError () returned 0x57 [0155.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7610b8 [0155.965] SetLastError (dwErrCode=0x57) [0155.965] IcmpCreateFile () returned 0x74a128 [0155.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7636f8 [0155.965] IcmpSendEcho2 (IcmpHandle=0x74a128, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf00a8c0, RequestData=0x132cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7636f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1423 os_tid = 0x16d4 [0155.967] GetLastError () returned 0x57 [0155.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x761440 [0155.967] SetLastError (dwErrCode=0x57) [0155.967] IcmpCreateFile () returned 0x74a160 [0155.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763748 [0155.967] IcmpSendEcho2 (IcmpHandle=0x74a160, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1000a8c0, RequestData=0x1340ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763748, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1424 os_tid = 0x828 [0155.968] GetLastError () returned 0x57 [0155.968] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x75dbc0 [0155.968] SetLastError (dwErrCode=0x57) [0155.969] IcmpCreateFile () returned 0x74a198 [0155.969] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763798 [0155.969] IcmpSendEcho2 (IcmpHandle=0x74a198, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1100a8c0, RequestData=0x1354ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763798, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1425 os_tid = 0x770 [0155.970] GetLastError () returned 0x57 [0155.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef0f0 [0155.970] SetLastError (dwErrCode=0x57) [0155.970] IcmpCreateFile () returned 0x74a1d0 [0155.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7637e8 [0155.970] IcmpSendEcho2 (IcmpHandle=0x74a1d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1200a8c0, RequestData=0x1368ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7637e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1426 os_tid = 0x1120 [0155.971] GetLastError () returned 0x57 [0155.971] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef478 [0155.972] SetLastError (dwErrCode=0x57) [0155.972] IcmpCreateFile () returned 0x74a208 [0155.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763838 [0155.972] IcmpSendEcho2 (IcmpHandle=0x74a208, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1300a8c0, RequestData=0x137cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763838, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1427 os_tid = 0x1118 [0155.973] GetLastError () returned 0x57 [0155.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ef800 [0155.974] SetLastError (dwErrCode=0x57) [0155.974] IcmpCreateFile () returned 0x74a278 [0155.974] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763888 [0155.974] IcmpSendEcho2 (IcmpHandle=0x74a278, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1400a8c0, RequestData=0x1390ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763888, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1428 os_tid = 0xda4 [0155.975] GetLastError () returned 0x57 [0155.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6efb88 [0155.975] SetLastError (dwErrCode=0x57) [0155.975] IcmpCreateFile () returned 0x74a2b0 [0155.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7638d8 [0155.975] IcmpSendEcho2 (IcmpHandle=0x74a2b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1500a8c0, RequestData=0x13a4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7638d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1429 os_tid = 0x10f0 [0155.976] GetLastError () returned 0x57 [0155.976] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eff10 [0155.977] SetLastError (dwErrCode=0x57) [0155.977] IcmpCreateFile () returned 0x74a2e8 [0155.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763928 [0155.977] IcmpSendEcho2 (IcmpHandle=0x74a2e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1600a8c0, RequestData=0x13b8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763928, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1430 os_tid = 0x111c [0155.978] GetLastError () returned 0x57 [0155.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9198 [0155.978] SetLastError (dwErrCode=0x57) [0155.978] IcmpCreateFile () returned 0x74a320 [0155.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763978 [0155.978] IcmpSendEcho2 (IcmpHandle=0x74a320, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1700a8c0, RequestData=0x13ccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763978, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1431 os_tid = 0x1404 [0155.979] GetLastError () returned 0x57 [0155.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9520 [0155.980] SetLastError (dwErrCode=0x57) [0155.980] IcmpCreateFile () returned 0x74a358 [0155.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7639c8 [0155.980] IcmpSendEcho2 (IcmpHandle=0x74a358, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1800a8c0, RequestData=0x13e0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7639c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1432 os_tid = 0x1408 [0155.982] GetLastError () returned 0x57 [0155.982] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77d818 [0155.982] SetLastError (dwErrCode=0x57) [0155.982] IcmpCreateFile () returned 0x74a400 [0155.983] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763a68 [0155.983] IcmpSendEcho2 (IcmpHandle=0x74a400, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1900a8c0, RequestData=0x13f4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763a68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1433 os_tid = 0x140c [0155.984] GetLastError () returned 0x57 [0155.984] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77b850 [0155.984] SetLastError (dwErrCode=0x57) [0155.984] IcmpCreateFile () returned 0x74a390 [0155.984] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763a18 [0155.984] IcmpSendEcho2 (IcmpHandle=0x74a390, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1a00a8c0, RequestData=0x164cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763a18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1434 os_tid = 0x1410 [0155.985] GetLastError () returned 0x57 [0155.985] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77bbd8 [0155.985] SetLastError (dwErrCode=0x57) [0155.985] IcmpCreateFile () returned 0x74a3c8 [0155.986] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763ab8 [0155.986] IcmpSendEcho2 (IcmpHandle=0x74a3c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b00a8c0, RequestData=0x1827ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763ab8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1435 os_tid = 0x1414 [0155.994] GetLastError () returned 0x57 [0155.995] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77c2e8 [0155.995] SetLastError (dwErrCode=0x57) [0155.995] IcmpCreateFile () returned 0x74a438 [0155.995] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763b08 [0155.995] IcmpSendEcho2 (IcmpHandle=0x74a438, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1c00a8c0, RequestData=0x183bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763b08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1436 os_tid = 0x1418 [0155.996] GetLastError () returned 0x57 [0155.996] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77bf60 [0155.996] SetLastError (dwErrCode=0x57) [0155.997] IcmpCreateFile () returned 0x74a470 [0155.997] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763ba8 [0155.997] IcmpSendEcho2 (IcmpHandle=0x74a470, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1d00a8c0, RequestData=0x184fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763ba8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1437 os_tid = 0x141c [0155.998] GetLastError () returned 0x57 [0155.998] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77c670 [0155.998] SetLastError (dwErrCode=0x57) [0155.998] IcmpCreateFile () returned 0x74a4a8 [0155.998] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763bf8 [0155.998] IcmpSendEcho2 (IcmpHandle=0x74a4a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1e00a8c0, RequestData=0x1863ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763bf8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1438 os_tid = 0x1420 [0155.999] GetLastError () returned 0x57 [0155.999] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77c9f8 [0156.000] SetLastError (dwErrCode=0x57) [0156.000] IcmpCreateFile () returned 0x74a4e0 [0156.000] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763c48 [0156.000] IcmpSendEcho2 (IcmpHandle=0x74a4e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1f00a8c0, RequestData=0x1877ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763c48, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1439 os_tid = 0x1424 [0156.001] GetLastError () returned 0x57 [0156.001] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77cd80 [0156.001] SetLastError (dwErrCode=0x57) [0156.001] IcmpCreateFile () returned 0x74a518 [0156.001] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763c98 [0156.001] IcmpSendEcho2 (IcmpHandle=0x74a518, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2000a8c0, RequestData=0x188bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763c98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1440 os_tid = 0x1428 [0156.002] GetLastError () returned 0x57 [0156.003] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77d108 [0156.003] SetLastError (dwErrCode=0x57) [0156.003] IcmpCreateFile () returned 0x74a550 [0156.003] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763d88 [0156.003] IcmpSendEcho2 (IcmpHandle=0x74a550, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2100a8c0, RequestData=0x189fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763d88, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1441 os_tid = 0x142c [0156.004] GetLastError () returned 0x57 [0156.004] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77d490 [0156.005] SetLastError (dwErrCode=0x57) [0156.005] IcmpCreateFile () returned 0x749e88 [0156.005] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763dd8 [0156.005] IcmpSendEcho2 (IcmpHandle=0x749e88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2200a8c0, RequestData=0x18b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763dd8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1442 os_tid = 0x1430 [0156.006] GetLastError () returned 0x57 [0156.006] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77dba0 [0156.006] SetLastError (dwErrCode=0x57) [0156.006] IcmpCreateFile () returned 0x749ec0 [0156.006] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763428 [0156.006] IcmpSendEcho2 (IcmpHandle=0x749ec0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2300a8c0, RequestData=0x18c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763428, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1443 os_tid = 0x1434 [0156.007] GetLastError () returned 0x57 [0156.007] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77df28 [0156.007] SetLastError (dwErrCode=0x57) [0156.007] IcmpCreateFile () returned 0x749ef8 [0156.007] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7634c8 [0156.007] IcmpSendEcho2 (IcmpHandle=0x749ef8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2400a8c0, RequestData=0x18dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7634c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1444 os_tid = 0x1438 [0156.008] GetLastError () returned 0x57 [0156.008] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77e2b0 [0156.008] SetLastError (dwErrCode=0x57) [0156.008] IcmpCreateFile () returned 0x749f30 [0156.008] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763518 [0156.008] IcmpSendEcho2 (IcmpHandle=0x749f30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2500a8c0, RequestData=0x18efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763518, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1445 os_tid = 0x143c [0156.009] GetLastError () returned 0x57 [0156.009] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77e638 [0156.009] SetLastError (dwErrCode=0x57) [0156.009] IcmpCreateFile () returned 0x749f68 [0156.010] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763568 [0156.010] IcmpSendEcho2 (IcmpHandle=0x749f68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2600a8c0, RequestData=0x1903ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763568, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1446 os_tid = 0x1440 [0156.010] GetLastError () returned 0x57 [0156.011] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77e9c0 [0156.011] SetLastError (dwErrCode=0x57) [0156.011] IcmpCreateFile () returned 0x749fa0 [0156.011] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7635b8 [0156.011] IcmpSendEcho2 (IcmpHandle=0x749fa0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2700a8c0, RequestData=0x1917ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7635b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1447 os_tid = 0x1444 [0156.012] GetLastError () returned 0x57 [0156.012] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77ed48 [0156.012] SetLastError (dwErrCode=0x57) [0156.012] IcmpCreateFile () returned 0x749fd8 [0156.012] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763608 [0156.012] IcmpSendEcho2 (IcmpHandle=0x749fd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2800a8c0, RequestData=0x192bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763608, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1448 os_tid = 0x1448 [0156.014] GetLastError () returned 0x57 [0156.014] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77f0d0 [0156.014] SetLastError (dwErrCode=0x57) [0156.014] IcmpCreateFile () returned 0x74a010 [0156.014] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764378 [0156.014] IcmpSendEcho2 (IcmpHandle=0x74a010, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2900a8c0, RequestData=0x193fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764378, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1449 os_tid = 0x144c [0156.015] GetLastError () returned 0x57 [0156.015] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x77b4c8 [0156.015] SetLastError (dwErrCode=0x57) [0156.015] IcmpCreateFile () returned 0x74a048 [0156.015] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763e28 [0156.015] IcmpSendEcho2 (IcmpHandle=0x74a048, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2a00a8c0, RequestData=0x1953ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763e28, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1450 os_tid = 0x1450 [0156.019] GetLastError () returned 0x57 [0156.019] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76dbe8 [0156.021] SetLastError (dwErrCode=0x57) [0156.021] IcmpCreateFile () returned 0x74a080 [0156.021] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764328 [0156.021] IcmpSendEcho2 (IcmpHandle=0x74a080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2b00a8c0, RequestData=0x1967ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764328, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1451 os_tid = 0x1454 [0156.022] GetLastError () returned 0x57 [0156.022] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772610 [0156.023] SetLastError (dwErrCode=0x57) [0156.023] IcmpCreateFile () returned 0x74a5c0 [0156.023] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763e78 [0156.023] IcmpSendEcho2 (IcmpHandle=0x74a5c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2c00a8c0, RequestData=0x197bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763e78, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1452 os_tid = 0x1458 [0156.024] GetLastError () returned 0x57 [0156.024] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772998 [0156.024] SetLastError (dwErrCode=0x57) [0156.024] IcmpCreateFile () returned 0x74a5f8 [0156.024] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763ec8 [0156.024] IcmpSendEcho2 (IcmpHandle=0x74a5f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2d00a8c0, RequestData=0x198fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763ec8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1453 os_tid = 0x145c [0156.026] GetLastError () returned 0x57 [0156.026] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771f00 [0156.026] SetLastError (dwErrCode=0x57) [0156.026] IcmpCreateFile () returned 0x74a588 [0156.026] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764058 [0156.026] IcmpSendEcho2 (IcmpHandle=0x74a588, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2e00a8c0, RequestData=0x19a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764058, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1454 os_tid = 0x1460 [0156.027] GetLastError () returned 0x57 [0156.027] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772d20 [0156.027] SetLastError (dwErrCode=0x57) [0156.027] IcmpCreateFile () returned 0x7749c8 [0156.027] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764008 [0156.027] IcmpSendEcho2 (IcmpHandle=0x7749c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2f00a8c0, RequestData=0x19b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764008, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1455 os_tid = 0x1464 [0156.029] GetLastError () returned 0x57 [0156.029] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7730a8 [0156.029] SetLastError (dwErrCode=0x57) [0156.029] IcmpCreateFile () returned 0x7744c0 [0156.029] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763f18 [0156.029] IcmpSendEcho2 (IcmpHandle=0x7744c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3000a8c0, RequestData=0x19cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763f18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1456 os_tid = 0x1468 [0156.030] GetLastError () returned 0x57 [0156.030] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76c330 [0156.030] SetLastError (dwErrCode=0x57) [0156.030] IcmpCreateFile () returned 0x7744f8 [0156.031] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763f68 [0156.031] IcmpSendEcho2 (IcmpHandle=0x7744f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3100a8c0, RequestData=0x19dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763f68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1457 os_tid = 0x146c [0156.032] GetLastError () returned 0x57 [0156.032] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76c6b8 [0156.032] SetLastError (dwErrCode=0x57) [0156.032] IcmpCreateFile () returned 0x774530 [0156.032] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x763fb8 [0156.032] IcmpSendEcho2 (IcmpHandle=0x774530, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3200a8c0, RequestData=0x19f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x763fb8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1458 os_tid = 0x1470 [0156.033] GetLastError () returned 0x57 [0156.034] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76ca40 [0156.034] SetLastError (dwErrCode=0x57) [0156.034] IcmpCreateFile () returned 0x774568 [0156.034] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7640a8 [0156.034] IcmpSendEcho2 (IcmpHandle=0x774568, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3300a8c0, RequestData=0x1a07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7640a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1459 os_tid = 0x1474 [0156.035] GetLastError () returned 0x57 [0156.035] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76cdc8 [0156.036] SetLastError (dwErrCode=0x57) [0156.036] IcmpCreateFile () returned 0x7745a0 [0156.036] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7640f8 [0156.036] IcmpSendEcho2 (IcmpHandle=0x7745a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3400a8c0, RequestData=0x1a1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7640f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1460 os_tid = 0x1478 [0156.037] GetLastError () returned 0x57 [0156.037] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76d150 [0156.037] SetLastError (dwErrCode=0x57) [0156.037] IcmpCreateFile () returned 0x7745d8 [0156.037] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764148 [0156.037] IcmpSendEcho2 (IcmpHandle=0x7745d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3500a8c0, RequestData=0x1a2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764148, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1461 os_tid = 0x147c [0156.039] GetLastError () returned 0x57 [0156.039] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76d4d8 [0156.039] SetLastError (dwErrCode=0x57) [0156.039] IcmpCreateFile () returned 0x774610 [0156.039] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764198 [0156.039] IcmpSendEcho2 (IcmpHandle=0x774610, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3600a8c0, RequestData=0x1a43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764198, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1462 os_tid = 0x1480 [0156.040] GetLastError () returned 0x57 [0156.040] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76d860 [0156.040] SetLastError (dwErrCode=0x57) [0156.040] IcmpCreateFile () returned 0x774648 [0156.040] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7641e8 [0156.040] IcmpSendEcho2 (IcmpHandle=0x774648, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3700a8c0, RequestData=0x1a57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7641e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1463 os_tid = 0x1484 [0156.042] GetLastError () returned 0x57 [0156.042] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76df70 [0156.042] SetLastError (dwErrCode=0x57) [0156.042] IcmpCreateFile () returned 0x774680 [0156.042] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764238 [0156.042] IcmpSendEcho2 (IcmpHandle=0x774680, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3800a8c0, RequestData=0x1a6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764238, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1464 os_tid = 0x1488 [0156.044] GetLastError () returned 0x57 [0156.045] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76fbb0 [0156.045] SetLastError (dwErrCode=0x57) [0156.045] IcmpCreateFile () returned 0x774920 [0156.045] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x764288 [0156.045] IcmpSendEcho2 (IcmpHandle=0x774920, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3900a8c0, RequestData=0x1a8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x764288, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1465 os_tid = 0x148c [0156.046] GetLastError () returned 0x57 [0156.046] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76e2f8 [0156.046] SetLastError (dwErrCode=0x57) [0156.046] IcmpCreateFile () returned 0x774370 [0156.046] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7642d8 [0156.046] IcmpSendEcho2 (IcmpHandle=0x774370, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3a00a8c0, RequestData=0x1aa3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7642d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1466 os_tid = 0x1490 [0156.047] GetLastError () returned 0x57 [0156.048] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76e680 [0156.048] SetLastError (dwErrCode=0x57) [0156.048] IcmpCreateFile () returned 0x7743a8 [0156.048] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783e78 [0156.048] IcmpSendEcho2 (IcmpHandle=0x7743a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3b00a8c0, RequestData=0x1ab7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783e78, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1467 os_tid = 0x1494 [0156.049] GetLastError () returned 0x57 [0156.049] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76ff38 [0156.049] SetLastError (dwErrCode=0x57) [0156.049] IcmpCreateFile () returned 0x7746b8 [0156.049] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783ec8 [0156.049] IcmpSendEcho2 (IcmpHandle=0x7746b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3c00a8c0, RequestData=0x1acbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783ec8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1468 os_tid = 0x1498 [0156.050] GetLastError () returned 0x57 [0156.051] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7702c0 [0156.051] SetLastError (dwErrCode=0x57) [0156.051] IcmpCreateFile () returned 0x7746f0 [0156.051] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784238 [0156.051] IcmpSendEcho2 (IcmpHandle=0x7746f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3d00a8c0, RequestData=0x1adfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784238, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1469 os_tid = 0x149c [0156.052] GetLastError () returned 0x57 [0156.052] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770648 [0156.052] SetLastError (dwErrCode=0x57) [0156.052] IcmpCreateFile () returned 0x774728 [0156.052] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784288 [0156.052] IcmpSendEcho2 (IcmpHandle=0x774728, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3e00a8c0, RequestData=0x1af3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784288, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1470 os_tid = 0x14a0 [0156.054] GetLastError () returned 0x57 [0156.054] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7709d0 [0156.054] SetLastError (dwErrCode=0x57) [0156.054] IcmpCreateFile () returned 0x774760 [0156.054] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7842d8 [0156.054] IcmpSendEcho2 (IcmpHandle=0x774760, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3f00a8c0, RequestData=0x1b07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7842d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1471 os_tid = 0x14a4 [0156.055] GetLastError () returned 0x57 [0156.055] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x770d58 [0156.055] SetLastError (dwErrCode=0x57) [0156.055] IcmpCreateFile () returned 0x774798 [0156.055] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784328 [0156.055] IcmpSendEcho2 (IcmpHandle=0x774798, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4000a8c0, RequestData=0x1b1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784328, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1472 os_tid = 0x14a8 [0156.059] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.060] ReadFile (in: hFile=0x3cc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.061] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.061] ReadFile (in: hFile=0x3cc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.062] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.063] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.064] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0156.064] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0156.064] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0156.064] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.064] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0156.069] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.071] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.071] WriteFile (in: hFile=0x3cc, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0156.072] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.072] ReadFile (in: hFile=0x3cc, lpBuffer=0x2750000, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xe9f61c*=0x19539, lpOverlapped=0x0) returned 1 [0156.074] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffe6ac7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.075] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0x19539, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe9f848, pbOutput=0x2750000, pcbResult=0xe9f618) returned 0x0 [0156.075] WriteFile (in: hFile=0x3cc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xe9f61c*=0x19540, lpOverlapped=0x0) returned 1 [0156.075] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0156.075] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.075] WriteFile (in: hFile=0x3cc, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.075] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x19540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.076] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.076] CloseHandle (hObject=0x3cc) returned 1 [0156.076] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0156.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\expeditn.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\expeditn.elm.play")) returned 1 [0156.078] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1473 os_tid = 0x14ac [0156.072] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.081] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0156.081] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0156.081] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0156.081] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.081] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0156.086] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.087] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.088] WriteFile (in: hFile=0x7e4, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0156.091] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.091] ReadFile (in: hFile=0x7e4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x111f61c*=0x255, lpOverlapped=0x0) returned 1 [0156.091] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffdab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.092] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2850000, cbInput=0x255, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2850000, pcbResult=0x111f618) returned 0x0 [0156.092] WriteFile (in: hFile=0x7e4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x111f61c*=0x260, lpOverlapped=0x0) returned 1 [0156.092] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0156.092] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.092] WriteFile (in: hFile=0x7e4, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.092] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.092] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.092] CloseHandle (hObject=0x7e4) returned 1 [0156.092] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\expeditn.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\expeditn.inf.play")) returned 1 [0156.096] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1474 os_tid = 0x14b0 [0156.099] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.099] ReadFile (in: hFile=0xb6c, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.101] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.101] ReadFile (in: hFile=0xb6c, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.101] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.102] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.102] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0156.102] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0156.102] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xea8f500) returned 0x0 [0156.102] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.103] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xea8f500) returned 0x0 [0156.107] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.109] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.109] WriteFile (in: hFile=0xb6c, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0156.110] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.110] ReadFile (in: hFile=0xb6c, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xea8f61c*=0x1400, lpOverlapped=0x0) returned 1 [0156.110] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xffffec00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.110] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0x1400, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xea8f848, pbOutput=0x2950000, pcbResult=0xea8f618) returned 0x0 [0156.110] WriteFile (in: hFile=0xb6c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xea8f61c*=0x1410, lpOverlapped=0x0) returned 1 [0156.110] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0156.110] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.110] WriteFile (in: hFile=0xb6c, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.110] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x1410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.110] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.111] CloseHandle (hObject=0xb6c) returned 1 [0156.111] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\preview.gif.play")) returned 1 [0156.113] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1475 os_tid = 0x14b4 [0156.116] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.116] ReadFile (in: hFile=0xb74, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.118] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.118] ReadFile (in: hFile=0xb74, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.118] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.119] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0156.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0156.119] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xebcf500) returned 0x0 [0156.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.120] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xebcf500) returned 0x0 [0156.124] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.126] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.126] WriteFile (in: hFile=0xb74, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0156.127] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.127] ReadFile (in: hFile=0xb74, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0xebcf61c*=0xed34, lpOverlapped=0x0) returned 1 [0156.128] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0xffff12cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.128] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3f50000, cbInput=0xed34, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xebcf848, pbOutput=0x3f50000, pcbResult=0xebcf618) returned 0x0 [0156.128] WriteFile (in: hFile=0xb74, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0xebcf61c*=0xed40, lpOverlapped=0x0) returned 1 [0156.128] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0156.128] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.128] WriteFile (in: hFile=0xb74, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.129] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0xed40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.129] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.129] CloseHandle (hObject=0xb74) returned 1 [0156.129] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\expeditn\\thmbnail.png.play")) returned 1 [0156.131] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1476 os_tid = 0xa6c [0156.134] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.134] ReadFile (in: hFile=0xb7c, lpBuffer=0x1b2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1b2ffb34*, lpNumberOfBytesRead=0x1b2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.137] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.137] ReadFile (in: hFile=0xb7c, lpBuffer=0x1b2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1b2ffb34*, lpNumberOfBytesRead=0x1b2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.137] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.138] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.138] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x1b2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0156.138] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x1b2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x1b2ff828, pbKeyObject=0x0) returned 0x0 [0156.138] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1b2ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1b2ff500) returned 0x0 [0156.139] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.139] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1b2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1b2ff500) returned 0x0 [0156.144] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.145] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.145] WriteFile (in: hFile=0xb7c, lpBuffer=0x1b2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1b2ff830, lpOverlapped=0x0 | out: lpBuffer=0x1b2ffb34*, lpNumberOfBytesWritten=0x1b2ff830*=0x428, lpOverlapped=0x0) returned 1 [0156.146] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.146] ReadFile (in: hFile=0xb7c, lpBuffer=0x4250000, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x1b2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x1b2ff61c*=0x109d0, lpOverlapped=0x0) returned 1 [0156.149] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xfffef630, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.149] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4250000, cbInput=0x109d0, pPaddingInfo=0x0, pbIV=0x1b2ff848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x1b2ff618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1b2ff848, pbOutput=0x4250000, pcbResult=0x1b2ff618) returned 0x0 [0156.149] WriteFile (in: hFile=0xb7c, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x109e0, lpNumberOfBytesWritten=0x1b2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x1b2ff61c*=0x109e0, lpOverlapped=0x0) returned 1 [0156.149] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b2ff60c | out: lpNewFilePointer=0x0) returned 1 [0156.149] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.150] WriteFile (in: hFile=0xb7c, lpBuffer=0x1b2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x1b2ff83c*, lpNumberOfBytesWritten=0x1b2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0156.150] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x109e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.150] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.150] CloseHandle (hObject=0xb7c) returned 1 [0156.150] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0156.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\ice.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\ice.elm.play")) returned 1 [0156.152] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1477 os_tid = 0xe58 [0156.147] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.155] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x1b43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0156.155] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x1b43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x1b43f828, pbKeyObject=0x0) returned 0x0 [0156.155] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1b43f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1b43f500) returned 0x0 [0156.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.155] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1b43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1b43f500) returned 0x0 [0156.160] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.162] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.162] WriteFile (in: hFile=0xb84, lpBuffer=0x1b43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1b43f830, lpOverlapped=0x0 | out: lpBuffer=0x1b43fb34*, lpNumberOfBytesWritten=0x1b43f830*=0x428, lpOverlapped=0x0) returned 1 [0156.165] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.165] ReadFile (in: hFile=0xb84, lpBuffer=0x4350000, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x1b43f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x1b43f61c*=0x1ad, lpOverlapped=0x0) returned 1 [0156.165] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0xfffffe53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.165] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4350000, cbInput=0x1ad, pPaddingInfo=0x0, pbIV=0x1b43f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x1b43f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1b43f848, pbOutput=0x4350000, pcbResult=0x1b43f618) returned 0x0 [0156.165] WriteFile (in: hFile=0xb84, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x1b43f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x1b43f61c*=0x1b0, lpOverlapped=0x0) returned 1 [0156.165] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b43f60c | out: lpNewFilePointer=0x0) returned 1 [0156.165] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.166] WriteFile (in: hFile=0xb84, lpBuffer=0x1b43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b43f61c, lpOverlapped=0x0 | out: lpBuffer=0x1b43f83c*, lpNumberOfBytesWritten=0x1b43f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.166] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x1b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.166] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.166] CloseHandle (hObject=0xb84) returned 1 [0156.166] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\ice.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\ice.inf.play")) returned 1 [0156.168] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1478 os_tid = 0x14bc [0156.171] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.171] ReadFile (in: hFile=0xb8c, lpBuffer=0x1b57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b57f85c, lpOverlapped=0x0 | out: lpBuffer=0x1b57fb34*, lpNumberOfBytesRead=0x1b57f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.172] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.173] ReadFile (in: hFile=0xb8c, lpBuffer=0x1b57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b57f85c, lpOverlapped=0x0 | out: lpBuffer=0x1b57fb34*, lpNumberOfBytesRead=0x1b57f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.174] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.174] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x1b57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0156.174] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x1b57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x1b57f828, pbKeyObject=0x0) returned 0x0 [0156.174] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1b57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1b57f500) returned 0x0 [0156.174] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.174] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1b57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1b57f500) returned 0x0 [0156.179] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.181] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.181] WriteFile (in: hFile=0xb8c, lpBuffer=0x1b57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1b57f830, lpOverlapped=0x0 | out: lpBuffer=0x1b57fb34*, lpNumberOfBytesWritten=0x1b57f830*=0x428, lpOverlapped=0x0) returned 1 [0156.181] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.181] ReadFile (in: hFile=0xb8c, lpBuffer=0x4450000, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x1b57f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x1b57f61c*=0x9f8, lpOverlapped=0x0) returned 1 [0156.182] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffff608, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.182] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4450000, cbInput=0x9f8, pPaddingInfo=0x0, pbIV=0x1b57f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x1b57f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1b57f848, pbOutput=0x4450000, pcbResult=0x1b57f618) returned 0x0 [0156.182] WriteFile (in: hFile=0xb8c, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x1b57f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x1b57f61c*=0xa00, lpOverlapped=0x0) returned 1 [0156.182] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b57f60c | out: lpNewFilePointer=0x0) returned 1 [0156.182] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.182] WriteFile (in: hFile=0xb8c, lpBuffer=0x1b57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b57f61c, lpOverlapped=0x0 | out: lpBuffer=0x1b57f83c*, lpNumberOfBytesWritten=0x1b57f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.182] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.182] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.182] CloseHandle (hObject=0xb8c) returned 1 [0156.182] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\preview.gif.play")) returned 1 [0156.186] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1479 os_tid = 0x14c0 [0156.190] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.190] ReadFile (in: hFile=0xb94, lpBuffer=0x1b6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x1b6bfb34*, lpNumberOfBytesRead=0x1b6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.192] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.192] ReadFile (in: hFile=0xb94, lpBuffer=0x1b6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x1b6bfb34*, lpNumberOfBytesRead=0x1b6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.192] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.193] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.194] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x1b6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0156.194] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x1b6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x1b6bf828, pbKeyObject=0x0) returned 0x0 [0156.194] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1b6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1b6bf500) returned 0x0 [0156.194] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.194] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1b6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1b6bf500) returned 0x0 [0156.199] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.200] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.200] WriteFile (in: hFile=0xb94, lpBuffer=0x1b6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1b6bf830, lpOverlapped=0x0 | out: lpBuffer=0x1b6bfb34*, lpNumberOfBytesWritten=0x1b6bf830*=0x428, lpOverlapped=0x0) returned 1 [0156.201] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.201] ReadFile (in: hFile=0xb94, lpBuffer=0x4550000, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x1b6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x1b6bf61c*=0x4981, lpOverlapped=0x0) returned 1 [0156.201] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0xffffb67f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.201] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4550000, cbInput=0x4981, pPaddingInfo=0x0, pbIV=0x1b6bf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x1b6bf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1b6bf848, pbOutput=0x4550000, pcbResult=0x1b6bf618) returned 0x0 [0156.201] WriteFile (in: hFile=0xb94, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x1b6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x1b6bf61c*=0x4990, lpOverlapped=0x0) returned 1 [0156.202] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b6bf60c | out: lpNewFilePointer=0x0) returned 1 [0156.202] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.202] WriteFile (in: hFile=0xb94, lpBuffer=0x1b6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x1b6bf83c*, lpNumberOfBytesWritten=0x1b6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.202] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x4990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.202] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.202] CloseHandle (hObject=0xb94) returned 1 [0156.202] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.203] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ice\\thmbnail.png.play")) returned 1 [0156.204] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1480 os_tid = 0x14c4 [0156.206] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.207] ReadFile (in: hFile=0xb9c, lpBuffer=0x1b7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1b7ffb34*, lpNumberOfBytesRead=0x1b7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.209] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.209] ReadFile (in: hFile=0xb9c, lpBuffer=0x1b7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1b7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1b7ffb34*, lpNumberOfBytesRead=0x1b7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.209] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.211] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x1b7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0156.211] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x1b7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x1b7ff828, pbKeyObject=0x0) returned 0x0 [0156.211] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1b7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1b7ff500) returned 0x0 [0156.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.211] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1b7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1b7ff500) returned 0x0 [0156.216] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.217] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.218] WriteFile (in: hFile=0xb9c, lpBuffer=0x1b7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1b7ff830, lpOverlapped=0x0 | out: lpBuffer=0x1b7ffb34*, lpNumberOfBytesWritten=0x1b7ff830*=0x428, lpOverlapped=0x0) returned 1 [0156.218] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.218] ReadFile (in: hFile=0xb9c, lpBuffer=0x4650000, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x1b7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x1b7ff61c*=0x184e9, lpOverlapped=0x0) returned 1 [0156.221] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0xfffe7b17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.221] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4650000, cbInput=0x184e9, pPaddingInfo=0x0, pbIV=0x1b7ff848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x1b7ff618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1b7ff848, pbOutput=0x4650000, pcbResult=0x1b7ff618) returned 0x0 [0156.221] WriteFile (in: hFile=0xb9c, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x1b7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x1b7ff61c*=0x184f0, lpOverlapped=0x0) returned 1 [0156.221] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b7ff60c | out: lpNewFilePointer=0x0) returned 1 [0156.222] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.222] WriteFile (in: hFile=0xb9c, lpBuffer=0x1b7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x1b7ff83c*, lpNumberOfBytesWritten=0x1b7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0156.222] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x184f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.222] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.222] CloseHandle (hObject=0xb9c) returned 1 [0156.222] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0156.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\indust.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\indust.elm.play")) returned 1 [0156.225] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1481 os_tid = 0x14d0 [0156.219] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.227] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.227] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x1b93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0156.227] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x1b93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x1b93f828, pbKeyObject=0x0) returned 0x0 [0156.227] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1b93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1b93f500) returned 0x0 [0156.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.228] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1b93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1b93f500) returned 0x0 [0156.233] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.235] SetFilePointerEx (in: hFile=0xba4, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.235] WriteFile (in: hFile=0xba4, lpBuffer=0x1b93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1b93f830, lpOverlapped=0x0 | out: lpBuffer=0x1b93fb34*, lpNumberOfBytesWritten=0x1b93f830*=0x428, lpOverlapped=0x0) returned 1 [0156.238] SetFilePointerEx (in: hFile=0xba4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.238] ReadFile (in: hFile=0xba4, lpBuffer=0x4750000, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x1b93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x1b93f61c*=0x225, lpOverlapped=0x0) returned 1 [0156.238] SetFilePointerEx (in: hFile=0xba4, liDistanceToMove=0xfffffddb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.238] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4750000, cbInput=0x225, pPaddingInfo=0x0, pbIV=0x1b93f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x1b93f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1b93f848, pbOutput=0x4750000, pcbResult=0x1b93f618) returned 0x0 [0156.238] WriteFile (in: hFile=0xba4, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x1b93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x1b93f61c*=0x230, lpOverlapped=0x0) returned 1 [0156.238] SetFilePointerEx (in: hFile=0xba4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b93f60c | out: lpNewFilePointer=0x0) returned 1 [0156.239] SetFilePointerEx (in: hFile=0xba4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.239] WriteFile (in: hFile=0xba4, lpBuffer=0x1b93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b93f61c, lpOverlapped=0x0 | out: lpBuffer=0x1b93f83c*, lpNumberOfBytesWritten=0x1b93f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.239] SetFilePointerEx (in: hFile=0xba4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.239] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.239] CloseHandle (hObject=0xba4) returned 1 [0156.239] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\indust.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\indust.inf.play")) returned 1 [0156.241] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1482 os_tid = 0x14d4 [0156.244] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.244] ReadFile (in: hFile=0xbac, lpBuffer=0x1ba7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1ba7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1ba7fb34*, lpNumberOfBytesRead=0x1ba7f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.246] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.246] ReadFile (in: hFile=0xbac, lpBuffer=0x1ba7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1ba7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1ba7fb34*, lpNumberOfBytesRead=0x1ba7f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.247] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.248] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.248] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x1ba7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0156.248] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x1ba7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x1ba7f828, pbKeyObject=0x0) returned 0x0 [0156.248] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1ba7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1ba7f500) returned 0x0 [0156.248] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.248] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1ba7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1ba7f500) returned 0x0 [0156.253] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.255] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.255] WriteFile (in: hFile=0xbac, lpBuffer=0x1ba7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1ba7f830, lpOverlapped=0x0 | out: lpBuffer=0x1ba7fb34*, lpNumberOfBytesWritten=0x1ba7f830*=0x428, lpOverlapped=0x0) returned 1 [0156.256] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.256] ReadFile (in: hFile=0xbac, lpBuffer=0x4850000, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x1ba7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x1ba7f61c*=0x143b, lpOverlapped=0x0) returned 1 [0156.256] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xffffebc5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.256] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4850000, cbInput=0x143b, pPaddingInfo=0x0, pbIV=0x1ba7f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x1ba7f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1ba7f848, pbOutput=0x4850000, pcbResult=0x1ba7f618) returned 0x0 [0156.256] WriteFile (in: hFile=0xbac, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x1ba7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x1ba7f61c*=0x1440, lpOverlapped=0x0) returned 1 [0156.256] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ba7f60c | out: lpNewFilePointer=0x0) returned 1 [0156.256] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.256] WriteFile (in: hFile=0xbac, lpBuffer=0x1ba7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ba7f61c, lpOverlapped=0x0 | out: lpBuffer=0x1ba7f83c*, lpNumberOfBytesWritten=0x1ba7f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.256] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x1440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.256] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.256] CloseHandle (hObject=0xbac) returned 1 [0156.257] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\preview.gif.play")) returned 1 [0156.260] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1483 os_tid = 0x14d8 [0156.245] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.259] ReadFile (in: hFile=0xbb4, lpBuffer=0x1bbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1bbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x1bbbfb34*, lpNumberOfBytesRead=0x1bbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.265] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.265] ReadFile (in: hFile=0xbb4, lpBuffer=0x1bbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1bbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x1bbbfb34*, lpNumberOfBytesRead=0x1bbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.265] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.266] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.266] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x1bbbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0156.266] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x1bbbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x1bbbf828, pbKeyObject=0x0) returned 0x0 [0156.266] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1bbbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1bbbf500) returned 0x0 [0156.266] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.267] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1bbbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1bbbf500) returned 0x0 [0156.271] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.273] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.273] WriteFile (in: hFile=0xbb4, lpBuffer=0x1bbbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1bbbf830, lpOverlapped=0x0 | out: lpBuffer=0x1bbbfb34*, lpNumberOfBytesWritten=0x1bbbf830*=0x428, lpOverlapped=0x0) returned 1 [0156.274] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.274] ReadFile (in: hFile=0xbb4, lpBuffer=0x4950000, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x1bbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x1bbbf61c*=0x8317, lpOverlapped=0x0) returned 1 [0156.275] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0xffff7ce9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.275] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4950000, cbInput=0x8317, pPaddingInfo=0x0, pbIV=0x1bbbf848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x1bbbf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1bbbf848, pbOutput=0x4950000, pcbResult=0x1bbbf618) returned 0x0 [0156.275] WriteFile (in: hFile=0xbb4, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x1bbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x1bbbf61c*=0x8320, lpOverlapped=0x0) returned 1 [0156.275] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1bbbf60c | out: lpNewFilePointer=0x0) returned 1 [0156.275] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.275] WriteFile (in: hFile=0xbb4, lpBuffer=0x1bbbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1bbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x1bbbf83c*, lpNumberOfBytesWritten=0x1bbbf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.276] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x8320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.276] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.276] CloseHandle (hObject=0xbb4) returned 1 [0156.276] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\indust\\thmbnail.png.play")) returned 1 [0156.278] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1484 os_tid = 0x14dc [0156.281] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.281] ReadFile (in: hFile=0xbbc, lpBuffer=0x1bcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1bcff85c, lpOverlapped=0x0 | out: lpBuffer=0x1bcffb34*, lpNumberOfBytesRead=0x1bcff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.460] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.460] ReadFile (in: hFile=0xbbc, lpBuffer=0x1bcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1bcff85c, lpOverlapped=0x0 | out: lpBuffer=0x1bcffb34*, lpNumberOfBytesRead=0x1bcff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.460] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0156.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0156.462] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x1bcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0156.462] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x1bcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x1bcff828, pbKeyObject=0x0) returned 0x0 [0156.463] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1bcff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1bcff500) returned 0x0 [0156.463] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0156.463] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1bcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1bcff500) returned 0x0 [0156.468] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.470] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.470] WriteFile (in: hFile=0xbbc, lpBuffer=0x1bcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1bcff830, lpOverlapped=0x0 | out: lpBuffer=0x1bcffb34*, lpNumberOfBytesWritten=0x1bcff830*=0x428, lpOverlapped=0x0) returned 1 [0156.471] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.471] ReadFile (in: hFile=0xbbc, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x1bcff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x1bcff61c*=0x1015d, lpOverlapped=0x0) returned 1 [0156.487] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xfffefea3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.487] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4a50000, cbInput=0x1015d, pPaddingInfo=0x0, pbIV=0x1bcff848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x1bcff618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x1bcff848, pbOutput=0x4a50000, pcbResult=0x1bcff618) returned 0x0 [0156.487] WriteFile (in: hFile=0xbbc, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x1bcff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x1bcff61c*=0x10160, lpOverlapped=0x0) returned 1 [0156.487] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1bcff60c | out: lpNewFilePointer=0x0) returned 1 [0156.487] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.487] WriteFile (in: hFile=0xbbc, lpBuffer=0x1bcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1bcff61c, lpOverlapped=0x0 | out: lpBuffer=0x1bcff83c*, lpNumberOfBytesWritten=0x1bcff61c*=0x8, lpOverlapped=0x0) returned 1 [0156.487] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x10160, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.488] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0156.488] CloseHandle (hObject=0xbbc) returned 1 [0156.488] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\iris.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\iris.elm.play")) returned 1 [0156.500] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1485 os_tid = 0x17cc [0156.282] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.284] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.284] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x1be3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0156.284] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x1be3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x1be3f828, pbKeyObject=0x0) returned 0x0 [0156.284] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1be3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1be3f500) returned 0x0 [0156.284] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.284] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1be3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1be3f500) returned 0x0 [0156.290] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.291] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.291] WriteFile (in: hFile=0xbc4, lpBuffer=0x1be3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1be3f830, lpOverlapped=0x0 | out: lpBuffer=0x1be3fb34*, lpNumberOfBytesWritten=0x1be3f830*=0x428, lpOverlapped=0x0) returned 1 [0156.295] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.295] ReadFile (in: hFile=0xbc4, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x1be3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x1be3f61c*=0x1ce, lpOverlapped=0x0) returned 1 [0156.295] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.295] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4b50000, cbInput=0x1ce, pPaddingInfo=0x0, pbIV=0x1be3f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x1be3f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1be3f848, pbOutput=0x4b50000, pcbResult=0x1be3f618) returned 0x0 [0156.295] WriteFile (in: hFile=0xbc4, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x1be3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x1be3f61c*=0x1d0, lpOverlapped=0x0) returned 1 [0156.296] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1be3f60c | out: lpNewFilePointer=0x0) returned 1 [0156.296] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.296] WriteFile (in: hFile=0xbc4, lpBuffer=0x1be3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1be3f61c, lpOverlapped=0x0 | out: lpBuffer=0x1be3f83c*, lpNumberOfBytesWritten=0x1be3f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.296] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x1d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.296] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.296] CloseHandle (hObject=0xbc4) returned 1 [0156.296] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\iris.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\iris.inf.play")) returned 1 [0156.298] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1486 os_tid = 0x14e0 [0156.301] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.301] ReadFile (in: hFile=0xbcc, lpBuffer=0x1bf7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1bf7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1bf7fb34*, lpNumberOfBytesRead=0x1bf7f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.303] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.303] ReadFile (in: hFile=0xbcc, lpBuffer=0x1bf7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1bf7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1bf7fb34*, lpNumberOfBytesRead=0x1bf7f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.303] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.304] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x1bf7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0156.304] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x1bf7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x1bf7f828, pbKeyObject=0x0) returned 0x0 [0156.304] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1bf7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1bf7f500) returned 0x0 [0156.305] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.305] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1bf7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1bf7f500) returned 0x0 [0156.309] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.311] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.311] WriteFile (in: hFile=0xbcc, lpBuffer=0x1bf7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1bf7f830, lpOverlapped=0x0 | out: lpBuffer=0x1bf7fb34*, lpNumberOfBytesWritten=0x1bf7f830*=0x428, lpOverlapped=0x0) returned 1 [0156.311] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.312] ReadFile (in: hFile=0xbcc, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x1bf7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x1bf7f61c*=0x9ac, lpOverlapped=0x0) returned 1 [0156.312] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0xfffff654, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.312] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4c50000, cbInput=0x9ac, pPaddingInfo=0x0, pbIV=0x1bf7f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x1bf7f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1bf7f848, pbOutput=0x4c50000, pcbResult=0x1bf7f618) returned 0x0 [0156.312] WriteFile (in: hFile=0xbcc, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x1bf7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x1bf7f61c*=0x9b0, lpOverlapped=0x0) returned 1 [0156.312] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1bf7f60c | out: lpNewFilePointer=0x0) returned 1 [0156.312] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.312] WriteFile (in: hFile=0xbcc, lpBuffer=0x1bf7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1bf7f61c, lpOverlapped=0x0 | out: lpBuffer=0x1bf7f83c*, lpNumberOfBytesWritten=0x1bf7f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.312] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x9b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.312] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.312] CloseHandle (hObject=0xbcc) returned 1 [0156.312] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\preview.gif.play")) returned 1 [0156.314] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1487 os_tid = 0x14e4 [0156.318] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.318] ReadFile (in: hFile=0xbd4, lpBuffer=0x1c0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1c0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x1c0bfb34*, lpNumberOfBytesRead=0x1c0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.319] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.319] ReadFile (in: hFile=0xbd4, lpBuffer=0x1c0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1c0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x1c0bfb34*, lpNumberOfBytesRead=0x1c0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.319] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.321] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.321] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x1c0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0156.321] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x1c0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x1c0bf828, pbKeyObject=0x0) returned 0x0 [0156.321] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1c0bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1c0bf500) returned 0x0 [0156.321] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.321] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1c0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1c0bf500) returned 0x0 [0156.326] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.327] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.327] WriteFile (in: hFile=0xbd4, lpBuffer=0x1c0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1c0bf830, lpOverlapped=0x0 | out: lpBuffer=0x1c0bfb34*, lpNumberOfBytesWritten=0x1c0bf830*=0x428, lpOverlapped=0x0) returned 1 [0156.328] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.328] ReadFile (in: hFile=0xbd4, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x1c0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x1c0bf61c*=0x4c1d, lpOverlapped=0x0) returned 1 [0156.329] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xffffb3e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.329] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4d50000, cbInput=0x4c1d, pPaddingInfo=0x0, pbIV=0x1c0bf848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x1c0bf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1c0bf848, pbOutput=0x4d50000, pcbResult=0x1c0bf618) returned 0x0 [0156.329] WriteFile (in: hFile=0xbd4, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x1c0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x1c0bf61c*=0x4c20, lpOverlapped=0x0) returned 1 [0156.329] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c0bf60c | out: lpNewFilePointer=0x0) returned 1 [0156.329] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.329] WriteFile (in: hFile=0xbd4, lpBuffer=0x1c0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x1c0bf83c*, lpNumberOfBytesWritten=0x1c0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.330] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x4c20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.330] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.330] CloseHandle (hObject=0xbd4) returned 1 [0156.330] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\iris\\thmbnail.png.play")) returned 1 [0156.334] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1488 os_tid = 0x14e8 [0156.336] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.337] ReadFile (in: hFile=0xbdc, lpBuffer=0x1c1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1c1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1c1ffb34*, lpNumberOfBytesRead=0x1c1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.449] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.449] ReadFile (in: hFile=0xbdc, lpBuffer=0x1c1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1c1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1c1ffb34*, lpNumberOfBytesRead=0x1c1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0156.449] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0156.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0156.451] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x1c1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0156.451] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x1c1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x1c1ff828, pbKeyObject=0x0) returned 0x0 [0156.451] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1c1ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1c1ff500) returned 0x0 [0156.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0156.451] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1c1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1c1ff500) returned 0x0 [0156.456] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.459] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.459] WriteFile (in: hFile=0xbdc, lpBuffer=0x1c1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1c1ff830, lpOverlapped=0x0 | out: lpBuffer=0x1c1ffb34*, lpNumberOfBytesWritten=0x1c1ff830*=0x428, lpOverlapped=0x0) returned 1 [0156.459] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.459] ReadFile (in: hFile=0xbdc, lpBuffer=0x4e50000, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x1c1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x1c1ff61c*=0xba32, lpOverlapped=0x0) returned 1 [0156.479] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xffff45ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.479] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4e50000, cbInput=0xba32, pPaddingInfo=0x0, pbIV=0x1c1ff848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x1c1ff618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1c1ff848, pbOutput=0x4e50000, pcbResult=0x1c1ff618) returned 0x0 [0156.479] WriteFile (in: hFile=0xbdc, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x1c1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x1c1ff61c*=0xba40, lpOverlapped=0x0) returned 1 [0156.479] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c1ff60c | out: lpNewFilePointer=0x0) returned 1 [0156.479] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.479] WriteFile (in: hFile=0xbdc, lpBuffer=0x1c1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x1c1ff83c*, lpNumberOfBytesWritten=0x1c1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0156.480] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xba40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.480] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.480] CloseHandle (hObject=0xbdc) returned 1 [0156.480] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\journal.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\journal.elm.play")) returned 1 [0156.482] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1489 os_tid = 0x14ec [0156.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.340] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x1c33f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0156.340] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x1c33f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x1c33f828, pbKeyObject=0x0) returned 0x0 [0156.340] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1c33f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1c33f500) returned 0x0 [0156.340] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.340] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1c33f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1c33f500) returned 0x0 [0156.345] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.347] SetFilePointerEx (in: hFile=0xbe4, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.347] WriteFile (in: hFile=0xbe4, lpBuffer=0x1c33fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1c33f830, lpOverlapped=0x0 | out: lpBuffer=0x1c33fb34*, lpNumberOfBytesWritten=0x1c33f830*=0x428, lpOverlapped=0x0) returned 1 [0156.350] SetFilePointerEx (in: hFile=0xbe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.350] ReadFile (in: hFile=0xbe4, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x1c33f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x1c33f61c*=0x1f3, lpOverlapped=0x0) returned 1 [0156.350] SetFilePointerEx (in: hFile=0xbe4, liDistanceToMove=0xfffffe0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.350] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4f50000, cbInput=0x1f3, pPaddingInfo=0x0, pbIV=0x1c33f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x1c33f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1c33f848, pbOutput=0x4f50000, pcbResult=0x1c33f618) returned 0x0 [0156.350] WriteFile (in: hFile=0xbe4, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1c33f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x1c33f61c*=0x200, lpOverlapped=0x0) returned 1 [0156.350] SetFilePointerEx (in: hFile=0xbe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c33f60c | out: lpNewFilePointer=0x0) returned 1 [0156.351] SetFilePointerEx (in: hFile=0xbe4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.351] WriteFile (in: hFile=0xbe4, lpBuffer=0x1c33f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c33f61c, lpOverlapped=0x0 | out: lpBuffer=0x1c33f83c*, lpNumberOfBytesWritten=0x1c33f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.351] SetFilePointerEx (in: hFile=0xbe4, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.351] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.351] CloseHandle (hObject=0xbe4) returned 1 [0156.368] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\journal.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\journal.inf.play")) returned 1 [0156.370] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1490 os_tid = 0x14f0 [0156.351] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.351] ReadFile (in: hFile=0xbec, lpBuffer=0x1c47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1c47f85c, lpOverlapped=0x0 | out: lpBuffer=0x1c47fb34*, lpNumberOfBytesRead=0x1c47f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.353] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.354] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.354] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x1c47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0156.354] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x1c47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x1c47f828, pbKeyObject=0x0) returned 0x0 [0156.355] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1c47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1c47f500) returned 0x0 [0156.355] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.355] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1c47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1c47f500) returned 0x0 [0156.360] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.361] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.361] WriteFile (in: hFile=0xbec, lpBuffer=0x1c47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1c47f830, lpOverlapped=0x0 | out: lpBuffer=0x1c47fb34*, lpNumberOfBytesWritten=0x1c47f830*=0x428, lpOverlapped=0x0) returned 1 [0156.362] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.362] ReadFile (in: hFile=0xbec, lpBuffer=0x5050000, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x1c47f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x1c47f61c*=0x4d0, lpOverlapped=0x0) returned 1 [0156.362] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0xfffffb30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.362] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5050000, cbInput=0x4d0, pPaddingInfo=0x0, pbIV=0x1c47f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x1c47f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1c47f848, pbOutput=0x5050000, pcbResult=0x1c47f618) returned 0x0 [0156.362] WriteFile (in: hFile=0xbec, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x1c47f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x1c47f61c*=0x4e0, lpOverlapped=0x0) returned 1 [0156.362] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c47f60c | out: lpNewFilePointer=0x0) returned 1 [0156.362] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.363] WriteFile (in: hFile=0xbec, lpBuffer=0x1c47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c47f61c, lpOverlapped=0x0 | out: lpBuffer=0x1c47f83c*, lpNumberOfBytesWritten=0x1c47f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.363] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x4e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.363] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.363] CloseHandle (hObject=0xbec) returned 1 [0156.364] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\preview.gif.play")) returned 1 [0156.366] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1491 os_tid = 0x14f4 [0156.392] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.392] ReadFile (in: hFile=0xbec, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.395] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.395] ReadFile (in: hFile=0xbec, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.396] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.398] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.398] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0156.398] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0156.398] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0156.398] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.398] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0156.403] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.405] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.405] WriteFile (in: hFile=0xbec, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0156.405] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.405] ReadFile (in: hFile=0xbec, lpBuffer=0x5150000, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0xe9f61c*=0x47ed, lpOverlapped=0x0) returned 1 [0156.406] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0xffffb813, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.406] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5150000, cbInput=0x47ed, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe9f848, pbOutput=0x5150000, pcbResult=0xe9f618) returned 0x0 [0156.406] WriteFile (in: hFile=0xbec, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0xe9f61c*=0x47f0, lpOverlapped=0x0) returned 1 [0156.407] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0156.407] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.407] WriteFile (in: hFile=0xbec, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.407] SetFilePointerEx (in: hFile=0xbec, liDistanceToMove=0x47f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.407] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.407] CloseHandle (hObject=0xbec) returned 1 [0156.407] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\journal\\thmbnail.png.play")) returned 1 [0156.475] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1492 os_tid = 0x14f8 [0156.536] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.536] ReadFile (in: hFile=0xbd4, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.540] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.540] ReadFile (in: hFile=0xbd4, lpBuffer=0x111fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x111f85c, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesRead=0x111f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.544] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.544] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0156.544] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0156.544] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0156.545] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.545] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x111f500) returned 0x0 [0156.549] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.567] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.567] WriteFile (in: hFile=0xbd4, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0156.567] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.568] ReadFile (in: hFile=0xbd4, lpBuffer=0x2750000, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0xe743, lpOverlapped=0x0) returned 1 [0156.569] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xffff18bd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.569] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0xe743, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0156.569] WriteFile (in: hFile=0xbd4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0xe750, lpOverlapped=0x0) returned 1 [0156.569] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0156.570] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.570] WriteFile (in: hFile=0xbd4, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.570] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0xe750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.570] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.570] CloseHandle (hObject=0xbd4) returned 1 [0156.570] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\layers.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\layers.elm.play")) returned 1 [0156.576] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1493 os_tid = 0x14fc [0156.583] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.585] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xe58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0156.585] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xe58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xe58f828, pbKeyObject=0x0) returned 0x0 [0156.585] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe58f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe58f500) returned 0x0 [0156.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.585] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe58f500) returned 0x0 [0156.590] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.591] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.592] WriteFile (in: hFile=0x998, lpBuffer=0xe58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe58f830, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesWritten=0xe58f830*=0x428, lpOverlapped=0x0) returned 1 [0156.595] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.595] ReadFile (in: hFile=0x998, lpBuffer=0x2850000, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xe58f61c*=0x215, lpOverlapped=0x0) returned 1 [0156.595] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0xfffffdeb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.595] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2850000, cbInput=0x215, pPaddingInfo=0x0, pbIV=0xe58f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xe58f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe58f848, pbOutput=0x2850000, pcbResult=0xe58f618) returned 0x0 [0156.595] WriteFile (in: hFile=0x998, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xe58f61c*=0x220, lpOverlapped=0x0) returned 1 [0156.595] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe58f60c | out: lpNewFilePointer=0x0) returned 1 [0156.596] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.596] WriteFile (in: hFile=0x998, lpBuffer=0xe58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0xe58f83c*, lpNumberOfBytesWritten=0xe58f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.596] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0x220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.596] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.596] CloseHandle (hObject=0x998) returned 1 [0156.596] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\layers.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\layers.inf.play")) returned 1 [0156.599] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1494 os_tid = 0xe68 [0156.601] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.601] ReadFile (in: hFile=0xbdc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.603] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.604] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.605] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0156.605] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0156.605] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0156.605] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.605] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe9f500) returned 0x0 [0156.610] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.611] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.611] WriteFile (in: hFile=0xbdc, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0156.612] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.612] ReadFile (in: hFile=0xbdc, lpBuffer=0x2950000, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xe9f61c*=0x67b, lpOverlapped=0x0) returned 1 [0156.612] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffff985, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.612] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0x67b, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe9f848, pbOutput=0x2950000, pcbResult=0xe9f618) returned 0x0 [0156.612] WriteFile (in: hFile=0xbdc, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xe9f61c*=0x680, lpOverlapped=0x0) returned 1 [0156.612] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0156.612] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.612] WriteFile (in: hFile=0xbdc, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.612] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.613] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.613] CloseHandle (hObject=0xbdc) returned 1 [0156.613] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\preview.gif.play")) returned 1 [0156.616] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1495 os_tid = 0xe7c [0156.619] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.619] ReadFile (in: hFile=0xbbc, lpBuffer=0xe6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesRead=0xe6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.621] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.621] ReadFile (in: hFile=0xbbc, lpBuffer=0xe6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesRead=0xe6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.621] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.622] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.622] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xe6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0156.622] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xe6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xe6cf828, pbKeyObject=0x0) returned 0x0 [0156.622] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe6cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe6cf500) returned 0x0 [0156.623] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.623] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe6cf500) returned 0x0 [0156.628] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.630] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.630] WriteFile (in: hFile=0xbbc, lpBuffer=0xe6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe6cf830, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesWritten=0xe6cf830*=0x428, lpOverlapped=0x0) returned 1 [0156.630] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.631] ReadFile (in: hFile=0xbbc, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xe6cf61c*=0xaf32, lpOverlapped=0x0) returned 1 [0156.632] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xffff50ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.632] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2a50000, cbInput=0xaf32, pPaddingInfo=0x0, pbIV=0xe6cf848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xe6cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe6cf848, pbOutput=0x2a50000, pcbResult=0xe6cf618) returned 0x0 [0156.632] WriteFile (in: hFile=0xbbc, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xe6cf61c*=0xaf40, lpOverlapped=0x0) returned 1 [0156.632] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe6cf60c | out: lpNewFilePointer=0x0) returned 1 [0156.632] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.632] WriteFile (in: hFile=0xbbc, lpBuffer=0xe6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xe6cf83c*, lpNumberOfBytesWritten=0xe6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.632] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0xaf40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.632] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.632] CloseHandle (hObject=0xbbc) returned 1 [0156.633] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\layers\\thmbnail.png.play")) returned 1 [0156.635] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1496 os_tid = 0x1500 [0156.637] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.637] ReadFile (in: hFile=0xbac, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.639] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.639] ReadFile (in: hFile=0xbac, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.639] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.641] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.641] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0156.641] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0156.641] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xea8f500) returned 0x0 [0156.641] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.641] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xea8f500) returned 0x0 [0156.646] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.648] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.648] WriteFile (in: hFile=0xbac, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0156.648] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.648] ReadFile (in: hFile=0xbac, lpBuffer=0x2b50000, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xea8f61c*=0xe2ec, lpOverlapped=0x0) returned 1 [0156.650] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xffff1d14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.650] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2b50000, cbInput=0xe2ec, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xea8f848, pbOutput=0x2b50000, pcbResult=0xea8f618) returned 0x0 [0156.650] WriteFile (in: hFile=0xbac, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xea8f61c*=0xe2f0, lpOverlapped=0x0) returned 1 [0156.650] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0156.650] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.650] WriteFile (in: hFile=0xbac, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.651] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xe2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.651] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.651] CloseHandle (hObject=0xbac) returned 1 [0156.651] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\level.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\level.elm.play")) returned 1 [0156.653] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1497 os_tid = 0x1504 [0156.649] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.656] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.657] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0156.657] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0156.657] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xebcf500) returned 0x0 [0156.657] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.657] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xebcf500) returned 0x0 [0156.662] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.663] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.664] WriteFile (in: hFile=0xb9c, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0156.666] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.667] ReadFile (in: hFile=0xb9c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xebcf61c*=0x20e, lpOverlapped=0x0) returned 1 [0156.667] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0xfffffdf2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.667] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2c50000, cbInput=0x20e, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xebcf848, pbOutput=0x2c50000, pcbResult=0xebcf618) returned 0x0 [0156.667] WriteFile (in: hFile=0xb9c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xebcf61c*=0x210, lpOverlapped=0x0) returned 1 [0156.667] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0156.667] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.667] WriteFile (in: hFile=0xb9c, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.667] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.667] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.667] CloseHandle (hObject=0xb9c) returned 1 [0156.667] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\level.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\level.inf.play")) returned 1 [0156.669] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1498 os_tid = 0x1508 [0156.672] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.672] ReadFile (in: hFile=0xb8c, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.674] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.675] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.675] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0156.675] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0156.675] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xed0f500) returned 0x0 [0156.675] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.675] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xed0f500) returned 0x0 [0156.680] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.681] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.682] WriteFile (in: hFile=0xb8c, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0156.682] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.682] ReadFile (in: hFile=0xb8c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xed0f61c*=0x563, lpOverlapped=0x0) returned 1 [0156.682] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffa9d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.682] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2d50000, cbInput=0x563, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xed0f848, pbOutput=0x2d50000, pcbResult=0xed0f618) returned 0x0 [0156.682] WriteFile (in: hFile=0xb8c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xed0f61c*=0x570, lpOverlapped=0x0) returned 1 [0156.682] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0156.683] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.683] WriteFile (in: hFile=0xb8c, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.683] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.683] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.683] CloseHandle (hObject=0xb8c) returned 1 [0156.683] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.684] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\preview.gif.play")) returned 1 [0156.687] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1499 os_tid = 0x150c [0156.689] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.690] ReadFile (in: hFile=0xb7c, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.692] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.692] ReadFile (in: hFile=0xb7c, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.692] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.693] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.693] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0156.693] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0156.693] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xee4f500) returned 0x0 [0156.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.694] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xee4f500) returned 0x0 [0156.698] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.700] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.700] WriteFile (in: hFile=0xb7c, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0156.701] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.701] ReadFile (in: hFile=0xb7c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xee4f61c*=0xbbf3, lpOverlapped=0x0) returned 1 [0156.703] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xffff440d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.703] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0xbbf3, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xee4f848, pbOutput=0x2e50000, pcbResult=0xee4f618) returned 0x0 [0156.703] WriteFile (in: hFile=0xb7c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xee4f61c*=0xbc00, lpOverlapped=0x0) returned 1 [0156.703] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0156.704] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.704] WriteFile (in: hFile=0xb7c, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.704] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0xbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.704] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.704] CloseHandle (hObject=0xb7c) returned 1 [0156.704] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\level\\thmbnail.png.play")) returned 1 [0156.706] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1500 os_tid = 0x1510 [0156.709] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.709] ReadFile (in: hFile=0xb6c, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.711] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.711] ReadFile (in: hFile=0xb6c, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.712] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.713] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.713] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0156.713] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0156.713] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xef8f500) returned 0x0 [0156.713] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.714] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xef8f500) returned 0x0 [0156.718] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.720] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.720] WriteFile (in: hFile=0xb6c, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0156.720] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.720] ReadFile (in: hFile=0xb6c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xef8f61c*=0xc649, lpOverlapped=0x0) returned 1 [0156.722] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xffff39b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.723] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2f50000, cbInput=0xc649, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xef8f848, pbOutput=0x2f50000, pcbResult=0xef8f618) returned 0x0 [0156.723] WriteFile (in: hFile=0xb6c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xef8f61c*=0xc650, lpOverlapped=0x0) returned 1 [0156.723] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0156.723] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.723] WriteFile (in: hFile=0xb6c, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.724] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xc650, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.724] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.724] CloseHandle (hObject=0xb6c) returned 1 [0156.724] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0156.725] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\network.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\network.elm.play")) returned 1 [0156.726] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1501 os_tid = 0x1514 [0156.711] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.728] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.729] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0156.729] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0156.729] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf0cf500) returned 0x0 [0156.729] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.729] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf0cf500) returned 0x0 [0156.734] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.735] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.735] WriteFile (in: hFile=0x3cc, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0156.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.738] ReadFile (in: hFile=0x3cc, lpBuffer=0x3050000, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xf0cf61c*=0x249, lpOverlapped=0x0) returned 1 [0156.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.738] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3050000, cbInput=0x249, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf0cf848, pbOutput=0x3050000, pcbResult=0xf0cf618) returned 0x0 [0156.738] WriteFile (in: hFile=0x3cc, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xf0cf61c*=0x250, lpOverlapped=0x0) returned 1 [0156.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0156.739] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.739] WriteFile (in: hFile=0x3cc, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.739] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.739] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.739] CloseHandle (hObject=0x3cc) returned 1 [0156.739] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\network.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\network.inf.play")) returned 1 [0156.741] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1502 os_tid = 0x1518 [0156.744] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.744] ReadFile (in: hFile=0xc9c, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.746] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.747] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.747] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0156.747] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0156.747] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf34f500) returned 0x0 [0156.747] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.747] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf34f500) returned 0x0 [0156.752] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.754] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.754] WriteFile (in: hFile=0xc9c, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0156.755] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.755] ReadFile (in: hFile=0xc9c, lpBuffer=0x3150000, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xf34f61c*=0x554, lpOverlapped=0x0) returned 1 [0156.755] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffaac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.755] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3150000, cbInput=0x554, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf34f848, pbOutput=0x3150000, pcbResult=0xf34f618) returned 0x0 [0156.755] WriteFile (in: hFile=0xc9c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xf34f61c*=0x560, lpOverlapped=0x0) returned 1 [0156.755] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0156.755] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.755] WriteFile (in: hFile=0xc9c, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.756] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.756] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.756] CloseHandle (hObject=0xc9c) returned 1 [0156.756] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\preview.gif.play")) returned 1 [0156.760] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1503 os_tid = 0x151c [0156.762] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.762] ReadFile (in: hFile=0xca4, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.764] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.764] ReadFile (in: hFile=0xca4, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.764] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.766] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.766] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0156.766] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0156.766] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0156.766] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.766] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf48f500) returned 0x0 [0156.771] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.773] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.773] WriteFile (in: hFile=0xca4, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0156.774] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.774] ReadFile (in: hFile=0xca4, lpBuffer=0x3250000, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0xf48f61c*=0x2d35, lpOverlapped=0x0) returned 1 [0156.774] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0xffffd2cb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.775] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3250000, cbInput=0x2d35, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf48f848, pbOutput=0x3250000, pcbResult=0xf48f618) returned 0x0 [0156.775] WriteFile (in: hFile=0xca4, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0xf48f61c*=0x2d40, lpOverlapped=0x0) returned 1 [0156.775] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0156.775] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.775] WriteFile (in: hFile=0xca4, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.775] SetFilePointerEx (in: hFile=0xca4, liDistanceToMove=0x2d40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.775] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.775] CloseHandle (hObject=0xca4) returned 1 [0156.775] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\network\\thmbnail.png.play")) returned 1 [0156.778] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1504 os_tid = 0x1520 [0156.780] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.780] ReadFile (in: hFile=0xcac, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.782] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.782] ReadFile (in: hFile=0xcac, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.783] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.784] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.784] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0156.784] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0156.784] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0156.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.785] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfe4f500) returned 0x0 [0156.789] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.790] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.791] WriteFile (in: hFile=0xcac, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0156.791] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.791] ReadFile (in: hFile=0xcac, lpBuffer=0x3350000, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xfe4f61c*=0x166d5, lpOverlapped=0x0) returned 1 [0156.793] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xfffe992b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.794] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3350000, cbInput=0x166d5, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xfe4f848, pbOutput=0x3350000, pcbResult=0xfe4f618) returned 0x0 [0156.794] WriteFile (in: hFile=0xcac, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xfe4f61c*=0x166e0, lpOverlapped=0x0) returned 1 [0156.794] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0156.794] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.794] WriteFile (in: hFile=0xcac, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.794] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0x166e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.795] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.795] CloseHandle (hObject=0xcac) returned 1 [0156.795] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0156.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\papyrus.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\papyrus.elm.play")) returned 1 [0156.797] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1505 os_tid = 0x1524 [0156.792] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.799] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.799] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0156.799] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0156.799] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0156.800] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.800] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x100cf500) returned 0x0 [0156.805] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.806] SetFilePointerEx (in: hFile=0xcb4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.806] WriteFile (in: hFile=0xcb4, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0156.811] SetFilePointerEx (in: hFile=0xcb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.811] ReadFile (in: hFile=0xcb4, lpBuffer=0x3450000, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x100cf61c*=0x1f4, lpOverlapped=0x0) returned 1 [0156.811] SetFilePointerEx (in: hFile=0xcb4, liDistanceToMove=0xfffffe0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.811] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3450000, cbInput=0x1f4, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x100cf848, pbOutput=0x3450000, pcbResult=0x100cf618) returned 0x0 [0156.811] WriteFile (in: hFile=0xcb4, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x100cf61c*=0x200, lpOverlapped=0x0) returned 1 [0156.811] SetFilePointerEx (in: hFile=0xcb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0156.811] SetFilePointerEx (in: hFile=0xcb4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.811] WriteFile (in: hFile=0xcb4, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.811] SetFilePointerEx (in: hFile=0xcb4, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.811] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.811] CloseHandle (hObject=0xcb4) returned 1 [0156.811] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\papyrus.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\papyrus.inf.play")) returned 1 [0156.814] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1506 os_tid = 0x1528 [0156.826] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.826] ReadFile (in: hFile=0xcbc, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.828] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.828] ReadFile (in: hFile=0xcbc, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.828] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.830] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.830] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0156.830] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0156.830] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0156.830] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.830] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0156.835] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.837] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.837] WriteFile (in: hFile=0xcbc, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0156.838] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.838] ReadFile (in: hFile=0xcbc, lpBuffer=0x3550000, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1034f61c*=0xa0e, lpOverlapped=0x0) returned 1 [0156.838] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffff5f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.838] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3550000, cbInput=0xa0e, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1034f848, pbOutput=0x3550000, pcbResult=0x1034f618) returned 0x0 [0156.838] WriteFile (in: hFile=0xcbc, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1034f61c*=0xa10, lpOverlapped=0x0) returned 1 [0156.838] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0156.838] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.838] WriteFile (in: hFile=0xcbc, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.838] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xa10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.838] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.838] CloseHandle (hObject=0xcbc) returned 1 [0156.839] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\preview.gif.play")) returned 1 [0156.842] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1507 os_tid = 0x152c [0156.845] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.845] ReadFile (in: hFile=0xcc4, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.847] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.847] ReadFile (in: hFile=0xcc4, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.847] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.848] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.849] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0156.849] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0156.849] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0156.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.849] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1048f500) returned 0x0 [0156.853] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.854] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.854] WriteFile (in: hFile=0xcc4, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0156.855] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.855] ReadFile (in: hFile=0xcc4, lpBuffer=0x3650000, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1048f61c*=0x9240, lpOverlapped=0x0) returned 1 [0156.855] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0xffff6dc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.855] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3650000, cbInput=0x9240, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1048f848, pbOutput=0x3650000, pcbResult=0x1048f618) returned 0x0 [0156.855] WriteFile (in: hFile=0xcc4, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1048f61c*=0x9250, lpOverlapped=0x0) returned 1 [0156.856] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0156.856] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.856] WriteFile (in: hFile=0xcc4, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.856] SetFilePointerEx (in: hFile=0xcc4, liDistanceToMove=0x9250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.856] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.856] CloseHandle (hObject=0xcc4) returned 1 [0156.856] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\papyrus\\thmbnail.png.play")) returned 1 [0156.858] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1508 os_tid = 0x1530 [0156.861] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.861] ReadFile (in: hFile=0xccc, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.863] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.863] ReadFile (in: hFile=0xccc, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.863] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.865] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.865] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0156.865] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0156.865] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0156.865] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.865] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1070f500) returned 0x0 [0156.870] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.872] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.872] WriteFile (in: hFile=0xccc, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0156.872] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.872] ReadFile (in: hFile=0xccc, lpBuffer=0x3750000, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1070f61c*=0xd0e5, lpOverlapped=0x0) returned 1 [0156.874] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xffff2f1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.874] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3750000, cbInput=0xd0e5, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1070f848, pbOutput=0x3750000, pcbResult=0x1070f618) returned 0x0 [0156.874] WriteFile (in: hFile=0xccc, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1070f61c*=0xd0f0, lpOverlapped=0x0) returned 1 [0156.874] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0156.874] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.874] WriteFile (in: hFile=0xccc, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.874] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xd0f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.874] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.875] CloseHandle (hObject=0xccc) returned 1 [0156.875] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\pixel.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\pixel.elm.play")) returned 1 [0156.877] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1509 os_tid = 0x1534 [0156.873] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.880] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.880] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0156.880] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0156.881] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0156.881] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.881] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1084f500) returned 0x0 [0156.886] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.888] SetFilePointerEx (in: hFile=0xcd4, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.888] WriteFile (in: hFile=0xcd4, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0156.890] SetFilePointerEx (in: hFile=0xcd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.890] ReadFile (in: hFile=0xcd4, lpBuffer=0x3850000, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1084f61c*=0x21b, lpOverlapped=0x0) returned 1 [0156.890] SetFilePointerEx (in: hFile=0xcd4, liDistanceToMove=0xfffffde5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.890] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3850000, cbInput=0x21b, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1084f848, pbOutput=0x3850000, pcbResult=0x1084f618) returned 0x0 [0156.890] WriteFile (in: hFile=0xcd4, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1084f61c*=0x220, lpOverlapped=0x0) returned 1 [0156.891] SetFilePointerEx (in: hFile=0xcd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0156.891] SetFilePointerEx (in: hFile=0xcd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.891] WriteFile (in: hFile=0xcd4, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.891] SetFilePointerEx (in: hFile=0xcd4, liDistanceToMove=0x220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.891] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.891] CloseHandle (hObject=0xcd4) returned 1 [0156.891] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\pixel.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\pixel.inf.play")) returned 1 [0156.893] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1510 os_tid = 0x1538 [0156.896] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.896] ReadFile (in: hFile=0xcdc, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0156.898] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.899] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.899] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0156.899] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0156.899] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0156.900] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.900] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10acf500) returned 0x0 [0156.905] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.906] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.906] WriteFile (in: hFile=0xcdc, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0156.907] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.907] ReadFile (in: hFile=0xcdc, lpBuffer=0x3950000, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x10acf61c*=0x639, lpOverlapped=0x0) returned 1 [0156.907] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffff9c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.907] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3950000, cbInput=0x639, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10acf848, pbOutput=0x3950000, pcbResult=0x10acf618) returned 0x0 [0156.907] WriteFile (in: hFile=0xcdc, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x10acf61c*=0x640, lpOverlapped=0x0) returned 1 [0156.907] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0156.907] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.908] WriteFile (in: hFile=0xcdc, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.908] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.908] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.908] CloseHandle (hObject=0xcdc) returned 1 [0156.908] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\preview.gif.play")) returned 1 [0156.913] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1511 os_tid = 0x153c [0156.915] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.916] ReadFile (in: hFile=0xce4, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.918] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.918] ReadFile (in: hFile=0xce4, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.918] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.919] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.920] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0156.920] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0156.920] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0156.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.920] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0156.925] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.927] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.927] WriteFile (in: hFile=0xce4, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0156.927] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.927] ReadFile (in: hFile=0xce4, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x10c0f61c*=0x54f1, lpOverlapped=0x0) returned 1 [0156.928] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0xffffab0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.928] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3a50000, cbInput=0x54f1, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10c0f848, pbOutput=0x3a50000, pcbResult=0x10c0f618) returned 0x0 [0156.928] WriteFile (in: hFile=0xce4, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x10c0f61c*=0x5500, lpOverlapped=0x0) returned 1 [0156.928] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0156.928] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.929] WriteFile (in: hFile=0xce4, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.929] SetFilePointerEx (in: hFile=0xce4, liDistanceToMove=0x5500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.929] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.929] CloseHandle (hObject=0xce4) returned 1 [0156.929] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\pixel\\thmbnail.png.play")) returned 1 [0156.931] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1512 os_tid = 0x1540 [0156.933] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.934] ReadFile (in: hFile=0xcec, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.935] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.936] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.937] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0156.937] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0156.937] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0156.937] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.937] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0156.942] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.944] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.944] WriteFile (in: hFile=0xcec, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0156.945] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.945] ReadFile (in: hFile=0xcec, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x10d4f61c*=0x53b, lpOverlapped=0x0) returned 1 [0156.945] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xfffffac5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.945] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3b50000, cbInput=0x53b, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10d4f848, pbOutput=0x3b50000, pcbResult=0x10d4f618) returned 0x0 [0156.945] WriteFile (in: hFile=0xcec, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x10d4f61c*=0x540, lpOverlapped=0x0) returned 1 [0156.945] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0156.945] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.945] WriteFile (in: hFile=0xcec, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.945] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.945] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.945] CloseHandle (hObject=0xcec) returned 1 [0156.946] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\preview.gif.play")) returned 1 [0156.948] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1513 os_tid = 0x1544 [0156.950] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.950] ReadFile (in: hFile=0xcf4, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.952] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.952] ReadFile (in: hFile=0xcf4, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.952] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.953] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.953] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0156.953] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0156.954] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0156.954] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.954] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0156.959] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.961] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.961] WriteFile (in: hFile=0xcf4, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0156.961] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.961] ReadFile (in: hFile=0xcf4, lpBuffer=0x3c50000, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x10e8f61c*=0xb20e, lpOverlapped=0x0) returned 1 [0156.962] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0xffff4df2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.962] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3c50000, cbInput=0xb20e, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10e8f848, pbOutput=0x3c50000, pcbResult=0x10e8f618) returned 0x0 [0156.962] WriteFile (in: hFile=0xcf4, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x10e8f61c*=0xb210, lpOverlapped=0x0) returned 1 [0156.963] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0156.963] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.963] WriteFile (in: hFile=0xcf4, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0156.963] SetFilePointerEx (in: hFile=0xcf4, liDistanceToMove=0xb210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.963] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.963] CloseHandle (hObject=0xcf4) returned 1 [0156.963] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\profile.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\profile.elm.play")) returned 1 [0156.965] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1514 os_tid = 0x1548 [0156.968] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.969] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.969] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0156.969] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0156.969] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0156.969] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.969] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0156.974] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.977] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.977] WriteFile (in: hFile=0xcfc, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0156.981] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.981] ReadFile (in: hFile=0xcfc, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x10fcf61c*=0x24b, lpOverlapped=0x0) returned 1 [0156.981] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffdb5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.981] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3d50000, cbInput=0x24b, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10fcf848, pbOutput=0x3d50000, pcbResult=0x10fcf618) returned 0x0 [0156.981] WriteFile (in: hFile=0xcfc, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x10fcf61c*=0x250, lpOverlapped=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.982] WriteFile (in: hFile=0xcfc, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.982] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0156.982] CloseHandle (hObject=0xcfc) returned 1 [0156.982] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0156.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\profile.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\profile.inf.play")) returned 1 [0156.987] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1515 os_tid = 0x154c [0156.991] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.991] ReadFile (in: hFile=0xd04, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.992] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.992] ReadFile (in: hFile=0xd04, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0156.993] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0156.994] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0156.994] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0156.994] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0156.994] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0156.994] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0156.994] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0156.997] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.999] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.999] WriteFile (in: hFile=0xd04, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0156.999] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.999] ReadFile (in: hFile=0xd04, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x1110f61c*=0x4162, lpOverlapped=0x0) returned 1 [0157.000] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xffffbe9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.000] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3e50000, cbInput=0x4162, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1110f848, pbOutput=0x3e50000, pcbResult=0x1110f618) returned 0x0 [0157.001] WriteFile (in: hFile=0xd04, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x1110f61c*=0x4170, lpOverlapped=0x0) returned 1 [0157.001] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0157.001] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.001] WriteFile (in: hFile=0xd04, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.001] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x4170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.001] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.001] CloseHandle (hObject=0xd04) returned 1 [0157.001] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\profile\\thmbnail.png.play")) returned 1 [0157.003] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1516 os_tid = 0x1550 [0157.005] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.006] ReadFile (in: hFile=0xd0c, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.007] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0157.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0157.008] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0157.008] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0157.008] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0157.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0157.008] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0157.012] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.013] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.013] WriteFile (in: hFile=0xd0c, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0157.013] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.014] ReadFile (in: hFile=0xd0c, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x1124f61c*=0x59f, lpOverlapped=0x0) returned 1 [0157.014] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xfffffa61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.014] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3f50000, cbInput=0x59f, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1124f848, pbOutput=0x3f50000, pcbResult=0x1124f618) returned 0x0 [0157.014] WriteFile (in: hFile=0xd0c, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x1124f61c*=0x5a0, lpOverlapped=0x0) returned 1 [0157.014] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0157.014] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.014] WriteFile (in: hFile=0xd0c, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.014] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.014] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.014] CloseHandle (hObject=0xd0c) returned 1 [0157.015] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\preview.gif.play")) returned 1 [0157.017] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1517 os_tid = 0x1554 [0157.070] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.070] ReadFile (in: hFile=0xd0c, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.072] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.072] ReadFile (in: hFile=0xd0c, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.072] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.073] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.074] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0157.074] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0157.074] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0157.074] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.074] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0157.077] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.079] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.079] WriteFile (in: hFile=0xd0c, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0157.079] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.079] ReadFile (in: hFile=0xd0c, lpBuffer=0x4050000, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0xe9f61c*=0xbba7, lpOverlapped=0x0) returned 1 [0157.081] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xffff4459, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.081] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4050000, cbInput=0xbba7, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe9f848, pbOutput=0x4050000, pcbResult=0xe9f618) returned 0x0 [0157.081] WriteFile (in: hFile=0xd0c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0xe9f61c*=0xbbb0, lpOverlapped=0x0) returned 1 [0157.082] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0157.082] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.082] WriteFile (in: hFile=0xd0c, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.082] SetFilePointerEx (in: hFile=0xd0c, liDistanceToMove=0xbbb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.082] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.082] CloseHandle (hObject=0xd0c) returned 1 [0157.082] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\quad.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\quad.elm.play")) returned 1 [0157.084] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1518 os_tid = 0x1558 [0157.080] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.086] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.086] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0157.086] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0157.086] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0157.087] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.087] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0157.090] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.092] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.092] WriteFile (in: hFile=0xcfc, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0157.094] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.094] ReadFile (in: hFile=0xcfc, lpBuffer=0x2750000, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x258, lpOverlapped=0x0) returned 1 [0157.094] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffda8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.095] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0x258, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0157.095] WriteFile (in: hFile=0xcfc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x260, lpOverlapped=0x0) returned 1 [0157.095] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0157.095] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.095] WriteFile (in: hFile=0xcfc, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.095] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.095] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.095] CloseHandle (hObject=0xcfc) returned 1 [0157.095] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\quad.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\quad.inf.play")) returned 1 [0157.099] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1519 os_tid = 0xe50 [0157.101] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.101] ReadFile (in: hFile=0xcec, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.103] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.103] ReadFile (in: hFile=0xcec, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.103] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.104] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.104] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xe44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0157.104] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xe44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xe44f828, pbKeyObject=0x0) returned 0x0 [0157.104] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe44f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe44f500) returned 0x0 [0157.104] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.104] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe44f500) returned 0x0 [0157.108] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.109] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.109] WriteFile (in: hFile=0xcec, lpBuffer=0xe44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe44f830, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesWritten=0xe44f830*=0x428, lpOverlapped=0x0) returned 1 [0157.110] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.110] ReadFile (in: hFile=0xcec, lpBuffer=0x2850000, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xe44f61c*=0x90f8, lpOverlapped=0x0) returned 1 [0157.111] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xffff6f08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.111] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2850000, cbInput=0x90f8, pPaddingInfo=0x0, pbIV=0xe44f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xe44f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe44f848, pbOutput=0x2850000, pcbResult=0xe44f618) returned 0x0 [0157.111] WriteFile (in: hFile=0xcec, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xe44f61c*=0x9100, lpOverlapped=0x0) returned 1 [0157.111] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe44f60c | out: lpNewFilePointer=0x0) returned 1 [0157.111] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.111] WriteFile (in: hFile=0xcec, lpBuffer=0xe44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0xe44f83c*, lpNumberOfBytesWritten=0xe44f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.111] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x9100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.111] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.111] CloseHandle (hObject=0xcec) returned 1 [0157.111] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\quad\\thmbnail.png.play")) returned 1 [0157.113] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1520 os_tid = 0x155c [0157.116] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.117] ReadFile (in: hFile=0xcdc, lpBuffer=0xe58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe58f85c, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesRead=0xe58f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.118] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.119] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xe58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0157.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xe58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xe58f828, pbKeyObject=0x0) returned 0x0 [0157.119] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe58f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe58f500) returned 0x0 [0157.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.120] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe58f500) returned 0x0 [0157.123] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.124] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.124] WriteFile (in: hFile=0xcdc, lpBuffer=0xe58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe58f830, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesWritten=0xe58f830*=0x428, lpOverlapped=0x0) returned 1 [0157.125] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.125] ReadFile (in: hFile=0xcdc, lpBuffer=0x2950000, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xe58f61c*=0x682, lpOverlapped=0x0) returned 1 [0157.125] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffff97e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.125] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0x682, pPaddingInfo=0x0, pbIV=0xe58f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xe58f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe58f848, pbOutput=0x2950000, pcbResult=0xe58f618) returned 0x0 [0157.125] WriteFile (in: hFile=0xcdc, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xe58f61c*=0x690, lpOverlapped=0x0) returned 1 [0157.125] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe58f60c | out: lpNewFilePointer=0x0) returned 1 [0157.125] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.125] WriteFile (in: hFile=0xcdc, lpBuffer=0xe58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0xe58f83c*, lpNumberOfBytesWritten=0xe58f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.125] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.125] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.126] CloseHandle (hObject=0xcdc) returned 1 [0157.126] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.127] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\preview.gif.play")) returned 1 [0157.127] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1521 os_tid = 0x1560 [0157.131] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.131] ReadFile (in: hFile=0xccc, lpBuffer=0xe6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesRead=0xe6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.133] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.133] ReadFile (in: hFile=0xccc, lpBuffer=0xe6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesRead=0xe6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.134] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.135] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xe6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0157.135] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xe6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xe6cf828, pbKeyObject=0x0) returned 0x0 [0157.135] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe6cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe6cf500) returned 0x0 [0157.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.135] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe6cf500) returned 0x0 [0157.138] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.140] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.140] WriteFile (in: hFile=0xccc, lpBuffer=0xe6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe6cf830, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesWritten=0xe6cf830*=0x428, lpOverlapped=0x0) returned 1 [0157.141] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.141] ReadFile (in: hFile=0xccc, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xe6cf61c*=0xb75e, lpOverlapped=0x0) returned 1 [0157.142] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xffff48a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.142] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2a50000, cbInput=0xb75e, pPaddingInfo=0x0, pbIV=0xe6cf848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xe6cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe6cf848, pbOutput=0x2a50000, pcbResult=0xe6cf618) returned 0x0 [0157.142] WriteFile (in: hFile=0xccc, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xe6cf61c*=0xb760, lpOverlapped=0x0) returned 1 [0157.143] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe6cf60c | out: lpNewFilePointer=0x0) returned 1 [0157.143] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.143] WriteFile (in: hFile=0xccc, lpBuffer=0xe6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xe6cf83c*, lpNumberOfBytesWritten=0xe6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.143] SetFilePointerEx (in: hFile=0xccc, liDistanceToMove=0xb760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.143] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.143] CloseHandle (hObject=0xccc) returned 1 [0157.143] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\radial.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\radial.elm.play")) returned 1 [0157.145] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1522 os_tid = 0x1564 [0157.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.147] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.148] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0157.148] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0157.148] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xea8f500) returned 0x0 [0157.148] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.148] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xea8f500) returned 0x0 [0157.151] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.153] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.153] WriteFile (in: hFile=0xcbc, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0157.155] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.155] ReadFile (in: hFile=0xcbc, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xea8f61c*=0x24a, lpOverlapped=0x0) returned 1 [0157.155] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffdb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.155] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2b50000, cbInput=0x24a, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xea8f848, pbOutput=0x2b50000, pcbResult=0xea8f618) returned 0x0 [0157.155] WriteFile (in: hFile=0xcbc, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xea8f61c*=0x250, lpOverlapped=0x0) returned 1 [0157.156] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0157.156] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.156] WriteFile (in: hFile=0xcbc, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.156] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.156] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.156] CloseHandle (hObject=0xcbc) returned 1 [0157.156] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\radial.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\radial.inf.play")) returned 1 [0157.160] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1523 os_tid = 0x1568 [0157.164] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.164] ReadFile (in: hFile=0xcac, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.167] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.167] ReadFile (in: hFile=0xcac, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.167] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.169] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0157.169] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0157.169] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0157.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.169] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0157.174] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.176] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.176] WriteFile (in: hFile=0xcac, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0157.177] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.177] ReadFile (in: hFile=0xcac, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xebcf61c*=0x4c6b, lpOverlapped=0x0) returned 1 [0157.178] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xffffb395, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.178] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2c50000, cbInput=0x4c6b, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xebcf848, pbOutput=0x2c50000, pcbResult=0xebcf618) returned 0x0 [0157.178] WriteFile (in: hFile=0xcac, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xebcf61c*=0x4c70, lpOverlapped=0x0) returned 1 [0157.178] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0157.178] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.178] WriteFile (in: hFile=0xcac, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.179] SetFilePointerEx (in: hFile=0xcac, liDistanceToMove=0x4c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.179] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.179] CloseHandle (hObject=0xcac) returned 1 [0157.179] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\radial\\thmbnail.png.play")) returned 1 [0157.182] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1524 os_tid = 0x156c [0157.184] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.185] ReadFile (in: hFile=0xc9c, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.187] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.188] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0157.188] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0157.188] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0157.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.188] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0157.202] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.205] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.205] WriteFile (in: hFile=0xc9c, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0157.205] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.205] ReadFile (in: hFile=0xc9c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xed0f61c*=0x58f, lpOverlapped=0x0) returned 1 [0157.207] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffa71, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.207] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2d50000, cbInput=0x58f, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xed0f848, pbOutput=0x2d50000, pcbResult=0xed0f618) returned 0x0 [0157.207] WriteFile (in: hFile=0xc9c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xed0f61c*=0x590, lpOverlapped=0x0) returned 1 [0157.207] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0157.207] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.207] WriteFile (in: hFile=0xc9c, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.207] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.207] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.207] CloseHandle (hObject=0xc9c) returned 1 [0157.207] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\preview.gif.play")) returned 1 [0157.293] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1525 os_tid = 0x1570 [0157.342] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.343] ReadFile (in: hFile=0xb6c, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.344] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.344] ReadFile (in: hFile=0xb6c, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.344] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.346] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.346] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0157.346] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0157.346] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0157.346] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.346] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0157.349] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.351] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.351] WriteFile (in: hFile=0xb6c, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0157.352] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.352] ReadFile (in: hFile=0xb6c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xee4f61c*=0xb30e, lpOverlapped=0x0) returned 1 [0157.355] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xffff4cf2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.355] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0xb30e, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xee4f848, pbOutput=0x2e50000, pcbResult=0xee4f618) returned 0x0 [0157.355] WriteFile (in: hFile=0xb6c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xee4f61c*=0xb310, lpOverlapped=0x0) returned 1 [0157.355] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0157.355] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.355] WriteFile (in: hFile=0xb6c, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.355] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0xb310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.356] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.356] CloseHandle (hObject=0xb6c) returned 1 [0157.356] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\refined.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\refined.elm.play")) returned 1 [0157.358] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1526 os_tid = 0x1574 [0157.352] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.360] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0157.360] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0157.360] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0157.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.361] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0157.364] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.365] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.366] WriteFile (in: hFile=0xb8c, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0157.368] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.368] ReadFile (in: hFile=0xb8c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xef8f61c*=0x24a, lpOverlapped=0x0) returned 1 [0157.369] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffdb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.369] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2f50000, cbInput=0x24a, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xef8f848, pbOutput=0x2f50000, pcbResult=0xef8f618) returned 0x0 [0157.369] WriteFile (in: hFile=0xb8c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xef8f61c*=0x250, lpOverlapped=0x0) returned 1 [0157.369] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0157.369] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.369] WriteFile (in: hFile=0xb8c, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.369] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.369] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.370] CloseHandle (hObject=0xb8c) returned 1 [0157.370] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\refined.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\refined.inf.play")) returned 1 [0157.373] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1527 os_tid = 0x1578 [0157.377] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.377] ReadFile (in: hFile=0xbac, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.379] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.379] ReadFile (in: hFile=0xbac, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.379] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.380] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.381] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0157.381] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0157.381] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0157.381] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.381] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0157.384] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.386] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.386] WriteFile (in: hFile=0xbac, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0157.387] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.387] ReadFile (in: hFile=0xbac, lpBuffer=0x3050000, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xf0cf61c*=0x3d79, lpOverlapped=0x0) returned 1 [0157.387] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xffffc287, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.388] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3050000, cbInput=0x3d79, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf0cf848, pbOutput=0x3050000, pcbResult=0xf0cf618) returned 0x0 [0157.388] WriteFile (in: hFile=0xbac, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xf0cf61c*=0x3d80, lpOverlapped=0x0) returned 1 [0157.388] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0157.388] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.388] WriteFile (in: hFile=0xbac, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.388] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x3d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.388] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.388] CloseHandle (hObject=0xbac) returned 1 [0157.388] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\refined\\thmbnail.png.play")) returned 1 [0157.394] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1528 os_tid = 0x157c [0157.396] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.396] ReadFile (in: hFile=0xbdc, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.399] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.399] ReadFile (in: hFile=0xbdc, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.399] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.400] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.400] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0157.400] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0157.400] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0157.400] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.401] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0157.405] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.407] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.407] WriteFile (in: hFile=0xbdc, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0157.407] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.407] ReadFile (in: hFile=0xbdc, lpBuffer=0x3150000, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xf34f61c*=0xf82, lpOverlapped=0x0) returned 1 [0157.407] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffff07e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.407] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3150000, cbInput=0xf82, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf34f848, pbOutput=0x3150000, pcbResult=0xf34f618) returned 0x0 [0157.408] WriteFile (in: hFile=0xbdc, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xf34f61c*=0xf90, lpOverlapped=0x0) returned 1 [0157.408] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0157.408] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.408] WriteFile (in: hFile=0xbdc, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.408] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xf90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.408] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.408] CloseHandle (hObject=0xbdc) returned 1 [0157.408] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\preview.gif.play")) returned 1 [0157.410] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1529 os_tid = 0x1580 [0157.412] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.412] ReadFile (in: hFile=0x99c, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.415] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.415] ReadFile (in: hFile=0x99c, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.415] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.416] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.416] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0157.416] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0157.416] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0157.417] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.417] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0157.420] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.421] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.422] WriteFile (in: hFile=0x99c, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0157.422] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.422] ReadFile (in: hFile=0x99c, lpBuffer=0x3250000, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0xf48f61c*=0x1205e, lpOverlapped=0x0) returned 1 [0157.424] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0xfffedfa2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.424] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3250000, cbInput=0x1205e, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf48f848, pbOutput=0x3250000, pcbResult=0xf48f618) returned 0x0 [0157.424] WriteFile (in: hFile=0x99c, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0xf48f61c*=0x12060, lpOverlapped=0x0) returned 1 [0157.424] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0157.426] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.426] WriteFile (in: hFile=0x99c, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.426] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x12060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.426] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.426] CloseHandle (hObject=0x99c) returned 1 [0157.426] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\ricepapr.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\ricepapr.elm.play")) returned 1 [0157.430] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1530 os_tid = 0x1584 [0157.422] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.433] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.433] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0157.433] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0157.433] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0157.433] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.433] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0157.438] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.439] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.439] WriteFile (in: hFile=0xd14, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0157.441] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.441] ReadFile (in: hFile=0xd14, lpBuffer=0x3350000, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xfe4f61c*=0x239, lpOverlapped=0x0) returned 1 [0157.442] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffffdc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.442] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3350000, cbInput=0x239, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xfe4f848, pbOutput=0x3350000, pcbResult=0xfe4f618) returned 0x0 [0157.442] WriteFile (in: hFile=0xd14, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xfe4f61c*=0x240, lpOverlapped=0x0) returned 1 [0157.442] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0157.442] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.442] WriteFile (in: hFile=0xd14, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.442] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.442] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.442] CloseHandle (hObject=0xd14) returned 1 [0157.442] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\ricepapr.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\ricepapr.inf.play")) returned 1 [0157.444] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1531 os_tid = 0x1588 [0157.448] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.448] ReadFile (in: hFile=0xd1c, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.449] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.449] ReadFile (in: hFile=0xd1c, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.449] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.450] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.450] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0157.450] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0157.450] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0157.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.451] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0157.454] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.455] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.455] WriteFile (in: hFile=0xd1c, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0157.456] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.456] ReadFile (in: hFile=0xd1c, lpBuffer=0x3450000, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x100cf61c*=0xcf7b, lpOverlapped=0x0) returned 1 [0157.457] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0xffff3085, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.457] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3450000, cbInput=0xcf7b, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x100cf848, pbOutput=0x3450000, pcbResult=0x100cf618) returned 0x0 [0157.458] WriteFile (in: hFile=0xd1c, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x100cf61c*=0xcf80, lpOverlapped=0x0) returned 1 [0157.458] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0157.458] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.458] WriteFile (in: hFile=0xd1c, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.458] SetFilePointerEx (in: hFile=0xd1c, liDistanceToMove=0xcf80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.458] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.458] CloseHandle (hObject=0xd1c) returned 1 [0157.458] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.459] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ricepapr\\thmbnail.png.play")) returned 1 [0157.460] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1532 os_tid = 0x158c [0157.462] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.462] ReadFile (in: hFile=0xd24, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.464] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.464] ReadFile (in: hFile=0xd24, lpBuffer=0x1034fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1034f85c, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesRead=0x1034f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.464] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.465] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.465] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0157.465] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0157.465] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0157.465] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.465] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1034f500) returned 0x0 [0157.469] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.470] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.470] WriteFile (in: hFile=0xd24, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0157.471] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.471] ReadFile (in: hFile=0xd24, lpBuffer=0x3550000, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1034f61c*=0xa2c, lpOverlapped=0x0) returned 1 [0157.471] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xfffff5d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.471] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3550000, cbInput=0xa2c, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1034f848, pbOutput=0x3550000, pcbResult=0x1034f618) returned 0x0 [0157.471] WriteFile (in: hFile=0xd24, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1034f61c*=0xa30, lpOverlapped=0x0) returned 1 [0157.471] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0157.471] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.471] WriteFile (in: hFile=0xd24, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.471] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xa30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.471] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.472] CloseHandle (hObject=0xd24) returned 1 [0157.472] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\preview.gif.play")) returned 1 [0157.473] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1533 os_tid = 0x1590 [0157.477] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.477] ReadFile (in: hFile=0xd2c, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.479] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.479] ReadFile (in: hFile=0xd2c, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.479] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.480] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0157.480] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0157.480] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0157.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.480] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0157.484] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.485] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.485] WriteFile (in: hFile=0xd2c, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0157.486] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.486] ReadFile (in: hFile=0xd2c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x1048f61c*=0x101e0, lpOverlapped=0x0) returned 1 [0157.489] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0xfffefe20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.489] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3650000, cbInput=0x101e0, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1048f848, pbOutput=0x3650000, pcbResult=0x1048f618) returned 0x0 [0157.489] WriteFile (in: hFile=0xd2c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x101f0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x1048f61c*=0x101f0, lpOverlapped=0x0) returned 1 [0157.489] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0157.489] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.489] WriteFile (in: hFile=0xd2c, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.489] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x101f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.489] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.489] CloseHandle (hObject=0xd2c) returned 1 [0157.490] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\ripple.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\ripple.elm.play")) returned 1 [0157.491] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1534 os_tid = 0x1594 [0157.487] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.494] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.494] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0157.494] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0157.494] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0157.494] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.494] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0157.500] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.502] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.502] WriteFile (in: hFile=0xd34, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0157.505] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.505] ReadFile (in: hFile=0xd34, lpBuffer=0x3750000, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1070f61c*=0x1e7, lpOverlapped=0x0) returned 1 [0157.505] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffffe19, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.505] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3750000, cbInput=0x1e7, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1070f848, pbOutput=0x3750000, pcbResult=0x1070f618) returned 0x0 [0157.505] WriteFile (in: hFile=0xd34, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1070f61c*=0x1f0, lpOverlapped=0x0) returned 1 [0157.505] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0157.505] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.506] WriteFile (in: hFile=0xd34, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.506] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x1f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.506] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.506] CloseHandle (hObject=0xd34) returned 1 [0157.506] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\ripple.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\ripple.inf.play")) returned 1 [0157.510] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1535 os_tid = 0x1598 [0157.504] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.504] ReadFile (in: hFile=0xd3c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.514] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.514] ReadFile (in: hFile=0xd3c, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.514] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.515] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.515] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0157.515] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0157.516] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0157.516] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.516] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0157.519] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.520] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.520] WriteFile (in: hFile=0xd3c, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0157.521] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.521] ReadFile (in: hFile=0xd3c, lpBuffer=0x3850000, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1084f61c*=0x7ce7, lpOverlapped=0x0) returned 1 [0157.522] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0xffff8319, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.522] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3850000, cbInput=0x7ce7, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1084f848, pbOutput=0x3850000, pcbResult=0x1084f618) returned 0x0 [0157.522] WriteFile (in: hFile=0xd3c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1084f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0157.522] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0157.523] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.524] WriteFile (in: hFile=0xd3c, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.524] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.524] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.524] CloseHandle (hObject=0xd3c) returned 1 [0157.524] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\ripple\\thmbnail.png.play")) returned 1 [0157.526] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1536 os_tid = 0x159c [0157.529] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.529] ReadFile (in: hFile=0xd44, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.531] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.531] ReadFile (in: hFile=0xd44, lpBuffer=0x10acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10acf85c, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesRead=0x10acf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.531] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.532] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.533] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0157.533] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0157.533] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0157.533] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.533] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0157.536] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.537] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.538] WriteFile (in: hFile=0xd44, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0157.538] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.538] ReadFile (in: hFile=0xd44, lpBuffer=0x3950000, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x10acf61c*=0x1004, lpOverlapped=0x0) returned 1 [0157.538] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xffffeffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.538] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3950000, cbInput=0x1004, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10acf848, pbOutput=0x3950000, pcbResult=0x10acf618) returned 0x0 [0157.538] WriteFile (in: hFile=0xd44, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x10acf61c*=0x1010, lpOverlapped=0x0) returned 1 [0157.538] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0157.539] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.539] WriteFile (in: hFile=0xd44, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.539] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x1010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.539] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.539] CloseHandle (hObject=0xd44) returned 1 [0157.539] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\preview.gif.play")) returned 1 [0157.541] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1537 os_tid = 0x15a0 [0157.544] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.544] ReadFile (in: hFile=0xd4c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.546] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.546] ReadFile (in: hFile=0xd4c, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.547] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0157.547] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0157.547] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0157.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.548] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10c0f500) returned 0x0 [0157.551] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.552] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.552] WriteFile (in: hFile=0xd4c, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0157.553] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.553] ReadFile (in: hFile=0xd4c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x10c0f61c*=0x11e37, lpOverlapped=0x0) returned 1 [0157.556] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0xfffee1c9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.556] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3a50000, cbInput=0x11e37, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10c0f848, pbOutput=0x3a50000, pcbResult=0x10c0f618) returned 0x0 [0157.556] WriteFile (in: hFile=0xd4c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x10c0f61c*=0x11e40, lpOverlapped=0x0) returned 1 [0157.556] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0157.557] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.557] WriteFile (in: hFile=0xd4c, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.557] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x11e40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.557] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.557] CloseHandle (hObject=0xd4c) returned 1 [0157.557] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\rmnsque.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\rmnsque.elm.play")) returned 1 [0157.559] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1538 os_tid = 0x15a4 [0157.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.576] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.577] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0157.577] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0157.577] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0157.577] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.577] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10d4f500) returned 0x0 [0157.580] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.582] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.582] WriteFile (in: hFile=0xd54, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0157.584] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.584] ReadFile (in: hFile=0xd54, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x10d4f61c*=0x265, lpOverlapped=0x0) returned 1 [0157.584] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffd9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.584] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3b50000, cbInput=0x265, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10d4f848, pbOutput=0x3b50000, pcbResult=0x10d4f618) returned 0x0 [0157.584] WriteFile (in: hFile=0xd54, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x10d4f61c*=0x270, lpOverlapped=0x0) returned 1 [0157.585] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0157.585] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.585] WriteFile (in: hFile=0xd54, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.585] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.585] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.585] CloseHandle (hObject=0xd54) returned 1 [0157.585] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\rmnsque.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\rmnsque.inf.play")) returned 1 [0157.589] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1539 os_tid = 0x15a8 [0157.592] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.592] ReadFile (in: hFile=0xd5c, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.594] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.594] ReadFile (in: hFile=0xd5c, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.594] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.596] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.596] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0157.596] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0157.596] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0157.596] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.596] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10e8f500) returned 0x0 [0157.601] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.603] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.603] WriteFile (in: hFile=0xd5c, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0157.603] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.604] ReadFile (in: hFile=0xd5c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x10e8f61c*=0xbb5a, lpOverlapped=0x0) returned 1 [0157.606] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0xffff44a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.606] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3c50000, cbInput=0xbb5a, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10e8f848, pbOutput=0x3c50000, pcbResult=0x10e8f618) returned 0x0 [0157.606] WriteFile (in: hFile=0xd5c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x10e8f61c*=0xbb60, lpOverlapped=0x0) returned 1 [0157.606] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0157.606] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.606] WriteFile (in: hFile=0xd5c, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.607] SetFilePointerEx (in: hFile=0xd5c, liDistanceToMove=0xbb60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.607] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.607] CloseHandle (hObject=0xd5c) returned 1 [0157.607] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\rmnsque\\thmbnail.png.play")) returned 1 [0157.609] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1540 os_tid = 0x15ac [0157.611] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.611] ReadFile (in: hFile=0xd64, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.612] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.612] ReadFile (in: hFile=0xd64, lpBuffer=0x10fcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10fcf85c, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesRead=0x10fcf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.612] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.613] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.613] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0157.613] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0157.613] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0157.613] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.614] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10fcf500) returned 0x0 [0157.617] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.618] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.618] WriteFile (in: hFile=0xd64, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0157.619] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.619] ReadFile (in: hFile=0xd64, lpBuffer=0x3d50000, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x10fcf61c*=0xe1b, lpOverlapped=0x0) returned 1 [0157.619] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xfffff1e5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.619] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3d50000, cbInput=0xe1b, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10fcf848, pbOutput=0x3d50000, pcbResult=0x10fcf618) returned 0x0 [0157.619] WriteFile (in: hFile=0xd64, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x10fcf61c*=0xe20, lpOverlapped=0x0) returned 1 [0157.619] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0157.619] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.619] WriteFile (in: hFile=0xd64, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.619] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.619] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.619] CloseHandle (hObject=0xd64) returned 1 [0157.620] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\preview.gif.play")) returned 1 [0157.621] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1541 os_tid = 0x15b0 [0157.624] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.624] ReadFile (in: hFile=0xd6c, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.626] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.626] ReadFile (in: hFile=0xd6c, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.626] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.627] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0157.627] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0157.627] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0157.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.627] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1110f500) returned 0x0 [0157.631] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.632] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.632] WriteFile (in: hFile=0xd6c, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0157.632] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.632] ReadFile (in: hFile=0xd6c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x1110f61c*=0x1936f, lpOverlapped=0x0) returned 1 [0157.636] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0xfffe6c91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.636] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3e50000, cbInput=0x1936f, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1110f848, pbOutput=0x3e50000, pcbResult=0x1110f618) returned 0x0 [0157.636] WriteFile (in: hFile=0xd6c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x1110f61c*=0x19370, lpOverlapped=0x0) returned 1 [0157.636] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0157.637] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.637] WriteFile (in: hFile=0xd6c, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.637] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x19370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.637] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.637] CloseHandle (hObject=0xd6c) returned 1 [0157.637] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\satin.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\satin.elm.play")) returned 1 [0157.639] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1542 os_tid = 0x14b8 [0157.641] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.643] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0157.643] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0157.643] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1124f500) returned 0x0 [0157.643] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.643] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1124f500) returned 0x0 [0157.646] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.648] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.648] WriteFile (in: hFile=0xd74, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0157.650] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.650] ReadFile (in: hFile=0xd74, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x1124f61c*=0x1c8, lpOverlapped=0x0) returned 1 [0157.650] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffe38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.651] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3f50000, cbInput=0x1c8, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1124f848, pbOutput=0x3f50000, pcbResult=0x1124f618) returned 0x0 [0157.651] WriteFile (in: hFile=0xd74, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x1124f61c*=0x1d0, lpOverlapped=0x0) returned 1 [0157.651] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0157.651] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.651] WriteFile (in: hFile=0xd74, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.651] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x1d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.651] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.651] CloseHandle (hObject=0xd74) returned 1 [0157.651] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\satin.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\satin.inf.play")) returned 1 [0157.655] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1543 os_tid = 0xddc [0157.657] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.657] ReadFile (in: hFile=0xd7c, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.658] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.659] ReadFile (in: hFile=0xd7c, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.659] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.660] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.660] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x1138f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0157.660] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x1138f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x1138f828, pbKeyObject=0x0) returned 0x0 [0157.660] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1138f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1138f500) returned 0x0 [0157.660] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.661] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1138f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1138f500) returned 0x0 [0157.664] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.665] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.665] WriteFile (in: hFile=0xd7c, lpBuffer=0x1138fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1138f830, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesWritten=0x1138f830*=0x428, lpOverlapped=0x0) returned 1 [0157.666] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.666] ReadFile (in: hFile=0xd7c, lpBuffer=0x4150000, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1138f61c*=0x8573, lpOverlapped=0x0) returned 1 [0157.668] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0xffff7a8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.668] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4150000, cbInput=0x8573, pPaddingInfo=0x0, pbIV=0x1138f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1138f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1138f848, pbOutput=0x4150000, pcbResult=0x1138f618) returned 0x0 [0157.668] WriteFile (in: hFile=0xd7c, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1138f61c*=0x8580, lpOverlapped=0x0) returned 1 [0157.668] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1138f60c | out: lpNewFilePointer=0x0) returned 1 [0157.668] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.668] WriteFile (in: hFile=0xd7c, lpBuffer=0x1138f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x1138f83c*, lpNumberOfBytesWritten=0x1138f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.669] SetFilePointerEx (in: hFile=0xd7c, liDistanceToMove=0x8580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.669] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.669] CloseHandle (hObject=0xd7c) returned 1 [0157.669] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\satin\\thmbnail.png.play")) returned 1 [0157.671] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1544 os_tid = 0x16a0 [0157.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.674] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.675] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x114cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0157.675] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x114cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x114cf828, pbKeyObject=0x0) returned 0x0 [0157.675] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x114cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x114cf500) returned 0x0 [0157.675] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.675] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x114cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x114cf500) returned 0x0 [0157.678] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.680] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.680] WriteFile (in: hFile=0xd84, lpBuffer=0x114cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x114cf830, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesWritten=0x114cf830*=0x428, lpOverlapped=0x0) returned 1 [0157.683] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.683] ReadFile (in: hFile=0xd84, lpBuffer=0x4250000, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x114cf61c*=0x3a9, lpOverlapped=0x0) returned 1 [0157.683] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0xfffffc57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.683] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4250000, cbInput=0x3a9, pPaddingInfo=0x0, pbIV=0x114cf848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x114cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x114cf848, pbOutput=0x4250000, pcbResult=0x114cf618) returned 0x0 [0157.683] WriteFile (in: hFile=0xd84, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x114cf61c*=0x3b0, lpOverlapped=0x0) returned 1 [0157.683] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x114cf60c | out: lpNewFilePointer=0x0) returned 1 [0157.683] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.683] WriteFile (in: hFile=0xd84, lpBuffer=0x114cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x114cf83c*, lpNumberOfBytesWritten=0x114cf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.683] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x3b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.683] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.683] CloseHandle (hObject=0xd84) returned 1 [0157.684] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.685] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\preview.gif.play")) returned 1 [0157.686] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1545 os_tid = 0x16a4 [0157.780] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.780] ReadFile (in: hFile=0xd84, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.782] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.782] ReadFile (in: hFile=0xd84, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.782] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.785] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0157.785] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0157.785] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0157.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.785] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0157.788] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.790] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.790] WriteFile (in: hFile=0xd84, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0157.790] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.790] ReadFile (in: hFile=0xd84, lpBuffer=0x4350000, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0xe9f61c*=0x1413d, lpOverlapped=0x0) returned 1 [0157.794] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0xfffebec3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.794] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4350000, cbInput=0x1413d, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe9f848, pbOutput=0x4350000, pcbResult=0xe9f618) returned 0x0 [0157.794] WriteFile (in: hFile=0xd84, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0xe9f61c*=0x14140, lpOverlapped=0x0) returned 1 [0157.794] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0157.794] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.795] WriteFile (in: hFile=0xd84, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.795] SetFilePointerEx (in: hFile=0xd84, liDistanceToMove=0x14140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.795] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.795] CloseHandle (hObject=0xd84) returned 1 [0157.795] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\sky.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\sky.elm.play")) returned 1 [0157.797] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1546 os_tid = 0x169c [0157.791] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.799] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.799] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0157.799] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0157.799] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0157.800] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.800] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x111f500) returned 0x0 [0157.803] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.804] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.804] WriteFile (in: hFile=0xd74, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0157.808] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.808] ReadFile (in: hFile=0xd74, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x1bc, lpOverlapped=0x0) returned 1 [0157.808] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffe44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.808] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2750000, cbInput=0x1bc, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0157.808] WriteFile (in: hFile=0xd74, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x1c0, lpOverlapped=0x0) returned 1 [0157.808] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0157.809] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.809] WriteFile (in: hFile=0xd74, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.809] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x1c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.809] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.809] CloseHandle (hObject=0xd74) returned 1 [0157.809] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\sky.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\sky.inf.play")) returned 1 [0157.812] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1547 os_tid = 0x15b4 [0157.807] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.807] ReadFile (in: hFile=0xd64, lpBuffer=0xe30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe30f85c, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesRead=0xe30f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.815] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.815] ReadFile (in: hFile=0xd64, lpBuffer=0xe30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe30f85c, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesRead=0xe30f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.815] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.817] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.817] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xe30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0157.817] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xe30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xe30f828, pbKeyObject=0x0) returned 0x0 [0157.817] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe30f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe30f500) returned 0x0 [0157.817] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.817] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe30f500) returned 0x0 [0157.820] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.822] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.822] WriteFile (in: hFile=0xd64, lpBuffer=0xe30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe30f830, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesWritten=0xe30f830*=0x428, lpOverlapped=0x0) returned 1 [0157.822] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.822] ReadFile (in: hFile=0xd64, lpBuffer=0x2850000, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xe30f61c*=0x7279, lpOverlapped=0x0) returned 1 [0157.832] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xffff8d87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.832] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2850000, cbInput=0x7279, pPaddingInfo=0x0, pbIV=0xe30f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xe30f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe30f848, pbOutput=0x2850000, pcbResult=0xe30f618) returned 0x0 [0157.832] WriteFile (in: hFile=0xd64, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xe30f61c*=0x7280, lpOverlapped=0x0) returned 1 [0157.832] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe30f60c | out: lpNewFilePointer=0x0) returned 1 [0157.832] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.832] WriteFile (in: hFile=0xd64, lpBuffer=0xe30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0xe30f83c*, lpNumberOfBytesWritten=0xe30f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.832] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x7280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.832] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.832] CloseHandle (hObject=0xd64) returned 1 [0157.833] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.834] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sky\\thmbnail.png.play")) returned 1 [0157.835] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1548 os_tid = 0x1698 [0157.839] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.841] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.841] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xe44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0157.841] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xe44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xe44f828, pbKeyObject=0x0) returned 0x0 [0157.841] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe44f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe44f500) returned 0x0 [0157.841] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.841] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe44f500) returned 0x0 [0157.845] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.846] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.846] WriteFile (in: hFile=0xd54, lpBuffer=0xe44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe44f830, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesWritten=0xe44f830*=0x428, lpOverlapped=0x0) returned 1 [0157.848] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.848] ReadFile (in: hFile=0xd54, lpBuffer=0x2950000, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xe44f61c*=0x3f1, lpOverlapped=0x0) returned 1 [0157.848] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffc0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.848] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2950000, cbInput=0x3f1, pPaddingInfo=0x0, pbIV=0xe44f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xe44f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe44f848, pbOutput=0x2950000, pcbResult=0xe44f618) returned 0x0 [0157.848] WriteFile (in: hFile=0xd54, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xe44f61c*=0x400, lpOverlapped=0x0) returned 1 [0157.848] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe44f60c | out: lpNewFilePointer=0x0) returned 1 [0157.849] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.849] WriteFile (in: hFile=0xd54, lpBuffer=0xe44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0xe44f83c*, lpNumberOfBytesWritten=0xe44f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.849] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.849] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.849] CloseHandle (hObject=0xd54) returned 1 [0157.849] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\preview.gif.play")) returned 1 [0157.851] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1549 os_tid = 0x1694 [0157.854] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.854] ReadFile (in: hFile=0xd44, lpBuffer=0xe58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe58f85c, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesRead=0xe58f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.856] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.856] ReadFile (in: hFile=0xd44, lpBuffer=0xe58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe58f85c, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesRead=0xe58f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.856] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.857] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.857] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xe58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0157.857] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xe58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xe58f828, pbKeyObject=0x0) returned 0x0 [0157.858] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe58f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe58f500) returned 0x0 [0157.858] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.858] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe58f500) returned 0x0 [0157.861] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.863] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.863] WriteFile (in: hFile=0xd44, lpBuffer=0xe58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe58f830, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesWritten=0xe58f830*=0x428, lpOverlapped=0x0) returned 1 [0157.863] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.863] ReadFile (in: hFile=0xd44, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xe58f61c*=0x14c40, lpOverlapped=0x0) returned 1 [0157.866] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xfffeb3c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.866] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2a50000, cbInput=0x14c40, pPaddingInfo=0x0, pbIV=0xe58f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xe58f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe58f848, pbOutput=0x2a50000, pcbResult=0xe58f618) returned 0x0 [0157.866] WriteFile (in: hFile=0xd44, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x14c50, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xe58f61c*=0x14c50, lpOverlapped=0x0) returned 1 [0157.866] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe58f60c | out: lpNewFilePointer=0x0) returned 1 [0157.866] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.866] WriteFile (in: hFile=0xd44, lpBuffer=0xe58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0xe58f83c*, lpNumberOfBytesWritten=0xe58f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.866] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x14c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.866] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.866] CloseHandle (hObject=0xd44) returned 1 [0157.867] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\slate.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\slate.elm.play")) returned 1 [0157.868] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1550 os_tid = 0x1690 [0157.865] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.871] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.872] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xe6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0157.872] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xe6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xe6cf828, pbKeyObject=0x0) returned 0x0 [0157.872] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe6cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe6cf500) returned 0x0 [0157.872] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.872] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe6cf500) returned 0x0 [0157.876] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.877] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.877] WriteFile (in: hFile=0xd34, lpBuffer=0xe6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe6cf830, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesWritten=0xe6cf830*=0x428, lpOverlapped=0x0) returned 1 [0157.881] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.881] ReadFile (in: hFile=0xd34, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xe6cf61c*=0x1f4, lpOverlapped=0x0) returned 1 [0157.881] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffffe0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.881] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2b50000, cbInput=0x1f4, pPaddingInfo=0x0, pbIV=0xe6cf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xe6cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe6cf848, pbOutput=0x2b50000, pcbResult=0xe6cf618) returned 0x0 [0157.881] WriteFile (in: hFile=0xd34, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xe6cf61c*=0x200, lpOverlapped=0x0) returned 1 [0157.881] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe6cf60c | out: lpNewFilePointer=0x0) returned 1 [0157.881] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.881] WriteFile (in: hFile=0xd34, lpBuffer=0xe6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xe6cf83c*, lpNumberOfBytesWritten=0xe6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.881] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.881] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.881] CloseHandle (hObject=0xd34) returned 1 [0157.881] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\slate.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\slate.inf.play")) returned 1 [0157.885] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1551 os_tid = 0x168c [0157.879] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.879] ReadFile (in: hFile=0xd24, lpBuffer=0xe94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe94f85c, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesRead=0xe94f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.888] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.888] ReadFile (in: hFile=0xd24, lpBuffer=0xe94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe94f85c, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesRead=0xe94f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.888] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.889] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.889] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xe94f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0157.889] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xe94f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xe94f828, pbKeyObject=0x0) returned 0x0 [0157.889] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe94f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe94f500) returned 0x0 [0157.889] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.890] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe94f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe94f500) returned 0x0 [0157.893] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.894] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.894] WriteFile (in: hFile=0xd24, lpBuffer=0xe94fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe94f830, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesWritten=0xe94f830*=0x428, lpOverlapped=0x0) returned 1 [0157.895] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.895] ReadFile (in: hFile=0xd24, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xe94f61c*=0x6a29, lpOverlapped=0x0) returned 1 [0157.896] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xffff95d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.896] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2c50000, cbInput=0x6a29, pPaddingInfo=0x0, pbIV=0xe94f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xe94f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe94f848, pbOutput=0x2c50000, pcbResult=0xe94f618) returned 0x0 [0157.896] WriteFile (in: hFile=0xd24, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xe94f61c*=0x6a30, lpOverlapped=0x0) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe94f60c | out: lpNewFilePointer=0x0) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.897] WriteFile (in: hFile=0xd24, lpBuffer=0xe94f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0xe94f83c*, lpNumberOfBytesWritten=0xe94f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xd24, liDistanceToMove=0x6a30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.897] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.897] CloseHandle (hObject=0xd24) returned 1 [0157.897] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\slate\\thmbnail.png.play")) returned 1 [0157.899] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1552 os_tid = 0x1688 [0157.901] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.901] ReadFile (in: hFile=0xd14, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.902] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.902] ReadFile (in: hFile=0xd14, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.902] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.904] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.904] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0157.904] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0157.904] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xea8f500) returned 0x0 [0157.904] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.904] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xea8f500) returned 0x0 [0157.907] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.909] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.909] WriteFile (in: hFile=0xd14, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0157.909] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.909] ReadFile (in: hFile=0xd14, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xea8f61c*=0x8a1, lpOverlapped=0x0) returned 1 [0157.909] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffff75f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.910] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2d50000, cbInput=0x8a1, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xea8f848, pbOutput=0x2d50000, pcbResult=0xea8f618) returned 0x0 [0157.910] WriteFile (in: hFile=0xd14, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xea8f61c*=0x8b0, lpOverlapped=0x0) returned 1 [0157.910] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0157.910] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.910] WriteFile (in: hFile=0xd14, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.910] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x8b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.910] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.910] CloseHandle (hObject=0xd14) returned 1 [0157.910] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\preview.gif.play")) returned 1 [0157.912] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1553 os_tid = 0xb90 [0157.914] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.914] ReadFile (in: hFile=0xbdc, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.917] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.917] ReadFile (in: hFile=0xbdc, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.918] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0157.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0157.920] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0157.920] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0157.920] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xebcf500) returned 0x0 [0157.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0157.920] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xebcf500) returned 0x0 [0157.923] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.925] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.925] WriteFile (in: hFile=0xbdc, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0157.925] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.925] ReadFile (in: hFile=0xbdc, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xebcf61c*=0xd59f, lpOverlapped=0x0) returned 1 [0157.927] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xffff2a61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.927] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0xd59f, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xebcf848, pbOutput=0x2e50000, pcbResult=0xebcf618) returned 0x0 [0157.927] WriteFile (in: hFile=0xbdc, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xebcf61c*=0xd5a0, lpOverlapped=0x0) returned 1 [0157.928] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0157.928] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.928] WriteFile (in: hFile=0xbdc, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.928] SetFilePointerEx (in: hFile=0xbdc, liDistanceToMove=0xd5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.928] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.928] CloseHandle (hObject=0xbdc) returned 1 [0157.928] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0157.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\sonora.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\sonora.elm.play")) returned 1 [0157.930] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1554 os_tid = 0x1128 [0157.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.927] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.927] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0157.927] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0157.932] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0157.932] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.932] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0157.936] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.938] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.938] WriteFile (in: hFile=0xb8c, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0157.941] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.941] ReadFile (in: hFile=0xb8c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xed0f61c*=0x1e4, lpOverlapped=0x0) returned 1 [0157.942] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffe1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.942] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2f50000, cbInput=0x1e4, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xed0f848, pbOutput=0x2f50000, pcbResult=0xed0f618) returned 0x0 [0157.942] WriteFile (in: hFile=0xb8c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xed0f61c*=0x1f0, lpOverlapped=0x0) returned 1 [0157.942] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0157.942] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.942] WriteFile (in: hFile=0xb8c, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.942] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x1f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.942] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0157.942] CloseHandle (hObject=0xb8c) returned 1 [0157.942] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\sonora.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\sonora.inf.play")) returned 1 [0157.945] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1555 os_tid = 0x1684 [0157.948] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.948] ReadFile (in: hFile=0xc9c, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.950] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.950] ReadFile (in: hFile=0xc9c, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.952] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.953] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.953] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0157.953] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0157.953] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0157.953] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.953] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xee4f500) returned 0x0 [0157.956] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.958] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.958] WriteFile (in: hFile=0xc9c, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0157.958] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.958] ReadFile (in: hFile=0xc9c, lpBuffer=0x3050000, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xee4f61c*=0x5534, lpOverlapped=0x0) returned 1 [0157.959] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xffffaacc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.959] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3050000, cbInput=0x5534, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xee4f848, pbOutput=0x3050000, pcbResult=0xee4f618) returned 0x0 [0157.959] WriteFile (in: hFile=0xc9c, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xee4f61c*=0x5540, lpOverlapped=0x0) returned 1 [0157.959] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0157.960] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.960] WriteFile (in: hFile=0xc9c, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.960] SetFilePointerEx (in: hFile=0xc9c, liDistanceToMove=0x5540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.960] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.960] CloseHandle (hObject=0xc9c) returned 1 [0157.960] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sonora\\thmbnail.png.play")) returned 1 [0157.962] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1556 os_tid = 0x17e0 [0157.965] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.965] ReadFile (in: hFile=0xcbc, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.966] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.966] ReadFile (in: hFile=0xcbc, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0157.966] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.967] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.968] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0157.968] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0157.968] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0157.968] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.968] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xef8f500) returned 0x0 [0157.971] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.974] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.974] WriteFile (in: hFile=0xcbc, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0157.975] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.975] ReadFile (in: hFile=0xcbc, lpBuffer=0x3150000, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xef8f61c*=0x9df, lpOverlapped=0x0) returned 1 [0157.975] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffff621, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.975] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3150000, cbInput=0x9df, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xef8f848, pbOutput=0x3150000, pcbResult=0xef8f618) returned 0x0 [0157.975] WriteFile (in: hFile=0xcbc, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xef8f61c*=0x9e0, lpOverlapped=0x0) returned 1 [0157.976] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0157.976] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.976] WriteFile (in: hFile=0xcbc, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0157.976] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x9e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.976] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.976] CloseHandle (hObject=0xcbc) returned 1 [0157.977] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.979] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\preview.gif.play")) returned 1 [0157.980] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1557 os_tid = 0x1680 [0157.984] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.984] ReadFile (in: hFile=0xcdc, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.986] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.986] ReadFile (in: hFile=0xcdc, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0157.986] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0157.987] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0157.987] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0157.987] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0157.987] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0157.987] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0157.987] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf0cf500) returned 0x0 [0157.991] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.992] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.993] WriteFile (in: hFile=0xcdc, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0157.993] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.993] ReadFile (in: hFile=0xcdc, lpBuffer=0x3250000, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0xf0cf61c*=0x10af1, lpOverlapped=0x0) returned 1 [0157.994] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffef50f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.994] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3250000, cbInput=0x10af1, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf0cf848, pbOutput=0x3250000, pcbResult=0xf0cf618) returned 0x0 [0157.994] WriteFile (in: hFile=0xcdc, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0xf0cf61c*=0x10b00, lpOverlapped=0x0) returned 1 [0157.996] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0157.996] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.996] WriteFile (in: hFile=0xcdc, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0157.996] SetFilePointerEx (in: hFile=0xcdc, liDistanceToMove=0x10b00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.996] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0157.996] CloseHandle (hObject=0xcdc) returned 1 [0157.996] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0157.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\spring.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\spring.elm.play")) returned 1 [0158.000] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1558 os_tid = 0xe84 [0158.002] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.003] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.003] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0158.003] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0158.003] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0158.003] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0158.004] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0158.007] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.008] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.008] WriteFile (in: hFile=0xcfc, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0158.011] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.011] ReadFile (in: hFile=0xcfc, lpBuffer=0x3350000, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xf34f61c*=0x1d2, lpOverlapped=0x0) returned 1 [0158.011] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffe2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.012] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3350000, cbInput=0x1d2, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf34f848, pbOutput=0x3350000, pcbResult=0xf34f618) returned 0x0 [0158.012] WriteFile (in: hFile=0xcfc, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xf34f61c*=0x1e0, lpOverlapped=0x0) returned 1 [0158.012] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0158.012] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.012] WriteFile (in: hFile=0xcfc, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.012] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x1e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.012] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.012] CloseHandle (hObject=0xcfc) returned 1 [0158.012] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0158.013] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\spring.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\spring.inf.play")) returned 1 [0158.015] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1559 os_tid = 0x308 [0158.018] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.018] ReadFile (in: hFile=0xb64, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.019] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.019] ReadFile (in: hFile=0xb64, lpBuffer=0xf48fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf48f85c, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesRead=0xf48f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.019] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.020] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.020] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0xf48f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0158.020] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0xf48f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0xf48f828, pbKeyObject=0x0) returned 0x0 [0158.020] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf48f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0158.020] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0158.021] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf48f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf48f500) returned 0x0 [0158.024] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.025] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.025] WriteFile (in: hFile=0xb64, lpBuffer=0xf48fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf48f830, lpOverlapped=0x0 | out: lpBuffer=0xf48fb34*, lpNumberOfBytesWritten=0xf48f830*=0x428, lpOverlapped=0x0) returned 1 [0158.026] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.026] ReadFile (in: hFile=0xb64, lpBuffer=0x3450000, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0xf48f61c*=0x4c45, lpOverlapped=0x0) returned 1 [0158.026] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0xffffb3bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.027] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3450000, cbInput=0x4c45, pPaddingInfo=0x0, pbIV=0xf48f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0xf48f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xf48f848, pbOutput=0x3450000, pcbResult=0xf48f618) returned 0x0 [0158.027] WriteFile (in: hFile=0xb64, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0xf48f61c*=0x4c50, lpOverlapped=0x0) returned 1 [0158.027] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf48f60c | out: lpNewFilePointer=0x0) returned 1 [0158.027] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.027] WriteFile (in: hFile=0xb64, lpBuffer=0xf48f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf48f61c, lpOverlapped=0x0 | out: lpBuffer=0xf48f83c*, lpNumberOfBytesWritten=0xf48f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.027] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x4c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.028] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.028] CloseHandle (hObject=0xb64) returned 1 [0158.028] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0158.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\spring\\thmbnail.png.play")) returned 1 [0158.030] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1560 os_tid = 0x167c [0158.032] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.032] ReadFile (in: hFile=0xb5c, lpBuffer=0xfe4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfe4f85c, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesRead=0xfe4f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.033] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.034] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.034] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0xfe4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0158.035] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0xfe4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0xfe4f828, pbKeyObject=0x0) returned 0x0 [0158.035] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xfe4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0158.035] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0158.035] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xfe4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xfe4f500) returned 0x0 [0158.038] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.039] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.040] WriteFile (in: hFile=0xb5c, lpBuffer=0xfe4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfe4f830, lpOverlapped=0x0 | out: lpBuffer=0xfe4fb34*, lpNumberOfBytesWritten=0xfe4f830*=0x428, lpOverlapped=0x0) returned 1 [0158.040] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.040] ReadFile (in: hFile=0xb5c, lpBuffer=0x3550000, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0xfe4f61c*=0x6c9, lpOverlapped=0x0) returned 1 [0158.040] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xfffff937, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.040] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3550000, cbInput=0x6c9, pPaddingInfo=0x0, pbIV=0xfe4f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0xfe4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xfe4f848, pbOutput=0x3550000, pcbResult=0xfe4f618) returned 0x0 [0158.040] WriteFile (in: hFile=0xb5c, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0xfe4f61c*=0x6d0, lpOverlapped=0x0) returned 1 [0158.040] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfe4f60c | out: lpNewFilePointer=0x0) returned 1 [0158.040] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.040] WriteFile (in: hFile=0xb5c, lpBuffer=0xfe4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe4f61c, lpOverlapped=0x0 | out: lpBuffer=0xfe4f83c*, lpNumberOfBytesWritten=0xfe4f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.041] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x6d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.041] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.041] CloseHandle (hObject=0xb5c) returned 1 [0158.041] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0158.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\preview.gif.play")) returned 1 [0158.046] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1561 os_tid = 0x1224 [0158.048] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.048] ReadFile (in: hFile=0xb54, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.050] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.050] ReadFile (in: hFile=0xb54, lpBuffer=0x100cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x100cf85c, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesRead=0x100cf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.050] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.051] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.051] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x100cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0158.051] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x100cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x100cf828, pbKeyObject=0x0) returned 0x0 [0158.051] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x100cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0158.052] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0158.052] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x100cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x100cf500) returned 0x0 [0158.056] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.058] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.058] WriteFile (in: hFile=0xb54, lpBuffer=0x100cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x100cf830, lpOverlapped=0x0 | out: lpBuffer=0x100cfb34*, lpNumberOfBytesWritten=0x100cf830*=0x428, lpOverlapped=0x0) returned 1 [0158.059] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.059] ReadFile (in: hFile=0xb54, lpBuffer=0x3650000, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x100cf61c*=0xe232, lpOverlapped=0x0) returned 1 [0158.060] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0xffff1dce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.061] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3650000, cbInput=0xe232, pPaddingInfo=0x0, pbIV=0x100cf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x100cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x100cf848, pbOutput=0x3650000, pcbResult=0x100cf618) returned 0x0 [0158.061] WriteFile (in: hFile=0xb54, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x100cf61c*=0xe240, lpOverlapped=0x0) returned 1 [0158.062] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100cf60c | out: lpNewFilePointer=0x0) returned 1 [0158.062] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.062] WriteFile (in: hFile=0xb54, lpBuffer=0x100cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100cf61c, lpOverlapped=0x0 | out: lpBuffer=0x100cf83c*, lpNumberOfBytesWritten=0x100cf61c*=0x8, lpOverlapped=0x0) returned 1 [0158.062] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0xe240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.062] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.062] CloseHandle (hObject=0xb54) returned 1 [0158.062] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0158.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\strtedge.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\strtedge.elm.play")) returned 1 [0158.067] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1562 os_tid = 0x1678 [0158.059] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.069] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.070] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x1034f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0158.070] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x1034f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x1034f828, pbKeyObject=0x0) returned 0x0 [0158.070] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1034f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0158.070] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.070] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1034f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1034f500) returned 0x0 [0158.075] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.078] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.078] WriteFile (in: hFile=0xb4c, lpBuffer=0x1034fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1034f830, lpOverlapped=0x0 | out: lpBuffer=0x1034fb34*, lpNumberOfBytesWritten=0x1034f830*=0x428, lpOverlapped=0x0) returned 1 [0158.084] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.084] ReadFile (in: hFile=0xb4c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x1034f61c*=0x271, lpOverlapped=0x0) returned 1 [0158.084] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffd8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.084] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3750000, cbInput=0x271, pPaddingInfo=0x0, pbIV=0x1034f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x1034f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1034f848, pbOutput=0x3750000, pcbResult=0x1034f618) returned 0x0 [0158.084] WriteFile (in: hFile=0xb4c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x1034f61c*=0x280, lpOverlapped=0x0) returned 1 [0158.084] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1034f60c | out: lpNewFilePointer=0x0) returned 1 [0158.084] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.084] WriteFile (in: hFile=0xb4c, lpBuffer=0x1034f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1034f61c, lpOverlapped=0x0 | out: lpBuffer=0x1034f83c*, lpNumberOfBytesWritten=0x1034f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.084] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.085] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.085] CloseHandle (hObject=0xb4c) returned 1 [0158.085] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0158.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\strtedge.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\strtedge.inf.play")) returned 1 [0158.088] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1563 os_tid = 0x13dc [0158.091] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.091] ReadFile (in: hFile=0xb44, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.093] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.093] ReadFile (in: hFile=0xb44, lpBuffer=0x1048fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1048f85c, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesRead=0x1048f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.093] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.094] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.094] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x1048f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0158.094] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x1048f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x1048f828, pbKeyObject=0x0) returned 0x0 [0158.095] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1048f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0158.095] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0158.095] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1048f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1048f500) returned 0x0 [0158.099] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.101] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.101] WriteFile (in: hFile=0xb44, lpBuffer=0x1048fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1048f830, lpOverlapped=0x0 | out: lpBuffer=0x1048fb34*, lpNumberOfBytesWritten=0x1048f830*=0x428, lpOverlapped=0x0) returned 1 [0158.102] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.102] ReadFile (in: hFile=0xb44, lpBuffer=0x3850000, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1048f61c*=0x82c7, lpOverlapped=0x0) returned 1 [0158.102] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0xffff7d39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.103] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3850000, cbInput=0x82c7, pPaddingInfo=0x0, pbIV=0x1048f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1048f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1048f848, pbOutput=0x3850000, pcbResult=0x1048f618) returned 0x0 [0158.103] WriteFile (in: hFile=0xb44, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1048f61c*=0x82d0, lpOverlapped=0x0) returned 1 [0158.104] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1048f60c | out: lpNewFilePointer=0x0) returned 1 [0158.104] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.104] WriteFile (in: hFile=0xb44, lpBuffer=0x1048f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1048f61c, lpOverlapped=0x0 | out: lpBuffer=0x1048f83c*, lpNumberOfBytesWritten=0x1048f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.104] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0x82d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.104] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.104] CloseHandle (hObject=0xb44) returned 1 [0158.104] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0158.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\strtedge\\thmbnail.png.play")) returned 1 [0158.107] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1564 os_tid = 0x1674 [0158.109] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.109] ReadFile (in: hFile=0xb3c, lpBuffer=0x1070fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1070f85c, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesRead=0x1070f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.111] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.112] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.112] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x1070f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0158.112] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x1070f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x1070f828, pbKeyObject=0x0) returned 0x0 [0158.112] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1070f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0158.112] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0158.112] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1070f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1070f500) returned 0x0 [0158.117] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.118] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.119] WriteFile (in: hFile=0xb3c, lpBuffer=0x1070fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1070f830, lpOverlapped=0x0 | out: lpBuffer=0x1070fb34*, lpNumberOfBytesWritten=0x1070f830*=0x428, lpOverlapped=0x0) returned 1 [0158.119] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.119] ReadFile (in: hFile=0xb3c, lpBuffer=0x3950000, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1070f61c*=0x68b, lpOverlapped=0x0) returned 1 [0158.119] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xfffff975, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.119] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3950000, cbInput=0x68b, pPaddingInfo=0x0, pbIV=0x1070f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1070f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1070f848, pbOutput=0x3950000, pcbResult=0x1070f618) returned 0x0 [0158.119] WriteFile (in: hFile=0xb3c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1070f61c*=0x690, lpOverlapped=0x0) returned 1 [0158.120] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1070f60c | out: lpNewFilePointer=0x0) returned 1 [0158.120] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.120] WriteFile (in: hFile=0xb3c, lpBuffer=0x1070f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1070f61c, lpOverlapped=0x0 | out: lpBuffer=0x1070f83c*, lpNumberOfBytesWritten=0x1070f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.120] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.120] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.120] CloseHandle (hObject=0xb3c) returned 1 [0158.120] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0158.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\preview.gif.play")) returned 1 [0158.123] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1565 os_tid = 0x1670 [0158.126] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.126] ReadFile (in: hFile=0xb34, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.128] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.128] ReadFile (in: hFile=0xb34, lpBuffer=0x1084fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1084f85c, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesRead=0x1084f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.128] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.129] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.129] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1084f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0158.129] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1084f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1084f828, pbKeyObject=0x0) returned 0x0 [0158.129] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1084f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0158.130] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0158.130] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1084f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1084f500) returned 0x0 [0158.134] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.136] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.136] WriteFile (in: hFile=0xb34, lpBuffer=0x1084fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1084f830, lpOverlapped=0x0 | out: lpBuffer=0x1084fb34*, lpNumberOfBytesWritten=0x1084f830*=0x428, lpOverlapped=0x0) returned 1 [0158.136] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.136] ReadFile (in: hFile=0xb34, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1084f61c*=0xbfed, lpOverlapped=0x0) returned 1 [0158.139] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0xffff4013, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.139] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3a50000, cbInput=0xbfed, pPaddingInfo=0x0, pbIV=0x1084f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1084f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1084f848, pbOutput=0x3a50000, pcbResult=0x1084f618) returned 0x0 [0158.139] WriteFile (in: hFile=0xb34, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1084f61c*=0xbff0, lpOverlapped=0x0) returned 1 [0158.140] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1084f60c | out: lpNewFilePointer=0x0) returned 1 [0158.140] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.140] WriteFile (in: hFile=0xb34, lpBuffer=0x1084f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1084f61c, lpOverlapped=0x0 | out: lpBuffer=0x1084f83c*, lpNumberOfBytesWritten=0x1084f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.140] SetFilePointerEx (in: hFile=0xb34, liDistanceToMove=0xbff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.140] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.140] CloseHandle (hObject=0xb34) returned 1 [0158.140] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\studio.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\studio.elm.play")) returned 1 [0158.142] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1566 os_tid = 0x166c [0158.139] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0158.430] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0158.430] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x10acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0158.430] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x10acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x10acf828, pbKeyObject=0x0) returned 0x0 [0158.430] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x10acf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0159.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.135] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x10acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x10acf500) returned 0x0 [0159.139] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.141] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.141] WriteFile (in: hFile=0xa40, lpBuffer=0x10acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10acf830, lpOverlapped=0x0 | out: lpBuffer=0x10acfb34*, lpNumberOfBytesWritten=0x10acf830*=0x428, lpOverlapped=0x0) returned 1 [0159.164] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.165] ReadFile (in: hFile=0xa40, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x10acf61c*=0x242, lpOverlapped=0x0) returned 1 [0159.165] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xfffffdbe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.165] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3b50000, cbInput=0x242, pPaddingInfo=0x0, pbIV=0x10acf848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x10acf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10acf848, pbOutput=0x3b50000, pcbResult=0x10acf618) returned 0x0 [0159.165] WriteFile (in: hFile=0xa40, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x10acf61c*=0x250, lpOverlapped=0x0) returned 1 [0159.165] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10acf60c | out: lpNewFilePointer=0x0) returned 1 [0159.165] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.165] WriteFile (in: hFile=0xa40, lpBuffer=0x10acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10acf61c, lpOverlapped=0x0 | out: lpBuffer=0x10acf83c*, lpNumberOfBytesWritten=0x10acf61c*=0x8, lpOverlapped=0x0) returned 1 [0159.165] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.165] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0159.165] CloseHandle (hObject=0xa40) returned 1 [0159.165] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\studio.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\studio.inf.play")) returned 1 [0159.167] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1567 os_tid = 0x1668 [0158.146] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.146] ReadFile (in: hFile=0xa48, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.148] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.148] ReadFile (in: hFile=0xa48, lpBuffer=0x10c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesRead=0x10c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.149] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.150] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.150] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x10c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0158.150] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x10c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x10c0f828, pbKeyObject=0x0) returned 0x0 [0158.150] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10c0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0158.151] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.151] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10c0f500) returned 0x0 [0158.156] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.157] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.157] WriteFile (in: hFile=0xa48, lpBuffer=0x10c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10c0f830, lpOverlapped=0x0 | out: lpBuffer=0x10c0fb34*, lpNumberOfBytesWritten=0x10c0f830*=0x428, lpOverlapped=0x0) returned 1 [0158.158] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.158] ReadFile (in: hFile=0xa48, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x10c0f61c*=0x47cc, lpOverlapped=0x0) returned 1 [0158.159] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xffffb834, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.159] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3c50000, cbInput=0x47cc, pPaddingInfo=0x0, pbIV=0x10c0f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x10c0f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10c0f848, pbOutput=0x3c50000, pcbResult=0x10c0f618) returned 0x0 [0158.159] WriteFile (in: hFile=0xa48, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x10c0f61c*=0x47d0, lpOverlapped=0x0) returned 1 [0158.159] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10c0f60c | out: lpNewFilePointer=0x0) returned 1 [0158.159] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.160] WriteFile (in: hFile=0xa48, lpBuffer=0x10c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x10c0f83c*, lpNumberOfBytesWritten=0x10c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.160] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x47d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.161] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.161] CloseHandle (hObject=0xa48) returned 1 [0158.161] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\studio\\thmbnail.png.play")) returned 1 [0158.165] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1568 os_tid = 0xad8 [0158.163] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.167] ReadFile (in: hFile=0x72c, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.169] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.169] ReadFile (in: hFile=0x72c, lpBuffer=0x10d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesRead=0x10d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.169] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.171] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.172] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x10d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0158.172] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x10d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x10d4f828, pbKeyObject=0x0) returned 0x0 [0158.172] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10d4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0158.172] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.172] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10d4f500) returned 0x0 [0158.177] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.180] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.180] WriteFile (in: hFile=0x72c, lpBuffer=0x10d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10d4f830, lpOverlapped=0x0 | out: lpBuffer=0x10d4fb34*, lpNumberOfBytesWritten=0x10d4f830*=0x428, lpOverlapped=0x0) returned 1 [0158.180] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.180] ReadFile (in: hFile=0x72c, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x10d4f61c*=0x137f, lpOverlapped=0x0) returned 1 [0158.180] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0xffffec81, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.180] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3d50000, cbInput=0x137f, pPaddingInfo=0x0, pbIV=0x10d4f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x10d4f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10d4f848, pbOutput=0x3d50000, pcbResult=0x10d4f618) returned 0x0 [0158.180] WriteFile (in: hFile=0x72c, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x10d4f61c*=0x1380, lpOverlapped=0x0) returned 1 [0158.181] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10d4f60c | out: lpNewFilePointer=0x0) returned 1 [0158.181] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.181] WriteFile (in: hFile=0x72c, lpBuffer=0x10d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x10d4f83c*, lpNumberOfBytesWritten=0x10d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.181] SetFilePointerEx (in: hFile=0x72c, liDistanceToMove=0x1380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.181] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.181] CloseHandle (hObject=0x72c) returned 1 [0158.181] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\preview.gif.play")) returned 1 [0158.183] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1569 os_tid = 0x1804 [0158.187] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.187] ReadFile (in: hFile=0x724, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.189] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.189] ReadFile (in: hFile=0x724, lpBuffer=0x10e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x10e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesRead=0x10e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.189] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.190] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.190] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x10e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0158.190] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x10e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x10e8f828, pbKeyObject=0x0) returned 0x0 [0158.190] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10e8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0158.191] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.191] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10e8f500) returned 0x0 [0158.195] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.197] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.197] WriteFile (in: hFile=0x724, lpBuffer=0x10e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10e8f830, lpOverlapped=0x0 | out: lpBuffer=0x10e8fb34*, lpNumberOfBytesWritten=0x10e8f830*=0x428, lpOverlapped=0x0) returned 1 [0158.198] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.198] ReadFile (in: hFile=0x724, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x10e8f61c*=0x19e14, lpOverlapped=0x0) returned 1 [0158.201] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffe61ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.202] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3e50000, cbInput=0x19e14, pPaddingInfo=0x0, pbIV=0x10e8f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x10e8f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10e8f848, pbOutput=0x3e50000, pcbResult=0x10e8f618) returned 0x0 [0158.202] WriteFile (in: hFile=0x724, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x10e8f61c*=0x19e20, lpOverlapped=0x0) returned 1 [0158.202] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10e8f60c | out: lpNewFilePointer=0x0) returned 1 [0158.202] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.202] WriteFile (in: hFile=0x724, lpBuffer=0x10e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x10e8f83c*, lpNumberOfBytesWritten=0x10e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.202] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x19e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.203] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.203] CloseHandle (hObject=0x724) returned 1 [0158.203] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0158.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\sumipntg.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\sumipntg.elm.play")) returned 1 [0158.207] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1570 os_tid = 0x1808 [0158.199] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.205] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.209] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x10fcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0158.209] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x10fcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x10fcf828, pbKeyObject=0x0) returned 0x0 [0158.209] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x10fcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0158.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.209] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x10fcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x10fcf500) returned 0x0 [0158.214] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.216] SetFilePointerEx (in: hFile=0x720, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.216] WriteFile (in: hFile=0x720, lpBuffer=0x10fcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x10fcf830, lpOverlapped=0x0 | out: lpBuffer=0x10fcfb34*, lpNumberOfBytesWritten=0x10fcf830*=0x428, lpOverlapped=0x0) returned 1 [0158.218] SetFilePointerEx (in: hFile=0x720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.219] ReadFile (in: hFile=0x720, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x10fcf61c*=0x22b, lpOverlapped=0x0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x720, liDistanceToMove=0xfffffdd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.219] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3f50000, cbInput=0x22b, pPaddingInfo=0x0, pbIV=0x10fcf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x10fcf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x10fcf848, pbOutput=0x3f50000, pcbResult=0x10fcf618) returned 0x0 [0158.219] WriteFile (in: hFile=0x720, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x10fcf61c*=0x230, lpOverlapped=0x0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fcf60c | out: lpNewFilePointer=0x0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x720, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.219] WriteFile (in: hFile=0x720, lpBuffer=0x10fcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fcf61c, lpOverlapped=0x0 | out: lpBuffer=0x10fcf83c*, lpNumberOfBytesWritten=0x10fcf61c*=0x8, lpOverlapped=0x0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x720, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.219] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.219] CloseHandle (hObject=0x720) returned 1 [0158.219] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\sumipntg.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\sumipntg.inf.play")) returned 1 [0158.221] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1571 os_tid = 0x180c [0158.225] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.225] ReadFile (in: hFile=0x718, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.226] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.227] ReadFile (in: hFile=0x718, lpBuffer=0x1110fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1110f85c, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesRead=0x1110f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.227] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.228] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x1110f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0158.228] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x1110f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x1110f828, pbKeyObject=0x0) returned 0x0 [0158.228] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1110f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0158.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.228] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1110f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1110f500) returned 0x0 [0158.234] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.236] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.236] WriteFile (in: hFile=0x718, lpBuffer=0x1110fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1110f830, lpOverlapped=0x0 | out: lpBuffer=0x1110fb34*, lpNumberOfBytesWritten=0x1110f830*=0x428, lpOverlapped=0x0) returned 1 [0158.237] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.237] ReadFile (in: hFile=0x718, lpBuffer=0x4050000, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x1110f61c*=0xad0e, lpOverlapped=0x0) returned 1 [0158.238] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xffff52f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.238] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4050000, cbInput=0xad0e, pPaddingInfo=0x0, pbIV=0x1110f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x1110f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1110f848, pbOutput=0x4050000, pcbResult=0x1110f618) returned 0x0 [0158.238] WriteFile (in: hFile=0x718, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x1110f61c*=0xad10, lpOverlapped=0x0) returned 1 [0158.240] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1110f60c | out: lpNewFilePointer=0x0) returned 1 [0158.240] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.240] WriteFile (in: hFile=0x718, lpBuffer=0x1110f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1110f61c, lpOverlapped=0x0 | out: lpBuffer=0x1110f83c*, lpNumberOfBytesWritten=0x1110f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.240] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xad10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.240] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.240] CloseHandle (hObject=0x718) returned 1 [0158.240] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\sumipntg\\thmbnail.png.play")) returned 1 [0158.242] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1572 os_tid = 0x1810 [0158.246] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.247] ReadFile (in: hFile=0xac4, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.250] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.250] ReadFile (in: hFile=0xac4, lpBuffer=0x1124fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1124f85c, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesRead=0x1124f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.250] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.251] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.252] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x1124f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0158.252] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x1124f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x1124f828, pbKeyObject=0x0) returned 0x0 [0158.252] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1124f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0158.252] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.252] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1124f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1124f500) returned 0x0 [0158.258] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.260] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.260] WriteFile (in: hFile=0xac4, lpBuffer=0x1124fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1124f830, lpOverlapped=0x0 | out: lpBuffer=0x1124fb34*, lpNumberOfBytesWritten=0x1124f830*=0x428, lpOverlapped=0x0) returned 1 [0158.261] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.261] ReadFile (in: hFile=0xac4, lpBuffer=0x4150000, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x1124f61c*=0x1c6c, lpOverlapped=0x0) returned 1 [0158.262] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xffffe394, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.262] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4150000, cbInput=0x1c6c, pPaddingInfo=0x0, pbIV=0x1124f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x1124f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1124f848, pbOutput=0x4150000, pcbResult=0x1124f618) returned 0x0 [0158.262] WriteFile (in: hFile=0xac4, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x1124f61c*=0x1c70, lpOverlapped=0x0) returned 1 [0158.262] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1124f60c | out: lpNewFilePointer=0x0) returned 1 [0158.264] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.264] WriteFile (in: hFile=0xac4, lpBuffer=0x1124f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1124f61c, lpOverlapped=0x0 | out: lpBuffer=0x1124f83c*, lpNumberOfBytesWritten=0x1124f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.264] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x1c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.264] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.264] CloseHandle (hObject=0xac4) returned 1 [0158.264] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.266] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\THEMES.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\themes.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\THEMES.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\themes.inf.play")) returned 1 [0158.267] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1573 os_tid = 0x1814 [0158.269] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.270] ReadFile (in: hFile=0x708, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.271] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.272] ReadFile (in: hFile=0x708, lpBuffer=0x1138fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1138f85c, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesRead=0x1138f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.272] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.273] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.273] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x1138f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0158.273] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x1138f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x1138f828, pbKeyObject=0x0) returned 0x0 [0158.273] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1138f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1138f500) returned 0x0 [0158.273] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.273] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1138f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1138f500) returned 0x0 [0158.281] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.283] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.283] WriteFile (in: hFile=0x708, lpBuffer=0x1138fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1138f830, lpOverlapped=0x0 | out: lpBuffer=0x1138fb34*, lpNumberOfBytesWritten=0x1138f830*=0x428, lpOverlapped=0x0) returned 1 [0158.284] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.284] ReadFile (in: hFile=0x708, lpBuffer=0x4250000, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x1138f61c*=0xa6c, lpOverlapped=0x0) returned 1 [0158.284] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffff594, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.284] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4250000, cbInput=0xa6c, pPaddingInfo=0x0, pbIV=0x1138f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x1138f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1138f848, pbOutput=0x4250000, pcbResult=0x1138f618) returned 0x0 [0158.284] WriteFile (in: hFile=0x708, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x1138f61c*=0xa70, lpOverlapped=0x0) returned 1 [0158.284] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1138f60c | out: lpNewFilePointer=0x0) returned 1 [0158.284] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.284] WriteFile (in: hFile=0x708, lpBuffer=0x1138f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1138f61c, lpOverlapped=0x0 | out: lpBuffer=0x1138f83c*, lpNumberOfBytesWritten=0x1138f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.285] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.285] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.285] CloseHandle (hObject=0x708) returned 1 [0158.285] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\preview.gif.play")) returned 1 [0158.288] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1574 os_tid = 0x1818 [0158.318] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.318] ReadFile (in: hFile=0x6fc, lpBuffer=0x114cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x114cf85c, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesRead=0x114cf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.320] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.320] ReadFile (in: hFile=0x6fc, lpBuffer=0x114cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x114cf85c, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesRead=0x114cf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.320] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0158.323] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0158.323] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x114cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0158.323] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x114cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x114cf828, pbKeyObject=0x0) returned 0x0 [0158.323] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x114cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x114cf500) returned 0x0 [0158.323] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0158.324] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x114cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x114cf500) returned 0x0 [0158.328] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.330] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.330] WriteFile (in: hFile=0x6fc, lpBuffer=0x114cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x114cf830, lpOverlapped=0x0 | out: lpBuffer=0x114cfb34*, lpNumberOfBytesWritten=0x114cf830*=0x428, lpOverlapped=0x0) returned 1 [0158.330] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.330] ReadFile (in: hFile=0x6fc, lpBuffer=0x4450000, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x114cf61c*=0xa5d5, lpOverlapped=0x0) returned 1 [0158.331] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xffff5a2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.331] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x4450000, cbInput=0xa5d5, pPaddingInfo=0x0, pbIV=0x114cf848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x114cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x114cf848, pbOutput=0x4450000, pcbResult=0x114cf618) returned 0x0 [0158.331] WriteFile (in: hFile=0x6fc, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x114cf61c*=0xa5e0, lpOverlapped=0x0) returned 1 [0158.331] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x114cf60c | out: lpNewFilePointer=0x0) returned 1 [0158.331] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.332] WriteFile (in: hFile=0x6fc, lpBuffer=0x114cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x114cf61c, lpOverlapped=0x0 | out: lpBuffer=0x114cf83c*, lpNumberOfBytesWritten=0x114cf61c*=0x8, lpOverlapped=0x0) returned 1 [0158.332] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xa5e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.332] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0158.332] CloseHandle (hObject=0x6fc) returned 1 [0158.332] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\thmbnail.png.play")) returned 1 [0158.334] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1575 os_tid = 0x181c [0158.344] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0158.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94 [0158.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f030c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0158.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0158.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0324, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0158.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0158.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f033c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0158.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0158.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0354, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0158.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0158.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f036c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0158.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0158.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0384, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0158.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0158.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f039c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0158.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0158.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0158.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0158.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0158.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0158.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0158.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0158.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0158.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0158.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0414, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0158.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0158.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f042c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0158.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0158.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0444, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0158.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0158.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f045c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0158.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0158.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0474, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0158.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0158.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f048c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0158.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0158.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0158.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0158.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0158.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0158.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0158.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98 [0158.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0158.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0158.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4 [0158.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8 [0158.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f051c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac [0158.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0158.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0534, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0158.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0158.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f054c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0158.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0158.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0564, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0158.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0158.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f057c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc [0158.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0158.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0594, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0158.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0158.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0158.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0158.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0158.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0158.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0159.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0159.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0159.171] WaitForMultipleObjects (nCount=0x40, lpHandles=0x700000*=0xa94, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0160.593] CloseHandle (hObject=0xa94) returned 1 [0160.593] CloseHandle (hObject=0x6fc) returned 1 [0160.593] CloseHandle (hObject=0x70c) returned 1 [0160.593] CloseHandle (hObject=0x22c) returned 1 [0160.593] CloseHandle (hObject=0x628) returned 1 [0160.593] CloseHandle (hObject=0x6f4) returned 1 [0160.593] CloseHandle (hObject=0x6f0) returned 1 [0160.593] CloseHandle (hObject=0x6ec) returned 1 [0160.594] CloseHandle (hObject=0x6e8) returned 1 [0160.594] CloseHandle (hObject=0x6e4) returned 1 [0160.594] CloseHandle (hObject=0x34c) returned 1 [0160.594] CloseHandle (hObject=0x450) returned 1 [0160.594] CloseHandle (hObject=0x63c) returned 1 [0160.594] CloseHandle (hObject=0x638) returned 1 [0160.594] CloseHandle (hObject=0x634) returned 1 [0160.594] CloseHandle (hObject=0x62c) returned 1 [0160.594] CloseHandle (hObject=0x624) returned 1 [0160.594] CloseHandle (hObject=0x620) returned 1 [0160.594] CloseHandle (hObject=0x61c) returned 1 [0160.594] CloseHandle (hObject=0x5d4) returned 1 [0160.594] CloseHandle (hObject=0x618) returned 1 [0160.594] CloseHandle (hObject=0x614) returned 1 [0160.594] CloseHandle (hObject=0x610) returned 1 [0160.594] CloseHandle (hObject=0x60c) returned 1 [0160.594] CloseHandle (hObject=0x608) returned 1 [0160.594] CloseHandle (hObject=0x604) returned 1 [0160.595] CloseHandle (hObject=0x600) returned 1 [0160.595] CloseHandle (hObject=0x5fc) returned 1 [0160.595] CloseHandle (hObject=0x5f8) returned 1 [0160.595] CloseHandle (hObject=0x5f4) returned 1 [0160.595] CloseHandle (hObject=0x5f0) returned 1 [0160.595] CloseHandle (hObject=0x5ec) returned 1 [0160.595] CloseHandle (hObject=0x5e8) returned 1 [0160.595] CloseHandle (hObject=0x5e4) returned 1 [0160.595] CloseHandle (hObject=0x984) returned 1 [0160.595] CloseHandle (hObject=0x990) returned 1 [0160.595] CloseHandle (hObject=0x694) returned 1 [0160.595] CloseHandle (hObject=0xd8c) returned 1 [0160.595] CloseHandle (hObject=0xd90) returned 1 [0160.595] CloseHandle (hObject=0xd94) returned 1 [0160.595] CloseHandle (hObject=0xd98) returned 1 [0160.595] CloseHandle (hObject=0xd9c) returned 1 [0160.595] CloseHandle (hObject=0xda0) returned 1 [0160.595] CloseHandle (hObject=0xda4) returned 1 [0160.596] CloseHandle (hObject=0xda8) returned 1 [0160.596] CloseHandle (hObject=0xdac) returned 1 [0160.596] CloseHandle (hObject=0xdb0) returned 1 [0160.596] CloseHandle (hObject=0xdb4) returned 1 [0160.596] CloseHandle (hObject=0xdb8) returned 1 [0160.596] CloseHandle (hObject=0xdbc) returned 1 [0160.596] CloseHandle (hObject=0xdc0) returned 1 [0160.596] CloseHandle (hObject=0xdc4) returned 1 [0160.596] CloseHandle (hObject=0xdc8) returned 1 [0160.596] CloseHandle (hObject=0xdcc) returned 1 [0160.596] CloseHandle (hObject=0xdd0) returned 1 [0160.596] CloseHandle (hObject=0xdd4) returned 1 [0160.596] CloseHandle (hObject=0xdd8) returned 1 [0160.596] CloseHandle (hObject=0xddc) returned 1 [0160.596] CloseHandle (hObject=0xde0) returned 1 [0160.596] CloseHandle (hObject=0xde4) returned 1 [0160.596] CloseHandle (hObject=0xde8) returned 1 [0160.596] CloseHandle (hObject=0xa40) returned 1 [0160.597] CloseHandle (hObject=0xd34) returned 1 [0160.597] CloseHandle (hObject=0xd54) returned 1 [0160.597] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1576 os_tid = 0x1824 [0158.431] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.431] ReadFile (in: hFile=0x708, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.543] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.543] ReadFile (in: hFile=0x708, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.543] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.549] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.551] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0158.551] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0158.551] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xe9f500) returned 0x0 [0158.552] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.552] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xe9f500) returned 0x0 [0158.555] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.557] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.557] WriteFile (in: hFile=0x708, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0158.558] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.558] ReadFile (in: hFile=0x708, lpBuffer=0x4550000, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0xe9f61c*=0x101cc, lpOverlapped=0x0) returned 1 [0158.795] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffefe34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.795] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4550000, cbInput=0x101cc, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xe9f848, pbOutput=0x4550000, pcbResult=0xe9f618) returned 0x0 [0158.795] WriteFile (in: hFile=0x708, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0xe9f61c*=0x101d0, lpOverlapped=0x0) returned 1 [0158.897] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0158.897] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.897] WriteFile (in: hFile=0x708, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.897] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x101d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.897] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0158.897] CloseHandle (hObject=0x708) returned 1 [0158.897] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0158.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\water.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\water.elm.play")) returned 1 [0158.900] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1577 os_tid = 0x1828 [0158.433] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.122] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.122] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x111f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0159.122] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x111f828, pbKeyObject=0x0) returned 0x0 [0159.122] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x111f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x111f500) returned 0x0 [0159.122] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.122] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x111f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x111f500) returned 0x0 [0159.126] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.127] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.127] WriteFile (in: hFile=0x718, lpBuffer=0x111fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x111f830, lpOverlapped=0x0 | out: lpBuffer=0x111fb34*, lpNumberOfBytesWritten=0x111f830*=0x428, lpOverlapped=0x0) returned 1 [0159.130] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.130] ReadFile (in: hFile=0x718, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x111f61c*=0x1a1, lpOverlapped=0x0) returned 1 [0159.130] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xfffffe5f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.130] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2750000, cbInput=0x1a1, pPaddingInfo=0x0, pbIV=0x111f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x111f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x111f848, pbOutput=0x2750000, pcbResult=0x111f618) returned 0x0 [0159.130] WriteFile (in: hFile=0x718, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x111f61c*=0x1b0, lpOverlapped=0x0) returned 1 [0159.130] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x111f60c | out: lpNewFilePointer=0x0) returned 1 [0159.130] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.130] WriteFile (in: hFile=0x718, lpBuffer=0x111f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111f61c, lpOverlapped=0x0 | out: lpBuffer=0x111f83c*, lpNumberOfBytesWritten=0x111f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.130] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x1b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.130] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0159.130] CloseHandle (hObject=0x718) returned 1 [0159.130] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0159.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\water.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\water\\water.inf.play")) returned 1 [0159.132] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1578 os_tid = 0x182c [0158.436] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.436] ReadFile (in: hFile=0x724, lpBuffer=0xe30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe30f85c, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesRead=0xe30f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.438] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.440] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.440] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xe30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0158.440] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xe30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xe30f828, pbKeyObject=0x0) returned 0x0 [0158.440] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xe30f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xe30f500) returned 0x0 [0158.441] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.441] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xe30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xe30f500) returned 0x0 [0158.446] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.448] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.448] WriteFile (in: hFile=0x724, lpBuffer=0xe30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe30f830, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesWritten=0xe30f830*=0x428, lpOverlapped=0x0) returned 1 [0158.448] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.448] ReadFile (in: hFile=0x724, lpBuffer=0x2850000, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xe30f61c*=0x623, lpOverlapped=0x0) returned 1 [0158.449] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffff9dd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.449] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2850000, cbInput=0x623, pPaddingInfo=0x0, pbIV=0xe30f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xe30f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xe30f848, pbOutput=0x2850000, pcbResult=0xe30f618) returned 0x0 [0158.449] WriteFile (in: hFile=0x724, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xe30f61c*=0x630, lpOverlapped=0x0) returned 1 [0158.449] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe30f60c | out: lpNewFilePointer=0x0) returned 1 [0158.449] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.449] WriteFile (in: hFile=0x724, lpBuffer=0xe30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0xe30f83c*, lpNumberOfBytesWritten=0xe30f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.449] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.449] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0158.449] CloseHandle (hObject=0x724) returned 1 [0158.449] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0158.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\preview.gif.play")) returned 1 [0158.459] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1579 os_tid = 0x1830 [0158.462] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.462] ReadFile (in: hFile=0xa48, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.591] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.591] ReadFile (in: hFile=0xa48, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.806] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0158.808] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0158.808] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xe44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0158.808] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xe44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xe44f828, pbKeyObject=0x0) returned 0x0 [0158.808] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0xe44f500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0xe44f500) returned 0x0 [0158.808] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0158.808] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0xe44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0xe44f500) returned 0x0 [0158.815] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.817] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.817] WriteFile (in: hFile=0xa48, lpBuffer=0xe44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe44f830, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesWritten=0xe44f830*=0x428, lpOverlapped=0x0) returned 1 [0158.842] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.842] ReadFile (in: hFile=0xa48, lpBuffer=0x2950000, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xe44f61c*=0x75da, lpOverlapped=0x0) returned 1 [0158.886] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xffff8a26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.886] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2950000, cbInput=0x75da, pPaddingInfo=0x0, pbIV=0xe44f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xe44f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xe44f848, pbOutput=0x2950000, pcbResult=0xe44f618) returned 0x0 [0158.886] WriteFile (in: hFile=0xa48, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xe44f61c*=0x75e0, lpOverlapped=0x0) returned 1 [0158.887] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe44f60c | out: lpNewFilePointer=0x0) returned 1 [0158.887] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.887] WriteFile (in: hFile=0xa48, lpBuffer=0xe44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0xe44f83c*, lpNumberOfBytesWritten=0xe44f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.887] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x75e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.887] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0158.887] CloseHandle (hObject=0xa48) returned 1 [0158.887] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0158.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\thmbnail.png.play")) returned 1 [0158.890] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1580 os_tid = 0x1834 [0158.561] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.561] ReadFile (in: hFile=0xb3c, lpBuffer=0xe58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe58f85c, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesRead=0xe58f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.787] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.788] ReadFile (in: hFile=0xb3c, lpBuffer=0xe58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe58f85c, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesRead=0xe58f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.788] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0158.789] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0158.789] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xe58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0158.789] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xe58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xe58f828, pbKeyObject=0x0) returned 0x0 [0158.789] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0xe58f500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0xe58f500) returned 0x0 [0158.789] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0158.790] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0xe58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0xe58f500) returned 0x0 [0158.793] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.795] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.795] WriteFile (in: hFile=0xb3c, lpBuffer=0xe58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe58f830, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesWritten=0xe58f830*=0x428, lpOverlapped=0x0) returned 1 [0158.904] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.904] ReadFile (in: hFile=0xb3c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xe58f61c*=0xbfc6, lpOverlapped=0x0) returned 1 [0159.009] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xffff403a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.009] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2a50000, cbInput=0xbfc6, pPaddingInfo=0x0, pbIV=0xe58f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xe58f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xe58f848, pbOutput=0x2a50000, pcbResult=0xe58f618) returned 0x0 [0159.009] WriteFile (in: hFile=0xb3c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xe58f61c*=0xbfd0, lpOverlapped=0x0) returned 1 [0159.009] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe58f60c | out: lpNewFilePointer=0x0) returned 1 [0159.009] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.009] WriteFile (in: hFile=0xb3c, lpBuffer=0xe58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0xe58f83c*, lpNumberOfBytesWritten=0xe58f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.009] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0xbfd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.009] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0159.009] CloseHandle (hObject=0xb3c) returned 1 [0159.010] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0159.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\watermar.elm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\watermar.elm.play")) returned 1 [0159.012] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1581 os_tid = 0x1838 [0158.563] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.564] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.564] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xe6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0158.564] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xe6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xe6cf828, pbKeyObject=0x0) returned 0x0 [0158.564] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xe6cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xe6cf500) returned 0x0 [0158.564] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.565] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xe6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xe6cf500) returned 0x0 [0158.568] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.569] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.569] WriteFile (in: hFile=0xb4c, lpBuffer=0xe6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe6cf830, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesWritten=0xe6cf830*=0x428, lpOverlapped=0x0) returned 1 [0158.667] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.667] ReadFile (in: hFile=0xb4c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xe6cf61c*=0x2ab, lpOverlapped=0x0) returned 1 [0158.667] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffd55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.667] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2b50000, cbInput=0x2ab, pPaddingInfo=0x0, pbIV=0xe6cf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xe6cf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xe6cf848, pbOutput=0x2b50000, pcbResult=0xe6cf618) returned 0x0 [0158.667] WriteFile (in: hFile=0xb4c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xe6cf61c*=0x2b0, lpOverlapped=0x0) returned 1 [0158.667] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe6cf60c | out: lpNewFilePointer=0x0) returned 1 [0158.667] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.667] WriteFile (in: hFile=0xb4c, lpBuffer=0xe6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xe6cf83c*, lpNumberOfBytesWritten=0xe6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0158.668] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x2b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.668] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0158.668] CloseHandle (hObject=0xb4c) returned 1 [0158.668] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0158.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\watermar.inf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\themes16\\watermar\\watermar.inf.play")) returned 1 [0158.865] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1582 os_tid = 0x183c [0158.573] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.573] ReadFile (in: hFile=0xb5c, lpBuffer=0xe94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe94f85c, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesRead=0xe94f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.574] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.574] ReadFile (in: hFile=0xb5c, lpBuffer=0xe94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe94f85c, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesRead=0xe94f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.574] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.576] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.576] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xe94f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0158.576] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xe94f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xe94f828, pbKeyObject=0x0) returned 0x0 [0158.576] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xe94f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xe94f500) returned 0x0 [0158.576] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.576] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xe94f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xe94f500) returned 0x0 [0158.580] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.583] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.583] WriteFile (in: hFile=0xb5c, lpBuffer=0xe94fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe94f830, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesWritten=0xe94f830*=0x428, lpOverlapped=0x0) returned 1 [0158.584] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.584] ReadFile (in: hFile=0xb5c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xe94f61c*=0xeed1e, lpOverlapped=0x0) returned 1 [0158.853] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xfff112e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.853] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2c50000, cbInput=0xeed1e, pPaddingInfo=0x0, pbIV=0xe94f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xe94f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xe94f848, pbOutput=0x2c50000, pcbResult=0xe94f618) returned 0x0 [0158.854] WriteFile (in: hFile=0xb5c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xe94f61c*=0xeed20, lpOverlapped=0x0) returned 1 [0158.857] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe94f60c | out: lpNewFilePointer=0x0) returned 1 [0158.857] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.857] WriteFile (in: hFile=0xb5c, lpBuffer=0xe94f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0xe94f83c*, lpNumberOfBytesWritten=0xe94f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.858] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xeed20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.858] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0158.858] CloseHandle (hObject=0xb5c) returned 1 [0158.858] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0xebd0000 [0158.860] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.play")) returned 1 [0158.861] VirtualFree (lpAddress=0xebd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1583 os_tid = 0x1840 [0158.592] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.592] ReadFile (in: hFile=0xcfc, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.806] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.806] ReadFile (in: hFile=0xcfc, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.869] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.870] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.871] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0158.871] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0158.871] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xea8f500) returned 0x0 [0158.871] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.871] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xea8f500) returned 0x0 [0158.877] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.879] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.879] WriteFile (in: hFile=0xcfc, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0158.880] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.880] ReadFile (in: hFile=0xcfc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xea8f61c*=0xe64da, lpOverlapped=0x0) returned 1 [0159.035] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfff19b26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.035] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2d50000, cbInput=0xe64da, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xea8f848, pbOutput=0x2d50000, pcbResult=0xea8f618) returned 0x0 [0159.036] WriteFile (in: hFile=0xcfc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xea8f61c*=0xe64e0, lpOverlapped=0x0) returned 1 [0159.038] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0159.038] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.039] WriteFile (in: hFile=0xcfc, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.039] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xe64e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.039] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0159.039] CloseHandle (hObject=0xcfc) returned 1 [0159.039] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0159.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.play")) returned 1 [0159.041] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1584 os_tid = 0x1844 [0158.593] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.594] ReadFile (in: hFile=0xcbc, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.797] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.797] ReadFile (in: hFile=0xcbc, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.798] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0158.799] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0158.799] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0158.799] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0158.799] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0xebcf500) returned 0x0 [0158.799] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0158.799] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0xebcf500) returned 0x0 [0158.803] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.805] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.805] WriteFile (in: hFile=0xcbc, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0158.896] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.896] ReadFile (in: hFile=0xcbc, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x118d8, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xebcf61c*=0x118d8, lpOverlapped=0x0) returned 1 [0159.024] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffee728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.024] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2e50000, cbInput=0x118d8, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xebcf848, pbOutput=0x2e50000, pcbResult=0xebcf618) returned 0x0 [0159.024] WriteFile (in: hFile=0xcbc, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x118e0, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xebcf61c*=0x118e0, lpOverlapped=0x0) returned 1 [0159.025] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0159.025] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.025] WriteFile (in: hFile=0xcbc, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0159.025] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x118e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.025] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0159.025] CloseHandle (hObject=0xcbc) returned 1 [0159.025] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0159.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.play")) returned 1 [0159.027] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1585 os_tid = 0x1848 [0158.595] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.595] ReadFile (in: hFile=0xb8c, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.597] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.597] ReadFile (in: hFile=0xb8c, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.597] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.599] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0158.599] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0158.599] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xed0f500) returned 0x0 [0158.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.599] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xed0f500) returned 0x0 [0158.603] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.604] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.604] WriteFile (in: hFile=0xb8c, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0158.605] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.605] ReadFile (in: hFile=0xb8c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xed0f61c*=0xff7f2, lpOverlapped=0x0) returned 1 [0158.786] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfff0080e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.786] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2f50000, cbInput=0xff7f2, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xed0f848, pbOutput=0x2f50000, pcbResult=0xed0f618) returned 0x0 [0158.787] WriteFile (in: hFile=0xb8c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xed0f61c*=0xff800, lpOverlapped=0x0) returned 1 [0158.845] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0158.845] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.845] WriteFile (in: hFile=0xb8c, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0158.845] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xff800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.845] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0158.845] CloseHandle (hObject=0xb8c) returned 1 [0158.845] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0158.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.play")) returned 1 [0158.848] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1586 os_tid = 0x184c [0158.904] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.905] ReadFile (in: hFile=0xd14, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.014] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.014] ReadFile (in: hFile=0xd14, lpBuffer=0xee4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xee4f85c, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesRead=0xee4f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.014] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0159.015] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0159.015] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xee4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0159.015] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xee4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xee4f828, pbKeyObject=0x0) returned 0x0 [0159.015] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xee4f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xee4f500) returned 0x0 [0159.016] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0159.016] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xee4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xee4f500) returned 0x0 [0159.019] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.021] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.021] WriteFile (in: hFile=0xd14, lpBuffer=0xee4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xee4f830, lpOverlapped=0x0 | out: lpBuffer=0xee4fb34*, lpNumberOfBytesWritten=0xee4f830*=0x428, lpOverlapped=0x0) returned 1 [0159.021] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.021] ReadFile (in: hFile=0xd14, lpBuffer=0x3050000, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xee4f61c*=0xa5c00, lpOverlapped=0x0) returned 1 [0159.290] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfff5a400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.290] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3050000, cbInput=0xa5c00, pPaddingInfo=0x0, pbIV=0xee4f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xee4f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xee4f848, pbOutput=0x3050000, pcbResult=0xee4f618) returned 0x0 [0159.291] WriteFile (in: hFile=0xd14, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0xa5c10, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xee4f61c*=0xa5c10, lpOverlapped=0x0) returned 1 [0159.294] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xee4f60c | out: lpNewFilePointer=0x0) returned 1 [0159.294] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.294] WriteFile (in: hFile=0xd14, lpBuffer=0xee4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee4f61c, lpOverlapped=0x0 | out: lpBuffer=0xee4f83c*, lpNumberOfBytesWritten=0xee4f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.294] SetFilePointerEx (in: hFile=0xd14, liDistanceToMove=0xa5c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.294] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0159.294] CloseHandle (hObject=0xd14) returned 1 [0159.294] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.play")) returned 1 [0159.441] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1587 os_tid = 0x1850 [0158.906] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.906] ReadFile (in: hFile=0xd34, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.000] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.000] ReadFile (in: hFile=0xd34, lpBuffer=0xef8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xef8f85c, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesRead=0xef8f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.000] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0159.001] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0159.001] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xef8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0159.001] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xef8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xef8f828, pbKeyObject=0x0) returned 0x0 [0159.001] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xef8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xef8f500) returned 0x0 [0159.002] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0159.002] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xef8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xef8f500) returned 0x0 [0159.006] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.007] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.008] WriteFile (in: hFile=0xd34, lpBuffer=0xef8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xef8f830, lpOverlapped=0x0 | out: lpBuffer=0xef8fb34*, lpNumberOfBytesWritten=0xef8f830*=0x428, lpOverlapped=0x0) returned 1 [0159.008] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.008] ReadFile (in: hFile=0xd34, lpBuffer=0x3150000, nNumberOfBytesToRead=0x118d8, lpNumberOfBytesRead=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xef8f61c*=0x118d8, lpOverlapped=0x0) returned 1 [0159.156] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffee728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.156] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3150000, cbInput=0x118d8, pPaddingInfo=0x0, pbIV=0xef8f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xef8f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xef8f848, pbOutput=0x3150000, pcbResult=0xef8f618) returned 0x0 [0159.157] WriteFile (in: hFile=0xd34, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x118e0, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xef8f61c*=0x118e0, lpOverlapped=0x0) returned 1 [0159.157] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xef8f60c | out: lpNewFilePointer=0x0) returned 1 [0159.157] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.157] WriteFile (in: hFile=0xd34, lpBuffer=0xef8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xef8f61c, lpOverlapped=0x0 | out: lpBuffer=0xef8f83c*, lpNumberOfBytesWritten=0xef8f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.157] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x118e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.157] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0159.157] CloseHandle (hObject=0xd34) returned 1 [0159.157] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.play")) returned 1 [0159.161] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1588 os_tid = 0x1854 [0158.907] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.907] ReadFile (in: hFile=0xd54, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.986] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.987] ReadFile (in: hFile=0xd54, lpBuffer=0xf0cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf0cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesRead=0xf0cf85c*=0x428, lpOverlapped=0x0) returned 1 [0158.987] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.988] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.989] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0xf0cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0158.989] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0xf0cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0xf0cf828, pbKeyObject=0x0) returned 0x0 [0158.989] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xf0cf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xf0cf500) returned 0x0 [0158.989] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.989] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xf0cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xf0cf500) returned 0x0 [0158.994] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.996] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.996] WriteFile (in: hFile=0xd54, lpBuffer=0xf0cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf0cf830, lpOverlapped=0x0 | out: lpBuffer=0xf0cfb34*, lpNumberOfBytesWritten=0xf0cf830*=0x428, lpOverlapped=0x0) returned 1 [0158.997] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.997] ReadFile (in: hFile=0xd54, lpBuffer=0x3250000, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0xf0cf61c*=0xcd2ac, lpOverlapped=0x0) returned 1 [0159.148] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfff32d54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.148] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x3250000, cbInput=0xcd2ac, pPaddingInfo=0x0, pbIV=0xf0cf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0xf0cf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0xf0cf848, pbOutput=0x3250000, pcbResult=0xf0cf618) returned 0x0 [0159.149] WriteFile (in: hFile=0xd54, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0xf0cf61c*=0xcd2b0, lpOverlapped=0x0) returned 1 [0159.151] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0cf60c | out: lpNewFilePointer=0x0) returned 1 [0159.151] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.151] WriteFile (in: hFile=0xd54, lpBuffer=0xf0cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf0cf83c*, lpNumberOfBytesWritten=0xf0cf61c*=0x8, lpOverlapped=0x0) returned 1 [0159.151] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xcd2b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.151] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0159.151] CloseHandle (hObject=0xd54) returned 1 [0159.151] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.play")) returned 1 [0159.154] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1589 os_tid = 0x1858 [0158.908] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.908] ReadFile (in: hFile=0xd74, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.971] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.971] ReadFile (in: hFile=0xd74, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0158.971] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0158.973] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0158.973] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0158.973] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0158.973] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xf34f500) returned 0x0 [0158.974] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0158.974] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xf34f500) returned 0x0 [0158.980] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.982] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.982] WriteFile (in: hFile=0xd74, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0158.983] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.983] ReadFile (in: hFile=0xd74, lpBuffer=0x3350000, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xf34f61c*=0x96a00, lpOverlapped=0x0) returned 1 [0159.047] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfff69600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.047] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3350000, cbInput=0x96a00, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0xf34f848, pbOutput=0x3350000, pcbResult=0xf34f618) returned 0x0 [0159.048] WriteFile (in: hFile=0xd74, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x96a10, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xf34f61c*=0x96a10, lpOverlapped=0x0) returned 1 [0159.050] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0159.050] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.050] WriteFile (in: hFile=0xd74, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.050] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x96a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.050] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0159.050] CloseHandle (hObject=0xd74) returned 1 [0159.050] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0159.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.play")) returned 1 [0159.052] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1590 os_tid = 0x185c [0158.915] GetLastError () returned 0x57 [0158.915] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7710e0 [0158.916] SetLastError (dwErrCode=0x57) [0158.916] IcmpCreateFile () returned 0x7747d0 [0158.916] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784378 [0158.916] IcmpSendEcho2 (IcmpHandle=0x7747d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4100a8c0, RequestData=0xe08ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784378, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1591 os_tid = 0x1860 [0158.918] GetLastError () returned 0x57 [0158.918] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771468 [0158.918] SetLastError (dwErrCode=0x57) [0158.918] IcmpCreateFile () returned 0x774808 [0158.918] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7843c8 [0158.918] IcmpSendEcho2 (IcmpHandle=0x774808, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4200a8c0, RequestData=0xf48ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7843c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1592 os_tid = 0x1864 [0158.919] GetLastError () returned 0x57 [0158.919] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7717f0 [0158.919] SetLastError (dwErrCode=0x57) [0158.919] IcmpCreateFile () returned 0x774840 [0158.919] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784418 [0158.919] IcmpSendEcho2 (IcmpHandle=0x774840, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4300a8c0, RequestData=0xfe4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784418, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1593 os_tid = 0x1868 [0158.920] GetLastError () returned 0x57 [0158.920] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x771b78 [0158.920] SetLastError (dwErrCode=0x57) [0158.920] IcmpCreateFile () returned 0x774878 [0158.920] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783f18 [0158.920] IcmpSendEcho2 (IcmpHandle=0x774878, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4400a8c0, RequestData=0x100cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783f18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1594 os_tid = 0x186c [0158.923] GetLastError () returned 0x57 [0158.923] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x772288 [0158.923] SetLastError (dwErrCode=0x57) [0158.923] IcmpCreateFile () returned 0x7748b0 [0158.923] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783f68 [0158.923] IcmpSendEcho2 (IcmpHandle=0x7748b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4500a8c0, RequestData=0x1034ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783f68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1595 os_tid = 0x1870 [0158.924] GetLastError () returned 0x57 [0158.924] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76ea08 [0158.924] SetLastError (dwErrCode=0x57) [0158.924] IcmpCreateFile () returned 0x7748e8 [0158.924] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784468 [0158.924] IcmpSendEcho2 (IcmpHandle=0x7748e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4600a8c0, RequestData=0x1048ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784468, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1596 os_tid = 0x1874 [0158.925] GetLastError () returned 0x57 [0158.925] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76ed90 [0158.925] SetLastError (dwErrCode=0x57) [0158.925] IcmpCreateFile () returned 0x774958 [0158.925] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7844b8 [0158.925] IcmpSendEcho2 (IcmpHandle=0x774958, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4700a8c0, RequestData=0x1070ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7844b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1597 os_tid = 0x1878 [0158.926] GetLastError () returned 0x57 [0158.926] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76f118 [0158.927] SetLastError (dwErrCode=0x57) [0158.927] IcmpCreateFile () returned 0x774990 [0158.927] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784508 [0158.927] IcmpSendEcho2 (IcmpHandle=0x774990, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4800a8c0, RequestData=0x1084ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784508, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1598 os_tid = 0x187c [0158.928] GetLastError () returned 0x57 [0158.928] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76f4a0 [0158.928] SetLastError (dwErrCode=0x57) [0158.928] IcmpCreateFile () returned 0x774a00 [0158.928] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784558 [0158.928] IcmpSendEcho2 (IcmpHandle=0x774a00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4900a8c0, RequestData=0x10c0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784558, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1599 os_tid = 0x1880 [0158.929] GetLastError () returned 0x57 [0158.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x76f828 [0158.929] SetLastError (dwErrCode=0x57) [0158.929] IcmpCreateFile () returned 0x774338 [0158.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7845a8 [0158.929] IcmpSendEcho2 (IcmpHandle=0x774338, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4a00a8c0, RequestData=0x10d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7845a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1600 os_tid = 0x1884 [0158.930] GetLastError () returned 0x57 [0158.930] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773ec8 [0158.930] SetLastError (dwErrCode=0x57) [0158.930] IcmpCreateFile () returned 0x7743e0 [0158.930] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7845f8 [0158.930] IcmpSendEcho2 (IcmpHandle=0x7743e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4b00a8c0, RequestData=0x10e8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7845f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1601 os_tid = 0x1888 [0158.931] GetLastError () returned 0x57 [0158.931] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773430 [0158.931] SetLastError (dwErrCode=0x57) [0158.931] IcmpCreateFile () returned 0x774418 [0158.931] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784648 [0158.931] IcmpSendEcho2 (IcmpHandle=0x774418, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4c00a8c0, RequestData=0x10fcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784648, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1602 os_tid = 0x188c [0158.932] GetLastError () returned 0x57 [0158.932] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7737b8 [0158.932] SetLastError (dwErrCode=0x57) [0158.933] IcmpCreateFile () returned 0x774450 [0158.933] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784698 [0158.933] IcmpSendEcho2 (IcmpHandle=0x774450, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4d00a8c0, RequestData=0x1110ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784698, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1603 os_tid = 0x1890 [0158.935] GetLastError () returned 0x57 [0158.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x773b40 [0158.935] SetLastError (dwErrCode=0x57) [0158.935] IcmpCreateFile () returned 0x774488 [0158.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783ce8 [0158.935] IcmpSendEcho2 (IcmpHandle=0x774488, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4e00a8c0, RequestData=0x1124ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783ce8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1604 os_tid = 0x1894 [0158.936] GetLastError () returned 0x57 [0158.936] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edbc0 [0158.936] SetLastError (dwErrCode=0x57) [0158.936] IcmpCreateFile () returned 0x774a70 [0158.936] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783d38 [0158.936] IcmpSendEcho2 (IcmpHandle=0x774a70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4f00a8c0, RequestData=0x1138ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783d38, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1605 os_tid = 0x1898 [0158.937] GetLastError () returned 0x57 [0158.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6edf48 [0158.937] SetLastError (dwErrCode=0x57) [0158.937] IcmpCreateFile () returned 0x774aa8 [0158.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783fb8 [0158.937] IcmpSendEcho2 (IcmpHandle=0x774aa8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5000a8c0, RequestData=0x114cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783fb8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1606 os_tid = 0x189c [0158.938] GetLastError () returned 0x57 [0158.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee2d0 [0158.938] SetLastError (dwErrCode=0x57) [0158.939] IcmpCreateFile () returned 0x774a38 [0158.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783d88 [0158.939] IcmpSendEcho2 (IcmpHandle=0x774a38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5100a8c0, RequestData=0x1160ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783d88, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1607 os_tid = 0x18a0 [0158.939] GetLastError () returned 0x57 [0158.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee658 [0158.940] SetLastError (dwErrCode=0x57) [0158.940] IcmpCreateFile () returned 0x74f3a0 [0158.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783dd8 [0158.940] IcmpSendEcho2 (IcmpHandle=0x74f3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5200a8c0, RequestData=0x1174ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783dd8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1608 os_tid = 0x18a4 [0158.942] GetLastError () returned 0x57 [0158.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ee9e0 [0158.942] SetLastError (dwErrCode=0x57) [0158.942] IcmpCreateFile () returned 0x74ed10 [0158.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x783e28 [0158.942] IcmpSendEcho2 (IcmpHandle=0x74ed10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5300a8c0, RequestData=0x1b2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x783e28, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1609 os_tid = 0x18a8 [0158.943] GetLastError () returned 0x57 [0158.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eed68 [0158.943] SetLastError (dwErrCode=0x57) [0158.943] IcmpCreateFile () returned 0x74ed48 [0158.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784008 [0158.943] IcmpSendEcho2 (IcmpHandle=0x74ed48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5400a8c0, RequestData=0x1b43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784008, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1610 os_tid = 0x18ac [0158.944] GetLastError () returned 0x57 [0158.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dbd10 [0158.945] SetLastError (dwErrCode=0x57) [0158.945] IcmpCreateFile () returned 0x74ecd8 [0158.945] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7840f8 [0158.945] IcmpSendEcho2 (IcmpHandle=0x74ecd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5500a8c0, RequestData=0x1b57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7840f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1611 os_tid = 0x18b0 [0158.946] GetLastError () returned 0x57 [0158.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dab68 [0158.946] SetLastError (dwErrCode=0x57) [0158.946] IcmpCreateFile () returned 0x74ed80 [0158.946] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784058 [0158.946] IcmpSendEcho2 (IcmpHandle=0x74ed80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5600a8c0, RequestData=0x1b6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784058, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1612 os_tid = 0x18b4 [0158.948] GetLastError () returned 0x57 [0158.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7daef0 [0158.948] SetLastError (dwErrCode=0x57) [0158.948] IcmpCreateFile () returned 0x74edb8 [0158.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7840a8 [0158.948] IcmpSendEcho2 (IcmpHandle=0x74edb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5700a8c0, RequestData=0x1b7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7840a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1613 os_tid = 0x18b8 [0158.949] GetLastError () returned 0x57 [0158.949] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db278 [0158.949] SetLastError (dwErrCode=0x57) [0158.950] IcmpCreateFile () returned 0x7dd048 [0158.950] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7841e8 [0158.950] IcmpSendEcho2 (IcmpHandle=0x7dd048, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5800a8c0, RequestData=0x1b93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7841e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1614 os_tid = 0x18bc [0158.951] GetLastError () returned 0x57 [0158.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db600 [0158.952] SetLastError (dwErrCode=0x57) [0158.952] IcmpCreateFile () returned 0x7dd198 [0158.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784148 [0158.952] IcmpSendEcho2 (IcmpHandle=0x7dd198, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5900a8c0, RequestData=0x1ba7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784148, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1615 os_tid = 0x18c0 [0158.954] GetLastError () returned 0x57 [0158.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7db988 [0158.954] SetLastError (dwErrCode=0x57) [0158.954] IcmpCreateFile () returned 0x7dd1d0 [0158.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784198 [0158.954] IcmpSendEcho2 (IcmpHandle=0x7dd1d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5a00a8c0, RequestData=0x1bbbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784198, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1616 os_tid = 0x18c4 [0158.956] GetLastError () returned 0x57 [0158.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d4f98 [0158.956] SetLastError (dwErrCode=0x57) [0158.956] IcmpCreateFile () returned 0x7dd208 [0158.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784b48 [0158.956] IcmpSendEcho2 (IcmpHandle=0x7dd208, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5b00a8c0, RequestData=0x1bcfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784b48, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1617 os_tid = 0x18c8 [0158.957] GetLastError () returned 0x57 [0158.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5320 [0158.958] SetLastError (dwErrCode=0x57) [0158.958] IcmpCreateFile () returned 0x7dd240 [0158.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784b98 [0158.958] IcmpSendEcho2 (IcmpHandle=0x7dd240, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5c00a8c0, RequestData=0x1be3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784b98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1618 os_tid = 0x18cc [0158.959] GetLastError () returned 0x57 [0158.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d56a8 [0158.959] SetLastError (dwErrCode=0x57) [0158.959] IcmpCreateFile () returned 0x7dd278 [0158.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784be8 [0158.959] IcmpSendEcho2 (IcmpHandle=0x7dd278, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5d00a8c0, RequestData=0x1bf7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784be8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1619 os_tid = 0x18d0 [0158.961] GetLastError () returned 0x57 [0158.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5a30 [0158.961] SetLastError (dwErrCode=0x57) [0158.961] IcmpCreateFile () returned 0x7dd2b0 [0158.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784c38 [0158.961] IcmpSendEcho2 (IcmpHandle=0x7dd2b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5e00a8c0, RequestData=0x1c0bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784c38, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1620 os_tid = 0x18d4 [0158.962] GetLastError () returned 0x57 [0158.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d5db8 [0158.963] SetLastError (dwErrCode=0x57) [0158.963] IcmpCreateFile () returned 0x7dd2e8 [0158.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7846e8 [0158.963] IcmpSendEcho2 (IcmpHandle=0x7dd2e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5f00a8c0, RequestData=0x1c1fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7846e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1621 os_tid = 0x18d8 [0158.964] GetLastError () returned 0x57 [0158.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6140 [0158.964] SetLastError (dwErrCode=0x57) [0158.964] IcmpCreateFile () returned 0x7dd320 [0158.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784738 [0158.964] IcmpSendEcho2 (IcmpHandle=0x7dd320, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6000a8c0, RequestData=0x1c33ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784738, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1622 os_tid = 0x18dc [0158.966] GetLastError () returned 0x57 [0158.966] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d64c8 [0158.966] SetLastError (dwErrCode=0x57) [0158.966] IcmpCreateFile () returned 0x7dd358 [0158.966] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784788 [0158.966] IcmpSendEcho2 (IcmpHandle=0x7dd358, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6100a8c0, RequestData=0x1c47ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784788, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1623 os_tid = 0x18e0 [0158.968] GetLastError () returned 0x57 [0158.968] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da7e0 [0158.968] SetLastError (dwErrCode=0x57) [0158.968] IcmpCreateFile () returned 0x7dd080 [0158.968] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784aa8 [0158.968] IcmpSendEcho2 (IcmpHandle=0x7dd080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6200a8c0, RequestData=0x1c5bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784aa8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1624 os_tid = 0x18e4 [0158.969] GetLastError () returned 0x57 [0158.969] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6850 [0158.969] SetLastError (dwErrCode=0x57) [0158.969] IcmpCreateFile () returned 0x7dd390 [0158.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7847d8 [0158.970] IcmpSendEcho2 (IcmpHandle=0x7dd390, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6300a8c0, RequestData=0x1c6fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7847d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1625 os_tid = 0x18e8 [0159.082] GetLastError () returned 0x57 [0159.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6bd8 [0159.082] SetLastError (dwErrCode=0x57) [0159.082] IcmpCreateFile () returned 0x7dcfa0 [0159.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784828 [0159.082] IcmpSendEcho2 (IcmpHandle=0x7dcfa0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6400a8c0, RequestData=0x1c83ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784828, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1626 os_tid = 0x18ec [0159.083] GetLastError () returned 0x57 [0159.083] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d6f60 [0159.084] SetLastError (dwErrCode=0x57) [0159.084] IcmpCreateFile () returned 0x7dcfd8 [0159.084] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784878 [0159.084] IcmpSendEcho2 (IcmpHandle=0x7dcfd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6500a8c0, RequestData=0x1c97ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784878, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1627 os_tid = 0x18f0 [0159.085] GetLastError () returned 0x57 [0159.085] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d72e8 [0159.086] SetLastError (dwErrCode=0x57) [0159.086] IcmpCreateFile () returned 0x7dd010 [0159.086] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7848c8 [0159.086] IcmpSendEcho2 (IcmpHandle=0x7dd010, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6600a8c0, RequestData=0x1cabff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7848c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1628 os_tid = 0x18f4 [0159.087] GetLastError () returned 0x57 [0159.087] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7670 [0159.087] SetLastError (dwErrCode=0x57) [0159.087] IcmpCreateFile () returned 0x7dd0b8 [0159.087] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784918 [0159.087] IcmpSendEcho2 (IcmpHandle=0x7dd0b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6700a8c0, RequestData=0x1cbfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784918, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1629 os_tid = 0x18f8 [0159.088] GetLastError () returned 0x57 [0159.088] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d79f8 [0159.088] SetLastError (dwErrCode=0x57) [0159.088] IcmpCreateFile () returned 0x7dd0f0 [0159.088] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784968 [0159.088] IcmpSendEcho2 (IcmpHandle=0x7dd0f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6800a8c0, RequestData=0x1cd3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784968, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1630 os_tid = 0x18fc [0159.089] GetLastError () returned 0x57 [0159.089] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d7d80 [0159.089] SetLastError (dwErrCode=0x57) [0159.089] IcmpCreateFile () returned 0x7dd128 [0159.089] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7849b8 [0159.089] IcmpSendEcho2 (IcmpHandle=0x7dd128, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6900a8c0, RequestData=0x1ce7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7849b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1631 os_tid = 0x1900 [0159.090] GetLastError () returned 0x57 [0159.090] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8108 [0159.091] SetLastError (dwErrCode=0x57) [0159.091] IcmpCreateFile () returned 0x7dd160 [0159.091] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784a08 [0159.091] IcmpSendEcho2 (IcmpHandle=0x7dd160, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6a00a8c0, RequestData=0x1cfbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784a08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1632 os_tid = 0x1904 [0159.092] GetLastError () returned 0x57 [0159.092] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8490 [0159.092] SetLastError (dwErrCode=0x57) [0159.092] IcmpCreateFile () returned 0x7dd3c8 [0159.092] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784a58 [0159.092] IcmpSendEcho2 (IcmpHandle=0x7dd3c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6b00a8c0, RequestData=0x1d0fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784a58, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1633 os_tid = 0x1908 [0159.093] GetLastError () returned 0x57 [0159.093] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8818 [0159.093] SetLastError (dwErrCode=0x57) [0159.094] IcmpCreateFile () returned 0x7dd400 [0159.094] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x784af8 [0159.094] IcmpSendEcho2 (IcmpHandle=0x7dd400, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6c00a8c0, RequestData=0x1d23ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x784af8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1634 os_tid = 0x190c [0159.094] GetLastError () returned 0x57 [0159.095] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8ba0 [0159.095] SetLastError (dwErrCode=0x57) [0159.095] IcmpCreateFile () returned 0x7dd438 [0159.095] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dbf8 [0159.095] IcmpSendEcho2 (IcmpHandle=0x7dd438, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6d00a8c0, RequestData=0x1d37ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dbf8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1635 os_tid = 0x1910 [0159.096] GetLastError () returned 0x57 [0159.096] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d8f28 [0159.096] SetLastError (dwErrCode=0x57) [0159.096] IcmpCreateFile () returned 0x7dd470 [0159.096] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dc98 [0159.096] IcmpSendEcho2 (IcmpHandle=0x7dd470, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6e00a8c0, RequestData=0x1d4bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dc98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1636 os_tid = 0x1914 [0159.098] GetLastError () returned 0x57 [0159.098] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d92b0 [0159.098] SetLastError (dwErrCode=0x57) [0159.098] IcmpCreateFile () returned 0x7dd4a8 [0159.098] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dce8 [0159.098] IcmpSendEcho2 (IcmpHandle=0x7dd4a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6f00a8c0, RequestData=0x1d5fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dce8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1637 os_tid = 0x1918 [0159.099] GetLastError () returned 0x57 [0159.099] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d9638 [0159.100] SetLastError (dwErrCode=0x57) [0159.100] IcmpCreateFile () returned 0x7dd4e0 [0159.100] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dd38 [0159.100] IcmpSendEcho2 (IcmpHandle=0x7dd4e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7000a8c0, RequestData=0x1d73ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dd38, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1638 os_tid = 0x191c [0159.101] GetLastError () returned 0x57 [0159.101] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d99c0 [0159.101] SetLastError (dwErrCode=0x57) [0159.101] IcmpCreateFile () returned 0x7dd518 [0159.101] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73ddd8 [0159.101] IcmpSendEcho2 (IcmpHandle=0x7dd518, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7100a8c0, RequestData=0x1d87ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73ddd8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1639 os_tid = 0x1920 [0159.102] GetLastError () returned 0x57 [0159.102] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7d9d48 [0159.102] SetLastError (dwErrCode=0x57) [0159.102] IcmpCreateFile () returned 0x7dd550 [0159.102] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd78 [0159.102] IcmpSendEcho2 (IcmpHandle=0x7dd550, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7200a8c0, RequestData=0x1d9bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd78, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1640 os_tid = 0x1924 [0159.103] GetLastError () returned 0x57 [0159.103] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da0d0 [0159.104] SetLastError (dwErrCode=0x57) [0159.104] IcmpCreateFile () returned 0x7dd588 [0159.104] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7621a0 [0159.104] IcmpSendEcho2 (IcmpHandle=0x7dd588, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7300a8c0, RequestData=0x1dafff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7621a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1641 os_tid = 0x1928 [0159.107] GetLastError () returned 0x57 [0159.107] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7da458 [0159.107] SetLastError (dwErrCode=0x57) [0159.107] IcmpCreateFile () returned 0x7dd5c0 [0159.107] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761f20 [0159.107] IcmpSendEcho2 (IcmpHandle=0x7dd5c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7400a8c0, RequestData=0x1dc3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761f20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1642 os_tid = 0x192c [0159.108] GetLastError () returned 0x57 [0159.108] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc098 [0159.109] SetLastError (dwErrCode=0x57) [0159.109] IcmpCreateFile () returned 0x7dd5f8 [0159.109] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762380 [0159.109] IcmpSendEcho2 (IcmpHandle=0x7dd5f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7500a8c0, RequestData=0x1dd7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762380, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1643 os_tid = 0x1930 [0159.110] GetLastError () returned 0x57 [0159.110] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc420 [0159.110] SetLastError (dwErrCode=0x57) [0159.110] IcmpCreateFile () returned 0x7dd630 [0159.110] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7623d0 [0159.110] IcmpSendEcho2 (IcmpHandle=0x7dd630, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7600a8c0, RequestData=0x1debff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7623d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1644 os_tid = 0x1934 [0159.111] GetLastError () returned 0x57 [0159.111] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dc7a8 [0159.111] SetLastError (dwErrCode=0x57) [0159.111] IcmpCreateFile () returned 0x7dd668 [0159.111] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761a20 [0159.111] IcmpSendEcho2 (IcmpHandle=0x7dd668, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7700a8c0, RequestData=0x1dffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761a20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1645 os_tid = 0x1938 [0159.112] GetLastError () returned 0x57 [0159.112] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7dcb30 [0159.112] SetLastError (dwErrCode=0x57) [0159.112] IcmpCreateFile () returned 0x7dd6d8 [0159.112] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761a70 [0159.112] IcmpSendEcho2 (IcmpHandle=0x7dd6d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7800a8c0, RequestData=0x1e13ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761a70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1646 os_tid = 0x193c [0159.114] GetLastError () returned 0x57 [0159.114] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4cf8 [0159.114] SetLastError (dwErrCode=0x57) [0159.114] IcmpCreateFile () returned 0x7dd6a0 [0159.114] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761b60 [0159.114] IcmpSendEcho2 (IcmpHandle=0x7dd6a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7900a8c0, RequestData=0x1e27ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761b60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1647 os_tid = 0x1940 [0159.115] GetLastError () returned 0x57 [0159.115] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5080 [0159.115] SetLastError (dwErrCode=0x57) [0159.115] IcmpCreateFile () returned 0x7dd710 [0159.115] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761bb0 [0159.115] IcmpSendEcho2 (IcmpHandle=0x7dd710, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7a00a8c0, RequestData=0x1e3bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761bb0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1648 os_tid = 0x1944 [0159.116] GetLastError () returned 0x57 [0159.116] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5408 [0159.117] SetLastError (dwErrCode=0x57) [0159.117] IcmpCreateFile () returned 0x1a6f2458 [0159.117] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761c00 [0159.117] IcmpSendEcho2 (IcmpHandle=0x1a6f2458, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7b00a8c0, RequestData=0x1e4fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761c00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1649 os_tid = 0x1948 [0159.118] GetLastError () returned 0x57 [0159.118] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5790 [0159.118] SetLastError (dwErrCode=0x57) [0159.118] IcmpCreateFile () returned 0x1a6f20d8 [0159.118] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762240 [0159.118] IcmpSendEcho2 (IcmpHandle=0x1a6f20d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7c00a8c0, RequestData=0x1e63ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762240, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1650 os_tid = 0x194c [0159.119] GetLastError () returned 0x57 [0159.119] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0658 [0159.119] SetLastError (dwErrCode=0x57) [0159.119] IcmpCreateFile () returned 0x1a6f2260 [0159.119] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7621f0 [0159.119] IcmpSendEcho2 (IcmpHandle=0x1a6f2260, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7d00a8c0, RequestData=0x1e77ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7621f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1651 os_tid = 0x1954 [0159.201] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.201] ReadFile (in: hFile=0x724, lpBuffer=0xe30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe30f85c, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesRead=0xe30f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.424] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.426] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.426] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0xe30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0159.426] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0xe30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0xe30f828, pbKeyObject=0x0) returned 0x0 [0159.426] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xe30f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xe30f500) returned 0x0 [0159.426] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.426] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xe30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xe30f500) returned 0x0 [0159.431] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.433] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.433] WriteFile (in: hFile=0x724, lpBuffer=0xe30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe30f830, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesWritten=0xe30f830*=0x428, lpOverlapped=0x0) returned 1 [0159.433] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.433] ReadFile (in: hFile=0x724, lpBuffer=0x3450000, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0xe30f61c*=0x600, lpOverlapped=0x0) returned 1 [0159.433] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffffa00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.434] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3450000, cbInput=0x600, pPaddingInfo=0x0, pbIV=0xe30f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0xe30f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xe30f848, pbOutput=0x3450000, pcbResult=0xe30f618) returned 0x0 [0159.434] WriteFile (in: hFile=0x724, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0xe30f61c*=0x610, lpOverlapped=0x0) returned 1 [0159.434] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe30f60c | out: lpNewFilePointer=0x0) returned 1 [0159.434] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.434] WriteFile (in: hFile=0x724, lpBuffer=0xe30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0xe30f83c*, lpNumberOfBytesWritten=0xe30f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.434] SetFilePointerEx (in: hFile=0x724, liDistanceToMove=0x610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.434] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0159.434] CloseHandle (hObject=0x724) returned 1 [0159.434] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0159.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\msb1cach.lex.play")) returned 1 [0159.437] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1652 os_tid = 0x1958 [0159.202] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.202] ReadFile (in: hFile=0xdf0, lpBuffer=0x1e9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1e9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1e9ffb34*, lpNumberOfBytesRead=0x1e9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0159.413] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.413] ReadFile (in: hFile=0xdf0, lpBuffer=0x1e9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1e9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x1e9ffb34*, lpNumberOfBytesRead=0x1e9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0159.413] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.415] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1e9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0159.415] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1e9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1e9ff828, pbKeyObject=0x0) returned 0x0 [0159.415] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1e9ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1e9ff500) returned 0x0 [0159.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.415] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1e9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1e9ff500) returned 0x0 [0159.420] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.422] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.423] WriteFile (in: hFile=0xdf0, lpBuffer=0x1e9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1e9ff830, lpOverlapped=0x0 | out: lpBuffer=0x1e9ffb34*, lpNumberOfBytesWritten=0x1e9ff830*=0x428, lpOverlapped=0x0) returned 1 [0159.423] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.423] ReadFile (in: hFile=0xdf0, lpBuffer=0x2850000, nNumberOfBytesToRead=0x238d8, lpNumberOfBytesRead=0x1e9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1e9ff61c*=0x238d8, lpOverlapped=0x0) returned 1 [0159.531] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0xfffdc728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.531] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2850000, cbInput=0x238d8, pPaddingInfo=0x0, pbIV=0x1e9ff848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1e9ff618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x1e9ff848, pbOutput=0x2850000, pcbResult=0x1e9ff618) returned 0x0 [0159.531] WriteFile (in: hFile=0xdf0, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x238e0, lpNumberOfBytesWritten=0x1e9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1e9ff61c*=0x238e0, lpOverlapped=0x0) returned 1 [0159.532] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e9ff60c | out: lpNewFilePointer=0x0) returned 1 [0159.532] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.532] WriteFile (in: hFile=0xdf0, lpBuffer=0x1e9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x1e9ff83c*, lpNumberOfBytesWritten=0x1e9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0159.532] SetFilePointerEx (in: hFile=0xdf0, liDistanceToMove=0x238e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.532] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0159.532] CloseHandle (hObject=0xdf0) returned 1 [0159.532] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\msb1core.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\msb1core.dll.play")) returned 1 [0159.535] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1653 os_tid = 0x195c [0159.206] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.206] ReadFile (in: hFile=0xdf8, lpBuffer=0x1eb3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1eb3f85c, lpOverlapped=0x0 | out: lpBuffer=0x1eb3fb34*, lpNumberOfBytesRead=0x1eb3f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.312] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.312] ReadFile (in: hFile=0xdf8, lpBuffer=0x1eb3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1eb3f85c, lpOverlapped=0x0 | out: lpBuffer=0x1eb3fb34*, lpNumberOfBytesRead=0x1eb3f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.312] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.314] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.314] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x1eb3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0159.314] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x1eb3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x1eb3f828, pbKeyObject=0x0) returned 0x0 [0159.314] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1eb3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1eb3f500) returned 0x0 [0159.314] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.314] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1eb3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1eb3f500) returned 0x0 [0159.319] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.321] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.321] WriteFile (in: hFile=0xdf8, lpBuffer=0x1eb3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1eb3f830, lpOverlapped=0x0 | out: lpBuffer=0x1eb3fb34*, lpNumberOfBytesWritten=0x1eb3f830*=0x428, lpOverlapped=0x0) returned 1 [0159.322] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.322] ReadFile (in: hFile=0xdf8, lpBuffer=0x3550000, nNumberOfBytesToRead=0xfed8, lpNumberOfBytesRead=0x1eb3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x1eb3f61c*=0xfed8, lpOverlapped=0x0) returned 1 [0159.453] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0xffff0128, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.453] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3550000, cbInput=0xfed8, pPaddingInfo=0x0, pbIV=0x1eb3f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x1eb3f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x1eb3f848, pbOutput=0x3550000, pcbResult=0x1eb3f618) returned 0x0 [0159.453] WriteFile (in: hFile=0xdf8, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x1eb3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x1eb3f61c*=0xfee0, lpOverlapped=0x0) returned 1 [0159.453] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eb3f60c | out: lpNewFilePointer=0x0) returned 1 [0159.453] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.453] WriteFile (in: hFile=0xdf8, lpBuffer=0x1eb3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1eb3f61c, lpOverlapped=0x0 | out: lpBuffer=0x1eb3f83c*, lpNumberOfBytesWritten=0x1eb3f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.453] SetFilePointerEx (in: hFile=0xdf8, liDistanceToMove=0xfee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.453] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0159.453] CloseHandle (hObject=0xdf8) returned 1 [0159.454] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\msb1xtor.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\translat\\msb1xtor.dll.play")) returned 1 [0159.475] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1654 os_tid = 0x1960 [0159.209] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.209] ReadFile (in: hFile=0xb4c, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.299] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.299] ReadFile (in: hFile=0xb4c, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.299] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.300] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.301] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xe44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0159.301] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xe44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xe44f828, pbKeyObject=0x0) returned 0x0 [0159.301] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xe44f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xe44f500) returned 0x0 [0159.301] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.301] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xe44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xe44f500) returned 0x0 [0159.306] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.308] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.308] WriteFile (in: hFile=0xb4c, lpBuffer=0xe44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe44f830, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesWritten=0xe44f830*=0x428, lpOverlapped=0x0) returned 1 [0159.309] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.309] ReadFile (in: hFile=0xb4c, lpBuffer=0x2950000, nNumberOfBytesToRead=0xba88, lpNumberOfBytesRead=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xe44f61c*=0xba88, lpOverlapped=0x0) returned 1 [0159.444] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xffff4578, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.444] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2950000, cbInput=0xba88, pPaddingInfo=0x0, pbIV=0xe44f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xe44f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xe44f848, pbOutput=0x2950000, pcbResult=0xe44f618) returned 0x0 [0159.444] WriteFile (in: hFile=0xb4c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0xba90, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xe44f61c*=0xba90, lpOverlapped=0x0) returned 1 [0159.444] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe44f60c | out: lpNewFilePointer=0x0) returned 1 [0159.444] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.444] WriteFile (in: hFile=0xb4c, lpBuffer=0xe44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0xe44f83c*, lpNumberOfBytesWritten=0xe44f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.445] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xba90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.445] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0159.445] CloseHandle (hObject=0xb4c) returned 1 [0159.445] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba6\\vbe6ext.olb"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba6\\vbe6ext.olb.play")) returned 1 [0159.447] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1655 os_tid = 0x1964 [0159.212] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.212] ReadFile (in: hFile=0xd74, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.214] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.214] ReadFile (in: hFile=0xd74, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.214] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.215] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.216] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0159.216] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0159.216] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0159.216] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.216] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0159.219] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.221] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.221] WriteFile (in: hFile=0xd74, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0159.222] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.222] ReadFile (in: hFile=0xd74, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x4f982, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xe9f61c*=0x4f982, lpOverlapped=0x0) returned 1 [0159.406] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffb067e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.406] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2a50000, cbInput=0x4f982, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xe9f848, pbOutput=0x2a50000, pcbResult=0xe9f618) returned 0x0 [0159.406] WriteFile (in: hFile=0xd74, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x4f990, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xe9f61c*=0x4f990, lpOverlapped=0x0) returned 1 [0159.408] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0159.408] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.408] WriteFile (in: hFile=0xd74, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.408] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x4f990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.408] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0159.408] CloseHandle (hObject=0xd74) returned 1 [0159.408] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0159.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\fm20.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\fm20.chm.play")) returned 1 [0159.410] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1656 os_tid = 0x1968 [0159.223] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.223] ReadFile (in: hFile=0xcbc, lpBuffer=0xdf4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdf4f85c, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesRead=0xdf4f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.350] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.350] ReadFile (in: hFile=0xcbc, lpBuffer=0xdf4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdf4f85c, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesRead=0xdf4f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.350] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.352] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.352] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xdf4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0159.352] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xdf4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xdf4f828, pbKeyObject=0x0) returned 0x0 [0159.353] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xdf4f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xdf4f500) returned 0x0 [0159.353] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.353] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xdf4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xdf4f500) returned 0x0 [0159.358] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.359] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.359] WriteFile (in: hFile=0xcbc, lpBuffer=0xdf4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdf4f830, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesWritten=0xdf4f830*=0x428, lpOverlapped=0x0) returned 1 [0159.360] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.360] ReadFile (in: hFile=0xcbc, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1a40b, lpNumberOfBytesRead=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xdf4f61c*=0x1a40b, lpOverlapped=0x0) returned 1 [0159.478] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffe5bf5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.478] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2b50000, cbInput=0x1a40b, pPaddingInfo=0x0, pbIV=0xdf4f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xdf4f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xdf4f848, pbOutput=0x2b50000, pcbResult=0xdf4f618) returned 0x0 [0159.479] WriteFile (in: hFile=0xcbc, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1a410, lpNumberOfBytesWritten=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xdf4f61c*=0x1a410, lpOverlapped=0x0) returned 1 [0159.479] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdf4f60c | out: lpNewFilePointer=0x0) returned 1 [0159.479] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.479] WriteFile (in: hFile=0xcbc, lpBuffer=0xdf4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0xdf4f83c*, lpNumberOfBytesWritten=0xdf4f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.479] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x1a410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.479] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0159.479] CloseHandle (hObject=0xcbc) returned 1 [0159.480] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbcn6.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbcn6.chm.play")) returned 1 [0159.483] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1657 os_tid = 0x196c [0159.224] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.225] ReadFile (in: hFile=0xe88, lpBuffer=0xe58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe58f85c, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesRead=0xe58f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.226] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.226] ReadFile (in: hFile=0xe88, lpBuffer=0xe58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe58f85c, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesRead=0xe58f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.226] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.227] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.227] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xe58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0159.227] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xe58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xe58f828, pbKeyObject=0x0) returned 0x0 [0159.228] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe58f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe58f500) returned 0x0 [0159.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.228] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe58f500) returned 0x0 [0159.231] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.234] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.234] WriteFile (in: hFile=0xe88, lpBuffer=0xe58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe58f830, lpOverlapped=0x0 | out: lpBuffer=0xe58fb34*, lpNumberOfBytesWritten=0xe58f830*=0x428, lpOverlapped=0x0) returned 1 [0159.235] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.235] ReadFile (in: hFile=0xe88, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x26098, lpNumberOfBytesRead=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xe58f61c*=0x26098, lpOverlapped=0x0) returned 1 [0159.395] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0xfffd9f68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.395] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x2c50000, cbInput=0x26098, pPaddingInfo=0x0, pbIV=0xe58f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xe58f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0xe58f848, pbOutput=0x2c50000, pcbResult=0xe58f618) returned 0x0 [0159.395] WriteFile (in: hFile=0xe88, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x260a0, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xe58f61c*=0x260a0, lpOverlapped=0x0) returned 1 [0159.396] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe58f60c | out: lpNewFilePointer=0x0) returned 1 [0159.396] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.396] WriteFile (in: hFile=0xe88, lpBuffer=0xe58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe58f61c, lpOverlapped=0x0 | out: lpBuffer=0xe58f83c*, lpNumberOfBytesWritten=0xe58f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.396] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x260a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.396] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0159.396] CloseHandle (hObject=0xe88) returned 1 [0159.396] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0159.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll.play")) returned 1 [0159.399] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1658 os_tid = 0x1970 [0159.235] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.236] ReadFile (in: hFile=0xe90, lpBuffer=0xe6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesRead=0xe6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0159.339] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.339] ReadFile (in: hFile=0xe90, lpBuffer=0xe6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesRead=0xe6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0159.339] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.341] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.341] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xe6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0159.341] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xe6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xe6cf828, pbKeyObject=0x0) returned 0x0 [0159.341] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xe6cf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xe6cf500) returned 0x0 [0159.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.342] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xe6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xe6cf500) returned 0x0 [0159.347] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.348] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.349] WriteFile (in: hFile=0xe90, lpBuffer=0xe6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe6cf830, lpOverlapped=0x0 | out: lpBuffer=0xe6cfb34*, lpNumberOfBytesWritten=0xe6cf830*=0x428, lpOverlapped=0x0) returned 1 [0159.350] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.350] ReadFile (in: hFile=0xe90, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xe6cf61c*=0x1195f, lpOverlapped=0x0) returned 1 [0159.486] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffee6a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.486] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2d50000, cbInput=0x1195f, pPaddingInfo=0x0, pbIV=0xe6cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xe6cf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xe6cf848, pbOutput=0x2d50000, pcbResult=0xe6cf618) returned 0x0 [0159.486] WriteFile (in: hFile=0xe90, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xe6cf61c*=0x11960, lpOverlapped=0x0) returned 1 [0159.487] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe6cf60c | out: lpNewFilePointer=0x0) returned 1 [0159.487] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.487] WriteFile (in: hFile=0xe90, lpBuffer=0xe6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xe6cf83c*, lpNumberOfBytesWritten=0xe6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0159.487] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x11960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.487] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0159.487] CloseHandle (hObject=0xe90) returned 1 [0159.487] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbendf98.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbendf98.chm.play")) returned 1 [0159.489] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1659 os_tid = 0x1974 [0159.237] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.237] ReadFile (in: hFile=0xe98, lpBuffer=0xe94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe94f85c, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesRead=0xe94f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.322] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.323] ReadFile (in: hFile=0xe98, lpBuffer=0xe94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe94f85c, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesRead=0xe94f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.323] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.324] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.324] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xe94f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0159.324] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xe94f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xe94f828, pbKeyObject=0x0) returned 0x0 [0159.324] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xe94f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xe94f500) returned 0x0 [0159.324] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.324] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xe94f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xe94f500) returned 0x0 [0159.329] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.331] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.331] WriteFile (in: hFile=0xe98, lpBuffer=0xe94fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe94f830, lpOverlapped=0x0 | out: lpBuffer=0xe94fb34*, lpNumberOfBytesWritten=0xe94f830*=0x428, lpOverlapped=0x0) returned 1 [0159.332] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.332] ReadFile (in: hFile=0xe98, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xe94f61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.503] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.503] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xe94f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xe94f618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0xe94f848, pbOutput=0x2e50000, pcbResult=0xe94f618) returned 0x0 [0159.505] WriteFile (in: hFile=0xe98, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xe94f61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.508] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe94f60c | out: lpNewFilePointer=0x0) returned 1 [0159.508] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.508] WriteFile (in: hFile=0xe98, lpBuffer=0xe94f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0xe94f83c*, lpNumberOfBytesWritten=0xe94f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.508] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.508] ReadFile (in: hFile=0xe98, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xe94f61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.751] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.751] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xe94f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xe94f618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0xe94f848, pbOutput=0x2e50000, pcbResult=0xe94f618) returned 0x0 [0159.752] WriteFile (in: hFile=0xe98, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xe94f61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.756] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe94f60c | out: lpNewFilePointer=0x0) returned 1 [0159.756] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.756] WriteFile (in: hFile=0xe98, lpBuffer=0xe94f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0xe94f83c*, lpNumberOfBytesWritten=0xe94f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.766] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.766] ReadFile (in: hFile=0xe98, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x80e8, lpNumberOfBytesRead=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xe94f61c*=0x80e8, lpOverlapped=0x0) returned 1 [0159.767] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xffff7f18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.767] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0x80e8, pPaddingInfo=0x0, pbIV=0xe94f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xe94f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe94f848, pbOutput=0x2e50000, pcbResult=0xe94f618) returned 0x0 [0159.768] WriteFile (in: hFile=0xe98, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x80f0, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xe94f61c*=0x80f0, lpOverlapped=0x0) returned 1 [0159.768] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe94f60c | out: lpNewFilePointer=0x0) returned 1 [0159.768] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.768] WriteFile (in: hFile=0xe98, lpBuffer=0xe94f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe94f61c, lpOverlapped=0x0 | out: lpBuffer=0xe94f83c*, lpNumberOfBytesWritten=0xe94f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.768] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x2080f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.768] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0159.768] CloseHandle (hObject=0xe98) returned 1 [0159.768] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBEUIINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbeuiintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBEUIINTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbeuiintl.dll.play")) returned 1 [0159.771] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1660 os_tid = 0x1978 [0159.241] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.241] ReadFile (in: hFile=0xea0, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.361] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.361] ReadFile (in: hFile=0xea0, lpBuffer=0xea8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xea8f85c, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesRead=0xea8f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.361] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0159.363] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0159.363] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xea8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0159.364] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xea8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xea8f828, pbKeyObject=0x0) returned 0x0 [0159.364] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xea8f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xea8f500) returned 0x0 [0159.364] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0159.364] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xea8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xea8f500) returned 0x0 [0159.370] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.373] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.373] WriteFile (in: hFile=0xea0, lpBuffer=0xea8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xea8f830, lpOverlapped=0x0 | out: lpBuffer=0xea8fb34*, lpNumberOfBytesWritten=0xea8f830*=0x428, lpOverlapped=0x0) returned 1 [0159.374] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.374] ReadFile (in: hFile=0xea0, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xea8f61c*=0xe2aa, lpOverlapped=0x0) returned 1 [0159.523] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0xffff1d56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.523] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2f50000, cbInput=0xe2aa, pPaddingInfo=0x0, pbIV=0xea8f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xea8f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xea8f848, pbOutput=0x2f50000, pcbResult=0xea8f618) returned 0x0 [0159.523] WriteFile (in: hFile=0xea0, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xea8f61c*=0xe2b0, lpOverlapped=0x0) returned 1 [0159.523] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xea8f60c | out: lpNewFilePointer=0x0) returned 1 [0159.523] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.523] WriteFile (in: hFile=0xea0, lpBuffer=0xea8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xea8f61c, lpOverlapped=0x0 | out: lpBuffer=0xea8f83c*, lpNumberOfBytesWritten=0xea8f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.524] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0xe2b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.524] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0159.524] CloseHandle (hObject=0xea0) returned 1 [0159.524] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbhw6.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbhw6.chm.play")) returned 1 [0159.527] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1661 os_tid = 0x197c [0159.242] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.242] ReadFile (in: hFile=0xea8, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0159.244] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.244] ReadFile (in: hFile=0xea8, lpBuffer=0xebcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xebcf85c, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesRead=0xebcf85c*=0x428, lpOverlapped=0x0) returned 1 [0159.244] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.245] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.245] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xebcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0159.245] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xebcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xebcf828, pbKeyObject=0x0) returned 0x0 [0159.246] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xebcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0159.246] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.246] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xebcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xebcf500) returned 0x0 [0159.249] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.251] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.251] WriteFile (in: hFile=0xea8, lpBuffer=0xebcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xebcf830, lpOverlapped=0x0 | out: lpBuffer=0xebcfb34*, lpNumberOfBytesWritten=0xebcf830*=0x428, lpOverlapped=0x0) returned 1 [0159.252] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.252] ReadFile (in: hFile=0xea8, lpBuffer=0x3350000, nNumberOfBytesToRead=0xe230b, lpNumberOfBytesRead=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xebcf61c*=0xe230b, lpOverlapped=0x0) returned 1 [0159.382] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xfff1dcf5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.382] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3350000, cbInput=0xe230b, pPaddingInfo=0x0, pbIV=0xebcf848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xebcf618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xebcf848, pbOutput=0x3350000, pcbResult=0xebcf618) returned 0x0 [0159.383] WriteFile (in: hFile=0xea8, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xe2310, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xebcf61c*=0xe2310, lpOverlapped=0x0) returned 1 [0159.386] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xebcf60c | out: lpNewFilePointer=0x0) returned 1 [0159.386] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.386] WriteFile (in: hFile=0xea8, lpBuffer=0xebcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xebcf61c, lpOverlapped=0x0 | out: lpBuffer=0xebcf83c*, lpNumberOfBytesWritten=0xebcf61c*=0x8, lpOverlapped=0x0) returned 1 [0159.386] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xe2310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.387] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0159.387] CloseHandle (hObject=0xea8) returned 1 [0159.387] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0159.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vblr6.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vblr6.chm.play")) returned 1 [0159.391] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1662 os_tid = 0x1980 [0159.254] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.254] ReadFile (in: hFile=0xeb0, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.256] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.257] ReadFile (in: hFile=0xeb0, lpBuffer=0xed0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xed0f85c, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesRead=0xed0f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.257] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.259] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.260] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0xed0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0159.260] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0xed0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0xed0f828, pbKeyObject=0x0) returned 0x0 [0159.260] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xed0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0159.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.260] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xed0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xed0f500) returned 0x0 [0159.265] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.267] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.267] WriteFile (in: hFile=0xeb0, lpBuffer=0xed0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xed0f830, lpOverlapped=0x0 | out: lpBuffer=0xed0fb34*, lpNumberOfBytesWritten=0xed0f830*=0x428, lpOverlapped=0x0) returned 1 [0159.268] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.268] ReadFile (in: hFile=0xeb0, lpBuffer=0x3650000, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0xed0f61c*=0x1e434, lpOverlapped=0x0) returned 1 [0159.270] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0xfffe1bcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.270] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3650000, cbInput=0x1e434, pPaddingInfo=0x0, pbIV=0xed0f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0xed0f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0xed0f848, pbOutput=0x3650000, pcbResult=0xed0f618) returned 0x0 [0159.271] WriteFile (in: hFile=0xeb0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0xed0f61c*=0x1e440, lpOverlapped=0x0) returned 1 [0159.271] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xed0f60c | out: lpNewFilePointer=0x0) returned 1 [0159.271] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.271] WriteFile (in: hFile=0xeb0, lpBuffer=0xed0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xed0f61c, lpOverlapped=0x0 | out: lpBuffer=0xed0f83c*, lpNumberOfBytesWritten=0xed0f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.271] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x1e440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.272] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0159.272] CloseHandle (hObject=0xeb0) returned 1 [0159.272] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbob6.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbob6.chm.play")) returned 1 [0159.275] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1663 os_tid = 0x1984 [0159.279] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.279] ReadFile (in: hFile=0xeb8, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.731] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.732] ReadFile (in: hFile=0xeb8, lpBuffer=0xf34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf34f85c, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesRead=0xf34f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.732] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.733] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.733] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0xf34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0159.733] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0xf34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0xf34f828, pbKeyObject=0x0) returned 0x0 [0159.733] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf34f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0159.733] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.734] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf34f500) returned 0x0 [0159.738] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.740] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.740] WriteFile (in: hFile=0xeb8, lpBuffer=0xf34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf34f830, lpOverlapped=0x0 | out: lpBuffer=0xf34fb34*, lpNumberOfBytesWritten=0xf34f830*=0x428, lpOverlapped=0x0) returned 1 [0159.741] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.741] ReadFile (in: hFile=0xeb8, lpBuffer=0x3750000, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0xf34f61c*=0x65c96, lpOverlapped=0x0) returned 1 [0159.923] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xfff9a36a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.923] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3750000, cbInput=0x65c96, pPaddingInfo=0x0, pbIV=0xf34f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0xf34f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xf34f848, pbOutput=0x3750000, pcbResult=0xf34f618) returned 0x0 [0159.923] WriteFile (in: hFile=0xeb8, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0xf34f61c*=0x65ca0, lpOverlapped=0x0) returned 1 [0159.971] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf34f60c | out: lpNewFilePointer=0x0) returned 1 [0159.971] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.972] WriteFile (in: hFile=0xeb8, lpBuffer=0xf34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf34f61c, lpOverlapped=0x0 | out: lpBuffer=0xf34f83c*, lpNumberOfBytesWritten=0xf34f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.972] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x65ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.972] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0159.972] CloseHandle (hObject=0xeb8) returned 1 [0159.972] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0159.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbui6.chm"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbui6.chm.play")) returned 1 [0159.975] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1664 os_tid = 0x1988 [0159.542] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.542] ReadFile (in: hFile=0xb8c, lpBuffer=0x1ec7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1ec7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1ec7fb34*, lpNumberOfBytesRead=0x1ec7f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.625] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.625] ReadFile (in: hFile=0xb8c, lpBuffer=0x1ec7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1ec7f85c, lpOverlapped=0x0 | out: lpBuffer=0x1ec7fb34*, lpNumberOfBytesRead=0x1ec7f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.625] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.628] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.628] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x1ec7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0159.628] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x1ec7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x1ec7f828, pbKeyObject=0x0) returned 0x0 [0159.628] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1ec7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1ec7f500) returned 0x0 [0159.628] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.628] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1ec7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1ec7f500) returned 0x0 [0159.634] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.636] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.636] WriteFile (in: hFile=0xb8c, lpBuffer=0x1ec7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1ec7f830, lpOverlapped=0x0 | out: lpBuffer=0x1ec7fb34*, lpNumberOfBytesWritten=0x1ec7f830*=0x428, lpOverlapped=0x0) returned 1 [0159.637] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.637] ReadFile (in: hFile=0xb8c, lpBuffer=0x3850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1ec7f61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.991] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.991] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1ec7f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1ec7f618, dwFlags=0x0 | out: hKey=0x1a6d8aa0, pbIV=0x1ec7f848, pbOutput=0x3850000, pcbResult=0x1ec7f618) returned 0x0 [0159.992] WriteFile (in: hFile=0xb8c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1ec7f61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.994] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ec7f60c | out: lpNewFilePointer=0x0) returned 1 [0159.995] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.995] WriteFile (in: hFile=0xb8c, lpBuffer=0x1ec7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x1ec7f83c*, lpNumberOfBytesWritten=0x1ec7f61c*=0x8, lpOverlapped=0x0) returned 1 [0159.995] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.995] ReadFile (in: hFile=0xb8c, lpBuffer=0x3850000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1ec7f61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.091] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.091] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3850000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1ec7f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1ec7f618, dwFlags=0x0 | out: hKey=0x1a6d8aa0, pbIV=0x1ec7f848, pbOutput=0x3850000, pcbResult=0x1ec7f618) returned 0x0 [0160.092] WriteFile (in: hFile=0xb8c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1ec7f61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.095] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ec7f60c | out: lpNewFilePointer=0x0) returned 1 [0160.095] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.095] WriteFile (in: hFile=0xb8c, lpBuffer=0x1ec7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x1ec7f83c*, lpNumberOfBytesWritten=0x1ec7f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.095] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.095] ReadFile (in: hFile=0xb8c, lpBuffer=0x3850000, nNumberOfBytesToRead=0x7fa88, lpNumberOfBytesRead=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x1ec7f61c*=0x7fa88, lpOverlapped=0x0) returned 1 [0160.128] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfff80578, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.129] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3850000, cbInput=0x7fa88, pPaddingInfo=0x0, pbIV=0x1ec7f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x1ec7f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x1ec7f848, pbOutput=0x3850000, pcbResult=0x1ec7f618) returned 0x0 [0160.129] WriteFile (in: hFile=0xb8c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x7fa90, lpNumberOfBytesWritten=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x1ec7f61c*=0x7fa90, lpOverlapped=0x0) returned 1 [0160.131] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ec7f60c | out: lpNewFilePointer=0x0) returned 1 [0160.131] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.131] WriteFile (in: hFile=0xb8c, lpBuffer=0x1ec7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ec7f61c, lpOverlapped=0x0 | out: lpBuffer=0x1ec7f83c*, lpNumberOfBytesWritten=0x1ec7f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.131] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x27fa90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.131] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.131] CloseHandle (hObject=0xb8c) returned 1 [0160.131] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll.play")) returned 1 [0160.133] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1665 os_tid = 0x198c [0159.543] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.543] ReadFile (in: hFile=0xec4, lpBuffer=0x1edbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1edbf85c, lpOverlapped=0x0 | out: lpBuffer=0x1edbfb34*, lpNumberOfBytesRead=0x1edbf85c*=0x428, lpOverlapped=0x0) returned 1 [0159.717] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.717] ReadFile (in: hFile=0xec4, lpBuffer=0x1edbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1edbf85c, lpOverlapped=0x0 | out: lpBuffer=0x1edbfb34*, lpNumberOfBytesRead=0x1edbf85c*=0x428, lpOverlapped=0x0) returned 1 [0159.717] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.719] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.719] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x1edbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0159.719] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x1edbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x1edbf828, pbKeyObject=0x0) returned 0x0 [0159.719] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1edbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1edbf500) returned 0x0 [0159.719] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.720] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1edbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1edbf500) returned 0x0 [0159.724] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.726] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.726] WriteFile (in: hFile=0xec4, lpBuffer=0x1edbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1edbf830, lpOverlapped=0x0 | out: lpBuffer=0x1edbfb34*, lpNumberOfBytesWritten=0x1edbf830*=0x428, lpOverlapped=0x0) returned 1 [0159.727] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.727] ReadFile (in: hFile=0xec4, lpBuffer=0x3950000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1edbf61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.022] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.022] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3950000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1edbf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1edbf618, dwFlags=0x0 | out: hKey=0x1a6d8fb0, pbIV=0x1edbf848, pbOutput=0x3950000, pcbResult=0x1edbf618) returned 0x0 [0160.023] WriteFile (in: hFile=0xec4, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1edbf61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.026] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1edbf60c | out: lpNewFilePointer=0x0) returned 1 [0160.026] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.026] WriteFile (in: hFile=0xec4, lpBuffer=0x1edbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x1edbf83c*, lpNumberOfBytesWritten=0x1edbf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.026] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.026] ReadFile (in: hFile=0xec4, lpBuffer=0x3950000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1edbf61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.113] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.113] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3950000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1edbf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1edbf618, dwFlags=0x0 | out: hKey=0x1a6d8fb0, pbIV=0x1edbf848, pbOutput=0x3950000, pcbResult=0x1edbf618) returned 0x0 [0160.114] WriteFile (in: hFile=0xec4, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1edbf61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.117] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1edbf60c | out: lpNewFilePointer=0x0) returned 1 [0160.117] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.118] WriteFile (in: hFile=0xec4, lpBuffer=0x1edbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x1edbf83c*, lpNumberOfBytesWritten=0x1edbf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.170] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.170] ReadFile (in: hFile=0xec4, lpBuffer=0x3950000, nNumberOfBytesToRead=0x25ae8, lpNumberOfBytesRead=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1edbf61c*=0x25ae8, lpOverlapped=0x0) returned 1 [0160.203] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffda518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.203] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3950000, cbInput=0x25ae8, pPaddingInfo=0x0, pbIV=0x1edbf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1edbf618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x1edbf848, pbOutput=0x3950000, pcbResult=0x1edbf618) returned 0x0 [0160.203] WriteFile (in: hFile=0xec4, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x25af0, lpNumberOfBytesWritten=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1edbf61c*=0x25af0, lpOverlapped=0x0) returned 1 [0160.204] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1edbf60c | out: lpNewFilePointer=0x0) returned 1 [0160.204] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.204] WriteFile (in: hFile=0xec4, lpBuffer=0x1edbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1edbf61c, lpOverlapped=0x0 | out: lpBuffer=0x1edbf83c*, lpNumberOfBytesWritten=0x1edbf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.204] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x225af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.204] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0160.204] CloseHandle (hObject=0xec4) returned 1 [0160.204] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\vbeui.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\vbeui.dll.play")) returned 1 [0160.251] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1666 os_tid = 0x1990 [0159.545] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.545] ReadFile (in: hFile=0xecc, lpBuffer=0x1eeffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1eeff85c, lpOverlapped=0x0 | out: lpBuffer=0x1eeffb34*, lpNumberOfBytesRead=0x1eeff85c*=0x428, lpOverlapped=0x0) returned 1 [0159.640] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.640] ReadFile (in: hFile=0xecc, lpBuffer=0x1eeffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1eeff85c, lpOverlapped=0x0 | out: lpBuffer=0x1eeffb34*, lpNumberOfBytesRead=0x1eeff85c*=0x428, lpOverlapped=0x0) returned 1 [0159.640] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.642] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1eeff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0159.642] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1eeff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1eeff828, pbKeyObject=0x0) returned 0x0 [0159.642] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1eeff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1eeff500) returned 0x0 [0159.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.642] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1eeff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1eeff500) returned 0x0 [0159.647] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.649] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.649] WriteFile (in: hFile=0xecc, lpBuffer=0x1eeffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1eeff830, lpOverlapped=0x0 | out: lpBuffer=0x1eeffb34*, lpNumberOfBytesWritten=0x1eeff830*=0x428, lpOverlapped=0x0) returned 1 [0159.650] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.650] ReadFile (in: hFile=0xecc, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1eeff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1eeff61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.874] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.874] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3a50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0x1eeff848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1eeff618, dwFlags=0x0 | out: hKey=0x1a6d8d30, pbIV=0x1eeff848, pbOutput=0x3a50000, pcbResult=0x1eeff618) returned 0x0 [0159.876] WriteFile (in: hFile=0xecc, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1eeff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1eeff61c*=0x100000, lpOverlapped=0x0) returned 1 [0159.878] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eeff60c | out: lpNewFilePointer=0x0) returned 1 [0159.878] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.878] WriteFile (in: hFile=0xecc, lpBuffer=0x1eeff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1eeff61c, lpOverlapped=0x0 | out: lpBuffer=0x1eeff83c*, lpNumberOfBytesWritten=0x1eeff61c*=0x8, lpOverlapped=0x0) returned 1 [0159.878] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.878] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xffeffbd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.879] ReadFile (in: hFile=0xecc, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1eeff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1eeff61c*=0xffff0, lpOverlapped=0x0) returned 1 [0160.060] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfff00010, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.060] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3a50000, cbInput=0xffff0, pPaddingInfo=0x0, pbIV=0x1eeff848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1eeff618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x1eeff848, pbOutput=0x3a50000, pcbResult=0x1eeff618) returned 0x0 [0160.062] WriteFile (in: hFile=0xecc, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1eeff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1eeff61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.075] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eeff60c | out: lpNewFilePointer=0x0) returned 1 [0160.075] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.075] WriteFile (in: hFile=0xecc, lpBuffer=0x1eeff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1eeff61c, lpOverlapped=0x0 | out: lpBuffer=0x1eeff83c*, lpNumberOfBytesWritten=0x1eeff61c*=0x8, lpOverlapped=0x0) returned 1 [0160.075] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x52aaf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.075] WriteFile (in: hFile=0xecc, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1eeff82c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1eeff82c*=0x8, lpOverlapped=0x0) returned 1 [0160.075] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0160.075] CloseHandle (hObject=0xecc) returned 1 [0160.075] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUIRES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\vbeuires.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUIRES.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7.1\\vbeuires.dll.play")) returned 1 [0160.078] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1667 os_tid = 0x1994 [0159.547] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.547] ReadFile (in: hFile=0xed4, lpBuffer=0x1f03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1f03f85c, lpOverlapped=0x0 | out: lpBuffer=0x1f03fb34*, lpNumberOfBytesRead=0x1f03f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.639] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.640] ReadFile (in: hFile=0xed4, lpBuffer=0x1f03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1f03f85c, lpOverlapped=0x0 | out: lpBuffer=0x1f03fb34*, lpNumberOfBytesRead=0x1f03f85c*=0x428, lpOverlapped=0x0) returned 1 [0159.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0159.859] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0159.859] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x1f03f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0159.859] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x1f03f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x1f03f828, pbKeyObject=0x0) returned 0x0 [0159.859] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1f03f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1f03f500) returned 0x0 [0159.859] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0159.859] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1f03f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1f03f500) returned 0x0 [0159.863] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.865] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.865] WriteFile (in: hFile=0xed4, lpBuffer=0x1f03fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1f03f830, lpOverlapped=0x0 | out: lpBuffer=0x1f03fb34*, lpNumberOfBytesWritten=0x1f03f830*=0x428, lpOverlapped=0x0) returned 1 [0159.866] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.866] ReadFile (in: hFile=0xed4, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x25b9, lpNumberOfBytesRead=0x1f03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x1f03f61c*=0x25b9, lpOverlapped=0x0) returned 1 [0160.039] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xffffda47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.039] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3c50000, cbInput=0x25b9, pPaddingInfo=0x0, pbIV=0x1f03f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x1f03f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x1f03f848, pbOutput=0x3c50000, pcbResult=0x1f03f618) returned 0x0 [0160.039] WriteFile (in: hFile=0xed4, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x1f03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x1f03f61c*=0x25c0, lpOverlapped=0x0) returned 1 [0160.039] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f03f60c | out: lpNewFilePointer=0x0) returned 1 [0160.039] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.039] WriteFile (in: hFile=0xed4, lpBuffer=0x1f03f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f03f61c, lpOverlapped=0x0 | out: lpBuffer=0x1f03f83c*, lpNumberOfBytesWritten=0x1f03f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.039] SetFilePointerEx (in: hFile=0xed4, liDistanceToMove=0x25c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.039] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0160.039] CloseHandle (hObject=0xed4) returned 1 [0160.039] VirtualAlloc (lpAddress=0x0, dwSize=0xc1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\AppInfoDocument\\AddIns.store" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\appinfodocument\\addins.store"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\AppInfoDocument\\AddIns.store.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\appinfodocument\\addins.store.play")) returned 1 [0160.042] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1668 os_tid = 0x1950 [0159.549] GetLastError () returned 0x57 [0159.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2298 [0159.549] SetLastError (dwErrCode=0x57) [0159.549] IcmpCreateFile () returned 0x1a6f2298 [0159.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762290 [0159.549] IcmpSendEcho2 (IcmpHandle=0x1a6f2298, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7e00a8c0, RequestData=0x1e8bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762290, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1669 os_tid = 0x1998 [0159.550] GetLastError () returned 0x57 [0159.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2620 [0159.551] SetLastError (dwErrCode=0x57) [0159.551] IcmpCreateFile () returned 0x1a6f22d0 [0159.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7622e0 [0159.551] IcmpSendEcho2 (IcmpHandle=0x1a6f22d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7f00a8c0, RequestData=0x111ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7622e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1670 os_tid = 0x199c [0159.552] GetLastError () returned 0x57 [0159.552] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b29a8 [0159.552] SetLastError (dwErrCode=0x57) [0159.552] IcmpCreateFile () returned 0x1a6f2308 [0159.552] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762330 [0159.552] IcmpSendEcho2 (IcmpHandle=0x1a6f2308, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8000a8c0, RequestData=0xef8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762330, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1671 os_tid = 0x19a0 [0160.155] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.155] ReadFile (in: hFile=0xecc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.156] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.156] ReadFile (in: hFile=0xecc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.156] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.158] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.158] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0160.158] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0160.158] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0160.159] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.159] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0160.162] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.164] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.164] WriteFile (in: hFile=0xecc, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0160.164] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.164] ReadFile (in: hFile=0xecc, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1fdc1, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xe9f61c*=0x1fdc1, lpOverlapped=0x0) returned 1 [0160.196] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffe023f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.196] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2750000, cbInput=0x1fdc1, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xe9f848, pbOutput=0x2750000, pcbResult=0xe9f618) returned 0x0 [0160.196] WriteFile (in: hFile=0xecc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1fdd0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xe9f61c*=0x1fdd0, lpOverlapped=0x0) returned 1 [0160.196] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0160.196] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.196] WriteFile (in: hFile=0xecc, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.196] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x1fdd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.197] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.197] CloseHandle (hObject=0xecc) returned 1 [0160.197] VirtualAlloc (lpAddress=0x0, dwSize=0xd3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\PipelineSegments.store" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\pipeline.v10.0\\pipelinesegments.store"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\PipelineSegments.store.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\pipeline.v10.0\\pipelinesegments.store.play")) returned 1 [0160.199] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1672 os_tid = 0x19a4 [0160.170] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.170] ReadFile (in: hFile=0xa30, lpBuffer=0xd40fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd40f85c, lpOverlapped=0x0 | out: lpBuffer=0xd40fb34*, lpNumberOfBytesRead=0xd40f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.215] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.215] ReadFile (in: hFile=0xa30, lpBuffer=0xd40fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd40f85c, lpOverlapped=0x0 | out: lpBuffer=0xd40fb34*, lpNumberOfBytesRead=0xd40f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.215] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0160.217] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0160.217] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xd40f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0160.217] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xd40f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xd40f828, pbKeyObject=0x0) returned 0x0 [0160.217] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xd40f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xd40f500) returned 0x0 [0160.217] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0160.217] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xd40f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xd40f500) returned 0x0 [0160.220] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.222] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.222] WriteFile (in: hFile=0xa30, lpBuffer=0xd40fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd40f830, lpOverlapped=0x0 | out: lpBuffer=0xd40fb34*, lpNumberOfBytesWritten=0xd40f830*=0x428, lpOverlapped=0x0) returned 1 [0160.222] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.222] ReadFile (in: hFile=0xa30, lpBuffer=0x2850000, nNumberOfBytesToRead=0x15e2a, lpNumberOfBytesRead=0xd40f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xd40f61c*=0x15e2a, lpOverlapped=0x0) returned 1 [0160.267] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffea1d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.267] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x2850000, cbInput=0x15e2a, pPaddingInfo=0x0, pbIV=0xd40f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xd40f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0xd40f848, pbOutput=0x2850000, pcbResult=0xd40f618) returned 0x0 [0160.267] WriteFile (in: hFile=0xa30, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x15e30, lpNumberOfBytesWritten=0xd40f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xd40f61c*=0x15e30, lpOverlapped=0x0) returned 1 [0160.267] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd40f60c | out: lpNewFilePointer=0x0) returned 1 [0160.267] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.267] WriteFile (in: hFile=0xa30, lpBuffer=0xd40f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd40f61c, lpOverlapped=0x0 | out: lpBuffer=0xd40f83c*, lpNumberOfBytesWritten=0xd40f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.268] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x15e30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.268] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0160.268] CloseHandle (hObject=0xa30) returned 1 [0160.268] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.269] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\VSTOFiles.cat" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\vstofiles.cat"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\VSTOFiles.cat.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\vstofiles.cat.play")) returned 1 [0160.269] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1673 os_tid = 0x19a8 [0160.172] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.173] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xd54f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0160.173] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xd54f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xd54f828, pbKeyObject=0x0) returned 0x0 [0160.173] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd54f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd54f500) returned 0x0 [0160.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.173] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd54f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd54f500) returned 0x0 [0160.177] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.178] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.178] WriteFile (in: hFile=0xeb8, lpBuffer=0xd54fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd54f830, lpOverlapped=0x0 | out: lpBuffer=0xd54fb34*, lpNumberOfBytesWritten=0xd54f830*=0x428, lpOverlapped=0x0) returned 1 [0160.223] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.223] ReadFile (in: hFile=0xeb8, lpBuffer=0x2950000, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0xd54f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xd54f61c*=0x295, lpOverlapped=0x0) returned 1 [0160.223] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xfffffd6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.223] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2950000, cbInput=0x295, pPaddingInfo=0x0, pbIV=0xd54f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xd54f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xd54f848, pbOutput=0x2950000, pcbResult=0xd54f618) returned 0x0 [0160.223] WriteFile (in: hFile=0xeb8, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0xd54f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xd54f61c*=0x2a0, lpOverlapped=0x0) returned 1 [0160.223] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd54f60c | out: lpNewFilePointer=0x0) returned 1 [0160.224] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.224] WriteFile (in: hFile=0xeb8, lpBuffer=0xd54f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd54f61c, lpOverlapped=0x0 | out: lpBuffer=0xd54f83c*, lpNumberOfBytesWritten=0xd54f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.224] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x2a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.224] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0160.224] CloseHandle (hObject=0xeb8) returned 1 [0160.224] VirtualAlloc (lpAddress=0x0, dwSize=0xc3, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0160.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.config" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.config"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.config.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.config.play")) returned 1 [0160.226] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1674 os_tid = 0x19ac [0160.180] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.183] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xd68f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0160.183] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xd68f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xd68f828, pbKeyObject=0x0) returned 0x0 [0160.183] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd68f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd68f500) returned 0x0 [0160.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.183] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd68f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd68f500) returned 0x0 [0160.187] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.188] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.188] WriteFile (in: hFile=0xb8c, lpBuffer=0xd68fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd68f830, lpOverlapped=0x0 | out: lpBuffer=0xd68fb34*, lpNumberOfBytesWritten=0xd68f830*=0x428, lpOverlapped=0x0) returned 1 [0160.259] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.259] ReadFile (in: hFile=0xb8c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x87, lpNumberOfBytesRead=0xd68f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xd68f61c*=0x87, lpOverlapped=0x0) returned 1 [0160.259] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xffffff79, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.259] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2a50000, cbInput=0x87, pPaddingInfo=0x0, pbIV=0xd68f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xd68f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xd68f848, pbOutput=0x2a50000, pcbResult=0xd68f618) returned 0x0 [0160.259] WriteFile (in: hFile=0xb8c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0xd68f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xd68f61c*=0x90, lpOverlapped=0x0) returned 1 [0160.260] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd68f60c | out: lpNewFilePointer=0x0) returned 1 [0160.260] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.260] WriteFile (in: hFile=0xb8c, lpBuffer=0xd68f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd68f61c, lpOverlapped=0x0 | out: lpBuffer=0xd68f83c*, lpNumberOfBytesWritten=0xd68f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.260] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.260] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0160.260] CloseHandle (hObject=0xb8c) returned 1 [0160.260] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.261] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\actionspane3.xsd"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\actionspane3.xsd.play")) returned 1 [0160.262] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1675 os_tid = 0x19b0 [0160.193] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.193] ReadFile (in: hFile=0xe98, lpBuffer=0xd7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd7cfb34*, lpNumberOfBytesRead=0xd7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.235] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.235] ReadFile (in: hFile=0xe98, lpBuffer=0xd7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd7cfb34*, lpNumberOfBytesRead=0xd7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.235] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0160.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0160.236] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xd7cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0160.236] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xd7cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xd7cf828, pbKeyObject=0x0) returned 0x0 [0160.236] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xd7cf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xd7cf500) returned 0x0 [0160.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0160.236] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xd7cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xd7cf500) returned 0x0 [0160.240] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.241] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.241] WriteFile (in: hFile=0xe98, lpBuffer=0xd7cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd7cf830, lpOverlapped=0x0 | out: lpBuffer=0xd7cfb34*, lpNumberOfBytesWritten=0xd7cf830*=0x428, lpOverlapped=0x0) returned 1 [0160.241] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.242] ReadFile (in: hFile=0xe98, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x4098, lpNumberOfBytesRead=0xd7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xd7cf61c*=0x4098, lpOverlapped=0x0) returned 1 [0160.329] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xffffbf68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.329] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2b50000, cbInput=0x4098, pPaddingInfo=0x0, pbIV=0xd7cf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xd7cf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xd7cf848, pbOutput=0x2b50000, pcbResult=0xd7cf618) returned 0x0 [0160.329] WriteFile (in: hFile=0xe98, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0xd7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xd7cf61c*=0x40a0, lpOverlapped=0x0) returned 1 [0160.329] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd7cf60c | out: lpNewFilePointer=0x0) returned 1 [0160.329] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.329] WriteFile (in: hFile=0xe98, lpBuffer=0xd7cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd7cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd7cf83c*, lpNumberOfBytesWritten=0xd7cf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.329] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x40a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.329] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0160.330] CloseHandle (hObject=0xe98) returned 1 [0160.330] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\vstoee100.tlb.play")) returned 1 [0160.333] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1676 os_tid = 0x19b4 [0160.194] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.194] ReadFile (in: hFile=0xa7c, lpBuffer=0xd90fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd90f85c, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesRead=0xd90f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.249] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.249] ReadFile (in: hFile=0xa7c, lpBuffer=0xd90fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd90f85c, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesRead=0xd90f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.308] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.309] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xd90f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0160.309] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xd90f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xd90f828, pbKeyObject=0x0) returned 0x0 [0160.309] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd90f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd90f500) returned 0x0 [0160.310] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.310] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd90f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd90f500) returned 0x0 [0160.314] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.315] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.315] WriteFile (in: hFile=0xa7c, lpBuffer=0xd90fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd90f830, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesWritten=0xd90f830*=0x428, lpOverlapped=0x0) returned 1 [0160.316] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.316] ReadFile (in: hFile=0xa7c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x5490, lpNumberOfBytesRead=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xd90f61c*=0x5490, lpOverlapped=0x0) returned 1 [0160.399] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0xffffab70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.399] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2c50000, cbInput=0x5490, pPaddingInfo=0x0, pbIV=0xd90f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xd90f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xd90f848, pbOutput=0x2c50000, pcbResult=0xd90f618) returned 0x0 [0160.399] WriteFile (in: hFile=0xa7c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x54a0, lpNumberOfBytesWritten=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xd90f61c*=0x54a0, lpOverlapped=0x0) returned 1 [0160.400] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd90f60c | out: lpNewFilePointer=0x0) returned 1 [0160.400] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.400] WriteFile (in: hFile=0xa7c, lpBuffer=0xd90f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0xd90f83c*, lpNumberOfBytesWritten=0xd90f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.400] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x54a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.400] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.400] CloseHandle (hObject=0xa7c) returned 1 [0160.400] VirtualAlloc (lpAddress=0x0, dwSize=0xa1, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\vstoee90.tlb.play")) returned 1 [0160.402] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1677 os_tid = 0x19b8 [0160.206] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.206] ReadFile (in: hFile=0xe90, lpBuffer=0xda4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda4f85c, lpOverlapped=0x0 | out: lpBuffer=0xda4fb34*, lpNumberOfBytesRead=0xda4f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.207] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.207] ReadFile (in: hFile=0xe90, lpBuffer=0xda4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda4f85c, lpOverlapped=0x0 | out: lpBuffer=0xda4fb34*, lpNumberOfBytesRead=0xda4f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.207] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0160.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0160.209] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xda4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0160.209] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xda4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xda4f828, pbKeyObject=0x0) returned 0x0 [0160.209] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xda4f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xda4f500) returned 0x0 [0160.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0160.209] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xda4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xda4f500) returned 0x0 [0160.213] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.214] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.214] WriteFile (in: hFile=0xe90, lpBuffer=0xda4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xda4f830, lpOverlapped=0x0 | out: lpBuffer=0xda4fb34*, lpNumberOfBytesWritten=0xda4f830*=0x428, lpOverlapped=0x0) returned 1 [0160.214] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.215] ReadFile (in: hFile=0xe90, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x29b77, lpNumberOfBytesRead=0xda4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xda4f61c*=0x29b77, lpOverlapped=0x0) returned 1 [0160.254] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffd6489, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.254] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2d50000, cbInput=0x29b77, pPaddingInfo=0x0, pbIV=0xda4f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xda4f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xda4f848, pbOutput=0x2d50000, pcbResult=0xda4f618) returned 0x0 [0160.254] WriteFile (in: hFile=0xe90, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x29b80, lpNumberOfBytesWritten=0xda4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xda4f61c*=0x29b80, lpOverlapped=0x0) returned 1 [0160.255] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xda4f60c | out: lpNewFilePointer=0x0) returned 1 [0160.255] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.255] WriteFile (in: hFile=0xe90, lpBuffer=0xda4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xda4f61c, lpOverlapped=0x0 | out: lpBuffer=0xda4f83c*, lpNumberOfBytesWritten=0xda4f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.255] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x29b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.255] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.255] CloseHandle (hObject=0xe90) returned 1 [0160.255] VirtualAlloc (lpAddress=0x0, dwSize=0xd5, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\16\\bin\\1033\\fpext.msg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\16\\bin\\1033\\fpext.msg.play")) returned 1 [0160.257] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1678 os_tid = 0x19bc [0160.264] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.264] ReadFile (in: hFile=0xa8c, lpBuffer=0xdb8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdb8f85c, lpOverlapped=0x0 | out: lpBuffer=0xdb8fb34*, lpNumberOfBytesRead=0xdb8f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.348] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.348] ReadFile (in: hFile=0xa8c, lpBuffer=0xdb8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdb8f85c, lpOverlapped=0x0 | out: lpBuffer=0xdb8fb34*, lpNumberOfBytesRead=0xdb8f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.348] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.349] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.349] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xdb8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0160.349] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xdb8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xdb8f828, pbKeyObject=0x0) returned 0x0 [0160.349] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xdb8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xdb8f500) returned 0x0 [0160.349] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.349] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xdb8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xdb8f500) returned 0x0 [0160.353] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.354] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.354] WriteFile (in: hFile=0xa8c, lpBuffer=0xdb8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdb8f830, lpOverlapped=0x0 | out: lpBuffer=0xdb8fb34*, lpNumberOfBytesWritten=0xdb8f830*=0x428, lpOverlapped=0x0) returned 1 [0160.355] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.355] ReadFile (in: hFile=0xa8c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xdb8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.567] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.567] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x2e50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xdb8f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xdb8f618, dwFlags=0x0 | out: hKey=0x1a6d8fb0, pbIV=0xdb8f848, pbOutput=0x2e50000, pcbResult=0xdb8f618) returned 0x0 [0160.568] WriteFile (in: hFile=0xa8c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xdb8f61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.571] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdb8f60c | out: lpNewFilePointer=0x0) returned 1 [0160.572] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.572] WriteFile (in: hFile=0xa8c, lpBuffer=0xdb8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0xdb8f83c*, lpNumberOfBytesWritten=0xdb8f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.572] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.572] ReadFile (in: hFile=0xa8c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x850c0, lpNumberOfBytesRead=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xdb8f61c*=0x850c0, lpOverlapped=0x0) returned 1 [0160.635] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfff7af40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.635] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x2e50000, cbInput=0x850c0, pPaddingInfo=0x0, pbIV=0xdb8f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xdb8f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0xdb8f848, pbOutput=0x2e50000, pcbResult=0xdb8f618) returned 0x0 [0160.635] WriteFile (in: hFile=0xa8c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x850d0, lpNumberOfBytesWritten=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xdb8f61c*=0x850d0, lpOverlapped=0x0) returned 1 [0160.637] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdb8f60c | out: lpNewFilePointer=0x0) returned 1 [0160.637] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.637] WriteFile (in: hFile=0xa8c, lpBuffer=0xdb8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0xdb8f83c*, lpNumberOfBytesWritten=0xdb8f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.637] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x1850d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.637] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0160.637] CloseHandle (hObject=0xa8c) returned 1 [0160.637] VirtualAlloc (lpAddress=0x0, dwSize=0xd1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0160.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\16\\bin\\fpsrvutl.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPSRVUTL.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\16\\bin\\fpsrvutl.dll.play")) returned 1 [0160.641] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1679 os_tid = 0x19c0 [0160.266] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.266] ReadFile (in: hFile=0xb4c, lpBuffer=0xdccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdccf85c, lpOverlapped=0x0 | out: lpBuffer=0xdccfb34*, lpNumberOfBytesRead=0xdccf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.337] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.337] ReadFile (in: hFile=0xb4c, lpBuffer=0xdccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdccf85c, lpOverlapped=0x0 | out: lpBuffer=0xdccfb34*, lpNumberOfBytesRead=0xdccf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.337] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.338] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.339] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xdccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0160.339] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xdccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xdccf828, pbKeyObject=0x0) returned 0x0 [0160.339] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xdccf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xdccf500) returned 0x0 [0160.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.339] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xdccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xdccf500) returned 0x0 [0160.343] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.345] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.345] WriteFile (in: hFile=0xb4c, lpBuffer=0xdccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdccf830, lpOverlapped=0x0 | out: lpBuffer=0xdccfb34*, lpNumberOfBytesWritten=0xdccf830*=0x428, lpOverlapped=0x0) returned 1 [0160.345] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.345] ReadFile (in: hFile=0xb4c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xdccf61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.417] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.417] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2f50000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xdccf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xdccf618, dwFlags=0x0 | out: hKey=0x1a6d8d30, pbIV=0xdccf848, pbOutput=0x2f50000, pcbResult=0xdccf618) returned 0x0 [0160.419] WriteFile (in: hFile=0xb4c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xdccf61c*=0x100000, lpOverlapped=0x0) returned 1 [0160.421] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdccf60c | out: lpNewFilePointer=0x0) returned 1 [0160.422] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.422] WriteFile (in: hFile=0xb4c, lpBuffer=0xdccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0xdccf83c*, lpNumberOfBytesWritten=0xdccf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.422] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.422] ReadFile (in: hFile=0xb4c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x2d0d8, lpNumberOfBytesRead=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xdccf61c*=0x2d0d8, lpOverlapped=0x0) returned 1 [0160.550] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffd2f28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.551] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2f50000, cbInput=0x2d0d8, pPaddingInfo=0x0, pbIV=0xdccf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xdccf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xdccf848, pbOutput=0x2f50000, pcbResult=0xdccf618) returned 0x0 [0160.551] WriteFile (in: hFile=0xb4c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x2d0e0, lpNumberOfBytesWritten=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xdccf61c*=0x2d0e0, lpOverlapped=0x0) returned 1 [0160.552] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdccf60c | out: lpNewFilePointer=0x0) returned 1 [0160.552] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.552] WriteFile (in: hFile=0xb4c, lpBuffer=0xdccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0xdccf83c*, lpNumberOfBytesWritten=0xdccf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.552] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x12d0e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.552] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0160.552] CloseHandle (hObject=0xb4c) returned 1 [0160.552] VirtualAlloc (lpAddress=0x0, dwSize=0xcb, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPWEC.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\16\\bin\\fpwec.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPWEC.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\16\\bin\\fpwec.dll.play")) returned 1 [0160.555] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1680 os_tid = 0x19c4 [0160.409] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.409] ReadFile (in: hFile=0xa50, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.423] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.423] ReadFile (in: hFile=0xa50, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.423] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.425] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.425] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0160.425] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0160.425] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0160.425] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.425] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0160.428] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.430] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.430] WriteFile (in: hFile=0xa50, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0160.430] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.430] ReadFile (in: hFile=0xa50, lpBuffer=0x2750000, nNumberOfBytesToRead=0xd4c0, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xe9f61c*=0xd4c0, lpOverlapped=0x0) returned 1 [0160.432] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xffff2b40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.433] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2750000, cbInput=0xd4c0, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xe9f848, pbOutput=0x2750000, pcbResult=0xe9f618) returned 0x0 [0160.433] WriteFile (in: hFile=0xa50, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xd4d0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xe9f61c*=0xd4d0, lpOverlapped=0x0) returned 1 [0160.433] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0160.433] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.433] WriteFile (in: hFile=0xa50, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.433] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xd4d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.433] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.433] CloseHandle (hObject=0xa50) returned 1 [0160.433] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files (x86)\\common files\\system\\msmapi\\1033\\msmapi32.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.PLAY" (normalized: "c:\\program files (x86)\\common files\\system\\msmapi\\1033\\msmapi32.dll.play")) returned 1 [0160.435] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1681 os_tid = 0x19c8 [0160.461] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.462] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0160.462] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0160.462] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0160.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.462] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0160.466] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.470] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.470] WriteFile (in: hFile=0x2fc, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0160.473] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.473] ReadFile (in: hFile=0x2fc, lpBuffer=0x2750000, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xe9f61c*=0xae, lpOverlapped=0x0) returned 1 [0160.473] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.473] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2750000, cbInput=0xae, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xe9f848, pbOutput=0x2750000, pcbResult=0xe9f618) returned 0x0 [0160.473] WriteFile (in: hFile=0x2fc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xe9f61c*=0xb0, lpOverlapped=0x0) returned 1 [0160.473] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0160.473] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.473] WriteFile (in: hFile=0x2fc, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.473] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.473] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.473] CloseHandle (hObject=0x2fc) returned 1 [0160.473] VirtualAlloc (lpAddress=0x0, dwSize=0x59, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\desktop.ini" (normalized: "c:\\program files (x86)\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\desktop.ini.PLAY" (normalized: "c:\\program files (x86)\\desktop.ini.play")) returned 1 [0160.475] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1682 os_tid = 0x19cc [0160.478] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0160.479] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0160.479] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xca0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0160.479] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xca0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xca0f828, pbKeyObject=0x0) returned 0x0 [0160.479] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xca0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xca0f500) returned 0x0 [0160.479] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0160.479] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xca0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xca0f500) returned 0x0 [0160.483] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.484] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.484] WriteFile (in: hFile=0xa50, lpBuffer=0xca0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xca0f830, lpOverlapped=0x0 | out: lpBuffer=0xca0fb34*, lpNumberOfBytesWritten=0xca0f830*=0x428, lpOverlapped=0x0) returned 1 [0160.487] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.487] ReadFile (in: hFile=0xa50, lpBuffer=0x2850000, nNumberOfBytesToRead=0x1c4, lpNumberOfBytesRead=0xca0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xca0f61c*=0x1c4, lpOverlapped=0x0) returned 1 [0160.487] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xfffffe3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.487] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2850000, cbInput=0x1c4, pPaddingInfo=0x0, pbIV=0xca0f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xca0f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xca0f848, pbOutput=0x2850000, pcbResult=0xca0f618) returned 0x0 [0160.487] WriteFile (in: hFile=0xa50, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0xca0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xca0f61c*=0x1d0, lpOverlapped=0x0) returned 1 [0160.487] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xca0f60c | out: lpNewFilePointer=0x0) returned 1 [0160.487] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.487] WriteFile (in: hFile=0xa50, lpBuffer=0xca0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xca0f61c, lpOverlapped=0x0 | out: lpBuffer=0xca0f83c*, lpNumberOfBytesWritten=0xca0f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.487] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0x1d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.487] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.487] CloseHandle (hObject=0xa50) returned 1 [0160.488] VirtualAlloc (lpAddress=0x0, dwSize=0x8b, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\install.ins"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\install.ins.PLAY" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\install.ins.play")) returned 1 [0160.489] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1683 os_tid = 0x19d0 [0160.605] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0160.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0160.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f060c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0160.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0160.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0624, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0160.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0160.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f063c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0160.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0160.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0654, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0160.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0160.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f066c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0160.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0160.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0684, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc [0160.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0160.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f069c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0160.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0160.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0160.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0160.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0160.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0160.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0160.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0160.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0160.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0160.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0714, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0160.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0160.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f072c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0160.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0160.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0160.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0160.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f075c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0160.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0160.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0774, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0160.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0160.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f078c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0160.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94 [0160.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0160.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0160.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0160.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0160.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0160.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0160.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0160.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0160.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0804, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0160.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0160.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f081c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0160.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0160.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0160.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0160.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f084c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0160.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0160.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0864, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8 [0161.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0161.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f087c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0 [0161.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4 [0161.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0894, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8 [0161.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc [0161.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0161.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0161.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0161.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc [0161.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0 [0161.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4 [0161.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0161.195] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x54c, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0163.882] CloseHandle (hObject=0x54c) returned 1 [0163.882] CloseHandle (hObject=0xd54) returned 1 [0163.882] CloseHandle (hObject=0xd34) returned 1 [0163.882] CloseHandle (hObject=0xa40) returned 1 [0163.882] CloseHandle (hObject=0xde8) returned 1 [0163.882] CloseHandle (hObject=0xde4) returned 1 [0163.882] CloseHandle (hObject=0xde0) returned 1 [0163.882] CloseHandle (hObject=0xddc) returned 1 [0163.882] CloseHandle (hObject=0xdd8) returned 1 [0163.882] CloseHandle (hObject=0xdd4) returned 1 [0163.882] CloseHandle (hObject=0xdd0) returned 1 [0163.882] CloseHandle (hObject=0xdcc) returned 1 [0163.882] CloseHandle (hObject=0xdc8) returned 1 [0163.882] CloseHandle (hObject=0xdc4) returned 1 [0163.882] CloseHandle (hObject=0xdc0) returned 1 [0163.882] CloseHandle (hObject=0xdbc) returned 1 [0163.882] CloseHandle (hObject=0xdb8) returned 1 [0163.883] CloseHandle (hObject=0xb4c) returned 1 [0163.883] CloseHandle (hObject=0x610) returned 1 [0163.883] CloseHandle (hObject=0x62c) returned 1 [0163.883] CloseHandle (hObject=0x634) returned 1 [0163.883] CloseHandle (hObject=0x638) returned 1 [0163.883] CloseHandle (hObject=0x63c) returned 1 [0163.883] CloseHandle (hObject=0x450) returned 1 [0163.883] CloseHandle (hObject=0x34c) returned 1 [0163.883] CloseHandle (hObject=0x6e4) returned 1 [0163.883] CloseHandle (hObject=0x6e8) returned 1 [0163.883] CloseHandle (hObject=0x6ec) returned 1 [0163.883] CloseHandle (hObject=0x6f0) returned 1 [0163.883] CloseHandle (hObject=0x6f4) returned 1 [0163.883] CloseHandle (hObject=0x628) returned 1 [0163.883] CloseHandle (hObject=0x22c) returned 1 [0163.883] CloseHandle (hObject=0x70c) returned 1 [0163.883] CloseHandle (hObject=0x6fc) returned 1 [0163.883] CloseHandle (hObject=0xa94) returned 1 [0163.883] CloseHandle (hObject=0x548) returned 1 [0163.883] CloseHandle (hObject=0x544) returned 1 [0163.883] CloseHandle (hObject=0x428) returned 1 [0163.884] CloseHandle (hObject=0x540) returned 1 [0163.884] CloseHandle (hObject=0x444) returned 1 [0163.884] CloseHandle (hObject=0x310) returned 1 [0163.884] CloseHandle (hObject=0x314) returned 1 [0163.884] CloseHandle (hObject=0x440) returned 1 [0163.884] CloseHandle (hObject=0x43c) returned 1 [0163.884] CloseHandle (hObject=0x438) returned 1 [0163.884] CloseHandle (hObject=0x434) returned 1 [0163.884] CloseHandle (hObject=0xa50) returned 1 [0163.884] CloseHandle (hObject=0x2fc) returned 1 [0163.884] CloseHandle (hObject=0xa58) returned 1 [0163.884] CloseHandle (hObject=0xfd0) returned 1 [0163.884] CloseHandle (hObject=0xfd4) returned 1 [0163.884] CloseHandle (hObject=0x10a8) returned 1 [0163.884] CloseHandle (hObject=0x10ac) returned 1 [0163.884] CloseHandle (hObject=0x10b0) returned 1 [0163.884] CloseHandle (hObject=0x10b4) returned 1 [0163.884] CloseHandle (hObject=0x10b8) returned 1 [0163.884] CloseHandle (hObject=0x10bc) returned 1 [0163.884] CloseHandle (hObject=0x10c0) returned 1 [0163.884] CloseHandle (hObject=0x10c4) returned 1 [0163.884] CloseHandle (hObject=0x10c8) returned 1 [0163.885] CloseHandle (hObject=0x10cc) returned 1 [0163.885] CloseHandle (hObject=0x10d0) returned 1 [0163.885] CloseHandle (hObject=0x10d4) returned 1 [0163.885] CloseHandle (hObject=0x10d8) returned 1 [0163.885] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1684 os_tid = 0x19d4 [0160.686] GetLastError () returned 0x57 [0160.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b2d30 [0160.686] SetLastError (dwErrCode=0x57) [0160.686] IcmpCreateFile () returned 0x1a6f2650 [0160.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762060 [0160.687] IcmpSendEcho2 (IcmpHandle=0x1a6f2650, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8100a8c0, RequestData=0xbb0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762060, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1685 os_tid = 0x19d8 [0160.688] GetLastError () returned 0x57 [0160.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b30b8 [0160.688] SetLastError (dwErrCode=0x57) [0160.688] IcmpCreateFile () returned 0x1a6f2688 [0160.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7620b0 [0160.688] IcmpSendEcho2 (IcmpHandle=0x1a6f2688, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8200a8c0, RequestData=0xbc4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7620b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1686 os_tid = 0x19dc [0160.689] GetLastError () returned 0x57 [0160.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3440 [0160.690] SetLastError (dwErrCode=0x57) [0160.690] IcmpCreateFile () returned 0x1a6f26c0 [0160.690] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762100 [0160.690] IcmpSendEcho2 (IcmpHandle=0x1a6f26c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8300a8c0, RequestData=0xbd8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762100, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1687 os_tid = 0x19e0 [0160.691] GetLastError () returned 0x57 [0160.691] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b37c8 [0160.691] SetLastError (dwErrCode=0x57) [0160.691] IcmpCreateFile () returned 0x1a6f26f8 [0160.691] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762150 [0160.691] IcmpSendEcho2 (IcmpHandle=0x1a6f26f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8400a8c0, RequestData=0xbecff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762150, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1688 os_tid = 0x19e4 [0160.692] GetLastError () returned 0x57 [0160.692] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3b50 [0160.692] SetLastError (dwErrCode=0x57) [0160.692] IcmpCreateFile () returned 0x1a6f2730 [0160.692] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761ac0 [0160.692] IcmpSendEcho2 (IcmpHandle=0x1a6f2730, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8500a8c0, RequestData=0xc00ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761ac0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1689 os_tid = 0x19e8 [0160.693] GetLastError () returned 0x57 [0160.693] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b3ed8 [0160.693] SetLastError (dwErrCode=0x57) [0160.693] IcmpCreateFile () returned 0x1a6f2768 [0160.693] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761b10 [0160.693] IcmpSendEcho2 (IcmpHandle=0x1a6f2768, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8600a8c0, RequestData=0xc14ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761b10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1690 os_tid = 0x19ec [0160.694] GetLastError () returned 0x57 [0160.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4260 [0160.695] SetLastError (dwErrCode=0x57) [0160.695] IcmpCreateFile () returned 0x1a6f20a0 [0160.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761c50 [0160.695] IcmpSendEcho2 (IcmpHandle=0x1a6f20a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8700a8c0, RequestData=0xc28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761c50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1691 os_tid = 0x19f0 [0160.696] GetLastError () returned 0x57 [0160.696] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b45e8 [0160.696] SetLastError (dwErrCode=0x57) [0160.696] IcmpCreateFile () returned 0x1a6f2110 [0160.696] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761ca0 [0160.696] IcmpSendEcho2 (IcmpHandle=0x1a6f2110, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8800a8c0, RequestData=0xc3cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761ca0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1692 os_tid = 0x19f4 [0160.697] GetLastError () returned 0x57 [0160.697] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b4970 [0160.697] SetLastError (dwErrCode=0x57) [0160.697] IcmpCreateFile () returned 0x1a6f2148 [0160.697] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761cf0 [0160.697] IcmpSendEcho2 (IcmpHandle=0x1a6f2148, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8900a8c0, RequestData=0xc50ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761cf0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1693 os_tid = 0x19f8 [0160.698] GetLastError () returned 0x57 [0160.698] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5b18 [0160.698] SetLastError (dwErrCode=0x57) [0160.698] IcmpCreateFile () returned 0x1a6f2180 [0160.698] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761d40 [0160.698] IcmpSendEcho2 (IcmpHandle=0x1a6f2180, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8a00a8c0, RequestData=0xc64ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761d40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1694 os_tid = 0x19fc [0160.699] GetLastError () returned 0x57 [0160.699] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b5ea0 [0160.700] SetLastError (dwErrCode=0x57) [0160.700] IcmpCreateFile () returned 0x1a6f21b8 [0160.700] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761d90 [0160.700] IcmpSendEcho2 (IcmpHandle=0x1a6f21b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8b00a8c0, RequestData=0xc78ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761d90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1695 os_tid = 0x1a00 [0160.701] GetLastError () returned 0x57 [0160.701] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b6228 [0160.701] SetLastError (dwErrCode=0x57) [0160.701] IcmpCreateFile () returned 0x1a6f21f0 [0160.701] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761de0 [0160.701] IcmpSendEcho2 (IcmpHandle=0x1a6f21f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8c00a8c0, RequestData=0xc8cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761de0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1696 os_tid = 0x1a04 [0160.702] GetLastError () returned 0x57 [0160.702] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b65b0 [0160.702] SetLastError (dwErrCode=0x57) [0160.702] IcmpCreateFile () returned 0x1a6f2228 [0160.702] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761e30 [0160.702] IcmpSendEcho2 (IcmpHandle=0x1a6f2228, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8d00a8c0, RequestData=0xca0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761e30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1697 os_tid = 0x1a08 [0160.703] GetLastError () returned 0x57 [0160.703] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b6938 [0160.703] SetLastError (dwErrCode=0x57) [0160.703] IcmpCreateFile () returned 0x1a6f2340 [0160.703] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761e80 [0160.704] IcmpSendEcho2 (IcmpHandle=0x1a6f2340, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8e00a8c0, RequestData=0xcb4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761e80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1698 os_tid = 0x1a0c [0160.704] GetLastError () returned 0x57 [0160.704] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7afbc0 [0160.705] SetLastError (dwErrCode=0x57) [0160.705] IcmpCreateFile () returned 0x1a6f2378 [0160.705] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761ed0 [0160.705] IcmpSendEcho2 (IcmpHandle=0x1a6f2378, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8f00a8c0, RequestData=0xcc8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761ed0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1699 os_tid = 0x1a10 [0160.706] GetLastError () returned 0x57 [0160.706] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aff48 [0160.706] SetLastError (dwErrCode=0x57) [0160.706] IcmpCreateFile () returned 0x1a6f23b0 [0160.706] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761f70 [0160.706] IcmpSendEcho2 (IcmpHandle=0x1a6f23b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9000a8c0, RequestData=0xcdcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761f70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1700 os_tid = 0x1a14 [0160.707] GetLastError () returned 0x57 [0160.707] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b02d0 [0160.707] SetLastError (dwErrCode=0x57) [0160.707] IcmpCreateFile () returned 0x1a6f23e8 [0160.707] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x761fc0 [0160.707] IcmpSendEcho2 (IcmpHandle=0x1a6f23e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9100a8c0, RequestData=0xcf0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x761fc0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1701 os_tid = 0x1a18 [0160.708] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.708] ReadFile (in: hFile=0xdb4, lpBuffer=0xd04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd04f85c, lpOverlapped=0x0 | out: lpBuffer=0xd04fb34*, lpNumberOfBytesRead=0xd04f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.724] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.724] ReadFile (in: hFile=0xdb4, lpBuffer=0xd04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd04f85c, lpOverlapped=0x0 | out: lpBuffer=0xd04fb34*, lpNumberOfBytesRead=0xd04f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.724] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.725] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.725] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xd04f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0160.725] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xd04f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xd04f828, pbKeyObject=0x0) returned 0x0 [0160.725] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd04f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd04f500) returned 0x0 [0160.726] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.726] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd04f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd04f500) returned 0x0 [0160.729] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.731] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.731] WriteFile (in: hFile=0xdb4, lpBuffer=0xd04fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd04f830, lpOverlapped=0x0 | out: lpBuffer=0xd04fb34*, lpNumberOfBytesWritten=0xd04f830*=0x428, lpOverlapped=0x0) returned 1 [0160.731] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.731] ReadFile (in: hFile=0xdb4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x43e4, lpNumberOfBytesRead=0xd04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xd04f61c*=0x43e4, lpOverlapped=0x0) returned 1 [0160.737] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0xffffbc1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.738] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2750000, cbInput=0x43e4, pPaddingInfo=0x0, pbIV=0xd04f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xd04f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xd04f848, pbOutput=0x2750000, pcbResult=0xd04f618) returned 0x0 [0160.738] WriteFile (in: hFile=0xdb4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x43f0, lpNumberOfBytesWritten=0xd04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xd04f61c*=0x43f0, lpOverlapped=0x0) returned 1 [0160.738] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd04f60c | out: lpNewFilePointer=0x0) returned 1 [0160.738] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.738] WriteFile (in: hFile=0xdb4, lpBuffer=0xd04f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd04f61c, lpOverlapped=0x0 | out: lpBuffer=0xd04f83c*, lpNumberOfBytesWritten=0xd04f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.738] SetFilePointerEx (in: hFile=0xdb4, liDistanceToMove=0x43f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.738] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0160.738] CloseHandle (hObject=0xdb4) returned 1 [0160.738] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0160.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl.play")) returned 1 [0160.741] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1702 os_tid = 0x1a1c [0160.711] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.711] ReadFile (in: hFile=0xdac, lpBuffer=0xd18fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd18f85c, lpOverlapped=0x0 | out: lpBuffer=0xd18fb34*, lpNumberOfBytesRead=0xd18f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.713] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.713] ReadFile (in: hFile=0xdac, lpBuffer=0xd18fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd18f85c, lpOverlapped=0x0 | out: lpBuffer=0xd18fb34*, lpNumberOfBytesRead=0xd18f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.713] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.716] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.717] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xd18f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0160.717] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xd18f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xd18f828, pbKeyObject=0x0) returned 0x0 [0160.717] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd18f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd18f500) returned 0x0 [0160.717] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.717] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd18f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd18f500) returned 0x0 [0160.720] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.723] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.723] WriteFile (in: hFile=0xdac, lpBuffer=0xd18fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd18f830, lpOverlapped=0x0 | out: lpBuffer=0xd18fb34*, lpNumberOfBytesWritten=0xd18f830*=0x428, lpOverlapped=0x0) returned 1 [0160.723] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.723] ReadFile (in: hFile=0xdac, lpBuffer=0x2850000, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0xd18f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xd18f61c*=0x49ba, lpOverlapped=0x0) returned 1 [0160.732] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xffffb646, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.732] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2850000, cbInput=0x49ba, pPaddingInfo=0x0, pbIV=0xd18f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xd18f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xd18f848, pbOutput=0x2850000, pcbResult=0xd18f618) returned 0x0 [0160.732] WriteFile (in: hFile=0xdac, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0xd18f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xd18f61c*=0x49c0, lpOverlapped=0x0) returned 1 [0160.732] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd18f60c | out: lpNewFilePointer=0x0) returned 1 [0160.732] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.732] WriteFile (in: hFile=0xdac, lpBuffer=0xd18f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd18f61c, lpOverlapped=0x0 | out: lpBuffer=0xd18f83c*, lpNumberOfBytesWritten=0xd18f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.732] SetFilePointerEx (in: hFile=0xdac, liDistanceToMove=0x49c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.732] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0160.732] CloseHandle (hObject=0xdac) returned 1 [0160.733] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0160.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl.play")) returned 1 [0160.735] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1703 os_tid = 0x1a20 [0160.744] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.744] ReadFile (in: hFile=0xda4, lpBuffer=0xd2cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd2cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd2cfb34*, lpNumberOfBytesRead=0xd2cf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.746] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.746] ReadFile (in: hFile=0xda4, lpBuffer=0xd2cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd2cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd2cfb34*, lpNumberOfBytesRead=0xd2cf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.746] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.748] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.748] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xd2cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0160.748] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xd2cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xd2cf828, pbKeyObject=0x0) returned 0x0 [0160.749] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd2cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd2cf500) returned 0x0 [0160.749] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.749] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd2cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd2cf500) returned 0x0 [0160.753] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.756] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.756] WriteFile (in: hFile=0xda4, lpBuffer=0xd2cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd2cf830, lpOverlapped=0x0 | out: lpBuffer=0xd2cfb34*, lpNumberOfBytesWritten=0xd2cf830*=0x428, lpOverlapped=0x0) returned 1 [0160.756] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.756] ReadFile (in: hFile=0xda4, lpBuffer=0x2950000, nNumberOfBytesToRead=0x75ab, lpNumberOfBytesRead=0xd2cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xd2cf61c*=0x75ab, lpOverlapped=0x0) returned 1 [0160.758] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0xffff8a55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.758] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2950000, cbInput=0x75ab, pPaddingInfo=0x0, pbIV=0xd2cf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xd2cf618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xd2cf848, pbOutput=0x2950000, pcbResult=0xd2cf618) returned 0x0 [0160.759] WriteFile (in: hFile=0xda4, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0xd2cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xd2cf61c*=0x75b0, lpOverlapped=0x0) returned 1 [0160.759] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd2cf60c | out: lpNewFilePointer=0x0) returned 1 [0160.759] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.759] WriteFile (in: hFile=0xda4, lpBuffer=0xd2cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd2cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd2cf83c*, lpNumberOfBytesWritten=0xd2cf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.759] SetFilePointerEx (in: hFile=0xda4, liDistanceToMove=0x75b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.759] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.759] CloseHandle (hObject=0xda4) returned 1 [0160.759] VirtualAlloc (lpAddress=0x0, dwSize=0xc3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0160.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl.play")) returned 1 [0160.762] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1704 os_tid = 0x1a24 [0160.780] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.780] ReadFile (in: hFile=0xd9c, lpBuffer=0xd40fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd40f85c, lpOverlapped=0x0 | out: lpBuffer=0xd40fb34*, lpNumberOfBytesRead=0xd40f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.818] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.818] ReadFile (in: hFile=0xd9c, lpBuffer=0xd40fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd40f85c, lpOverlapped=0x0 | out: lpBuffer=0xd40fb34*, lpNumberOfBytesRead=0xd40f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.818] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.820] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.820] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xd40f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0160.820] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xd40f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xd40f828, pbKeyObject=0x0) returned 0x0 [0160.820] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd40f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd40f500) returned 0x0 [0160.820] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.820] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd40f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd40f500) returned 0x0 [0160.825] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.836] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.836] WriteFile (in: hFile=0xd9c, lpBuffer=0xd40fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd40f830, lpOverlapped=0x0 | out: lpBuffer=0xd40fb34*, lpNumberOfBytesWritten=0xd40f830*=0x428, lpOverlapped=0x0) returned 1 [0160.837] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.837] ReadFile (in: hFile=0xd9c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1816e, lpNumberOfBytesRead=0xd40f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xd40f61c*=0x1816e, lpOverlapped=0x0) returned 1 [0161.012] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0xfffe7e92, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.012] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2a50000, cbInput=0x1816e, pPaddingInfo=0x0, pbIV=0xd40f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xd40f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xd40f848, pbOutput=0x2a50000, pcbResult=0xd40f618) returned 0x0 [0161.013] WriteFile (in: hFile=0xd9c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x18170, lpNumberOfBytesWritten=0xd40f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xd40f61c*=0x18170, lpOverlapped=0x0) returned 1 [0161.013] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd40f60c | out: lpNewFilePointer=0x0) returned 1 [0161.013] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.013] WriteFile (in: hFile=0xd9c, lpBuffer=0xd40f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd40f61c, lpOverlapped=0x0 | out: lpBuffer=0xd40f83c*, lpNumberOfBytesWritten=0xd40f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.014] SetFilePointerEx (in: hFile=0xd9c, liDistanceToMove=0x18170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.014] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.014] CloseHandle (hObject=0xd9c) returned 1 [0161.014] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl.play")) returned 1 [0161.016] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1705 os_tid = 0x1a28 [0160.781] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.781] ReadFile (in: hFile=0xd94, lpBuffer=0xd54fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd54f85c, lpOverlapped=0x0 | out: lpBuffer=0xd54fb34*, lpNumberOfBytesRead=0xd54f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.783] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.783] ReadFile (in: hFile=0xd94, lpBuffer=0xd54fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd54f85c, lpOverlapped=0x0 | out: lpBuffer=0xd54fb34*, lpNumberOfBytesRead=0xd54f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.783] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.785] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xd54f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0160.785] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xd54f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xd54f828, pbKeyObject=0x0) returned 0x0 [0160.785] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd54f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd54f500) returned 0x0 [0160.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.785] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd54f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd54f500) returned 0x0 [0160.790] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.792] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.792] WriteFile (in: hFile=0xd94, lpBuffer=0xd54fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd54f830, lpOverlapped=0x0 | out: lpBuffer=0xd54fb34*, lpNumberOfBytesWritten=0xd54f830*=0x428, lpOverlapped=0x0) returned 1 [0160.793] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.793] ReadFile (in: hFile=0xd94, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x7b27, lpNumberOfBytesRead=0xd54f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xd54f61c*=0x7b27, lpOverlapped=0x0) returned 1 [0160.794] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0xffff84d9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.794] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2b50000, cbInput=0x7b27, pPaddingInfo=0x0, pbIV=0xd54f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xd54f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xd54f848, pbOutput=0x2b50000, pcbResult=0xd54f618) returned 0x0 [0160.794] WriteFile (in: hFile=0xd94, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x7b30, lpNumberOfBytesWritten=0xd54f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xd54f61c*=0x7b30, lpOverlapped=0x0) returned 1 [0160.794] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd54f60c | out: lpNewFilePointer=0x0) returned 1 [0160.794] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.794] WriteFile (in: hFile=0xd94, lpBuffer=0xd54f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd54f61c, lpOverlapped=0x0 | out: lpBuffer=0xd54f83c*, lpNumberOfBytesWritten=0xd54f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.794] SetFilePointerEx (in: hFile=0xd94, liDistanceToMove=0x7b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.794] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.795] CloseHandle (hObject=0xd94) returned 1 [0160.795] VirtualAlloc (lpAddress=0x0, dwSize=0xc3, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0160.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl.play")) returned 1 [0160.797] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1706 os_tid = 0x1a2c [0160.800] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.800] ReadFile (in: hFile=0xd8c, lpBuffer=0xd68fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd68f85c, lpOverlapped=0x0 | out: lpBuffer=0xd68fb34*, lpNumberOfBytesRead=0xd68f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.911] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.911] ReadFile (in: hFile=0xd8c, lpBuffer=0xd68fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd68f85c, lpOverlapped=0x0 | out: lpBuffer=0xd68fb34*, lpNumberOfBytesRead=0xd68f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.911] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.912] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.912] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xd68f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0160.912] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xd68f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xd68f828, pbKeyObject=0x0) returned 0x0 [0160.912] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd68f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd68f500) returned 0x0 [0160.912] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.913] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd68f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd68f500) returned 0x0 [0160.916] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.918] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.918] WriteFile (in: hFile=0xd8c, lpBuffer=0xd68fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd68f830, lpOverlapped=0x0 | out: lpBuffer=0xd68fb34*, lpNumberOfBytesWritten=0xd68f830*=0x428, lpOverlapped=0x0) returned 1 [0160.918] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.918] ReadFile (in: hFile=0xd8c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x7339, lpNumberOfBytesRead=0xd68f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xd68f61c*=0x7339, lpOverlapped=0x0) returned 1 [0161.048] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xffff8cc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.048] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2c50000, cbInput=0x7339, pPaddingInfo=0x0, pbIV=0xd68f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xd68f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xd68f848, pbOutput=0x2c50000, pcbResult=0xd68f618) returned 0x0 [0161.048] WriteFile (in: hFile=0xd8c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x7340, lpNumberOfBytesWritten=0xd68f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xd68f61c*=0x7340, lpOverlapped=0x0) returned 1 [0161.048] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd68f60c | out: lpNewFilePointer=0x0) returned 1 [0161.048] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.048] WriteFile (in: hFile=0xd8c, lpBuffer=0xd68f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd68f61c, lpOverlapped=0x0 | out: lpBuffer=0xd68f83c*, lpNumberOfBytesWritten=0xd68f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.049] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x7340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.049] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0161.049] CloseHandle (hObject=0xd8c) returned 1 [0161.049] VirtualAlloc (lpAddress=0x0, dwSize=0xbd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl.play")) returned 1 [0161.051] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1707 os_tid = 0x1a30 [0160.801] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.802] ReadFile (in: hFile=0x990, lpBuffer=0xd7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd7cfb34*, lpNumberOfBytesRead=0xd7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.920] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.920] ReadFile (in: hFile=0x990, lpBuffer=0xd7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd7cfb34*, lpNumberOfBytesRead=0xd7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.920] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.921] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.922] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xd7cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0160.922] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xd7cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xd7cf828, pbKeyObject=0x0) returned 0x0 [0160.922] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd7cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd7cf500) returned 0x0 [0160.922] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.922] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd7cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd7cf500) returned 0x0 [0160.925] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.927] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.927] WriteFile (in: hFile=0x990, lpBuffer=0xd7cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd7cf830, lpOverlapped=0x0 | out: lpBuffer=0xd7cfb34*, lpNumberOfBytesWritten=0xd7cf830*=0x428, lpOverlapped=0x0) returned 1 [0160.927] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.927] ReadFile (in: hFile=0x990, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x8a2a, lpNumberOfBytesRead=0xd7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xd7cf61c*=0x8a2a, lpOverlapped=0x0) returned 1 [0161.039] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0xffff75d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.039] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x2d50000, cbInput=0x8a2a, pPaddingInfo=0x0, pbIV=0xd7cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xd7cf618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0xd7cf848, pbOutput=0x2d50000, pcbResult=0xd7cf618) returned 0x0 [0161.039] WriteFile (in: hFile=0x990, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x8a30, lpNumberOfBytesWritten=0xd7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xd7cf61c*=0x8a30, lpOverlapped=0x0) returned 1 [0161.042] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd7cf60c | out: lpNewFilePointer=0x0) returned 1 [0161.042] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.042] WriteFile (in: hFile=0x990, lpBuffer=0xd7cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd7cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd7cf83c*, lpNumberOfBytesWritten=0xd7cf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.042] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0x8a30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.042] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0161.042] CloseHandle (hObject=0x990) returned 1 [0161.042] VirtualAlloc (lpAddress=0x0, dwSize=0xbd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl.play")) returned 1 [0161.045] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1708 os_tid = 0x1a34 [0160.803] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.803] ReadFile (in: hFile=0x5e4, lpBuffer=0xd90fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd90f85c, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesRead=0xd90f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.920] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.920] ReadFile (in: hFile=0x5e4, lpBuffer=0xd90fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd90f85c, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesRead=0xd90f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.053] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.054] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.054] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xd90f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0161.054] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xd90f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xd90f828, pbKeyObject=0x0) returned 0x0 [0161.054] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd90f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd90f500) returned 0x0 [0161.054] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.054] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd90f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd90f500) returned 0x0 [0161.058] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.059] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.059] WriteFile (in: hFile=0x5e4, lpBuffer=0xd90fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd90f830, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesWritten=0xd90f830*=0x428, lpOverlapped=0x0) returned 1 [0161.059] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.060] ReadFile (in: hFile=0x5e4, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x858c, lpNumberOfBytesRead=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xd90f61c*=0x858c, lpOverlapped=0x0) returned 1 [0161.142] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0xffff7a74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.142] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2f50000, cbInput=0x858c, pPaddingInfo=0x0, pbIV=0xd90f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xd90f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xd90f848, pbOutput=0x2f50000, pcbResult=0xd90f618) returned 0x0 [0161.142] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x8590, lpNumberOfBytesWritten=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xd90f61c*=0x8590, lpOverlapped=0x0) returned 1 [0161.143] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd90f60c | out: lpNewFilePointer=0x0) returned 1 [0161.143] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.143] WriteFile (in: hFile=0x5e4, lpBuffer=0xd90f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0xd90f83c*, lpNumberOfBytesWritten=0xd90f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.143] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x8590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.143] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0161.143] CloseHandle (hObject=0x5e4) returned 1 [0161.143] VirtualAlloc (lpAddress=0x0, dwSize=0xc1, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl.play")) returned 1 [0161.145] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1709 os_tid = 0x1a38 [0160.804] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.805] ReadFile (in: hFile=0x5ec, lpBuffer=0xda4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda4f85c, lpOverlapped=0x0 | out: lpBuffer=0xda4fb34*, lpNumberOfBytesRead=0xda4f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.806] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.806] ReadFile (in: hFile=0x5ec, lpBuffer=0xda4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda4f85c, lpOverlapped=0x0 | out: lpBuffer=0xda4fb34*, lpNumberOfBytesRead=0xda4f85c*=0x428, lpOverlapped=0x0) returned 1 [0160.807] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.808] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.808] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xda4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0160.808] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xda4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xda4f828, pbKeyObject=0x0) returned 0x0 [0160.808] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xda4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xda4f500) returned 0x0 [0160.809] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.809] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xda4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xda4f500) returned 0x0 [0160.814] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.816] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.816] WriteFile (in: hFile=0x5ec, lpBuffer=0xda4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xda4f830, lpOverlapped=0x0 | out: lpBuffer=0xda4fb34*, lpNumberOfBytesWritten=0xda4f830*=0x428, lpOverlapped=0x0) returned 1 [0160.817] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.817] ReadFile (in: hFile=0x5ec, lpBuffer=0x3050000, nNumberOfBytesToRead=0x7e02, lpNumberOfBytesRead=0xda4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xda4f61c*=0x7e02, lpOverlapped=0x0) returned 1 [0160.905] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xffff81fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.905] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3050000, cbInput=0x7e02, pPaddingInfo=0x0, pbIV=0xda4f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xda4f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xda4f848, pbOutput=0x3050000, pcbResult=0xda4f618) returned 0x0 [0160.905] WriteFile (in: hFile=0x5ec, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x7e10, lpNumberOfBytesWritten=0xda4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xda4f61c*=0x7e10, lpOverlapped=0x0) returned 1 [0160.905] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xda4f60c | out: lpNewFilePointer=0x0) returned 1 [0160.905] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.905] WriteFile (in: hFile=0x5ec, lpBuffer=0xda4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xda4f61c, lpOverlapped=0x0 | out: lpBuffer=0xda4f83c*, lpNumberOfBytesWritten=0xda4f61c*=0x8, lpOverlapped=0x0) returned 1 [0160.906] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x7e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.906] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0160.906] CloseHandle (hObject=0x5ec) returned 1 [0160.906] VirtualAlloc (lpAddress=0x0, dwSize=0xbd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0160.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl.play")) returned 1 [0160.908] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1710 os_tid = 0x1a3c [0160.928] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.928] ReadFile (in: hFile=0x5f4, lpBuffer=0xdccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdccf85c, lpOverlapped=0x0 | out: lpBuffer=0xdccfb34*, lpNumberOfBytesRead=0xdccf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.929] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.929] ReadFile (in: hFile=0x5f4, lpBuffer=0xdccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdccf85c, lpOverlapped=0x0 | out: lpBuffer=0xdccfb34*, lpNumberOfBytesRead=0xdccf85c*=0x428, lpOverlapped=0x0) returned 1 [0160.930] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0160.931] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0160.931] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xdccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0160.931] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xdccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xdccf828, pbKeyObject=0x0) returned 0x0 [0160.931] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xdccf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xdccf500) returned 0x0 [0160.931] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0160.931] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xdccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xdccf500) returned 0x0 [0160.935] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.936] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.936] WriteFile (in: hFile=0x5f4, lpBuffer=0xdccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdccf830, lpOverlapped=0x0 | out: lpBuffer=0xdccfb34*, lpNumberOfBytesWritten=0xdccf830*=0x428, lpOverlapped=0x0) returned 1 [0160.937] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.937] ReadFile (in: hFile=0x5f4, lpBuffer=0x3150000, nNumberOfBytesToRead=0x18559, lpNumberOfBytesRead=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xdccf61c*=0x18559, lpOverlapped=0x0) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0xfffe7aa7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.938] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3150000, cbInput=0x18559, pPaddingInfo=0x0, pbIV=0xdccf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xdccf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xdccf848, pbOutput=0x3150000, pcbResult=0xdccf618) returned 0x0 [0160.938] WriteFile (in: hFile=0x5f4, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x18560, lpNumberOfBytesWritten=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xdccf61c*=0x18560, lpOverlapped=0x0) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdccf60c | out: lpNewFilePointer=0x0) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.938] WriteFile (in: hFile=0x5f4, lpBuffer=0xdccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdccf61c, lpOverlapped=0x0 | out: lpBuffer=0xdccf83c*, lpNumberOfBytesWritten=0xdccf61c*=0x8, lpOverlapped=0x0) returned 1 [0160.939] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x18560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.939] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0160.939] CloseHandle (hObject=0x5f4) returned 1 [0160.939] VirtualAlloc (lpAddress=0x0, dwSize=0xbd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0160.940] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl.play")) returned 1 [0160.940] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1711 os_tid = 0x1a40 [0160.943] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.943] ReadFile (in: hFile=0x5fc, lpBuffer=0xde0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xde0f85c, lpOverlapped=0x0 | out: lpBuffer=0xde0fb34*, lpNumberOfBytesRead=0xde0f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.068] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.068] ReadFile (in: hFile=0x5fc, lpBuffer=0xde0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xde0f85c, lpOverlapped=0x0 | out: lpBuffer=0xde0fb34*, lpNumberOfBytesRead=0xde0f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.068] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.070] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.070] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0xde0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0161.070] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0xde0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0xde0f828, pbKeyObject=0x0) returned 0x0 [0161.070] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xde0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xde0f500) returned 0x0 [0161.070] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.070] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xde0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xde0f500) returned 0x0 [0161.074] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.077] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.077] WriteFile (in: hFile=0x5fc, lpBuffer=0xde0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xde0f830, lpOverlapped=0x0 | out: lpBuffer=0xde0fb34*, lpNumberOfBytesWritten=0xde0f830*=0x428, lpOverlapped=0x0) returned 1 [0161.078] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.078] ReadFile (in: hFile=0x5fc, lpBuffer=0x3250000, nNumberOfBytesToRead=0x1393e, lpNumberOfBytesRead=0xde0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0xde0f61c*=0x1393e, lpOverlapped=0x0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xfffec6c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.148] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3250000, cbInput=0x1393e, pPaddingInfo=0x0, pbIV=0xde0f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0xde0f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xde0f848, pbOutput=0x3250000, pcbResult=0xde0f618) returned 0x0 [0161.148] WriteFile (in: hFile=0x5fc, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x13940, lpNumberOfBytesWritten=0xde0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0xde0f61c*=0x13940, lpOverlapped=0x0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xde0f60c | out: lpNewFilePointer=0x0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.148] WriteFile (in: hFile=0x5fc, lpBuffer=0xde0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xde0f61c, lpOverlapped=0x0 | out: lpBuffer=0xde0f83c*, lpNumberOfBytesWritten=0xde0f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0x13940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.148] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.148] CloseHandle (hObject=0x5fc) returned 1 [0161.149] VirtualAlloc (lpAddress=0x0, dwSize=0xbf, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl.play")) returned 1 [0161.151] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1712 os_tid = 0x1a44 [0160.944] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.944] ReadFile (in: hFile=0xa8c, lpBuffer=0xdb8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdb8f85c, lpOverlapped=0x0 | out: lpBuffer=0xdb8fb34*, lpNumberOfBytesRead=0xdb8f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.099] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.099] ReadFile (in: hFile=0xa8c, lpBuffer=0xdb8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdb8f85c, lpOverlapped=0x0 | out: lpBuffer=0xdb8fb34*, lpNumberOfBytesRead=0xdb8f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.325] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0161.326] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0161.326] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xdb8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0161.326] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xdb8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xdb8f828, pbKeyObject=0x0) returned 0x0 [0161.326] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xdb8f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xdb8f500) returned 0x0 [0161.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0161.327] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xdb8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xdb8f500) returned 0x0 [0161.330] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.332] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.332] WriteFile (in: hFile=0xa8c, lpBuffer=0xdb8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdb8f830, lpOverlapped=0x0 | out: lpBuffer=0xdb8fb34*, lpNumberOfBytesWritten=0xdb8f830*=0x428, lpOverlapped=0x0) returned 1 [0161.332] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.332] ReadFile (in: hFile=0xa8c, lpBuffer=0x3350000, nNumberOfBytesToRead=0x76a1, lpNumberOfBytesRead=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xdb8f61c*=0x76a1, lpOverlapped=0x0) returned 1 [0161.517] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xffff895f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.517] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3350000, cbInput=0x76a1, pPaddingInfo=0x0, pbIV=0xdb8f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xdb8f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xdb8f848, pbOutput=0x3350000, pcbResult=0xdb8f618) returned 0x0 [0161.517] WriteFile (in: hFile=0xa8c, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x76b0, lpNumberOfBytesWritten=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xdb8f61c*=0x76b0, lpOverlapped=0x0) returned 1 [0161.517] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdb8f60c | out: lpNewFilePointer=0x0) returned 1 [0161.517] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.517] WriteFile (in: hFile=0xa8c, lpBuffer=0xdb8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdb8f61c, lpOverlapped=0x0 | out: lpBuffer=0xdb8f83c*, lpNumberOfBytesWritten=0xdb8f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.517] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x76b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.517] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0161.517] CloseHandle (hObject=0xa8c) returned 1 [0161.517] VirtualAlloc (lpAddress=0x0, dwSize=0xbf, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0161.519] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl.play")) returned 1 [0161.520] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1713 os_tid = 0x1a48 [0160.945] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.946] ReadFile (in: hFile=0x608, lpBuffer=0xdf4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdf4f85c, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesRead=0xdf4f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.083] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.083] ReadFile (in: hFile=0x608, lpBuffer=0xdf4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdf4f85c, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesRead=0xdf4f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.085] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.085] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xdf4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0161.085] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xdf4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xdf4f828, pbKeyObject=0x0) returned 0x0 [0161.085] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xdf4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xdf4f500) returned 0x0 [0161.085] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.086] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xdf4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xdf4f500) returned 0x0 [0161.089] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.093] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.093] WriteFile (in: hFile=0x608, lpBuffer=0xdf4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdf4f830, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesWritten=0xdf4f830*=0x428, lpOverlapped=0x0) returned 1 [0161.096] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.096] ReadFile (in: hFile=0x608, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x6c42, lpNumberOfBytesRead=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xdf4f61c*=0x6c42, lpOverlapped=0x0) returned 1 [0161.286] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xffff93be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.286] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x2e50000, cbInput=0x6c42, pPaddingInfo=0x0, pbIV=0xdf4f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xdf4f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0xdf4f848, pbOutput=0x2e50000, pcbResult=0xdf4f618) returned 0x0 [0161.286] WriteFile (in: hFile=0x608, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x6c50, lpNumberOfBytesWritten=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xdf4f61c*=0x6c50, lpOverlapped=0x0) returned 1 [0161.286] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdf4f60c | out: lpNewFilePointer=0x0) returned 1 [0161.286] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.287] WriteFile (in: hFile=0x608, lpBuffer=0xdf4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0xdf4f83c*, lpNumberOfBytesWritten=0xdf4f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.287] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x6c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.287] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0161.287] CloseHandle (hObject=0x608) returned 1 [0161.287] VirtualAlloc (lpAddress=0x0, dwSize=0xc5, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl.play")) returned 1 [0161.290] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1714 os_tid = 0x1a4c [0160.947] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.947] ReadFile (in: hFile=0x614, lpBuffer=0xe1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe1cfb34*, lpNumberOfBytesRead=0xe1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.105] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.105] ReadFile (in: hFile=0x614, lpBuffer=0xe1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xe1cfb34*, lpNumberOfBytesRead=0xe1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.105] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.107] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.107] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0xe1cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0161.107] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0xe1cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0xe1cf828, pbKeyObject=0x0) returned 0x0 [0161.107] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe1cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe1cf500) returned 0x0 [0161.107] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.107] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe1cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe1cf500) returned 0x0 [0161.112] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.114] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.114] WriteFile (in: hFile=0x614, lpBuffer=0xe1cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe1cf830, lpOverlapped=0x0 | out: lpBuffer=0xe1cfb34*, lpNumberOfBytesWritten=0xe1cf830*=0x428, lpOverlapped=0x0) returned 1 [0161.115] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.115] ReadFile (in: hFile=0x614, lpBuffer=0x3450000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0xe1cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0161.559] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.559] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3450000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xe1cf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0xe1cf618, dwFlags=0x0 | out: hKey=0x1a6d9240, pbIV=0xe1cf848, pbOutput=0x3450000, pcbResult=0xe1cf618) returned 0x0 [0161.560] WriteFile (in: hFile=0x614, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xe1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0xe1cf61c*=0x100000, lpOverlapped=0x0) returned 1 [0161.563] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe1cf60c | out: lpNewFilePointer=0x0) returned 1 [0161.563] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.563] WriteFile (in: hFile=0x614, lpBuffer=0xe1cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe1cf61c, lpOverlapped=0x0 | out: lpBuffer=0xe1cf83c*, lpNumberOfBytesWritten=0xe1cf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.563] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.563] ReadFile (in: hFile=0x614, lpBuffer=0x3450000, nNumberOfBytesToRead=0x132d0, lpNumberOfBytesRead=0xe1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0xe1cf61c*=0x132d0, lpOverlapped=0x0) returned 1 [0161.719] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffecd30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.719] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3450000, cbInput=0x132d0, pPaddingInfo=0x0, pbIV=0xe1cf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0xe1cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xe1cf848, pbOutput=0x3450000, pcbResult=0xe1cf618) returned 0x0 [0161.720] WriteFile (in: hFile=0x614, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x132e0, lpNumberOfBytesWritten=0xe1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0xe1cf61c*=0x132e0, lpOverlapped=0x0) returned 1 [0161.720] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe1cf60c | out: lpNewFilePointer=0x0) returned 1 [0161.720] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.720] WriteFile (in: hFile=0x614, lpBuffer=0xe1cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe1cf61c, lpOverlapped=0x0 | out: lpBuffer=0xe1cf83c*, lpNumberOfBytesWritten=0xe1cf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.720] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x1132e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.720] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0161.720] CloseHandle (hObject=0x614) returned 1 [0161.720] VirtualAlloc (lpAddress=0x0, dwSize=0xc9, flAllocationType=0x1000, flProtect=0x4) returned 0xdad0000 [0161.721] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll.play")) returned 1 [0161.722] VirtualFree (lpAddress=0xdad0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1715 os_tid = 0x1a50 [0160.948] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.948] ReadFile (in: hFile=0x5d4, lpBuffer=0xe30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe30f85c, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesRead=0xe30f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.104] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.104] ReadFile (in: hFile=0x5d4, lpBuffer=0xe30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe30f85c, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesRead=0xe30f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.315] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0161.316] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0161.316] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0xe30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0161.316] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0xe30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0xe30f828, pbKeyObject=0x0) returned 0x0 [0161.316] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xe30f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xe30f500) returned 0x0 [0161.316] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0161.317] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xe30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xe30f500) returned 0x0 [0161.320] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.322] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.322] WriteFile (in: hFile=0x5d4, lpBuffer=0xe30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe30f830, lpOverlapped=0x0 | out: lpBuffer=0xe30fb34*, lpNumberOfBytesWritten=0xe30f830*=0x428, lpOverlapped=0x0) returned 1 [0161.322] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.323] ReadFile (in: hFile=0x5d4, lpBuffer=0x3550000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0xe30f61c*=0x100000, lpOverlapped=0x0) returned 1 [0161.670] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.670] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3550000, cbInput=0x100000, pPaddingInfo=0x0, pbIV=0xe30f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0xe30f618, dwFlags=0x0 | out: hKey=0x1a6d8fb0, pbIV=0xe30f848, pbOutput=0x3550000, pcbResult=0xe30f618) returned 0x0 [0161.671] WriteFile (in: hFile=0x5d4, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0xe30f61c*=0x100000, lpOverlapped=0x0) returned 1 [0161.674] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe30f60c | out: lpNewFilePointer=0x0) returned 1 [0161.674] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.674] WriteFile (in: hFile=0x5d4, lpBuffer=0xe30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0xe30f83c*, lpNumberOfBytesWritten=0xe30f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.674] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.674] ReadFile (in: hFile=0x5d4, lpBuffer=0x3550000, nNumberOfBytesToRead=0x126d0, lpNumberOfBytesRead=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0xe30f61c*=0x126d0, lpOverlapped=0x0) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffed930, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.740] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3550000, cbInput=0x126d0, pPaddingInfo=0x0, pbIV=0xe30f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0xe30f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0xe30f848, pbOutput=0x3550000, pcbResult=0xe30f618) returned 0x0 [0161.740] WriteFile (in: hFile=0x5d4, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x126e0, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0xe30f61c*=0x126e0, lpOverlapped=0x0) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe30f60c | out: lpNewFilePointer=0x0) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.740] WriteFile (in: hFile=0x5d4, lpBuffer=0xe30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe30f61c, lpOverlapped=0x0 | out: lpBuffer=0xe30f83c*, lpNumberOfBytesWritten=0xe30f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x1126e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.740] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0161.740] CloseHandle (hObject=0x5d4) returned 1 [0161.741] VirtualAlloc (lpAddress=0x0, dwSize=0xcb, flAllocationType=0x1000, flProtect=0x4) returned 0xdad0000 [0161.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll.play")) returned 1 [0161.784] VirtualFree (lpAddress=0xdad0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1716 os_tid = 0x1a54 [0160.950] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.950] ReadFile (in: hFile=0x620, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.104] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.104] ReadFile (in: hFile=0x620, lpBuffer=0xe44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe44f85c, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesRead=0xe44f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0161.302] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0161.302] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0xe44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0161.302] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0xe44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0xe44f828, pbKeyObject=0x0) returned 0x0 [0161.302] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xe44f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xe44f500) returned 0x0 [0161.302] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0161.302] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xe44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xe44f500) returned 0x0 [0161.306] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.308] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.308] WriteFile (in: hFile=0x620, lpBuffer=0xe44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe44f830, lpOverlapped=0x0 | out: lpBuffer=0xe44fb34*, lpNumberOfBytesWritten=0xe44f830*=0x428, lpOverlapped=0x0) returned 1 [0161.309] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.309] ReadFile (in: hFile=0x620, lpBuffer=0x3650000, nNumberOfBytesToRead=0x3728, lpNumberOfBytesRead=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0xe44f61c*=0x3728, lpOverlapped=0x0) returned 1 [0161.464] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0xffffc8d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.464] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3650000, cbInput=0x3728, pPaddingInfo=0x0, pbIV=0xe44f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0xe44f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xe44f848, pbOutput=0x3650000, pcbResult=0xe44f618) returned 0x0 [0161.464] WriteFile (in: hFile=0x620, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x3730, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0xe44f61c*=0x3730, lpOverlapped=0x0) returned 1 [0161.464] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe44f60c | out: lpNewFilePointer=0x0) returned 1 [0161.464] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.464] WriteFile (in: hFile=0x620, lpBuffer=0xe44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe44f61c, lpOverlapped=0x0 | out: lpBuffer=0xe44f83c*, lpNumberOfBytesWritten=0xe44f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.464] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x3730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.464] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0161.464] CloseHandle (hObject=0x620) returned 1 [0161.465] VirtualAlloc (lpAddress=0x0, dwSize=0xcd, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.PLAY" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll.play")) returned 1 [0161.468] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1717 os_tid = 0x1a58 [0160.951] GetLastError () returned 0x57 [0160.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b09e0 [0160.952] SetLastError (dwErrCode=0x57) [0160.952] IcmpCreateFile () returned 0x1a6f25a8 [0160.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762010 [0160.952] IcmpSendEcho2 (IcmpHandle=0x1a6f25a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9200a8c0, RequestData=0xe58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762010, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1718 os_tid = 0x1a5c [0160.953] GetLastError () returned 0x57 [0160.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b0d68 [0160.953] SetLastError (dwErrCode=0x57) [0160.953] IcmpCreateFile () returned 0x1a6f25e0 [0160.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762420 [0160.953] IcmpSendEcho2 (IcmpHandle=0x1a6f25e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9300a8c0, RequestData=0xe6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762420, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1719 os_tid = 0x1a60 [0160.954] GetLastError () returned 0x57 [0160.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b10f0 [0160.954] SetLastError (dwErrCode=0x57) [0160.954] IcmpCreateFile () returned 0x1a6f2618 [0160.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762470 [0160.954] IcmpSendEcho2 (IcmpHandle=0x1a6f2618, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9400a8c0, RequestData=0xe94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762470, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1720 os_tid = 0x1a64 [0160.955] GetLastError () returned 0x57 [0160.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1478 [0160.956] SetLastError (dwErrCode=0x57) [0160.956] IcmpCreateFile () returned 0x1a6f2420 [0160.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7624c0 [0160.956] IcmpSendEcho2 (IcmpHandle=0x1a6f2420, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9500a8c0, RequestData=0xea8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7624c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1721 os_tid = 0x1a68 [0160.957] GetLastError () returned 0x57 [0160.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1800 [0160.957] SetLastError (dwErrCode=0x57) [0160.957] IcmpCreateFile () returned 0x1a6f2490 [0160.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762510 [0160.957] IcmpSendEcho2 (IcmpHandle=0x1a6f2490, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9600a8c0, RequestData=0xebcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762510, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1722 os_tid = 0x1a6c [0160.958] GetLastError () returned 0x57 [0160.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1b88 [0160.958] SetLastError (dwErrCode=0x57) [0160.958] IcmpCreateFile () returned 0x1a6f24c8 [0160.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762560 [0160.958] IcmpSendEcho2 (IcmpHandle=0x1a6f24c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9700a8c0, RequestData=0xed0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762560, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1723 os_tid = 0x1a70 [0160.959] GetLastError () returned 0x57 [0160.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b1f10 [0160.959] SetLastError (dwErrCode=0x57) [0160.959] IcmpCreateFile () returned 0x1a6f2500 [0160.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7625b0 [0160.960] IcmpSendEcho2 (IcmpHandle=0x1a6f2500, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9800a8c0, RequestData=0xee4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7625b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1724 os_tid = 0x1a74 [0160.960] GetLastError () returned 0x57 [0160.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b7048 [0160.961] SetLastError (dwErrCode=0x57) [0160.961] IcmpCreateFile () returned 0x1a6f2538 [0160.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762600 [0160.961] IcmpSendEcho2 (IcmpHandle=0x1a6f2538, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9900a8c0, RequestData=0xf0cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762600, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1725 os_tid = 0x1a78 [0160.962] GetLastError () returned 0x57 [0160.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b73d0 [0160.962] SetLastError (dwErrCode=0x57) [0160.962] IcmpCreateFile () returned 0x1a6f2570 [0160.962] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762650 [0160.962] IcmpSendEcho2 (IcmpHandle=0x1a6f2570, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9a00a8c0, RequestData=0xf34ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762650, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1726 os_tid = 0x1a7c [0160.963] GetLastError () returned 0x57 [0160.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b7758 [0160.963] SetLastError (dwErrCode=0x57) [0160.963] IcmpCreateFile () returned 0x1a6f2810 [0160.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7626a0 [0160.963] IcmpSendEcho2 (IcmpHandle=0x1a6f2810, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9b00a8c0, RequestData=0x10acff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7626a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1727 os_tid = 0x1a80 [0160.964] GetLastError () returned 0x57 [0160.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7b6cc0 [0160.964] SetLastError (dwErrCode=0x57) [0160.964] IcmpCreateFile () returned 0x1a6f27a0 [0160.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7626f0 [0160.964] IcmpSendEcho2 (IcmpHandle=0x1a6f27a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9c00a8c0, RequestData=0x1e9fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7626f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1728 os_tid = 0x1a84 [0160.965] GetLastError () returned 0x57 [0160.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4770 [0160.965] SetLastError (dwErrCode=0x57) [0160.965] IcmpCreateFile () returned 0x1a6f27d8 [0160.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762740 [0160.966] IcmpSendEcho2 (IcmpHandle=0x1a6f27d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9d00a8c0, RequestData=0x1eb3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762740, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1729 os_tid = 0x1a88 [0160.969] GetLastError () returned 0x57 [0160.969] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4af8 [0160.969] SetLastError (dwErrCode=0x57) [0160.969] IcmpCreateFile () returned 0x728da0 [0160.969] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762790 [0160.969] IcmpSendEcho2 (IcmpHandle=0x728da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9e00a8c0, RequestData=0x1ec7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762790, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1730 os_tid = 0x1a8c [0160.970] GetLastError () returned 0x57 [0160.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4e80 [0160.970] SetLastError (dwErrCode=0x57) [0160.970] IcmpCreateFile () returned 0x7286d8 [0160.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7627e0 [0160.970] IcmpSendEcho2 (IcmpHandle=0x7286d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9f00a8c0, RequestData=0x1edbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7627e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1731 os_tid = 0x1a90 [0160.971] GetLastError () returned 0x57 [0160.971] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5208 [0160.972] SetLastError (dwErrCode=0x57) [0160.972] IcmpCreateFile () returned 0x728748 [0160.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762830 [0160.972] IcmpSendEcho2 (IcmpHandle=0x728748, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa000a8c0, RequestData=0x1eefff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762830, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1732 os_tid = 0x1a94 [0160.973] GetLastError () returned 0x57 [0160.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5590 [0160.973] SetLastError (dwErrCode=0x57) [0160.973] IcmpCreateFile () returned 0x728780 [0160.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762880 [0160.973] IcmpSendEcho2 (IcmpHandle=0x728780, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa100a8c0, RequestData=0x1f03ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762880, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1733 os_tid = 0x1a98 [0160.974] GetLastError () returned 0x57 [0160.974] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5918 [0160.974] SetLastError (dwErrCode=0x57) [0160.974] IcmpCreateFile () returned 0x7287b8 [0160.974] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7628d0 [0160.974] IcmpSendEcho2 (IcmpHandle=0x7287b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa200a8c0, RequestData=0x1f17ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7628d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1734 os_tid = 0x1a9c [0160.975] GetLastError () returned 0x57 [0160.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e5ca0 [0160.975] SetLastError (dwErrCode=0x57) [0160.975] IcmpCreateFile () returned 0x728828 [0160.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762920 [0160.975] IcmpSendEcho2 (IcmpHandle=0x728828, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa300a8c0, RequestData=0x1f2bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762920, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1735 os_tid = 0x1aa0 [0160.976] GetLastError () returned 0x57 [0160.976] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6028 [0160.976] SetLastError (dwErrCode=0x57) [0160.976] IcmpCreateFile () returned 0x728860 [0160.976] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x762970 [0160.977] IcmpSendEcho2 (IcmpHandle=0x728860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa400a8c0, RequestData=0x1f3fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x762970, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1736 os_tid = 0x1aa4 [0160.977] GetLastError () returned 0x57 [0160.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e63b0 [0160.978] SetLastError (dwErrCode=0x57) [0160.978] IcmpCreateFile () returned 0x728898 [0160.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b378 [0160.978] IcmpSendEcho2 (IcmpHandle=0x728898, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa500a8c0, RequestData=0x1f53ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b378, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1737 os_tid = 0x1aa8 [0160.979] GetLastError () returned 0x57 [0160.979] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7558 [0160.979] SetLastError (dwErrCode=0x57) [0160.979] IcmpCreateFile () returned 0x7288d0 [0160.979] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b3c8 [0160.979] IcmpSendEcho2 (IcmpHandle=0x7288d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa600a8c0, RequestData=0x1f67ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b3c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1738 os_tid = 0x1aac [0160.980] GetLastError () returned 0x57 [0160.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e78e0 [0160.980] SetLastError (dwErrCode=0x57) [0160.980] IcmpCreateFile () returned 0x728908 [0160.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b418 [0160.980] IcmpSendEcho2 (IcmpHandle=0x728908, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa700a8c0, RequestData=0x1f7bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b418, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1739 os_tid = 0x1ab0 [0160.981] GetLastError () returned 0x57 [0160.981] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7c68 [0160.982] SetLastError (dwErrCode=0x57) [0160.982] IcmpCreateFile () returned 0x728940 [0160.982] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b468 [0160.982] IcmpSendEcho2 (IcmpHandle=0x728940, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa800a8c0, RequestData=0x1f8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b468, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1740 os_tid = 0x1ab4 [0160.984] GetLastError () returned 0x57 [0160.984] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3cd8 [0160.985] SetLastError (dwErrCode=0x57) [0160.985] IcmpCreateFile () returned 0x728978 [0160.985] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bcd8 [0160.985] IcmpSendEcho2 (IcmpHandle=0x728978, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa900a8c0, RequestData=0x1fa3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bcd8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1741 os_tid = 0x1ab8 [0160.986] GetLastError () returned 0x57 [0160.986] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e7ff0 [0160.986] SetLastError (dwErrCode=0x57) [0160.986] IcmpCreateFile () returned 0x728dd8 [0160.986] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b5a8 [0160.986] IcmpSendEcho2 (IcmpHandle=0x728dd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaa00a8c0, RequestData=0x1fb7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b5a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1742 os_tid = 0x1abc [0160.987] GetLastError () returned 0x57 [0160.987] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8378 [0160.987] SetLastError (dwErrCode=0x57) [0160.987] IcmpCreateFile () returned 0x728e10 [0160.987] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b5f8 [0160.987] IcmpSendEcho2 (IcmpHandle=0x728e10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xab00a8c0, RequestData=0x1fcbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b5f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1743 os_tid = 0x1ac0 [0160.989] GetLastError () returned 0x57 [0160.989] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8700 [0160.989] SetLastError (dwErrCode=0x57) [0160.989] IcmpCreateFile () returned 0x728e48 [0160.989] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b648 [0160.989] IcmpSendEcho2 (IcmpHandle=0x728e48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xac00a8c0, RequestData=0x1fdfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b648, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1744 os_tid = 0x1ac4 [0160.990] GetLastError () returned 0x57 [0160.990] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8a88 [0160.990] SetLastError (dwErrCode=0x57) [0160.990] IcmpCreateFile () returned 0x74efb0 [0160.990] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b328 [0160.990] IcmpSendEcho2 (IcmpHandle=0x74efb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xad00a8c0, RequestData=0x1ff3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b328, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1745 os_tid = 0x1ac8 [0160.991] GetLastError () returned 0x57 [0160.991] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e8e10 [0160.992] SetLastError (dwErrCode=0x57) [0160.992] IcmpCreateFile () returned 0x74efe8 [0160.992] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b4b8 [0160.992] IcmpSendEcho2 (IcmpHandle=0x74efe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xae00a8c0, RequestData=0x2007ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b4b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1746 os_tid = 0x1acc [0160.993] GetLastError () returned 0x57 [0160.993] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2098 [0160.993] SetLastError (dwErrCode=0x57) [0160.993] IcmpCreateFile () returned 0x74f020 [0160.993] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b508 [0160.993] IcmpSendEcho2 (IcmpHandle=0x74f020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaf00a8c0, RequestData=0x201bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b508, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1747 os_tid = 0x1ad0 [0160.994] GetLastError () returned 0x57 [0160.994] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2420 [0160.994] SetLastError (dwErrCode=0x57) [0160.994] IcmpCreateFile () returned 0x74f058 [0160.994] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b558 [0160.994] IcmpSendEcho2 (IcmpHandle=0x74f058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb000a8c0, RequestData=0x202fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b558, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1748 os_tid = 0x1ad4 [0160.995] GetLastError () returned 0x57 [0160.995] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e27a8 [0160.995] SetLastError (dwErrCode=0x57) [0160.995] IcmpCreateFile () returned 0x74f090 [0160.995] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be68 [0160.995] IcmpSendEcho2 (IcmpHandle=0x74f090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb100a8c0, RequestData=0x2043ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1749 os_tid = 0x1adc [0161.007] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.007] ReadFile (in: hFile=0xa5c, lpBuffer=0x205bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x205bf85c, lpOverlapped=0x0 | out: lpBuffer=0x205bfb34*, lpNumberOfBytesRead=0x205bf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.134] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.134] ReadFile (in: hFile=0xa5c, lpBuffer=0x205bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x205bf85c, lpOverlapped=0x0 | out: lpBuffer=0x205bfb34*, lpNumberOfBytesRead=0x205bf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.134] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.136] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x205bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0161.136] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x205bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x205bf828, pbKeyObject=0x0) returned 0x0 [0161.136] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x205bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x205bf500) returned 0x0 [0161.136] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.136] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x205bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x205bf500) returned 0x0 [0161.139] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.141] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.141] WriteFile (in: hFile=0xa5c, lpBuffer=0x205bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x205bf830, lpOverlapped=0x0 | out: lpBuffer=0x205bfb34*, lpNumberOfBytesWritten=0x205bf830*=0x428, lpOverlapped=0x0) returned 1 [0161.142] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.142] ReadFile (in: hFile=0xa5c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x205bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x205bf61c*=0x2340, lpOverlapped=0x0) returned 1 [0161.360] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0xffffdcc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.360] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3750000, cbInput=0x2340, pPaddingInfo=0x0, pbIV=0x205bf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x205bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x205bf848, pbOutput=0x3750000, pcbResult=0x205bf618) returned 0x0 [0161.360] WriteFile (in: hFile=0xa5c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x205bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x205bf61c*=0x2350, lpOverlapped=0x0) returned 1 [0161.361] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x205bf60c | out: lpNewFilePointer=0x0) returned 1 [0161.361] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.361] WriteFile (in: hFile=0xa5c, lpBuffer=0x205bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x205bf61c, lpOverlapped=0x0 | out: lpBuffer=0x205bf83c*, lpNumberOfBytesWritten=0x205bf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.361] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x2350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.361] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0161.361] CloseHandle (hObject=0xa5c) returned 1 [0161.699] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xda70000 [0161.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.play")) returned 1 [0161.902] VirtualFree (lpAddress=0xda70000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1750 os_tid = 0x1ae0 [0161.008] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.008] ReadFile (in: hFile=0xa64, lpBuffer=0x206ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x206ff85c, lpOverlapped=0x0 | out: lpBuffer=0x206ffb34*, lpNumberOfBytesRead=0x206ff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.126] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.126] ReadFile (in: hFile=0xa64, lpBuffer=0x206ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x206ff85c, lpOverlapped=0x0 | out: lpBuffer=0x206ffb34*, lpNumberOfBytesRead=0x206ff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.126] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.128] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.128] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x206ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0161.128] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x206ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x206ff828, pbKeyObject=0x0) returned 0x0 [0161.128] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x206ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x206ff500) returned 0x0 [0161.128] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.128] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x206ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x206ff500) returned 0x0 [0161.131] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.133] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.133] WriteFile (in: hFile=0xa64, lpBuffer=0x206ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x206ff830, lpOverlapped=0x0 | out: lpBuffer=0x206ffb34*, lpNumberOfBytesWritten=0x206ff830*=0x428, lpOverlapped=0x0) returned 1 [0161.134] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.134] ReadFile (in: hFile=0xa64, lpBuffer=0x3850000, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x206ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x206ff61c*=0x1c30, lpOverlapped=0x0) returned 1 [0161.343] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0xffffe3d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.344] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3850000, cbInput=0x1c30, pPaddingInfo=0x0, pbIV=0x206ff848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x206ff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x206ff848, pbOutput=0x3850000, pcbResult=0x206ff618) returned 0x0 [0161.344] WriteFile (in: hFile=0xa64, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x206ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x206ff61c*=0x1c40, lpOverlapped=0x0) returned 1 [0161.344] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x206ff60c | out: lpNewFilePointer=0x0) returned 1 [0161.344] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.344] WriteFile (in: hFile=0xa64, lpBuffer=0x206ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x206ff61c, lpOverlapped=0x0 | out: lpBuffer=0x206ff83c*, lpNumberOfBytesWritten=0x206ff61c*=0x8, lpOverlapped=0x0) returned 1 [0161.344] SetFilePointerEx (in: hFile=0xa64, liDistanceToMove=0x1c40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.344] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0161.344] CloseHandle (hObject=0xa64) returned 1 [0161.696] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xda50000 [0161.697] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.play")) returned 1 [0161.897] VirtualFree (lpAddress=0xda50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1751 os_tid = 0x1ae4 [0161.009] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.009] ReadFile (in: hFile=0xb8c, lpBuffer=0x2083fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2083f85c, lpOverlapped=0x0 | out: lpBuffer=0x2083fb34*, lpNumberOfBytesRead=0x2083f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.117] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.117] ReadFile (in: hFile=0xb8c, lpBuffer=0x2083fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2083f85c, lpOverlapped=0x0 | out: lpBuffer=0x2083fb34*, lpNumberOfBytesRead=0x2083f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.117] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.119] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2083f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0161.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2083f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2083f828, pbKeyObject=0x0) returned 0x0 [0161.119] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2083f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2083f500) returned 0x0 [0161.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.120] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2083f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2083f500) returned 0x0 [0161.123] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.125] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.125] WriteFile (in: hFile=0xb8c, lpBuffer=0x2083fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2083f830, lpOverlapped=0x0 | out: lpBuffer=0x2083fb34*, lpNumberOfBytesWritten=0x2083f830*=0x428, lpOverlapped=0x0) returned 1 [0161.126] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.126] ReadFile (in: hFile=0xb8c, lpBuffer=0x3950000, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x2083f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2083f61c*=0x3a19, lpOverlapped=0x0) returned 1 [0161.333] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xffffc5e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.333] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3950000, cbInput=0x3a19, pPaddingInfo=0x0, pbIV=0x2083f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2083f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2083f848, pbOutput=0x3950000, pcbResult=0x2083f618) returned 0x0 [0161.333] WriteFile (in: hFile=0xb8c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2083f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2083f61c*=0x3a20, lpOverlapped=0x0) returned 1 [0161.333] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2083f60c | out: lpNewFilePointer=0x0) returned 1 [0161.333] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.333] WriteFile (in: hFile=0xb8c, lpBuffer=0x2083f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2083f61c, lpOverlapped=0x0 | out: lpBuffer=0x2083f83c*, lpNumberOfBytesWritten=0x2083f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.333] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x3a20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.333] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0161.334] CloseHandle (hObject=0xb8c) returned 1 [0161.334] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0161.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.play")) returned 1 [0161.871] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1752 os_tid = 0x1ae8 [0161.011] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.011] ReadFile (in: hFile=0xec4, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.019] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.019] ReadFile (in: hFile=0xec4, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.019] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.020] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.021] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2097f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0161.021] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2097f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2097f828, pbKeyObject=0x0) returned 0x0 [0161.021] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2097f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2097f500) returned 0x0 [0161.021] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.021] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2097f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2097f500) returned 0x0 [0161.024] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.026] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.026] WriteFile (in: hFile=0xec4, lpBuffer=0x2097fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2097f830, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesWritten=0x2097f830*=0x428, lpOverlapped=0x0) returned 1 [0161.026] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.026] ReadFile (in: hFile=0xec4, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2097f61c*=0x1a1c, lpOverlapped=0x0) returned 1 [0161.027] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xffffe5e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.027] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3a50000, cbInput=0x1a1c, pPaddingInfo=0x0, pbIV=0x2097f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2097f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2097f848, pbOutput=0x3a50000, pcbResult=0x2097f618) returned 0x0 [0161.027] WriteFile (in: hFile=0xec4, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2097f61c*=0x1a20, lpOverlapped=0x0) returned 1 [0161.027] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2097f60c | out: lpNewFilePointer=0x0) returned 1 [0161.027] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.027] WriteFile (in: hFile=0xec4, lpBuffer=0x2097f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x2097f83c*, lpNumberOfBytesWritten=0x2097f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.027] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x1a20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.028] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.028] CloseHandle (hObject=0xec4) returned 1 [0161.028] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.play")) returned 1 [0161.030] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1753 os_tid = 0x1aec [0161.177] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.177] ReadFile (in: hFile=0xecc, lpBuffer=0x20abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20abf85c, lpOverlapped=0x0 | out: lpBuffer=0x20abfb34*, lpNumberOfBytesRead=0x20abf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.394] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.394] ReadFile (in: hFile=0xecc, lpBuffer=0x20abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20abf85c, lpOverlapped=0x0 | out: lpBuffer=0x20abfb34*, lpNumberOfBytesRead=0x20abf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.394] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.396] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.396] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x20abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0161.396] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x20abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x20abf828, pbKeyObject=0x0) returned 0x0 [0161.396] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x20abf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x20abf500) returned 0x0 [0161.396] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.396] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x20abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x20abf500) returned 0x0 [0161.399] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.401] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.401] WriteFile (in: hFile=0xecc, lpBuffer=0x20abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20abf830, lpOverlapped=0x0 | out: lpBuffer=0x20abfb34*, lpNumberOfBytesWritten=0x20abf830*=0x428, lpOverlapped=0x0) returned 1 [0161.402] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.402] ReadFile (in: hFile=0xecc, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x20abf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x20abf61c*=0xcb3, lpOverlapped=0x0) returned 1 [0161.402] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffff34d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.402] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3b50000, cbInput=0xcb3, pPaddingInfo=0x0, pbIV=0x20abf848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x20abf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x20abf848, pbOutput=0x3b50000, pcbResult=0x20abf618) returned 0x0 [0161.402] WriteFile (in: hFile=0xecc, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x20abf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x20abf61c*=0xcc0, lpOverlapped=0x0) returned 1 [0161.402] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20abf60c | out: lpNewFilePointer=0x0) returned 1 [0161.402] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.402] WriteFile (in: hFile=0xecc, lpBuffer=0x20abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20abf61c, lpOverlapped=0x0 | out: lpBuffer=0x20abf83c*, lpNumberOfBytesWritten=0x20abf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.402] SetFilePointerEx (in: hFile=0xecc, liDistanceToMove=0xcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.402] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0161.402] CloseHandle (hObject=0xecc) returned 1 [0161.705] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdaa0000 [0161.706] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.play")) returned 1 [0161.961] VirtualFree (lpAddress=0xdaa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1754 os_tid = 0x1ad8 [0161.184] GetLastError () returned 0x57 [0161.184] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e71d0 [0161.184] SetLastError (dwErrCode=0x57) [0161.184] IcmpCreateFile () returned 0x74f0c8 [0161.184] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b698 [0161.184] IcmpSendEcho2 (IcmpHandle=0x74f0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb200a8c0, RequestData=0x20bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b698, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1755 os_tid = 0x1af0 [0161.186] GetLastError () returned 0x57 [0161.186] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2b30 [0161.186] SetLastError (dwErrCode=0x57) [0161.186] IcmpCreateFile () returned 0x74f100 [0161.186] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76beb8 [0161.186] IcmpSendEcho2 (IcmpHandle=0x74f100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb300a8c0, RequestData=0xd04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76beb8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1756 os_tid = 0x1af8 [0161.196] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.196] ReadFile (in: hFile=0xd8c, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.198] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.198] ReadFile (in: hFile=0xd8c, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.198] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.201] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.201] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0xd1cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0161.201] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0xd1cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0xd1cf828, pbKeyObject=0x0) returned 0x0 [0161.201] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd1cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd1cf500) returned 0x0 [0161.202] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.202] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd1cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd1cf500) returned 0x0 [0161.205] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.207] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.207] WriteFile (in: hFile=0xd8c, lpBuffer=0xd1cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd1cf830, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesWritten=0xd1cf830*=0x428, lpOverlapped=0x0) returned 1 [0161.208] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.208] ReadFile (in: hFile=0xd8c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0xd1cf61c*=0x1fa1, lpOverlapped=0x0) returned 1 [0161.208] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xffffe05f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.208] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3c50000, cbInput=0x1fa1, pPaddingInfo=0x0, pbIV=0xd1cf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0xd1cf618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xd1cf848, pbOutput=0x3c50000, pcbResult=0xd1cf618) returned 0x0 [0161.208] WriteFile (in: hFile=0xd8c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0xd1cf61c*=0x1fb0, lpOverlapped=0x0) returned 1 [0161.209] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd1cf60c | out: lpNewFilePointer=0x0) returned 1 [0161.209] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.209] WriteFile (in: hFile=0xd8c, lpBuffer=0xd1cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd1cf83c*, lpNumberOfBytesWritten=0xd1cf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.209] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x1fb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.209] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0161.209] CloseHandle (hObject=0xd8c) returned 1 [0161.209] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.play")) returned 1 [0161.211] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1757 os_tid = 0x1afc [0161.255] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.255] ReadFile (in: hFile=0xec4, lpBuffer=0xd30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd30f85c, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesRead=0xd30f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.256] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.256] ReadFile (in: hFile=0xec4, lpBuffer=0xd30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd30f85c, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesRead=0xd30f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.257] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.259] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.259] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xd30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0161.259] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xd30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xd30f828, pbKeyObject=0x0) returned 0x0 [0161.260] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd30f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd30f500) returned 0x0 [0161.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.260] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd30f500) returned 0x0 [0161.263] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.265] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.265] WriteFile (in: hFile=0xec4, lpBuffer=0xd30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd30f830, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesWritten=0xd30f830*=0x428, lpOverlapped=0x0) returned 1 [0161.266] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.266] ReadFile (in: hFile=0xec4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xd30f61c*=0x1e06, lpOverlapped=0x0) returned 1 [0161.266] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xffffe1fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.267] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x2750000, cbInput=0x1e06, pPaddingInfo=0x0, pbIV=0xd30f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xd30f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xd30f848, pbOutput=0x2750000, pcbResult=0xd30f618) returned 0x0 [0161.267] WriteFile (in: hFile=0xec4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xd30f61c*=0x1e10, lpOverlapped=0x0) returned 1 [0161.267] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd30f60c | out: lpNewFilePointer=0x0) returned 1 [0161.267] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.267] WriteFile (in: hFile=0xec4, lpBuffer=0xd30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0xd30f83c*, lpNumberOfBytesWritten=0xd30f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.267] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x1e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.267] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0161.267] CloseHandle (hObject=0xec4) returned 1 [0161.267] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.269] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.play")) returned 1 [0161.269] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1758 os_tid = 0x1b00 [0161.297] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.298] ReadFile (in: hFile=0xfd8, lpBuffer=0xd44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd44f85c, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesRead=0xd44f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.471] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.471] ReadFile (in: hFile=0xfd8, lpBuffer=0xd44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd44f85c, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesRead=0xd44f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.471] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.473] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.473] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xd44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0161.473] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xd44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xd44f828, pbKeyObject=0x0) returned 0x0 [0161.473] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd44f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd44f500) returned 0x0 [0161.473] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.473] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd44f500) returned 0x0 [0161.478] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.480] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.480] WriteFile (in: hFile=0xfd8, lpBuffer=0xd44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd44f830, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesWritten=0xd44f830*=0x428, lpOverlapped=0x0) returned 1 [0161.481] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.481] ReadFile (in: hFile=0xfd8, lpBuffer=0x2850000, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xd44f61c*=0x2e73, lpOverlapped=0x0) returned 1 [0161.564] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0xffffd18d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.564] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2850000, cbInput=0x2e73, pPaddingInfo=0x0, pbIV=0xd44f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xd44f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xd44f848, pbOutput=0x2850000, pcbResult=0xd44f618) returned 0x0 [0161.564] WriteFile (in: hFile=0xfd8, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xd44f61c*=0x2e80, lpOverlapped=0x0) returned 1 [0161.564] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd44f60c | out: lpNewFilePointer=0x0) returned 1 [0161.565] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.565] WriteFile (in: hFile=0xfd8, lpBuffer=0xd44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0xd44f83c*, lpNumberOfBytesWritten=0xd44f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.565] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0x2e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.565] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0161.565] CloseHandle (hObject=0xfd8) returned 1 [0161.746] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb00000 [0161.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.play")) returned 1 [0161.973] VirtualFree (lpAddress=0xdb00000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1759 os_tid = 0x1b04 [0161.299] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.310] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xd58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0161.310] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xd58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xd58f828, pbKeyObject=0x0) returned 0x0 [0161.310] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd58f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd58f500) returned 0x0 [0161.310] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.310] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd58f500) returned 0x0 [0161.314] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.336] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.336] WriteFile (in: hFile=0xfe0, lpBuffer=0xd58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd58f830, lpOverlapped=0x0 | out: lpBuffer=0xd58fb34*, lpNumberOfBytesWritten=0xd58f830*=0x428, lpOverlapped=0x0) returned 1 [0161.339] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.339] ReadFile (in: hFile=0xfe0, lpBuffer=0x2950000, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xd58f61c*=0x205, lpOverlapped=0x0) returned 1 [0161.339] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xfffffdfb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.339] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2950000, cbInput=0x205, pPaddingInfo=0x0, pbIV=0xd58f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xd58f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xd58f848, pbOutput=0x2950000, pcbResult=0xd58f618) returned 0x0 [0161.339] WriteFile (in: hFile=0xfe0, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xd58f61c*=0x210, lpOverlapped=0x0) returned 1 [0161.339] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd58f60c | out: lpNewFilePointer=0x0) returned 1 [0161.339] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.339] WriteFile (in: hFile=0xfe0, lpBuffer=0xd58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0xd58f83c*, lpNumberOfBytesWritten=0xd58f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.339] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.339] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.339] CloseHandle (hObject=0xfe0) returned 1 [0161.694] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0161.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.play")) returned 1 [0161.892] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1760 os_tid = 0x1b08 [0161.340] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.341] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.342] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xd6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0161.342] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xd6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xd6cf828, pbKeyObject=0x0) returned 0x0 [0161.342] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd6cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd6cf500) returned 0x0 [0161.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.342] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd6cf500) returned 0x0 [0161.346] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.348] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.348] WriteFile (in: hFile=0xfe8, lpBuffer=0xd6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd6cf830, lpOverlapped=0x0 | out: lpBuffer=0xd6cfb34*, lpNumberOfBytesWritten=0xd6cf830*=0x428, lpOverlapped=0x0) returned 1 [0161.351] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.351] ReadFile (in: hFile=0xfe8, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xd6cf61c*=0x1f6, lpOverlapped=0x0) returned 1 [0161.351] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0xfffffe0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.351] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2a50000, cbInput=0x1f6, pPaddingInfo=0x0, pbIV=0xd6cf848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xd6cf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xd6cf848, pbOutput=0x2a50000, pcbResult=0xd6cf618) returned 0x0 [0161.351] WriteFile (in: hFile=0xfe8, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xd6cf61c*=0x200, lpOverlapped=0x0) returned 1 [0161.352] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd6cf60c | out: lpNewFilePointer=0x0) returned 1 [0161.352] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.352] WriteFile (in: hFile=0xfe8, lpBuffer=0xd6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd6cf83c*, lpNumberOfBytesWritten=0xd6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.352] SetFilePointerEx (in: hFile=0xfe8, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.352] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.352] CloseHandle (hObject=0xfe8) returned 1 [0161.698] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xda60000 [0161.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.play")) returned 1 [0161.900] VirtualFree (lpAddress=0xda60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1761 os_tid = 0x1b0c [0161.353] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.353] ReadFile (in: hFile=0xff0, lpBuffer=0xda0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda0f85c, lpOverlapped=0x0 | out: lpBuffer=0xda0fb34*, lpNumberOfBytesRead=0xda0f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.646] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.646] ReadFile (in: hFile=0xff0, lpBuffer=0xda0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda0f85c, lpOverlapped=0x0 | out: lpBuffer=0xda0fb34*, lpNumberOfBytesRead=0xda0f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.646] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.647] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.647] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xda0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0161.647] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xda0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xda0f828, pbKeyObject=0x0) returned 0x0 [0161.647] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xda0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xda0f500) returned 0x0 [0161.648] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.648] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xda0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xda0f500) returned 0x0 [0161.651] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.653] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.653] WriteFile (in: hFile=0xff0, lpBuffer=0xda0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xda0f830, lpOverlapped=0x0 | out: lpBuffer=0xda0fb34*, lpNumberOfBytesWritten=0xda0f830*=0x428, lpOverlapped=0x0) returned 1 [0161.654] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.654] ReadFile (in: hFile=0xff0, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0xda0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xda0f61c*=0x319e, lpOverlapped=0x0) returned 1 [0161.738] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0xffffce62, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.738] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2b50000, cbInput=0x319e, pPaddingInfo=0x0, pbIV=0xda0f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xda0f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xda0f848, pbOutput=0x2b50000, pcbResult=0xda0f618) returned 0x0 [0161.738] WriteFile (in: hFile=0xff0, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0xda0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xda0f61c*=0x31a0, lpOverlapped=0x0) returned 1 [0161.738] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xda0f60c | out: lpNewFilePointer=0x0) returned 1 [0161.738] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.738] WriteFile (in: hFile=0xff0, lpBuffer=0xda0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xda0f61c, lpOverlapped=0x0 | out: lpBuffer=0xda0f83c*, lpNumberOfBytesWritten=0xda0f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.738] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x31a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.738] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0161.738] CloseHandle (hObject=0xff0) returned 1 [0161.771] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe0d0000 [0161.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.play")) returned 1 [0161.775] VirtualFree (lpAddress=0xe0d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1762 os_tid = 0x1b10 [0161.354] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.355] ReadFile (in: hFile=0xff8, lpBuffer=0xdc8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdc8f85c, lpOverlapped=0x0 | out: lpBuffer=0xdc8fb34*, lpNumberOfBytesRead=0xdc8f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.636] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.637] ReadFile (in: hFile=0xff8, lpBuffer=0xdc8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdc8f85c, lpOverlapped=0x0 | out: lpBuffer=0xdc8fb34*, lpNumberOfBytesRead=0xdc8f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.637] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.638] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.639] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xdc8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0161.639] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xdc8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xdc8f828, pbKeyObject=0x0) returned 0x0 [0161.639] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xdc8f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xdc8f500) returned 0x0 [0161.639] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.639] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xdc8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xdc8f500) returned 0x0 [0161.642] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.644] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.644] WriteFile (in: hFile=0xff8, lpBuffer=0xdc8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdc8f830, lpOverlapped=0x0 | out: lpBuffer=0xdc8fb34*, lpNumberOfBytesWritten=0xdc8f830*=0x428, lpOverlapped=0x0) returned 1 [0161.645] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.645] ReadFile (in: hFile=0xff8, lpBuffer=0x2c50000, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0xdc8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xdc8f61c*=0xd9c, lpOverlapped=0x0) returned 1 [0161.645] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0xfffff264, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.645] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2c50000, cbInput=0xd9c, pPaddingInfo=0x0, pbIV=0xdc8f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xdc8f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xdc8f848, pbOutput=0x2c50000, pcbResult=0xdc8f618) returned 0x0 [0161.645] WriteFile (in: hFile=0xff8, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0xdc8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xdc8f61c*=0xda0, lpOverlapped=0x0) returned 1 [0161.645] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdc8f60c | out: lpNewFilePointer=0x0) returned 1 [0161.645] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.645] WriteFile (in: hFile=0xff8, lpBuffer=0xdc8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdc8f61c, lpOverlapped=0x0 | out: lpBuffer=0xdc8f83c*, lpNumberOfBytesWritten=0xdc8f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.645] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0xda0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.646] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0161.646] CloseHandle (hObject=0xff8) returned 1 [0161.756] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb40000 [0161.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.play")) returned 1 [0161.986] VirtualFree (lpAddress=0xdb40000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1763 os_tid = 0x1b14 [0161.356] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.356] ReadFile (in: hFile=0x1004, lpBuffer=0x2093fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2093f85c, lpOverlapped=0x0 | out: lpBuffer=0x2093fb34*, lpNumberOfBytesRead=0x2093f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.361] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.361] ReadFile (in: hFile=0x1004, lpBuffer=0x2093fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2093f85c, lpOverlapped=0x0 | out: lpBuffer=0x2093fb34*, lpNumberOfBytesRead=0x2093f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.361] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.363] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.363] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2093f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0161.363] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2093f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2093f828, pbKeyObject=0x0) returned 0x0 [0161.363] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2093f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2093f500) returned 0x0 [0161.363] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.363] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2093f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2093f500) returned 0x0 [0161.367] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.368] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.368] WriteFile (in: hFile=0x1004, lpBuffer=0x2093fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2093f830, lpOverlapped=0x0 | out: lpBuffer=0x2093fb34*, lpNumberOfBytesWritten=0x2093f830*=0x428, lpOverlapped=0x0) returned 1 [0161.369] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.369] ReadFile (in: hFile=0x1004, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x2093f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2093f61c*=0xc44, lpOverlapped=0x0) returned 1 [0161.369] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0xfffff3bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.369] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2d50000, cbInput=0xc44, pPaddingInfo=0x0, pbIV=0x2093f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2093f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2093f848, pbOutput=0x2d50000, pcbResult=0x2093f618) returned 0x0 [0161.369] WriteFile (in: hFile=0x1004, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2093f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2093f61c*=0xc50, lpOverlapped=0x0) returned 1 [0161.369] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2093f60c | out: lpNewFilePointer=0x0) returned 1 [0161.369] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.369] WriteFile (in: hFile=0x1004, lpBuffer=0x2093f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2093f61c, lpOverlapped=0x0 | out: lpBuffer=0x2093f83c*, lpNumberOfBytesWritten=0x2093f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.369] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0xc50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.369] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.369] CloseHandle (hObject=0x1004) returned 1 [0161.701] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xda80000 [0161.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.play")) returned 1 [0161.951] VirtualFree (lpAddress=0xda80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1764 os_tid = 0x1b18 [0161.370] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.370] ReadFile (in: hFile=0x100c, lpBuffer=0x20cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20cbfb34*, lpNumberOfBytesRead=0x20cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.628] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.629] ReadFile (in: hFile=0x100c, lpBuffer=0x20cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20cbfb34*, lpNumberOfBytesRead=0x20cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.629] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.630] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.630] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x20cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0161.630] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x20cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x20cbf828, pbKeyObject=0x0) returned 0x0 [0161.630] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x20cbf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x20cbf500) returned 0x0 [0161.630] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.630] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x20cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x20cbf500) returned 0x0 [0161.634] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.635] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.635] WriteFile (in: hFile=0x100c, lpBuffer=0x20cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20cbf830, lpOverlapped=0x0 | out: lpBuffer=0x20cbfb34*, lpNumberOfBytesWritten=0x20cbf830*=0x428, lpOverlapped=0x0) returned 1 [0161.636] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.636] ReadFile (in: hFile=0x100c, lpBuffer=0x3050000, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x20cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x20cbf61c*=0x30c2, lpOverlapped=0x0) returned 1 [0161.737] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xffffcf3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.737] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3050000, cbInput=0x30c2, pPaddingInfo=0x0, pbIV=0x20cbf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x20cbf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x20cbf848, pbOutput=0x3050000, pcbResult=0x20cbf618) returned 0x0 [0161.737] WriteFile (in: hFile=0x100c, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x20cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x20cbf61c*=0x30d0, lpOverlapped=0x0) returned 1 [0161.737] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20cbf60c | out: lpNewFilePointer=0x0) returned 1 [0161.737] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.737] WriteFile (in: hFile=0x100c, lpBuffer=0x20cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20cbf83c*, lpNumberOfBytesWritten=0x20cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.737] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x30d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.737] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0161.737] CloseHandle (hObject=0x100c) returned 1 [0161.770] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe0c0000 [0161.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.play")) returned 1 [0162.014] VirtualFree (lpAddress=0xe0c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1765 os_tid = 0x1b1c [0161.371] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.371] ReadFile (in: hFile=0x1014, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.373] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.373] ReadFile (in: hFile=0x1014, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.373] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.375] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.375] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x20dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0161.375] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x20dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x20dbf828, pbKeyObject=0x0) returned 0x0 [0161.375] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x20dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x20dbf500) returned 0x0 [0161.375] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.375] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x20dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x20dbf500) returned 0x0 [0161.379] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.380] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.380] WriteFile (in: hFile=0x1014, lpBuffer=0x20dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20dbf830, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesWritten=0x20dbf830*=0x428, lpOverlapped=0x0) returned 1 [0161.381] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.381] ReadFile (in: hFile=0x1014, lpBuffer=0x3150000, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x20dbf61c*=0x1485, lpOverlapped=0x0) returned 1 [0161.381] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0xffffeb7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.381] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3150000, cbInput=0x1485, pPaddingInfo=0x0, pbIV=0x20dbf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x20dbf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x20dbf848, pbOutput=0x3150000, pcbResult=0x20dbf618) returned 0x0 [0161.381] WriteFile (in: hFile=0x1014, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x20dbf61c*=0x1490, lpOverlapped=0x0) returned 1 [0161.381] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20dbf60c | out: lpNewFilePointer=0x0) returned 1 [0161.381] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.381] WriteFile (in: hFile=0x1014, lpBuffer=0x20dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20dbf83c*, lpNumberOfBytesWritten=0x20dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.381] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x1490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.381] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.381] CloseHandle (hObject=0x1014) returned 1 [0161.703] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xda90000 [0161.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.play")) returned 1 [0161.955] VirtualFree (lpAddress=0xda90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1766 os_tid = 0x1b20 [0161.381] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.382] ReadFile (in: hFile=0x101c, lpBuffer=0x20ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesRead=0x20ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.620] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.621] ReadFile (in: hFile=0x101c, lpBuffer=0x20ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesRead=0x20ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.621] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.622] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.622] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x20ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0161.622] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x20ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x20ebf828, pbKeyObject=0x0) returned 0x0 [0161.622] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x20ebf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x20ebf500) returned 0x0 [0161.622] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.622] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x20ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x20ebf500) returned 0x0 [0161.626] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.627] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x101c, lpBuffer=0x20ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20ebf830, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesWritten=0x20ebf830*=0x428, lpOverlapped=0x0) returned 1 [0161.628] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.628] ReadFile (in: hFile=0x101c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x20ebf61c*=0xa24, lpOverlapped=0x0) returned 1 [0161.628] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xfffff5dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.628] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3a50000, cbInput=0xa24, pPaddingInfo=0x0, pbIV=0x20ebf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x20ebf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x20ebf848, pbOutput=0x3a50000, pcbResult=0x20ebf618) returned 0x0 [0161.628] WriteFile (in: hFile=0x101c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x20ebf61c*=0xa30, lpOverlapped=0x0) returned 1 [0161.628] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20ebf60c | out: lpNewFilePointer=0x0) returned 1 [0161.628] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.628] WriteFile (in: hFile=0x101c, lpBuffer=0x20ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x20ebf83c*, lpNumberOfBytesWritten=0x20ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.628] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xa30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.628] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0161.628] CloseHandle (hObject=0x101c) returned 1 [0161.754] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb30000 [0161.755] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.play")) returned 1 [0161.980] VirtualFree (lpAddress=0xdb30000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1767 os_tid = 0x1b24 [0161.383] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.383] ReadFile (in: hFile=0x1024, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.612] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.612] ReadFile (in: hFile=0x1024, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.612] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.614] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.614] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x20fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0161.614] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x20fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x20fbf828, pbKeyObject=0x0) returned 0x0 [0161.614] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x20fbf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x20fbf500) returned 0x0 [0161.614] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.614] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x20fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x20fbf500) returned 0x0 [0161.617] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.619] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.619] WriteFile (in: hFile=0x1024, lpBuffer=0x20fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20fbf830, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesWritten=0x20fbf830*=0x428, lpOverlapped=0x0) returned 1 [0161.620] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.620] ReadFile (in: hFile=0x1024, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x20fbf61c*=0x296f, lpOverlapped=0x0) returned 1 [0161.727] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xffffd691, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.727] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3d50000, cbInput=0x296f, pPaddingInfo=0x0, pbIV=0x20fbf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x20fbf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x20fbf848, pbOutput=0x3d50000, pcbResult=0x20fbf618) returned 0x0 [0161.727] WriteFile (in: hFile=0x1024, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x20fbf61c*=0x2970, lpOverlapped=0x0) returned 1 [0161.727] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20fbf60c | out: lpNewFilePointer=0x0) returned 1 [0161.727] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.727] WriteFile (in: hFile=0x1024, lpBuffer=0x20fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20fbf83c*, lpNumberOfBytesWritten=0x20fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.727] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x2970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.727] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0161.728] CloseHandle (hObject=0x1024) returned 1 [0161.766] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe0a0000 [0161.768] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.play")) returned 1 [0162.005] VirtualFree (lpAddress=0xe0a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1768 os_tid = 0x1b28 [0161.384] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.384] ReadFile (in: hFile=0x102c, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.386] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.386] ReadFile (in: hFile=0x102c, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.386] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.387] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x210ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0161.387] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x210ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x210ff828, pbKeyObject=0x0) returned 0x0 [0161.387] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x210ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x210ff500) returned 0x0 [0161.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.388] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x210ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x210ff500) returned 0x0 [0161.391] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.393] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.393] WriteFile (in: hFile=0x102c, lpBuffer=0x210ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210ff830, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesWritten=0x210ff830*=0x428, lpOverlapped=0x0) returned 1 [0161.393] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.394] ReadFile (in: hFile=0x102c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x210ff61c*=0x3bcc, lpOverlapped=0x0) returned 1 [0161.404] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0xffffc434, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.404] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3e50000, cbInput=0x3bcc, pPaddingInfo=0x0, pbIV=0x210ff848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x210ff618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x210ff848, pbOutput=0x3e50000, pcbResult=0x210ff618) returned 0x0 [0161.404] WriteFile (in: hFile=0x102c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x210ff61c*=0x3bd0, lpOverlapped=0x0) returned 1 [0161.404] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210ff60c | out: lpNewFilePointer=0x0) returned 1 [0161.404] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.404] WriteFile (in: hFile=0x102c, lpBuffer=0x210ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x210ff83c*, lpNumberOfBytesWritten=0x210ff61c*=0x8, lpOverlapped=0x0) returned 1 [0161.404] SetFilePointerEx (in: hFile=0x102c, liDistanceToMove=0x3bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.404] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.404] CloseHandle (hObject=0x102c) returned 1 [0161.706] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdab0000 [0161.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.play")) returned 1 [0161.963] VirtualFree (lpAddress=0xdab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1769 os_tid = 0x1b2c [0161.409] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.409] ReadFile (in: hFile=0x5fc, lpBuffer=0xd90fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd90f85c, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesRead=0xd90f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.612] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.612] ReadFile (in: hFile=0x5fc, lpBuffer=0xd90fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd90f85c, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesRead=0xd90f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.728] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xdad0000 [0161.729] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xdad0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xdad0000) returned 0x0 [0161.730] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0xd90f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0161.730] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0xd90f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xdad0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0xd90f828, pbKeyObject=0x0) returned 0x0 [0161.730] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xdad0000, cbOutput=0x230, pcbResult=0xd90f500, dwFlags=0x0 | out: pbOutput=0xdad0000, pcbResult=0xd90f500) returned 0x0 [0161.730] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xdad0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xdad0230) returned 0x0 [0161.730] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xdad0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xdad0000, cbOutput=0x400, pcbResult=0xd90f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xdad0000, pcbResult=0xd90f500) returned 0x0 [0161.733] VirtualFree (lpAddress=0xdad0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.735] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.735] WriteFile (in: hFile=0x5fc, lpBuffer=0xd90fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd90f830, lpOverlapped=0x0 | out: lpBuffer=0xd90fb34*, lpNumberOfBytesWritten=0xd90f830*=0x428, lpOverlapped=0x0) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.736] ReadFile (in: hFile=0x5fc, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0xd90f61c*=0x14c3, lpOverlapped=0x0) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xffffeb3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.736] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3f50000, cbInput=0x14c3, pPaddingInfo=0x0, pbIV=0xd90f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0xd90f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd90f848, pbOutput=0x3f50000, pcbResult=0xd90f618) returned 0x0 [0161.736] WriteFile (in: hFile=0x5fc, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0xd90f61c*=0x14d0, lpOverlapped=0x0) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd90f60c | out: lpNewFilePointer=0x0) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.736] WriteFile (in: hFile=0x5fc, lpBuffer=0xd90f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd90f61c, lpOverlapped=0x0 | out: lpBuffer=0xd90f83c*, lpNumberOfBytesWritten=0xd90f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x5fc, liDistanceToMove=0x14d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.736] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0161.736] CloseHandle (hObject=0x5fc) returned 1 [0161.768] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe0b0000 [0161.769] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.play")) returned 1 [0162.008] VirtualFree (lpAddress=0xe0b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1770 os_tid = 0x1b30 [0161.411] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.411] ReadFile (in: hFile=0x1034, lpBuffer=0xde0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xde0f85c, lpOverlapped=0x0 | out: lpBuffer=0xde0fb34*, lpNumberOfBytesRead=0xde0f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.601] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.601] ReadFile (in: hFile=0x1034, lpBuffer=0xde0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xde0f85c, lpOverlapped=0x0 | out: lpBuffer=0xde0fb34*, lpNumberOfBytesRead=0xde0f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.601] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.602] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xde0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0161.602] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xde0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xde0f828, pbKeyObject=0x0) returned 0x0 [0161.602] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xde0f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xde0f500) returned 0x0 [0161.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.602] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xde0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xde0f500) returned 0x0 [0161.608] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.610] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.610] WriteFile (in: hFile=0x1034, lpBuffer=0xde0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xde0f830, lpOverlapped=0x0 | out: lpBuffer=0xde0fb34*, lpNumberOfBytesWritten=0xde0f830*=0x428, lpOverlapped=0x0) returned 1 [0161.610] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.611] ReadFile (in: hFile=0x1034, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0xde0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xde0f61c*=0x135b, lpOverlapped=0x0) returned 1 [0161.611] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0xffffeca5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.611] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2f50000, cbInput=0x135b, pPaddingInfo=0x0, pbIV=0xde0f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xde0f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xde0f848, pbOutput=0x2f50000, pcbResult=0xde0f618) returned 0x0 [0161.611] WriteFile (in: hFile=0x1034, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0xde0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xde0f61c*=0x1360, lpOverlapped=0x0) returned 1 [0161.611] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xde0f60c | out: lpNewFilePointer=0x0) returned 1 [0161.611] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.611] WriteFile (in: hFile=0x1034, lpBuffer=0xde0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xde0f61c, lpOverlapped=0x0 | out: lpBuffer=0xde0f83c*, lpNumberOfBytesWritten=0xde0f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.611] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x1360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.611] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0161.611] CloseHandle (hObject=0x1034) returned 1 [0161.752] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb20000 [0161.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.play")) returned 1 [0161.978] VirtualFree (lpAddress=0xdb20000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1771 os_tid = 0x1b34 [0161.412] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.412] ReadFile (in: hFile=0x103c, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.592] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.592] ReadFile (in: hFile=0x103c, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.592] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.593] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.594] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2123f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0161.594] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2123f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2123f828, pbKeyObject=0x0) returned 0x0 [0161.594] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2123f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2123f500) returned 0x0 [0161.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.594] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2123f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2123f500) returned 0x0 [0161.597] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.599] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.599] WriteFile (in: hFile=0x103c, lpBuffer=0x2123fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2123f830, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesWritten=0x2123f830*=0x428, lpOverlapped=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.600] ReadFile (in: hFile=0x103c, lpBuffer=0x3250000, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2123f61c*=0x13a6, lpOverlapped=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xffffec5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.600] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3250000, cbInput=0x13a6, pPaddingInfo=0x0, pbIV=0x2123f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2123f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x2123f848, pbOutput=0x3250000, pcbResult=0x2123f618) returned 0x0 [0161.600] WriteFile (in: hFile=0x103c, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2123f61c*=0x13b0, lpOverlapped=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2123f60c | out: lpNewFilePointer=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.600] WriteFile (in: hFile=0x103c, lpBuffer=0x2123f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x2123f83c*, lpNumberOfBytesWritten=0x2123f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x13b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.600] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0161.600] CloseHandle (hObject=0x103c) returned 1 [0161.751] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb10000 [0161.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.play")) returned 1 [0161.976] VirtualFree (lpAddress=0xdb10000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1772 os_tid = 0x1b38 [0161.413] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.414] ReadFile (in: hFile=0x1044, lpBuffer=0x2137fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2137f85c, lpOverlapped=0x0 | out: lpBuffer=0x2137fb34*, lpNumberOfBytesRead=0x2137f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.687] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.687] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2137f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0161.687] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2137f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2137f828, pbKeyObject=0x0) returned 0x0 [0161.687] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2137f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2137f500) returned 0x0 [0161.687] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.688] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2137f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2137f500) returned 0x0 [0161.691] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.692] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.693] WriteFile (in: hFile=0x1044, lpBuffer=0x2137fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2137f830, lpOverlapped=0x0 | out: lpBuffer=0x2137fb34*, lpNumberOfBytesWritten=0x2137f830*=0x428, lpOverlapped=0x0) returned 1 [0161.693] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.693] ReadFile (in: hFile=0x1044, lpBuffer=0x4050000, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x2137f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2137f61c*=0x47a, lpOverlapped=0x0) returned 1 [0161.693] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xfffffb86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.693] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x4050000, cbInput=0x47a, pPaddingInfo=0x0, pbIV=0x2137f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2137f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x2137f848, pbOutput=0x4050000, pcbResult=0x2137f618) returned 0x0 [0161.693] WriteFile (in: hFile=0x1044, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2137f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2137f61c*=0x480, lpOverlapped=0x0) returned 1 [0161.693] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2137f60c | out: lpNewFilePointer=0x0) returned 1 [0161.693] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.694] WriteFile (in: hFile=0x1044, lpBuffer=0x2137f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2137f61c, lpOverlapped=0x0 | out: lpBuffer=0x2137f83c*, lpNumberOfBytesWritten=0x2137f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.694] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.694] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0161.694] CloseHandle (hObject=0x1044) returned 1 [0161.778] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd6d0000 [0161.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.play")) returned 1 [0161.781] VirtualFree (lpAddress=0xd6d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1773 os_tid = 0x1b3c [0161.415] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.415] ReadFile (in: hFile=0x104c, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.416] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.416] ReadFile (in: hFile=0x104c, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.416] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.418] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x214bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0161.418] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x214bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x214bf828, pbKeyObject=0x0) returned 0x0 [0161.418] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x214bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x214bf500) returned 0x0 [0161.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.418] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x214bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x214bf500) returned 0x0 [0161.422] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.423] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.424] WriteFile (in: hFile=0x104c, lpBuffer=0x214bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x214bf830, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesWritten=0x214bf830*=0x428, lpOverlapped=0x0) returned 1 [0161.424] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.424] ReadFile (in: hFile=0x104c, lpBuffer=0x4150000, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x214bf61c*=0x1d9f, lpOverlapped=0x0) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0xffffe261, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.427] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4150000, cbInput=0x1d9f, pPaddingInfo=0x0, pbIV=0x214bf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x214bf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x214bf848, pbOutput=0x4150000, pcbResult=0x214bf618) returned 0x0 [0161.427] WriteFile (in: hFile=0x104c, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x214bf61c*=0x1da0, lpOverlapped=0x0) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x214bf60c | out: lpNewFilePointer=0x0) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.427] WriteFile (in: hFile=0x104c, lpBuffer=0x214bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x214bf83c*, lpNumberOfBytesWritten=0x214bf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x1da0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.427] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0161.427] CloseHandle (hObject=0x104c) returned 1 [0161.709] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdac0000 [0161.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.play")) returned 1 [0161.966] VirtualFree (lpAddress=0xdac0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1774 os_tid = 0x1b40 [0161.428] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.428] ReadFile (in: hFile=0x1054, lpBuffer=0x215ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215ff85c, lpOverlapped=0x0 | out: lpBuffer=0x215ffb34*, lpNumberOfBytesRead=0x215ff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.584] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.584] ReadFile (in: hFile=0x1054, lpBuffer=0x215ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215ff85c, lpOverlapped=0x0 | out: lpBuffer=0x215ffb34*, lpNumberOfBytesRead=0x215ff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.584] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.585] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x215ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0161.586] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x215ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x215ff828, pbKeyObject=0x0) returned 0x0 [0161.586] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x215ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x215ff500) returned 0x0 [0161.586] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.586] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x215ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x215ff500) returned 0x0 [0161.589] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.591] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.591] WriteFile (in: hFile=0x1054, lpBuffer=0x215ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x215ff830, lpOverlapped=0x0 | out: lpBuffer=0x215ffb34*, lpNumberOfBytesWritten=0x215ff830*=0x428, lpOverlapped=0x0) returned 1 [0161.591] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.591] ReadFile (in: hFile=0x1054, lpBuffer=0x4250000, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x215ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x215ff61c*=0x1b48, lpOverlapped=0x0) returned 1 [0161.725] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xffffe4b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.725] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4250000, cbInput=0x1b48, pPaddingInfo=0x0, pbIV=0x215ff848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x215ff618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x215ff848, pbOutput=0x4250000, pcbResult=0x215ff618) returned 0x0 [0161.725] WriteFile (in: hFile=0x1054, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x215ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x215ff61c*=0x1b50, lpOverlapped=0x0) returned 1 [0161.726] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x215ff60c | out: lpNewFilePointer=0x0) returned 1 [0161.726] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.726] WriteFile (in: hFile=0x1054, lpBuffer=0x215ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x215ff61c, lpOverlapped=0x0 | out: lpBuffer=0x215ff83c*, lpNumberOfBytesWritten=0x215ff61c*=0x8, lpOverlapped=0x0) returned 1 [0161.726] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x1b50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.726] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0161.726] CloseHandle (hObject=0x1054) returned 1 [0161.762] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb80000 [0161.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.play")) returned 1 [0161.999] VirtualFree (lpAddress=0xdb80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1775 os_tid = 0x1b44 [0161.429] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.429] ReadFile (in: hFile=0x105c, lpBuffer=0x2173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2173f85c, lpOverlapped=0x0 | out: lpBuffer=0x2173fb34*, lpNumberOfBytesRead=0x2173f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.574] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.574] ReadFile (in: hFile=0x105c, lpBuffer=0x2173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2173f85c, lpOverlapped=0x0 | out: lpBuffer=0x2173fb34*, lpNumberOfBytesRead=0x2173f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.574] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.577] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.577] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x2173f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0161.577] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x2173f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x2173f828, pbKeyObject=0x0) returned 0x0 [0161.577] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2173f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2173f500) returned 0x0 [0161.577] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.578] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2173f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2173f500) returned 0x0 [0161.581] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.583] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.583] WriteFile (in: hFile=0x105c, lpBuffer=0x2173fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2173f830, lpOverlapped=0x0 | out: lpBuffer=0x2173fb34*, lpNumberOfBytesWritten=0x2173f830*=0x428, lpOverlapped=0x0) returned 1 [0161.583] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.584] ReadFile (in: hFile=0x105c, lpBuffer=0x4350000, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x2173f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x2173f61c*=0x33c6, lpOverlapped=0x0) returned 1 [0161.726] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0xffffcc3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.726] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4350000, cbInput=0x33c6, pPaddingInfo=0x0, pbIV=0x2173f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x2173f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2173f848, pbOutput=0x4350000, pcbResult=0x2173f618) returned 0x0 [0161.726] WriteFile (in: hFile=0x105c, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2173f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x2173f61c*=0x33d0, lpOverlapped=0x0) returned 1 [0161.726] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2173f60c | out: lpNewFilePointer=0x0) returned 1 [0161.726] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.726] WriteFile (in: hFile=0x105c, lpBuffer=0x2173f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2173f61c, lpOverlapped=0x0 | out: lpBuffer=0x2173f83c*, lpNumberOfBytesWritten=0x2173f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.727] SetFilePointerEx (in: hFile=0x105c, liDistanceToMove=0x33d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.727] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0161.727] CloseHandle (hObject=0x105c) returned 1 [0161.764] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe090000 [0161.766] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.play")) returned 1 [0162.002] VirtualFree (lpAddress=0xe090000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1776 os_tid = 0x1b48 [0161.430] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.431] ReadFile (in: hFile=0x1064, lpBuffer=0x2187fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2187f85c, lpOverlapped=0x0 | out: lpBuffer=0x2187fb34*, lpNumberOfBytesRead=0x2187f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.675] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.675] ReadFile (in: hFile=0x1064, lpBuffer=0x2187fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2187f85c, lpOverlapped=0x0 | out: lpBuffer=0x2187fb34*, lpNumberOfBytesRead=0x2187f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.675] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.677] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.677] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x2187f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0161.677] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x2187f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x2187f828, pbKeyObject=0x0) returned 0x0 [0161.677] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2187f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2187f500) returned 0x0 [0161.677] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.677] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2187f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2187f500) returned 0x0 [0161.681] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.682] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.682] WriteFile (in: hFile=0x1064, lpBuffer=0x2187fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2187f830, lpOverlapped=0x0 | out: lpBuffer=0x2187fb34*, lpNumberOfBytesWritten=0x2187f830*=0x428, lpOverlapped=0x0) returned 1 [0161.683] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.683] ReadFile (in: hFile=0x1064, lpBuffer=0x4450000, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x2187f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x2187f61c*=0x2186, lpOverlapped=0x0) returned 1 [0161.739] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xffffde7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.739] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x4450000, cbInput=0x2186, pPaddingInfo=0x0, pbIV=0x2187f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x2187f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x2187f848, pbOutput=0x4450000, pcbResult=0x2187f618) returned 0x0 [0161.739] WriteFile (in: hFile=0x1064, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2187f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x2187f61c*=0x2190, lpOverlapped=0x0) returned 1 [0161.739] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2187f60c | out: lpNewFilePointer=0x0) returned 1 [0161.739] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.739] WriteFile (in: hFile=0x1064, lpBuffer=0x2187f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2187f61c, lpOverlapped=0x0 | out: lpBuffer=0x2187f83c*, lpNumberOfBytesWritten=0x2187f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.739] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0x2190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.739] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0161.739] CloseHandle (hObject=0x1064) returned 1 [0161.822] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdad0000 [0161.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.play")) returned 1 [0161.895] VirtualFree (lpAddress=0xdad0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1777 os_tid = 0x1b4c [0161.432] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.432] ReadFile (in: hFile=0x106c, lpBuffer=0x219bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219bf85c, lpOverlapped=0x0 | out: lpBuffer=0x219bfb34*, lpNumberOfBytesRead=0x219bf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.433] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.433] ReadFile (in: hFile=0x106c, lpBuffer=0x219bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219bf85c, lpOverlapped=0x0 | out: lpBuffer=0x219bfb34*, lpNumberOfBytesRead=0x219bf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.434] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.436] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.436] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x219bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0161.436] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x219bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x219bf828, pbKeyObject=0x0) returned 0x0 [0161.436] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219bf500) returned 0x0 [0161.436] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.436] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219bf500) returned 0x0 [0161.439] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.441] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.441] WriteFile (in: hFile=0x106c, lpBuffer=0x219bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219bf830, lpOverlapped=0x0 | out: lpBuffer=0x219bfb34*, lpNumberOfBytesWritten=0x219bf830*=0x428, lpOverlapped=0x0) returned 1 [0161.442] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.442] ReadFile (in: hFile=0x106c, lpBuffer=0x4550000, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x219bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x219bf61c*=0x131e, lpOverlapped=0x0) returned 1 [0161.442] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0xffffece2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.442] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x4550000, cbInput=0x131e, pPaddingInfo=0x0, pbIV=0x219bf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x219bf618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x219bf848, pbOutput=0x4550000, pcbResult=0x219bf618) returned 0x0 [0161.442] WriteFile (in: hFile=0x106c, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x219bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x219bf61c*=0x1320, lpOverlapped=0x0) returned 1 [0161.442] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219bf60c | out: lpNewFilePointer=0x0) returned 1 [0161.442] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.442] WriteFile (in: hFile=0x106c, lpBuffer=0x219bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219bf61c, lpOverlapped=0x0 | out: lpBuffer=0x219bf83c*, lpNumberOfBytesWritten=0x219bf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.442] SetFilePointerEx (in: hFile=0x106c, liDistanceToMove=0x1320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.442] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0161.442] CloseHandle (hObject=0x106c) returned 1 [0161.833] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0161.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.play")) returned 1 [0161.885] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1778 os_tid = 0x1b50 [0161.443] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.443] ReadFile (in: hFile=0x1074, lpBuffer=0x21affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21aff85c, lpOverlapped=0x0 | out: lpBuffer=0x21affb34*, lpNumberOfBytesRead=0x21aff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.516] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.516] ReadFile (in: hFile=0x1074, lpBuffer=0x21affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21aff85c, lpOverlapped=0x0 | out: lpBuffer=0x21affb34*, lpNumberOfBytesRead=0x21aff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.711] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xdad0000 [0161.712] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xdad0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xdad0000) returned 0x0 [0161.712] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x21aff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0161.712] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x21aff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xdad0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x21aff828, pbKeyObject=0x0) returned 0x0 [0161.712] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xdad0000, cbOutput=0x230, pcbResult=0x21aff500, dwFlags=0x0 | out: pbOutput=0xdad0000, pcbResult=0x21aff500) returned 0x0 [0161.712] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xdad0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xdad0230) returned 0x0 [0161.712] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xdad0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xdad0000, cbOutput=0x400, pcbResult=0x21aff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xdad0000, pcbResult=0x21aff500) returned 0x0 [0161.715] VirtualFree (lpAddress=0xdad0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.718] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.718] WriteFile (in: hFile=0x1074, lpBuffer=0x21affb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21aff830, lpOverlapped=0x0 | out: lpBuffer=0x21affb34*, lpNumberOfBytesWritten=0x21aff830*=0x428, lpOverlapped=0x0) returned 1 [0161.718] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.718] ReadFile (in: hFile=0x1074, lpBuffer=0x4650000, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x21aff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x21aff61c*=0x14ff, lpOverlapped=0x0) returned 1 [0161.718] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0xffffeb01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.718] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x4650000, cbInput=0x14ff, pPaddingInfo=0x0, pbIV=0x21aff848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x21aff618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x21aff848, pbOutput=0x4650000, pcbResult=0x21aff618) returned 0x0 [0161.718] WriteFile (in: hFile=0x1074, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x21aff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x21aff61c*=0x1500, lpOverlapped=0x0) returned 1 [0161.719] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21aff60c | out: lpNewFilePointer=0x0) returned 1 [0161.719] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.719] WriteFile (in: hFile=0x1074, lpBuffer=0x21aff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21aff61c, lpOverlapped=0x0 | out: lpBuffer=0x21aff83c*, lpNumberOfBytesWritten=0x21aff61c*=0x8, lpOverlapped=0x0) returned 1 [0161.719] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x1500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.719] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0161.719] CloseHandle (hObject=0x1074) returned 1 [0161.759] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb60000 [0161.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.play")) returned 1 [0161.993] VirtualFree (lpAddress=0xdb60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1779 os_tid = 0x1b54 [0161.444] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.444] ReadFile (in: hFile=0x107c, lpBuffer=0x21c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21c3fb34*, lpNumberOfBytesRead=0x21c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.565] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.565] ReadFile (in: hFile=0x107c, lpBuffer=0x21c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21c3fb34*, lpNumberOfBytesRead=0x21c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.565] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.567] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.567] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x21c3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0161.567] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x21c3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x21c3f828, pbKeyObject=0x0) returned 0x0 [0161.567] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x21c3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x21c3f500) returned 0x0 [0161.567] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.567] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x21c3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x21c3f500) returned 0x0 [0161.571] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.573] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.573] WriteFile (in: hFile=0x107c, lpBuffer=0x21c3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21c3f830, lpOverlapped=0x0 | out: lpBuffer=0x21c3fb34*, lpNumberOfBytesWritten=0x21c3f830*=0x428, lpOverlapped=0x0) returned 1 [0161.574] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.574] ReadFile (in: hFile=0x107c, lpBuffer=0x4750000, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x21c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x21c3f61c*=0x2420, lpOverlapped=0x0) returned 1 [0161.725] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0xffffdbe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.725] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4750000, cbInput=0x2420, pPaddingInfo=0x0, pbIV=0x21c3f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x21c3f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x21c3f848, pbOutput=0x4750000, pcbResult=0x21c3f618) returned 0x0 [0161.725] WriteFile (in: hFile=0x107c, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x21c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x21c3f61c*=0x2430, lpOverlapped=0x0) returned 1 [0161.725] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21c3f60c | out: lpNewFilePointer=0x0) returned 1 [0161.725] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.725] WriteFile (in: hFile=0x107c, lpBuffer=0x21c3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21c3f83c*, lpNumberOfBytesWritten=0x21c3f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.725] SetFilePointerEx (in: hFile=0x107c, liDistanceToMove=0x2430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.725] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0161.725] CloseHandle (hObject=0x107c) returned 1 [0161.761] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb70000 [0161.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.play")) returned 1 [0161.996] VirtualFree (lpAddress=0xdb70000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1780 os_tid = 0x1b58 [0161.446] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.446] ReadFile (in: hFile=0x1084, lpBuffer=0x21d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesRead=0x21d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.655] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.655] ReadFile (in: hFile=0x1084, lpBuffer=0x21d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesRead=0x21d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.655] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.656] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.656] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x21d7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0161.656] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x21d7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x21d7f828, pbKeyObject=0x0) returned 0x0 [0161.656] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x21d7f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x21d7f500) returned 0x0 [0161.656] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.657] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x21d7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x21d7f500) returned 0x0 [0161.660] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.661] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.661] WriteFile (in: hFile=0x1084, lpBuffer=0x21d7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d7f830, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesWritten=0x21d7f830*=0x428, lpOverlapped=0x0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.662] ReadFile (in: hFile=0x1084, lpBuffer=0x4850000, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x21d7f61c*=0x1398, lpOverlapped=0x0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xffffec68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.662] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x4850000, cbInput=0x1398, pPaddingInfo=0x0, pbIV=0x21d7f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x21d7f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x21d7f848, pbOutput=0x4850000, pcbResult=0x21d7f618) returned 0x0 [0161.662] WriteFile (in: hFile=0x1084, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x21d7f61c*=0x13a0, lpOverlapped=0x0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d7f60c | out: lpNewFilePointer=0x0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.662] WriteFile (in: hFile=0x1084, lpBuffer=0x21d7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d7f83c*, lpNumberOfBytesWritten=0x21d7f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x13a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.662] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0161.662] CloseHandle (hObject=0x1084) returned 1 [0161.757] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb50000 [0161.759] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.play")) returned 1 [0161.989] VirtualFree (lpAddress=0xdb50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1781 os_tid = 0x1b5c [0161.447] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.447] ReadFile (in: hFile=0x108c, lpBuffer=0x21ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x21ebfb34*, lpNumberOfBytesRead=0x21ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.532] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.532] ReadFile (in: hFile=0x108c, lpBuffer=0x21ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x21ebfb34*, lpNumberOfBytesRead=0x21ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.532] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.533] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.533] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x21ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0161.533] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x21ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x21ebf828, pbKeyObject=0x0) returned 0x0 [0161.533] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x21ebf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x21ebf500) returned 0x0 [0161.533] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.533] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x21ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x21ebf500) returned 0x0 [0161.537] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.539] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.539] WriteFile (in: hFile=0x108c, lpBuffer=0x21ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21ebf830, lpOverlapped=0x0 | out: lpBuffer=0x21ebfb34*, lpNumberOfBytesWritten=0x21ebf830*=0x428, lpOverlapped=0x0) returned 1 [0161.539] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.539] ReadFile (in: hFile=0x108c, lpBuffer=0x4950000, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x21ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x21ebf61c*=0x1126, lpOverlapped=0x0) returned 1 [0161.539] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xffffeeda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.539] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4950000, cbInput=0x1126, pPaddingInfo=0x0, pbIV=0x21ebf848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x21ebf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x21ebf848, pbOutput=0x4950000, pcbResult=0x21ebf618) returned 0x0 [0161.539] WriteFile (in: hFile=0x108c, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x21ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x21ebf61c*=0x1130, lpOverlapped=0x0) returned 1 [0161.540] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ebf60c | out: lpNewFilePointer=0x0) returned 1 [0161.540] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.540] WriteFile (in: hFile=0x108c, lpBuffer=0x21ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x21ebf83c*, lpNumberOfBytesWritten=0x21ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.540] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x1130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.540] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0161.540] CloseHandle (hObject=0x108c) returned 1 [0161.745] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdaf0000 [0161.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.play")) returned 1 [0161.971] VirtualFree (lpAddress=0xdaf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1782 os_tid = 0x1b60 [0161.448] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.448] ReadFile (in: hFile=0x1094, lpBuffer=0x21fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21fff85c, lpOverlapped=0x0 | out: lpBuffer=0x21fffb34*, lpNumberOfBytesRead=0x21fff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.523] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.523] ReadFile (in: hFile=0x1094, lpBuffer=0x21fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21fff85c, lpOverlapped=0x0 | out: lpBuffer=0x21fffb34*, lpNumberOfBytesRead=0x21fff85c*=0x428, lpOverlapped=0x0) returned 1 [0161.523] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0161.524] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0161.524] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x21fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0161.524] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x21fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x21fff828, pbKeyObject=0x0) returned 0x0 [0161.524] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x21fff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x21fff500) returned 0x0 [0161.525] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0161.525] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x21fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x21fff500) returned 0x0 [0161.528] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.530] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.530] WriteFile (in: hFile=0x1094, lpBuffer=0x21fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21fff830, lpOverlapped=0x0 | out: lpBuffer=0x21fffb34*, lpNumberOfBytesWritten=0x21fff830*=0x428, lpOverlapped=0x0) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.531] ReadFile (in: hFile=0x1094, lpBuffer=0x4a50000, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x21fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x21fff61c*=0xf7e, lpOverlapped=0x0) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xfffff082, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.531] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4a50000, cbInput=0xf7e, pPaddingInfo=0x0, pbIV=0x21fff848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x21fff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x21fff848, pbOutput=0x4a50000, pcbResult=0x21fff618) returned 0x0 [0161.531] WriteFile (in: hFile=0x1094, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x21fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x21fff61c*=0xf80, lpOverlapped=0x0) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21fff60c | out: lpNewFilePointer=0x0) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.531] WriteFile (in: hFile=0x1094, lpBuffer=0x21fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21fff61c, lpOverlapped=0x0 | out: lpBuffer=0x21fff83c*, lpNumberOfBytesWritten=0x21fff61c*=0x8, lpOverlapped=0x0) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0xf80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.531] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0161.531] CloseHandle (hObject=0x1094) returned 1 [0161.743] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdae0000 [0161.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.play")) returned 1 [0161.969] VirtualFree (lpAddress=0xdae0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1783 os_tid = 0x1b64 [0161.449] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.450] ReadFile (in: hFile=0x109c, lpBuffer=0x2213fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2213f85c, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesRead=0x2213f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.481] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.481] ReadFile (in: hFile=0x109c, lpBuffer=0x2213fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2213f85c, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesRead=0x2213f85c*=0x428, lpOverlapped=0x0) returned 1 [0161.481] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0161.503] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0161.503] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x2213f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0161.503] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x2213f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x2213f828, pbKeyObject=0x0) returned 0x0 [0161.503] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2213f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2213f500) returned 0x0 [0161.503] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0161.503] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2213f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2213f500) returned 0x0 [0161.508] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.510] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.510] WriteFile (in: hFile=0x109c, lpBuffer=0x2213fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2213f830, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesWritten=0x2213f830*=0x428, lpOverlapped=0x0) returned 1 [0161.511] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.511] ReadFile (in: hFile=0x109c, lpBuffer=0x4b50000, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x2213f61c*=0xd32, lpOverlapped=0x0) returned 1 [0161.511] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0xfffff2ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.511] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4b50000, cbInput=0xd32, pPaddingInfo=0x0, pbIV=0x2213f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x2213f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2213f848, pbOutput=0x4b50000, pcbResult=0x2213f618) returned 0x0 [0161.511] WriteFile (in: hFile=0x109c, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x2213f61c*=0xd40, lpOverlapped=0x0) returned 1 [0161.512] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2213f60c | out: lpNewFilePointer=0x0) returned 1 [0161.512] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.512] WriteFile (in: hFile=0x109c, lpBuffer=0x2213f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x2213f83c*, lpNumberOfBytesWritten=0x2213f61c*=0x8, lpOverlapped=0x0) returned 1 [0161.512] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0xd40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.512] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0161.512] CloseHandle (hObject=0x109c) returned 1 [0161.512] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0161.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.play")) returned 1 [0161.889] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1784 os_tid = 0x1af4 [0161.452] GetLastError () returned 0x57 [0161.452] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e2eb8 [0161.453] SetLastError (dwErrCode=0x57) [0161.453] IcmpCreateFile () returned 0x74f138 [0161.453] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76be18 [0161.453] IcmpSendEcho2 (IcmpHandle=0x74f138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb500a8c0, RequestData=0x2223ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76be18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1785 os_tid = 0x1b68 [0161.454] GetLastError () returned 0x57 [0161.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3240 [0161.454] SetLastError (dwErrCode=0x57) [0161.454] IcmpCreateFile () returned 0x74f170 [0161.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf08 [0161.454] IcmpSendEcho2 (IcmpHandle=0x74f170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb600a8c0, RequestData=0xb9cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1786 os_tid = 0x1b6c [0161.455] GetLastError () returned 0x57 [0161.455] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e35c8 [0161.455] SetLastError (dwErrCode=0x57) [0161.455] IcmpCreateFile () returned 0x74f1a8 [0161.456] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bf58 [0161.456] IcmpSendEcho2 (IcmpHandle=0x74f1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb700a8c0, RequestData=0x2237ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bf58, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1787 os_tid = 0x1b70 [0161.457] GetLastError () returned 0x57 [0161.457] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e3950 [0161.457] SetLastError (dwErrCode=0x57) [0161.457] IcmpCreateFile () returned 0x74f1e0 [0161.457] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bfa8 [0161.457] IcmpSendEcho2 (IcmpHandle=0x74f1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb800a8c0, RequestData=0x224bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bfa8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1788 os_tid = 0x1b74 [0161.458] GetLastError () returned 0x57 [0161.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e4060 [0161.458] SetLastError (dwErrCode=0x57) [0161.458] IcmpCreateFile () returned 0x74f218 [0161.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bff8 [0161.458] IcmpSendEcho2 (IcmpHandle=0x74f218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb900a8c0, RequestData=0x225fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bff8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1789 os_tid = 0x1b78 [0161.459] GetLastError () returned 0x57 [0161.459] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e43e8 [0161.459] SetLastError (dwErrCode=0x57) [0161.459] IcmpCreateFile () returned 0x74f250 [0161.459] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c048 [0161.459] IcmpSendEcho2 (IcmpHandle=0x74f250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xba00a8c0, RequestData=0x2273ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c048, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1790 os_tid = 0x1b7c [0161.460] GetLastError () returned 0x57 [0161.460] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed838 [0161.461] SetLastError (dwErrCode=0x57) [0161.461] IcmpCreateFile () returned 0x74f368 [0161.461] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c098 [0161.461] IcmpSendEcho2 (IcmpHandle=0x74f368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbb00a8c0, RequestData=0x2287ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c098, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1791 os_tid = 0x1b80 [0161.462] GetLastError () returned 0x57 [0161.462] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7caa68 [0161.462] SetLastError (dwErrCode=0x57) [0161.462] IcmpCreateFile () returned 0x728d68 [0161.462] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c0e8 [0161.462] IcmpSendEcho2 (IcmpHandle=0x728d68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbc00a8c0, RequestData=0x229bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c0e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1792 os_tid = 0x1b84 [0161.836] GetLastError () returned 0x57 [0161.836] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c8aa0 [0161.836] SetLastError (dwErrCode=0x57) [0161.836] IcmpCreateFile () returned 0x7ba7a0 [0161.836] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c138 [0161.836] IcmpSendEcho2 (IcmpHandle=0x7ba7a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbd00a8c0, RequestData=0x22afff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c138, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1793 os_tid = 0x1b88 [0161.838] GetLastError () returned 0x57 [0161.838] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c8e28 [0161.838] SetLastError (dwErrCode=0x57) [0161.838] IcmpCreateFile () returned 0x7ba8f0 [0161.838] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c188 [0161.838] IcmpSendEcho2 (IcmpHandle=0x7ba8f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbe00a8c0, RequestData=0x22c3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c188, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1794 os_tid = 0x1b8c [0161.839] GetLastError () returned 0x57 [0161.839] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c91b0 [0161.839] SetLastError (dwErrCode=0x57) [0161.839] IcmpCreateFile () returned 0x7ba928 [0161.839] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c1d8 [0161.840] IcmpSendEcho2 (IcmpHandle=0x7ba928, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbf00a8c0, RequestData=0x22d7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c1d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1795 os_tid = 0x1b90 [0161.841] GetLastError () returned 0x57 [0161.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c9538 [0161.841] SetLastError (dwErrCode=0x57) [0161.841] IcmpCreateFile () returned 0x7ba960 [0161.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c228 [0161.841] IcmpSendEcho2 (IcmpHandle=0x7ba960, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc000a8c0, RequestData=0x22ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c228, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1796 os_tid = 0x1b94 [0161.842] GetLastError () returned 0x57 [0161.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c98c0 [0161.842] SetLastError (dwErrCode=0x57) [0161.842] IcmpCreateFile () returned 0x7ba998 [0161.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76c278 [0161.842] IcmpSendEcho2 (IcmpHandle=0x7ba998, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc100a8c0, RequestData=0x22ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76c278, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1797 os_tid = 0x1b98 [0161.844] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.844] ReadFile (in: hFile=0xd8c, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.845] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.845] ReadFile (in: hFile=0xd8c, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0161.845] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0161.847] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0161.847] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0xd1cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0161.847] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0xd1cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0xd1cf828, pbKeyObject=0x0) returned 0x0 [0161.847] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0xd1cf500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0xd1cf500) returned 0x0 [0161.847] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0161.848] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0xd1cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0xd1cf500) returned 0x0 [0161.851] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.854] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.854] WriteFile (in: hFile=0xd8c, lpBuffer=0xd1cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd1cf830, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesWritten=0xd1cf830*=0x428, lpOverlapped=0x0) returned 1 [0161.855] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.855] ReadFile (in: hFile=0xd8c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0xd1cf61c*=0xc30, lpOverlapped=0x0) returned 1 [0161.855] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffff3d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.855] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3c50000, cbInput=0xc30, pPaddingInfo=0x0, pbIV=0xd1cf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0xd1cf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xd1cf848, pbOutput=0x3c50000, pcbResult=0xd1cf618) returned 0x0 [0161.855] WriteFile (in: hFile=0xd8c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0xd1cf61c*=0xc40, lpOverlapped=0x0) returned 1 [0161.855] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd1cf60c | out: lpNewFilePointer=0x0) returned 1 [0161.855] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.855] WriteFile (in: hFile=0xd8c, lpBuffer=0xd1cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd1cf83c*, lpNumberOfBytesWritten=0xd1cf61c*=0x8, lpOverlapped=0x0) returned 1 [0161.855] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xc40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.855] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0161.855] CloseHandle (hObject=0xd8c) returned 1 [0161.876] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0161.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.play")) returned 1 [0161.878] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1798 os_tid = 0x1b9c [0162.056] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.056] ReadFile (in: hFile=0x10e0, lpBuffer=0x2313fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2313f85c, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesRead=0x2313f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.161] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.161] ReadFile (in: hFile=0x10e0, lpBuffer=0x2313fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2313f85c, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesRead=0x2313f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.161] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0162.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0162.163] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x2313f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0162.163] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x2313f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x2313f828, pbKeyObject=0x0) returned 0x0 [0162.163] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2313f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2313f500) returned 0x0 [0162.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0162.164] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2313f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2313f500) returned 0x0 [0162.168] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.171] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.171] WriteFile (in: hFile=0x10e0, lpBuffer=0x2313fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2313f830, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesWritten=0x2313f830*=0x428, lpOverlapped=0x0) returned 1 [0162.172] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.172] ReadFile (in: hFile=0x10e0, lpBuffer=0x4c50000, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x2313f61c*=0xbd2, lpOverlapped=0x0) returned 1 [0162.172] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffff42e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.172] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4c50000, cbInput=0xbd2, pPaddingInfo=0x0, pbIV=0x2313f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x2313f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2313f848, pbOutput=0x4c50000, pcbResult=0x2313f618) returned 0x0 [0162.172] WriteFile (in: hFile=0x10e0, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x2313f61c*=0xbe0, lpOverlapped=0x0) returned 1 [0162.172] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2313f60c | out: lpNewFilePointer=0x0) returned 1 [0162.172] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.172] WriteFile (in: hFile=0x10e0, lpBuffer=0x2313f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x2313f83c*, lpNumberOfBytesWritten=0x2313f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.172] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.172] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0162.172] CloseHandle (hObject=0x10e0) returned 1 [0162.173] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0162.175] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.play")) returned 1 [0162.176] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1799 os_tid = 0x1ba0 [0162.058] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.058] ReadFile (in: hFile=0x10e8, lpBuffer=0x2327fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2327f85c, lpOverlapped=0x0 | out: lpBuffer=0x2327fb34*, lpNumberOfBytesRead=0x2327f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.135] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.135] ReadFile (in: hFile=0x10e8, lpBuffer=0x2327fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2327f85c, lpOverlapped=0x0 | out: lpBuffer=0x2327fb34*, lpNumberOfBytesRead=0x2327f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.135] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.137] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.137] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x2327f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0162.137] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x2327f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x2327f828, pbKeyObject=0x0) returned 0x0 [0162.137] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2327f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2327f500) returned 0x0 [0162.137] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.137] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2327f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2327f500) returned 0x0 [0162.154] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.157] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.157] WriteFile (in: hFile=0x10e8, lpBuffer=0x2327fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2327f830, lpOverlapped=0x0 | out: lpBuffer=0x2327fb34*, lpNumberOfBytesWritten=0x2327f830*=0x428, lpOverlapped=0x0) returned 1 [0162.157] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.157] ReadFile (in: hFile=0x10e8, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x2327f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x2327f61c*=0x127e, lpOverlapped=0x0) returned 1 [0162.158] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xffffed82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.158] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4d50000, cbInput=0x127e, pPaddingInfo=0x0, pbIV=0x2327f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x2327f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2327f848, pbOutput=0x4d50000, pcbResult=0x2327f618) returned 0x0 [0162.158] WriteFile (in: hFile=0x10e8, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2327f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x2327f61c*=0x1280, lpOverlapped=0x0) returned 1 [0162.158] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2327f60c | out: lpNewFilePointer=0x0) returned 1 [0162.158] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.158] WriteFile (in: hFile=0x10e8, lpBuffer=0x2327f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2327f61c, lpOverlapped=0x0 | out: lpBuffer=0x2327f83c*, lpNumberOfBytesWritten=0x2327f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.158] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x1280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.158] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0162.158] CloseHandle (hObject=0x10e8) returned 1 [0162.159] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.play")) returned 1 [0162.364] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1800 os_tid = 0x1ba4 [0162.059] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.059] ReadFile (in: hFile=0x10f0, lpBuffer=0x233bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x233bf85c, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesRead=0x233bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.135] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.135] ReadFile (in: hFile=0x10f0, lpBuffer=0x233bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x233bf85c, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesRead=0x233bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.229] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0162.231] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0162.231] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x233bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0162.232] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x233bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x233bf828, pbKeyObject=0x0) returned 0x0 [0162.232] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0x233bf500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0x233bf500) returned 0x0 [0162.232] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0162.232] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0x233bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0x233bf500) returned 0x0 [0162.240] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.243] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.243] WriteFile (in: hFile=0x10f0, lpBuffer=0x233bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x233bf830, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesWritten=0x233bf830*=0x428, lpOverlapped=0x0) returned 1 [0162.244] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.244] ReadFile (in: hFile=0x10f0, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x233bf61c*=0x1634, lpOverlapped=0x0) returned 1 [0162.244] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0xffffe9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.244] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4e50000, cbInput=0x1634, pPaddingInfo=0x0, pbIV=0x233bf848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x233bf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x233bf848, pbOutput=0x4e50000, pcbResult=0x233bf618) returned 0x0 [0162.244] WriteFile (in: hFile=0x10f0, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x233bf61c*=0x1640, lpOverlapped=0x0) returned 1 [0162.244] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x233bf60c | out: lpNewFilePointer=0x0) returned 1 [0162.244] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.245] WriteFile (in: hFile=0x10f0, lpBuffer=0x233bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x233bf83c*, lpNumberOfBytesWritten=0x233bf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.245] SetFilePointerEx (in: hFile=0x10f0, liDistanceToMove=0x1640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.245] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0162.245] CloseHandle (hObject=0x10f0) returned 1 [0162.273] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17be0000 [0162.275] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.play")) returned 1 [0162.292] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1801 os_tid = 0x1ba8 [0162.061] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.061] ReadFile (in: hFile=0x10f8, lpBuffer=0x234ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x234ff85c, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesRead=0x234ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.124] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.124] ReadFile (in: hFile=0x10f8, lpBuffer=0x234ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x234ff85c, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesRead=0x234ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.124] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.126] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.126] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x234ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0162.126] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x234ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x234ff828, pbKeyObject=0x0) returned 0x0 [0162.126] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x234ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x234ff500) returned 0x0 [0162.127] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.127] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x234ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x234ff500) returned 0x0 [0162.131] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.133] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.134] WriteFile (in: hFile=0x10f8, lpBuffer=0x234ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x234ff830, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesWritten=0x234ff830*=0x428, lpOverlapped=0x0) returned 1 [0162.134] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.134] ReadFile (in: hFile=0x10f8, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x234ff61c*=0x5062, lpOverlapped=0x0) returned 1 [0162.245] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xffffaf9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.245] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4f50000, cbInput=0x5062, pPaddingInfo=0x0, pbIV=0x234ff848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x234ff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x234ff848, pbOutput=0x4f50000, pcbResult=0x234ff618) returned 0x0 [0162.245] WriteFile (in: hFile=0x10f8, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x234ff61c*=0x5070, lpOverlapped=0x0) returned 1 [0162.246] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234ff60c | out: lpNewFilePointer=0x0) returned 1 [0162.246] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.246] WriteFile (in: hFile=0x10f8, lpBuffer=0x234ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x234ff83c*, lpNumberOfBytesWritten=0x234ff61c*=0x8, lpOverlapped=0x0) returned 1 [0162.246] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0x5070, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.246] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0162.246] CloseHandle (hObject=0x10f8) returned 1 [0162.275] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bf0000 [0162.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.play")) returned 1 [0162.289] VirtualFree (lpAddress=0x17bf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1802 os_tid = 0x1bac [0162.063] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.063] ReadFile (in: hFile=0x1100, lpBuffer=0x2363fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2363f85c, lpOverlapped=0x0 | out: lpBuffer=0x2363fb34*, lpNumberOfBytesRead=0x2363f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.113] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.113] ReadFile (in: hFile=0x1100, lpBuffer=0x2363fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2363f85c, lpOverlapped=0x0 | out: lpBuffer=0x2363fb34*, lpNumberOfBytesRead=0x2363f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.113] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.115] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.115] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x2363f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0162.115] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x2363f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x2363f828, pbKeyObject=0x0) returned 0x0 [0162.115] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2363f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2363f500) returned 0x0 [0162.115] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.115] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2363f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2363f500) returned 0x0 [0162.120] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.123] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.123] WriteFile (in: hFile=0x1100, lpBuffer=0x2363fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2363f830, lpOverlapped=0x0 | out: lpBuffer=0x2363fb34*, lpNumberOfBytesWritten=0x2363f830*=0x428, lpOverlapped=0x0) returned 1 [0162.124] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.124] ReadFile (in: hFile=0x1100, lpBuffer=0x5050000, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x2363f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x2363f61c*=0x2a50, lpOverlapped=0x0) returned 1 [0162.188] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xffffd5b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.188] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x5050000, cbInput=0x2a50, pPaddingInfo=0x0, pbIV=0x2363f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x2363f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2363f848, pbOutput=0x5050000, pcbResult=0x2363f618) returned 0x0 [0162.188] WriteFile (in: hFile=0x1100, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2363f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x2363f61c*=0x2a60, lpOverlapped=0x0) returned 1 [0162.188] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2363f60c | out: lpNewFilePointer=0x0) returned 1 [0162.188] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.188] WriteFile (in: hFile=0x1100, lpBuffer=0x2363f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2363f61c, lpOverlapped=0x0 | out: lpBuffer=0x2363f83c*, lpNumberOfBytesWritten=0x2363f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.189] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x2a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.189] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0162.189] CloseHandle (hObject=0x1100) returned 1 [0162.189] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0162.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.play")) returned 1 [0162.371] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1803 os_tid = 0x1bb0 [0162.064] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.064] ReadFile (in: hFile=0x1108, lpBuffer=0x2377fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2377f85c, lpOverlapped=0x0 | out: lpBuffer=0x2377fb34*, lpNumberOfBytesRead=0x2377f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.100] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.100] ReadFile (in: hFile=0x1108, lpBuffer=0x2377fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2377f85c, lpOverlapped=0x0 | out: lpBuffer=0x2377fb34*, lpNumberOfBytesRead=0x2377f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.100] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.103] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.103] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x2377f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0162.103] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x2377f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x2377f828, pbKeyObject=0x0) returned 0x0 [0162.103] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2377f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2377f500) returned 0x0 [0162.103] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.103] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2377f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2377f500) returned 0x0 [0162.108] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.111] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.111] WriteFile (in: hFile=0x1108, lpBuffer=0x2377fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2377f830, lpOverlapped=0x0 | out: lpBuffer=0x2377fb34*, lpNumberOfBytesWritten=0x2377f830*=0x428, lpOverlapped=0x0) returned 1 [0162.111] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.111] ReadFile (in: hFile=0x1108, lpBuffer=0x5150000, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x2377f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x2377f61c*=0x385c, lpOverlapped=0x0) returned 1 [0162.184] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0xffffc7a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.185] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5150000, cbInput=0x385c, pPaddingInfo=0x0, pbIV=0x2377f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x2377f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2377f848, pbOutput=0x5150000, pcbResult=0x2377f618) returned 0x0 [0162.185] WriteFile (in: hFile=0x1108, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2377f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x2377f61c*=0x3860, lpOverlapped=0x0) returned 1 [0162.185] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2377f60c | out: lpNewFilePointer=0x0) returned 1 [0162.185] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.185] WriteFile (in: hFile=0x1108, lpBuffer=0x2377f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2377f61c, lpOverlapped=0x0 | out: lpBuffer=0x2377f83c*, lpNumberOfBytesWritten=0x2377f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.185] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x3860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.185] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.185] CloseHandle (hObject=0x1108) returned 1 [0162.186] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0162.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.play")) returned 1 [0162.368] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1804 os_tid = 0x1bb4 [0162.065] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.066] ReadFile (in: hFile=0x1110, lpBuffer=0x238bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x238bf85c, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesRead=0x238bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.067] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.067] ReadFile (in: hFile=0x1110, lpBuffer=0x238bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x238bf85c, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesRead=0x238bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.067] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.071] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.072] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x238bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0162.072] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x238bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x238bf828, pbKeyObject=0x0) returned 0x0 [0162.072] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x238bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x238bf500) returned 0x0 [0162.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.072] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x238bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x238bf500) returned 0x0 [0162.077] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.080] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.080] WriteFile (in: hFile=0x1110, lpBuffer=0x238bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x238bf830, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesWritten=0x238bf830*=0x428, lpOverlapped=0x0) returned 1 [0162.081] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.081] ReadFile (in: hFile=0x1110, lpBuffer=0x5250000, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x238bf61c*=0x1ba0, lpOverlapped=0x0) returned 1 [0162.081] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xffffe460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.081] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5250000, cbInput=0x1ba0, pPaddingInfo=0x0, pbIV=0x238bf848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x238bf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x238bf848, pbOutput=0x5250000, pcbResult=0x238bf618) returned 0x0 [0162.081] WriteFile (in: hFile=0x1110, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x238bf61c*=0x1bb0, lpOverlapped=0x0) returned 1 [0162.082] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238bf60c | out: lpNewFilePointer=0x0) returned 1 [0162.082] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.082] WriteFile (in: hFile=0x1110, lpBuffer=0x238bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x238bf83c*, lpNumberOfBytesWritten=0x238bf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.082] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x1bb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.082] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.082] CloseHandle (hObject=0x1110) returned 1 [0162.082] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.play")) returned 1 [0162.085] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1805 os_tid = 0x1bb8 [0162.193] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.193] ReadFile (in: hFile=0x1118, lpBuffer=0x239ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x239ff85c, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesRead=0x239ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.259] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.259] ReadFile (in: hFile=0x1118, lpBuffer=0x239ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x239ff85c, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesRead=0x239ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.259] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0162.261] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0162.261] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x239ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0162.261] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x239ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x239ff828, pbKeyObject=0x0) returned 0x0 [0162.261] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0x239ff500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0x239ff500) returned 0x0 [0162.261] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0162.262] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0x239ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0x239ff500) returned 0x0 [0162.267] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.269] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.269] WriteFile (in: hFile=0x1118, lpBuffer=0x239ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x239ff830, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesWritten=0x239ff830*=0x428, lpOverlapped=0x0) returned 1 [0162.269] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.269] ReadFile (in: hFile=0x1118, lpBuffer=0x5350000, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x239ff61c*=0xd10, lpOverlapped=0x0) returned 1 [0162.269] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0xfffff2f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.270] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5350000, cbInput=0xd10, pPaddingInfo=0x0, pbIV=0x239ff848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x239ff618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x239ff848, pbOutput=0x5350000, pcbResult=0x239ff618) returned 0x0 [0162.270] WriteFile (in: hFile=0x1118, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x239ff61c*=0xd20, lpOverlapped=0x0) returned 1 [0162.270] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239ff60c | out: lpNewFilePointer=0x0) returned 1 [0162.270] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.270] WriteFile (in: hFile=0x1118, lpBuffer=0x239ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x239ff83c*, lpNumberOfBytesWritten=0x239ff61c*=0x8, lpOverlapped=0x0) returned 1 [0162.270] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0xd20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.270] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.270] CloseHandle (hObject=0x1118) returned 1 [0162.295] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17be0000 [0162.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.play")) returned 1 [0162.298] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1806 os_tid = 0x1bbc [0162.195] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.195] ReadFile (in: hFile=0x1120, lpBuffer=0x23b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesRead=0x23b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.248] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0162.250] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0162.250] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x23b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0162.250] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x23b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x23b3f828, pbKeyObject=0x0) returned 0x0 [0162.250] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0x23b3f500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0x23b3f500) returned 0x0 [0162.250] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0162.251] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0x23b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0x23b3f500) returned 0x0 [0162.255] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.257] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.257] WriteFile (in: hFile=0x1120, lpBuffer=0x23b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23b3f830, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesWritten=0x23b3f830*=0x428, lpOverlapped=0x0) returned 1 [0162.258] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.258] ReadFile (in: hFile=0x1120, lpBuffer=0x5450000, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x23b3f61c*=0x63c, lpOverlapped=0x0) returned 1 [0162.258] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xfffff9c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.258] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5450000, cbInput=0x63c, pPaddingInfo=0x0, pbIV=0x23b3f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x23b3f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x23b3f848, pbOutput=0x5450000, pcbResult=0x23b3f618) returned 0x0 [0162.258] WriteFile (in: hFile=0x1120, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x23b3f61c*=0x640, lpOverlapped=0x0) returned 1 [0162.258] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23b3f60c | out: lpNewFilePointer=0x0) returned 1 [0162.259] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.259] WriteFile (in: hFile=0x1120, lpBuffer=0x23b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x23b3f83c*, lpNumberOfBytesWritten=0x23b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.259] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.259] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.259] CloseHandle (hObject=0x1120) returned 1 [0162.280] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27f90000 [0162.282] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.play")) returned 1 [0162.283] VirtualFree (lpAddress=0x27f90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1807 os_tid = 0x1bc0 [0162.196] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.196] ReadFile (in: hFile=0x1128, lpBuffer=0x23c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x23c7fb34*, lpNumberOfBytesRead=0x23c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.302] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.302] ReadFile (in: hFile=0x1128, lpBuffer=0x23c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x23c7fb34*, lpNumberOfBytesRead=0x23c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.302] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0162.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0162.304] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x23c7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0162.304] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x23c7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x23c7f828, pbKeyObject=0x0) returned 0x0 [0162.304] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x23c7f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x23c7f500) returned 0x0 [0162.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0162.304] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x23c7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x23c7f500) returned 0x0 [0162.309] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.313] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.313] WriteFile (in: hFile=0x1128, lpBuffer=0x23c7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23c7f830, lpOverlapped=0x0 | out: lpBuffer=0x23c7fb34*, lpNumberOfBytesWritten=0x23c7f830*=0x428, lpOverlapped=0x0) returned 1 [0162.314] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.314] ReadFile (in: hFile=0x1128, lpBuffer=0x5550000, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x23c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x23c7f61c*=0x1f20, lpOverlapped=0x0) returned 1 [0162.376] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0xffffe0e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.376] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5550000, cbInput=0x1f20, pPaddingInfo=0x0, pbIV=0x23c7f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x23c7f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x23c7f848, pbOutput=0x5550000, pcbResult=0x23c7f618) returned 0x0 [0162.376] WriteFile (in: hFile=0x1128, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x23c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x23c7f61c*=0x1f30, lpOverlapped=0x0) returned 1 [0162.377] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23c7f60c | out: lpNewFilePointer=0x0) returned 1 [0162.377] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.377] WriteFile (in: hFile=0x1128, lpBuffer=0x23c7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x23c7f83c*, lpNumberOfBytesWritten=0x23c7f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.377] SetFilePointerEx (in: hFile=0x1128, liDistanceToMove=0x1f30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.377] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.377] CloseHandle (hObject=0x1128) returned 1 [0162.377] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.play")) returned 1 [0162.380] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1808 os_tid = 0x1bc4 [0162.198] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.198] ReadFile (in: hFile=0x1130, lpBuffer=0x23dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x23dbfb34*, lpNumberOfBytesRead=0x23dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.199] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0162.202] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0162.202] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x23dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0162.202] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x23dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x23dbf828, pbKeyObject=0x0) returned 0x0 [0162.202] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0x23dbf500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0x23dbf500) returned 0x0 [0162.202] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0162.202] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0x23dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0x23dbf500) returned 0x0 [0162.207] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.209] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.209] WriteFile (in: hFile=0x1130, lpBuffer=0x23dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23dbf830, lpOverlapped=0x0 | out: lpBuffer=0x23dbfb34*, lpNumberOfBytesWritten=0x23dbf830*=0x428, lpOverlapped=0x0) returned 1 [0162.210] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.210] ReadFile (in: hFile=0x1130, lpBuffer=0x5650000, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x23dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x23dbf61c*=0x728, lpOverlapped=0x0) returned 1 [0162.210] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0xfffff8d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.210] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5650000, cbInput=0x728, pPaddingInfo=0x0, pbIV=0x23dbf848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x23dbf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x23dbf848, pbOutput=0x5650000, pcbResult=0x23dbf618) returned 0x0 [0162.210] WriteFile (in: hFile=0x1130, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x23dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x23dbf61c*=0x730, lpOverlapped=0x0) returned 1 [0162.210] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dbf60c | out: lpNewFilePointer=0x0) returned 1 [0162.210] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.210] WriteFile (in: hFile=0x1130, lpBuffer=0x23dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x23dbf83c*, lpNumberOfBytesWritten=0x23dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.210] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.210] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.210] CloseHandle (hObject=0x1130) returned 1 [0162.271] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0162.272] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.play")) returned 1 [0162.358] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1809 os_tid = 0x1bc8 [0162.211] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.211] ReadFile (in: hFile=0x1138, lpBuffer=0x23effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23eff85c, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesRead=0x23eff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.214] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.214] ReadFile (in: hFile=0x1138, lpBuffer=0x23effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23eff85c, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesRead=0x23eff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.214] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bd0000 [0162.217] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bd0000) returned 0x0 [0162.217] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x23eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0162.217] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x23eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bd0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x23eff828, pbKeyObject=0x0) returned 0x0 [0162.217] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bd0000, cbOutput=0x230, pcbResult=0x23eff500, dwFlags=0x0 | out: pbOutput=0x17bd0000, pcbResult=0x23eff500) returned 0x0 [0162.217] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bd0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bd0230) returned 0x0 [0162.218] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bd0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bd0000, cbOutput=0x400, pcbResult=0x23eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bd0000, pcbResult=0x23eff500) returned 0x0 [0162.225] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.228] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.228] WriteFile (in: hFile=0x1138, lpBuffer=0x23effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23eff830, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesWritten=0x23eff830*=0x428, lpOverlapped=0x0) returned 1 [0162.228] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.228] ReadFile (in: hFile=0x1138, lpBuffer=0x5750000, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x23eff61c*=0x66dc, lpOverlapped=0x0) returned 1 [0162.247] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0xffff9924, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.247] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5750000, cbInput=0x66dc, pPaddingInfo=0x0, pbIV=0x23eff848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x23eff618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x23eff848, pbOutput=0x5750000, pcbResult=0x23eff618) returned 0x0 [0162.247] WriteFile (in: hFile=0x1138, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x23eff61c*=0x66e0, lpOverlapped=0x0) returned 1 [0162.247] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23eff60c | out: lpNewFilePointer=0x0) returned 1 [0162.248] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.248] WriteFile (in: hFile=0x1138, lpBuffer=0x23eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x23eff83c*, lpNumberOfBytesWritten=0x23eff61c*=0x8, lpOverlapped=0x0) returned 1 [0162.248] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x66e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.248] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.248] CloseHandle (hObject=0x1138) returned 1 [0162.277] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27f80000 [0162.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.play")) returned 1 [0162.287] VirtualFree (lpAddress=0x27f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1810 os_tid = 0x1bcc [0162.374] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.375] ReadFile (in: hFile=0x1140, lpBuffer=0x2403fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2403f85c, lpOverlapped=0x0 | out: lpBuffer=0x2403fb34*, lpNumberOfBytesRead=0x2403f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.494] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.494] ReadFile (in: hFile=0x1140, lpBuffer=0x2403fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2403f85c, lpOverlapped=0x0 | out: lpBuffer=0x2403fb34*, lpNumberOfBytesRead=0x2403f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.494] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.496] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.496] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x2403f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0162.496] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x2403f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x2403f828, pbKeyObject=0x0) returned 0x0 [0162.496] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2403f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2403f500) returned 0x0 [0162.496] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.496] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2403f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2403f500) returned 0x0 [0162.517] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.520] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.520] WriteFile (in: hFile=0x1140, lpBuffer=0x2403fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2403f830, lpOverlapped=0x0 | out: lpBuffer=0x2403fb34*, lpNumberOfBytesWritten=0x2403f830*=0x428, lpOverlapped=0x0) returned 1 [0162.520] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.521] ReadFile (in: hFile=0x1140, lpBuffer=0x5850000, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x2403f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x2403f61c*=0x6cd2, lpOverlapped=0x0) returned 1 [0162.657] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0xffff932e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.657] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x5850000, cbInput=0x6cd2, pPaddingInfo=0x0, pbIV=0x2403f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x2403f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2403f848, pbOutput=0x5850000, pcbResult=0x2403f618) returned 0x0 [0162.657] WriteFile (in: hFile=0x1140, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2403f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x2403f61c*=0x6ce0, lpOverlapped=0x0) returned 1 [0162.657] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2403f60c | out: lpNewFilePointer=0x0) returned 1 [0162.658] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.658] WriteFile (in: hFile=0x1140, lpBuffer=0x2403f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2403f61c, lpOverlapped=0x0 | out: lpBuffer=0x2403f83c*, lpNumberOfBytesWritten=0x2403f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.658] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x6ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.658] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.658] CloseHandle (hObject=0x1140) returned 1 [0162.658] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.play")) returned 1 [0162.660] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1811 os_tid = 0x1bd0 [0162.383] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.383] ReadFile (in: hFile=0x1148, lpBuffer=0x2417fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2417f85c, lpOverlapped=0x0 | out: lpBuffer=0x2417fb34*, lpNumberOfBytesRead=0x2417f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.452] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.452] ReadFile (in: hFile=0x1148, lpBuffer=0x2417fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2417f85c, lpOverlapped=0x0 | out: lpBuffer=0x2417fb34*, lpNumberOfBytesRead=0x2417f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.452] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.454] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.454] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x2417f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0162.454] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x2417f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x2417f828, pbKeyObject=0x0) returned 0x0 [0162.454] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2417f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2417f500) returned 0x0 [0162.454] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.454] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2417f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2417f500) returned 0x0 [0162.479] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.483] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.483] WriteFile (in: hFile=0x1148, lpBuffer=0x2417fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2417f830, lpOverlapped=0x0 | out: lpBuffer=0x2417fb34*, lpNumberOfBytesWritten=0x2417f830*=0x428, lpOverlapped=0x0) returned 1 [0162.483] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.483] ReadFile (in: hFile=0x1148, lpBuffer=0x5950000, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x2417f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x2417f61c*=0xea2, lpOverlapped=0x0) returned 1 [0162.483] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0xfffff15e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.483] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x5950000, cbInput=0xea2, pPaddingInfo=0x0, pbIV=0x2417f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x2417f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2417f848, pbOutput=0x5950000, pcbResult=0x2417f618) returned 0x0 [0162.484] WriteFile (in: hFile=0x1148, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2417f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x2417f61c*=0xeb0, lpOverlapped=0x0) returned 1 [0162.484] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2417f60c | out: lpNewFilePointer=0x0) returned 1 [0162.484] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.484] WriteFile (in: hFile=0x1148, lpBuffer=0x2417f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2417f61c, lpOverlapped=0x0 | out: lpBuffer=0x2417f83c*, lpNumberOfBytesWritten=0x2417f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.484] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0xeb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.484] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0162.484] CloseHandle (hObject=0x1148) returned 1 [0162.484] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.play")) returned 1 [0162.486] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1812 os_tid = 0x1bd4 [0162.385] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.385] ReadFile (in: hFile=0x1150, lpBuffer=0x242bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x242bf85c, lpOverlapped=0x0 | out: lpBuffer=0x242bfb34*, lpNumberOfBytesRead=0x242bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.452] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.452] ReadFile (in: hFile=0x1150, lpBuffer=0x242bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x242bf85c, lpOverlapped=0x0 | out: lpBuffer=0x242bfb34*, lpNumberOfBytesRead=0x242bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.625] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.627] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x242bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0162.627] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x242bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x242bf828, pbKeyObject=0x0) returned 0x0 [0162.627] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x242bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x242bf500) returned 0x0 [0162.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.627] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x242bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x242bf500) returned 0x0 [0162.630] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.632] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.632] WriteFile (in: hFile=0x1150, lpBuffer=0x242bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x242bf830, lpOverlapped=0x0 | out: lpBuffer=0x242bfb34*, lpNumberOfBytesWritten=0x242bf830*=0x428, lpOverlapped=0x0) returned 1 [0162.633] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.633] ReadFile (in: hFile=0x1150, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x242bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x242bf61c*=0x16cc, lpOverlapped=0x0) returned 1 [0162.633] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0xffffe934, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.633] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5a50000, cbInput=0x16cc, pPaddingInfo=0x0, pbIV=0x242bf848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x242bf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x242bf848, pbOutput=0x5a50000, pcbResult=0x242bf618) returned 0x0 [0162.633] WriteFile (in: hFile=0x1150, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x242bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x242bf61c*=0x16d0, lpOverlapped=0x0) returned 1 [0162.633] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x242bf60c | out: lpNewFilePointer=0x0) returned 1 [0162.633] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.633] WriteFile (in: hFile=0x1150, lpBuffer=0x242bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x242bf61c, lpOverlapped=0x0 | out: lpBuffer=0x242bf83c*, lpNumberOfBytesWritten=0x242bf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.633] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x16d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.633] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0162.633] CloseHandle (hObject=0x1150) returned 1 [0162.633] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.play")) returned 1 [0162.635] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1813 os_tid = 0x1bd8 [0162.405] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.406] ReadFile (in: hFile=0x1158, lpBuffer=0x243ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x243ff85c, lpOverlapped=0x0 | out: lpBuffer=0x243ffb34*, lpNumberOfBytesRead=0x243ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.597] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.597] ReadFile (in: hFile=0x1158, lpBuffer=0x243ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x243ff85c, lpOverlapped=0x0 | out: lpBuffer=0x243ffb34*, lpNumberOfBytesRead=0x243ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.597] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.598] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.598] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x243ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0162.598] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x243ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x243ff828, pbKeyObject=0x0) returned 0x0 [0162.599] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x243ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x243ff500) returned 0x0 [0162.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.599] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x243ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x243ff500) returned 0x0 [0162.602] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.604] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.604] WriteFile (in: hFile=0x1158, lpBuffer=0x243ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x243ff830, lpOverlapped=0x0 | out: lpBuffer=0x243ffb34*, lpNumberOfBytesWritten=0x243ff830*=0x428, lpOverlapped=0x0) returned 1 [0162.604] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.604] ReadFile (in: hFile=0x1158, lpBuffer=0x5b50000, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x243ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x243ff61c*=0xbc4, lpOverlapped=0x0) returned 1 [0162.605] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0xfffff43c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.605] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5b50000, cbInput=0xbc4, pPaddingInfo=0x0, pbIV=0x243ff848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x243ff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x243ff848, pbOutput=0x5b50000, pcbResult=0x243ff618) returned 0x0 [0162.605] WriteFile (in: hFile=0x1158, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x243ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x243ff61c*=0xbd0, lpOverlapped=0x0) returned 1 [0162.605] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243ff60c | out: lpNewFilePointer=0x0) returned 1 [0162.605] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.605] WriteFile (in: hFile=0x1158, lpBuffer=0x243ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x243ff61c, lpOverlapped=0x0 | out: lpBuffer=0x243ff83c*, lpNumberOfBytesWritten=0x243ff61c*=0x8, lpOverlapped=0x0) returned 1 [0162.605] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0xbd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.605] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0162.605] CloseHandle (hObject=0x1158) returned 1 [0162.605] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.play")) returned 1 [0162.608] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1814 os_tid = 0x1bdc [0162.407] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.407] ReadFile (in: hFile=0x1160, lpBuffer=0x2453fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2453f85c, lpOverlapped=0x0 | out: lpBuffer=0x2453fb34*, lpNumberOfBytesRead=0x2453f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.583] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.583] ReadFile (in: hFile=0x1160, lpBuffer=0x2453fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2453f85c, lpOverlapped=0x0 | out: lpBuffer=0x2453fb34*, lpNumberOfBytesRead=0x2453f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.583] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.584] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.584] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x2453f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0162.584] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x2453f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x2453f828, pbKeyObject=0x0) returned 0x0 [0162.585] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2453f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2453f500) returned 0x0 [0162.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.585] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2453f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2453f500) returned 0x0 [0162.588] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.590] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.590] WriteFile (in: hFile=0x1160, lpBuffer=0x2453fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2453f830, lpOverlapped=0x0 | out: lpBuffer=0x2453fb34*, lpNumberOfBytesWritten=0x2453f830*=0x428, lpOverlapped=0x0) returned 1 [0162.591] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.591] ReadFile (in: hFile=0x1160, lpBuffer=0x5c50000, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x2453f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x2453f61c*=0xac4, lpOverlapped=0x0) returned 1 [0162.591] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0xfffff53c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.591] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5c50000, cbInput=0xac4, pPaddingInfo=0x0, pbIV=0x2453f848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x2453f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2453f848, pbOutput=0x5c50000, pcbResult=0x2453f618) returned 0x0 [0162.591] WriteFile (in: hFile=0x1160, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2453f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x2453f61c*=0xad0, lpOverlapped=0x0) returned 1 [0162.591] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2453f60c | out: lpNewFilePointer=0x0) returned 1 [0162.591] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.591] WriteFile (in: hFile=0x1160, lpBuffer=0x2453f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2453f61c, lpOverlapped=0x0 | out: lpBuffer=0x2453f83c*, lpNumberOfBytesWritten=0x2453f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.592] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0xad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.592] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0162.592] CloseHandle (hObject=0x1160) returned 1 [0162.592] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.play")) returned 1 [0162.594] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1815 os_tid = 0x1be0 [0162.409] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.409] ReadFile (in: hFile=0x1168, lpBuffer=0x2467fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2467f85c, lpOverlapped=0x0 | out: lpBuffer=0x2467fb34*, lpNumberOfBytesRead=0x2467f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.574] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.574] ReadFile (in: hFile=0x1168, lpBuffer=0x2467fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2467f85c, lpOverlapped=0x0 | out: lpBuffer=0x2467fb34*, lpNumberOfBytesRead=0x2467f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.574] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.575] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.575] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x2467f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0162.575] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x2467f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x2467f828, pbKeyObject=0x0) returned 0x0 [0162.575] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2467f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2467f500) returned 0x0 [0162.576] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.576] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2467f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2467f500) returned 0x0 [0162.579] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.581] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.582] WriteFile (in: hFile=0x1168, lpBuffer=0x2467fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2467f830, lpOverlapped=0x0 | out: lpBuffer=0x2467fb34*, lpNumberOfBytesWritten=0x2467f830*=0x428, lpOverlapped=0x0) returned 1 [0162.582] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.582] ReadFile (in: hFile=0x1168, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x2467f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x2467f61c*=0x1ccc, lpOverlapped=0x0) returned 1 [0162.668] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0xffffe334, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.668] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x5d50000, cbInput=0x1ccc, pPaddingInfo=0x0, pbIV=0x2467f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x2467f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x2467f848, pbOutput=0x5d50000, pcbResult=0x2467f618) returned 0x0 [0162.668] WriteFile (in: hFile=0x1168, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2467f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x2467f61c*=0x1cd0, lpOverlapped=0x0) returned 1 [0162.668] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2467f60c | out: lpNewFilePointer=0x0) returned 1 [0162.668] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.668] WriteFile (in: hFile=0x1168, lpBuffer=0x2467f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2467f61c, lpOverlapped=0x0 | out: lpBuffer=0x2467f83c*, lpNumberOfBytesWritten=0x2467f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.668] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x1cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.668] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0162.668] CloseHandle (hObject=0x1168) returned 1 [0162.669] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.play")) returned 1 [0162.671] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1816 os_tid = 0x1be4 [0162.411] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.411] ReadFile (in: hFile=0x1170, lpBuffer=0x247bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x247bf85c, lpOverlapped=0x0 | out: lpBuffer=0x247bfb34*, lpNumberOfBytesRead=0x247bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.566] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.566] ReadFile (in: hFile=0x1170, lpBuffer=0x247bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x247bf85c, lpOverlapped=0x0 | out: lpBuffer=0x247bfb34*, lpNumberOfBytesRead=0x247bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.566] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.567] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.567] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x247bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0162.567] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x247bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x247bf828, pbKeyObject=0x0) returned 0x0 [0162.567] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x247bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x247bf500) returned 0x0 [0162.567] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.567] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x247bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x247bf500) returned 0x0 [0162.571] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.573] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.573] WriteFile (in: hFile=0x1170, lpBuffer=0x247bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x247bf830, lpOverlapped=0x0 | out: lpBuffer=0x247bfb34*, lpNumberOfBytesWritten=0x247bf830*=0x428, lpOverlapped=0x0) returned 1 [0162.573] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.573] ReadFile (in: hFile=0x1170, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x247bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x247bf61c*=0x1d74, lpOverlapped=0x0) returned 1 [0162.663] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0xffffe28c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.663] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x5e50000, cbInput=0x1d74, pPaddingInfo=0x0, pbIV=0x247bf848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x247bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x247bf848, pbOutput=0x5e50000, pcbResult=0x247bf618) returned 0x0 [0162.663] WriteFile (in: hFile=0x1170, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x247bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x247bf61c*=0x1d80, lpOverlapped=0x0) returned 1 [0162.663] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x247bf60c | out: lpNewFilePointer=0x0) returned 1 [0162.663] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.663] WriteFile (in: hFile=0x1170, lpBuffer=0x247bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x247bf61c, lpOverlapped=0x0 | out: lpBuffer=0x247bf83c*, lpNumberOfBytesWritten=0x247bf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.663] SetFilePointerEx (in: hFile=0x1170, liDistanceToMove=0x1d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.663] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0162.663] CloseHandle (hObject=0x1170) returned 1 [0162.664] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.play")) returned 1 [0162.665] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1817 os_tid = 0x1be8 [0162.413] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.413] ReadFile (in: hFile=0x1178, lpBuffer=0x248ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x248ff85c, lpOverlapped=0x0 | out: lpBuffer=0x248ffb34*, lpNumberOfBytesRead=0x248ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.557] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.557] ReadFile (in: hFile=0x1178, lpBuffer=0x248ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x248ff85c, lpOverlapped=0x0 | out: lpBuffer=0x248ffb34*, lpNumberOfBytesRead=0x248ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.557] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.558] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.559] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x248ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0162.559] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x248ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x248ff828, pbKeyObject=0x0) returned 0x0 [0162.559] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x248ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x248ff500) returned 0x0 [0162.559] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.559] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x248ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x248ff500) returned 0x0 [0162.562] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.565] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.565] WriteFile (in: hFile=0x1178, lpBuffer=0x248ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x248ff830, lpOverlapped=0x0 | out: lpBuffer=0x248ffb34*, lpNumberOfBytesWritten=0x248ff830*=0x428, lpOverlapped=0x0) returned 1 [0162.565] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.565] ReadFile (in: hFile=0x1178, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x248ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x248ff61c*=0x19e8, lpOverlapped=0x0) returned 1 [0162.674] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0xffffe618, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.674] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x5f50000, cbInput=0x19e8, pPaddingInfo=0x0, pbIV=0x248ff848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x248ff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x248ff848, pbOutput=0x5f50000, pcbResult=0x248ff618) returned 0x0 [0162.674] WriteFile (in: hFile=0x1178, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x248ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x248ff61c*=0x19f0, lpOverlapped=0x0) returned 1 [0162.674] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x248ff60c | out: lpNewFilePointer=0x0) returned 1 [0162.675] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.675] WriteFile (in: hFile=0x1178, lpBuffer=0x248ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x248ff61c, lpOverlapped=0x0 | out: lpBuffer=0x248ff83c*, lpNumberOfBytesWritten=0x248ff61c*=0x8, lpOverlapped=0x0) returned 1 [0162.675] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x19f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.675] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0162.675] CloseHandle (hObject=0x1178) returned 1 [0162.675] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.play")) returned 1 [0162.677] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1818 os_tid = 0x1bec [0162.415] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.415] ReadFile (in: hFile=0x1180, lpBuffer=0x24a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x24a3fb34*, lpNumberOfBytesRead=0x24a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.544] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.544] ReadFile (in: hFile=0x1180, lpBuffer=0x24a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x24a3fb34*, lpNumberOfBytesRead=0x24a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.546] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.546] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x24a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0162.546] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x24a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x24a3f828, pbKeyObject=0x0) returned 0x0 [0162.546] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x24a3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x24a3f500) returned 0x0 [0162.546] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.546] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x24a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x24a3f500) returned 0x0 [0162.549] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.551] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.551] WriteFile (in: hFile=0x1180, lpBuffer=0x24a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x24a3f830, lpOverlapped=0x0 | out: lpBuffer=0x24a3fb34*, lpNumberOfBytesWritten=0x24a3f830*=0x428, lpOverlapped=0x0) returned 1 [0162.551] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.552] ReadFile (in: hFile=0x1180, lpBuffer=0x6050000, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x24a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x24a3f61c*=0x83c, lpOverlapped=0x0) returned 1 [0162.552] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0xfffff7c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.552] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x6050000, cbInput=0x83c, pPaddingInfo=0x0, pbIV=0x24a3f848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x24a3f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x24a3f848, pbOutput=0x6050000, pcbResult=0x24a3f618) returned 0x0 [0162.552] WriteFile (in: hFile=0x1180, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x24a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x24a3f61c*=0x840, lpOverlapped=0x0) returned 1 [0162.552] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24a3f60c | out: lpNewFilePointer=0x0) returned 1 [0162.552] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.552] WriteFile (in: hFile=0x1180, lpBuffer=0x24a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x24a3f83c*, lpNumberOfBytesWritten=0x24a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.552] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x840, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.552] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0162.553] CloseHandle (hObject=0x1180) returned 1 [0162.553] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.play")) returned 1 [0162.555] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1819 os_tid = 0x1bf0 [0162.416] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.416] ReadFile (in: hFile=0xec4, lpBuffer=0xd30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd30f85c, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesRead=0xd30f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.536] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.536] ReadFile (in: hFile=0xec4, lpBuffer=0xd30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd30f85c, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesRead=0xd30f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.536] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.537] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.537] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0xd30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0162.537] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0xd30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0xd30f828, pbKeyObject=0x0) returned 0x0 [0162.537] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xd30f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xd30f500) returned 0x0 [0162.538] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.538] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xd30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xd30f500) returned 0x0 [0162.541] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.543] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.543] WriteFile (in: hFile=0xec4, lpBuffer=0xd30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd30f830, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesWritten=0xd30f830*=0x428, lpOverlapped=0x0) returned 1 [0162.543] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.543] ReadFile (in: hFile=0xec4, lpBuffer=0x6150000, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0xd30f61c*=0x2418, lpOverlapped=0x0) returned 1 [0162.638] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xffffdbe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.638] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x6150000, cbInput=0x2418, pPaddingInfo=0x0, pbIV=0xd30f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0xd30f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xd30f848, pbOutput=0x6150000, pcbResult=0xd30f618) returned 0x0 [0162.638] WriteFile (in: hFile=0xec4, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0xd30f61c*=0x2420, lpOverlapped=0x0) returned 1 [0162.638] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd30f60c | out: lpNewFilePointer=0x0) returned 1 [0162.639] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.639] WriteFile (in: hFile=0xec4, lpBuffer=0xd30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0xd30f83c*, lpNumberOfBytesWritten=0xd30f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.639] SetFilePointerEx (in: hFile=0xec4, liDistanceToMove=0x2420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.639] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0162.639] CloseHandle (hObject=0xec4) returned 1 [0162.639] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.play")) returned 1 [0162.641] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1820 os_tid = 0x1bf4 [0162.417] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.417] ReadFile (in: hFile=0x118c, lpBuffer=0x24b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x24b7fb34*, lpNumberOfBytesRead=0x24b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.521] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.521] ReadFile (in: hFile=0x118c, lpBuffer=0x24b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x24b7fb34*, lpNumberOfBytesRead=0x24b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.522] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.523] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x24b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0162.523] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x24b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x24b7f828, pbKeyObject=0x0) returned 0x0 [0162.523] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x24b7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x24b7f500) returned 0x0 [0162.524] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.524] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x24b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x24b7f500) returned 0x0 [0162.527] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.529] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.529] WriteFile (in: hFile=0x118c, lpBuffer=0x24b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x24b7f830, lpOverlapped=0x0 | out: lpBuffer=0x24b7fb34*, lpNumberOfBytesWritten=0x24b7f830*=0x428, lpOverlapped=0x0) returned 1 [0162.530] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.530] ReadFile (in: hFile=0x118c, lpBuffer=0x2750000, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x24b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x24b7f61c*=0x928, lpOverlapped=0x0) returned 1 [0162.530] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0xfffff6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.530] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2750000, cbInput=0x928, pPaddingInfo=0x0, pbIV=0x24b7f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x24b7f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x24b7f848, pbOutput=0x2750000, pcbResult=0x24b7f618) returned 0x0 [0162.530] WriteFile (in: hFile=0x118c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x24b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x24b7f61c*=0x930, lpOverlapped=0x0) returned 1 [0162.530] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24b7f60c | out: lpNewFilePointer=0x0) returned 1 [0162.531] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.531] WriteFile (in: hFile=0x118c, lpBuffer=0x24b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x24b7f83c*, lpNumberOfBytesWritten=0x24b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.531] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.531] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0162.531] CloseHandle (hObject=0x118c) returned 1 [0162.531] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.play")) returned 1 [0162.533] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1821 os_tid = 0x1bf8 [0162.418] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.419] ReadFile (in: hFile=0x1194, lpBuffer=0x24cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x24cbfb34*, lpNumberOfBytesRead=0x24cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.521] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.521] ReadFile (in: hFile=0x1194, lpBuffer=0x24cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x24cbfb34*, lpNumberOfBytesRead=0x24cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.644] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.645] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.645] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x24cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0162.645] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x24cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x24cbf828, pbKeyObject=0x0) returned 0x0 [0162.645] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x24cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x24cbf500) returned 0x0 [0162.645] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.645] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x24cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x24cbf500) returned 0x0 [0162.649] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.650] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.651] WriteFile (in: hFile=0x1194, lpBuffer=0x24cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x24cbf830, lpOverlapped=0x0 | out: lpBuffer=0x24cbfb34*, lpNumberOfBytesWritten=0x24cbf830*=0x428, lpOverlapped=0x0) returned 1 [0162.651] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.651] ReadFile (in: hFile=0x1194, lpBuffer=0x6250000, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x24cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x24cbf61c*=0x17ac, lpOverlapped=0x0) returned 1 [0162.651] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0xffffe854, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.651] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x6250000, cbInput=0x17ac, pPaddingInfo=0x0, pbIV=0x24cbf848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x24cbf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x24cbf848, pbOutput=0x6250000, pcbResult=0x24cbf618) returned 0x0 [0162.651] WriteFile (in: hFile=0x1194, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x24cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x24cbf61c*=0x17b0, lpOverlapped=0x0) returned 1 [0162.651] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24cbf60c | out: lpNewFilePointer=0x0) returned 1 [0162.651] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.651] WriteFile (in: hFile=0x1194, lpBuffer=0x24cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x24cbf83c*, lpNumberOfBytesWritten=0x24cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.652] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x17b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.652] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0162.652] CloseHandle (hObject=0x1194) returned 1 [0162.652] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.play")) returned 1 [0162.654] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1822 os_tid = 0x1bfc [0162.420] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.420] ReadFile (in: hFile=0x119c, lpBuffer=0x24dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24dff85c, lpOverlapped=0x0 | out: lpBuffer=0x24dffb34*, lpNumberOfBytesRead=0x24dff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.422] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.422] ReadFile (in: hFile=0x119c, lpBuffer=0x24dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24dff85c, lpOverlapped=0x0 | out: lpBuffer=0x24dffb34*, lpNumberOfBytesRead=0x24dff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.422] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.424] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.424] BCryptSetProperty (in: hObject=0x732d30, pszProperty="ChainingMode", pbInput=0x24dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732d30) returned 0x0 [0162.424] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732d30, phKey=0x24dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732d30, phKey=0x24dff828, pbKeyObject=0x0) returned 0x0 [0162.424] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x24dff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x24dff500) returned 0x0 [0162.424] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.424] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x24dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x24dff500) returned 0x0 [0162.427] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.430] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.430] WriteFile (in: hFile=0x119c, lpBuffer=0x24dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x24dff830, lpOverlapped=0x0 | out: lpBuffer=0x24dffb34*, lpNumberOfBytesWritten=0x24dff830*=0x428, lpOverlapped=0x0) returned 1 [0162.431] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.431] ReadFile (in: hFile=0x119c, lpBuffer=0x6350000, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x24dff61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x24dff61c*=0xd58, lpOverlapped=0x0) returned 1 [0162.431] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0xfffff2a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.431] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6350000, cbInput=0xd58, pPaddingInfo=0x0, pbIV=0x24dff848, cbIV=0x10, pbOutput=0x6350000, cbOutput=0x100000, pcbResult=0x24dff618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x24dff848, pbOutput=0x6350000, pcbResult=0x24dff618) returned 0x0 [0162.431] WriteFile (in: hFile=0x119c, lpBuffer=0x6350000*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x24dff61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesWritten=0x24dff61c*=0xd60, lpOverlapped=0x0) returned 1 [0162.431] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dff60c | out: lpNewFilePointer=0x0) returned 1 [0162.431] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.431] WriteFile (in: hFile=0x119c, lpBuffer=0x24dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dff61c, lpOverlapped=0x0 | out: lpBuffer=0x24dff83c*, lpNumberOfBytesWritten=0x24dff61c*=0x8, lpOverlapped=0x0) returned 1 [0162.431] SetFilePointerEx (in: hFile=0x119c, liDistanceToMove=0xd60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.431] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.431] CloseHandle (hObject=0x119c) returned 1 [0162.431] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.play")) returned 1 [0162.434] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1823 os_tid = 0x1664 [0162.437] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.437] ReadFile (in: hFile=0x11a4, lpBuffer=0x24f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x24f3fb34*, lpNumberOfBytesRead=0x24f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.610] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.610] ReadFile (in: hFile=0x11a4, lpBuffer=0x24f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x24f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x24f3fb34*, lpNumberOfBytesRead=0x24f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.610] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.612] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.612] BCryptSetProperty (in: hObject=0x731d60, pszProperty="ChainingMode", pbInput=0x24f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731d60) returned 0x0 [0162.612] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731d60, phKey=0x24f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731d60, phKey=0x24f3f828, pbKeyObject=0x0) returned 0x0 [0162.612] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x24f3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x24f3f500) returned 0x0 [0162.612] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.612] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x24f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x24f3f500) returned 0x0 [0162.616] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.618] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.618] WriteFile (in: hFile=0x11a4, lpBuffer=0x24f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x24f3f830, lpOverlapped=0x0 | out: lpBuffer=0x24f3fb34*, lpNumberOfBytesWritten=0x24f3f830*=0x428, lpOverlapped=0x0) returned 1 [0162.618] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.618] ReadFile (in: hFile=0x11a4, lpBuffer=0x6450000, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x24f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesRead=0x24f3f61c*=0xa4c, lpOverlapped=0x0) returned 1 [0162.618] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0xfffff5b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.619] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x6450000, cbInput=0xa4c, pPaddingInfo=0x0, pbIV=0x24f3f848, cbIV=0x10, pbOutput=0x6450000, cbOutput=0x100000, pcbResult=0x24f3f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x24f3f848, pbOutput=0x6450000, pcbResult=0x24f3f618) returned 0x0 [0162.619] WriteFile (in: hFile=0x11a4, lpBuffer=0x6450000*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x24f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesWritten=0x24f3f61c*=0xa50, lpOverlapped=0x0) returned 1 [0162.619] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24f3f60c | out: lpNewFilePointer=0x0) returned 1 [0162.619] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.619] WriteFile (in: hFile=0x11a4, lpBuffer=0x24f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x24f3f83c*, lpNumberOfBytesWritten=0x24f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.619] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0xa50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.619] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0162.619] CloseHandle (hObject=0x11a4) returned 1 [0162.619] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.play")) returned 1 [0162.621] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1824 os_tid = 0x808 [0162.440] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.440] ReadFile (in: hFile=0x11ac, lpBuffer=0x2507fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2507f85c, lpOverlapped=0x0 | out: lpBuffer=0x2507fb34*, lpNumberOfBytesRead=0x2507f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.441] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.442] ReadFile (in: hFile=0x11ac, lpBuffer=0x2507fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2507f85c, lpOverlapped=0x0 | out: lpBuffer=0x2507fb34*, lpNumberOfBytesRead=0x2507f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.442] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.445] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.445] BCryptSetProperty (in: hObject=0x7329c0, pszProperty="ChainingMode", pbInput=0x2507f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7329c0) returned 0x0 [0162.445] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7329c0, phKey=0x2507f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7329c0, phKey=0x2507f828, pbKeyObject=0x0) returned 0x0 [0162.445] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2507f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2507f500) returned 0x0 [0162.445] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.445] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2507f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2507f500) returned 0x0 [0162.448] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.450] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.450] WriteFile (in: hFile=0x11ac, lpBuffer=0x2507fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2507f830, lpOverlapped=0x0 | out: lpBuffer=0x2507fb34*, lpNumberOfBytesWritten=0x2507f830*=0x428, lpOverlapped=0x0) returned 1 [0162.451] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.451] ReadFile (in: hFile=0x11ac, lpBuffer=0x6550000, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x2507f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesRead=0x2507f61c*=0x19ec, lpOverlapped=0x0) returned 1 [0162.489] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0xffffe614, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.489] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6550000, cbInput=0x19ec, pPaddingInfo=0x0, pbIV=0x2507f848, cbIV=0x10, pbOutput=0x6550000, cbOutput=0x100000, pcbResult=0x2507f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2507f848, pbOutput=0x6550000, pcbResult=0x2507f618) returned 0x0 [0162.489] WriteFile (in: hFile=0x11ac, lpBuffer=0x6550000*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2507f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesWritten=0x2507f61c*=0x19f0, lpOverlapped=0x0) returned 1 [0162.489] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2507f60c | out: lpNewFilePointer=0x0) returned 1 [0162.489] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.489] WriteFile (in: hFile=0x11ac, lpBuffer=0x2507f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2507f61c, lpOverlapped=0x0 | out: lpBuffer=0x2507f83c*, lpNumberOfBytesWritten=0x2507f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.489] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x19f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.490] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.490] CloseHandle (hObject=0x11ac) returned 1 [0162.490] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.play")) returned 1 [0162.492] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1825 os_tid = 0x1820 [0162.680] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.680] ReadFile (in: hFile=0x11b4, lpBuffer=0x251bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x251bf85c, lpOverlapped=0x0 | out: lpBuffer=0x251bfb34*, lpNumberOfBytesRead=0x251bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.681] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.681] ReadFile (in: hFile=0x11b4, lpBuffer=0x251bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x251bf85c, lpOverlapped=0x0 | out: lpBuffer=0x251bfb34*, lpNumberOfBytesRead=0x251bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.681] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.683] BCryptSetProperty (in: hObject=0x732020, pszProperty="ChainingMode", pbInput=0x251bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732020) returned 0x0 [0162.683] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732020, phKey=0x251bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732020, phKey=0x251bf828, pbKeyObject=0x0) returned 0x0 [0162.683] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x251bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x251bf500) returned 0x0 [0162.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.683] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x251bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x251bf500) returned 0x0 [0162.687] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.689] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.689] WriteFile (in: hFile=0x11b4, lpBuffer=0x251bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x251bf830, lpOverlapped=0x0 | out: lpBuffer=0x251bfb34*, lpNumberOfBytesWritten=0x251bf830*=0x428, lpOverlapped=0x0) returned 1 [0162.689] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.689] ReadFile (in: hFile=0x11b4, lpBuffer=0x6650000, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x251bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesRead=0x251bf61c*=0x1204, lpOverlapped=0x0) returned 1 [0162.689] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0xffffedfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.690] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6650000, cbInput=0x1204, pPaddingInfo=0x0, pbIV=0x251bf848, cbIV=0x10, pbOutput=0x6650000, cbOutput=0x100000, pcbResult=0x251bf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x251bf848, pbOutput=0x6650000, pcbResult=0x251bf618) returned 0x0 [0162.690] WriteFile (in: hFile=0x11b4, lpBuffer=0x6650000*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x251bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesWritten=0x251bf61c*=0x1210, lpOverlapped=0x0) returned 1 [0162.690] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251bf60c | out: lpNewFilePointer=0x0) returned 1 [0162.690] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.690] WriteFile (in: hFile=0x11b4, lpBuffer=0x251bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x251bf61c, lpOverlapped=0x0 | out: lpBuffer=0x251bf83c*, lpNumberOfBytesWritten=0x251bf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.690] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x1210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.690] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.690] CloseHandle (hObject=0x11b4) returned 1 [0162.690] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.691] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.play")) returned 1 [0162.692] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1826 os_tid = 0x1660 [0162.695] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.695] ReadFile (in: hFile=0x11bc, lpBuffer=0x254ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x254ff85c, lpOverlapped=0x0 | out: lpBuffer=0x254ffb34*, lpNumberOfBytesRead=0x254ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.697] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.697] ReadFile (in: hFile=0x11bc, lpBuffer=0x254ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x254ff85c, lpOverlapped=0x0 | out: lpBuffer=0x254ffb34*, lpNumberOfBytesRead=0x254ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.697] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.698] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.698] BCryptSetProperty (in: hObject=0x732a70, pszProperty="ChainingMode", pbInput=0x254ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732a70) returned 0x0 [0162.698] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732a70, phKey=0x254ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732a70, phKey=0x254ff828, pbKeyObject=0x0) returned 0x0 [0162.698] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x254ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x254ff500) returned 0x0 [0162.698] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.698] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x254ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x254ff500) returned 0x0 [0162.702] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.706] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.706] WriteFile (in: hFile=0x11bc, lpBuffer=0x254ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x254ff830, lpOverlapped=0x0 | out: lpBuffer=0x254ffb34*, lpNumberOfBytesWritten=0x254ff830*=0x428, lpOverlapped=0x0) returned 1 [0162.708] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.708] ReadFile (in: hFile=0x11bc, lpBuffer=0x6750000, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x254ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesRead=0x254ff61c*=0xc48, lpOverlapped=0x0) returned 1 [0162.708] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0xfffff3b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.709] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6750000, cbInput=0xc48, pPaddingInfo=0x0, pbIV=0x254ff848, cbIV=0x10, pbOutput=0x6750000, cbOutput=0x100000, pcbResult=0x254ff618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x254ff848, pbOutput=0x6750000, pcbResult=0x254ff618) returned 0x0 [0162.709] WriteFile (in: hFile=0x11bc, lpBuffer=0x6750000*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x254ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesWritten=0x254ff61c*=0xc50, lpOverlapped=0x0) returned 1 [0162.709] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x254ff60c | out: lpNewFilePointer=0x0) returned 1 [0162.709] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.710] WriteFile (in: hFile=0x11bc, lpBuffer=0x254ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x254ff61c, lpOverlapped=0x0 | out: lpBuffer=0x254ff83c*, lpNumberOfBytesWritten=0x254ff61c*=0x8, lpOverlapped=0x0) returned 1 [0162.710] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0xc50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.710] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.710] CloseHandle (hObject=0x11bc) returned 1 [0162.710] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.713] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.play")) returned 1 [0162.715] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1827 os_tid = 0x165c [0162.718] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.718] ReadFile (in: hFile=0x11c4, lpBuffer=0x2563fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2563f85c, lpOverlapped=0x0 | out: lpBuffer=0x2563fb34*, lpNumberOfBytesRead=0x2563f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.719] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.719] ReadFile (in: hFile=0x11c4, lpBuffer=0x2563fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2563f85c, lpOverlapped=0x0 | out: lpBuffer=0x2563fb34*, lpNumberOfBytesRead=0x2563f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.719] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.721] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.721] BCryptSetProperty (in: hObject=0x732bd0, pszProperty="ChainingMode", pbInput=0x2563f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732bd0) returned 0x0 [0162.721] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732bd0, phKey=0x2563f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732bd0, phKey=0x2563f828, pbKeyObject=0x0) returned 0x0 [0162.721] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2563f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2563f500) returned 0x0 [0162.721] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.721] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2563f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2563f500) returned 0x0 [0162.725] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.726] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.726] WriteFile (in: hFile=0x11c4, lpBuffer=0x2563fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2563f830, lpOverlapped=0x0 | out: lpBuffer=0x2563fb34*, lpNumberOfBytesWritten=0x2563f830*=0x428, lpOverlapped=0x0) returned 1 [0162.727] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.727] ReadFile (in: hFile=0x11c4, lpBuffer=0x6850000, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x2563f61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesRead=0x2563f61c*=0x1df4, lpOverlapped=0x0) returned 1 [0162.728] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0xffffe20c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.728] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6850000, cbInput=0x1df4, pPaddingInfo=0x0, pbIV=0x2563f848, cbIV=0x10, pbOutput=0x6850000, cbOutput=0x100000, pcbResult=0x2563f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2563f848, pbOutput=0x6850000, pcbResult=0x2563f618) returned 0x0 [0162.728] WriteFile (in: hFile=0x11c4, lpBuffer=0x6850000*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2563f61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesWritten=0x2563f61c*=0x1e00, lpOverlapped=0x0) returned 1 [0162.729] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2563f60c | out: lpNewFilePointer=0x0) returned 1 [0162.729] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.729] WriteFile (in: hFile=0x11c4, lpBuffer=0x2563f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2563f61c, lpOverlapped=0x0 | out: lpBuffer=0x2563f83c*, lpNumberOfBytesWritten=0x2563f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.729] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x1e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.729] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.729] CloseHandle (hObject=0x11c4) returned 1 [0162.729] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.730] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.play")) returned 1 [0162.731] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1828 os_tid = 0x1658 [0162.737] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.737] ReadFile (in: hFile=0x11cc, lpBuffer=0x2577fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2577f85c, lpOverlapped=0x0 | out: lpBuffer=0x2577fb34*, lpNumberOfBytesRead=0x2577f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.751] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.751] ReadFile (in: hFile=0x11cc, lpBuffer=0x2577fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2577f85c, lpOverlapped=0x0 | out: lpBuffer=0x2577fb34*, lpNumberOfBytesRead=0x2577f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.751] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.755] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.756] BCryptSetProperty (in: hObject=0x733200, pszProperty="ChainingMode", pbInput=0x2577f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733200) returned 0x0 [0162.756] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733200, phKey=0x2577f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733200, phKey=0x2577f828, pbKeyObject=0x0) returned 0x0 [0162.756] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2577f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2577f500) returned 0x0 [0162.757] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.757] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2577f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2577f500) returned 0x0 [0162.765] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.767] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.767] WriteFile (in: hFile=0x11cc, lpBuffer=0x2577fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2577f830, lpOverlapped=0x0 | out: lpBuffer=0x2577fb34*, lpNumberOfBytesWritten=0x2577f830*=0x428, lpOverlapped=0x0) returned 1 [0162.768] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.768] ReadFile (in: hFile=0x11cc, lpBuffer=0x6950000, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x2577f61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesRead=0x2577f61c*=0x212c, lpOverlapped=0x0) returned 1 [0162.844] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0xffffded4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.844] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x6950000, cbInput=0x212c, pPaddingInfo=0x0, pbIV=0x2577f848, cbIV=0x10, pbOutput=0x6950000, cbOutput=0x100000, pcbResult=0x2577f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2577f848, pbOutput=0x6950000, pcbResult=0x2577f618) returned 0x0 [0162.845] WriteFile (in: hFile=0x11cc, lpBuffer=0x6950000*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2577f61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesWritten=0x2577f61c*=0x2130, lpOverlapped=0x0) returned 1 [0163.043] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2577f60c | out: lpNewFilePointer=0x0) returned 1 [0163.043] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.043] WriteFile (in: hFile=0x11cc, lpBuffer=0x2577f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2577f61c, lpOverlapped=0x0 | out: lpBuffer=0x2577f83c*, lpNumberOfBytesWritten=0x2577f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.044] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x2130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.044] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0163.044] CloseHandle (hObject=0x11cc) returned 1 [0163.044] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd280000 [0163.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.play")) returned 1 [0163.049] VirtualFree (lpAddress=0xd280000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1829 os_tid = 0x1654 [0162.738] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.738] ReadFile (in: hFile=0x11d4, lpBuffer=0x258bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x258bf85c, lpOverlapped=0x0 | out: lpBuffer=0x258bfb34*, lpNumberOfBytesRead=0x258bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.739] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.739] ReadFile (in: hFile=0x11d4, lpBuffer=0x258bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x258bf85c, lpOverlapped=0x0 | out: lpBuffer=0x258bfb34*, lpNumberOfBytesRead=0x258bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.739] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.741] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.741] BCryptSetProperty (in: hObject=0x731cb0, pszProperty="ChainingMode", pbInput=0x258bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731cb0) returned 0x0 [0162.741] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731cb0, phKey=0x258bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731cb0, phKey=0x258bf828, pbKeyObject=0x0) returned 0x0 [0162.741] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x258bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x258bf500) returned 0x0 [0162.741] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.741] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x258bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x258bf500) returned 0x0 [0162.745] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.748] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.748] WriteFile (in: hFile=0x11d4, lpBuffer=0x258bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x258bf830, lpOverlapped=0x0 | out: lpBuffer=0x258bfb34*, lpNumberOfBytesWritten=0x258bf830*=0x428, lpOverlapped=0x0) returned 1 [0162.749] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.750] ReadFile (in: hFile=0x11d4, lpBuffer=0x6a50000, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x258bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesRead=0x258bf61c*=0x1e7c, lpOverlapped=0x0) returned 1 [0162.768] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0xffffe184, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.768] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6a50000, cbInput=0x1e7c, pPaddingInfo=0x0, pbIV=0x258bf848, cbIV=0x10, pbOutput=0x6a50000, cbOutput=0x100000, pcbResult=0x258bf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x258bf848, pbOutput=0x6a50000, pcbResult=0x258bf618) returned 0x0 [0162.768] WriteFile (in: hFile=0x11d4, lpBuffer=0x6a50000*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x258bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesWritten=0x258bf61c*=0x1e80, lpOverlapped=0x0) returned 1 [0162.769] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258bf60c | out: lpNewFilePointer=0x0) returned 1 [0162.769] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.769] WriteFile (in: hFile=0x11d4, lpBuffer=0x258bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x258bf61c, lpOverlapped=0x0 | out: lpBuffer=0x258bf83c*, lpNumberOfBytesWritten=0x258bf61c*=0x8, lpOverlapped=0x0) returned 1 [0162.769] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x1e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.769] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.769] CloseHandle (hObject=0x11d4) returned 1 [0162.769] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0162.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.play")) returned 1 [0162.771] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1830 os_tid = 0x1650 [0162.774] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.774] ReadFile (in: hFile=0x608, lpBuffer=0xdf4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdf4f85c, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesRead=0xdf4f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.855] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.855] ReadFile (in: hFile=0x608, lpBuffer=0xdf4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdf4f85c, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesRead=0xdf4f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.855] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.857] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.857] BCryptSetProperty (in: hObject=0x732230, pszProperty="ChainingMode", pbInput=0xdf4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732230) returned 0x0 [0162.857] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732230, phKey=0xdf4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732230, phKey=0xdf4f828, pbKeyObject=0x0) returned 0x0 [0162.857] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xdf4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xdf4f500) returned 0x0 [0162.857] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.857] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xdf4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xdf4f500) returned 0x0 [0162.861] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.862] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.862] WriteFile (in: hFile=0x608, lpBuffer=0xdf4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdf4f830, lpOverlapped=0x0 | out: lpBuffer=0xdf4fb34*, lpNumberOfBytesWritten=0xdf4f830*=0x428, lpOverlapped=0x0) returned 1 [0163.038] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.038] ReadFile (in: hFile=0x608, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0xdf4f61c*=0x1e7c, lpOverlapped=0x0) returned 1 [0163.114] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xffffe184, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.114] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x6b50000, cbInput=0x1e7c, pPaddingInfo=0x0, pbIV=0xdf4f848, cbIV=0x10, pbOutput=0x6b50000, cbOutput=0x100000, pcbResult=0xdf4f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xdf4f848, pbOutput=0x6b50000, pcbResult=0xdf4f618) returned 0x0 [0163.114] WriteFile (in: hFile=0x608, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0xdf4f61c*=0x1e80, lpOverlapped=0x0) returned 1 [0163.114] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdf4f60c | out: lpNewFilePointer=0x0) returned 1 [0163.114] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.114] WriteFile (in: hFile=0x608, lpBuffer=0xdf4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdf4f61c, lpOverlapped=0x0 | out: lpBuffer=0xdf4f83c*, lpNumberOfBytesWritten=0xdf4f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.114] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x1e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.114] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0163.114] CloseHandle (hObject=0x608) returned 1 [0163.114] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.play")) returned 1 [0163.117] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1831 os_tid = 0x164c [0162.812] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.812] ReadFile (in: hFile=0x5d4, lpBuffer=0xda0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda0f85c, lpOverlapped=0x0 | out: lpBuffer=0xda0fb34*, lpNumberOfBytesRead=0xda0f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.813] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.815] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.815] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xda0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0162.815] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xda0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xda0f828, pbKeyObject=0x0) returned 0x0 [0162.815] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xda0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xda0f500) returned 0x0 [0162.815] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.816] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xda0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xda0f500) returned 0x0 [0162.819] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.821] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.821] WriteFile (in: hFile=0x5d4, lpBuffer=0xda0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xda0f830, lpOverlapped=0x0 | out: lpBuffer=0xda0fb34*, lpNumberOfBytesWritten=0xda0f830*=0x428, lpOverlapped=0x0) returned 1 [0162.959] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.959] ReadFile (in: hFile=0x5d4, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0xda0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xda0f61c*=0x7e0, lpOverlapped=0x0) returned 1 [0162.959] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffff820, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.959] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x2e50000, cbInput=0x7e0, pPaddingInfo=0x0, pbIV=0xda0f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xda0f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0xda0f848, pbOutput=0x2e50000, pcbResult=0xda0f618) returned 0x0 [0162.959] WriteFile (in: hFile=0x5d4, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0xda0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xda0f61c*=0x7f0, lpOverlapped=0x0) returned 1 [0162.961] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xda0f60c | out: lpNewFilePointer=0x0) returned 1 [0162.961] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.961] WriteFile (in: hFile=0x5d4, lpBuffer=0xda0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xda0f61c, lpOverlapped=0x0 | out: lpBuffer=0xda0f83c*, lpNumberOfBytesWritten=0xda0f61c*=0x8, lpOverlapped=0x0) returned 1 [0162.961] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.961] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0162.961] CloseHandle (hObject=0x5d4) returned 1 [0162.961] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0162.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.play")) returned 1 [0162.965] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1832 os_tid = 0x1648 [0162.821] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.822] ReadFile (in: hFile=0x11ec, lpBuffer=0xe20fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe20f85c, lpOverlapped=0x0 | out: lpBuffer=0xe20fb34*, lpNumberOfBytesRead=0xe20f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.823] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.823] ReadFile (in: hFile=0x11ec, lpBuffer=0xe20fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe20f85c, lpOverlapped=0x0 | out: lpBuffer=0xe20fb34*, lpNumberOfBytesRead=0xe20f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.823] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.825] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.825] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xe20f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0162.825] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xe20f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xe20f828, pbKeyObject=0x0) returned 0x0 [0162.825] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xe20f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xe20f500) returned 0x0 [0162.825] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.825] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xe20f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xe20f500) returned 0x0 [0162.835] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.838] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.839] WriteFile (in: hFile=0x11ec, lpBuffer=0xe20fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe20f830, lpOverlapped=0x0 | out: lpBuffer=0xe20fb34*, lpNumberOfBytesWritten=0xe20f830*=0x428, lpOverlapped=0x0) returned 1 [0163.051] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.051] ReadFile (in: hFile=0x11ec, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0xe20f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xe20f61c*=0x9bc, lpOverlapped=0x0) returned 1 [0163.051] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0xfffff644, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.051] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2b50000, cbInput=0x9bc, pPaddingInfo=0x0, pbIV=0xe20f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xe20f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xe20f848, pbOutput=0x2b50000, pcbResult=0xe20f618) returned 0x0 [0163.051] WriteFile (in: hFile=0x11ec, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0xe20f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xe20f61c*=0x9c0, lpOverlapped=0x0) returned 1 [0163.051] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe20f60c | out: lpNewFilePointer=0x0) returned 1 [0163.051] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.051] WriteFile (in: hFile=0x11ec, lpBuffer=0xe20f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe20f61c, lpOverlapped=0x0 | out: lpBuffer=0xe20f83c*, lpNumberOfBytesWritten=0xe20f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.051] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x9c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.051] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0163.051] CloseHandle (hObject=0x11ec) returned 1 [0163.051] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd280000 [0163.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.play")) returned 1 [0163.053] VirtualFree (lpAddress=0xd280000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1833 os_tid = 0x1644 [0162.840] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.840] ReadFile (in: hFile=0x11f4, lpBuffer=0xe34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe34f85c, lpOverlapped=0x0 | out: lpBuffer=0xe34fb34*, lpNumberOfBytesRead=0xe34f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.968] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.969] ReadFile (in: hFile=0x11f4, lpBuffer=0xe34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe34f85c, lpOverlapped=0x0 | out: lpBuffer=0xe34fb34*, lpNumberOfBytesRead=0xe34f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.969] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0163.515] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0163.515] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xe34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0163.515] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xe34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xe34f828, pbKeyObject=0x0) returned 0x0 [0163.515] BCryptExportKey (in: hKey=0x793f40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xe34f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xe34f500) returned 0x0 [0163.515] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0163.515] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xe34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xe34f500) returned 0x0 [0163.519] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.521] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.521] WriteFile (in: hFile=0x11f4, lpBuffer=0xe34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe34f830, lpOverlapped=0x0 | out: lpBuffer=0xe34fb34*, lpNumberOfBytesWritten=0xe34f830*=0x428, lpOverlapped=0x0) returned 1 [0163.522] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.522] ReadFile (in: hFile=0x11f4, lpBuffer=0x3350000, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0xe34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xe34f61c*=0xd14, lpOverlapped=0x0) returned 1 [0163.522] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xfffff2ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.522] BCryptEncrypt (in: hKey=0x793f40, pbInput=0x3350000, cbInput=0xd14, pPaddingInfo=0x0, pbIV=0xe34f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xe34f618, dwFlags=0x1 | out: hKey=0x793f40, pbIV=0xe34f848, pbOutput=0x3350000, pcbResult=0xe34f618) returned 0x0 [0163.522] WriteFile (in: hFile=0x11f4, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0xe34f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xe34f61c*=0xd20, lpOverlapped=0x0) returned 1 [0163.522] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe34f60c | out: lpNewFilePointer=0x0) returned 1 [0163.522] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.522] WriteFile (in: hFile=0x11f4, lpBuffer=0xe34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe34f61c, lpOverlapped=0x0 | out: lpBuffer=0xe34f83c*, lpNumberOfBytesWritten=0xe34f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.523] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0xd20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.523] BCryptDestroyKey (in: hKey=0x793f40 | out: hKey=0x793f40) returned 0x0 [0163.523] CloseHandle (hObject=0x11f4) returned 1 [0163.523] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.play")) returned 1 [0163.525] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1834 os_tid = 0x1640 [0162.842] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.842] ReadFile (in: hFile=0x11fc, lpBuffer=0x2133fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2133f85c, lpOverlapped=0x0 | out: lpBuffer=0x2133fb34*, lpNumberOfBytesRead=0x2133f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.936] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.936] ReadFile (in: hFile=0x11fc, lpBuffer=0x2133fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2133f85c, lpOverlapped=0x0 | out: lpBuffer=0x2133fb34*, lpNumberOfBytesRead=0x2133f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.936] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0163.073] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0163.073] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2133f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0163.073] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2133f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2133f828, pbKeyObject=0x0) returned 0x0 [0163.073] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2133f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2133f500) returned 0x0 [0163.073] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0163.073] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2133f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2133f500) returned 0x0 [0163.077] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.079] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.079] WriteFile (in: hFile=0x11fc, lpBuffer=0x2133fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2133f830, lpOverlapped=0x0 | out: lpBuffer=0x2133fb34*, lpNumberOfBytesWritten=0x2133f830*=0x428, lpOverlapped=0x0) returned 1 [0163.080] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.080] ReadFile (in: hFile=0x11fc, lpBuffer=0x3450000, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x2133f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2133f61c*=0x10c8, lpOverlapped=0x0) returned 1 [0163.080] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0xffffef38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.080] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3450000, cbInput=0x10c8, pPaddingInfo=0x0, pbIV=0x2133f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2133f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x2133f848, pbOutput=0x3450000, pcbResult=0x2133f618) returned 0x0 [0163.080] WriteFile (in: hFile=0x11fc, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2133f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2133f61c*=0x10d0, lpOverlapped=0x0) returned 1 [0163.080] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2133f60c | out: lpNewFilePointer=0x0) returned 1 [0163.080] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.080] WriteFile (in: hFile=0x11fc, lpBuffer=0x2133f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2133f61c, lpOverlapped=0x0 | out: lpBuffer=0x2133f83c*, lpNumberOfBytesWritten=0x2133f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.081] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0x10d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.081] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0163.081] CloseHandle (hObject=0x11fc) returned 1 [0163.081] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.play")) returned 1 [0163.083] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1835 os_tid = 0x163c [0162.843] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.843] ReadFile (in: hFile=0x1204, lpBuffer=0x259bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x259bf85c, lpOverlapped=0x0 | out: lpBuffer=0x259bfb34*, lpNumberOfBytesRead=0x259bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.973] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.973] ReadFile (in: hFile=0x1204, lpBuffer=0x259bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x259bf85c, lpOverlapped=0x0 | out: lpBuffer=0x259bfb34*, lpNumberOfBytesRead=0x259bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb760000 [0163.492] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb760000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb760000) returned 0x0 [0163.493] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x259bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0163.493] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x259bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb760000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x259bf828, pbKeyObject=0x0) returned 0x0 [0163.493] BCryptExportKey (in: hKey=0x793f40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb760000, cbOutput=0x230, pcbResult=0x259bf500, dwFlags=0x0 | out: pbOutput=0xb760000, pcbResult=0x259bf500) returned 0x0 [0163.493] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb760230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb760230) returned 0x0 [0163.493] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb760000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb760000, cbOutput=0x400, pcbResult=0x259bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb760000, pcbResult=0x259bf500) returned 0x0 [0163.496] VirtualFree (lpAddress=0xb760000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.498] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.498] WriteFile (in: hFile=0x1204, lpBuffer=0x259bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x259bf830, lpOverlapped=0x0 | out: lpBuffer=0x259bfb34*, lpNumberOfBytesWritten=0x259bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.498] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.499] ReadFile (in: hFile=0x1204, lpBuffer=0x3550000, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x259bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x259bf61c*=0xc9c, lpOverlapped=0x0) returned 1 [0163.499] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0xfffff364, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.499] BCryptEncrypt (in: hKey=0x793f40, pbInput=0x3550000, cbInput=0xc9c, pPaddingInfo=0x0, pbIV=0x259bf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x259bf618, dwFlags=0x1 | out: hKey=0x793f40, pbIV=0x259bf848, pbOutput=0x3550000, pcbResult=0x259bf618) returned 0x0 [0163.499] WriteFile (in: hFile=0x1204, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x259bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x259bf61c*=0xca0, lpOverlapped=0x0) returned 1 [0163.499] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.499] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.499] WriteFile (in: hFile=0x1204, lpBuffer=0x259bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x259bf61c, lpOverlapped=0x0 | out: lpBuffer=0x259bf83c*, lpNumberOfBytesWritten=0x259bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.499] SetFilePointerEx (in: hFile=0x1204, liDistanceToMove=0xca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.499] BCryptDestroyKey (in: hKey=0x793f40 | out: hKey=0x793f40) returned 0x0 [0163.499] CloseHandle (hObject=0x1204) returned 1 [0163.499] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.play")) returned 1 [0163.501] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1836 os_tid = 0x1638 [0162.845] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.845] ReadFile (in: hFile=0x120c, lpBuffer=0x25abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25abf85c, lpOverlapped=0x0 | out: lpBuffer=0x25abfb34*, lpNumberOfBytesRead=0x25abf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.846] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.847] ReadFile (in: hFile=0x120c, lpBuffer=0x25abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25abf85c, lpOverlapped=0x0 | out: lpBuffer=0x25abfb34*, lpNumberOfBytesRead=0x25abf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.847] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.848] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.849] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x25abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0162.849] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x25abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x25abf828, pbKeyObject=0x0) returned 0x0 [0162.849] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x25abf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x25abf500) returned 0x0 [0162.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.849] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x25abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x25abf500) returned 0x0 [0162.853] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.855] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.855] WriteFile (in: hFile=0x120c, lpBuffer=0x25abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x25abf830, lpOverlapped=0x0 | out: lpBuffer=0x25abfb34*, lpNumberOfBytesWritten=0x25abf830*=0x428, lpOverlapped=0x0) returned 1 [0163.038] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.038] ReadFile (in: hFile=0x120c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x25abf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x25abf61c*=0x12c8, lpOverlapped=0x0) returned 1 [0163.039] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0xffffed38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.039] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3650000, cbInput=0x12c8, pPaddingInfo=0x0, pbIV=0x25abf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x25abf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x25abf848, pbOutput=0x3650000, pcbResult=0x25abf618) returned 0x0 [0163.039] WriteFile (in: hFile=0x120c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x25abf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x25abf61c*=0x12d0, lpOverlapped=0x0) returned 1 [0163.039] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25abf60c | out: lpNewFilePointer=0x0) returned 1 [0163.039] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.039] WriteFile (in: hFile=0x120c, lpBuffer=0x25abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25abf61c, lpOverlapped=0x0 | out: lpBuffer=0x25abf83c*, lpNumberOfBytesWritten=0x25abf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.039] SetFilePointerEx (in: hFile=0x120c, liDistanceToMove=0x12d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.039] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0163.039] CloseHandle (hObject=0x120c) returned 1 [0163.039] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd280000 [0163.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.play")) returned 1 [0163.041] VirtualFree (lpAddress=0xd280000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1837 os_tid = 0x1634 [0162.863] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.863] ReadFile (in: hFile=0x1214, lpBuffer=0x25bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x25bbfb34*, lpNumberOfBytesRead=0x25bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.864] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.865] ReadFile (in: hFile=0x1214, lpBuffer=0x25bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x25bbfb34*, lpNumberOfBytesRead=0x25bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.865] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.866] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.866] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x25bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0162.866] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x25bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x25bbf828, pbKeyObject=0x0) returned 0x0 [0162.866] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x25bbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x25bbf500) returned 0x0 [0162.866] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.866] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x25bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x25bbf500) returned 0x0 [0162.870] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.871] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.871] WriteFile (in: hFile=0x1214, lpBuffer=0x25bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x25bbf830, lpOverlapped=0x0 | out: lpBuffer=0x25bbfb34*, lpNumberOfBytesWritten=0x25bbf830*=0x428, lpOverlapped=0x0) returned 1 [0163.031] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.031] ReadFile (in: hFile=0x1214, lpBuffer=0x4050000, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x25bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x25bbf61c*=0x1384, lpOverlapped=0x0) returned 1 [0163.031] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0xffffec7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.032] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4050000, cbInput=0x1384, pPaddingInfo=0x0, pbIV=0x25bbf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x25bbf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x25bbf848, pbOutput=0x4050000, pcbResult=0x25bbf618) returned 0x0 [0163.032] WriteFile (in: hFile=0x1214, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x25bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x25bbf61c*=0x1390, lpOverlapped=0x0) returned 1 [0163.032] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bbf60c | out: lpNewFilePointer=0x0) returned 1 [0163.032] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.032] WriteFile (in: hFile=0x1214, lpBuffer=0x25bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x25bbf83c*, lpNumberOfBytesWritten=0x25bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.032] SetFilePointerEx (in: hFile=0x1214, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.032] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0163.032] CloseHandle (hObject=0x1214) returned 1 [0163.032] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd280000 [0163.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.play")) returned 1 [0163.035] VirtualFree (lpAddress=0xd280000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1838 os_tid = 0x1630 [0162.872] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.872] ReadFile (in: hFile=0x121c, lpBuffer=0x25cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x25cbfb34*, lpNumberOfBytesRead=0x25cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.971] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.971] ReadFile (in: hFile=0x121c, lpBuffer=0x25cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x25cbfb34*, lpNumberOfBytesRead=0x25cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.971] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb750000 [0163.504] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb750000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb750000) returned 0x0 [0163.504] BCryptSetProperty (in: hObject=0x732440, pszProperty="ChainingMode", pbInput=0x25cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732440) returned 0x0 [0163.504] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732440, phKey=0x25cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb750000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732440, phKey=0x25cbf828, pbKeyObject=0x0) returned 0x0 [0163.504] BCryptExportKey (in: hKey=0x793f40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb750000, cbOutput=0x230, pcbResult=0x25cbf500, dwFlags=0x0 | out: pbOutput=0xb750000, pcbResult=0x25cbf500) returned 0x0 [0163.504] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb750230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb750230) returned 0x0 [0163.504] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb750000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb750000, cbOutput=0x400, pcbResult=0x25cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb750000, pcbResult=0x25cbf500) returned 0x0 [0163.507] VirtualFree (lpAddress=0xb750000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.509] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.509] WriteFile (in: hFile=0x121c, lpBuffer=0x25cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x25cbf830, lpOverlapped=0x0 | out: lpBuffer=0x25cbfb34*, lpNumberOfBytesWritten=0x25cbf830*=0x428, lpOverlapped=0x0) returned 1 [0163.509] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.509] ReadFile (in: hFile=0x121c, lpBuffer=0x6c50000, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x25cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesRead=0x25cbf61c*=0x138c, lpOverlapped=0x0) returned 1 [0163.510] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xffffec74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.510] BCryptEncrypt (in: hKey=0x793f40, pbInput=0x6c50000, cbInput=0x138c, pPaddingInfo=0x0, pbIV=0x25cbf848, cbIV=0x10, pbOutput=0x6c50000, cbOutput=0x100000, pcbResult=0x25cbf618, dwFlags=0x1 | out: hKey=0x793f40, pbIV=0x25cbf848, pbOutput=0x6c50000, pcbResult=0x25cbf618) returned 0x0 [0163.510] WriteFile (in: hFile=0x121c, lpBuffer=0x6c50000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x25cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesWritten=0x25cbf61c*=0x1390, lpOverlapped=0x0) returned 1 [0163.510] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cbf60c | out: lpNewFilePointer=0x0) returned 1 [0163.510] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.510] WriteFile (in: hFile=0x121c, lpBuffer=0x25cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x25cbf83c*, lpNumberOfBytesWritten=0x25cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.510] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.510] BCryptDestroyKey (in: hKey=0x793f40 | out: hKey=0x793f40) returned 0x0 [0163.510] CloseHandle (hObject=0x121c) returned 1 [0163.510] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.play")) returned 1 [0163.512] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1839 os_tid = 0x162c [0162.874] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.874] ReadFile (in: hFile=0x1224, lpBuffer=0x25dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25dff85c, lpOverlapped=0x0 | out: lpBuffer=0x25dffb34*, lpNumberOfBytesRead=0x25dff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.997] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.997] ReadFile (in: hFile=0x1224, lpBuffer=0x25dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25dff85c, lpOverlapped=0x0 | out: lpBuffer=0x25dffb34*, lpNumberOfBytesRead=0x25dff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.997] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb830000 [0163.391] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb830000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb830000) returned 0x0 [0163.391] BCryptSetProperty (in: hObject=0x7324f0, pszProperty="ChainingMode", pbInput=0x25dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7324f0) returned 0x0 [0163.391] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7324f0, phKey=0x25dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb830000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7324f0, phKey=0x25dff828, pbKeyObject=0x0) returned 0x0 [0163.391] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb830000, cbOutput=0x230, pcbResult=0x25dff500, dwFlags=0x0 | out: pbOutput=0xb830000, pcbResult=0x25dff500) returned 0x0 [0163.391] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb830230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb830230) returned 0x0 [0163.392] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb830000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb830000, cbOutput=0x400, pcbResult=0x25dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb830000, pcbResult=0x25dff500) returned 0x0 [0163.396] VirtualFree (lpAddress=0xb830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.398] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.398] WriteFile (in: hFile=0x1224, lpBuffer=0x25dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x25dff830, lpOverlapped=0x0 | out: lpBuffer=0x25dffb34*, lpNumberOfBytesWritten=0x25dff830*=0x428, lpOverlapped=0x0) returned 1 [0163.399] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.399] ReadFile (in: hFile=0x1224, lpBuffer=0x6d50000, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x25dff61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesRead=0x25dff61c*=0x1cd8, lpOverlapped=0x0) returned 1 [0163.528] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0xffffe328, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.528] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x6d50000, cbInput=0x1cd8, pPaddingInfo=0x0, pbIV=0x25dff848, cbIV=0x10, pbOutput=0x6d50000, cbOutput=0x100000, pcbResult=0x25dff618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x25dff848, pbOutput=0x6d50000, pcbResult=0x25dff618) returned 0x0 [0163.528] WriteFile (in: hFile=0x1224, lpBuffer=0x6d50000*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x25dff61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesWritten=0x25dff61c*=0x1ce0, lpOverlapped=0x0) returned 1 [0163.528] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dff60c | out: lpNewFilePointer=0x0) returned 1 [0163.528] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.528] WriteFile (in: hFile=0x1224, lpBuffer=0x25dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25dff61c, lpOverlapped=0x0 | out: lpBuffer=0x25dff83c*, lpNumberOfBytesWritten=0x25dff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.528] SetFilePointerEx (in: hFile=0x1224, liDistanceToMove=0x1ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.528] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0163.528] CloseHandle (hObject=0x1224) returned 1 [0163.529] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\baby_01.mid.play")) returned 1 [0163.531] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1840 os_tid = 0x1628 [0162.876] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.876] ReadFile (in: hFile=0x122c, lpBuffer=0x25f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x25f3fb34*, lpNumberOfBytesRead=0x25f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.004] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.005] ReadFile (in: hFile=0x122c, lpBuffer=0x25f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x25f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x25f3fb34*, lpNumberOfBytesRead=0x25f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.005] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb870000 [0163.356] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb870000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb870000) returned 0x0 [0163.356] BCryptSetProperty (in: hObject=0x7325a0, pszProperty="ChainingMode", pbInput=0x25f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7325a0) returned 0x0 [0163.356] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7325a0, phKey=0x25f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb870000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7325a0, phKey=0x25f3f828, pbKeyObject=0x0) returned 0x0 [0163.356] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb870000, cbOutput=0x230, pcbResult=0x25f3f500, dwFlags=0x0 | out: pbOutput=0xb870000, pcbResult=0x25f3f500) returned 0x0 [0163.356] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb870230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb870230) returned 0x0 [0163.356] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb870000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb870000, cbOutput=0x400, pcbResult=0x25f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb870000, pcbResult=0x25f3f500) returned 0x0 [0163.360] VirtualFree (lpAddress=0xb870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.361] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.361] WriteFile (in: hFile=0x122c, lpBuffer=0x25f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x25f3f830, lpOverlapped=0x0 | out: lpBuffer=0x25f3fb34*, lpNumberOfBytesWritten=0x25f3f830*=0x428, lpOverlapped=0x0) returned 1 [0163.362] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.362] ReadFile (in: hFile=0x122c, lpBuffer=0x6e50000, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x25f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesRead=0x25f3f61c*=0x1306, lpOverlapped=0x0) returned 1 [0163.362] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0xffffecfa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.362] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6e50000, cbInput=0x1306, pPaddingInfo=0x0, pbIV=0x25f3f848, cbIV=0x10, pbOutput=0x6e50000, cbOutput=0x100000, pcbResult=0x25f3f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x25f3f848, pbOutput=0x6e50000, pcbResult=0x25f3f618) returned 0x0 [0163.362] WriteFile (in: hFile=0x122c, lpBuffer=0x6e50000*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x25f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesWritten=0x25f3f61c*=0x1310, lpOverlapped=0x0) returned 1 [0163.362] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25f3f60c | out: lpNewFilePointer=0x0) returned 1 [0163.362] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.363] WriteFile (in: hFile=0x122c, lpBuffer=0x25f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x25f3f83c*, lpNumberOfBytesWritten=0x25f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.363] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x1310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.363] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0163.363] CloseHandle (hObject=0x122c) returned 1 [0163.363] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.play")) returned 1 [0163.365] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1841 os_tid = 0x1624 [0162.877] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.877] ReadFile (in: hFile=0x1234, lpBuffer=0x2607fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2607f85c, lpOverlapped=0x0 | out: lpBuffer=0x2607fb34*, lpNumberOfBytesRead=0x2607f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.003] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.003] ReadFile (in: hFile=0x1234, lpBuffer=0x2607fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2607f85c, lpOverlapped=0x0 | out: lpBuffer=0x2607fb34*, lpNumberOfBytesRead=0x2607f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.003] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb860000 [0163.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb860000) returned 0x0 [0163.368] BCryptSetProperty (in: hObject=0x736300, pszProperty="ChainingMode", pbInput=0x2607f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736300) returned 0x0 [0163.368] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736300, phKey=0x2607f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736300, phKey=0x2607f828, pbKeyObject=0x0) returned 0x0 [0163.368] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb860000, cbOutput=0x230, pcbResult=0x2607f500, dwFlags=0x0 | out: pbOutput=0xb860000, pcbResult=0x2607f500) returned 0x0 [0163.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb860230) returned 0x0 [0163.368] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb860000, cbOutput=0x400, pcbResult=0x2607f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb860000, pcbResult=0x2607f500) returned 0x0 [0163.371] VirtualFree (lpAddress=0xb860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.375] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.375] WriteFile (in: hFile=0x1234, lpBuffer=0x2607fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2607f830, lpOverlapped=0x0 | out: lpBuffer=0x2607fb34*, lpNumberOfBytesWritten=0x2607f830*=0x428, lpOverlapped=0x0) returned 1 [0163.376] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.376] ReadFile (in: hFile=0x1234, lpBuffer=0x6f50000, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x2607f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesRead=0x2607f61c*=0x6906, lpOverlapped=0x0) returned 1 [0163.571] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0xffff96fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.571] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6f50000, cbInput=0x6906, pPaddingInfo=0x0, pbIV=0x2607f848, cbIV=0x10, pbOutput=0x6f50000, cbOutput=0x100000, pcbResult=0x2607f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2607f848, pbOutput=0x6f50000, pcbResult=0x2607f618) returned 0x0 [0163.571] WriteFile (in: hFile=0x1234, lpBuffer=0x6f50000*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2607f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesWritten=0x2607f61c*=0x6910, lpOverlapped=0x0) returned 1 [0163.571] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2607f60c | out: lpNewFilePointer=0x0) returned 1 [0163.571] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.571] WriteFile (in: hFile=0x1234, lpBuffer=0x2607f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2607f61c, lpOverlapped=0x0 | out: lpBuffer=0x2607f83c*, lpNumberOfBytesWritten=0x2607f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.571] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x6910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.571] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0163.571] CloseHandle (hObject=0x1234) returned 1 [0163.571] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.play")) returned 1 [0163.573] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1842 os_tid = 0x1620 [0162.879] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.879] ReadFile (in: hFile=0x123c, lpBuffer=0x261bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x261bf85c, lpOverlapped=0x0 | out: lpBuffer=0x261bfb34*, lpNumberOfBytesRead=0x261bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.001] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.001] ReadFile (in: hFile=0x123c, lpBuffer=0x261bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x261bf85c, lpOverlapped=0x0 | out: lpBuffer=0x261bfb34*, lpNumberOfBytesRead=0x261bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.001] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb850000 [0163.376] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb850000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb850000) returned 0x0 [0163.377] BCryptSetProperty (in: hObject=0x736250, pszProperty="ChainingMode", pbInput=0x261bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736250) returned 0x0 [0163.377] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736250, phKey=0x261bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb850000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736250, phKey=0x261bf828, pbKeyObject=0x0) returned 0x0 [0163.377] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb850000, cbOutput=0x230, pcbResult=0x261bf500, dwFlags=0x0 | out: pbOutput=0xb850000, pcbResult=0x261bf500) returned 0x0 [0163.377] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb850230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb850230) returned 0x0 [0163.377] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb850000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb850000, cbOutput=0x400, pcbResult=0x261bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb850000, pcbResult=0x261bf500) returned 0x0 [0163.380] VirtualFree (lpAddress=0xb850000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.382] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.382] WriteFile (in: hFile=0x123c, lpBuffer=0x261bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x261bf830, lpOverlapped=0x0 | out: lpBuffer=0x261bfb34*, lpNumberOfBytesWritten=0x261bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.382] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.382] ReadFile (in: hFile=0x123c, lpBuffer=0x7050000, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x261bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesRead=0x261bf61c*=0x7114, lpOverlapped=0x0) returned 1 [0163.596] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xffff8eec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.596] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x7050000, cbInput=0x7114, pPaddingInfo=0x0, pbIV=0x261bf848, cbIV=0x10, pbOutput=0x7050000, cbOutput=0x100000, pcbResult=0x261bf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x261bf848, pbOutput=0x7050000, pcbResult=0x261bf618) returned 0x0 [0163.596] WriteFile (in: hFile=0x123c, lpBuffer=0x7050000*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x261bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesWritten=0x261bf61c*=0x7120, lpOverlapped=0x0) returned 1 [0163.596] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x261bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.597] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.597] WriteFile (in: hFile=0x123c, lpBuffer=0x261bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x261bf61c, lpOverlapped=0x0 | out: lpBuffer=0x261bf83c*, lpNumberOfBytesWritten=0x261bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.597] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x7120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.597] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0163.597] CloseHandle (hObject=0x123c) returned 1 [0163.597] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.play")) returned 1 [0163.599] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1843 os_tid = 0x161c [0162.880] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.880] ReadFile (in: hFile=0x1244, lpBuffer=0x262ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x262ff85c, lpOverlapped=0x0 | out: lpBuffer=0x262ffb34*, lpNumberOfBytesRead=0x262ff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.000] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.000] ReadFile (in: hFile=0x1244, lpBuffer=0x262ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x262ff85c, lpOverlapped=0x0 | out: lpBuffer=0x262ffb34*, lpNumberOfBytesRead=0x262ff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.000] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb840000 [0163.384] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb840000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb840000) returned 0x0 [0163.384] BCryptSetProperty (in: hObject=0x7361a0, pszProperty="ChainingMode", pbInput=0x262ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7361a0) returned 0x0 [0163.384] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7361a0, phKey=0x262ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb840000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7361a0, phKey=0x262ff828, pbKeyObject=0x0) returned 0x0 [0163.384] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb840000, cbOutput=0x230, pcbResult=0x262ff500, dwFlags=0x0 | out: pbOutput=0xb840000, pcbResult=0x262ff500) returned 0x0 [0163.384] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb840230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb840230) returned 0x0 [0163.384] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb840000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb840000, cbOutput=0x400, pcbResult=0x262ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb840000, pcbResult=0x262ff500) returned 0x0 [0163.387] VirtualFree (lpAddress=0xb840000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.390] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.390] WriteFile (in: hFile=0x1244, lpBuffer=0x262ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x262ff830, lpOverlapped=0x0 | out: lpBuffer=0x262ffb34*, lpNumberOfBytesWritten=0x262ff830*=0x428, lpOverlapped=0x0) returned 1 [0163.391] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.391] ReadFile (in: hFile=0x1244, lpBuffer=0x7150000, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x262ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesRead=0x262ff61c*=0x2d74, lpOverlapped=0x0) returned 1 [0163.601] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0xffffd28c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.601] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x7150000, cbInput=0x2d74, pPaddingInfo=0x0, pbIV=0x262ff848, cbIV=0x10, pbOutput=0x7150000, cbOutput=0x100000, pcbResult=0x262ff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x262ff848, pbOutput=0x7150000, pcbResult=0x262ff618) returned 0x0 [0163.601] WriteFile (in: hFile=0x1244, lpBuffer=0x7150000*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x262ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesWritten=0x262ff61c*=0x2d80, lpOverlapped=0x0) returned 1 [0163.602] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262ff60c | out: lpNewFilePointer=0x0) returned 1 [0163.602] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.602] WriteFile (in: hFile=0x1244, lpBuffer=0x262ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x262ff61c, lpOverlapped=0x0 | out: lpBuffer=0x262ff83c*, lpNumberOfBytesWritten=0x262ff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.602] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0x2d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.602] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0163.602] CloseHandle (hObject=0x1244) returned 1 [0163.602] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.play")) returned 1 [0163.604] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1844 os_tid = 0x1618 [0162.882] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.882] ReadFile (in: hFile=0x124c, lpBuffer=0x2643fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2643f85c, lpOverlapped=0x0 | out: lpBuffer=0x2643fb34*, lpNumberOfBytesRead=0x2643f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.999] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.000] ReadFile (in: hFile=0x124c, lpBuffer=0x2643fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2643f85c, lpOverlapped=0x0 | out: lpBuffer=0x2643fb34*, lpNumberOfBytesRead=0x2643f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.134] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0163.136] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0163.136] BCryptSetProperty (in: hObject=0x7363b0, pszProperty="ChainingMode", pbInput=0x2643f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7363b0) returned 0x0 [0163.136] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7363b0, phKey=0x2643f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7363b0, phKey=0x2643f828, pbKeyObject=0x0) returned 0x0 [0163.136] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2643f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2643f500) returned 0x0 [0163.136] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0163.136] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2643f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2643f500) returned 0x0 [0163.140] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.142] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.142] WriteFile (in: hFile=0x124c, lpBuffer=0x2643fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2643f830, lpOverlapped=0x0 | out: lpBuffer=0x2643fb34*, lpNumberOfBytesWritten=0x2643f830*=0x428, lpOverlapped=0x0) returned 1 [0163.143] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.143] ReadFile (in: hFile=0x124c, lpBuffer=0x7250000, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x2643f61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesRead=0x2643f61c*=0x57f4, lpOverlapped=0x0) returned 1 [0163.182] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0xffffa80c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.182] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x7250000, cbInput=0x57f4, pPaddingInfo=0x0, pbIV=0x2643f848, cbIV=0x10, pbOutput=0x7250000, cbOutput=0x100000, pcbResult=0x2643f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x2643f848, pbOutput=0x7250000, pcbResult=0x2643f618) returned 0x0 [0163.182] WriteFile (in: hFile=0x124c, lpBuffer=0x7250000*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2643f61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesWritten=0x2643f61c*=0x5800, lpOverlapped=0x0) returned 1 [0163.182] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2643f60c | out: lpNewFilePointer=0x0) returned 1 [0163.182] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.182] WriteFile (in: hFile=0x124c, lpBuffer=0x2643f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2643f61c, lpOverlapped=0x0 | out: lpBuffer=0x2643f83c*, lpNumberOfBytesWritten=0x2643f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.182] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.182] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0163.182] CloseHandle (hObject=0x124c) returned 1 [0163.183] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.play")) returned 1 [0163.185] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1845 os_tid = 0x1614 [0162.883] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.883] ReadFile (in: hFile=0x1254, lpBuffer=0x2657fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2657f85c, lpOverlapped=0x0 | out: lpBuffer=0x2657fb34*, lpNumberOfBytesRead=0x2657f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.976] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.976] ReadFile (in: hFile=0x1254, lpBuffer=0x2657fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2657f85c, lpOverlapped=0x0 | out: lpBuffer=0x2657fb34*, lpNumberOfBytesRead=0x2657f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.976] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb780000 [0163.478] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb780000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb780000) returned 0x0 [0163.478] BCryptSetProperty (in: hObject=0x735f90, pszProperty="ChainingMode", pbInput=0x2657f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735f90) returned 0x0 [0163.478] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735f90, phKey=0x2657f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb780000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735f90, phKey=0x2657f828, pbKeyObject=0x0) returned 0x0 [0163.478] BCryptExportKey (in: hKey=0x793a30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb780000, cbOutput=0x230, pcbResult=0x2657f500, dwFlags=0x0 | out: pbOutput=0xb780000, pcbResult=0x2657f500) returned 0x0 [0163.478] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb780230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb780230) returned 0x0 [0163.478] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb780000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb780000, cbOutput=0x400, pcbResult=0x2657f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb780000, pcbResult=0x2657f500) returned 0x0 [0163.481] VirtualFree (lpAddress=0xb780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.485] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.485] WriteFile (in: hFile=0x1254, lpBuffer=0x2657fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2657f830, lpOverlapped=0x0 | out: lpBuffer=0x2657fb34*, lpNumberOfBytesWritten=0x2657f830*=0x428, lpOverlapped=0x0) returned 1 [0163.486] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.486] ReadFile (in: hFile=0x1254, lpBuffer=0x7350000, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x2657f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesRead=0x2657f61c*=0x3f34, lpOverlapped=0x0) returned 1 [0163.626] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0xffffc0cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.626] BCryptEncrypt (in: hKey=0x793a30, pbInput=0x7350000, cbInput=0x3f34, pPaddingInfo=0x0, pbIV=0x2657f848, cbIV=0x10, pbOutput=0x7350000, cbOutput=0x100000, pcbResult=0x2657f618, dwFlags=0x1 | out: hKey=0x793a30, pbIV=0x2657f848, pbOutput=0x7350000, pcbResult=0x2657f618) returned 0x0 [0163.626] WriteFile (in: hFile=0x1254, lpBuffer=0x7350000*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2657f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesWritten=0x2657f61c*=0x3f40, lpOverlapped=0x0) returned 1 [0163.626] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2657f60c | out: lpNewFilePointer=0x0) returned 1 [0163.626] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.626] WriteFile (in: hFile=0x1254, lpBuffer=0x2657f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2657f61c, lpOverlapped=0x0 | out: lpBuffer=0x2657f83c*, lpNumberOfBytesWritten=0x2657f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.626] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x3f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.626] BCryptDestroyKey (in: hKey=0x793a30 | out: hKey=0x793a30) returned 0x0 [0163.626] CloseHandle (hObject=0x1254) returned 1 [0163.626] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.play")) returned 1 [0163.628] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1846 os_tid = 0x1610 [0162.884] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.884] ReadFile (in: hFile=0x125c, lpBuffer=0x266bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x266bf85c, lpOverlapped=0x0 | out: lpBuffer=0x266bfb34*, lpNumberOfBytesRead=0x266bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.974] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.974] ReadFile (in: hFile=0x125c, lpBuffer=0x266bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x266bf85c, lpOverlapped=0x0 | out: lpBuffer=0x266bfb34*, lpNumberOfBytesRead=0x266bf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.974] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb770000 [0163.486] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb770000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb770000) returned 0x0 [0163.486] BCryptSetProperty (in: hObject=0x735ac0, pszProperty="ChainingMode", pbInput=0x266bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ac0) returned 0x0 [0163.486] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ac0, phKey=0x266bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb770000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ac0, phKey=0x266bf828, pbKeyObject=0x0) returned 0x0 [0163.486] BCryptExportKey (in: hKey=0x793cc0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb770000, cbOutput=0x230, pcbResult=0x266bf500, dwFlags=0x0 | out: pbOutput=0xb770000, pcbResult=0x266bf500) returned 0x0 [0163.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb770230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb770230) returned 0x0 [0163.487] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb770000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb770000, cbOutput=0x400, pcbResult=0x266bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb770000, pcbResult=0x266bf500) returned 0x0 [0163.490] VirtualFree (lpAddress=0xb770000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.492] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.492] WriteFile (in: hFile=0x125c, lpBuffer=0x266bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x266bf830, lpOverlapped=0x0 | out: lpBuffer=0x266bfb34*, lpNumberOfBytesWritten=0x266bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.492] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.492] ReadFile (in: hFile=0x125c, lpBuffer=0x7450000, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x266bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesRead=0x266bf61c*=0x4354, lpOverlapped=0x0) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xffffbcac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.631] BCryptEncrypt (in: hKey=0x793cc0, pbInput=0x7450000, cbInput=0x4354, pPaddingInfo=0x0, pbIV=0x266bf848, cbIV=0x10, pbOutput=0x7450000, cbOutput=0x100000, pcbResult=0x266bf618, dwFlags=0x1 | out: hKey=0x793cc0, pbIV=0x266bf848, pbOutput=0x7450000, pcbResult=0x266bf618) returned 0x0 [0163.631] WriteFile (in: hFile=0x125c, lpBuffer=0x7450000*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x266bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesWritten=0x266bf61c*=0x4360, lpOverlapped=0x0) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.631] WriteFile (in: hFile=0x125c, lpBuffer=0x266bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x266bf61c, lpOverlapped=0x0 | out: lpBuffer=0x266bf83c*, lpNumberOfBytesWritten=0x266bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x4360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.631] BCryptDestroyKey (in: hKey=0x793cc0 | out: hKey=0x793cc0) returned 0x0 [0163.631] CloseHandle (hObject=0x125c) returned 1 [0163.631] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.play")) returned 1 [0163.633] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1847 os_tid = 0x160c [0162.885] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.886] ReadFile (in: hFile=0x1264, lpBuffer=0x267ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x267ff85c, lpOverlapped=0x0 | out: lpBuffer=0x267ffb34*, lpNumberOfBytesRead=0x267ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.977] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.977] ReadFile (in: hFile=0x1264, lpBuffer=0x267ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x267ff85c, lpOverlapped=0x0 | out: lpBuffer=0x267ffb34*, lpNumberOfBytesRead=0x267ff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.977] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb790000 [0163.471] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb790000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb790000) returned 0x0 [0163.472] BCryptSetProperty (in: hObject=0x735d80, pszProperty="ChainingMode", pbInput=0x267ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735d80) returned 0x0 [0163.472] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735d80, phKey=0x267ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb790000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735d80, phKey=0x267ff828, pbKeyObject=0x0) returned 0x0 [0163.472] BCryptExportKey (in: hKey=0x7937b0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb790000, cbOutput=0x230, pcbResult=0x267ff500, dwFlags=0x0 | out: pbOutput=0xb790000, pcbResult=0x267ff500) returned 0x0 [0163.472] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb790230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb790230) returned 0x0 [0163.472] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb790000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb790000, cbOutput=0x400, pcbResult=0x267ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb790000, pcbResult=0x267ff500) returned 0x0 [0163.475] VirtualFree (lpAddress=0xb790000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.477] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.477] WriteFile (in: hFile=0x1264, lpBuffer=0x267ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x267ff830, lpOverlapped=0x0 | out: lpBuffer=0x267ffb34*, lpNumberOfBytesWritten=0x267ff830*=0x428, lpOverlapped=0x0) returned 1 [0163.477] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.477] ReadFile (in: hFile=0x1264, lpBuffer=0x7550000, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x267ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesRead=0x267ff61c*=0x3ef0, lpOverlapped=0x0) returned 1 [0163.612] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xffffc110, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.612] BCryptEncrypt (in: hKey=0x7937b0, pbInput=0x7550000, cbInput=0x3ef0, pPaddingInfo=0x0, pbIV=0x267ff848, cbIV=0x10, pbOutput=0x7550000, cbOutput=0x100000, pcbResult=0x267ff618, dwFlags=0x1 | out: hKey=0x7937b0, pbIV=0x267ff848, pbOutput=0x7550000, pcbResult=0x267ff618) returned 0x0 [0163.612] WriteFile (in: hFile=0x1264, lpBuffer=0x7550000*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x267ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesWritten=0x267ff61c*=0x3f00, lpOverlapped=0x0) returned 1 [0163.612] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x267ff60c | out: lpNewFilePointer=0x0) returned 1 [0163.612] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.612] WriteFile (in: hFile=0x1264, lpBuffer=0x267ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x267ff61c, lpOverlapped=0x0 | out: lpBuffer=0x267ff83c*, lpNumberOfBytesWritten=0x267ff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.612] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x3f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.612] BCryptDestroyKey (in: hKey=0x7937b0 | out: hKey=0x7937b0) returned 0x0 [0163.612] CloseHandle (hObject=0x1264) returned 1 [0163.612] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.play")) returned 1 [0163.623] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1848 os_tid = 0x1608 [0162.887] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.887] ReadFile (in: hFile=0x126c, lpBuffer=0x2693fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2693f85c, lpOverlapped=0x0 | out: lpBuffer=0x2693fb34*, lpNumberOfBytesRead=0x2693f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.980] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.981] ReadFile (in: hFile=0x126c, lpBuffer=0x2693fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2693f85c, lpOverlapped=0x0 | out: lpBuffer=0x2693fb34*, lpNumberOfBytesRead=0x2693f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.981] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb7b0000 [0163.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7b0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb7b0000) returned 0x0 [0163.459] BCryptSetProperty (in: hObject=0x735cd0, pszProperty="ChainingMode", pbInput=0x2693f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735cd0) returned 0x0 [0163.459] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735cd0, phKey=0x2693f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb7b0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735cd0, phKey=0x2693f828, pbKeyObject=0x0) returned 0x0 [0163.459] BCryptExportKey (in: hKey=0x7932a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb7b0000, cbOutput=0x230, pcbResult=0x2693f500, dwFlags=0x0 | out: pbOutput=0xb7b0000, pcbResult=0x2693f500) returned 0x0 [0163.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7b0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb7b0230) returned 0x0 [0163.459] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb7b0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb7b0000, cbOutput=0x400, pcbResult=0x2693f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb7b0000, pcbResult=0x2693f500) returned 0x0 [0163.462] VirtualFree (lpAddress=0xb7b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.464] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.464] WriteFile (in: hFile=0x126c, lpBuffer=0x2693fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2693f830, lpOverlapped=0x0 | out: lpBuffer=0x2693fb34*, lpNumberOfBytesWritten=0x2693f830*=0x428, lpOverlapped=0x0) returned 1 [0163.465] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.465] ReadFile (in: hFile=0x126c, lpBuffer=0x7650000, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x2693f61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesRead=0x2693f61c*=0x4124, lpOverlapped=0x0) returned 1 [0163.582] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0xffffbedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.582] BCryptEncrypt (in: hKey=0x7932a0, pbInput=0x7650000, cbInput=0x4124, pPaddingInfo=0x0, pbIV=0x2693f848, cbIV=0x10, pbOutput=0x7650000, cbOutput=0x100000, pcbResult=0x2693f618, dwFlags=0x1 | out: hKey=0x7932a0, pbIV=0x2693f848, pbOutput=0x7650000, pcbResult=0x2693f618) returned 0x0 [0163.582] WriteFile (in: hFile=0x126c, lpBuffer=0x7650000*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2693f61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesWritten=0x2693f61c*=0x4130, lpOverlapped=0x0) returned 1 [0163.583] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2693f60c | out: lpNewFilePointer=0x0) returned 1 [0163.583] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.583] WriteFile (in: hFile=0x126c, lpBuffer=0x2693f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2693f61c, lpOverlapped=0x0 | out: lpBuffer=0x2693f83c*, lpNumberOfBytesWritten=0x2693f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.583] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x4130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.583] BCryptDestroyKey (in: hKey=0x7932a0 | out: hKey=0x7932a0) returned 0x0 [0163.583] CloseHandle (hObject=0x126c) returned 1 [0163.583] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.585] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.play")) returned 1 [0163.586] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1849 os_tid = 0x1604 [0162.888] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.888] ReadFile (in: hFile=0x1274, lpBuffer=0x26a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb34*, lpNumberOfBytesRead=0x26a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.979] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.979] ReadFile (in: hFile=0x1274, lpBuffer=0x26a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb34*, lpNumberOfBytesRead=0x26a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.979] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb7a0000 [0163.465] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb7a0000) returned 0x0 [0163.465] BCryptSetProperty (in: hObject=0x735b70, pszProperty="ChainingMode", pbInput=0x26a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735b70) returned 0x0 [0163.465] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735b70, phKey=0x26a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb7a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735b70, phKey=0x26a7f828, pbKeyObject=0x0) returned 0x0 [0163.465] BCryptExportKey (in: hKey=0x793520, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb7a0000, cbOutput=0x230, pcbResult=0x26a7f500, dwFlags=0x0 | out: pbOutput=0xb7a0000, pcbResult=0x26a7f500) returned 0x0 [0163.465] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb7a0230) returned 0x0 [0163.465] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb7a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb7a0000, cbOutput=0x400, pcbResult=0x26a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb7a0000, pcbResult=0x26a7f500) returned 0x0 [0163.469] VirtualFree (lpAddress=0xb7a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.470] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.471] WriteFile (in: hFile=0x1274, lpBuffer=0x26a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x26a7f830, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb34*, lpNumberOfBytesWritten=0x26a7f830*=0x428, lpOverlapped=0x0) returned 1 [0163.471] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.471] ReadFile (in: hFile=0x1274, lpBuffer=0x7750000, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x26a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7750000*, lpNumberOfBytesRead=0x26a7f61c*=0x687c, lpOverlapped=0x0) returned 1 [0163.607] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xffff9784, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.607] BCryptEncrypt (in: hKey=0x793520, pbInput=0x7750000, cbInput=0x687c, pPaddingInfo=0x0, pbIV=0x26a7f848, cbIV=0x10, pbOutput=0x7750000, cbOutput=0x100000, pcbResult=0x26a7f618, dwFlags=0x1 | out: hKey=0x793520, pbIV=0x26a7f848, pbOutput=0x7750000, pcbResult=0x26a7f618) returned 0x0 [0163.607] WriteFile (in: hFile=0x1274, lpBuffer=0x7750000*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x26a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7750000*, lpNumberOfBytesWritten=0x26a7f61c*=0x6880, lpOverlapped=0x0) returned 1 [0163.607] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26a7f60c | out: lpNewFilePointer=0x0) returned 1 [0163.607] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.607] WriteFile (in: hFile=0x1274, lpBuffer=0x26a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x26a7f83c*, lpNumberOfBytesWritten=0x26a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.607] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x6880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.607] BCryptDestroyKey (in: hKey=0x793520 | out: hKey=0x793520) returned 0x0 [0163.607] CloseHandle (hObject=0x1274) returned 1 [0163.607] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.play")) returned 1 [0163.609] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1850 os_tid = 0x1600 [0162.890] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.890] ReadFile (in: hFile=0x127c, lpBuffer=0x26bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x26bbfb34*, lpNumberOfBytesRead=0x26bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.986] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.986] ReadFile (in: hFile=0x127c, lpBuffer=0x26bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x26bbfb34*, lpNumberOfBytesRead=0x26bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.986] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb7e0000 [0163.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7e0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb7e0000) returned 0x0 [0163.428] BCryptSetProperty (in: hObject=0x736040, pszProperty="ChainingMode", pbInput=0x26bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736040) returned 0x0 [0163.428] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736040, phKey=0x26bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb7e0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736040, phKey=0x26bbf828, pbKeyObject=0x0) returned 0x0 [0163.428] BCryptExportKey (in: hKey=0x793010, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb7e0000, cbOutput=0x230, pcbResult=0x26bbf500, dwFlags=0x0 | out: pbOutput=0xb7e0000, pcbResult=0x26bbf500) returned 0x0 [0163.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7e0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb7e0230) returned 0x0 [0163.429] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb7e0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb7e0000, cbOutput=0x400, pcbResult=0x26bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb7e0000, pcbResult=0x26bbf500) returned 0x0 [0163.432] VirtualFree (lpAddress=0xb7e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.434] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.434] WriteFile (in: hFile=0x127c, lpBuffer=0x26bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x26bbf830, lpOverlapped=0x0 | out: lpBuffer=0x26bbfb34*, lpNumberOfBytesWritten=0x26bbf830*=0x428, lpOverlapped=0x0) returned 1 [0163.434] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.434] ReadFile (in: hFile=0x127c, lpBuffer=0x7850000, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x26bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7850000*, lpNumberOfBytesRead=0x26bbf61c*=0x133c, lpOverlapped=0x0) returned 1 [0163.434] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0xffffecc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.434] BCryptEncrypt (in: hKey=0x793010, pbInput=0x7850000, cbInput=0x133c, pPaddingInfo=0x0, pbIV=0x26bbf848, cbIV=0x10, pbOutput=0x7850000, cbOutput=0x100000, pcbResult=0x26bbf618, dwFlags=0x1 | out: hKey=0x793010, pbIV=0x26bbf848, pbOutput=0x7850000, pcbResult=0x26bbf618) returned 0x0 [0163.434] WriteFile (in: hFile=0x127c, lpBuffer=0x7850000*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x26bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7850000*, lpNumberOfBytesWritten=0x26bbf61c*=0x1340, lpOverlapped=0x0) returned 1 [0163.434] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26bbf60c | out: lpNewFilePointer=0x0) returned 1 [0163.434] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.435] WriteFile (in: hFile=0x127c, lpBuffer=0x26bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x26bbf83c*, lpNumberOfBytesWritten=0x26bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.435] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x1340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.435] BCryptDestroyKey (in: hKey=0x793010 | out: hKey=0x793010) returned 0x0 [0163.435] CloseHandle (hObject=0x127c) returned 1 [0163.435] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.play")) returned 1 [0163.437] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1851 os_tid = 0x15fc [0162.891] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.891] ReadFile (in: hFile=0x1284, lpBuffer=0x26cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26cff85c, lpOverlapped=0x0 | out: lpBuffer=0x26cffb34*, lpNumberOfBytesRead=0x26cff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.984] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.985] ReadFile (in: hFile=0x1284, lpBuffer=0x26cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26cff85c, lpOverlapped=0x0 | out: lpBuffer=0x26cffb34*, lpNumberOfBytesRead=0x26cff85c*=0x428, lpOverlapped=0x0) returned 1 [0162.985] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb7d0000 [0163.440] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb7d0000) returned 0x0 [0163.440] BCryptSetProperty (in: hObject=0x735ee0, pszProperty="ChainingMode", pbInput=0x26cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ee0) returned 0x0 [0163.440] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ee0, phKey=0x26cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb7d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ee0, phKey=0x26cff828, pbKeyObject=0x0) returned 0x0 [0163.440] BCryptExportKey (in: hKey=0x793010, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb7d0000, cbOutput=0x230, pcbResult=0x26cff500, dwFlags=0x0 | out: pbOutput=0xb7d0000, pcbResult=0x26cff500) returned 0x0 [0163.440] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb7d0230) returned 0x0 [0163.440] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb7d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb7d0000, cbOutput=0x400, pcbResult=0x26cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb7d0000, pcbResult=0x26cff500) returned 0x0 [0163.443] VirtualFree (lpAddress=0xb7d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.445] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.445] WriteFile (in: hFile=0x1284, lpBuffer=0x26cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x26cff830, lpOverlapped=0x0 | out: lpBuffer=0x26cffb34*, lpNumberOfBytesWritten=0x26cff830*=0x428, lpOverlapped=0x0) returned 1 [0163.446] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.446] ReadFile (in: hFile=0x1284, lpBuffer=0x7950000, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x26cff61c, lpOverlapped=0x0 | out: lpBuffer=0x7950000*, lpNumberOfBytesRead=0x26cff61c*=0xfe2, lpOverlapped=0x0) returned 1 [0163.446] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffff01e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.446] BCryptEncrypt (in: hKey=0x793010, pbInput=0x7950000, cbInput=0xfe2, pPaddingInfo=0x0, pbIV=0x26cff848, cbIV=0x10, pbOutput=0x7950000, cbOutput=0x100000, pcbResult=0x26cff618, dwFlags=0x1 | out: hKey=0x793010, pbIV=0x26cff848, pbOutput=0x7950000, pcbResult=0x26cff618) returned 0x0 [0163.446] WriteFile (in: hFile=0x1284, lpBuffer=0x7950000*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x26cff61c, lpOverlapped=0x0 | out: lpBuffer=0x7950000*, lpNumberOfBytesWritten=0x26cff61c*=0xff0, lpOverlapped=0x0) returned 1 [0163.446] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26cff60c | out: lpNewFilePointer=0x0) returned 1 [0163.446] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.446] WriteFile (in: hFile=0x1284, lpBuffer=0x26cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26cff61c, lpOverlapped=0x0 | out: lpBuffer=0x26cff83c*, lpNumberOfBytesWritten=0x26cff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.447] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.447] BCryptDestroyKey (in: hKey=0x793010 | out: hKey=0x793010) returned 0x0 [0163.447] CloseHandle (hObject=0x1284) returned 1 [0163.447] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.play")) returned 1 [0163.449] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1852 os_tid = 0x15f8 [0162.892] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.892] ReadFile (in: hFile=0x128c, lpBuffer=0x26e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x26e3fb34*, lpNumberOfBytesRead=0x26e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.982] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.982] ReadFile (in: hFile=0x128c, lpBuffer=0x26e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x26e3fb34*, lpNumberOfBytesRead=0x26e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb7c0000 [0163.452] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb7c0000) returned 0x0 [0163.452] BCryptSetProperty (in: hObject=0x735c20, pszProperty="ChainingMode", pbInput=0x26e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735c20) returned 0x0 [0163.452] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735c20, phKey=0x26e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb7c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735c20, phKey=0x26e3f828, pbKeyObject=0x0) returned 0x0 [0163.452] BCryptExportKey (in: hKey=0x793010, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb7c0000, cbOutput=0x230, pcbResult=0x26e3f500, dwFlags=0x0 | out: pbOutput=0xb7c0000, pcbResult=0x26e3f500) returned 0x0 [0163.452] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb7c0230) returned 0x0 [0163.452] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb7c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb7c0000, cbOutput=0x400, pcbResult=0x26e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb7c0000, pcbResult=0x26e3f500) returned 0x0 [0163.455] VirtualFree (lpAddress=0xb7c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.457] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.457] WriteFile (in: hFile=0x128c, lpBuffer=0x26e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x26e3f830, lpOverlapped=0x0 | out: lpBuffer=0x26e3fb34*, lpNumberOfBytesWritten=0x26e3f830*=0x428, lpOverlapped=0x0) returned 1 [0163.458] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.458] ReadFile (in: hFile=0x128c, lpBuffer=0x7a50000, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x26e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7a50000*, lpNumberOfBytesRead=0x26e3f61c*=0x5f00, lpOverlapped=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0xffffa100, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.590] BCryptEncrypt (in: hKey=0x793010, pbInput=0x7a50000, cbInput=0x5f00, pPaddingInfo=0x0, pbIV=0x26e3f848, cbIV=0x10, pbOutput=0x7a50000, cbOutput=0x100000, pcbResult=0x26e3f618, dwFlags=0x1 | out: hKey=0x793010, pbIV=0x26e3f848, pbOutput=0x7a50000, pcbResult=0x26e3f618) returned 0x0 [0163.590] WriteFile (in: hFile=0x128c, lpBuffer=0x7a50000*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x26e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7a50000*, lpNumberOfBytesWritten=0x26e3f61c*=0x5f10, lpOverlapped=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26e3f60c | out: lpNewFilePointer=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.590] WriteFile (in: hFile=0x128c, lpBuffer=0x26e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x26e3f83c*, lpNumberOfBytesWritten=0x26e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.591] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x5f10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.591] BCryptDestroyKey (in: hKey=0x793010 | out: hKey=0x793010) returned 0x0 [0163.591] CloseHandle (hObject=0x128c) returned 1 [0163.591] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.play")) returned 1 [0163.593] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1853 os_tid = 0x15f4 [0162.894] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.894] ReadFile (in: hFile=0x11e4, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.995] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.995] ReadFile (in: hFile=0x11e4, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.995] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb820000 [0163.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb820000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb820000) returned 0x0 [0163.399] BCryptSetProperty (in: hObject=0x735e30, pszProperty="ChainingMode", pbInput=0xd1cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735e30) returned 0x0 [0163.399] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735e30, phKey=0xd1cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb820000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735e30, phKey=0xd1cf828, pbKeyObject=0x0) returned 0x0 [0163.399] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb820000, cbOutput=0x230, pcbResult=0xd1cf500, dwFlags=0x0 | out: pbOutput=0xb820000, pcbResult=0xd1cf500) returned 0x0 [0163.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb820230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb820230) returned 0x0 [0163.400] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb820000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb820000, cbOutput=0x400, pcbResult=0xd1cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb820000, pcbResult=0xd1cf500) returned 0x0 [0163.403] VirtualFree (lpAddress=0xb820000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.406] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.406] WriteFile (in: hFile=0x11e4, lpBuffer=0xd1cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd1cf830, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesWritten=0xd1cf830*=0x428, lpOverlapped=0x0) returned 1 [0163.407] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.407] ReadFile (in: hFile=0x11e4, lpBuffer=0x7b50000, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x7b50000*, lpNumberOfBytesRead=0xd1cf61c*=0x60ca, lpOverlapped=0x0) returned 1 [0163.544] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xffff9f36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.544] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x7b50000, cbInput=0x60ca, pPaddingInfo=0x0, pbIV=0xd1cf848, cbIV=0x10, pbOutput=0x7b50000, cbOutput=0x100000, pcbResult=0xd1cf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xd1cf848, pbOutput=0x7b50000, pcbResult=0xd1cf618) returned 0x0 [0163.544] WriteFile (in: hFile=0x11e4, lpBuffer=0x7b50000*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x7b50000*, lpNumberOfBytesWritten=0xd1cf61c*=0x60d0, lpOverlapped=0x0) returned 1 [0163.544] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd1cf60c | out: lpNewFilePointer=0x0) returned 1 [0163.544] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.544] WriteFile (in: hFile=0x11e4, lpBuffer=0xd1cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd1cf83c*, lpNumberOfBytesWritten=0xd1cf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.545] SetFilePointerEx (in: hFile=0x11e4, liDistanceToMove=0x60d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.545] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0163.545] CloseHandle (hObject=0x11e4) returned 1 [0163.545] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.play")) returned 1 [0163.547] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1854 os_tid = 0x15f0 [0162.895] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.895] ReadFile (in: hFile=0xfe0, lpBuffer=0xd44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd44f85c, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesRead=0xd44f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.993] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.993] ReadFile (in: hFile=0xfe0, lpBuffer=0xd44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd44f85c, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesRead=0xd44f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.993] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb810000 [0163.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb810000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb810000) returned 0x0 [0163.407] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xd44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0163.407] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xd44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb810000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xd44f828, pbKeyObject=0x0) returned 0x0 [0163.407] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb810000, cbOutput=0x230, pcbResult=0xd44f500, dwFlags=0x0 | out: pbOutput=0xb810000, pcbResult=0xd44f500) returned 0x0 [0163.408] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb810230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb810230) returned 0x0 [0163.408] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb810000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb810000, cbOutput=0x400, pcbResult=0xd44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb810000, pcbResult=0xd44f500) returned 0x0 [0163.411] VirtualFree (lpAddress=0xb810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.413] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.413] WriteFile (in: hFile=0xfe0, lpBuffer=0xd44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd44f830, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesWritten=0xd44f830*=0x428, lpOverlapped=0x0) returned 1 [0163.414] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.414] ReadFile (in: hFile=0xfe0, lpBuffer=0x2850000, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xd44f61c*=0xbb7c, lpOverlapped=0x0) returned 1 [0163.539] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xffff4484, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.539] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2850000, cbInput=0xbb7c, pPaddingInfo=0x0, pbIV=0xd44f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xd44f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xd44f848, pbOutput=0x2850000, pcbResult=0xd44f618) returned 0x0 [0163.539] WriteFile (in: hFile=0xfe0, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xd44f61c*=0xbb80, lpOverlapped=0x0) returned 1 [0163.539] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd44f60c | out: lpNewFilePointer=0x0) returned 1 [0163.539] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.539] WriteFile (in: hFile=0xfe0, lpBuffer=0xd44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0xd44f83c*, lpNumberOfBytesWritten=0xd44f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.539] SetFilePointerEx (in: hFile=0xfe0, liDistanceToMove=0xbb80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.540] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0163.540] CloseHandle (hObject=0xfe0) returned 1 [0163.540] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.541] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.play")) returned 1 [0163.542] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1855 os_tid = 0x15ec [0162.897] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.897] ReadFile (in: hFile=0xa8c, lpBuffer=0xd58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd58f85c, lpOverlapped=0x0 | out: lpBuffer=0xd58fb34*, lpNumberOfBytesRead=0xd58f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.991] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.991] ReadFile (in: hFile=0xa8c, lpBuffer=0xd58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd58f85c, lpOverlapped=0x0 | out: lpBuffer=0xd58fb34*, lpNumberOfBytesRead=0xd58f85c*=0x428, lpOverlapped=0x0) returned 1 [0162.991] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb800000 [0163.414] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb800000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb800000) returned 0x0 [0163.414] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xd58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0163.414] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xd58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb800000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xd58f828, pbKeyObject=0x0) returned 0x0 [0163.414] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb800000, cbOutput=0x230, pcbResult=0xd58f500, dwFlags=0x0 | out: pbOutput=0xb800000, pcbResult=0xd58f500) returned 0x0 [0163.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb800230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb800230) returned 0x0 [0163.415] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb800000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb800000, cbOutput=0x400, pcbResult=0xd58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb800000, pcbResult=0xd58f500) returned 0x0 [0163.418] VirtualFree (lpAddress=0xb800000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.420] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.420] WriteFile (in: hFile=0xa8c, lpBuffer=0xd58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd58f830, lpOverlapped=0x0 | out: lpBuffer=0xd58fb34*, lpNumberOfBytesWritten=0xd58f830*=0x428, lpOverlapped=0x0) returned 1 [0163.421] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.421] ReadFile (in: hFile=0xa8c, lpBuffer=0x2950000, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xd58f61c*=0x9d0e, lpOverlapped=0x0) returned 1 [0163.534] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xffff62f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.534] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2950000, cbInput=0x9d0e, pPaddingInfo=0x0, pbIV=0xd58f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xd58f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xd58f848, pbOutput=0x2950000, pcbResult=0xd58f618) returned 0x0 [0163.534] WriteFile (in: hFile=0xa8c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xd58f61c*=0x9d10, lpOverlapped=0x0) returned 1 [0163.534] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd58f60c | out: lpNewFilePointer=0x0) returned 1 [0163.534] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.534] WriteFile (in: hFile=0xa8c, lpBuffer=0xd58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0xd58f83c*, lpNumberOfBytesWritten=0xd58f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.534] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x9d10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.534] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0163.534] CloseHandle (hObject=0xa8c) returned 1 [0163.534] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.play")) returned 1 [0163.536] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1856 os_tid = 0x181c [0162.898] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.898] ReadFile (in: hFile=0x614, lpBuffer=0xd6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd6cfb34*, lpNumberOfBytesRead=0xd6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.989] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.989] ReadFile (in: hFile=0x614, lpBuffer=0xd6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd6cfb34*, lpNumberOfBytesRead=0xd6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0162.989] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb7f0000 [0163.421] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb7f0000) returned 0x0 [0163.422] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xd6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0163.422] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xd6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb7f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xd6cf828, pbKeyObject=0x0) returned 0x0 [0163.422] BCryptExportKey (in: hKey=0x794e70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb7f0000, cbOutput=0x230, pcbResult=0xd6cf500, dwFlags=0x0 | out: pbOutput=0xb7f0000, pcbResult=0xd6cf500) returned 0x0 [0163.422] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb7f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb7f0230) returned 0x0 [0163.422] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb7f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb7f0000, cbOutput=0x400, pcbResult=0xd6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb7f0000, pcbResult=0xd6cf500) returned 0x0 [0163.425] VirtualFree (lpAddress=0xb7f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.427] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.427] WriteFile (in: hFile=0x614, lpBuffer=0xd6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd6cf830, lpOverlapped=0x0 | out: lpBuffer=0xd6cfb34*, lpNumberOfBytesWritten=0xd6cf830*=0x428, lpOverlapped=0x0) returned 1 [0163.428] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.428] ReadFile (in: hFile=0x614, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xd6cf61c*=0xbaaa, lpOverlapped=0x0) returned 1 [0163.636] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xffff4556, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.636] BCryptEncrypt (in: hKey=0x794e70, pbInput=0x2a50000, cbInput=0xbaaa, pPaddingInfo=0x0, pbIV=0xd6cf848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xd6cf618, dwFlags=0x1 | out: hKey=0x794e70, pbIV=0xd6cf848, pbOutput=0x2a50000, pcbResult=0xd6cf618) returned 0x0 [0163.636] WriteFile (in: hFile=0x614, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xd6cf61c*=0xbab0, lpOverlapped=0x0) returned 1 [0163.636] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd6cf60c | out: lpNewFilePointer=0x0) returned 1 [0163.636] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.636] WriteFile (in: hFile=0x614, lpBuffer=0xd6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd6cf83c*, lpNumberOfBytesWritten=0xd6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.636] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xbab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.636] BCryptDestroyKey (in: hKey=0x794e70 | out: hKey=0x794e70) returned 0x0 [0163.636] CloseHandle (hObject=0x614) returned 1 [0163.636] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.play")) returned 1 [0163.638] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1857 os_tid = 0x15e8 [0162.899] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.899] ReadFile (in: hFile=0x1054, lpBuffer=0xd84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd84f85c, lpOverlapped=0x0 | out: lpBuffer=0xd84fb34*, lpNumberOfBytesRead=0xd84f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.011] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.011] ReadFile (in: hFile=0x1054, lpBuffer=0xd84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd84f85c, lpOverlapped=0x0 | out: lpBuffer=0xd84fb34*, lpNumberOfBytesRead=0xd84f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.011] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd1e0000 [0163.336] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd1e0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd1e0000) returned 0x0 [0163.336] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xd84f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0163.336] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xd84f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd1e0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xd84f828, pbKeyObject=0x0) returned 0x0 [0163.336] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd1e0000, cbOutput=0x230, pcbResult=0xd84f500, dwFlags=0x0 | out: pbOutput=0xd1e0000, pcbResult=0xd84f500) returned 0x0 [0163.336] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd1e0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd1e0230) returned 0x0 [0163.337] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd1e0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd1e0000, cbOutput=0x400, pcbResult=0xd84f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd1e0000, pcbResult=0xd84f500) returned 0x0 [0163.340] VirtualFree (lpAddress=0xd1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.342] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.342] WriteFile (in: hFile=0x1054, lpBuffer=0xd84fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd84f830, lpOverlapped=0x0 | out: lpBuffer=0xd84fb34*, lpNumberOfBytesWritten=0xd84f830*=0x428, lpOverlapped=0x0) returned 1 [0163.342] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.342] ReadFile (in: hFile=0x1054, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0xd84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xd84f61c*=0x38cc, lpOverlapped=0x0) returned 1 [0163.555] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xffffc734, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.555] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x2c50000, cbInput=0x38cc, pPaddingInfo=0x0, pbIV=0xd84f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xd84f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0xd84f848, pbOutput=0x2c50000, pcbResult=0xd84f618) returned 0x0 [0163.555] WriteFile (in: hFile=0x1054, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0xd84f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xd84f61c*=0x38d0, lpOverlapped=0x0) returned 1 [0163.555] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd84f60c | out: lpNewFilePointer=0x0) returned 1 [0163.555] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.555] WriteFile (in: hFile=0x1054, lpBuffer=0xd84f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd84f61c, lpOverlapped=0x0 | out: lpBuffer=0xd84f83c*, lpNumberOfBytesWritten=0xd84f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.555] SetFilePointerEx (in: hFile=0x1054, liDistanceToMove=0x38d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.555] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0163.556] CloseHandle (hObject=0x1054) returned 1 [0163.556] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.play")) returned 1 [0163.558] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1858 os_tid = 0x13d8 [0162.901] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.901] ReadFile (in: hFile=0x1024, lpBuffer=0xdb0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdb0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdb0fb34*, lpNumberOfBytesRead=0xdb0f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.009] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.009] ReadFile (in: hFile=0x1024, lpBuffer=0xdb0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdb0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdb0fb34*, lpNumberOfBytesRead=0xdb0f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.009] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd1d0000 [0163.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd1d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd1d0000) returned 0x0 [0163.343] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xdb0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0163.343] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xdb0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd1d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xdb0f828, pbKeyObject=0x0) returned 0x0 [0163.343] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd1d0000, cbOutput=0x230, pcbResult=0xdb0f500, dwFlags=0x0 | out: pbOutput=0xd1d0000, pcbResult=0xdb0f500) returned 0x0 [0163.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd1d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd1d0230) returned 0x0 [0163.343] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd1d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd1d0000, cbOutput=0x400, pcbResult=0xdb0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd1d0000, pcbResult=0xdb0f500) returned 0x0 [0163.346] VirtualFree (lpAddress=0xd1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.348] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.348] WriteFile (in: hFile=0x1024, lpBuffer=0xdb0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdb0f830, lpOverlapped=0x0 | out: lpBuffer=0xdb0fb34*, lpNumberOfBytesWritten=0xdb0f830*=0x428, lpOverlapped=0x0) returned 1 [0163.349] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.349] ReadFile (in: hFile=0x1024, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0xdb0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xdb0f61c*=0x504a, lpOverlapped=0x0) returned 1 [0163.565] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xffffafb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.566] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x2d50000, cbInput=0x504a, pPaddingInfo=0x0, pbIV=0xdb0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xdb0f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xdb0f848, pbOutput=0x2d50000, pcbResult=0xdb0f618) returned 0x0 [0163.566] WriteFile (in: hFile=0x1024, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0xdb0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xdb0f61c*=0x5050, lpOverlapped=0x0) returned 1 [0163.566] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdb0f60c | out: lpNewFilePointer=0x0) returned 1 [0163.566] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.566] WriteFile (in: hFile=0x1024, lpBuffer=0xdb0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdb0f61c, lpOverlapped=0x0 | out: lpBuffer=0xdb0f83c*, lpNumberOfBytesWritten=0xdb0f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.566] SetFilePointerEx (in: hFile=0x1024, liDistanceToMove=0x5050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.566] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0163.566] CloseHandle (hObject=0x1024) returned 1 [0163.566] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.play")) returned 1 [0163.568] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1859 os_tid = 0x1368 [0162.902] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.902] ReadFile (in: hFile=0x100c, lpBuffer=0xdc0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdc0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdc0fb34*, lpNumberOfBytesRead=0xdc0f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.006] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.006] ReadFile (in: hFile=0x100c, lpBuffer=0xdc0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdc0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdc0fb34*, lpNumberOfBytesRead=0xdc0f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.006] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb880000 [0163.349] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb880000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb880000) returned 0x0 [0163.349] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xdc0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0163.349] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xdc0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb880000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xdc0f828, pbKeyObject=0x0) returned 0x0 [0163.349] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb880000, cbOutput=0x230, pcbResult=0xdc0f500, dwFlags=0x0 | out: pbOutput=0xb880000, pcbResult=0xdc0f500) returned 0x0 [0163.350] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb880230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb880230) returned 0x0 [0163.350] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb880000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb880000, cbOutput=0x400, pcbResult=0xdc0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb880000, pcbResult=0xdc0f500) returned 0x0 [0163.353] VirtualFree (lpAddress=0xb880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.355] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.355] WriteFile (in: hFile=0x100c, lpBuffer=0xdc0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdc0f830, lpOverlapped=0x0 | out: lpBuffer=0xdc0fb34*, lpNumberOfBytesWritten=0xdc0f830*=0x428, lpOverlapped=0x0) returned 1 [0163.355] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.356] ReadFile (in: hFile=0x100c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0xdc0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xdc0f61c*=0x1f1e, lpOverlapped=0x0) returned 1 [0163.560] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xffffe0e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.560] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x2f50000, cbInput=0x1f1e, pPaddingInfo=0x0, pbIV=0xdc0f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xdc0f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0xdc0f848, pbOutput=0x2f50000, pcbResult=0xdc0f618) returned 0x0 [0163.560] WriteFile (in: hFile=0x100c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0xdc0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xdc0f61c*=0x1f20, lpOverlapped=0x0) returned 1 [0163.561] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdc0f60c | out: lpNewFilePointer=0x0) returned 1 [0163.561] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.561] WriteFile (in: hFile=0x100c, lpBuffer=0xdc0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdc0f61c, lpOverlapped=0x0 | out: lpBuffer=0xdc0f83c*, lpNumberOfBytesWritten=0xdc0f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.561] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x1f20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.561] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0163.561] CloseHandle (hObject=0x100c) returned 1 [0163.561] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.play")) returned 1 [0163.563] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1860 os_tid = 0x1134 [0162.905] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.905] ReadFile (in: hFile=0x1064, lpBuffer=0xdd0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdd0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdd0fb34*, lpNumberOfBytesRead=0xdd0f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.014] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.014] ReadFile (in: hFile=0x1064, lpBuffer=0xdd0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdd0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdd0fb34*, lpNumberOfBytesRead=0xdd0f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.095] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0163.096] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0163.096] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xdd0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0163.096] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xdd0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xdd0f828, pbKeyObject=0x0) returned 0x0 [0163.096] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xdd0f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xdd0f500) returned 0x0 [0163.096] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0163.097] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xdd0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xdd0f500) returned 0x0 [0163.100] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.102] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.102] WriteFile (in: hFile=0x1064, lpBuffer=0xdd0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdd0f830, lpOverlapped=0x0 | out: lpBuffer=0xdd0fb34*, lpNumberOfBytesWritten=0xdd0f830*=0x428, lpOverlapped=0x0) returned 1 [0163.103] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.103] ReadFile (in: hFile=0x1064, lpBuffer=0x3050000, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0xdd0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xdd0f61c*=0x34cb, lpOverlapped=0x0) returned 1 [0163.164] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xffffcb35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.164] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3050000, cbInput=0x34cb, pPaddingInfo=0x0, pbIV=0xdd0f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xdd0f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xdd0f848, pbOutput=0x3050000, pcbResult=0xdd0f618) returned 0x0 [0163.164] WriteFile (in: hFile=0x1064, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0xdd0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xdd0f61c*=0x34d0, lpOverlapped=0x0) returned 1 [0163.164] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdd0f60c | out: lpNewFilePointer=0x0) returned 1 [0163.164] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.164] WriteFile (in: hFile=0x1064, lpBuffer=0xdd0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdd0f61c, lpOverlapped=0x0 | out: lpBuffer=0xdd0f83c*, lpNumberOfBytesWritten=0xdd0f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.164] SetFilePointerEx (in: hFile=0x1064, liDistanceToMove=0x34d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.164] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0163.164] CloseHandle (hObject=0x1064) returned 1 [0163.164] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.play")) returned 1 [0163.166] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1861 os_tid = 0xe70 [0162.906] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.906] ReadFile (in: hFile=0x108c, lpBuffer=0x2057fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2057f85c, lpOverlapped=0x0 | out: lpBuffer=0x2057fb34*, lpNumberOfBytesRead=0x2057f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.013] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.013] ReadFile (in: hFile=0x108c, lpBuffer=0x2057fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2057f85c, lpOverlapped=0x0 | out: lpBuffer=0x2057fb34*, lpNumberOfBytesRead=0x2057f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.013] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd1f0000 [0163.328] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd1f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd1f0000) returned 0x0 [0163.328] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2057f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0163.328] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2057f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd1f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2057f828, pbKeyObject=0x0) returned 0x0 [0163.328] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd1f0000, cbOutput=0x230, pcbResult=0x2057f500, dwFlags=0x0 | out: pbOutput=0xd1f0000, pcbResult=0x2057f500) returned 0x0 [0163.328] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd1f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd1f0230) returned 0x0 [0163.328] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd1f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd1f0000, cbOutput=0x400, pcbResult=0x2057f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd1f0000, pcbResult=0x2057f500) returned 0x0 [0163.333] VirtualFree (lpAddress=0xd1f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.335] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.335] WriteFile (in: hFile=0x108c, lpBuffer=0x2057fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2057f830, lpOverlapped=0x0 | out: lpBuffer=0x2057fb34*, lpNumberOfBytesWritten=0x2057f830*=0x428, lpOverlapped=0x0) returned 1 [0163.336] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.336] ReadFile (in: hFile=0x108c, lpBuffer=0x3150000, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x2057f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2057f61c*=0x4edd, lpOverlapped=0x0) returned 1 [0163.549] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xffffb123, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.550] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3150000, cbInput=0x4edd, pPaddingInfo=0x0, pbIV=0x2057f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2057f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x2057f848, pbOutput=0x3150000, pcbResult=0x2057f618) returned 0x0 [0163.550] WriteFile (in: hFile=0x108c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2057f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2057f61c*=0x4ee0, lpOverlapped=0x0) returned 1 [0163.550] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2057f60c | out: lpNewFilePointer=0x0) returned 1 [0163.550] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.550] WriteFile (in: hFile=0x108c, lpBuffer=0x2057f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2057f61c, lpOverlapped=0x0 | out: lpBuffer=0x2057f83c*, lpNumberOfBytesWritten=0x2057f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.550] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x4ee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.550] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0163.550] CloseHandle (hObject=0x108c) returned 1 [0163.550] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.play")) returned 1 [0163.552] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1862 os_tid = 0x15e4 [0162.907] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.907] ReadFile (in: hFile=0x103c, lpBuffer=0x2067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2067f85c, lpOverlapped=0x0 | out: lpBuffer=0x2067fb34*, lpNumberOfBytesRead=0x2067f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.022] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.022] ReadFile (in: hFile=0x103c, lpBuffer=0x2067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2067f85c, lpOverlapped=0x0 | out: lpBuffer=0x2067fb34*, lpNumberOfBytesRead=0x2067f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.022] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd230000 [0163.207] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd230000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd230000) returned 0x0 [0163.207] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2067f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0163.207] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2067f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd230000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2067f828, pbKeyObject=0x0) returned 0x0 [0163.207] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd230000, cbOutput=0x230, pcbResult=0x2067f500, dwFlags=0x0 | out: pbOutput=0xd230000, pcbResult=0x2067f500) returned 0x0 [0163.207] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd230230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd230230) returned 0x0 [0163.207] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd230000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd230000, cbOutput=0x400, pcbResult=0x2067f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd230000, pcbResult=0x2067f500) returned 0x0 [0163.210] VirtualFree (lpAddress=0xd230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.212] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.212] WriteFile (in: hFile=0x103c, lpBuffer=0x2067fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2067f830, lpOverlapped=0x0 | out: lpBuffer=0x2067fb34*, lpNumberOfBytesWritten=0x2067f830*=0x428, lpOverlapped=0x0) returned 1 [0163.213] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.213] ReadFile (in: hFile=0x103c, lpBuffer=0x3250000, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x2067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2067f61c*=0x4fe6, lpOverlapped=0x0) returned 1 [0163.296] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xffffb01a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.296] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3250000, cbInput=0x4fe6, pPaddingInfo=0x0, pbIV=0x2067f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2067f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2067f848, pbOutput=0x3250000, pcbResult=0x2067f618) returned 0x0 [0163.296] WriteFile (in: hFile=0x103c, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2067f61c*=0x4ff0, lpOverlapped=0x0) returned 1 [0163.296] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2067f60c | out: lpNewFilePointer=0x0) returned 1 [0163.296] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.296] WriteFile (in: hFile=0x103c, lpBuffer=0x2067f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2067f61c, lpOverlapped=0x0 | out: lpBuffer=0x2067f83c*, lpNumberOfBytesWritten=0x2067f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.296] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x4ff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.296] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0163.296] CloseHandle (hObject=0x103c) returned 1 [0163.296] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.play")) returned 1 [0163.298] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1863 os_tid = 0x1130 [0162.908] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.909] ReadFile (in: hFile=0x101c, lpBuffer=0x2077fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2077f85c, lpOverlapped=0x0 | out: lpBuffer=0x2077fb34*, lpNumberOfBytesRead=0x2077f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.020] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.020] ReadFile (in: hFile=0x101c, lpBuffer=0x2077fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2077f85c, lpOverlapped=0x0 | out: lpBuffer=0x2077fb34*, lpNumberOfBytesRead=0x2077f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.020] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd220000 [0163.213] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd220000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd220000) returned 0x0 [0163.214] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2077f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0163.214] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2077f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd220000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2077f828, pbKeyObject=0x0) returned 0x0 [0163.214] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd220000, cbOutput=0x230, pcbResult=0x2077f500, dwFlags=0x0 | out: pbOutput=0xd220000, pcbResult=0x2077f500) returned 0x0 [0163.214] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd220230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd220230) returned 0x0 [0163.214] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd220000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd220000, cbOutput=0x400, pcbResult=0x2077f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd220000, pcbResult=0x2077f500) returned 0x0 [0163.217] VirtualFree (lpAddress=0xd220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.219] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.219] WriteFile (in: hFile=0x101c, lpBuffer=0x2077fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2077f830, lpOverlapped=0x0 | out: lpBuffer=0x2077fb34*, lpNumberOfBytesWritten=0x2077f830*=0x428, lpOverlapped=0x0) returned 1 [0163.220] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.220] ReadFile (in: hFile=0x101c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x2077f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2077f61c*=0x3d75, lpOverlapped=0x0) returned 1 [0163.290] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xffffc28b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.290] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3750000, cbInput=0x3d75, pPaddingInfo=0x0, pbIV=0x2077f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2077f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2077f848, pbOutput=0x3750000, pcbResult=0x2077f618) returned 0x0 [0163.290] WriteFile (in: hFile=0x101c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2077f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2077f61c*=0x3d80, lpOverlapped=0x0) returned 1 [0163.291] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2077f60c | out: lpNewFilePointer=0x0) returned 1 [0163.291] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.291] WriteFile (in: hFile=0x101c, lpBuffer=0x2077f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2077f61c, lpOverlapped=0x0 | out: lpBuffer=0x2077f83c*, lpNumberOfBytesWritten=0x2077f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.291] SetFilePointerEx (in: hFile=0x101c, liDistanceToMove=0x3d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.291] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0163.291] CloseHandle (hObject=0x101c) returned 1 [0163.291] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.play")) returned 1 [0163.293] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1864 os_tid = 0x1c04 [0162.910] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.910] ReadFile (in: hFile=0x1084, lpBuffer=0x2087fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2087f85c, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesRead=0x2087f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.029] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.029] ReadFile (in: hFile=0x1084, lpBuffer=0x2087fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2087f85c, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesRead=0x2087f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.029] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd270000 [0163.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd270000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd270000) returned 0x0 [0163.169] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2087f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0163.169] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2087f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd270000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2087f828, pbKeyObject=0x0) returned 0x0 [0163.169] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd270000, cbOutput=0x230, pcbResult=0x2087f500, dwFlags=0x0 | out: pbOutput=0xd270000, pcbResult=0x2087f500) returned 0x0 [0163.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd270230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd270230) returned 0x0 [0163.169] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd270000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd270000, cbOutput=0x400, pcbResult=0x2087f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd270000, pcbResult=0x2087f500) returned 0x0 [0163.173] VirtualFree (lpAddress=0xd270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.174] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.175] WriteFile (in: hFile=0x1084, lpBuffer=0x2087fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2087f830, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesWritten=0x2087f830*=0x428, lpOverlapped=0x0) returned 1 [0163.175] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.175] ReadFile (in: hFile=0x1084, lpBuffer=0x3850000, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2087f61c*=0x32b6, lpOverlapped=0x0) returned 1 [0163.305] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xffffcd4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.306] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3850000, cbInput=0x32b6, pPaddingInfo=0x0, pbIV=0x2087f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2087f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x2087f848, pbOutput=0x3850000, pcbResult=0x2087f618) returned 0x0 [0163.306] WriteFile (in: hFile=0x1084, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2087f61c*=0x32c0, lpOverlapped=0x0) returned 1 [0163.306] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2087f60c | out: lpNewFilePointer=0x0) returned 1 [0163.306] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.306] WriteFile (in: hFile=0x1084, lpBuffer=0x2087f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x2087f83c*, lpNumberOfBytesWritten=0x2087f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.306] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x32c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.306] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0163.306] CloseHandle (hObject=0x1084) returned 1 [0163.306] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.play")) returned 1 [0163.308] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1865 os_tid = 0x1c08 [0162.911] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.911] ReadFile (in: hFile=0x1044, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.028] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.029] ReadFile (in: hFile=0x1044, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.119] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0163.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0163.120] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2097f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0163.121] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2097f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2097f828, pbKeyObject=0x0) returned 0x0 [0163.121] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2097f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2097f500) returned 0x0 [0163.121] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0163.121] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2097f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2097f500) returned 0x0 [0163.124] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.126] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.126] WriteFile (in: hFile=0x1044, lpBuffer=0x2097fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2097f830, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesWritten=0x2097f830*=0x428, lpOverlapped=0x0) returned 1 [0163.127] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.127] ReadFile (in: hFile=0x1044, lpBuffer=0x3950000, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2097f61c*=0x25ee, lpOverlapped=0x0) returned 1 [0163.152] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xffffda12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.152] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x3950000, cbInput=0x25ee, pPaddingInfo=0x0, pbIV=0x2097f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2097f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2097f848, pbOutput=0x3950000, pcbResult=0x2097f618) returned 0x0 [0163.152] WriteFile (in: hFile=0x1044, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2097f61c*=0x25f0, lpOverlapped=0x0) returned 1 [0163.152] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2097f60c | out: lpNewFilePointer=0x0) returned 1 [0163.153] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.153] WriteFile (in: hFile=0x1044, lpBuffer=0x2097f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x2097f83c*, lpNumberOfBytesWritten=0x2097f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.153] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x25f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.153] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0163.153] CloseHandle (hObject=0x1044) returned 1 [0163.153] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.154] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.play")) returned 1 [0163.155] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1866 os_tid = 0x1c0c [0162.912] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.912] ReadFile (in: hFile=0x1298, lpBuffer=0x20abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20abf85c, lpOverlapped=0x0 | out: lpBuffer=0x20abfb34*, lpNumberOfBytesRead=0x20abf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.027] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.027] ReadFile (in: hFile=0x1298, lpBuffer=0x20abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20abf85c, lpOverlapped=0x0 | out: lpBuffer=0x20abfb34*, lpNumberOfBytesRead=0x20abf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.027] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd260000 [0163.175] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd260000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd260000) returned 0x0 [0163.176] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x20abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0163.176] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x20abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd260000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x20abf828, pbKeyObject=0x0) returned 0x0 [0163.176] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd260000, cbOutput=0x230, pcbResult=0x20abf500, dwFlags=0x0 | out: pbOutput=0xd260000, pcbResult=0x20abf500) returned 0x0 [0163.176] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd260230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd260230) returned 0x0 [0163.176] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd260000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd260000, cbOutput=0x400, pcbResult=0x20abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd260000, pcbResult=0x20abf500) returned 0x0 [0163.179] VirtualFree (lpAddress=0xd260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.181] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.181] WriteFile (in: hFile=0x1298, lpBuffer=0x20abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20abf830, lpOverlapped=0x0 | out: lpBuffer=0x20abfb34*, lpNumberOfBytesWritten=0x20abf830*=0x428, lpOverlapped=0x0) returned 1 [0163.181] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.181] ReadFile (in: hFile=0x1298, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x20abf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x20abf61c*=0x2244, lpOverlapped=0x0) returned 1 [0163.301] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0xffffddbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.301] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3a50000, cbInput=0x2244, pPaddingInfo=0x0, pbIV=0x20abf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x20abf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x20abf848, pbOutput=0x3a50000, pcbResult=0x20abf618) returned 0x0 [0163.301] WriteFile (in: hFile=0x1298, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x20abf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x20abf61c*=0x2250, lpOverlapped=0x0) returned 1 [0163.301] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20abf60c | out: lpNewFilePointer=0x0) returned 1 [0163.301] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.301] WriteFile (in: hFile=0x1298, lpBuffer=0x20abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20abf61c, lpOverlapped=0x0 | out: lpBuffer=0x20abf83c*, lpNumberOfBytesWritten=0x20abf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.301] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x2250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.301] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0163.301] CloseHandle (hObject=0x1298) returned 1 [0163.301] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.play")) returned 1 [0163.303] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1867 os_tid = 0x1c10 [0162.913] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.913] ReadFile (in: hFile=0xd8c, lpBuffer=0x20cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20cff85c, lpOverlapped=0x0 | out: lpBuffer=0x20cffb34*, lpNumberOfBytesRead=0x20cff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.018] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.018] ReadFile (in: hFile=0xd8c, lpBuffer=0x20cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20cff85c, lpOverlapped=0x0 | out: lpBuffer=0x20cffb34*, lpNumberOfBytesRead=0x20cff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.018] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd210000 [0163.220] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd210000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd210000) returned 0x0 [0163.220] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x20cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0163.220] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x20cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd210000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x20cff828, pbKeyObject=0x0) returned 0x0 [0163.220] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd210000, cbOutput=0x230, pcbResult=0x20cff500, dwFlags=0x0 | out: pbOutput=0xd210000, pcbResult=0x20cff500) returned 0x0 [0163.221] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd210230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd210230) returned 0x0 [0163.221] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd210000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd210000, cbOutput=0x400, pcbResult=0x20cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd210000, pcbResult=0x20cff500) returned 0x0 [0163.224] VirtualFree (lpAddress=0xd210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.226] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.226] WriteFile (in: hFile=0xd8c, lpBuffer=0x20cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20cff830, lpOverlapped=0x0 | out: lpBuffer=0x20cffb34*, lpNumberOfBytesWritten=0x20cff830*=0x428, lpOverlapped=0x0) returned 1 [0163.226] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.226] ReadFile (in: hFile=0xd8c, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x20cff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x20cff61c*=0x3896, lpOverlapped=0x0) returned 1 [0163.285] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xffffc76a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.285] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3b50000, cbInput=0x3896, pPaddingInfo=0x0, pbIV=0x20cff848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x20cff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x20cff848, pbOutput=0x3b50000, pcbResult=0x20cff618) returned 0x0 [0163.285] WriteFile (in: hFile=0xd8c, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x20cff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x20cff61c*=0x38a0, lpOverlapped=0x0) returned 1 [0163.285] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20cff60c | out: lpNewFilePointer=0x0) returned 1 [0163.285] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.285] WriteFile (in: hFile=0xd8c, lpBuffer=0x20cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20cff61c, lpOverlapped=0x0 | out: lpBuffer=0x20cff83c*, lpNumberOfBytesWritten=0x20cff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.285] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x38a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.285] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0163.285] CloseHandle (hObject=0xd8c) returned 1 [0163.285] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.play")) returned 1 [0163.288] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1868 os_tid = 0x1c14 [0162.915] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.915] ReadFile (in: hFile=0x12b0, lpBuffer=0x20e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x20e3fb34*, lpNumberOfBytesRead=0x20e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.016] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.016] ReadFile (in: hFile=0x12b0, lpBuffer=0x20e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x20e3fb34*, lpNumberOfBytesRead=0x20e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.086] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0163.088] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0163.088] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x20e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0163.088] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x20e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x20e3f828, pbKeyObject=0x0) returned 0x0 [0163.088] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x20e3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x20e3f500) returned 0x0 [0163.088] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0163.088] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x20e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x20e3f500) returned 0x0 [0163.092] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.094] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.094] WriteFile (in: hFile=0x12b0, lpBuffer=0x20e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20e3f830, lpOverlapped=0x0 | out: lpBuffer=0x20e3fb34*, lpNumberOfBytesWritten=0x20e3f830*=0x428, lpOverlapped=0x0) returned 1 [0163.094] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.094] ReadFile (in: hFile=0x12b0, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x20e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x20e3f61c*=0x4780, lpOverlapped=0x0) returned 1 [0163.146] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0xffffb880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.146] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3c50000, cbInput=0x4780, pPaddingInfo=0x0, pbIV=0x20e3f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x20e3f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x20e3f848, pbOutput=0x3c50000, pcbResult=0x20e3f618) returned 0x0 [0163.146] WriteFile (in: hFile=0x12b0, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x20e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x20e3f61c*=0x4790, lpOverlapped=0x0) returned 1 [0163.146] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20e3f60c | out: lpNewFilePointer=0x0) returned 1 [0163.146] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.147] WriteFile (in: hFile=0x12b0, lpBuffer=0x20e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x20e3f83c*, lpNumberOfBytesWritten=0x20e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.147] SetFilePointerEx (in: hFile=0x12b0, liDistanceToMove=0x4790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.147] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0163.147] CloseHandle (hObject=0x12b0) returned 1 [0163.147] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.play")) returned 1 [0163.150] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1869 os_tid = 0x1c18 [0162.916] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.917] ReadFile (in: hFile=0x12b8, lpBuffer=0x20f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x20f7fb34*, lpNumberOfBytesRead=0x20f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.025] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.025] ReadFile (in: hFile=0x12b8, lpBuffer=0x20f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x20f7fb34*, lpNumberOfBytesRead=0x20f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.025] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd250000 [0163.192] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd250000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd250000) returned 0x0 [0163.192] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x20f7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0163.192] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x20f7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd250000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x20f7f828, pbKeyObject=0x0) returned 0x0 [0163.192] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd250000, cbOutput=0x230, pcbResult=0x20f7f500, dwFlags=0x0 | out: pbOutput=0xd250000, pcbResult=0x20f7f500) returned 0x0 [0163.192] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd250230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd250230) returned 0x0 [0163.192] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd250000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd250000, cbOutput=0x400, pcbResult=0x20f7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd250000, pcbResult=0x20f7f500) returned 0x0 [0163.196] VirtualFree (lpAddress=0xd250000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.198] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.198] WriteFile (in: hFile=0x12b8, lpBuffer=0x20f7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20f7f830, lpOverlapped=0x0 | out: lpBuffer=0x20f7fb34*, lpNumberOfBytesWritten=0x20f7f830*=0x428, lpOverlapped=0x0) returned 1 [0163.198] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.198] ReadFile (in: hFile=0x12b8, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x20f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x20f7f61c*=0x2b32, lpOverlapped=0x0) returned 1 [0163.316] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0xffffd4ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.316] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x3d50000, cbInput=0x2b32, pPaddingInfo=0x0, pbIV=0x20f7f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x20f7f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x20f7f848, pbOutput=0x3d50000, pcbResult=0x20f7f618) returned 0x0 [0163.316] WriteFile (in: hFile=0x12b8, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x20f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x20f7f61c*=0x2b40, lpOverlapped=0x0) returned 1 [0163.316] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20f7f60c | out: lpNewFilePointer=0x0) returned 1 [0163.316] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.316] WriteFile (in: hFile=0x12b8, lpBuffer=0x20f7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x20f7f83c*, lpNumberOfBytesWritten=0x20f7f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.316] SetFilePointerEx (in: hFile=0x12b8, liDistanceToMove=0x2b40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.316] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0163.317] CloseHandle (hObject=0x12b8) returned 1 [0163.317] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.play")) returned 1 [0163.319] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1870 os_tid = 0x1c1c [0162.918] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.918] ReadFile (in: hFile=0x12c0, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.024] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.024] ReadFile (in: hFile=0x12c0, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.024] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd240000 [0163.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd240000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd240000) returned 0x0 [0163.199] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x210bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0163.199] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x210bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd240000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x210bf828, pbKeyObject=0x0) returned 0x0 [0163.199] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd240000, cbOutput=0x230, pcbResult=0x210bf500, dwFlags=0x0 | out: pbOutput=0xd240000, pcbResult=0x210bf500) returned 0x0 [0163.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd240230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd240230) returned 0x0 [0163.199] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd240000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd240000, cbOutput=0x400, pcbResult=0x210bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd240000, pcbResult=0x210bf500) returned 0x0 [0163.203] VirtualFree (lpAddress=0xd240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.205] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.206] WriteFile (in: hFile=0x12c0, lpBuffer=0x210bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210bf830, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesWritten=0x210bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.206] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.206] ReadFile (in: hFile=0x12c0, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x210bf61c*=0x30e8, lpOverlapped=0x0) returned 1 [0163.311] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0xffffcf18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.311] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3e50000, cbInput=0x30e8, pPaddingInfo=0x0, pbIV=0x210bf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x210bf618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x210bf848, pbOutput=0x3e50000, pcbResult=0x210bf618) returned 0x0 [0163.311] WriteFile (in: hFile=0x12c0, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x210bf61c*=0x30f0, lpOverlapped=0x0) returned 1 [0163.311] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.311] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.311] WriteFile (in: hFile=0x12c0, lpBuffer=0x210bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x210bf83c*, lpNumberOfBytesWritten=0x210bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.311] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0x30f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.311] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0163.311] CloseHandle (hObject=0x12c0) returned 1 [0163.311] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.play")) returned 1 [0163.314] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1871 os_tid = 0x1c20 [0162.919] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.919] ReadFile (in: hFile=0x12c8, lpBuffer=0x211ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x211ff85c, lpOverlapped=0x0 | out: lpBuffer=0x211ffb34*, lpNumberOfBytesRead=0x211ff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.023] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.023] ReadFile (in: hFile=0x12c8, lpBuffer=0x211ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x211ff85c, lpOverlapped=0x0 | out: lpBuffer=0x211ffb34*, lpNumberOfBytesRead=0x211ff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.105] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0163.107] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0163.107] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x211ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0163.107] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x211ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x211ff828, pbKeyObject=0x0) returned 0x0 [0163.107] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x211ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x211ff500) returned 0x0 [0163.107] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0163.108] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x211ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x211ff500) returned 0x0 [0163.111] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.113] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.113] WriteFile (in: hFile=0x12c8, lpBuffer=0x211ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x211ff830, lpOverlapped=0x0 | out: lpBuffer=0x211ffb34*, lpNumberOfBytesWritten=0x211ff830*=0x428, lpOverlapped=0x0) returned 1 [0163.113] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.113] ReadFile (in: hFile=0x12c8, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x211ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x211ff61c*=0x265a, lpOverlapped=0x0) returned 1 [0163.158] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0xffffd9a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.158] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x3f50000, cbInput=0x265a, pPaddingInfo=0x0, pbIV=0x211ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x211ff618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x211ff848, pbOutput=0x3f50000, pcbResult=0x211ff618) returned 0x0 [0163.158] WriteFile (in: hFile=0x12c8, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x211ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x211ff61c*=0x2660, lpOverlapped=0x0) returned 1 [0163.158] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x211ff60c | out: lpNewFilePointer=0x0) returned 1 [0163.158] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.159] WriteFile (in: hFile=0x12c8, lpBuffer=0x211ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x211ff61c, lpOverlapped=0x0 | out: lpBuffer=0x211ff83c*, lpNumberOfBytesWritten=0x211ff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.159] SetFilePointerEx (in: hFile=0x12c8, liDistanceToMove=0x2660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.159] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0163.159] CloseHandle (hObject=0x12c8) returned 1 [0163.159] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.play")) returned 1 [0163.161] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1872 os_tid = 0x1c24 [0162.920] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.920] ReadFile (in: hFile=0x12d0, lpBuffer=0x2147fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2147f85c, lpOverlapped=0x0 | out: lpBuffer=0x2147fb34*, lpNumberOfBytesRead=0x2147f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.015] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.015] ReadFile (in: hFile=0x12d0, lpBuffer=0x2147fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2147f85c, lpOverlapped=0x0 | out: lpBuffer=0x2147fb34*, lpNumberOfBytesRead=0x2147f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.015] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd200000 [0163.227] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd200000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd200000) returned 0x0 [0163.227] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x2147f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0163.227] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x2147f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd200000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x2147f828, pbKeyObject=0x0) returned 0x0 [0163.227] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd200000, cbOutput=0x230, pcbResult=0x2147f500, dwFlags=0x0 | out: pbOutput=0xd200000, pcbResult=0x2147f500) returned 0x0 [0163.227] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd200230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd200230) returned 0x0 [0163.227] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd200000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd200000, cbOutput=0x400, pcbResult=0x2147f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd200000, pcbResult=0x2147f500) returned 0x0 [0163.230] VirtualFree (lpAddress=0xd200000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.283] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.283] WriteFile (in: hFile=0x12d0, lpBuffer=0x2147fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2147f830, lpOverlapped=0x0 | out: lpBuffer=0x2147fb34*, lpNumberOfBytesWritten=0x2147f830*=0x428, lpOverlapped=0x0) returned 1 [0163.284] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.284] ReadFile (in: hFile=0x12d0, lpBuffer=0x4150000, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2147f61c*=0x1eb6, lpOverlapped=0x0) returned 1 [0163.321] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0xffffe14a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.321] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4150000, cbInput=0x1eb6, pPaddingInfo=0x0, pbIV=0x2147f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2147f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2147f848, pbOutput=0x4150000, pcbResult=0x2147f618) returned 0x0 [0163.321] WriteFile (in: hFile=0x12d0, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2147f61c*=0x1ec0, lpOverlapped=0x0) returned 1 [0163.321] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2147f60c | out: lpNewFilePointer=0x0) returned 1 [0163.321] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.321] WriteFile (in: hFile=0x12d0, lpBuffer=0x2147f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x2147f83c*, lpNumberOfBytesWritten=0x2147f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.321] SetFilePointerEx (in: hFile=0x12d0, liDistanceToMove=0x1ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.321] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0163.321] CloseHandle (hObject=0x12d0) returned 1 [0163.322] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.play")) returned 1 [0163.324] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1873 os_tid = 0x1c28 [0162.921] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.924] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.924] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x215bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0162.924] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x215bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x215bf828, pbKeyObject=0x0) returned 0x0 [0162.924] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x215bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x215bf500) returned 0x0 [0162.924] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.924] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x215bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x215bf500) returned 0x0 [0162.929] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.932] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.932] WriteFile (in: hFile=0x12d8, lpBuffer=0x215bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x215bf830, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesWritten=0x215bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.128] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.128] ReadFile (in: hFile=0x12d8, lpBuffer=0x4250000, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x215bf61c*=0x3f4, lpOverlapped=0x0) returned 1 [0163.128] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0xfffffc0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.128] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x4250000, cbInput=0x3f4, pPaddingInfo=0x0, pbIV=0x215bf848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x215bf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x215bf848, pbOutput=0x4250000, pcbResult=0x215bf618) returned 0x0 [0163.128] WriteFile (in: hFile=0x12d8, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x215bf61c*=0x400, lpOverlapped=0x0) returned 1 [0163.128] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x215bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.128] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.129] WriteFile (in: hFile=0x12d8, lpBuffer=0x215bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x215bf83c*, lpNumberOfBytesWritten=0x215bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.129] SetFilePointerEx (in: hFile=0x12d8, liDistanceToMove=0x400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.129] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0163.129] CloseHandle (hObject=0x12d8) returned 1 [0163.129] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0163.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.play")) returned 1 [0163.131] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1874 os_tid = 0x1c2c [0162.933] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0162.934] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0162.935] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x216ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0162.935] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x216ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x216ff828, pbKeyObject=0x0) returned 0x0 [0162.935] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x216ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x216ff500) returned 0x0 [0162.935] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0162.935] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x216ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x216ff500) returned 0x0 [0163.641] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.642] SetFilePointerEx (in: hFile=0x12e0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.642] WriteFile (in: hFile=0x12e0, lpBuffer=0x216ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x216ff830, lpOverlapped=0x0 | out: lpBuffer=0x216ffb34*, lpNumberOfBytesWritten=0x216ff830*=0x428, lpOverlapped=0x0) returned 1 [0163.644] SetFilePointerEx (in: hFile=0x12e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.644] ReadFile (in: hFile=0x12e0, lpBuffer=0x4350000, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x216ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x216ff61c*=0x370, lpOverlapped=0x0) returned 1 [0163.644] SetFilePointerEx (in: hFile=0x12e0, liDistanceToMove=0xfffffc90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.644] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x4350000, cbInput=0x370, pPaddingInfo=0x0, pbIV=0x216ff848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x216ff618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x216ff848, pbOutput=0x4350000, pcbResult=0x216ff618) returned 0x0 [0163.644] WriteFile (in: hFile=0x12e0, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x216ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x216ff61c*=0x380, lpOverlapped=0x0) returned 1 [0163.644] SetFilePointerEx (in: hFile=0x12e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x216ff60c | out: lpNewFilePointer=0x0) returned 1 [0163.644] SetFilePointerEx (in: hFile=0x12e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.644] WriteFile (in: hFile=0x12e0, lpBuffer=0x216ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x216ff61c, lpOverlapped=0x0 | out: lpBuffer=0x216ff83c*, lpNumberOfBytesWritten=0x216ff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.644] SetFilePointerEx (in: hFile=0x12e0, liDistanceToMove=0x380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.644] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0163.644] CloseHandle (hObject=0x12e0) returned 1 [0163.644] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0163.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.play")) returned 1 [0163.646] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1875 os_tid = 0x1c30 [0163.649] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.649] ReadFile (in: hFile=0x12e8, lpBuffer=0x2183fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2183f85c, lpOverlapped=0x0 | out: lpBuffer=0x2183fb34*, lpNumberOfBytesRead=0x2183f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.743] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.743] ReadFile (in: hFile=0x12e8, lpBuffer=0x2183fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2183f85c, lpOverlapped=0x0 | out: lpBuffer=0x2183fb34*, lpNumberOfBytesRead=0x2183f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.040] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.041] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.041] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x2183f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0164.041] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x2183f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x2183f828, pbKeyObject=0x0) returned 0x0 [0164.041] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2183f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2183f500) returned 0x0 [0164.042] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.042] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2183f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2183f500) returned 0x0 [0164.045] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.047] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.047] WriteFile (in: hFile=0x12e8, lpBuffer=0x2183fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2183f830, lpOverlapped=0x0 | out: lpBuffer=0x2183fb34*, lpNumberOfBytesWritten=0x2183f830*=0x428, lpOverlapped=0x0) returned 1 [0164.815] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.815] ReadFile (in: hFile=0x12e8, lpBuffer=0x4450000, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x2183f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x2183f61c*=0x27a2, lpOverlapped=0x0) returned 1 [0164.816] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0xffffd85e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.816] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x4450000, cbInput=0x27a2, pPaddingInfo=0x0, pbIV=0x2183f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x2183f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x2183f848, pbOutput=0x4450000, pcbResult=0x2183f618) returned 0x0 [0164.816] WriteFile (in: hFile=0x12e8, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2183f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x2183f61c*=0x27b0, lpOverlapped=0x0) returned 1 [0164.816] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2183f60c | out: lpNewFilePointer=0x0) returned 1 [0164.816] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.816] WriteFile (in: hFile=0x12e8, lpBuffer=0x2183f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2183f61c, lpOverlapped=0x0 | out: lpBuffer=0x2183f83c*, lpNumberOfBytesWritten=0x2183f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.816] SetFilePointerEx (in: hFile=0x12e8, liDistanceToMove=0x27b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.816] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0164.816] CloseHandle (hObject=0x12e8) returned 1 [0164.822] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0164.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.play")) returned 1 [0164.824] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1876 os_tid = 0x1c34 [0163.650] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.650] ReadFile (in: hFile=0x12f0, lpBuffer=0x2197fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2197f85c, lpOverlapped=0x0 | out: lpBuffer=0x2197fb34*, lpNumberOfBytesRead=0x2197f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.744] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.746] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.746] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x2197f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0163.746] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x2197f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x2197f828, pbKeyObject=0x0) returned 0x0 [0163.746] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2197f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2197f500) returned 0x0 [0163.747] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.747] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2197f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2197f500) returned 0x0 [0163.754] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.757] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.757] WriteFile (in: hFile=0x12f0, lpBuffer=0x2197fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2197f830, lpOverlapped=0x0 | out: lpBuffer=0x2197fb34*, lpNumberOfBytesWritten=0x2197f830*=0x428, lpOverlapped=0x0) returned 1 [0163.758] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.758] ReadFile (in: hFile=0x12f0, lpBuffer=0x4550000, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x2197f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x2197f61c*=0x5b8, lpOverlapped=0x0) returned 1 [0163.758] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0xfffffa48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.758] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x4550000, cbInput=0x5b8, pPaddingInfo=0x0, pbIV=0x2197f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x2197f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x2197f848, pbOutput=0x4550000, pcbResult=0x2197f618) returned 0x0 [0163.758] WriteFile (in: hFile=0x12f0, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2197f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x2197f61c*=0x5c0, lpOverlapped=0x0) returned 1 [0163.759] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2197f60c | out: lpNewFilePointer=0x0) returned 1 [0163.759] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.759] WriteFile (in: hFile=0x12f0, lpBuffer=0x2197f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2197f61c, lpOverlapped=0x0 | out: lpBuffer=0x2197f83c*, lpNumberOfBytesWritten=0x2197f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.759] SetFilePointerEx (in: hFile=0x12f0, liDistanceToMove=0x5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.759] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0163.759] CloseHandle (hObject=0x12f0) returned 1 [0163.759] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0163.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.play")) returned 1 [0163.763] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1877 os_tid = 0x1c38 [0163.651] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.651] ReadFile (in: hFile=0x12f8, lpBuffer=0x21abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21abf85c, lpOverlapped=0x0 | out: lpBuffer=0x21abfb34*, lpNumberOfBytesRead=0x21abf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.653] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.654] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.654] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x21abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0163.654] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x21abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x21abf828, pbKeyObject=0x0) returned 0x0 [0163.655] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21abf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21abf500) returned 0x0 [0163.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.655] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21abf500) returned 0x0 [0163.658] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.659] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.660] WriteFile (in: hFile=0x12f8, lpBuffer=0x21abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21abf830, lpOverlapped=0x0 | out: lpBuffer=0x21abfb34*, lpNumberOfBytesWritten=0x21abf830*=0x428, lpOverlapped=0x0) returned 1 [0163.660] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.660] ReadFile (in: hFile=0x12f8, lpBuffer=0x4650000, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x21abf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x21abf61c*=0x6a0, lpOverlapped=0x0) returned 1 [0163.660] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0xfffff960, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.660] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x4650000, cbInput=0x6a0, pPaddingInfo=0x0, pbIV=0x21abf848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x21abf618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x21abf848, pbOutput=0x4650000, pcbResult=0x21abf618) returned 0x0 [0163.660] WriteFile (in: hFile=0x12f8, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x21abf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x21abf61c*=0x6b0, lpOverlapped=0x0) returned 1 [0163.660] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21abf60c | out: lpNewFilePointer=0x0) returned 1 [0163.660] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.660] WriteFile (in: hFile=0x12f8, lpBuffer=0x21abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21abf61c, lpOverlapped=0x0 | out: lpBuffer=0x21abf83c*, lpNumberOfBytesWritten=0x21abf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.661] SetFilePointerEx (in: hFile=0x12f8, liDistanceToMove=0x6b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.661] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0163.661] CloseHandle (hObject=0x12f8) returned 1 [0163.661] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0163.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.play")) returned 1 [0163.663] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1878 os_tid = 0x1c3c [0163.665] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.665] ReadFile (in: hFile=0x1300, lpBuffer=0x21bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21bff85c, lpOverlapped=0x0 | out: lpBuffer=0x21bffb34*, lpNumberOfBytesRead=0x21bff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.667] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.668] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.668] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x21bff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0163.668] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x21bff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x21bff828, pbKeyObject=0x0) returned 0x0 [0163.668] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21bff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21bff500) returned 0x0 [0163.668] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.668] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21bff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21bff500) returned 0x0 [0163.672] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.673] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.673] WriteFile (in: hFile=0x1300, lpBuffer=0x21bffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21bff830, lpOverlapped=0x0 | out: lpBuffer=0x21bffb34*, lpNumberOfBytesWritten=0x21bff830*=0x428, lpOverlapped=0x0) returned 1 [0163.674] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.674] ReadFile (in: hFile=0x1300, lpBuffer=0x4750000, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x21bff61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x21bff61c*=0x5ec, lpOverlapped=0x0) returned 1 [0163.674] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xfffffa14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.674] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x4750000, cbInput=0x5ec, pPaddingInfo=0x0, pbIV=0x21bff848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x21bff618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x21bff848, pbOutput=0x4750000, pcbResult=0x21bff618) returned 0x0 [0163.674] WriteFile (in: hFile=0x1300, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x21bff61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x21bff61c*=0x5f0, lpOverlapped=0x0) returned 1 [0163.674] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21bff60c | out: lpNewFilePointer=0x0) returned 1 [0163.674] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.674] WriteFile (in: hFile=0x1300, lpBuffer=0x21bff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21bff61c, lpOverlapped=0x0 | out: lpBuffer=0x21bff83c*, lpNumberOfBytesWritten=0x21bff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.674] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x5f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.674] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0163.674] CloseHandle (hObject=0x1300) returned 1 [0163.674] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0163.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.play")) returned 1 [0163.676] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1879 os_tid = 0x1c40 [0163.678] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.678] ReadFile (in: hFile=0x1308, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.812] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.812] ReadFile (in: hFile=0x1308, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.812] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.813] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.813] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x21d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0163.813] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x21d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x21d3f828, pbKeyObject=0x0) returned 0x0 [0163.813] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21d3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21d3f500) returned 0x0 [0163.813] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.814] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21d3f500) returned 0x0 [0163.817] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.819] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.819] WriteFile (in: hFile=0x1308, lpBuffer=0x21d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d3f830, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesWritten=0x21d3f830*=0x428, lpOverlapped=0x0) returned 1 [0163.819] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.819] ReadFile (in: hFile=0x1308, lpBuffer=0x4850000, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x21d3f61c*=0xf92, lpOverlapped=0x0) returned 1 [0163.819] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffff06e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.819] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x4850000, cbInput=0xf92, pPaddingInfo=0x0, pbIV=0x21d3f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x21d3f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x21d3f848, pbOutput=0x4850000, pcbResult=0x21d3f618) returned 0x0 [0163.819] WriteFile (in: hFile=0x1308, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x21d3f61c*=0xfa0, lpOverlapped=0x0) returned 1 [0163.820] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d3f60c | out: lpNewFilePointer=0x0) returned 1 [0163.820] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.820] WriteFile (in: hFile=0x1308, lpBuffer=0x21d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d3f83c*, lpNumberOfBytesWritten=0x21d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.820] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.820] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0163.820] CloseHandle (hObject=0x1308) returned 1 [0163.820] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0163.821] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.play")) returned 1 [0163.822] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1880 os_tid = 0x1c44 [0163.680] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.680] ReadFile (in: hFile=0x1310, lpBuffer=0x21e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e7fb34*, lpNumberOfBytesRead=0x21e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.800] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.801] ReadFile (in: hFile=0x1310, lpBuffer=0x21e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e7fb34*, lpNumberOfBytesRead=0x21e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.801] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.803] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.804] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x21e7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0163.804] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x21e7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x21e7f828, pbKeyObject=0x0) returned 0x0 [0163.804] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21e7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21e7f500) returned 0x0 [0163.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.804] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21e7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21e7f500) returned 0x0 [0163.808] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.810] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.810] WriteFile (in: hFile=0x1310, lpBuffer=0x21e7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21e7f830, lpOverlapped=0x0 | out: lpBuffer=0x21e7fb34*, lpNumberOfBytesWritten=0x21e7f830*=0x428, lpOverlapped=0x0) returned 1 [0163.811] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.811] ReadFile (in: hFile=0x1310, lpBuffer=0x4950000, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x21e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x21e7f61c*=0x1f86, lpOverlapped=0x0) returned 1 [0164.414] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xffffe07a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.415] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4950000, cbInput=0x1f86, pPaddingInfo=0x0, pbIV=0x21e7f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x21e7f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x21e7f848, pbOutput=0x4950000, pcbResult=0x21e7f618) returned 0x0 [0164.415] WriteFile (in: hFile=0x1310, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x21e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x21e7f61c*=0x1f90, lpOverlapped=0x0) returned 1 [0164.415] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21e7f60c | out: lpNewFilePointer=0x0) returned 1 [0164.415] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.415] WriteFile (in: hFile=0x1310, lpBuffer=0x21e7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x21e7f83c*, lpNumberOfBytesWritten=0x21e7f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.415] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x1f90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.415] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0164.415] CloseHandle (hObject=0x1310) returned 1 [0164.603] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe60000 [0164.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.play")) returned 1 [0164.715] VirtualFree (lpAddress=0xe60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1881 os_tid = 0x1c48 [0163.681] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.681] ReadFile (in: hFile=0x1318, lpBuffer=0x21fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x21fbfb34*, lpNumberOfBytesRead=0x21fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.825] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.825] ReadFile (in: hFile=0x1318, lpBuffer=0x21fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x21fbfb34*, lpNumberOfBytesRead=0x21fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.415] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.417] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.417] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x21fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0164.417] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x21fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x21fbf828, pbKeyObject=0x0) returned 0x0 [0164.417] BCryptExportKey (in: hKey=0x796030, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21fbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21fbf500) returned 0x0 [0164.417] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.417] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21fbf500) returned 0x0 [0164.422] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.424] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.424] WriteFile (in: hFile=0x1318, lpBuffer=0x21fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21fbf830, lpOverlapped=0x0 | out: lpBuffer=0x21fbfb34*, lpNumberOfBytesWritten=0x21fbf830*=0x428, lpOverlapped=0x0) returned 1 [0164.425] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.425] ReadFile (in: hFile=0x1318, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x21fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x21fbf61c*=0x2458, lpOverlapped=0x0) returned 1 [0164.572] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0xffffdba8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.572] BCryptEncrypt (in: hKey=0x796030, pbInput=0x4a50000, cbInput=0x2458, pPaddingInfo=0x0, pbIV=0x21fbf848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x21fbf618, dwFlags=0x1 | out: hKey=0x796030, pbIV=0x21fbf848, pbOutput=0x4a50000, pcbResult=0x21fbf618) returned 0x0 [0164.572] WriteFile (in: hFile=0x1318, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x21fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x21fbf61c*=0x2460, lpOverlapped=0x0) returned 1 [0164.572] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21fbf60c | out: lpNewFilePointer=0x0) returned 1 [0164.572] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.572] WriteFile (in: hFile=0x1318, lpBuffer=0x21fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x21fbf83c*, lpNumberOfBytesWritten=0x21fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.572] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x2460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.572] BCryptDestroyKey (in: hKey=0x796030 | out: hKey=0x796030) returned 0x0 [0164.573] CloseHandle (hObject=0x1318) returned 1 [0164.634] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd290000 [0164.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.play")) returned 1 [0164.660] VirtualFree (lpAddress=0xd290000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1882 os_tid = 0x1c4c [0163.682] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.682] ReadFile (in: hFile=0x1320, lpBuffer=0x220ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x220ff85c, lpOverlapped=0x0 | out: lpBuffer=0x220ffb34*, lpNumberOfBytesRead=0x220ff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.929] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.929] ReadFile (in: hFile=0x1320, lpBuffer=0x220ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x220ff85c, lpOverlapped=0x0 | out: lpBuffer=0x220ffb34*, lpNumberOfBytesRead=0x220ff85c*=0x428, lpOverlapped=0x0) returned 1 [0163.929] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.931] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.931] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x220ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0163.931] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x220ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x220ff828, pbKeyObject=0x0) returned 0x0 [0163.931] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x220ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x220ff500) returned 0x0 [0163.932] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.932] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x220ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x220ff500) returned 0x0 [0163.943] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.947] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.948] WriteFile (in: hFile=0x1320, lpBuffer=0x220ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x220ff830, lpOverlapped=0x0 | out: lpBuffer=0x220ffb34*, lpNumberOfBytesWritten=0x220ff830*=0x428, lpOverlapped=0x0) returned 1 [0163.950] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.950] ReadFile (in: hFile=0x1320, lpBuffer=0x4b50000, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x220ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x220ff61c*=0xfb8, lpOverlapped=0x0) returned 1 [0163.950] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0xfffff048, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.950] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4b50000, cbInput=0xfb8, pPaddingInfo=0x0, pbIV=0x220ff848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x220ff618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x220ff848, pbOutput=0x4b50000, pcbResult=0x220ff618) returned 0x0 [0163.950] WriteFile (in: hFile=0x1320, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x220ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x220ff61c*=0xfc0, lpOverlapped=0x0) returned 1 [0163.950] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x220ff60c | out: lpNewFilePointer=0x0) returned 1 [0163.950] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.951] WriteFile (in: hFile=0x1320, lpBuffer=0x220ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x220ff61c, lpOverlapped=0x0 | out: lpBuffer=0x220ff83c*, lpNumberOfBytesWritten=0x220ff61c*=0x8, lpOverlapped=0x0) returned 1 [0163.951] SetFilePointerEx (in: hFile=0x1320, liDistanceToMove=0xfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.951] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0163.951] CloseHandle (hObject=0x1320) returned 1 [0164.528] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0164.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.play")) returned 1 [0164.757] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1883 os_tid = 0x1c50 [0163.686] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.686] ReadFile (in: hFile=0x1328, lpBuffer=0x26f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x26f3fb34*, lpNumberOfBytesRead=0x26f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.164] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.164] ReadFile (in: hFile=0x1328, lpBuffer=0x26f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x26f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x26f3fb34*, lpNumberOfBytesRead=0x26f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.164] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.166] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.166] BCryptSetProperty (in: hObject=0x7360f0, pszProperty="ChainingMode", pbInput=0x26f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7360f0) returned 0x0 [0164.166] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7360f0, phKey=0x26f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7360f0, phKey=0x26f3f828, pbKeyObject=0x0) returned 0x0 [0164.166] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x26f3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x26f3f500) returned 0x0 [0164.166] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.166] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x26f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x26f3f500) returned 0x0 [0164.169] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.171] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.171] WriteFile (in: hFile=0x1328, lpBuffer=0x26f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x26f3f830, lpOverlapped=0x0 | out: lpBuffer=0x26f3fb34*, lpNumberOfBytesWritten=0x26f3f830*=0x428, lpOverlapped=0x0) returned 1 [0164.171] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.171] ReadFile (in: hFile=0x1328, lpBuffer=0x7c50000, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x26f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x26f3f61c*=0x386c, lpOverlapped=0x0) returned 1 [0164.524] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xffffc794, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.525] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x7c50000, cbInput=0x386c, pPaddingInfo=0x0, pbIV=0x26f3f848, cbIV=0x10, pbOutput=0x7c50000, cbOutput=0x100000, pcbResult=0x26f3f618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x26f3f848, pbOutput=0x7c50000, pcbResult=0x26f3f618) returned 0x0 [0164.525] WriteFile (in: hFile=0x1328, lpBuffer=0x7c50000*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x26f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesWritten=0x26f3f61c*=0x3870, lpOverlapped=0x0) returned 1 [0164.525] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26f3f60c | out: lpNewFilePointer=0x0) returned 1 [0164.525] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.525] WriteFile (in: hFile=0x1328, lpBuffer=0x26f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x26f3f83c*, lpNumberOfBytesWritten=0x26f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.525] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x3870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.525] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0164.525] CloseHandle (hObject=0x1328) returned 1 [0164.618] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd210000 [0164.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.play")) returned 1 [0164.643] VirtualFree (lpAddress=0xd210000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1884 os_tid = 0x1c54 [0163.687] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.687] ReadFile (in: hFile=0x1110, lpBuffer=0x238bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x238bf85c, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesRead=0x238bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.906] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0163.910] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0163.910] BCryptSetProperty (in: hObject=0x734af0, pszProperty="ChainingMode", pbInput=0x238bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734af0) returned 0x0 [0163.910] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734af0, phKey=0x238bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734af0, phKey=0x238bf828, pbKeyObject=0x0) returned 0x0 [0163.910] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x238bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x238bf500) returned 0x0 [0163.910] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0163.911] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x238bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x238bf500) returned 0x0 [0163.920] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.923] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.923] WriteFile (in: hFile=0x1110, lpBuffer=0x238bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x238bf830, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesWritten=0x238bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.924] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.924] ReadFile (in: hFile=0x1110, lpBuffer=0x7d50000, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7d50000*, lpNumberOfBytesRead=0x238bf61c*=0x600, lpOverlapped=0x0) returned 1 [0163.924] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffa00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.925] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x7d50000, cbInput=0x600, pPaddingInfo=0x0, pbIV=0x238bf848, cbIV=0x10, pbOutput=0x7d50000, cbOutput=0x100000, pcbResult=0x238bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x238bf848, pbOutput=0x7d50000, pcbResult=0x238bf618) returned 0x0 [0163.925] WriteFile (in: hFile=0x1110, lpBuffer=0x7d50000*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7d50000*, lpNumberOfBytesWritten=0x238bf61c*=0x610, lpOverlapped=0x0) returned 1 [0163.925] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.925] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.925] WriteFile (in: hFile=0x1110, lpBuffer=0x238bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x238bf83c*, lpNumberOfBytesWritten=0x238bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.925] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.925] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0163.925] CloseHandle (hObject=0x1110) returned 1 [0163.926] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0163.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.play")) returned 1 [0164.753] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1885 os_tid = 0x1c58 [0163.689] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.689] ReadFile (in: hFile=0x1334, lpBuffer=0x2707fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2707f85c, lpOverlapped=0x0 | out: lpBuffer=0x2707fb34*, lpNumberOfBytesRead=0x2707f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.993] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.993] ReadFile (in: hFile=0x1334, lpBuffer=0x2707fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2707f85c, lpOverlapped=0x0 | out: lpBuffer=0x2707fb34*, lpNumberOfBytesRead=0x2707f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.993] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.996] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.996] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x2707f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0163.996] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x2707f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x2707f828, pbKeyObject=0x0) returned 0x0 [0163.996] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2707f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2707f500) returned 0x0 [0163.996] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.996] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2707f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2707f500) returned 0x0 [0164.037] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.039] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.039] WriteFile (in: hFile=0x1334, lpBuffer=0x2707fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2707f830, lpOverlapped=0x0 | out: lpBuffer=0x2707fb34*, lpNumberOfBytesWritten=0x2707f830*=0x428, lpOverlapped=0x0) returned 1 [0164.865] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.865] ReadFile (in: hFile=0x1334, lpBuffer=0x5250000, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x2707f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x2707f61c*=0x1264, lpOverlapped=0x0) returned 1 [0164.865] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xffffed9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.873] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x5250000, cbInput=0x1264, pPaddingInfo=0x0, pbIV=0x2707f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x2707f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2707f848, pbOutput=0x5250000, pcbResult=0x2707f618) returned 0x0 [0164.873] WriteFile (in: hFile=0x1334, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2707f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x2707f61c*=0x1270, lpOverlapped=0x0) returned 1 [0164.873] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2707f60c | out: lpNewFilePointer=0x0) returned 1 [0164.873] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.873] WriteFile (in: hFile=0x1334, lpBuffer=0x2707f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2707f61c, lpOverlapped=0x0 | out: lpBuffer=0x2707f83c*, lpNumberOfBytesWritten=0x2707f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.882] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x1270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.882] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0164.882] CloseHandle (hObject=0x1334) returned 1 [0164.882] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.play")) returned 1 [0164.887] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1886 os_tid = 0x1c5c [0163.691] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.691] ReadFile (in: hFile=0x133c, lpBuffer=0x271bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x271bf85c, lpOverlapped=0x0 | out: lpBuffer=0x271bfb34*, lpNumberOfBytesRead=0x271bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.984] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.984] BCryptSetProperty (in: hObject=0x7358b0, pszProperty="ChainingMode", pbInput=0x271bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7358b0) returned 0x0 [0163.984] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7358b0, phKey=0x271bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7358b0, phKey=0x271bf828, pbKeyObject=0x0) returned 0x0 [0163.984] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x271bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x271bf500) returned 0x0 [0163.985] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.985] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x271bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x271bf500) returned 0x0 [0163.989] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.991] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.991] WriteFile (in: hFile=0x133c, lpBuffer=0x271bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x271bf830, lpOverlapped=0x0 | out: lpBuffer=0x271bfb34*, lpNumberOfBytesWritten=0x271bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.992] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.992] ReadFile (in: hFile=0x133c, lpBuffer=0x7e50000, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x271bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7e50000*, lpNumberOfBytesRead=0x271bf61c*=0x6c8, lpOverlapped=0x0) returned 1 [0163.992] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0xfffff938, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.992] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x7e50000, cbInput=0x6c8, pPaddingInfo=0x0, pbIV=0x271bf848, cbIV=0x10, pbOutput=0x7e50000, cbOutput=0x100000, pcbResult=0x271bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x271bf848, pbOutput=0x7e50000, pcbResult=0x271bf618) returned 0x0 [0163.992] WriteFile (in: hFile=0x133c, lpBuffer=0x7e50000*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x271bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7e50000*, lpNumberOfBytesWritten=0x271bf61c*=0x6d0, lpOverlapped=0x0) returned 1 [0163.993] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.993] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.993] WriteFile (in: hFile=0x133c, lpBuffer=0x271bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x271bf61c, lpOverlapped=0x0 | out: lpBuffer=0x271bf83c*, lpNumberOfBytesWritten=0x271bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.993] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x6d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.993] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0163.993] CloseHandle (hObject=0x133c) returned 1 [0164.532] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0164.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.play")) returned 1 [0164.764] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1887 os_tid = 0x1c60 [0163.692] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.692] ReadFile (in: hFile=0x1344, lpBuffer=0x272ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x272ff85c, lpOverlapped=0x0 | out: lpBuffer=0x272ffb34*, lpNumberOfBytesRead=0x272ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.155] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.155] ReadFile (in: hFile=0x1344, lpBuffer=0x272ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x272ff85c, lpOverlapped=0x0 | out: lpBuffer=0x272ffb34*, lpNumberOfBytesRead=0x272ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.155] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.157] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.157] BCryptSetProperty (in: hObject=0x7346d0, pszProperty="ChainingMode", pbInput=0x272ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7346d0) returned 0x0 [0164.157] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7346d0, phKey=0x272ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7346d0, phKey=0x272ff828, pbKeyObject=0x0) returned 0x0 [0164.157] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x272ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x272ff500) returned 0x0 [0164.157] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.157] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x272ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x272ff500) returned 0x0 [0164.160] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.162] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.162] WriteFile (in: hFile=0x1344, lpBuffer=0x272ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x272ff830, lpOverlapped=0x0 | out: lpBuffer=0x272ffb34*, lpNumberOfBytesWritten=0x272ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.163] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.163] ReadFile (in: hFile=0x1344, lpBuffer=0x7f50000, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x272ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7f50000*, lpNumberOfBytesRead=0x272ff61c*=0x30c2, lpOverlapped=0x0) returned 1 [0164.524] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0xffffcf3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.524] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x7f50000, cbInput=0x30c2, pPaddingInfo=0x0, pbIV=0x272ff848, cbIV=0x10, pbOutput=0x7f50000, cbOutput=0x100000, pcbResult=0x272ff618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x272ff848, pbOutput=0x7f50000, pcbResult=0x272ff618) returned 0x0 [0164.524] WriteFile (in: hFile=0x1344, lpBuffer=0x7f50000*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x272ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7f50000*, lpNumberOfBytesWritten=0x272ff61c*=0x30d0, lpOverlapped=0x0) returned 1 [0164.524] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x272ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.524] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.524] WriteFile (in: hFile=0x1344, lpBuffer=0x272ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x272ff61c, lpOverlapped=0x0 | out: lpBuffer=0x272ff83c*, lpNumberOfBytesWritten=0x272ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.524] SetFilePointerEx (in: hFile=0x1344, liDistanceToMove=0x30d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.524] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0164.524] CloseHandle (hObject=0x1344) returned 1 [0164.615] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd200000 [0164.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.play")) returned 1 [0164.646] VirtualFree (lpAddress=0xd200000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1888 os_tid = 0x1c64 [0163.693] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.693] ReadFile (in: hFile=0x134c, lpBuffer=0x2743fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2743f85c, lpOverlapped=0x0 | out: lpBuffer=0x2743fb34*, lpNumberOfBytesRead=0x2743f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.951] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.952] ReadFile (in: hFile=0x134c, lpBuffer=0x2743fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2743f85c, lpOverlapped=0x0 | out: lpBuffer=0x2743fb34*, lpNumberOfBytesRead=0x2743f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.952] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.955] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.955] BCryptSetProperty (in: hObject=0x7344c0, pszProperty="ChainingMode", pbInput=0x2743f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7344c0) returned 0x0 [0163.955] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7344c0, phKey=0x2743f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7344c0, phKey=0x2743f828, pbKeyObject=0x0) returned 0x0 [0163.955] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2743f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2743f500) returned 0x0 [0163.955] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.956] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2743f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2743f500) returned 0x0 [0163.975] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.979] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.979] WriteFile (in: hFile=0x134c, lpBuffer=0x2743fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2743f830, lpOverlapped=0x0 | out: lpBuffer=0x2743fb34*, lpNumberOfBytesWritten=0x2743f830*=0x428, lpOverlapped=0x0) returned 1 [0163.980] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.980] ReadFile (in: hFile=0x134c, lpBuffer=0x8050000, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x2743f61c, lpOverlapped=0x0 | out: lpBuffer=0x8050000*, lpNumberOfBytesRead=0x2743f61c*=0x9fc, lpOverlapped=0x0) returned 1 [0163.980] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff604, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.981] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x8050000, cbInput=0x9fc, pPaddingInfo=0x0, pbIV=0x2743f848, cbIV=0x10, pbOutput=0x8050000, cbOutput=0x100000, pcbResult=0x2743f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2743f848, pbOutput=0x8050000, pcbResult=0x2743f618) returned 0x0 [0163.981] WriteFile (in: hFile=0x134c, lpBuffer=0x8050000*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2743f61c, lpOverlapped=0x0 | out: lpBuffer=0x8050000*, lpNumberOfBytesWritten=0x2743f61c*=0xa00, lpOverlapped=0x0) returned 1 [0163.981] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2743f60c | out: lpNewFilePointer=0x0) returned 1 [0163.981] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.981] WriteFile (in: hFile=0x134c, lpBuffer=0x2743f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2743f61c, lpOverlapped=0x0 | out: lpBuffer=0x2743f83c*, lpNumberOfBytesWritten=0x2743f61c*=0x8, lpOverlapped=0x0) returned 1 [0163.981] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.981] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0163.981] CloseHandle (hObject=0x134c) returned 1 [0164.530] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0164.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.play")) returned 1 [0164.762] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1889 os_tid = 0x1c68 [0163.694] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.694] ReadFile (in: hFile=0x1354, lpBuffer=0x2757fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2757f85c, lpOverlapped=0x0 | out: lpBuffer=0x2757fb34*, lpNumberOfBytesRead=0x2757f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.155] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.155] ReadFile (in: hFile=0x1354, lpBuffer=0x2757fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2757f85c, lpOverlapped=0x0 | out: lpBuffer=0x2757fb34*, lpNumberOfBytesRead=0x2757f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.513] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.514] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.514] BCryptSetProperty (in: hObject=0x735800, pszProperty="ChainingMode", pbInput=0x2757f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735800) returned 0x0 [0164.514] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735800, phKey=0x2757f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735800, phKey=0x2757f828, pbKeyObject=0x0) returned 0x0 [0164.514] BCryptExportKey (in: hKey=0x792b00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2757f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2757f500) returned 0x0 [0164.515] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.515] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2757f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2757f500) returned 0x0 [0164.519] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.521] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.521] WriteFile (in: hFile=0x1354, lpBuffer=0x2757fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2757f830, lpOverlapped=0x0 | out: lpBuffer=0x2757fb34*, lpNumberOfBytesWritten=0x2757f830*=0x428, lpOverlapped=0x0) returned 1 [0164.522] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.522] ReadFile (in: hFile=0x1354, lpBuffer=0x8150000, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x2757f61c, lpOverlapped=0x0 | out: lpBuffer=0x8150000*, lpNumberOfBytesRead=0x2757f61c*=0x1678, lpOverlapped=0x0) returned 1 [0164.522] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xffffe988, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.522] BCryptEncrypt (in: hKey=0x792b00, pbInput=0x8150000, cbInput=0x1678, pPaddingInfo=0x0, pbIV=0x2757f848, cbIV=0x10, pbOutput=0x8150000, cbOutput=0x100000, pcbResult=0x2757f618, dwFlags=0x1 | out: hKey=0x792b00, pbIV=0x2757f848, pbOutput=0x8150000, pcbResult=0x2757f618) returned 0x0 [0164.522] WriteFile (in: hFile=0x1354, lpBuffer=0x8150000*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2757f61c, lpOverlapped=0x0 | out: lpBuffer=0x8150000*, lpNumberOfBytesWritten=0x2757f61c*=0x1680, lpOverlapped=0x0) returned 1 [0164.523] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2757f60c | out: lpNewFilePointer=0x0) returned 1 [0164.523] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.523] WriteFile (in: hFile=0x1354, lpBuffer=0x2757f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2757f61c, lpOverlapped=0x0 | out: lpBuffer=0x2757f83c*, lpNumberOfBytesWritten=0x2757f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.523] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x1680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.523] BCryptDestroyKey (in: hKey=0x792b00 | out: hKey=0x792b00) returned 0x0 [0164.523] CloseHandle (hObject=0x1354) returned 1 [0164.614] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd1f0000 [0164.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.play")) returned 1 [0164.688] VirtualFree (lpAddress=0xd1f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1890 os_tid = 0x1c6c [0163.696] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.696] ReadFile (in: hFile=0x135c, lpBuffer=0x276bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x276bf85c, lpOverlapped=0x0 | out: lpBuffer=0x276bfb34*, lpNumberOfBytesRead=0x276bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.070] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.071] ReadFile (in: hFile=0x135c, lpBuffer=0x276bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x276bf85c, lpOverlapped=0x0 | out: lpBuffer=0x276bfb34*, lpNumberOfBytesRead=0x276bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.071] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.072] BCryptSetProperty (in: hObject=0x7356a0, pszProperty="ChainingMode", pbInput=0x276bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7356a0) returned 0x0 [0164.072] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7356a0, phKey=0x276bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7356a0, phKey=0x276bf828, pbKeyObject=0x0) returned 0x0 [0164.072] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x276bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x276bf500) returned 0x0 [0164.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.072] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x276bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x276bf500) returned 0x0 [0164.151] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.153] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.153] WriteFile (in: hFile=0x135c, lpBuffer=0x276bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x276bf830, lpOverlapped=0x0 | out: lpBuffer=0x276bfb34*, lpNumberOfBytesWritten=0x276bf830*=0x428, lpOverlapped=0x0) returned 1 [0164.154] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.154] ReadFile (in: hFile=0x135c, lpBuffer=0x8250000, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x276bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8250000*, lpNumberOfBytesRead=0x276bf61c*=0xa54, lpOverlapped=0x0) returned 1 [0164.154] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffff5ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.154] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x8250000, cbInput=0xa54, pPaddingInfo=0x0, pbIV=0x276bf848, cbIV=0x10, pbOutput=0x8250000, cbOutput=0x100000, pcbResult=0x276bf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x276bf848, pbOutput=0x8250000, pcbResult=0x276bf618) returned 0x0 [0164.154] WriteFile (in: hFile=0x135c, lpBuffer=0x8250000*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x276bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8250000*, lpNumberOfBytesWritten=0x276bf61c*=0xa60, lpOverlapped=0x0) returned 1 [0164.154] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x276bf60c | out: lpNewFilePointer=0x0) returned 1 [0164.154] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.154] WriteFile (in: hFile=0x135c, lpBuffer=0x276bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x276bf61c, lpOverlapped=0x0 | out: lpBuffer=0x276bf83c*, lpNumberOfBytesWritten=0x276bf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.154] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xa60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.154] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0164.154] CloseHandle (hObject=0x135c) returned 1 [0164.772] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.play")) returned 1 [0164.774] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1891 os_tid = 0x1c70 [0163.697] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.697] ReadFile (in: hFile=0x1364, lpBuffer=0x277ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x277ff85c, lpOverlapped=0x0 | out: lpBuffer=0x277ffb34*, lpNumberOfBytesRead=0x277ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.070] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.070] ReadFile (in: hFile=0x1364, lpBuffer=0x277ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x277ff85c, lpOverlapped=0x0 | out: lpBuffer=0x277ffb34*, lpNumberOfBytesRead=0x277ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.502] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.503] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.504] BCryptSetProperty (in: hObject=0x735540, pszProperty="ChainingMode", pbInput=0x277ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735540) returned 0x0 [0164.504] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735540, phKey=0x277ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735540, phKey=0x277ff828, pbKeyObject=0x0) returned 0x0 [0164.504] BCryptExportKey (in: hKey=0x792b00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x277ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x277ff500) returned 0x0 [0164.504] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.504] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x277ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x277ff500) returned 0x0 [0164.509] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.511] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.511] WriteFile (in: hFile=0x1364, lpBuffer=0x277ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x277ff830, lpOverlapped=0x0 | out: lpBuffer=0x277ffb34*, lpNumberOfBytesWritten=0x277ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.512] ReadFile (in: hFile=0x1364, lpBuffer=0x8350000, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x277ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8350000*, lpNumberOfBytesRead=0x277ff61c*=0x1498, lpOverlapped=0x0) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0xffffeb68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.512] BCryptEncrypt (in: hKey=0x792b00, pbInput=0x8350000, cbInput=0x1498, pPaddingInfo=0x0, pbIV=0x277ff848, cbIV=0x10, pbOutput=0x8350000, cbOutput=0x100000, pcbResult=0x277ff618, dwFlags=0x1 | out: hKey=0x792b00, pbIV=0x277ff848, pbOutput=0x8350000, pcbResult=0x277ff618) returned 0x0 [0164.512] WriteFile (in: hFile=0x1364, lpBuffer=0x8350000*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x277ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8350000*, lpNumberOfBytesWritten=0x277ff61c*=0x14a0, lpOverlapped=0x0) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x277ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.512] WriteFile (in: hFile=0x1364, lpBuffer=0x277ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x277ff61c, lpOverlapped=0x0 | out: lpBuffer=0x277ff83c*, lpNumberOfBytesWritten=0x277ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.512] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x14a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.512] BCryptDestroyKey (in: hKey=0x792b00 | out: hKey=0x792b00) returned 0x0 [0164.512] CloseHandle (hObject=0x1364) returned 1 [0164.612] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd1e0000 [0164.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.play")) returned 1 [0164.692] VirtualFree (lpAddress=0xd1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1892 os_tid = 0x1c74 [0163.698] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.698] ReadFile (in: hFile=0x136c, lpBuffer=0x2793fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2793f85c, lpOverlapped=0x0 | out: lpBuffer=0x2793fb34*, lpNumberOfBytesRead=0x2793f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.062] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.062] ReadFile (in: hFile=0x136c, lpBuffer=0x2793fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2793f85c, lpOverlapped=0x0 | out: lpBuffer=0x2793fb34*, lpNumberOfBytesRead=0x2793f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.062] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.064] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.064] BCryptSetProperty (in: hObject=0x734ba0, pszProperty="ChainingMode", pbInput=0x2793f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734ba0) returned 0x0 [0164.064] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734ba0, phKey=0x2793f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734ba0, phKey=0x2793f828, pbKeyObject=0x0) returned 0x0 [0164.064] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2793f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2793f500) returned 0x0 [0164.064] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.064] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2793f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2793f500) returned 0x0 [0164.068] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.070] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.070] WriteFile (in: hFile=0x136c, lpBuffer=0x2793fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2793f830, lpOverlapped=0x0 | out: lpBuffer=0x2793fb34*, lpNumberOfBytesWritten=0x2793f830*=0x428, lpOverlapped=0x0) returned 1 [0164.149] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.149] ReadFile (in: hFile=0x136c, lpBuffer=0x8450000, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x2793f61c, lpOverlapped=0x0 | out: lpBuffer=0x8450000*, lpNumberOfBytesRead=0x2793f61c*=0xbc8, lpOverlapped=0x0) returned 1 [0164.149] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xfffff438, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.149] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x8450000, cbInput=0xbc8, pPaddingInfo=0x0, pbIV=0x2793f848, cbIV=0x10, pbOutput=0x8450000, cbOutput=0x100000, pcbResult=0x2793f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x2793f848, pbOutput=0x8450000, pcbResult=0x2793f618) returned 0x0 [0164.150] WriteFile (in: hFile=0x136c, lpBuffer=0x8450000*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2793f61c, lpOverlapped=0x0 | out: lpBuffer=0x8450000*, lpNumberOfBytesWritten=0x2793f61c*=0xbd0, lpOverlapped=0x0) returned 1 [0164.150] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2793f60c | out: lpNewFilePointer=0x0) returned 1 [0164.150] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.150] WriteFile (in: hFile=0x136c, lpBuffer=0x2793f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2793f61c, lpOverlapped=0x0 | out: lpBuffer=0x2793f83c*, lpNumberOfBytesWritten=0x2793f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.150] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xbd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.150] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0164.150] CloseHandle (hObject=0x136c) returned 1 [0164.534] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd60000 [0164.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.play")) returned 1 [0164.766] VirtualFree (lpAddress=0xd60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1893 os_tid = 0x1c78 [0163.700] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.700] ReadFile (in: hFile=0x10e0, lpBuffer=0x2313fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2313f85c, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesRead=0x2313f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.055] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.055] ReadFile (in: hFile=0x10e0, lpBuffer=0x2313fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2313f85c, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesRead=0x2313f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.055] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.057] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.057] BCryptSetProperty (in: hObject=0x735a10, pszProperty="ChainingMode", pbInput=0x2313f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735a10) returned 0x0 [0164.057] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735a10, phKey=0x2313f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735a10, phKey=0x2313f828, pbKeyObject=0x0) returned 0x0 [0164.057] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2313f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2313f500) returned 0x0 [0164.057] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.057] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2313f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2313f500) returned 0x0 [0164.060] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.062] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.062] WriteFile (in: hFile=0x10e0, lpBuffer=0x2313fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2313f830, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesWritten=0x2313f830*=0x428, lpOverlapped=0x0) returned 1 [0164.809] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.809] ReadFile (in: hFile=0x10e0, lpBuffer=0x8550000, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x8550000*, lpNumberOfBytesRead=0x2313f61c*=0xec4, lpOverlapped=0x0) returned 1 [0164.809] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffff13c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.809] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x8550000, cbInput=0xec4, pPaddingInfo=0x0, pbIV=0x2313f848, cbIV=0x10, pbOutput=0x8550000, cbOutput=0x100000, pcbResult=0x2313f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x2313f848, pbOutput=0x8550000, pcbResult=0x2313f618) returned 0x0 [0164.810] WriteFile (in: hFile=0x10e0, lpBuffer=0x8550000*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x8550000*, lpNumberOfBytesWritten=0x2313f61c*=0xed0, lpOverlapped=0x0) returned 1 [0164.810] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2313f60c | out: lpNewFilePointer=0x0) returned 1 [0164.810] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.810] WriteFile (in: hFile=0x10e0, lpBuffer=0x2313f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x2313f83c*, lpNumberOfBytesWritten=0x2313f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.810] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.810] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0164.810] CloseHandle (hObject=0x10e0) returned 1 [0164.810] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.play")) returned 1 [0164.838] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1894 os_tid = 0x1c7c [0163.701] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.701] ReadFile (in: hFile=0x1378, lpBuffer=0x27a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x27a7fb34*, lpNumberOfBytesRead=0x27a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.048] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.048] ReadFile (in: hFile=0x1378, lpBuffer=0x27a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x27a7fb34*, lpNumberOfBytesRead=0x27a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.048] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.049] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.049] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x27a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0164.049] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x27a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x27a7f828, pbKeyObject=0x0) returned 0x0 [0164.049] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x27a7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x27a7f500) returned 0x0 [0164.050] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.050] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x27a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x27a7f500) returned 0x0 [0164.053] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.055] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.055] WriteFile (in: hFile=0x1378, lpBuffer=0x27a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27a7f830, lpOverlapped=0x0 | out: lpBuffer=0x27a7fb34*, lpNumberOfBytesWritten=0x27a7f830*=0x428, lpOverlapped=0x0) returned 1 [0164.813] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.813] ReadFile (in: hFile=0x1378, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x27a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x27a7f61c*=0x1044, lpOverlapped=0x0) returned 1 [0164.813] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0xffffefbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.813] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4c50000, cbInput=0x1044, pPaddingInfo=0x0, pbIV=0x27a7f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x27a7f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x27a7f848, pbOutput=0x4c50000, pcbResult=0x27a7f618) returned 0x0 [0164.813] WriteFile (in: hFile=0x1378, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x27a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x27a7f61c*=0x1050, lpOverlapped=0x0) returned 1 [0164.813] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27a7f60c | out: lpNewFilePointer=0x0) returned 1 [0164.814] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.814] WriteFile (in: hFile=0x1378, lpBuffer=0x27a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x27a7f83c*, lpNumberOfBytesWritten=0x27a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.814] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0x1050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.814] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0164.814] CloseHandle (hObject=0x1378) returned 1 [0164.816] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0164.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.play")) returned 1 [0164.834] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1895 os_tid = 0x1c80 [0163.703] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.706] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.706] BCryptSetProperty (in: hObject=0x735960, pszProperty="ChainingMode", pbInput=0x27bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735960) returned 0x0 [0163.706] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735960, phKey=0x27bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735960, phKey=0x27bbf828, pbKeyObject=0x0) returned 0x0 [0163.706] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x27bbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x27bbf500) returned 0x0 [0163.706] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.707] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x27bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x27bbf500) returned 0x0 [0163.714] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.718] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.718] WriteFile (in: hFile=0x1380, lpBuffer=0x27bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27bbf830, lpOverlapped=0x0 | out: lpBuffer=0x27bbfb34*, lpNumberOfBytesWritten=0x27bbf830*=0x428, lpOverlapped=0x0) returned 1 [0164.380] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.380] ReadFile (in: hFile=0x1380, lpBuffer=0x8650000, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x27bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x8650000*, lpNumberOfBytesRead=0x27bbf61c*=0x32c, lpOverlapped=0x0) returned 1 [0164.380] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffffcd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.380] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x8650000, cbInput=0x32c, pPaddingInfo=0x0, pbIV=0x27bbf848, cbIV=0x10, pbOutput=0x8650000, cbOutput=0x100000, pcbResult=0x27bbf618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x27bbf848, pbOutput=0x8650000, pcbResult=0x27bbf618) returned 0x0 [0164.380] WriteFile (in: hFile=0x1380, lpBuffer=0x8650000*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x27bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x8650000*, lpNumberOfBytesWritten=0x27bbf61c*=0x330, lpOverlapped=0x0) returned 1 [0164.380] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27bbf60c | out: lpNewFilePointer=0x0) returned 1 [0164.380] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.380] WriteFile (in: hFile=0x1380, lpBuffer=0x27bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x27bbf83c*, lpNumberOfBytesWritten=0x27bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.380] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.380] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0164.380] CloseHandle (hObject=0x1380) returned 1 [0164.600] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe40000 [0164.601] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.play")) returned 1 [0164.720] VirtualFree (lpAddress=0xe40000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1896 os_tid = 0x1c84 [0163.720] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.720] ReadFile (in: hFile=0x1388, lpBuffer=0x27cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27cff85c, lpOverlapped=0x0 | out: lpBuffer=0x27cffb34*, lpNumberOfBytesRead=0x27cff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.368] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.368] ReadFile (in: hFile=0x1388, lpBuffer=0x27cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27cff85c, lpOverlapped=0x0 | out: lpBuffer=0x27cffb34*, lpNumberOfBytesRead=0x27cff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.368] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.370] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.370] BCryptSetProperty (in: hObject=0x735330, pszProperty="ChainingMode", pbInput=0x27cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735330) returned 0x0 [0164.370] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735330, phKey=0x27cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735330, phKey=0x27cff828, pbKeyObject=0x0) returned 0x0 [0164.370] BCryptExportKey (in: hKey=0x795890, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x27cff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x27cff500) returned 0x0 [0164.370] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.370] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x27cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x27cff500) returned 0x0 [0164.375] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.377] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.377] WriteFile (in: hFile=0x1388, lpBuffer=0x27cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27cff830, lpOverlapped=0x0 | out: lpBuffer=0x27cffb34*, lpNumberOfBytesWritten=0x27cff830*=0x428, lpOverlapped=0x0) returned 1 [0164.378] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.378] ReadFile (in: hFile=0x1388, lpBuffer=0x8750000, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x27cff61c, lpOverlapped=0x0 | out: lpBuffer=0x8750000*, lpNumberOfBytesRead=0x27cff61c*=0x332e, lpOverlapped=0x0) returned 1 [0164.569] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0xffffccd2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.569] BCryptEncrypt (in: hKey=0x795890, pbInput=0x8750000, cbInput=0x332e, pPaddingInfo=0x0, pbIV=0x27cff848, cbIV=0x10, pbOutput=0x8750000, cbOutput=0x100000, pcbResult=0x27cff618, dwFlags=0x1 | out: hKey=0x795890, pbIV=0x27cff848, pbOutput=0x8750000, pcbResult=0x27cff618) returned 0x0 [0164.569] WriteFile (in: hFile=0x1388, lpBuffer=0x8750000*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x27cff61c, lpOverlapped=0x0 | out: lpBuffer=0x8750000*, lpNumberOfBytesWritten=0x27cff61c*=0x3330, lpOverlapped=0x0) returned 1 [0164.569] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27cff60c | out: lpNewFilePointer=0x0) returned 1 [0164.569] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.570] WriteFile (in: hFile=0x1388, lpBuffer=0x27cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27cff61c, lpOverlapped=0x0 | out: lpBuffer=0x27cff83c*, lpNumberOfBytesWritten=0x27cff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.570] SetFilePointerEx (in: hFile=0x1388, liDistanceToMove=0x3330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.570] BCryptDestroyKey (in: hKey=0x795890 | out: hKey=0x795890) returned 0x0 [0164.570] CloseHandle (hObject=0x1388) returned 1 [0164.628] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd260000 [0164.629] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.play")) returned 1 [0164.669] VirtualFree (lpAddress=0xd260000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1897 os_tid = 0x1c88 [0163.722] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.722] ReadFile (in: hFile=0x1390, lpBuffer=0x27e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x27e3fb34*, lpNumberOfBytesRead=0x27e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.724] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.725] ReadFile (in: hFile=0x1390, lpBuffer=0x27e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x27e3fb34*, lpNumberOfBytesRead=0x27e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0163.725] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.728] BCryptSetProperty (in: hObject=0x734570, pszProperty="ChainingMode", pbInput=0x27e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734570) returned 0x0 [0163.728] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734570, phKey=0x27e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734570, phKey=0x27e3f828, pbKeyObject=0x0) returned 0x0 [0163.728] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x27e3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x27e3f500) returned 0x0 [0163.728] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.728] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x27e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x27e3f500) returned 0x0 [0163.735] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.738] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.739] WriteFile (in: hFile=0x1390, lpBuffer=0x27e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27e3f830, lpOverlapped=0x0 | out: lpBuffer=0x27e3fb34*, lpNumberOfBytesWritten=0x27e3f830*=0x428, lpOverlapped=0x0) returned 1 [0163.742] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.742] ReadFile (in: hFile=0x1390, lpBuffer=0x8850000, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x27e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x8850000*, lpNumberOfBytesRead=0x27e3f61c*=0x69aa, lpOverlapped=0x0) returned 1 [0164.047] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xffff9656, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.047] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x8850000, cbInput=0x69aa, pPaddingInfo=0x0, pbIV=0x27e3f848, cbIV=0x10, pbOutput=0x8850000, cbOutput=0x100000, pcbResult=0x27e3f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x27e3f848, pbOutput=0x8850000, pcbResult=0x27e3f618) returned 0x0 [0164.047] WriteFile (in: hFile=0x1390, lpBuffer=0x8850000*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x27e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x8850000*, lpNumberOfBytesWritten=0x27e3f61c*=0x69b0, lpOverlapped=0x0) returned 1 [0164.814] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27e3f60c | out: lpNewFilePointer=0x0) returned 1 [0164.814] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.814] WriteFile (in: hFile=0x1390, lpBuffer=0x27e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x27e3f83c*, lpNumberOfBytesWritten=0x27e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.814] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x69b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.814] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0164.814] CloseHandle (hObject=0x1390) returned 1 [0164.818] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0164.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.play")) returned 1 [0164.820] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1898 os_tid = 0x1c8c [0163.767] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.767] ReadFile (in: hFile=0x1398, lpBuffer=0x27f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x27f7fb34*, lpNumberOfBytesRead=0x27f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.357] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.358] ReadFile (in: hFile=0x1398, lpBuffer=0x27f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x27f7fb34*, lpNumberOfBytesRead=0x27f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.358] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.359] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.359] BCryptSetProperty (in: hObject=0x734fc0, pszProperty="ChainingMode", pbInput=0x27f7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734fc0) returned 0x0 [0164.359] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734fc0, phKey=0x27f7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734fc0, phKey=0x27f7f828, pbKeyObject=0x0) returned 0x0 [0164.359] BCryptExportKey (in: hKey=0x795380, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x27f7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x27f7f500) returned 0x0 [0164.359] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.360] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x27f7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x27f7f500) returned 0x0 [0164.364] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.366] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.367] WriteFile (in: hFile=0x1398, lpBuffer=0x27f7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27f7f830, lpOverlapped=0x0 | out: lpBuffer=0x27f7fb34*, lpNumberOfBytesWritten=0x27f7f830*=0x428, lpOverlapped=0x0) returned 1 [0164.367] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.367] ReadFile (in: hFile=0x1398, lpBuffer=0x8950000, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x27f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x27f7f61c*=0x1b54, lpOverlapped=0x0) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xffffe4ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.568] BCryptEncrypt (in: hKey=0x795380, pbInput=0x8950000, cbInput=0x1b54, pPaddingInfo=0x0, pbIV=0x27f7f848, cbIV=0x10, pbOutput=0x8950000, cbOutput=0x100000, pcbResult=0x27f7f618, dwFlags=0x1 | out: hKey=0x795380, pbIV=0x27f7f848, pbOutput=0x8950000, pcbResult=0x27f7f618) returned 0x0 [0164.568] WriteFile (in: hFile=0x1398, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x27f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x27f7f61c*=0x1b60, lpOverlapped=0x0) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27f7f60c | out: lpNewFilePointer=0x0) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.569] WriteFile (in: hFile=0x1398, lpBuffer=0x27f7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x27f7f83c*, lpNumberOfBytesWritten=0x27f7f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.569] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x1b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.569] BCryptDestroyKey (in: hKey=0x795380 | out: hKey=0x795380) returned 0x0 [0164.569] CloseHandle (hObject=0x1398) returned 1 [0164.626] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd250000 [0164.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.play")) returned 1 [0164.672] VirtualFree (lpAddress=0xd250000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1899 os_tid = 0x1c90 [0163.769] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.770] ReadFile (in: hFile=0x1120, lpBuffer=0x233bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x233bf85c, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesRead=0x233bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.772] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.772] ReadFile (in: hFile=0x1120, lpBuffer=0x233bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x233bf85c, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesRead=0x233bf85c*=0x428, lpOverlapped=0x0) returned 1 [0163.773] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.776] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.776] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x233bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0163.776] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x233bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x233bf828, pbKeyObject=0x0) returned 0x0 [0163.776] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x233bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x233bf500) returned 0x0 [0163.776] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.776] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x233bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x233bf500) returned 0x0 [0163.789] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.793] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.793] WriteFile (in: hFile=0x1120, lpBuffer=0x233bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x233bf830, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesWritten=0x233bf830*=0x428, lpOverlapped=0x0) returned 1 [0163.794] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.794] ReadFile (in: hFile=0x1120, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x233bf61c*=0x2576, lpOverlapped=0x0) returned 1 [0163.832] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xffffda8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.833] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x4e50000, cbInput=0x2576, pPaddingInfo=0x0, pbIV=0x233bf848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x233bf618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x233bf848, pbOutput=0x4e50000, pcbResult=0x233bf618) returned 0x0 [0163.833] WriteFile (in: hFile=0x1120, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x233bf61c*=0x2580, lpOverlapped=0x0) returned 1 [0163.833] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x233bf60c | out: lpNewFilePointer=0x0) returned 1 [0163.833] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.833] WriteFile (in: hFile=0x1120, lpBuffer=0x233bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x233bf83c*, lpNumberOfBytesWritten=0x233bf61c*=0x8, lpOverlapped=0x0) returned 1 [0163.833] SetFilePointerEx (in: hFile=0x1120, liDistanceToMove=0x2580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.833] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0163.833] CloseHandle (hObject=0x1120) returned 1 [0163.833] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0163.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.play")) returned 1 [0163.836] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1900 os_tid = 0x1c94 [0163.839] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.839] ReadFile (in: hFile=0x10f8, lpBuffer=0x234ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x234ff85c, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesRead=0x234ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.426] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.426] ReadFile (in: hFile=0x10f8, lpBuffer=0x234ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x234ff85c, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesRead=0x234ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.426] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.428] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x234ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0164.428] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x234ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x234ff828, pbKeyObject=0x0) returned 0x0 [0164.428] BCryptExportKey (in: hKey=0x792370, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x234ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x234ff500) returned 0x0 [0164.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.429] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x234ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x234ff500) returned 0x0 [0164.434] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.436] WriteFile (in: hFile=0x10f8, lpBuffer=0x234ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x234ff830, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesWritten=0x234ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.436] ReadFile (in: hFile=0x10f8, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x234ff61c*=0x6ba0, lpOverlapped=0x0) returned 1 [0164.573] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xffff9460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.573] BCryptEncrypt (in: hKey=0x792370, pbInput=0x4f50000, cbInput=0x6ba0, pPaddingInfo=0x0, pbIV=0x234ff848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x234ff618, dwFlags=0x1 | out: hKey=0x792370, pbIV=0x234ff848, pbOutput=0x4f50000, pcbResult=0x234ff618) returned 0x0 [0164.573] WriteFile (in: hFile=0x10f8, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x234ff61c*=0x6bb0, lpOverlapped=0x0) returned 1 [0164.573] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.573] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.573] WriteFile (in: hFile=0x10f8, lpBuffer=0x234ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x234ff83c*, lpNumberOfBytesWritten=0x234ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.573] SetFilePointerEx (in: hFile=0x10f8, liDistanceToMove=0x6bb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.574] BCryptDestroyKey (in: hKey=0x792370 | out: hKey=0x792370) returned 0x0 [0164.574] CloseHandle (hObject=0x10f8) returned 1 [0164.635] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd2a0000 [0164.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.play")) returned 1 [0164.639] VirtualFree (lpAddress=0xd2a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1901 os_tid = 0x1c98 [0163.840] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.840] ReadFile (in: hFile=0x1130, lpBuffer=0x239ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x239ff85c, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesRead=0x239ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.403] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.404] ReadFile (in: hFile=0x1130, lpBuffer=0x239ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x239ff85c, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesRead=0x239ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.404] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.405] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.405] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x239ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0164.405] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x239ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x239ff828, pbKeyObject=0x0) returned 0x0 [0164.405] BCryptExportKey (in: hKey=0x795da0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x239ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x239ff500) returned 0x0 [0164.406] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.406] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x239ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x239ff500) returned 0x0 [0164.410] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.413] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.413] WriteFile (in: hFile=0x1130, lpBuffer=0x239ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x239ff830, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesWritten=0x239ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.414] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.414] ReadFile (in: hFile=0x1130, lpBuffer=0x5350000, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x239ff61c*=0x2cec, lpOverlapped=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0xffffd314, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.571] BCryptEncrypt (in: hKey=0x795da0, pbInput=0x5350000, cbInput=0x2cec, pPaddingInfo=0x0, pbIV=0x239ff848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x239ff618, dwFlags=0x1 | out: hKey=0x795da0, pbIV=0x239ff848, pbOutput=0x5350000, pcbResult=0x239ff618) returned 0x0 [0164.571] WriteFile (in: hFile=0x1130, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x239ff61c*=0x2cf0, lpOverlapped=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.572] WriteFile (in: hFile=0x1130, lpBuffer=0x239ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x239ff83c*, lpNumberOfBytesWritten=0x239ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.572] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x2cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.572] BCryptDestroyKey (in: hKey=0x795da0 | out: hKey=0x795da0) returned 0x0 [0164.572] CloseHandle (hObject=0x1130) returned 1 [0164.631] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd280000 [0164.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.play")) returned 1 [0164.663] VirtualFree (lpAddress=0xd280000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1902 os_tid = 0x1c9c [0163.841] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.841] ReadFile (in: hFile=0x13a4, lpBuffer=0x23b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesRead=0x23b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.392] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.392] ReadFile (in: hFile=0x13a4, lpBuffer=0x23b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesRead=0x23b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.392] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.394] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.394] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x23b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0164.394] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x23b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x23b3f828, pbKeyObject=0x0) returned 0x0 [0164.394] BCryptExportKey (in: hKey=0x795da0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x23b3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x23b3f500) returned 0x0 [0164.394] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.394] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x23b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x23b3f500) returned 0x0 [0164.399] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.402] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.402] WriteFile (in: hFile=0x13a4, lpBuffer=0x23b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23b3f830, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesWritten=0x23b3f830*=0x428, lpOverlapped=0x0) returned 1 [0164.402] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.402] ReadFile (in: hFile=0x13a4, lpBuffer=0x5450000, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x23b3f61c*=0x1138, lpOverlapped=0x0) returned 1 [0164.403] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0xffffeec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.403] BCryptEncrypt (in: hKey=0x795da0, pbInput=0x5450000, cbInput=0x1138, pPaddingInfo=0x0, pbIV=0x23b3f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x23b3f618, dwFlags=0x1 | out: hKey=0x795da0, pbIV=0x23b3f848, pbOutput=0x5450000, pcbResult=0x23b3f618) returned 0x0 [0164.403] WriteFile (in: hFile=0x13a4, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x23b3f61c*=0x1140, lpOverlapped=0x0) returned 1 [0164.403] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23b3f60c | out: lpNewFilePointer=0x0) returned 1 [0164.403] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.403] WriteFile (in: hFile=0x13a4, lpBuffer=0x23b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x23b3f83c*, lpNumberOfBytesWritten=0x23b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.403] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x1140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.403] BCryptDestroyKey (in: hKey=0x795da0 | out: hKey=0x795da0) returned 0x0 [0164.403] CloseHandle (hObject=0x13a4) returned 1 [0164.602] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe50000 [0164.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.play")) returned 1 [0164.718] VirtualFree (lpAddress=0xe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1903 os_tid = 0x1ca0 [0163.843] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.843] ReadFile (in: hFile=0x13ac, lpBuffer=0x23effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23eff85c, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesRead=0x23eff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.460] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.460] ReadFile (in: hFile=0x13ac, lpBuffer=0x23effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23eff85c, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesRead=0x23eff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.460] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.462] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x23eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0164.462] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x23eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x23eff828, pbKeyObject=0x0) returned 0x0 [0164.462] BCryptExportKey (in: hKey=0x7925f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x23eff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x23eff500) returned 0x0 [0164.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.462] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x23eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x23eff500) returned 0x0 [0164.467] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.469] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.469] WriteFile (in: hFile=0x13ac, lpBuffer=0x23effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23eff830, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesWritten=0x23eff830*=0x428, lpOverlapped=0x0) returned 1 [0164.470] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.470] ReadFile (in: hFile=0x13ac, lpBuffer=0x5750000, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x23eff61c*=0x1870, lpOverlapped=0x0) returned 1 [0164.653] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0xffffe790, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.654] BCryptEncrypt (in: hKey=0x7925f0, pbInput=0x5750000, cbInput=0x1870, pPaddingInfo=0x0, pbIV=0x23eff848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x23eff618, dwFlags=0x1 | out: hKey=0x7925f0, pbIV=0x23eff848, pbOutput=0x5750000, pcbResult=0x23eff618) returned 0x0 [0164.654] WriteFile (in: hFile=0x13ac, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x23eff61c*=0x1880, lpOverlapped=0x0) returned 1 [0164.654] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23eff60c | out: lpNewFilePointer=0x0) returned 1 [0164.654] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.654] WriteFile (in: hFile=0x13ac, lpBuffer=0x23eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x23eff83c*, lpNumberOfBytesWritten=0x23eff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.654] SetFilePointerEx (in: hFile=0x13ac, liDistanceToMove=0x1880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.654] BCryptDestroyKey (in: hKey=0x7925f0 | out: hKey=0x7925f0) returned 0x0 [0164.654] CloseHandle (hObject=0x13ac) returned 1 [0164.655] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd200000 [0164.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.play")) returned 1 [0164.657] VirtualFree (lpAddress=0xd200000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1904 os_tid = 0x1ca4 [0163.844] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.844] ReadFile (in: hFile=0x13b4, lpBuffer=0x280bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x280bf85c, lpOverlapped=0x0 | out: lpBuffer=0x280bfb34*, lpNumberOfBytesRead=0x280bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.381] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.381] ReadFile (in: hFile=0x13b4, lpBuffer=0x280bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x280bf85c, lpOverlapped=0x0 | out: lpBuffer=0x280bfb34*, lpNumberOfBytesRead=0x280bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.381] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.383] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.383] BCryptSetProperty (in: hObject=0x734620, pszProperty="ChainingMode", pbInput=0x280bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734620) returned 0x0 [0164.383] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734620, phKey=0x280bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734620, phKey=0x280bf828, pbKeyObject=0x0) returned 0x0 [0164.383] BCryptExportKey (in: hKey=0x795b20, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x280bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x280bf500) returned 0x0 [0164.383] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.383] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x280bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x280bf500) returned 0x0 [0164.388] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.390] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.390] WriteFile (in: hFile=0x13b4, lpBuffer=0x280bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x280bf830, lpOverlapped=0x0 | out: lpBuffer=0x280bfb34*, lpNumberOfBytesWritten=0x280bf830*=0x428, lpOverlapped=0x0) returned 1 [0164.391] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.391] ReadFile (in: hFile=0x13b4, lpBuffer=0x8a50000, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x280bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8a50000*, lpNumberOfBytesRead=0x280bf61c*=0x4c14, lpOverlapped=0x0) returned 1 [0164.570] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xffffb3ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.570] BCryptEncrypt (in: hKey=0x795b20, pbInput=0x8a50000, cbInput=0x4c14, pPaddingInfo=0x0, pbIV=0x280bf848, cbIV=0x10, pbOutput=0x8a50000, cbOutput=0x100000, pcbResult=0x280bf618, dwFlags=0x1 | out: hKey=0x795b20, pbIV=0x280bf848, pbOutput=0x8a50000, pcbResult=0x280bf618) returned 0x0 [0164.570] WriteFile (in: hFile=0x13b4, lpBuffer=0x8a50000*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x280bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8a50000*, lpNumberOfBytesWritten=0x280bf61c*=0x4c20, lpOverlapped=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280bf60c | out: lpNewFilePointer=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.571] WriteFile (in: hFile=0x13b4, lpBuffer=0x280bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x280bf61c, lpOverlapped=0x0 | out: lpBuffer=0x280bf83c*, lpNumberOfBytesWritten=0x280bf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x4c20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.571] BCryptDestroyKey (in: hKey=0x795b20 | out: hKey=0x795b20) returned 0x0 [0164.571] CloseHandle (hObject=0x13b4) returned 1 [0164.630] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd270000 [0164.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.play")) returned 1 [0164.666] VirtualFree (lpAddress=0xd270000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1905 os_tid = 0x1ca8 [0163.845] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.845] ReadFile (in: hFile=0x13bc, lpBuffer=0x281ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x281ff85c, lpOverlapped=0x0 | out: lpBuffer=0x281ffb34*, lpNumberOfBytesRead=0x281ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.449] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.449] ReadFile (in: hFile=0x13bc, lpBuffer=0x281ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x281ff85c, lpOverlapped=0x0 | out: lpBuffer=0x281ffb34*, lpNumberOfBytesRead=0x281ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.449] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.451] BCryptSetProperty (in: hObject=0x7353e0, pszProperty="ChainingMode", pbInput=0x281ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7353e0) returned 0x0 [0164.451] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7353e0, phKey=0x281ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7353e0, phKey=0x281ff828, pbKeyObject=0x0) returned 0x0 [0164.451] BCryptExportKey (in: hKey=0x7925f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x281ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x281ff500) returned 0x0 [0164.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.451] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x281ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x281ff500) returned 0x0 [0164.456] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.458] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.458] WriteFile (in: hFile=0x13bc, lpBuffer=0x281ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x281ff830, lpOverlapped=0x0 | out: lpBuffer=0x281ffb34*, lpNumberOfBytesWritten=0x281ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.459] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.459] ReadFile (in: hFile=0x13bc, lpBuffer=0x8b50000, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x281ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8b50000*, lpNumberOfBytesRead=0x281ff61c*=0xeb8, lpOverlapped=0x0) returned 1 [0164.459] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffff148, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.459] BCryptEncrypt (in: hKey=0x7925f0, pbInput=0x8b50000, cbInput=0xeb8, pPaddingInfo=0x0, pbIV=0x281ff848, cbIV=0x10, pbOutput=0x8b50000, cbOutput=0x100000, pcbResult=0x281ff618, dwFlags=0x1 | out: hKey=0x7925f0, pbIV=0x281ff848, pbOutput=0x8b50000, pcbResult=0x281ff618) returned 0x0 [0164.459] WriteFile (in: hFile=0x13bc, lpBuffer=0x8b50000*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x281ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8b50000*, lpNumberOfBytesWritten=0x281ff61c*=0xec0, lpOverlapped=0x0) returned 1 [0164.459] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x281ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.459] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.459] WriteFile (in: hFile=0x13bc, lpBuffer=0x281ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x281ff61c, lpOverlapped=0x0 | out: lpBuffer=0x281ff83c*, lpNumberOfBytesWritten=0x281ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.459] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.459] BCryptDestroyKey (in: hKey=0x7925f0 | out: hKey=0x7925f0) returned 0x0 [0164.459] CloseHandle (hObject=0x13bc) returned 1 [0164.607] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe80000 [0164.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.play")) returned 1 [0164.703] VirtualFree (lpAddress=0xe80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1906 os_tid = 0x1cac [0163.846] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.847] ReadFile (in: hFile=0x13c4, lpBuffer=0x2833fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2833f85c, lpOverlapped=0x0 | out: lpBuffer=0x2833fb34*, lpNumberOfBytesRead=0x2833f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.437] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.437] ReadFile (in: hFile=0x13c4, lpBuffer=0x2833fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2833f85c, lpOverlapped=0x0 | out: lpBuffer=0x2833fb34*, lpNumberOfBytesRead=0x2833f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.437] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.439] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.439] BCryptSetProperty (in: hObject=0x734db0, pszProperty="ChainingMode", pbInput=0x2833f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734db0) returned 0x0 [0164.439] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734db0, phKey=0x2833f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734db0, phKey=0x2833f828, pbKeyObject=0x0) returned 0x0 [0164.439] BCryptExportKey (in: hKey=0x7925f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2833f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2833f500) returned 0x0 [0164.439] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.440] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2833f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2833f500) returned 0x0 [0164.444] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.447] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.447] WriteFile (in: hFile=0x13c4, lpBuffer=0x2833fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2833f830, lpOverlapped=0x0 | out: lpBuffer=0x2833fb34*, lpNumberOfBytesWritten=0x2833f830*=0x428, lpOverlapped=0x0) returned 1 [0164.448] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.448] ReadFile (in: hFile=0x13c4, lpBuffer=0x8c50000, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x2833f61c, lpOverlapped=0x0 | out: lpBuffer=0x8c50000*, lpNumberOfBytesRead=0x2833f61c*=0xd16, lpOverlapped=0x0) returned 1 [0164.448] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0xfffff2ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.448] BCryptEncrypt (in: hKey=0x7925f0, pbInput=0x8c50000, cbInput=0xd16, pPaddingInfo=0x0, pbIV=0x2833f848, cbIV=0x10, pbOutput=0x8c50000, cbOutput=0x100000, pcbResult=0x2833f618, dwFlags=0x1 | out: hKey=0x7925f0, pbIV=0x2833f848, pbOutput=0x8c50000, pcbResult=0x2833f618) returned 0x0 [0164.448] WriteFile (in: hFile=0x13c4, lpBuffer=0x8c50000*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2833f61c, lpOverlapped=0x0 | out: lpBuffer=0x8c50000*, lpNumberOfBytesWritten=0x2833f61c*=0xd20, lpOverlapped=0x0) returned 1 [0164.448] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2833f60c | out: lpNewFilePointer=0x0) returned 1 [0164.448] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.448] WriteFile (in: hFile=0x13c4, lpBuffer=0x2833f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2833f61c, lpOverlapped=0x0 | out: lpBuffer=0x2833f83c*, lpNumberOfBytesWritten=0x2833f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.448] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0xd20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.448] BCryptDestroyKey (in: hKey=0x7925f0 | out: hKey=0x7925f0) returned 0x0 [0164.448] CloseHandle (hObject=0x13c4) returned 1 [0164.605] VirtualAlloc (lpAddress=0x0, dwSize=0x97, flAllocationType=0x1000, flProtect=0x4) returned 0xe70000 [0164.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\boat.wmf.play")) returned 1 [0164.707] VirtualFree (lpAddress=0xe70000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1907 os_tid = 0x1cb0 [0163.848] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.848] ReadFile (in: hFile=0x13cc, lpBuffer=0x2847fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2847f85c, lpOverlapped=0x0 | out: lpBuffer=0x2847fb34*, lpNumberOfBytesRead=0x2847f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.491] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.492] ReadFile (in: hFile=0x13cc, lpBuffer=0x2847fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2847f85c, lpOverlapped=0x0 | out: lpBuffer=0x2847fb34*, lpNumberOfBytesRead=0x2847f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.492] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.493] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.493] BCryptSetProperty (in: hObject=0x735750, pszProperty="ChainingMode", pbInput=0x2847f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735750) returned 0x0 [0164.494] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735750, phKey=0x2847f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735750, phKey=0x2847f828, pbKeyObject=0x0) returned 0x0 [0164.494] BCryptExportKey (in: hKey=0x792880, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2847f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2847f500) returned 0x0 [0164.494] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.494] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2847f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2847f500) returned 0x0 [0164.498] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.500] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.500] WriteFile (in: hFile=0x13cc, lpBuffer=0x2847fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2847f830, lpOverlapped=0x0 | out: lpBuffer=0x2847fb34*, lpNumberOfBytesWritten=0x2847f830*=0x428, lpOverlapped=0x0) returned 1 [0164.501] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.501] ReadFile (in: hFile=0x13cc, lpBuffer=0x8d50000, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x2847f61c, lpOverlapped=0x0 | out: lpBuffer=0x8d50000*, lpNumberOfBytesRead=0x2847f61c*=0x714c, lpOverlapped=0x0) returned 1 [0164.574] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xffff8eb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.574] BCryptEncrypt (in: hKey=0x792880, pbInput=0x8d50000, cbInput=0x714c, pPaddingInfo=0x0, pbIV=0x2847f848, cbIV=0x10, pbOutput=0x8d50000, cbOutput=0x100000, pcbResult=0x2847f618, dwFlags=0x1 | out: hKey=0x792880, pbIV=0x2847f848, pbOutput=0x8d50000, pcbResult=0x2847f618) returned 0x0 [0164.574] WriteFile (in: hFile=0x13cc, lpBuffer=0x8d50000*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2847f61c, lpOverlapped=0x0 | out: lpBuffer=0x8d50000*, lpNumberOfBytesWritten=0x2847f61c*=0x7150, lpOverlapped=0x0) returned 1 [0164.574] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2847f60c | out: lpNewFilePointer=0x0) returned 1 [0164.574] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.574] WriteFile (in: hFile=0x13cc, lpBuffer=0x2847f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2847f61c, lpOverlapped=0x0 | out: lpBuffer=0x2847f83c*, lpNumberOfBytesWritten=0x2847f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.574] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x7150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.574] BCryptDestroyKey (in: hKey=0x792880 | out: hKey=0x792880) returned 0x0 [0164.575] CloseHandle (hObject=0x13cc) returned 1 [0164.750] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xda0000 [0164.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.play")) returned 1 [0164.760] VirtualFree (lpAddress=0xda0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1908 os_tid = 0x1cb4 [0163.849] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.849] ReadFile (in: hFile=0x13d4, lpBuffer=0x285bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x285bf85c, lpOverlapped=0x0 | out: lpBuffer=0x285bfb34*, lpNumberOfBytesRead=0x285bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.481] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.483] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.483] BCryptSetProperty (in: hObject=0x734c50, pszProperty="ChainingMode", pbInput=0x285bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734c50) returned 0x0 [0164.483] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734c50, phKey=0x285bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734c50, phKey=0x285bf828, pbKeyObject=0x0) returned 0x0 [0164.483] BCryptExportKey (in: hKey=0x792880, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x285bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x285bf500) returned 0x0 [0164.483] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.483] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x285bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x285bf500) returned 0x0 [0164.488] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.490] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.490] WriteFile (in: hFile=0x13d4, lpBuffer=0x285bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x285bf830, lpOverlapped=0x0 | out: lpBuffer=0x285bfb34*, lpNumberOfBytesWritten=0x285bf830*=0x428, lpOverlapped=0x0) returned 1 [0164.490] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.490] ReadFile (in: hFile=0x13d4, lpBuffer=0x8e50000, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x285bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8e50000*, lpNumberOfBytesRead=0x285bf61c*=0x532, lpOverlapped=0x0) returned 1 [0164.490] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xffffface, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.490] BCryptEncrypt (in: hKey=0x792880, pbInput=0x8e50000, cbInput=0x532, pPaddingInfo=0x0, pbIV=0x285bf848, cbIV=0x10, pbOutput=0x8e50000, cbOutput=0x100000, pcbResult=0x285bf618, dwFlags=0x1 | out: hKey=0x792880, pbIV=0x285bf848, pbOutput=0x8e50000, pcbResult=0x285bf618) returned 0x0 [0164.490] WriteFile (in: hFile=0x13d4, lpBuffer=0x8e50000*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x285bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8e50000*, lpNumberOfBytesWritten=0x285bf61c*=0x540, lpOverlapped=0x0) returned 1 [0164.491] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x285bf60c | out: lpNewFilePointer=0x0) returned 1 [0164.491] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.491] WriteFile (in: hFile=0x13d4, lpBuffer=0x285bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x285bf61c, lpOverlapped=0x0 | out: lpBuffer=0x285bf83c*, lpNumberOfBytesWritten=0x285bf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.491] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.491] BCryptDestroyKey (in: hKey=0x792880 | out: hKey=0x792880) returned 0x0 [0164.491] CloseHandle (hObject=0x13d4) returned 1 [0164.610] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd1d0000 [0164.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.play")) returned 1 [0164.696] VirtualFree (lpAddress=0xd1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1909 os_tid = 0x1cb8 [0163.851] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.851] ReadFile (in: hFile=0x13dc, lpBuffer=0x286ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x286ff85c, lpOverlapped=0x0 | out: lpBuffer=0x286ffb34*, lpNumberOfBytesRead=0x286ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.470] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.472] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.472] BCryptSetProperty (in: hObject=0x735120, pszProperty="ChainingMode", pbInput=0x286ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735120) returned 0x0 [0164.472] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735120, phKey=0x286ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735120, phKey=0x286ff828, pbKeyObject=0x0) returned 0x0 [0164.472] BCryptExportKey (in: hKey=0x792880, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x286ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x286ff500) returned 0x0 [0164.472] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.472] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x286ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x286ff500) returned 0x0 [0164.477] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.479] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.479] WriteFile (in: hFile=0x13dc, lpBuffer=0x286ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x286ff830, lpOverlapped=0x0 | out: lpBuffer=0x286ffb34*, lpNumberOfBytesWritten=0x286ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.480] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.480] ReadFile (in: hFile=0x13dc, lpBuffer=0x8f50000, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x286ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8f50000*, lpNumberOfBytesRead=0x286ff61c*=0x5a4, lpOverlapped=0x0) returned 1 [0164.480] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0xfffffa5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.480] BCryptEncrypt (in: hKey=0x792880, pbInput=0x8f50000, cbInput=0x5a4, pPaddingInfo=0x0, pbIV=0x286ff848, cbIV=0x10, pbOutput=0x8f50000, cbOutput=0x100000, pcbResult=0x286ff618, dwFlags=0x1 | out: hKey=0x792880, pbIV=0x286ff848, pbOutput=0x8f50000, pcbResult=0x286ff618) returned 0x0 [0164.480] WriteFile (in: hFile=0x13dc, lpBuffer=0x8f50000*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x286ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8f50000*, lpNumberOfBytesWritten=0x286ff61c*=0x5b0, lpOverlapped=0x0) returned 1 [0164.480] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x286ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.480] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.480] WriteFile (in: hFile=0x13dc, lpBuffer=0x286ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x286ff61c, lpOverlapped=0x0 | out: lpBuffer=0x286ff83c*, lpNumberOfBytesWritten=0x286ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.481] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.481] BCryptDestroyKey (in: hKey=0x792880 | out: hKey=0x792880) returned 0x0 [0164.481] CloseHandle (hObject=0x13dc) returned 1 [0164.609] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe90000 [0164.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.play")) returned 1 [0164.700] VirtualFree (lpAddress=0xe90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1910 os_tid = 0x1cbc [0163.852] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.852] ReadFile (in: hFile=0x13e4, lpBuffer=0x2883fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2883f85c, lpOverlapped=0x0 | out: lpBuffer=0x2883fb34*, lpNumberOfBytesRead=0x2883f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.173] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.173] ReadFile (in: hFile=0x13e4, lpBuffer=0x2883fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2883f85c, lpOverlapped=0x0 | out: lpBuffer=0x2883fb34*, lpNumberOfBytesRead=0x2883f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.175] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.175] BCryptSetProperty (in: hObject=0x734780, pszProperty="ChainingMode", pbInput=0x2883f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734780) returned 0x0 [0164.175] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734780, phKey=0x2883f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734780, phKey=0x2883f828, pbKeyObject=0x0) returned 0x0 [0164.175] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2883f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2883f500) returned 0x0 [0164.175] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.176] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2883f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2883f500) returned 0x0 [0164.179] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.181] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.181] WriteFile (in: hFile=0x13e4, lpBuffer=0x2883fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2883f830, lpOverlapped=0x0 | out: lpBuffer=0x2883fb34*, lpNumberOfBytesWritten=0x2883f830*=0x428, lpOverlapped=0x0) returned 1 [0164.182] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.182] ReadFile (in: hFile=0x13e4, lpBuffer=0x9050000, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x2883f61c, lpOverlapped=0x0 | out: lpBuffer=0x9050000*, lpNumberOfBytesRead=0x2883f61c*=0x1f26, lpOverlapped=0x0) returned 1 [0164.526] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xffffe0da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.527] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x9050000, cbInput=0x1f26, pPaddingInfo=0x0, pbIV=0x2883f848, cbIV=0x10, pbOutput=0x9050000, cbOutput=0x100000, pcbResult=0x2883f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2883f848, pbOutput=0x9050000, pcbResult=0x2883f618) returned 0x0 [0164.527] WriteFile (in: hFile=0x13e4, lpBuffer=0x9050000*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2883f61c, lpOverlapped=0x0 | out: lpBuffer=0x9050000*, lpNumberOfBytesWritten=0x2883f61c*=0x1f30, lpOverlapped=0x0) returned 1 [0164.527] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2883f60c | out: lpNewFilePointer=0x0) returned 1 [0164.527] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.527] WriteFile (in: hFile=0x13e4, lpBuffer=0x2883f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2883f61c, lpOverlapped=0x0 | out: lpBuffer=0x2883f83c*, lpNumberOfBytesWritten=0x2883f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.527] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x1f30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.527] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0164.527] CloseHandle (hObject=0x13e4) returned 1 [0164.649] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd200000 [0164.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.play")) returned 1 [0164.651] VirtualFree (lpAddress=0xd200000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1911 os_tid = 0x1cc0 [0163.853] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.853] ReadFile (in: hFile=0x13ec, lpBuffer=0x2897fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2897f85c, lpOverlapped=0x0 | out: lpBuffer=0x2897fb34*, lpNumberOfBytesRead=0x2897f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.184] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.184] ReadFile (in: hFile=0x13ec, lpBuffer=0x2897fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2897f85c, lpOverlapped=0x0 | out: lpBuffer=0x2897fb34*, lpNumberOfBytesRead=0x2897f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.185] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.186] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.186] BCryptSetProperty (in: hObject=0x734830, pszProperty="ChainingMode", pbInput=0x2897f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734830) returned 0x0 [0164.186] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734830, phKey=0x2897f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734830, phKey=0x2897f828, pbKeyObject=0x0) returned 0x0 [0164.186] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2897f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2897f500) returned 0x0 [0164.186] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.187] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2897f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2897f500) returned 0x0 [0164.190] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.191] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.192] WriteFile (in: hFile=0x13ec, lpBuffer=0x2897fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2897f830, lpOverlapped=0x0 | out: lpBuffer=0x2897fb34*, lpNumberOfBytesWritten=0x2897f830*=0x428, lpOverlapped=0x0) returned 1 [0164.192] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.192] ReadFile (in: hFile=0x13ec, lpBuffer=0x9150000, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x2897f61c, lpOverlapped=0x0 | out: lpBuffer=0x9150000*, lpNumberOfBytesRead=0x2897f61c*=0x94a, lpOverlapped=0x0) returned 1 [0164.192] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffff6b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.192] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x9150000, cbInput=0x94a, pPaddingInfo=0x0, pbIV=0x2897f848, cbIV=0x10, pbOutput=0x9150000, cbOutput=0x100000, pcbResult=0x2897f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x2897f848, pbOutput=0x9150000, pcbResult=0x2897f618) returned 0x0 [0164.192] WriteFile (in: hFile=0x13ec, lpBuffer=0x9150000*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2897f61c, lpOverlapped=0x0 | out: lpBuffer=0x9150000*, lpNumberOfBytesWritten=0x2897f61c*=0x950, lpOverlapped=0x0) returned 1 [0164.192] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2897f60c | out: lpNewFilePointer=0x0) returned 1 [0164.192] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.193] WriteFile (in: hFile=0x13ec, lpBuffer=0x2897f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2897f61c, lpOverlapped=0x0 | out: lpBuffer=0x2897f83c*, lpNumberOfBytesWritten=0x2897f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.193] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.193] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.193] CloseHandle (hObject=0x13ec) returned 1 [0164.575] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd80000 [0164.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.play")) returned 1 [0164.770] VirtualFree (lpAddress=0xd80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1912 os_tid = 0x1cc4 [0163.855] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0163.856] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0163.857] BCryptSetProperty (in: hObject=0x735280, pszProperty="ChainingMode", pbInput=0x28abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735280) returned 0x0 [0163.857] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735280, phKey=0x28abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735280, phKey=0x28abf828, pbKeyObject=0x0) returned 0x0 [0163.857] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28abf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28abf500) returned 0x0 [0163.857] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0163.857] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28abf500) returned 0x0 [0163.860] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.863] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.863] WriteFile (in: hFile=0x13f4, lpBuffer=0x28abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28abf830, lpOverlapped=0x0 | out: lpBuffer=0x28abfb34*, lpNumberOfBytesWritten=0x28abf830*=0x428, lpOverlapped=0x0) returned 1 [0164.183] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.183] ReadFile (in: hFile=0x13f4, lpBuffer=0x9250000, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x28abf61c, lpOverlapped=0x0 | out: lpBuffer=0x9250000*, lpNumberOfBytesRead=0x28abf61c*=0x414, lpOverlapped=0x0) returned 1 [0164.184] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0xfffffbec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.184] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x9250000, cbInput=0x414, pPaddingInfo=0x0, pbIV=0x28abf848, cbIV=0x10, pbOutput=0x9250000, cbOutput=0x100000, pcbResult=0x28abf618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x28abf848, pbOutput=0x9250000, pcbResult=0x28abf618) returned 0x0 [0164.184] WriteFile (in: hFile=0x13f4, lpBuffer=0x9250000*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x28abf61c, lpOverlapped=0x0 | out: lpBuffer=0x9250000*, lpNumberOfBytesWritten=0x28abf61c*=0x420, lpOverlapped=0x0) returned 1 [0164.184] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28abf60c | out: lpNewFilePointer=0x0) returned 1 [0164.184] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.184] WriteFile (in: hFile=0x13f4, lpBuffer=0x28abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28abf61c, lpOverlapped=0x0 | out: lpBuffer=0x28abf83c*, lpNumberOfBytesWritten=0x28abf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.184] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.184] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.184] CloseHandle (hObject=0x13f4) returned 1 [0164.536] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd70000 [0164.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.play")) returned 1 [0164.768] VirtualFree (lpAddress=0xd70000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1913 os_tid = 0x1cc8 [0163.864] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.864] ReadFile (in: hFile=0x13fc, lpBuffer=0x28bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28bff85c, lpOverlapped=0x0 | out: lpBuffer=0x28bffb34*, lpNumberOfBytesRead=0x28bff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.312] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.312] ReadFile (in: hFile=0x13fc, lpBuffer=0x28bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28bff85c, lpOverlapped=0x0 | out: lpBuffer=0x28bffb34*, lpNumberOfBytesRead=0x28bff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.312] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.313] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.314] BCryptSetProperty (in: hObject=0x7348e0, pszProperty="ChainingMode", pbInput=0x28bff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7348e0) returned 0x0 [0164.314] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7348e0, phKey=0x28bff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7348e0, phKey=0x28bff828, pbKeyObject=0x0) returned 0x0 [0164.314] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28bff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28bff500) returned 0x0 [0164.314] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.314] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28bff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28bff500) returned 0x0 [0164.319] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.322] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.322] WriteFile (in: hFile=0x13fc, lpBuffer=0x28bffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28bff830, lpOverlapped=0x0 | out: lpBuffer=0x28bffb34*, lpNumberOfBytesWritten=0x28bff830*=0x428, lpOverlapped=0x0) returned 1 [0164.323] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.323] ReadFile (in: hFile=0x13fc, lpBuffer=0x9350000, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x28bff61c, lpOverlapped=0x0 | out: lpBuffer=0x9350000*, lpNumberOfBytesRead=0x28bff61c*=0x876, lpOverlapped=0x0) returned 1 [0164.323] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0xfffff78a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.323] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x9350000, cbInput=0x876, pPaddingInfo=0x0, pbIV=0x28bff848, cbIV=0x10, pbOutput=0x9350000, cbOutput=0x100000, pcbResult=0x28bff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x28bff848, pbOutput=0x9350000, pcbResult=0x28bff618) returned 0x0 [0164.323] WriteFile (in: hFile=0x13fc, lpBuffer=0x9350000*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x28bff61c, lpOverlapped=0x0 | out: lpBuffer=0x9350000*, lpNumberOfBytesWritten=0x28bff61c*=0x880, lpOverlapped=0x0) returned 1 [0164.323] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28bff60c | out: lpNewFilePointer=0x0) returned 1 [0164.324] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.324] WriteFile (in: hFile=0x13fc, lpBuffer=0x28bff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28bff61c, lpOverlapped=0x0 | out: lpBuffer=0x28bff83c*, lpNumberOfBytesWritten=0x28bff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.324] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.324] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0164.324] CloseHandle (hObject=0x13fc) returned 1 [0164.594] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe10000 [0164.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.play")) returned 1 [0164.731] VirtualFree (lpAddress=0xe10000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1914 os_tid = 0x1ccc [0163.865] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.865] ReadFile (in: hFile=0x1408, lpBuffer=0x28d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x28d3fb34*, lpNumberOfBytesRead=0x28d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.346] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.347] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.348] BCryptSetProperty (in: hObject=0x734990, pszProperty="ChainingMode", pbInput=0x28d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734990) returned 0x0 [0164.348] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734990, phKey=0x28d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734990, phKey=0x28d3f828, pbKeyObject=0x0) returned 0x0 [0164.348] BCryptExportKey (in: hKey=0x796030, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28d3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28d3f500) returned 0x0 [0164.348] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.348] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28d3f500) returned 0x0 [0164.353] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.355] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.355] WriteFile (in: hFile=0x1408, lpBuffer=0x28d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28d3f830, lpOverlapped=0x0 | out: lpBuffer=0x28d3fb34*, lpNumberOfBytesWritten=0x28d3f830*=0x428, lpOverlapped=0x0) returned 1 [0164.356] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.356] ReadFile (in: hFile=0x1408, lpBuffer=0x9450000, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x28d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9450000*, lpNumberOfBytesRead=0x28d3f61c*=0x6b0, lpOverlapped=0x0) returned 1 [0164.356] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0xfffff950, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.356] BCryptEncrypt (in: hKey=0x796030, pbInput=0x9450000, cbInput=0x6b0, pPaddingInfo=0x0, pbIV=0x28d3f848, cbIV=0x10, pbOutput=0x9450000, cbOutput=0x100000, pcbResult=0x28d3f618, dwFlags=0x1 | out: hKey=0x796030, pbIV=0x28d3f848, pbOutput=0x9450000, pcbResult=0x28d3f618) returned 0x0 [0164.356] WriteFile (in: hFile=0x1408, lpBuffer=0x9450000*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x28d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9450000*, lpNumberOfBytesWritten=0x28d3f61c*=0x6c0, lpOverlapped=0x0) returned 1 [0164.356] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28d3f60c | out: lpNewFilePointer=0x0) returned 1 [0164.356] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.356] WriteFile (in: hFile=0x1408, lpBuffer=0x28d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x28d3f83c*, lpNumberOfBytesWritten=0x28d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.356] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.356] BCryptDestroyKey (in: hKey=0x796030 | out: hKey=0x796030) returned 0x0 [0164.356] CloseHandle (hObject=0x1408) returned 1 [0164.598] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe30000 [0164.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.play")) returned 1 [0164.724] VirtualFree (lpAddress=0xe30000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1915 os_tid = 0x1cd0 [0163.866] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.867] ReadFile (in: hFile=0x1410, lpBuffer=0x28e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x28e7fb34*, lpNumberOfBytesRead=0x28e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.335] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.335] ReadFile (in: hFile=0x1410, lpBuffer=0x28e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x28e7fb34*, lpNumberOfBytesRead=0x28e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.335] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.337] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.337] BCryptSetProperty (in: hObject=0x734a40, pszProperty="ChainingMode", pbInput=0x28e7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734a40) returned 0x0 [0164.337] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734a40, phKey=0x28e7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734a40, phKey=0x28e7f828, pbKeyObject=0x0) returned 0x0 [0164.337] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28e7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28e7f500) returned 0x0 [0164.337] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.338] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28e7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28e7f500) returned 0x0 [0164.342] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.344] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.344] WriteFile (in: hFile=0x1410, lpBuffer=0x28e7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28e7f830, lpOverlapped=0x0 | out: lpBuffer=0x28e7fb34*, lpNumberOfBytesWritten=0x28e7f830*=0x428, lpOverlapped=0x0) returned 1 [0164.345] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.345] ReadFile (in: hFile=0x1410, lpBuffer=0x9550000, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x28e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x9550000*, lpNumberOfBytesRead=0x28e7f61c*=0x20ae, lpOverlapped=0x0) returned 1 [0164.539] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xffffdf52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.539] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x9550000, cbInput=0x20ae, pPaddingInfo=0x0, pbIV=0x28e7f848, cbIV=0x10, pbOutput=0x9550000, cbOutput=0x100000, pcbResult=0x28e7f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x28e7f848, pbOutput=0x9550000, pcbResult=0x28e7f618) returned 0x0 [0164.540] WriteFile (in: hFile=0x1410, lpBuffer=0x9550000*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x28e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x9550000*, lpNumberOfBytesWritten=0x28e7f61c*=0x20b0, lpOverlapped=0x0) returned 1 [0164.540] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28e7f60c | out: lpNewFilePointer=0x0) returned 1 [0164.540] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.540] WriteFile (in: hFile=0x1410, lpBuffer=0x28e7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x28e7f83c*, lpNumberOfBytesWritten=0x28e7f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.540] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x20b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.540] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0164.540] CloseHandle (hObject=0x1410) returned 1 [0164.621] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd230000 [0164.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.play")) returned 1 [0164.680] VirtualFree (lpAddress=0xd230000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1916 os_tid = 0x1cd4 [0163.868] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.868] ReadFile (in: hFile=0x1418, lpBuffer=0x28fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x28fbfb34*, lpNumberOfBytesRead=0x28fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.277] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.278] ReadFile (in: hFile=0x1418, lpBuffer=0x28fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x28fbfb34*, lpNumberOfBytesRead=0x28fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.278] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.280] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.280] BCryptSetProperty (in: hObject=0x734d00, pszProperty="ChainingMode", pbInput=0x28fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734d00) returned 0x0 [0164.280] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734d00, phKey=0x28fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734d00, phKey=0x28fbf828, pbKeyObject=0x0) returned 0x0 [0164.280] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28fbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28fbf500) returned 0x0 [0164.280] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.280] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28fbf500) returned 0x0 [0164.285] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.287] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.287] WriteFile (in: hFile=0x1418, lpBuffer=0x28fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28fbf830, lpOverlapped=0x0 | out: lpBuffer=0x28fbfb34*, lpNumberOfBytesWritten=0x28fbf830*=0x428, lpOverlapped=0x0) returned 1 [0164.287] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.288] ReadFile (in: hFile=0x1418, lpBuffer=0x9650000, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x28fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x9650000*, lpNumberOfBytesRead=0x28fbf61c*=0x1370, lpOverlapped=0x0) returned 1 [0164.288] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0xffffec90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.288] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x9650000, cbInput=0x1370, pPaddingInfo=0x0, pbIV=0x28fbf848, cbIV=0x10, pbOutput=0x9650000, cbOutput=0x100000, pcbResult=0x28fbf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x28fbf848, pbOutput=0x9650000, pcbResult=0x28fbf618) returned 0x0 [0164.288] WriteFile (in: hFile=0x1418, lpBuffer=0x9650000*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x28fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x9650000*, lpNumberOfBytesWritten=0x28fbf61c*=0x1380, lpOverlapped=0x0) returned 1 [0164.288] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28fbf60c | out: lpNewFilePointer=0x0) returned 1 [0164.288] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.288] WriteFile (in: hFile=0x1418, lpBuffer=0x28fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x28fbf83c*, lpNumberOfBytesWritten=0x28fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.289] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x1380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.289] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0164.289] CloseHandle (hObject=0x1418) returned 1 [0164.589] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xde0000 [0164.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.play")) returned 1 [0164.738] VirtualFree (lpAddress=0xde0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1917 os_tid = 0x1cd8 [0163.869] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.869] ReadFile (in: hFile=0x1420, lpBuffer=0x290ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x290ff85c, lpOverlapped=0x0 | out: lpBuffer=0x290ffb34*, lpNumberOfBytesRead=0x290ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.266] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.266] ReadFile (in: hFile=0x1420, lpBuffer=0x290ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x290ff85c, lpOverlapped=0x0 | out: lpBuffer=0x290ffb34*, lpNumberOfBytesRead=0x290ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.266] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.268] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.269] BCryptSetProperty (in: hObject=0x7351d0, pszProperty="ChainingMode", pbInput=0x290ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7351d0) returned 0x0 [0164.269] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7351d0, phKey=0x290ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7351d0, phKey=0x290ff828, pbKeyObject=0x0) returned 0x0 [0164.269] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x290ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x290ff500) returned 0x0 [0164.269] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.269] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x290ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x290ff500) returned 0x0 [0164.274] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.276] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.276] WriteFile (in: hFile=0x1420, lpBuffer=0x290ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x290ff830, lpOverlapped=0x0 | out: lpBuffer=0x290ffb34*, lpNumberOfBytesWritten=0x290ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.277] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.277] ReadFile (in: hFile=0x1420, lpBuffer=0x9750000, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x290ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9750000*, lpNumberOfBytesRead=0x290ff61c*=0x31f4, lpOverlapped=0x0) returned 1 [0164.538] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0xffffce0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.539] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x9750000, cbInput=0x31f4, pPaddingInfo=0x0, pbIV=0x290ff848, cbIV=0x10, pbOutput=0x9750000, cbOutput=0x100000, pcbResult=0x290ff618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x290ff848, pbOutput=0x9750000, pcbResult=0x290ff618) returned 0x0 [0164.539] WriteFile (in: hFile=0x1420, lpBuffer=0x9750000*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x290ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9750000*, lpNumberOfBytesWritten=0x290ff61c*=0x3200, lpOverlapped=0x0) returned 1 [0164.539] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.539] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.539] WriteFile (in: hFile=0x1420, lpBuffer=0x290ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ff61c, lpOverlapped=0x0 | out: lpBuffer=0x290ff83c*, lpNumberOfBytesWritten=0x290ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.539] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x3200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.539] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.539] CloseHandle (hObject=0x1420) returned 1 [0164.620] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd220000 [0164.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.play")) returned 1 [0164.684] VirtualFree (lpAddress=0xd220000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1918 os_tid = 0x1cdc [0163.870] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.870] ReadFile (in: hFile=0x1428, lpBuffer=0x2923fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2923f85c, lpOverlapped=0x0 | out: lpBuffer=0x2923fb34*, lpNumberOfBytesRead=0x2923f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.233] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.233] ReadFile (in: hFile=0x1428, lpBuffer=0x2923fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2923f85c, lpOverlapped=0x0 | out: lpBuffer=0x2923fb34*, lpNumberOfBytesRead=0x2923f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.233] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.235] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.235] BCryptSetProperty (in: hObject=0x735070, pszProperty="ChainingMode", pbInput=0x2923f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735070) returned 0x0 [0164.235] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735070, phKey=0x2923f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735070, phKey=0x2923f828, pbKeyObject=0x0) returned 0x0 [0164.235] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2923f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2923f500) returned 0x0 [0164.235] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.235] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2923f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2923f500) returned 0x0 [0164.240] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.264] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.264] WriteFile (in: hFile=0x1428, lpBuffer=0x2923fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2923f830, lpOverlapped=0x0 | out: lpBuffer=0x2923fb34*, lpNumberOfBytesWritten=0x2923f830*=0x428, lpOverlapped=0x0) returned 1 [0164.265] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.265] ReadFile (in: hFile=0x1428, lpBuffer=0x9850000, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x2923f61c, lpOverlapped=0x0 | out: lpBuffer=0x9850000*, lpNumberOfBytesRead=0x2923f61c*=0xc20, lpOverlapped=0x0) returned 1 [0164.265] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0xfffff3e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.265] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x9850000, cbInput=0xc20, pPaddingInfo=0x0, pbIV=0x2923f848, cbIV=0x10, pbOutput=0x9850000, cbOutput=0x100000, pcbResult=0x2923f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x2923f848, pbOutput=0x9850000, pcbResult=0x2923f618) returned 0x0 [0164.266] WriteFile (in: hFile=0x1428, lpBuffer=0x9850000*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2923f61c, lpOverlapped=0x0 | out: lpBuffer=0x9850000*, lpNumberOfBytesWritten=0x2923f61c*=0xc30, lpOverlapped=0x0) returned 1 [0164.266] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2923f60c | out: lpNewFilePointer=0x0) returned 1 [0164.266] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.266] WriteFile (in: hFile=0x1428, lpBuffer=0x2923f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2923f61c, lpOverlapped=0x0 | out: lpBuffer=0x2923f83c*, lpNumberOfBytesWritten=0x2923f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.266] SetFilePointerEx (in: hFile=0x1428, liDistanceToMove=0xc30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.266] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.266] CloseHandle (hObject=0x1428) returned 1 [0164.584] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdd0000 [0164.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.play")) returned 1 [0164.740] VirtualFree (lpAddress=0xdd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1919 os_tid = 0x1ce0 [0163.871] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.871] ReadFile (in: hFile=0x1430, lpBuffer=0x2937fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2937f85c, lpOverlapped=0x0 | out: lpBuffer=0x2937fb34*, lpNumberOfBytesRead=0x2937f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.222] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.223] BCryptSetProperty (in: hObject=0x735490, pszProperty="ChainingMode", pbInput=0x2937f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735490) returned 0x0 [0164.224] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735490, phKey=0x2937f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735490, phKey=0x2937f828, pbKeyObject=0x0) returned 0x0 [0164.224] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2937f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2937f500) returned 0x0 [0164.224] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.224] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2937f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2937f500) returned 0x0 [0164.229] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.231] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.231] WriteFile (in: hFile=0x1430, lpBuffer=0x2937fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2937f830, lpOverlapped=0x0 | out: lpBuffer=0x2937fb34*, lpNumberOfBytesWritten=0x2937f830*=0x428, lpOverlapped=0x0) returned 1 [0164.232] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.232] ReadFile (in: hFile=0x1430, lpBuffer=0x9950000, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x2937f61c, lpOverlapped=0x0 | out: lpBuffer=0x9950000*, lpNumberOfBytesRead=0x2937f61c*=0x634, lpOverlapped=0x0) returned 1 [0164.232] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xfffff9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.232] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x9950000, cbInput=0x634, pPaddingInfo=0x0, pbIV=0x2937f848, cbIV=0x10, pbOutput=0x9950000, cbOutput=0x100000, pcbResult=0x2937f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x2937f848, pbOutput=0x9950000, pcbResult=0x2937f618) returned 0x0 [0164.232] WriteFile (in: hFile=0x1430, lpBuffer=0x9950000*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2937f61c, lpOverlapped=0x0 | out: lpBuffer=0x9950000*, lpNumberOfBytesWritten=0x2937f61c*=0x640, lpOverlapped=0x0) returned 1 [0164.232] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2937f60c | out: lpNewFilePointer=0x0) returned 1 [0164.233] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.233] WriteFile (in: hFile=0x1430, lpBuffer=0x2937f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2937f61c, lpOverlapped=0x0 | out: lpBuffer=0x2937f83c*, lpNumberOfBytesWritten=0x2937f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.233] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.233] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.233] CloseHandle (hObject=0x1430) returned 1 [0164.582] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdc0000 [0164.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.play")) returned 1 [0164.743] VirtualFree (lpAddress=0xdc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1920 os_tid = 0x1ce4 [0163.872] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.872] ReadFile (in: hFile=0x1438, lpBuffer=0x294bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x294bf85c, lpOverlapped=0x0 | out: lpBuffer=0x294bfb34*, lpNumberOfBytesRead=0x294bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.211] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.213] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.213] BCryptSetProperty (in: hObject=0x7355f0, pszProperty="ChainingMode", pbInput=0x294bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7355f0) returned 0x0 [0164.213] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7355f0, phKey=0x294bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7355f0, phKey=0x294bf828, pbKeyObject=0x0) returned 0x0 [0164.213] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x294bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x294bf500) returned 0x0 [0164.213] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.213] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x294bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x294bf500) returned 0x0 [0164.217] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.219] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.219] WriteFile (in: hFile=0x1438, lpBuffer=0x294bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x294bf830, lpOverlapped=0x0 | out: lpBuffer=0x294bfb34*, lpNumberOfBytesWritten=0x294bf830*=0x428, lpOverlapped=0x0) returned 1 [0164.219] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.220] ReadFile (in: hFile=0x1438, lpBuffer=0x9a50000, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x294bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9a50000*, lpNumberOfBytesRead=0x294bf61c*=0x4bc, lpOverlapped=0x0) returned 1 [0164.220] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0xfffffb44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.220] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x9a50000, cbInput=0x4bc, pPaddingInfo=0x0, pbIV=0x294bf848, cbIV=0x10, pbOutput=0x9a50000, cbOutput=0x100000, pcbResult=0x294bf618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x294bf848, pbOutput=0x9a50000, pcbResult=0x294bf618) returned 0x0 [0164.220] WriteFile (in: hFile=0x1438, lpBuffer=0x9a50000*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x294bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9a50000*, lpNumberOfBytesWritten=0x294bf61c*=0x4c0, lpOverlapped=0x0) returned 1 [0164.220] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x294bf60c | out: lpNewFilePointer=0x0) returned 1 [0164.220] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.220] WriteFile (in: hFile=0x1438, lpBuffer=0x294bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x294bf61c, lpOverlapped=0x0 | out: lpBuffer=0x294bf83c*, lpNumberOfBytesWritten=0x294bf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.220] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x4c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.220] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.220] CloseHandle (hObject=0x1438) returned 1 [0164.581] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdb0000 [0164.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.play")) returned 1 [0164.745] VirtualFree (lpAddress=0xdb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1921 os_tid = 0x1ce8 [0163.874] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.874] ReadFile (in: hFile=0x1440, lpBuffer=0x295ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x295ff85c, lpOverlapped=0x0 | out: lpBuffer=0x295ffb34*, lpNumberOfBytesRead=0x295ff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.203] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.204] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.204] BCryptSetProperty (in: hObject=0x734e60, pszProperty="ChainingMode", pbInput=0x295ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734e60) returned 0x0 [0164.204] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734e60, phKey=0x295ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734e60, phKey=0x295ff828, pbKeyObject=0x0) returned 0x0 [0164.204] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x295ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x295ff500) returned 0x0 [0164.204] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.204] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x295ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x295ff500) returned 0x0 [0164.208] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.210] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.210] WriteFile (in: hFile=0x1440, lpBuffer=0x295ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x295ff830, lpOverlapped=0x0 | out: lpBuffer=0x295ffb34*, lpNumberOfBytesWritten=0x295ff830*=0x428, lpOverlapped=0x0) returned 1 [0164.210] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.210] ReadFile (in: hFile=0x1440, lpBuffer=0x9b50000, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x295ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9b50000*, lpNumberOfBytesRead=0x295ff61c*=0x804, lpOverlapped=0x0) returned 1 [0164.210] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffff7fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.211] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x9b50000, cbInput=0x804, pPaddingInfo=0x0, pbIV=0x295ff848, cbIV=0x10, pbOutput=0x9b50000, cbOutput=0x100000, pcbResult=0x295ff618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x295ff848, pbOutput=0x9b50000, pcbResult=0x295ff618) returned 0x0 [0164.211] WriteFile (in: hFile=0x1440, lpBuffer=0x9b50000*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x295ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9b50000*, lpNumberOfBytesWritten=0x295ff61c*=0x810, lpOverlapped=0x0) returned 1 [0164.211] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295ff60c | out: lpNewFilePointer=0x0) returned 1 [0164.211] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.211] WriteFile (in: hFile=0x1440, lpBuffer=0x295ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x295ff61c, lpOverlapped=0x0 | out: lpBuffer=0x295ff83c*, lpNumberOfBytesWritten=0x295ff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.211] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.211] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.211] CloseHandle (hObject=0x1440) returned 1 [0164.579] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xda0000 [0164.580] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.play")) returned 1 [0164.747] VirtualFree (lpAddress=0xda0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1922 os_tid = 0x1cec [0163.875] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.875] ReadFile (in: hFile=0x1448, lpBuffer=0x2973fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2973f85c, lpOverlapped=0x0 | out: lpBuffer=0x2973fb34*, lpNumberOfBytesRead=0x2973f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.357] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.357] ReadFile (in: hFile=0x1448, lpBuffer=0x2973fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2973f85c, lpOverlapped=0x0 | out: lpBuffer=0x2973fb34*, lpNumberOfBytesRead=0x2973f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.540] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xd80000 [0164.542] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd80000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xd80000) returned 0x0 [0164.542] BCryptSetProperty (in: hObject=0x734f10, pszProperty="ChainingMode", pbInput=0x2973f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734f10) returned 0x0 [0164.542] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734f10, phKey=0x2973f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xd80000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734f10, phKey=0x2973f828, pbKeyObject=0x0) returned 0x0 [0164.542] BCryptExportKey (in: hKey=0x792b00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xd80000, cbOutput=0x230, pcbResult=0x2973f500, dwFlags=0x0 | out: pbOutput=0xd80000, pcbResult=0x2973f500) returned 0x0 [0164.542] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xd80230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xd80230) returned 0x0 [0164.542] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xd80000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xd80000, cbOutput=0x400, pcbResult=0x2973f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xd80000, pcbResult=0x2973f500) returned 0x0 [0164.547] VirtualFree (lpAddress=0xd80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.566] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.566] WriteFile (in: hFile=0x1448, lpBuffer=0x2973fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2973f830, lpOverlapped=0x0 | out: lpBuffer=0x2973fb34*, lpNumberOfBytesWritten=0x2973f830*=0x428, lpOverlapped=0x0) returned 1 [0164.567] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.567] ReadFile (in: hFile=0x1448, lpBuffer=0x9c50000, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x2973f61c, lpOverlapped=0x0 | out: lpBuffer=0x9c50000*, lpNumberOfBytesRead=0x2973f61c*=0x15cc, lpOverlapped=0x0) returned 1 [0164.567] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0xffffea34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.567] BCryptEncrypt (in: hKey=0x792b00, pbInput=0x9c50000, cbInput=0x15cc, pPaddingInfo=0x0, pbIV=0x2973f848, cbIV=0x10, pbOutput=0x9c50000, cbOutput=0x100000, pcbResult=0x2973f618, dwFlags=0x1 | out: hKey=0x792b00, pbIV=0x2973f848, pbOutput=0x9c50000, pcbResult=0x2973f618) returned 0x0 [0164.567] WriteFile (in: hFile=0x1448, lpBuffer=0x9c50000*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2973f61c, lpOverlapped=0x0 | out: lpBuffer=0x9c50000*, lpNumberOfBytesWritten=0x2973f61c*=0x15d0, lpOverlapped=0x0) returned 1 [0164.567] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2973f60c | out: lpNewFilePointer=0x0) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.568] WriteFile (in: hFile=0x1448, lpBuffer=0x2973f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2973f61c, lpOverlapped=0x0 | out: lpBuffer=0x2973f83c*, lpNumberOfBytesWritten=0x2973f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x1448, liDistanceToMove=0x15d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.568] BCryptDestroyKey (in: hKey=0x792b00 | out: hKey=0x792b00) returned 0x0 [0164.568] CloseHandle (hObject=0x1448) returned 1 [0164.623] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd240000 [0164.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.play")) returned 1 [0164.675] VirtualFree (lpAddress=0xd240000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1923 os_tid = 0x1cf0 [0163.876] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.877] ReadFile (in: hFile=0x1450, lpBuffer=0x2987fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2987f85c, lpOverlapped=0x0 | out: lpBuffer=0x2987fb34*, lpNumberOfBytesRead=0x2987f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.324] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.324] ReadFile (in: hFile=0x1450, lpBuffer=0x2987fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2987f85c, lpOverlapped=0x0 | out: lpBuffer=0x2987fb34*, lpNumberOfBytesRead=0x2987f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.324] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.326] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.326] BCryptSetProperty (in: hObject=0x738c50, pszProperty="ChainingMode", pbInput=0x2987f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738c50) returned 0x0 [0164.326] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738c50, phKey=0x2987f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738c50, phKey=0x2987f828, pbKeyObject=0x0) returned 0x0 [0164.326] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2987f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2987f500) returned 0x0 [0164.326] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.326] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2987f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2987f500) returned 0x0 [0164.331] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.333] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.333] WriteFile (in: hFile=0x1450, lpBuffer=0x2987fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2987f830, lpOverlapped=0x0 | out: lpBuffer=0x2987fb34*, lpNumberOfBytesWritten=0x2987f830*=0x428, lpOverlapped=0x0) returned 1 [0164.334] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.334] ReadFile (in: hFile=0x1450, lpBuffer=0x9d50000, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x2987f61c, lpOverlapped=0x0 | out: lpBuffer=0x9d50000*, lpNumberOfBytesRead=0x2987f61c*=0xdc4, lpOverlapped=0x0) returned 1 [0164.334] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffff23c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.334] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x9d50000, cbInput=0xdc4, pPaddingInfo=0x0, pbIV=0x2987f848, cbIV=0x10, pbOutput=0x9d50000, cbOutput=0x100000, pcbResult=0x2987f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2987f848, pbOutput=0x9d50000, pcbResult=0x2987f618) returned 0x0 [0164.334] WriteFile (in: hFile=0x1450, lpBuffer=0x9d50000*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2987f61c, lpOverlapped=0x0 | out: lpBuffer=0x9d50000*, lpNumberOfBytesWritten=0x2987f61c*=0xdd0, lpOverlapped=0x0) returned 1 [0164.334] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2987f60c | out: lpNewFilePointer=0x0) returned 1 [0164.335] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.335] WriteFile (in: hFile=0x1450, lpBuffer=0x2987f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2987f61c, lpOverlapped=0x0 | out: lpBuffer=0x2987f83c*, lpNumberOfBytesWritten=0x2987f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.335] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xdd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.335] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0164.335] CloseHandle (hObject=0x1450) returned 1 [0164.596] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe20000 [0164.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.play")) returned 1 [0164.728] VirtualFree (lpAddress=0xe20000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1924 os_tid = 0x1cf4 [0163.878] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.878] ReadFile (in: hFile=0x1458, lpBuffer=0x299bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x299bf85c, lpOverlapped=0x0 | out: lpBuffer=0x299bfb34*, lpNumberOfBytesRead=0x299bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.301] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.301] ReadFile (in: hFile=0x1458, lpBuffer=0x299bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x299bf85c, lpOverlapped=0x0 | out: lpBuffer=0x299bfb34*, lpNumberOfBytesRead=0x299bf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.301] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.302] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.303] BCryptSetProperty (in: hObject=0x738e60, pszProperty="ChainingMode", pbInput=0x299bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738e60) returned 0x0 [0164.303] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738e60, phKey=0x299bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738e60, phKey=0x299bf828, pbKeyObject=0x0) returned 0x0 [0164.303] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x299bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x299bf500) returned 0x0 [0164.303] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.303] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x299bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x299bf500) returned 0x0 [0164.308] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.310] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.310] WriteFile (in: hFile=0x1458, lpBuffer=0x299bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x299bf830, lpOverlapped=0x0 | out: lpBuffer=0x299bfb34*, lpNumberOfBytesWritten=0x299bf830*=0x428, lpOverlapped=0x0) returned 1 [0164.310] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.311] ReadFile (in: hFile=0x1458, lpBuffer=0x9e50000, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x299bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9e50000*, lpNumberOfBytesRead=0x299bf61c*=0x9b8, lpOverlapped=0x0) returned 1 [0164.311] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffff648, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.311] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x9e50000, cbInput=0x9b8, pPaddingInfo=0x0, pbIV=0x299bf848, cbIV=0x10, pbOutput=0x9e50000, cbOutput=0x100000, pcbResult=0x299bf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x299bf848, pbOutput=0x9e50000, pcbResult=0x299bf618) returned 0x0 [0164.311] WriteFile (in: hFile=0x1458, lpBuffer=0x9e50000*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x299bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9e50000*, lpNumberOfBytesWritten=0x299bf61c*=0x9c0, lpOverlapped=0x0) returned 1 [0164.311] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299bf60c | out: lpNewFilePointer=0x0) returned 1 [0164.311] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.311] WriteFile (in: hFile=0x1458, lpBuffer=0x299bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x299bf61c, lpOverlapped=0x0 | out: lpBuffer=0x299bf83c*, lpNumberOfBytesWritten=0x299bf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.311] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x9c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.311] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0164.311] CloseHandle (hObject=0x1458) returned 1 [0164.593] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xe00000 [0164.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.play")) returned 1 [0164.733] VirtualFree (lpAddress=0xe00000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1925 os_tid = 0x1cf8 [0163.879] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.879] ReadFile (in: hFile=0x1460, lpBuffer=0x29affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29aff85c, lpOverlapped=0x0 | out: lpBuffer=0x29affb34*, lpNumberOfBytesRead=0x29aff85c*=0x428, lpOverlapped=0x0) returned 1 [0164.289] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.291] BCryptSetProperty (in: hObject=0x738af0, pszProperty="ChainingMode", pbInput=0x29aff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738af0) returned 0x0 [0164.291] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738af0, phKey=0x29aff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738af0, phKey=0x29aff828, pbKeyObject=0x0) returned 0x0 [0164.291] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29aff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29aff500) returned 0x0 [0164.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.292] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29aff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29aff500) returned 0x0 [0164.296] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.299] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.299] WriteFile (in: hFile=0x1460, lpBuffer=0x29affb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29aff830, lpOverlapped=0x0 | out: lpBuffer=0x29affb34*, lpNumberOfBytesWritten=0x29aff830*=0x428, lpOverlapped=0x0) returned 1 [0164.299] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.299] ReadFile (in: hFile=0x1460, lpBuffer=0x9f50000, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x29aff61c, lpOverlapped=0x0 | out: lpBuffer=0x9f50000*, lpNumberOfBytesRead=0x29aff61c*=0x68c, lpOverlapped=0x0) returned 1 [0164.300] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xfffff974, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.300] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x9f50000, cbInput=0x68c, pPaddingInfo=0x0, pbIV=0x29aff848, cbIV=0x10, pbOutput=0x9f50000, cbOutput=0x100000, pcbResult=0x29aff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x29aff848, pbOutput=0x9f50000, pcbResult=0x29aff618) returned 0x0 [0164.300] WriteFile (in: hFile=0x1460, lpBuffer=0x9f50000*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x29aff61c, lpOverlapped=0x0 | out: lpBuffer=0x9f50000*, lpNumberOfBytesWritten=0x29aff61c*=0x690, lpOverlapped=0x0) returned 1 [0164.300] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29aff60c | out: lpNewFilePointer=0x0) returned 1 [0164.300] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.300] WriteFile (in: hFile=0x1460, lpBuffer=0x29aff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29aff61c, lpOverlapped=0x0 | out: lpBuffer=0x29aff83c*, lpNumberOfBytesWritten=0x29aff61c*=0x8, lpOverlapped=0x0) returned 1 [0164.300] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.300] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0164.300] CloseHandle (hObject=0x1460) returned 1 [0164.591] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xdf0000 [0164.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.play")) returned 1 [0164.736] VirtualFree (lpAddress=0xdf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1926 os_tid = 0x1cfc [0163.902] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.903] ReadFile (in: hFile=0x1468, lpBuffer=0xb88fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb88f85c, lpOverlapped=0x0 | out: lpBuffer=0xb88fb34*, lpNumberOfBytesRead=0xb88f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.193] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.193] ReadFile (in: hFile=0x1468, lpBuffer=0xb88fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb88f85c, lpOverlapped=0x0 | out: lpBuffer=0xb88fb34*, lpNumberOfBytesRead=0xb88f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.193] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0164.194] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0164.195] BCryptSetProperty (in: hObject=0x738d00, pszProperty="ChainingMode", pbInput=0xb88f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738d00) returned 0x0 [0164.195] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738d00, phKey=0xb88f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738d00, phKey=0xb88f828, pbKeyObject=0x0) returned 0x0 [0164.195] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xb88f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xb88f500) returned 0x0 [0164.196] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0164.196] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xb88f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xb88f500) returned 0x0 [0164.199] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.201] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.201] WriteFile (in: hFile=0x1468, lpBuffer=0xb88fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb88f830, lpOverlapped=0x0 | out: lpBuffer=0xb88fb34*, lpNumberOfBytesWritten=0xb88f830*=0x428, lpOverlapped=0x0) returned 1 [0164.201] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.201] ReadFile (in: hFile=0x1468, lpBuffer=0xa050000, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0xb88f61c, lpOverlapped=0x0 | out: lpBuffer=0xa050000*, lpNumberOfBytesRead=0xb88f61c*=0xf38, lpOverlapped=0x0) returned 1 [0164.202] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0xfffff0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.202] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0xa050000, cbInput=0xf38, pPaddingInfo=0x0, pbIV=0xb88f848, cbIV=0x10, pbOutput=0xa050000, cbOutput=0x100000, pcbResult=0xb88f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xb88f848, pbOutput=0xa050000, pcbResult=0xb88f618) returned 0x0 [0164.202] WriteFile (in: hFile=0x1468, lpBuffer=0xa050000*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0xb88f61c, lpOverlapped=0x0 | out: lpBuffer=0xa050000*, lpNumberOfBytesWritten=0xb88f61c*=0xf40, lpOverlapped=0x0) returned 1 [0164.202] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb88f60c | out: lpNewFilePointer=0x0) returned 1 [0164.202] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.202] WriteFile (in: hFile=0x1468, lpBuffer=0xb88f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb88f61c, lpOverlapped=0x0 | out: lpBuffer=0xb88f83c*, lpNumberOfBytesWritten=0xb88f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.202] SetFilePointerEx (in: hFile=0x1468, liDistanceToMove=0xf40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.202] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0164.202] CloseHandle (hObject=0x1468) returned 1 [0164.577] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xd90000 [0164.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.play")) returned 1 [0164.755] VirtualFree (lpAddress=0xd90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1927 os_tid = 0x1d00 [0164.890] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.890] ReadFile (in: hFile=0x1308, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.891] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.891] ReadFile (in: hFile=0x1308, lpBuffer=0xd1cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd1cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesRead=0xd1cf85c*=0x428, lpOverlapped=0x0) returned 1 [0164.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0164.893] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0164.893] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xd1cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0164.893] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xd1cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xd1cf828, pbKeyObject=0x0) returned 0x0 [0164.893] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd1cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd1cf500) returned 0x0 [0164.893] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0164.893] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd1cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd1cf500) returned 0x0 [0164.897] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.899] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.900] WriteFile (in: hFile=0x1308, lpBuffer=0xd1cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd1cf830, lpOverlapped=0x0 | out: lpBuffer=0xd1cfb34*, lpNumberOfBytesWritten=0xd1cf830*=0x428, lpOverlapped=0x0) returned 1 [0164.900] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.900] ReadFile (in: hFile=0x1308, lpBuffer=0x2750000, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xd1cf61c*=0xed4, lpOverlapped=0x0) returned 1 [0164.901] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffff12c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.901] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2750000, cbInput=0xed4, pPaddingInfo=0x0, pbIV=0xd1cf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xd1cf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd1cf848, pbOutput=0x2750000, pcbResult=0xd1cf618) returned 0x0 [0164.901] WriteFile (in: hFile=0x1308, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xd1cf61c*=0xee0, lpOverlapped=0x0) returned 1 [0164.901] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd1cf60c | out: lpNewFilePointer=0x0) returned 1 [0164.901] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.901] WriteFile (in: hFile=0x1308, lpBuffer=0xd1cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd1cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd1cf83c*, lpNumberOfBytesWritten=0xd1cf61c*=0x8, lpOverlapped=0x0) returned 1 [0164.901] SetFilePointerEx (in: hFile=0x1308, liDistanceToMove=0xee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.901] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0164.901] CloseHandle (hObject=0x1308) returned 1 [0164.901] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.play")) returned 1 [0164.904] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1928 os_tid = 0x1d04 [0164.919] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.919] ReadFile (in: hFile=0x13cc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.921] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.921] ReadFile (in: hFile=0x13cc, lpBuffer=0xe9fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe9f85c, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesRead=0xe9f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.921] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0164.923] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0164.923] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xe9f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0164.923] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xe9f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xe9f828, pbKeyObject=0x0) returned 0x0 [0164.923] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe9f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0164.923] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0164.923] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe9f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe9f500) returned 0x0 [0164.928] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.931] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.931] WriteFile (in: hFile=0x13cc, lpBuffer=0xe9fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe9f830, lpOverlapped=0x0 | out: lpBuffer=0xe9fb34*, lpNumberOfBytesWritten=0xe9f830*=0x428, lpOverlapped=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.932] ReadFile (in: hFile=0x13cc, lpBuffer=0x2850000, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xe9f61c*=0x984, lpOverlapped=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xfffff67c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.932] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2850000, cbInput=0x984, pPaddingInfo=0x0, pbIV=0xe9f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xe9f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xe9f848, pbOutput=0x2850000, pcbResult=0xe9f618) returned 0x0 [0164.932] WriteFile (in: hFile=0x13cc, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xe9f61c*=0x990, lpOverlapped=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe9f60c | out: lpNewFilePointer=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.933] WriteFile (in: hFile=0x13cc, lpBuffer=0xe9f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe9f61c, lpOverlapped=0x0 | out: lpBuffer=0xe9f83c*, lpNumberOfBytesWritten=0xe9f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.933] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.933] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0164.933] CloseHandle (hObject=0x13cc) returned 1 [0164.933] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.935] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.play")) returned 1 [0164.936] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1929 os_tid = 0x1d08 [0164.940] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.940] ReadFile (in: hFile=0x1354, lpBuffer=0xb88fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb88f85c, lpOverlapped=0x0 | out: lpBuffer=0xb88fb34*, lpNumberOfBytesRead=0xb88f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.942] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.942] ReadFile (in: hFile=0x1354, lpBuffer=0xb88fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb88f85c, lpOverlapped=0x0 | out: lpBuffer=0xb88fb34*, lpNumberOfBytesRead=0xb88f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.942] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0164.944] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0164.944] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xb88f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0164.944] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xb88f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xb88f828, pbKeyObject=0x0) returned 0x0 [0164.944] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xb88f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xb88f500) returned 0x0 [0164.945] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0164.945] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xb88f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xb88f500) returned 0x0 [0164.950] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.952] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] WriteFile (in: hFile=0x1354, lpBuffer=0xb88fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb88f830, lpOverlapped=0x0 | out: lpBuffer=0xb88fb34*, lpNumberOfBytesWritten=0xb88f830*=0x428, lpOverlapped=0x0) returned 1 [0164.953] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] ReadFile (in: hFile=0x1354, lpBuffer=0x2950000, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0xb88f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xb88f61c*=0xaac, lpOverlapped=0x0) returned 1 [0164.953] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffff554, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.954] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2950000, cbInput=0xaac, pPaddingInfo=0x0, pbIV=0xb88f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xb88f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xb88f848, pbOutput=0x2950000, pcbResult=0xb88f618) returned 0x0 [0164.954] WriteFile (in: hFile=0x1354, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0xb88f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xb88f61c*=0xab0, lpOverlapped=0x0) returned 1 [0164.954] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb88f60c | out: lpNewFilePointer=0x0) returned 1 [0164.954] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.954] WriteFile (in: hFile=0x1354, lpBuffer=0xb88f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb88f61c, lpOverlapped=0x0 | out: lpBuffer=0xb88f83c*, lpNumberOfBytesWritten=0xb88f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.954] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.954] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0164.954] CloseHandle (hObject=0x1354) returned 1 [0164.954] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.play")) returned 1 [0164.957] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1930 os_tid = 0x1d0c [0164.961] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.961] ReadFile (in: hFile=0x1328, lpBuffer=0xd30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd30f85c, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesRead=0xd30f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.963] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.963] ReadFile (in: hFile=0x1328, lpBuffer=0xd30fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd30f85c, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesRead=0xd30f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.963] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0164.965] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0164.965] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xd30f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0164.965] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xd30f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xd30f828, pbKeyObject=0x0) returned 0x0 [0164.965] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd30f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd30f500) returned 0x0 [0164.965] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0164.965] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd30f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd30f500) returned 0x0 [0164.970] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.972] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.972] WriteFile (in: hFile=0x1328, lpBuffer=0xd30fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd30f830, lpOverlapped=0x0 | out: lpBuffer=0xd30fb34*, lpNumberOfBytesWritten=0xd30f830*=0x428, lpOverlapped=0x0) returned 1 [0164.974] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.974] ReadFile (in: hFile=0x1328, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xd30f61c*=0x1c08, lpOverlapped=0x0) returned 1 [0164.975] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xffffe3f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.975] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2a50000, cbInput=0x1c08, pPaddingInfo=0x0, pbIV=0xd30f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xd30f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd30f848, pbOutput=0x2a50000, pcbResult=0xd30f618) returned 0x0 [0164.975] WriteFile (in: hFile=0x1328, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xd30f61c*=0x1c10, lpOverlapped=0x0) returned 1 [0164.975] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd30f60c | out: lpNewFilePointer=0x0) returned 1 [0164.976] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.976] WriteFile (in: hFile=0x1328, lpBuffer=0xd30f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd30f61c, lpOverlapped=0x0 | out: lpBuffer=0xd30f83c*, lpNumberOfBytesWritten=0xd30f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.976] SetFilePointerEx (in: hFile=0x1328, liDistanceToMove=0x1c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.976] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0164.976] CloseHandle (hObject=0x1328) returned 1 [0164.976] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.978] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.play")) returned 1 [0164.979] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1931 os_tid = 0x1d10 [0164.975] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.982] ReadFile (in: hFile=0x13e4, lpBuffer=0xd44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd44f85c, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesRead=0xd44f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.984] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.984] ReadFile (in: hFile=0x13e4, lpBuffer=0xd44fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd44f85c, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesRead=0xd44f85c*=0x428, lpOverlapped=0x0) returned 1 [0164.984] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0164.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0164.986] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xd44f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0164.986] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xd44f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xd44f828, pbKeyObject=0x0) returned 0x0 [0164.986] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd44f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd44f500) returned 0x0 [0164.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0164.986] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd44f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd44f500) returned 0x0 [0164.991] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.993] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.993] WriteFile (in: hFile=0x13e4, lpBuffer=0xd44fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd44f830, lpOverlapped=0x0 | out: lpBuffer=0xd44fb34*, lpNumberOfBytesWritten=0xd44f830*=0x428, lpOverlapped=0x0) returned 1 [0164.994] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.994] ReadFile (in: hFile=0x13e4, lpBuffer=0x2b50000, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xd44f61c*=0xda6, lpOverlapped=0x0) returned 1 [0164.994] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xfffff25a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.994] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2b50000, cbInput=0xda6, pPaddingInfo=0x0, pbIV=0xd44f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xd44f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd44f848, pbOutput=0x2b50000, pcbResult=0xd44f618) returned 0x0 [0164.994] WriteFile (in: hFile=0x13e4, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xd44f61c*=0xdb0, lpOverlapped=0x0) returned 1 [0164.995] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd44f60c | out: lpNewFilePointer=0x0) returned 1 [0164.995] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.995] WriteFile (in: hFile=0x13e4, lpBuffer=0xd44f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd44f61c, lpOverlapped=0x0 | out: lpBuffer=0xd44f83c*, lpNumberOfBytesWritten=0xd44f61c*=0x8, lpOverlapped=0x0) returned 1 [0164.995] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0xdb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.995] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0164.995] CloseHandle (hObject=0x13e4) returned 1 [0164.995] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0164.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.play")) returned 1 [0164.998] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1932 os_tid = 0x1d14 [0165.001] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.001] ReadFile (in: hFile=0x1110, lpBuffer=0xd58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd58f85c, lpOverlapped=0x0 | out: lpBuffer=0xd58fb34*, lpNumberOfBytesRead=0xd58f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.003] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.003] ReadFile (in: hFile=0x1110, lpBuffer=0xd58fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd58f85c, lpOverlapped=0x0 | out: lpBuffer=0xd58fb34*, lpNumberOfBytesRead=0xd58f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.003] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.005] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.005] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xd58f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0165.005] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xd58f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xd58f828, pbKeyObject=0x0) returned 0x0 [0165.005] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd58f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd58f500) returned 0x0 [0165.005] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.005] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd58f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd58f500) returned 0x0 [0165.011] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.013] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.013] WriteFile (in: hFile=0x1110, lpBuffer=0xd58fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd58f830, lpOverlapped=0x0 | out: lpBuffer=0xd58fb34*, lpNumberOfBytesWritten=0xd58f830*=0x428, lpOverlapped=0x0) returned 1 [0165.013] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.013] ReadFile (in: hFile=0x1110, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xd58f61c*=0x3a94, lpOverlapped=0x0) returned 1 [0165.015] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xffffc56c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.015] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2c50000, cbInput=0x3a94, pPaddingInfo=0x0, pbIV=0xd58f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xd58f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd58f848, pbOutput=0x2c50000, pcbResult=0xd58f618) returned 0x0 [0165.015] WriteFile (in: hFile=0x1110, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xd58f61c*=0x3aa0, lpOverlapped=0x0) returned 1 [0165.015] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd58f60c | out: lpNewFilePointer=0x0) returned 1 [0165.015] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.015] WriteFile (in: hFile=0x1110, lpBuffer=0xd58f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd58f61c, lpOverlapped=0x0 | out: lpBuffer=0xd58f83c*, lpNumberOfBytesWritten=0xd58f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.015] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x3aa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.015] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.015] CloseHandle (hObject=0x1110) returned 1 [0165.016] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.play")) returned 1 [0165.018] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1933 os_tid = 0x1d18 [0165.002] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.003] ReadFile (in: hFile=0x13b4, lpBuffer=0xd6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xd6cfb34*, lpNumberOfBytesRead=0xd6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.042] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.043] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.043] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xd6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0165.043] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xd6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xd6cf828, pbKeyObject=0x0) returned 0x0 [0165.043] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd6cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd6cf500) returned 0x0 [0165.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.044] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd6cf500) returned 0x0 [0165.049] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.051] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.051] WriteFile (in: hFile=0x13b4, lpBuffer=0xd6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd6cf830, lpOverlapped=0x0 | out: lpBuffer=0xd6cfb34*, lpNumberOfBytesWritten=0xd6cf830*=0x428, lpOverlapped=0x0) returned 1 [0165.051] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.051] ReadFile (in: hFile=0x13b4, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xd6cf61c*=0x752, lpOverlapped=0x0) returned 1 [0165.051] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffff8ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.052] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2d50000, cbInput=0x752, pPaddingInfo=0x0, pbIV=0xd6cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xd6cf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd6cf848, pbOutput=0x2d50000, pcbResult=0xd6cf618) returned 0x0 [0165.052] WriteFile (in: hFile=0x13b4, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xd6cf61c*=0x760, lpOverlapped=0x0) returned 1 [0165.052] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd6cf60c | out: lpNewFilePointer=0x0) returned 1 [0165.052] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.052] WriteFile (in: hFile=0x13b4, lpBuffer=0xd6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xd6cf83c*, lpNumberOfBytesWritten=0xd6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.052] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.052] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.052] CloseHandle (hObject=0x13b4) returned 1 [0165.052] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.054] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.play")) returned 1 [0165.055] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1934 os_tid = 0x1d1c [0165.022] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.022] ReadFile (in: hFile=0x1398, lpBuffer=0xd80fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd80f85c, lpOverlapped=0x0 | out: lpBuffer=0xd80fb34*, lpNumberOfBytesRead=0xd80f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.023] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.024] ReadFile (in: hFile=0x1398, lpBuffer=0xd80fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd80f85c, lpOverlapped=0x0 | out: lpBuffer=0xd80fb34*, lpNumberOfBytesRead=0xd80f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.024] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.025] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.025] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xd80f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0165.025] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xd80f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xd80f828, pbKeyObject=0x0) returned 0x0 [0165.025] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd80f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd80f500) returned 0x0 [0165.026] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.026] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd80f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd80f500) returned 0x0 [0165.031] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.033] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.033] WriteFile (in: hFile=0x1398, lpBuffer=0xd80fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd80f830, lpOverlapped=0x0 | out: lpBuffer=0xd80fb34*, lpNumberOfBytesWritten=0xd80f830*=0x428, lpOverlapped=0x0) returned 1 [0165.034] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.034] ReadFile (in: hFile=0x1398, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0xd80f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xd80f61c*=0xf6c, lpOverlapped=0x0) returned 1 [0165.034] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xfffff094, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.034] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2e50000, cbInput=0xf6c, pPaddingInfo=0x0, pbIV=0xd80f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xd80f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd80f848, pbOutput=0x2e50000, pcbResult=0xd80f618) returned 0x0 [0165.034] WriteFile (in: hFile=0x1398, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0xd80f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xd80f61c*=0xf70, lpOverlapped=0x0) returned 1 [0165.034] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd80f60c | out: lpNewFilePointer=0x0) returned 1 [0165.035] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.035] WriteFile (in: hFile=0x1398, lpBuffer=0xd80f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd80f61c, lpOverlapped=0x0 | out: lpBuffer=0xd80f83c*, lpNumberOfBytesWritten=0xd80f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.035] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0xf70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.035] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.035] CloseHandle (hObject=0x1398) returned 1 [0165.035] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.play")) returned 1 [0165.037] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1935 os_tid = 0x1d20 [0165.058] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.058] ReadFile (in: hFile=0x1410, lpBuffer=0xd94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd94f85c, lpOverlapped=0x0 | out: lpBuffer=0xd94fb34*, lpNumberOfBytesRead=0xd94f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.060] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.060] ReadFile (in: hFile=0x1410, lpBuffer=0xd94fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xd94f85c, lpOverlapped=0x0 | out: lpBuffer=0xd94fb34*, lpNumberOfBytesRead=0xd94f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.060] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.062] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xd94f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0165.062] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xd94f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xd94f828, pbKeyObject=0x0) returned 0x0 [0165.062] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xd94f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xd94f500) returned 0x0 [0165.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.062] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xd94f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xd94f500) returned 0x0 [0165.067] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.069] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.069] WriteFile (in: hFile=0x1410, lpBuffer=0xd94fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xd94f830, lpOverlapped=0x0 | out: lpBuffer=0xd94fb34*, lpNumberOfBytesWritten=0xd94f830*=0x428, lpOverlapped=0x0) returned 1 [0165.070] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.070] ReadFile (in: hFile=0x1410, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0xd94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xd94f61c*=0x292a, lpOverlapped=0x0) returned 1 [0165.071] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xffffd6d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.071] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2f50000, cbInput=0x292a, pPaddingInfo=0x0, pbIV=0xd94f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xd94f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xd94f848, pbOutput=0x2f50000, pcbResult=0xd94f618) returned 0x0 [0165.071] WriteFile (in: hFile=0x1410, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0xd94f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xd94f61c*=0x2930, lpOverlapped=0x0) returned 1 [0165.071] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xd94f60c | out: lpNewFilePointer=0x0) returned 1 [0165.071] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.072] WriteFile (in: hFile=0x1410, lpBuffer=0xd94f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xd94f61c, lpOverlapped=0x0 | out: lpBuffer=0xd94f83c*, lpNumberOfBytesWritten=0xd94f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.072] SetFilePointerEx (in: hFile=0x1410, liDistanceToMove=0x2930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.072] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.072] CloseHandle (hObject=0x1410) returned 1 [0165.072] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.074] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.play")) returned 1 [0165.075] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1936 os_tid = 0x1d24 [0165.078] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.078] ReadFile (in: hFile=0x13d4, lpBuffer=0xda8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda8f85c, lpOverlapped=0x0 | out: lpBuffer=0xda8fb34*, lpNumberOfBytesRead=0xda8f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.080] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.080] ReadFile (in: hFile=0x13d4, lpBuffer=0xda8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xda8f85c, lpOverlapped=0x0 | out: lpBuffer=0xda8fb34*, lpNumberOfBytesRead=0xda8f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.080] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.081] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.082] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0xda8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0165.082] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0xda8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0xda8f828, pbKeyObject=0x0) returned 0x0 [0165.082] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xda8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xda8f500) returned 0x0 [0165.082] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.082] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xda8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xda8f500) returned 0x0 [0165.087] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.089] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.089] WriteFile (in: hFile=0x13d4, lpBuffer=0xda8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xda8f830, lpOverlapped=0x0 | out: lpBuffer=0xda8fb34*, lpNumberOfBytesWritten=0xda8f830*=0x428, lpOverlapped=0x0) returned 1 [0165.090] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.090] ReadFile (in: hFile=0x13d4, lpBuffer=0x3050000, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0xda8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0xda8f61c*=0x108c, lpOverlapped=0x0) returned 1 [0165.090] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xffffef74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.090] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3050000, cbInput=0x108c, pPaddingInfo=0x0, pbIV=0xda8f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0xda8f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xda8f848, pbOutput=0x3050000, pcbResult=0xda8f618) returned 0x0 [0165.090] WriteFile (in: hFile=0x13d4, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0xda8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0xda8f61c*=0x1090, lpOverlapped=0x0) returned 1 [0165.090] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xda8f60c | out: lpNewFilePointer=0x0) returned 1 [0165.091] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.091] WriteFile (in: hFile=0x13d4, lpBuffer=0xda8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xda8f61c, lpOverlapped=0x0 | out: lpBuffer=0xda8f83c*, lpNumberOfBytesWritten=0xda8f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.091] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x1090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.091] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.091] CloseHandle (hObject=0x13d4) returned 1 [0165.091] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.play")) returned 1 [0165.094] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1937 os_tid = 0x1d28 [0165.097] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.097] ReadFile (in: hFile=0x13bc, lpBuffer=0xdbcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdbcf85c, lpOverlapped=0x0 | out: lpBuffer=0xdbcfb34*, lpNumberOfBytesRead=0xdbcf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.167] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.167] ReadFile (in: hFile=0x13bc, lpBuffer=0xdbcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdbcf85c, lpOverlapped=0x0 | out: lpBuffer=0xdbcfb34*, lpNumberOfBytesRead=0xdbcf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.229] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.230] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.231] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xdbcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0165.231] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xdbcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xdbcf828, pbKeyObject=0x0) returned 0x0 [0165.231] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xdbcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xdbcf500) returned 0x0 [0165.231] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.231] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xdbcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xdbcf500) returned 0x0 [0165.234] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.236] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.236] WriteFile (in: hFile=0x13bc, lpBuffer=0xdbcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdbcf830, lpOverlapped=0x0 | out: lpBuffer=0xdbcfb34*, lpNumberOfBytesWritten=0xdbcf830*=0x428, lpOverlapped=0x0) returned 1 [0165.237] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.237] ReadFile (in: hFile=0x13bc, lpBuffer=0x3150000, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0xdbcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xdbcf61c*=0x246a, lpOverlapped=0x0) returned 1 [0165.277] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xffffdb96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.277] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3150000, cbInput=0x246a, pPaddingInfo=0x0, pbIV=0xdbcf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xdbcf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xdbcf848, pbOutput=0x3150000, pcbResult=0xdbcf618) returned 0x0 [0165.277] WriteFile (in: hFile=0x13bc, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0xdbcf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xdbcf61c*=0x2470, lpOverlapped=0x0) returned 1 [0165.277] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdbcf60c | out: lpNewFilePointer=0x0) returned 1 [0165.277] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.277] WriteFile (in: hFile=0x13bc, lpBuffer=0xdbcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdbcf61c, lpOverlapped=0x0 | out: lpBuffer=0xdbcf83c*, lpNumberOfBytesWritten=0xdbcf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.277] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x2470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.277] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0165.277] CloseHandle (hObject=0x13bc) returned 1 [0165.277] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.play")) returned 1 [0165.279] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1938 os_tid = 0x1d2c [0165.099] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.099] ReadFile (in: hFile=0x1310, lpBuffer=0xdd0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdd0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdd0fb34*, lpNumberOfBytesRead=0xdd0f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.151] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.151] ReadFile (in: hFile=0x1310, lpBuffer=0xdd0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xdd0f85c, lpOverlapped=0x0 | out: lpBuffer=0xdd0fb34*, lpNumberOfBytesRead=0xdd0f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.151] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.153] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.153] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0xdd0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0165.153] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0xdd0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0xdd0f828, pbKeyObject=0x0) returned 0x0 [0165.153] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xdd0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xdd0f500) returned 0x0 [0165.153] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.153] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xdd0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xdd0f500) returned 0x0 [0165.158] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.160] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.160] WriteFile (in: hFile=0x1310, lpBuffer=0xdd0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xdd0f830, lpOverlapped=0x0 | out: lpBuffer=0xdd0fb34*, lpNumberOfBytesWritten=0xdd0f830*=0x428, lpOverlapped=0x0) returned 1 [0165.161] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.161] ReadFile (in: hFile=0x1310, lpBuffer=0x3250000, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0xdd0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0xdd0f61c*=0xdec, lpOverlapped=0x0) returned 1 [0165.161] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xfffff214, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.161] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3250000, cbInput=0xdec, pPaddingInfo=0x0, pbIV=0xdd0f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0xdd0f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xdd0f848, pbOutput=0x3250000, pcbResult=0xdd0f618) returned 0x0 [0165.161] WriteFile (in: hFile=0x1310, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0xdd0f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0xdd0f61c*=0xdf0, lpOverlapped=0x0) returned 1 [0165.161] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xdd0f60c | out: lpNewFilePointer=0x0) returned 1 [0165.161] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.161] WriteFile (in: hFile=0x1310, lpBuffer=0xdd0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xdd0f61c, lpOverlapped=0x0 | out: lpBuffer=0xdd0f83c*, lpNumberOfBytesWritten=0xdd0f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.161] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0xdf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.162] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.162] CloseHandle (hObject=0x1310) returned 1 [0165.162] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.164] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.play")) returned 1 [0165.164] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1939 os_tid = 0x1d30 [0165.100] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.100] ReadFile (in: hFile=0x1380, lpBuffer=0xde4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xde4f85c, lpOverlapped=0x0 | out: lpBuffer=0xde4fb34*, lpNumberOfBytesRead=0xde4f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.133] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.133] ReadFile (in: hFile=0x1380, lpBuffer=0xde4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xde4f85c, lpOverlapped=0x0 | out: lpBuffer=0xde4fb34*, lpNumberOfBytesRead=0xde4f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.135] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xde4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0165.135] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xde4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xde4f828, pbKeyObject=0x0) returned 0x0 [0165.135] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xde4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xde4f500) returned 0x0 [0165.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.135] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xde4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xde4f500) returned 0x0 [0165.140] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.142] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.142] WriteFile (in: hFile=0x1380, lpBuffer=0xde4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xde4f830, lpOverlapped=0x0 | out: lpBuffer=0xde4fb34*, lpNumberOfBytesWritten=0xde4f830*=0x428, lpOverlapped=0x0) returned 1 [0165.143] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.143] ReadFile (in: hFile=0x1380, lpBuffer=0x3350000, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0xde4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xde4f61c*=0x976, lpOverlapped=0x0) returned 1 [0165.143] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffff68a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.143] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3350000, cbInput=0x976, pPaddingInfo=0x0, pbIV=0xde4f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xde4f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xde4f848, pbOutput=0x3350000, pcbResult=0xde4f618) returned 0x0 [0165.143] WriteFile (in: hFile=0x1380, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0xde4f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xde4f61c*=0x980, lpOverlapped=0x0) returned 1 [0165.143] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xde4f60c | out: lpNewFilePointer=0x0) returned 1 [0165.143] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.144] WriteFile (in: hFile=0x1380, lpBuffer=0xde4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xde4f61c, lpOverlapped=0x0 | out: lpBuffer=0xde4f83c*, lpNumberOfBytesWritten=0xde4f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.144] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.144] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.144] CloseHandle (hObject=0x1380) returned 1 [0165.144] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\classic1.wmf.play")) returned 1 [0165.146] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1940 os_tid = 0x1d34 [0165.102] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.102] ReadFile (in: hFile=0x1450, lpBuffer=0xe18fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe18f85c, lpOverlapped=0x0 | out: lpBuffer=0xe18fb34*, lpNumberOfBytesRead=0xe18f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.114] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.114] ReadFile (in: hFile=0x1450, lpBuffer=0xe18fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe18f85c, lpOverlapped=0x0 | out: lpBuffer=0xe18fb34*, lpNumberOfBytesRead=0xe18f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.114] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.117] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.117] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0xe18f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0165.117] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0xe18f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0xe18f828, pbKeyObject=0x0) returned 0x0 [0165.117] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe18f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe18f500) returned 0x0 [0165.118] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.118] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe18f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe18f500) returned 0x0 [0165.123] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.125] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.125] WriteFile (in: hFile=0x1450, lpBuffer=0xe18fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe18f830, lpOverlapped=0x0 | out: lpBuffer=0xe18fb34*, lpNumberOfBytesWritten=0xe18f830*=0x428, lpOverlapped=0x0) returned 1 [0165.126] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.126] ReadFile (in: hFile=0x1450, lpBuffer=0x3450000, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0xe18f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0xe18f61c*=0x8d6, lpOverlapped=0x0) returned 1 [0165.126] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffff72a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.126] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3450000, cbInput=0x8d6, pPaddingInfo=0x0, pbIV=0xe18f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0xe18f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0xe18f848, pbOutput=0x3450000, pcbResult=0xe18f618) returned 0x0 [0165.126] WriteFile (in: hFile=0x1450, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0xe18f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0xe18f61c*=0x8e0, lpOverlapped=0x0) returned 1 [0165.126] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe18f60c | out: lpNewFilePointer=0x0) returned 1 [0165.126] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.127] WriteFile (in: hFile=0x1450, lpBuffer=0xe18f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe18f61c, lpOverlapped=0x0 | out: lpBuffer=0xe18f83c*, lpNumberOfBytesWritten=0xe18f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.127] SetFilePointerEx (in: hFile=0x1450, liDistanceToMove=0x8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.127] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.127] CloseHandle (hObject=0x1450) returned 1 [0165.127] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\classic2.wmf.play")) returned 1 [0165.129] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1941 os_tid = 0x1d38 [0165.104] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.104] ReadFile (in: hFile=0x1458, lpBuffer=0xe28fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe28f85c, lpOverlapped=0x0 | out: lpBuffer=0xe28fb34*, lpNumberOfBytesRead=0xe28f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.217] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.217] ReadFile (in: hFile=0x1458, lpBuffer=0xe28fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe28f85c, lpOverlapped=0x0 | out: lpBuffer=0xe28fb34*, lpNumberOfBytesRead=0xe28f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.217] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.218] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.218] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0xe28f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0165.218] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0xe28f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0xe28f828, pbKeyObject=0x0) returned 0x0 [0165.218] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe28f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe28f500) returned 0x0 [0165.218] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.218] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe28f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe28f500) returned 0x0 [0165.222] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.223] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.223] WriteFile (in: hFile=0x1458, lpBuffer=0xe28fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe28f830, lpOverlapped=0x0 | out: lpBuffer=0xe28fb34*, lpNumberOfBytesWritten=0xe28f830*=0x428, lpOverlapped=0x0) returned 1 [0165.224] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.224] ReadFile (in: hFile=0x1458, lpBuffer=0x3550000, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0xe28f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0xe28f61c*=0x8d6, lpOverlapped=0x0) returned 1 [0165.224] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffff72a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.224] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3550000, cbInput=0x8d6, pPaddingInfo=0x0, pbIV=0xe28f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0xe28f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xe28f848, pbOutput=0x3550000, pcbResult=0xe28f618) returned 0x0 [0165.224] WriteFile (in: hFile=0x1458, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0xe28f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0xe28f61c*=0x8e0, lpOverlapped=0x0) returned 1 [0165.224] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe28f60c | out: lpNewFilePointer=0x0) returned 1 [0165.224] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.224] WriteFile (in: hFile=0x1458, lpBuffer=0xe28f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe28f61c, lpOverlapped=0x0 | out: lpBuffer=0xe28f83c*, lpNumberOfBytesWritten=0xe28f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.224] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.224] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0165.224] CloseHandle (hObject=0x1458) returned 1 [0165.224] VirtualAlloc (lpAddress=0x0, dwSize=0x97, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\clip.wmf.play")) returned 1 [0165.227] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1942 os_tid = 0x1d3c [0165.106] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.106] ReadFile (in: hFile=0x1430, lpBuffer=0xe38fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe38f85c, lpOverlapped=0x0 | out: lpBuffer=0xe38fb34*, lpNumberOfBytesRead=0xe38f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.206] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.207] ReadFile (in: hFile=0x1430, lpBuffer=0xe38fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xe38f85c, lpOverlapped=0x0 | out: lpBuffer=0xe38fb34*, lpNumberOfBytesRead=0xe38f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.207] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.208] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.208] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0xe38f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0165.208] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0xe38f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0xe38f828, pbKeyObject=0x0) returned 0x0 [0165.208] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xe38f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xe38f500) returned 0x0 [0165.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.209] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xe38f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xe38f500) returned 0x0 [0165.214] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.216] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.216] WriteFile (in: hFile=0x1430, lpBuffer=0xe38fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xe38f830, lpOverlapped=0x0 | out: lpBuffer=0xe38fb34*, lpNumberOfBytesWritten=0xe38f830*=0x428, lpOverlapped=0x0) returned 1 [0165.216] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.216] ReadFile (in: hFile=0x1430, lpBuffer=0x3650000, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0xe38f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0xe38f61c*=0x1b3a, lpOverlapped=0x0) returned 1 [0165.282] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xffffe4c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.282] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3650000, cbInput=0x1b3a, pPaddingInfo=0x0, pbIV=0xe38f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0xe38f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0xe38f848, pbOutput=0x3650000, pcbResult=0xe38f618) returned 0x0 [0165.282] WriteFile (in: hFile=0x1430, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0xe38f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0xe38f61c*=0x1b40, lpOverlapped=0x0) returned 1 [0165.282] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xe38f60c | out: lpNewFilePointer=0x0) returned 1 [0165.282] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.282] WriteFile (in: hFile=0x1430, lpBuffer=0xe38f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe38f61c, lpOverlapped=0x0 | out: lpBuffer=0xe38f83c*, lpNumberOfBytesWritten=0xe38f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.282] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x1b40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.282] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0165.283] CloseHandle (hObject=0x1430) returned 1 [0165.283] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.play")) returned 1 [0165.284] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1943 os_tid = 0x1d40 [0165.107] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.108] ReadFile (in: hFile=0x1440, lpBuffer=0x2057fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2057f85c, lpOverlapped=0x0 | out: lpBuffer=0x2057fb34*, lpNumberOfBytesRead=0x2057f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.114] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.114] ReadFile (in: hFile=0x1440, lpBuffer=0x2057fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2057f85c, lpOverlapped=0x0 | out: lpBuffer=0x2057fb34*, lpNumberOfBytesRead=0x2057f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.168] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.169] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2057f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0165.170] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2057f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2057f828, pbKeyObject=0x0) returned 0x0 [0165.170] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2057f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2057f500) returned 0x0 [0165.170] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.170] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2057f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2057f500) returned 0x0 [0165.175] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.177] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.177] WriteFile (in: hFile=0x1440, lpBuffer=0x2057fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2057f830, lpOverlapped=0x0 | out: lpBuffer=0x2057fb34*, lpNumberOfBytesWritten=0x2057f830*=0x428, lpOverlapped=0x0) returned 1 [0165.177] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.177] ReadFile (in: hFile=0x1440, lpBuffer=0x3750000, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x2057f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2057f61c*=0x1496, lpOverlapped=0x0) returned 1 [0165.177] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xffffeb6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.177] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3750000, cbInput=0x1496, pPaddingInfo=0x0, pbIV=0x2057f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2057f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2057f848, pbOutput=0x3750000, pcbResult=0x2057f618) returned 0x0 [0165.178] WriteFile (in: hFile=0x1440, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2057f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2057f61c*=0x14a0, lpOverlapped=0x0) returned 1 [0165.178] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2057f60c | out: lpNewFilePointer=0x0) returned 1 [0165.178] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.178] WriteFile (in: hFile=0x1440, lpBuffer=0x2057f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2057f61c, lpOverlapped=0x0 | out: lpBuffer=0x2057f83c*, lpNumberOfBytesWritten=0x2057f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.178] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x14a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.178] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.178] CloseHandle (hObject=0x1440) returned 1 [0165.178] VirtualAlloc (lpAddress=0x0, dwSize=0x99, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\crane.wmf.play")) returned 1 [0165.181] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1944 os_tid = 0x1d44 [0165.109] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.109] ReadFile (in: hFile=0x13ec, lpBuffer=0x2067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2067f85c, lpOverlapped=0x0 | out: lpBuffer=0x2067fb34*, lpNumberOfBytesRead=0x2067f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.196] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.196] ReadFile (in: hFile=0x13ec, lpBuffer=0x2067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2067f85c, lpOverlapped=0x0 | out: lpBuffer=0x2067fb34*, lpNumberOfBytesRead=0x2067f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.196] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.198] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.198] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2067f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0165.198] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2067f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2067f828, pbKeyObject=0x0) returned 0x0 [0165.198] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2067f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2067f500) returned 0x0 [0165.198] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.198] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2067f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2067f500) returned 0x0 [0165.203] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.205] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.205] WriteFile (in: hFile=0x13ec, lpBuffer=0x2067fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2067f830, lpOverlapped=0x0 | out: lpBuffer=0x2067fb34*, lpNumberOfBytesWritten=0x2067f830*=0x428, lpOverlapped=0x0) returned 1 [0165.206] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.206] ReadFile (in: hFile=0x13ec, lpBuffer=0x3850000, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x2067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2067f61c*=0xc18a, lpOverlapped=0x0) returned 1 [0165.287] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xffff3e76, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.287] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3850000, cbInput=0xc18a, pPaddingInfo=0x0, pbIV=0x2067f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2067f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2067f848, pbOutput=0x3850000, pcbResult=0x2067f618) returned 0x0 [0165.287] WriteFile (in: hFile=0x13ec, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2067f61c*=0xc190, lpOverlapped=0x0) returned 1 [0165.287] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2067f60c | out: lpNewFilePointer=0x0) returned 1 [0165.288] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.288] WriteFile (in: hFile=0x13ec, lpBuffer=0x2067f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2067f61c, lpOverlapped=0x0 | out: lpBuffer=0x2067f83c*, lpNumberOfBytesWritten=0x2067f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.288] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xc190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.288] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.288] CloseHandle (hObject=0x13ec) returned 1 [0165.288] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\craninst.wmf.play")) returned 1 [0165.293] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1945 os_tid = 0x1d48 [0165.111] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.111] ReadFile (in: hFile=0x135c, lpBuffer=0x2077fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2077f85c, lpOverlapped=0x0 | out: lpBuffer=0x2077fb34*, lpNumberOfBytesRead=0x2077f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.184] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.184] ReadFile (in: hFile=0x135c, lpBuffer=0x2077fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2077f85c, lpOverlapped=0x0 | out: lpBuffer=0x2077fb34*, lpNumberOfBytesRead=0x2077f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.184] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.185] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.185] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2077f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0165.185] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2077f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2077f828, pbKeyObject=0x0) returned 0x0 [0165.185] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2077f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2077f500) returned 0x0 [0165.185] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.185] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2077f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2077f500) returned 0x0 [0165.189] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.190] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.190] WriteFile (in: hFile=0x135c, lpBuffer=0x2077fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2077f830, lpOverlapped=0x0 | out: lpBuffer=0x2077fb34*, lpNumberOfBytesWritten=0x2077f830*=0x428, lpOverlapped=0x0) returned 1 [0165.190] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.191] ReadFile (in: hFile=0x135c, lpBuffer=0x3950000, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x2077f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2077f61c*=0xb96, lpOverlapped=0x0) returned 1 [0165.191] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffff46a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.191] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3950000, cbInput=0xb96, pPaddingInfo=0x0, pbIV=0x2077f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2077f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2077f848, pbOutput=0x3950000, pcbResult=0x2077f618) returned 0x0 [0165.191] WriteFile (in: hFile=0x135c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2077f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2077f61c*=0xba0, lpOverlapped=0x0) returned 1 [0165.191] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2077f60c | out: lpNewFilePointer=0x0) returned 1 [0165.191] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.191] WriteFile (in: hFile=0x135c, lpBuffer=0x2077f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2077f61c, lpOverlapped=0x0 | out: lpBuffer=0x2077f83c*, lpNumberOfBytesWritten=0x2077f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.191] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0xba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.191] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.191] CloseHandle (hObject=0x135c) returned 1 [0165.191] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cup.wmf.play")) returned 1 [0165.193] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1946 os_tid = 0x1d4c [0165.113] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.237] ReadFile (in: hFile=0x10e0, lpBuffer=0x2087fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2087f85c, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesRead=0x2087f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.238] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.238] ReadFile (in: hFile=0x10e0, lpBuffer=0x2087fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2087f85c, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesRead=0x2087f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.238] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.240] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.240] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2087f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0165.240] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2087f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2087f828, pbKeyObject=0x0) returned 0x0 [0165.240] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2087f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2087f500) returned 0x0 [0165.240] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.240] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2087f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2087f500) returned 0x0 [0165.244] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.245] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.245] WriteFile (in: hFile=0x10e0, lpBuffer=0x2087fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2087f830, lpOverlapped=0x0 | out: lpBuffer=0x2087fb34*, lpNumberOfBytesWritten=0x2087f830*=0x428, lpOverlapped=0x0) returned 1 [0165.246] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.246] ReadFile (in: hFile=0x10e0, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2087f61c*=0x2856, lpOverlapped=0x0) returned 1 [0165.246] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xffffd7aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.246] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x3a50000, cbInput=0x2856, pPaddingInfo=0x0, pbIV=0x2087f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2087f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x2087f848, pbOutput=0x3a50000, pcbResult=0x2087f618) returned 0x0 [0165.246] WriteFile (in: hFile=0x10e0, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2087f61c*=0x2860, lpOverlapped=0x0) returned 1 [0165.247] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2087f60c | out: lpNewFilePointer=0x0) returned 1 [0165.247] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.247] WriteFile (in: hFile=0x10e0, lpBuffer=0x2087f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2087f61c, lpOverlapped=0x0 | out: lpBuffer=0x2087f83c*, lpNumberOfBytesWritten=0x2087f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.247] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x2860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.247] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0165.247] CloseHandle (hObject=0x10e0) returned 1 [0165.247] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.play")) returned 1 [0165.249] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1947 os_tid = 0x1d50 [0165.252] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.252] ReadFile (in: hFile=0x1390, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.358] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.358] ReadFile (in: hFile=0x1390, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.358] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.360] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x209bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0165.360] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x209bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x209bf828, pbKeyObject=0x0) returned 0x0 [0165.360] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x209bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x209bf500) returned 0x0 [0165.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.360] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x209bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x209bf500) returned 0x0 [0165.363] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.365] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.365] WriteFile (in: hFile=0x1390, lpBuffer=0x209bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x209bf830, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesWritten=0x209bf830*=0x428, lpOverlapped=0x0) returned 1 [0165.366] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.366] ReadFile (in: hFile=0x1390, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x209bf61c*=0x7992, lpOverlapped=0x0) returned 1 [0165.871] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xffff866e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.871] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3b50000, cbInput=0x7992, pPaddingInfo=0x0, pbIV=0x209bf848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x209bf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x209bf848, pbOutput=0x3b50000, pcbResult=0x209bf618) returned 0x0 [0165.871] WriteFile (in: hFile=0x1390, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x209bf61c*=0x79a0, lpOverlapped=0x0) returned 1 [0165.871] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x209bf60c | out: lpNewFilePointer=0x0) returned 1 [0165.871] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.871] WriteFile (in: hFile=0x1390, lpBuffer=0x209bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x209bf83c*, lpNumberOfBytesWritten=0x209bf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.871] SetFilePointerEx (in: hFile=0x1390, liDistanceToMove=0x79a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.871] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0165.871] CloseHandle (hObject=0x1390) returned 1 [0166.045] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27890000 [0166.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.play")) returned 1 [0166.339] VirtualFree (lpAddress=0x27890000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1948 os_tid = 0x1d54 [0165.253] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.253] ReadFile (in: hFile=0x1460, lpBuffer=0x20cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20cbfb34*, lpNumberOfBytesRead=0x20cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.255] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.255] ReadFile (in: hFile=0x1460, lpBuffer=0x20cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20cbfb34*, lpNumberOfBytesRead=0x20cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.255] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.256] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.257] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x20cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0165.257] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x20cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x20cbf828, pbKeyObject=0x0) returned 0x0 [0165.257] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x20cbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x20cbf500) returned 0x0 [0165.257] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.257] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x20cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x20cbf500) returned 0x0 [0165.272] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.275] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.275] WriteFile (in: hFile=0x1460, lpBuffer=0x20cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20cbf830, lpOverlapped=0x0 | out: lpBuffer=0x20cbfb34*, lpNumberOfBytesWritten=0x20cbf830*=0x428, lpOverlapped=0x0) returned 1 [0165.276] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.276] ReadFile (in: hFile=0x1460, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x20cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x20cbf61c*=0x2040, lpOverlapped=0x0) returned 1 [0165.295] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xffffdfc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.295] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x3c50000, cbInput=0x2040, pPaddingInfo=0x0, pbIV=0x20cbf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x20cbf618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x20cbf848, pbOutput=0x3c50000, pcbResult=0x20cbf618) returned 0x0 [0165.295] WriteFile (in: hFile=0x1460, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x20cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x20cbf61c*=0x2050, lpOverlapped=0x0) returned 1 [0165.296] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20cbf60c | out: lpNewFilePointer=0x0) returned 1 [0165.296] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.296] WriteFile (in: hFile=0x1460, lpBuffer=0x20cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20cbf83c*, lpNumberOfBytesWritten=0x20cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.296] SetFilePointerEx (in: hFile=0x1460, liDistanceToMove=0x2050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.296] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0165.296] CloseHandle (hObject=0x1460) returned 1 [0165.296] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.play")) returned 1 [0165.298] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1949 os_tid = 0x1d58 [0165.300] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.300] ReadFile (in: hFile=0x136c, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.518] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.519] ReadFile (in: hFile=0x136c, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.519] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0165.520] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0165.520] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x20dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0165.520] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x20dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x20dbf828, pbKeyObject=0x0) returned 0x0 [0165.520] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x20dbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x20dbf500) returned 0x0 [0165.521] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0165.521] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x20dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x20dbf500) returned 0x0 [0165.524] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.526] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x136c, lpBuffer=0x20dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20dbf830, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesWritten=0x20dbf830*=0x428, lpOverlapped=0x0) returned 1 [0165.526] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.527] ReadFile (in: hFile=0x136c, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x20dbf61c*=0x73bc, lpOverlapped=0x0) returned 1 [0165.997] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xffff8c44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.997] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3d50000, cbInput=0x73bc, pPaddingInfo=0x0, pbIV=0x20dbf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x20dbf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x20dbf848, pbOutput=0x3d50000, pcbResult=0x20dbf618) returned 0x0 [0165.997] WriteFile (in: hFile=0x136c, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x20dbf61c*=0x73c0, lpOverlapped=0x0) returned 1 [0165.997] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20dbf60c | out: lpNewFilePointer=0x0) returned 1 [0165.998] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.998] WriteFile (in: hFile=0x136c, lpBuffer=0x20dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20dbf83c*, lpNumberOfBytesWritten=0x20dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.998] SetFilePointerEx (in: hFile=0x136c, liDistanceToMove=0x73c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.998] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0165.998] CloseHandle (hObject=0x136c) returned 1 [0166.009] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17be0000 [0166.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.play")) returned 1 [0166.571] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1950 os_tid = 0x1d5c [0165.301] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.302] ReadFile (in: hFile=0x134c, lpBuffer=0x20ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesRead=0x20ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.510] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.510] ReadFile (in: hFile=0x134c, lpBuffer=0x20ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesRead=0x20ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0165.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0165.512] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x20ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0165.512] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x20ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x20ebf828, pbKeyObject=0x0) returned 0x0 [0165.512] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x20ebf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x20ebf500) returned 0x0 [0165.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0165.512] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x20ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x20ebf500) returned 0x0 [0165.516] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.517] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.517] WriteFile (in: hFile=0x134c, lpBuffer=0x20ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20ebf830, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesWritten=0x20ebf830*=0x428, lpOverlapped=0x0) returned 1 [0165.518] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.518] ReadFile (in: hFile=0x134c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x20ebf61c*=0xa82, lpOverlapped=0x0) returned 1 [0165.518] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff57e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.518] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3e50000, cbInput=0xa82, pPaddingInfo=0x0, pbIV=0x20ebf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x20ebf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x20ebf848, pbOutput=0x3e50000, pcbResult=0x20ebf618) returned 0x0 [0165.518] WriteFile (in: hFile=0x134c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x20ebf61c*=0xa90, lpOverlapped=0x0) returned 1 [0165.518] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20ebf60c | out: lpNewFilePointer=0x0) returned 1 [0165.518] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.518] WriteFile (in: hFile=0x134c, lpBuffer=0x20ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x20ebf83c*, lpNumberOfBytesWritten=0x20ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.518] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xa90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.518] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0165.518] CloseHandle (hObject=0x134c) returned 1 [0165.546] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0165.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.play")) returned 1 [0166.616] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1951 os_tid = 0x1d60 [0165.303] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.303] ReadFile (in: hFile=0x10d8, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.499] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.499] ReadFile (in: hFile=0x10d8, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.499] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0165.501] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0165.501] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x20fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0165.501] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x20fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x20fbf828, pbKeyObject=0x0) returned 0x0 [0165.501] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x20fbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x20fbf500) returned 0x0 [0165.501] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0165.501] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x20fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x20fbf500) returned 0x0 [0165.504] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.507] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.507] WriteFile (in: hFile=0x10d8, lpBuffer=0x20fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20fbf830, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesWritten=0x20fbf830*=0x428, lpOverlapped=0x0) returned 1 [0165.507] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.507] ReadFile (in: hFile=0x10d8, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x20fbf61c*=0xb10, lpOverlapped=0x0) returned 1 [0165.507] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0xfffff4f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.507] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3f50000, cbInput=0xb10, pPaddingInfo=0x0, pbIV=0x20fbf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x20fbf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x20fbf848, pbOutput=0x3f50000, pcbResult=0x20fbf618) returned 0x0 [0165.507] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x20fbf61c*=0xb20, lpOverlapped=0x0) returned 1 [0165.508] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20fbf60c | out: lpNewFilePointer=0x0) returned 1 [0165.508] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.508] WriteFile (in: hFile=0x10d8, lpBuffer=0x20fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20fbf83c*, lpNumberOfBytesWritten=0x20fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.508] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0xb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.508] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0165.508] CloseHandle (hObject=0x10d8) returned 1 [0165.508] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0165.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.play")) returned 1 [0166.602] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1952 os_tid = 0x1d64 [0165.304] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.304] ReadFile (in: hFile=0x10d0, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.546] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.546] ReadFile (in: hFile=0x10d0, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.984] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.985] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x210ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0165.985] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x210ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x210ff828, pbKeyObject=0x0) returned 0x0 [0165.985] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x210ff500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x210ff500) returned 0x0 [0165.985] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.985] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x210ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x210ff500) returned 0x0 [0165.989] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.994] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.994] WriteFile (in: hFile=0x10d0, lpBuffer=0x210ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210ff830, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesWritten=0x210ff830*=0x428, lpOverlapped=0x0) returned 1 [0165.996] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.996] ReadFile (in: hFile=0x10d0, lpBuffer=0x4050000, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x210ff61c*=0x9456, lpOverlapped=0x0) returned 1 [0166.062] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xffff6baa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.062] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4050000, cbInput=0x9456, pPaddingInfo=0x0, pbIV=0x210ff848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x210ff618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x210ff848, pbOutput=0x4050000, pcbResult=0x210ff618) returned 0x0 [0166.062] WriteFile (in: hFile=0x10d0, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x210ff61c*=0x9460, lpOverlapped=0x0) returned 1 [0166.062] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210ff60c | out: lpNewFilePointer=0x0) returned 1 [0166.062] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.062] WriteFile (in: hFile=0x10d0, lpBuffer=0x210ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x210ff83c*, lpNumberOfBytesWritten=0x210ff61c*=0x8, lpOverlapped=0x0) returned 1 [0166.062] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x9460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.062] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0166.062] CloseHandle (hObject=0x10d0) returned 1 [0166.071] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27950000 [0166.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.play")) returned 1 [0166.087] VirtualFree (lpAddress=0x27950000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1953 os_tid = 0x1d68 [0165.306] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.306] ReadFile (in: hFile=0x10c8, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.527] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.527] ReadFile (in: hFile=0x10c8, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.527] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0165.529] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0165.529] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x2123f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0165.529] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x2123f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x2123f828, pbKeyObject=0x0) returned 0x0 [0165.529] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2123f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2123f500) returned 0x0 [0165.529] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0165.529] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2123f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2123f500) returned 0x0 [0165.532] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.535] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.535] WriteFile (in: hFile=0x10c8, lpBuffer=0x2123fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2123f830, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesWritten=0x2123f830*=0x428, lpOverlapped=0x0) returned 1 [0165.545] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.545] ReadFile (in: hFile=0x10c8, lpBuffer=0x4150000, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2123f61c*=0x9c5e, lpOverlapped=0x0) returned 1 [0165.950] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xffff63a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.950] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x4150000, cbInput=0x9c5e, pPaddingInfo=0x0, pbIV=0x2123f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2123f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x2123f848, pbOutput=0x4150000, pcbResult=0x2123f618) returned 0x0 [0165.950] WriteFile (in: hFile=0x10c8, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2123f61c*=0x9c60, lpOverlapped=0x0) returned 1 [0165.950] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2123f60c | out: lpNewFilePointer=0x0) returned 1 [0165.951] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.951] WriteFile (in: hFile=0x10c8, lpBuffer=0x2123f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x2123f83c*, lpNumberOfBytesWritten=0x2123f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.951] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x9c60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.951] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0165.951] CloseHandle (hObject=0x10c8) returned 1 [0166.106] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x284a0000 [0166.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.play")) returned 1 [0166.607] VirtualFree (lpAddress=0x284a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1954 os_tid = 0x1d6c [0165.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.308] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.309] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x2137f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0165.309] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x2137f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x2137f828, pbKeyObject=0x0) returned 0x0 [0165.309] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2137f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2137f500) returned 0x0 [0165.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.309] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2137f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2137f500) returned 0x0 [0165.312] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.314] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.314] WriteFile (in: hFile=0x10c0, lpBuffer=0x2137fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2137f830, lpOverlapped=0x0 | out: lpBuffer=0x2137fb34*, lpNumberOfBytesWritten=0x2137f830*=0x428, lpOverlapped=0x0) returned 1 [0165.316] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.316] ReadFile (in: hFile=0x10c0, lpBuffer=0x4250000, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x2137f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x2137f61c*=0x318, lpOverlapped=0x0) returned 1 [0165.316] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffffce8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.316] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4250000, cbInput=0x318, pPaddingInfo=0x0, pbIV=0x2137f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x2137f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2137f848, pbOutput=0x4250000, pcbResult=0x2137f618) returned 0x0 [0165.316] WriteFile (in: hFile=0x10c0, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2137f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x2137f61c*=0x320, lpOverlapped=0x0) returned 1 [0165.316] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2137f60c | out: lpNewFilePointer=0x0) returned 1 [0165.316] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.316] WriteFile (in: hFile=0x10c0, lpBuffer=0x2137f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2137f61c, lpOverlapped=0x0 | out: lpBuffer=0x2137f83c*, lpNumberOfBytesWritten=0x2137f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.316] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.316] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0165.316] CloseHandle (hObject=0x10c0) returned 1 [0165.317] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.play")) returned 1 [0165.318] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1955 os_tid = 0x1d70 [0165.321] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.321] ReadFile (in: hFile=0x10b8, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.549] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.549] ReadFile (in: hFile=0x10b8, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.998] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0166.001] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0166.001] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x214bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0166.001] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x214bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x214bf828, pbKeyObject=0x0) returned 0x0 [0166.001] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x214bf500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x214bf500) returned 0x0 [0166.001] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0166.001] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x214bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x214bf500) returned 0x0 [0166.005] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.007] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.007] WriteFile (in: hFile=0x10b8, lpBuffer=0x214bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x214bf830, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesWritten=0x214bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.008] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.008] ReadFile (in: hFile=0x10b8, lpBuffer=0x4350000, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x214bf61c*=0x44b0, lpOverlapped=0x0) returned 1 [0166.064] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xffffbb50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.064] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4350000, cbInput=0x44b0, pPaddingInfo=0x0, pbIV=0x214bf848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x214bf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x214bf848, pbOutput=0x4350000, pcbResult=0x214bf618) returned 0x0 [0166.064] WriteFile (in: hFile=0x10b8, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x214bf61c*=0x44c0, lpOverlapped=0x0) returned 1 [0166.064] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x214bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.064] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.064] WriteFile (in: hFile=0x10b8, lpBuffer=0x214bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x214bf83c*, lpNumberOfBytesWritten=0x214bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.064] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x44c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.064] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.064] CloseHandle (hObject=0x10b8) returned 1 [0166.075] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27970000 [0166.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.play")) returned 1 [0166.084] VirtualFree (lpAddress=0x27970000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1956 os_tid = 0x1d74 [0165.322] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.322] ReadFile (in: hFile=0x10b0, lpBuffer=0x215ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215ff85c, lpOverlapped=0x0 | out: lpBuffer=0x215ffb34*, lpNumberOfBytesRead=0x215ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.480] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.480] ReadFile (in: hFile=0x10b0, lpBuffer=0x215ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215ff85c, lpOverlapped=0x0 | out: lpBuffer=0x215ffb34*, lpNumberOfBytesRead=0x215ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.480] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0165.485] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0165.486] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x215ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0165.486] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x215ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x215ff828, pbKeyObject=0x0) returned 0x0 [0165.486] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x215ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x215ff500) returned 0x0 [0165.486] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0165.486] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x215ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x215ff500) returned 0x0 [0165.489] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.497] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.497] WriteFile (in: hFile=0x10b0, lpBuffer=0x215ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x215ff830, lpOverlapped=0x0 | out: lpBuffer=0x215ffb34*, lpNumberOfBytesWritten=0x215ff830*=0x428, lpOverlapped=0x0) returned 1 [0165.499] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.499] ReadFile (in: hFile=0x10b0, lpBuffer=0x4450000, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x215ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x215ff61c*=0x1e94, lpOverlapped=0x0) returned 1 [0165.550] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xffffe16c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.550] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4450000, cbInput=0x1e94, pPaddingInfo=0x0, pbIV=0x215ff848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x215ff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x215ff848, pbOutput=0x4450000, pcbResult=0x215ff618) returned 0x0 [0165.550] WriteFile (in: hFile=0x10b0, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x215ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x215ff61c*=0x1ea0, lpOverlapped=0x0) returned 1 [0165.550] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x215ff60c | out: lpNewFilePointer=0x0) returned 1 [0165.550] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.550] WriteFile (in: hFile=0x10b0, lpBuffer=0x215ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x215ff61c, lpOverlapped=0x0 | out: lpBuffer=0x215ff83c*, lpNumberOfBytesWritten=0x215ff61c*=0x8, lpOverlapped=0x0) returned 1 [0165.550] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x1ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.550] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0165.550] CloseHandle (hObject=0x10b0) returned 1 [0165.579] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0165.580] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.play")) returned 1 [0166.619] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1957 os_tid = 0x1d78 [0165.323] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.323] ReadFile (in: hFile=0x10a8, lpBuffer=0x2173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2173f85c, lpOverlapped=0x0 | out: lpBuffer=0x2173fb34*, lpNumberOfBytesRead=0x2173f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.549] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.549] ReadFile (in: hFile=0x10a8, lpBuffer=0x2173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2173f85c, lpOverlapped=0x0 | out: lpBuffer=0x2173fb34*, lpNumberOfBytesRead=0x2173f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.951] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.954] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.954] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x2173f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0165.954] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x2173f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x2173f828, pbKeyObject=0x0) returned 0x0 [0165.954] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2173f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2173f500) returned 0x0 [0165.954] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.954] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2173f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2173f500) returned 0x0 [0165.957] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.959] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.959] WriteFile (in: hFile=0x10a8, lpBuffer=0x2173fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2173f830, lpOverlapped=0x0 | out: lpBuffer=0x2173fb34*, lpNumberOfBytesWritten=0x2173f830*=0x428, lpOverlapped=0x0) returned 1 [0165.960] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.960] ReadFile (in: hFile=0x10a8, lpBuffer=0x4550000, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x2173f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x2173f61c*=0xa7f0, lpOverlapped=0x0) returned 1 [0166.024] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xffff5810, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.024] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x4550000, cbInput=0xa7f0, pPaddingInfo=0x0, pbIV=0x2173f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x2173f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x2173f848, pbOutput=0x4550000, pcbResult=0x2173f618) returned 0x0 [0166.024] WriteFile (in: hFile=0x10a8, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2173f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x2173f61c*=0xa800, lpOverlapped=0x0) returned 1 [0166.024] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2173f60c | out: lpNewFilePointer=0x0) returned 1 [0166.024] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.025] WriteFile (in: hFile=0x10a8, lpBuffer=0x2173f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2173f61c, lpOverlapped=0x0 | out: lpBuffer=0x2173f83c*, lpNumberOfBytesWritten=0x2173f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.025] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xa800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.025] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0166.025] CloseHandle (hObject=0x10a8) returned 1 [0166.069] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27940000 [0166.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.play")) returned 1 [0166.297] VirtualFree (lpAddress=0x27940000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1958 os_tid = 0x1d7c [0165.325] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.325] ReadFile (in: hFile=0xfd0, lpBuffer=0x2187fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2187f85c, lpOverlapped=0x0 | out: lpBuffer=0x2187fb34*, lpNumberOfBytesRead=0x2187f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.549] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.549] ReadFile (in: hFile=0xfd0, lpBuffer=0x2187fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2187f85c, lpOverlapped=0x0 | out: lpBuffer=0x2187fb34*, lpNumberOfBytesRead=0x2187f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.961] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.962] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.962] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x2187f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0165.962] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x2187f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x2187f828, pbKeyObject=0x0) returned 0x0 [0165.962] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2187f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2187f500) returned 0x0 [0165.963] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.963] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2187f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2187f500) returned 0x0 [0165.966] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.968] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.968] WriteFile (in: hFile=0xfd0, lpBuffer=0x2187fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2187f830, lpOverlapped=0x0 | out: lpBuffer=0x2187fb34*, lpNumberOfBytesWritten=0x2187f830*=0x428, lpOverlapped=0x0) returned 1 [0165.968] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.969] ReadFile (in: hFile=0xfd0, lpBuffer=0x4650000, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x2187f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x2187f61c*=0xa79c, lpOverlapped=0x0) returned 1 [0166.025] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0xffff5864, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.025] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x4650000, cbInput=0xa79c, pPaddingInfo=0x0, pbIV=0x2187f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x2187f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x2187f848, pbOutput=0x4650000, pcbResult=0x2187f618) returned 0x0 [0166.025] WriteFile (in: hFile=0xfd0, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2187f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x2187f61c*=0xa7a0, lpOverlapped=0x0) returned 1 [0166.026] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2187f60c | out: lpNewFilePointer=0x0) returned 1 [0166.026] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.026] WriteFile (in: hFile=0xfd0, lpBuffer=0x2187f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2187f61c, lpOverlapped=0x0 | out: lpBuffer=0x2187f83c*, lpNumberOfBytesWritten=0x2187f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.026] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0xa7a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.026] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0166.026] CloseHandle (hObject=0xfd0) returned 1 [0166.103] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x28490000 [0166.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.play")) returned 1 [0166.613] VirtualFree (lpAddress=0x28490000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1959 os_tid = 0x1d80 [0165.326] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.327] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x219bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0165.327] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x219bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x219bf828, pbKeyObject=0x0) returned 0x0 [0165.327] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x219bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x219bf500) returned 0x0 [0165.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.328] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x219bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x219bf500) returned 0x0 [0165.331] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.332] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.332] WriteFile (in: hFile=0x2fc, lpBuffer=0x219bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219bf830, lpOverlapped=0x0 | out: lpBuffer=0x219bfb34*, lpNumberOfBytesWritten=0x219bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.109] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.109] ReadFile (in: hFile=0x2fc, lpBuffer=0x4750000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x219bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x219bf61c*=0x2c8, lpOverlapped=0x0) returned 1 [0166.109] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffd38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.109] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4750000, cbInput=0x2c8, pPaddingInfo=0x0, pbIV=0x219bf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x219bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x219bf848, pbOutput=0x4750000, pcbResult=0x219bf618) returned 0x0 [0166.109] WriteFile (in: hFile=0x2fc, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x219bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x219bf61c*=0x2d0, lpOverlapped=0x0) returned 1 [0166.109] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.109] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.109] WriteFile (in: hFile=0x2fc, lpBuffer=0x219bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219bf61c, lpOverlapped=0x0 | out: lpBuffer=0x219bf83c*, lpNumberOfBytesWritten=0x219bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.109] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.109] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0166.109] CloseHandle (hObject=0x2fc) returned 1 [0166.146] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x284b0000 [0166.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.play")) returned 1 [0166.321] VirtualFree (lpAddress=0x284b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1960 os_tid = 0x1d84 [0165.334] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.334] ReadFile (in: hFile=0x434, lpBuffer=0x21affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21aff85c, lpOverlapped=0x0 | out: lpBuffer=0x21affb34*, lpNumberOfBytesRead=0x21aff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.570] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0165.572] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0165.572] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x21aff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0165.572] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x21aff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x21aff828, pbKeyObject=0x0) returned 0x0 [0165.572] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x21aff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x21aff500) returned 0x0 [0165.572] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0165.572] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x21aff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x21aff500) returned 0x0 [0165.575] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.577] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.577] WriteFile (in: hFile=0x434, lpBuffer=0x21affb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21aff830, lpOverlapped=0x0 | out: lpBuffer=0x21affb34*, lpNumberOfBytesWritten=0x21aff830*=0x428, lpOverlapped=0x0) returned 1 [0165.578] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.578] ReadFile (in: hFile=0x434, lpBuffer=0x4850000, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x21aff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x21aff61c*=0x78c, lpOverlapped=0x0) returned 1 [0165.578] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffff874, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.578] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x4850000, cbInput=0x78c, pPaddingInfo=0x0, pbIV=0x21aff848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x21aff618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x21aff848, pbOutput=0x4850000, pcbResult=0x21aff618) returned 0x0 [0165.578] WriteFile (in: hFile=0x434, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x21aff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x21aff61c*=0x790, lpOverlapped=0x0) returned 1 [0165.578] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21aff60c | out: lpNewFilePointer=0x0) returned 1 [0165.578] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.578] WriteFile (in: hFile=0x434, lpBuffer=0x21aff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21aff61c, lpOverlapped=0x0 | out: lpBuffer=0x21aff83c*, lpNumberOfBytesWritten=0x21aff61c*=0x8, lpOverlapped=0x0) returned 1 [0165.578] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.578] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.578] CloseHandle (hObject=0x434) returned 1 [0165.589] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0165.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.play")) returned 1 [0166.622] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1961 os_tid = 0x1d88 [0165.336] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.336] ReadFile (in: hFile=0x43c, lpBuffer=0x21c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21c3fb34*, lpNumberOfBytesRead=0x21c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.337] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.337] ReadFile (in: hFile=0x43c, lpBuffer=0x21c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21c3fb34*, lpNumberOfBytesRead=0x21c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.337] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0165.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0165.339] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x21c3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0165.339] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x21c3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x21c3f828, pbKeyObject=0x0) returned 0x0 [0165.339] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x21c3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x21c3f500) returned 0x0 [0165.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0165.339] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x21c3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x21c3f500) returned 0x0 [0165.342] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.344] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.344] WriteFile (in: hFile=0x43c, lpBuffer=0x21c3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21c3f830, lpOverlapped=0x0 | out: lpBuffer=0x21c3fb34*, lpNumberOfBytesWritten=0x21c3f830*=0x428, lpOverlapped=0x0) returned 1 [0165.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.345] ReadFile (in: hFile=0x43c, lpBuffer=0x4950000, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x21c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x21c3f61c*=0xb88, lpOverlapped=0x0) returned 1 [0165.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffff478, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.345] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x4950000, cbInput=0xb88, pPaddingInfo=0x0, pbIV=0x21c3f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x21c3f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x21c3f848, pbOutput=0x4950000, pcbResult=0x21c3f618) returned 0x0 [0165.345] WriteFile (in: hFile=0x43c, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x21c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x21c3f61c*=0xb90, lpOverlapped=0x0) returned 1 [0165.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21c3f60c | out: lpNewFilePointer=0x0) returned 1 [0165.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.345] WriteFile (in: hFile=0x43c, lpBuffer=0x21c3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21c3f83c*, lpNumberOfBytesWritten=0x21c3f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xb90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.345] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0165.345] CloseHandle (hObject=0x43c) returned 1 [0165.346] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.play")) returned 1 [0165.347] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1962 os_tid = 0x1d8c [0165.350] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.350] ReadFile (in: hFile=0x314, lpBuffer=0x21d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesRead=0x21d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.801] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.802] ReadFile (in: hFile=0x314, lpBuffer=0x21d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesRead=0x21d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.014] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17bf0000 [0166.015] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bf0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17bf0000) returned 0x0 [0166.015] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x21d7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0166.015] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x21d7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17bf0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x21d7f828, pbKeyObject=0x0) returned 0x0 [0166.015] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17bf0000, cbOutput=0x230, pcbResult=0x21d7f500, dwFlags=0x0 | out: pbOutput=0x17bf0000, pcbResult=0x21d7f500) returned 0x0 [0166.016] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17bf0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17bf0230) returned 0x0 [0166.016] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17bf0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17bf0000, cbOutput=0x400, pcbResult=0x21d7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17bf0000, pcbResult=0x21d7f500) returned 0x0 [0166.019] VirtualFree (lpAddress=0x17bf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.021] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.021] WriteFile (in: hFile=0x314, lpBuffer=0x21d7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d7f830, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesWritten=0x21d7f830*=0x428, lpOverlapped=0x0) returned 1 [0166.022] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.022] ReadFile (in: hFile=0x314, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x21d7f61c*=0x2708, lpOverlapped=0x0) returned 1 [0166.063] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xffffd8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.063] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4a50000, cbInput=0x2708, pPaddingInfo=0x0, pbIV=0x21d7f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x21d7f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x21d7f848, pbOutput=0x4a50000, pcbResult=0x21d7f618) returned 0x0 [0166.063] WriteFile (in: hFile=0x314, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x21d7f61c*=0x2710, lpOverlapped=0x0) returned 1 [0166.063] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d7f60c | out: lpNewFilePointer=0x0) returned 1 [0166.063] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.063] WriteFile (in: hFile=0x314, lpBuffer=0x21d7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d7f83c*, lpNumberOfBytesWritten=0x21d7f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.063] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x2710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.063] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0166.063] CloseHandle (hObject=0x314) returned 1 [0166.073] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27960000 [0166.074] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.play")) returned 1 [0166.079] VirtualFree (lpAddress=0x27960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1963 os_tid = 0x1d90 [0165.352] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.352] ReadFile (in: hFile=0x444, lpBuffer=0x21ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x21ebfb34*, lpNumberOfBytesRead=0x21ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.788] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.788] ReadFile (in: hFile=0x444, lpBuffer=0x21ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x21ebfb34*, lpNumberOfBytesRead=0x21ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.788] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.791] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.791] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x21ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0165.791] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x21ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x21ebf828, pbKeyObject=0x0) returned 0x0 [0165.791] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x21ebf500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x21ebf500) returned 0x0 [0165.792] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.792] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x21ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x21ebf500) returned 0x0 [0165.797] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.800] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.800] WriteFile (in: hFile=0x444, lpBuffer=0x21ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21ebf830, lpOverlapped=0x0 | out: lpBuffer=0x21ebfb34*, lpNumberOfBytesWritten=0x21ebf830*=0x428, lpOverlapped=0x0) returned 1 [0165.801] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.801] ReadFile (in: hFile=0x444, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x21ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x21ebf61c*=0x5130, lpOverlapped=0x0) returned 1 [0166.013] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xffffaed0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.013] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x4b50000, cbInput=0x5130, pPaddingInfo=0x0, pbIV=0x21ebf848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x21ebf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x21ebf848, pbOutput=0x4b50000, pcbResult=0x21ebf618) returned 0x0 [0166.013] WriteFile (in: hFile=0x444, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x21ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x21ebf61c*=0x5140, lpOverlapped=0x0) returned 1 [0166.013] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ebf60c | out: lpNewFilePointer=0x0) returned 1 [0166.013] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.013] WriteFile (in: hFile=0x444, lpBuffer=0x21ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x21ebf83c*, lpNumberOfBytesWritten=0x21ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.013] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x5140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.014] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0166.014] CloseHandle (hObject=0x444) returned 1 [0166.065] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27920000 [0166.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.play")) returned 1 [0166.302] VirtualFree (lpAddress=0x27920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1964 os_tid = 0x1d94 [0165.354] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.354] ReadFile (in: hFile=0x428, lpBuffer=0x21fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21fff85c, lpOverlapped=0x0 | out: lpBuffer=0x21fffb34*, lpNumberOfBytesRead=0x21fff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.802] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.802] ReadFile (in: hFile=0x428, lpBuffer=0x21fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21fff85c, lpOverlapped=0x0 | out: lpBuffer=0x21fffb34*, lpNumberOfBytesRead=0x21fff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.803] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.805] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.805] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x21fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0165.805] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x21fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x21fff828, pbKeyObject=0x0) returned 0x0 [0165.805] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x21fff500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x21fff500) returned 0x0 [0165.805] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.805] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x21fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x21fff500) returned 0x0 [0165.810] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.812] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.812] WriteFile (in: hFile=0x428, lpBuffer=0x21fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21fff830, lpOverlapped=0x0 | out: lpBuffer=0x21fffb34*, lpNumberOfBytesWritten=0x21fff830*=0x428, lpOverlapped=0x0) returned 1 [0165.813] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.813] ReadFile (in: hFile=0x428, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x21fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x21fff61c*=0x600c, lpOverlapped=0x0) returned 1 [0166.022] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0xffff9ff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.022] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x4c50000, cbInput=0x600c, pPaddingInfo=0x0, pbIV=0x21fff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x21fff618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x21fff848, pbOutput=0x4c50000, pcbResult=0x21fff618) returned 0x0 [0166.023] WriteFile (in: hFile=0x428, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x21fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x21fff61c*=0x6010, lpOverlapped=0x0) returned 1 [0166.023] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21fff60c | out: lpNewFilePointer=0x0) returned 1 [0166.023] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.023] WriteFile (in: hFile=0x428, lpBuffer=0x21fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21fff61c, lpOverlapped=0x0 | out: lpBuffer=0x21fff83c*, lpNumberOfBytesWritten=0x21fff61c*=0x8, lpOverlapped=0x0) returned 1 [0166.023] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x6010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.023] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0166.023] CloseHandle (hObject=0x428) returned 1 [0166.067] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27930000 [0166.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.play")) returned 1 [0166.300] VirtualFree (lpAddress=0x27930000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1965 os_tid = 0x1d98 [0165.355] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.355] ReadFile (in: hFile=0x548, lpBuffer=0x2213fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2213f85c, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesRead=0x2213f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.561] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.561] ReadFile (in: hFile=0x548, lpBuffer=0x2213fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2213f85c, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesRead=0x2213f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0165.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0165.563] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x2213f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0165.563] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x2213f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x2213f828, pbKeyObject=0x0) returned 0x0 [0165.563] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2213f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2213f500) returned 0x0 [0165.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0165.563] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2213f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2213f500) returned 0x0 [0165.566] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.568] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.568] WriteFile (in: hFile=0x548, lpBuffer=0x2213fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2213f830, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesWritten=0x2213f830*=0x428, lpOverlapped=0x0) returned 1 [0165.569] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.569] ReadFile (in: hFile=0x548, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x2213f61c*=0x8b2, lpOverlapped=0x0) returned 1 [0165.569] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xfffff74e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.569] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x4d50000, cbInput=0x8b2, pPaddingInfo=0x0, pbIV=0x2213f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x2213f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x2213f848, pbOutput=0x4d50000, pcbResult=0x2213f618) returned 0x0 [0165.569] WriteFile (in: hFile=0x548, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x2213f61c*=0x8c0, lpOverlapped=0x0) returned 1 [0165.569] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2213f60c | out: lpNewFilePointer=0x0) returned 1 [0165.569] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.570] WriteFile (in: hFile=0x548, lpBuffer=0x2213f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x2213f83c*, lpNumberOfBytesWritten=0x2213f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.570] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.570] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.570] CloseHandle (hObject=0x548) returned 1 [0165.581] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0165.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.play")) returned 1 [0165.585] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1966 os_tid = 0x1d9c [0165.356] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.356] ReadFile (in: hFile=0x6fc, lpBuffer=0x2313fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2313f85c, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesRead=0x2313f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.551] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.551] ReadFile (in: hFile=0x6fc, lpBuffer=0x2313fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2313f85c, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesRead=0x2313f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.551] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0165.552] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0165.552] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x2313f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0165.552] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x2313f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x2313f828, pbKeyObject=0x0) returned 0x0 [0165.552] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2313f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2313f500) returned 0x0 [0165.553] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0165.553] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2313f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2313f500) returned 0x0 [0165.558] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.560] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.560] WriteFile (in: hFile=0x6fc, lpBuffer=0x2313fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2313f830, lpOverlapped=0x0 | out: lpBuffer=0x2313fb34*, lpNumberOfBytesWritten=0x2313f830*=0x428, lpOverlapped=0x0) returned 1 [0165.561] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.561] ReadFile (in: hFile=0x6fc, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x2313f61c*=0x39e4, lpOverlapped=0x0) returned 1 [0166.012] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xffffc61c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.012] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x4e50000, cbInput=0x39e4, pPaddingInfo=0x0, pbIV=0x2313f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x2313f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x2313f848, pbOutput=0x4e50000, pcbResult=0x2313f618) returned 0x0 [0166.012] WriteFile (in: hFile=0x6fc, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x2313f61c*=0x39f0, lpOverlapped=0x0) returned 1 [0166.012] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2313f60c | out: lpNewFilePointer=0x0) returned 1 [0166.012] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.013] WriteFile (in: hFile=0x6fc, lpBuffer=0x2313f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2313f61c, lpOverlapped=0x0 | out: lpBuffer=0x2313f83c*, lpNumberOfBytesWritten=0x2313f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.013] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x39f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.013] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0166.013] CloseHandle (hObject=0x6fc) returned 1 [0166.059] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27910000 [0166.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.play")) returned 1 [0166.305] VirtualFree (lpAddress=0x27910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1967 os_tid = 0x1da0 [0165.357] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.357] ReadFile (in: hFile=0x22c, lpBuffer=0x2327fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2327f85c, lpOverlapped=0x0 | out: lpBuffer=0x2327fb34*, lpNumberOfBytesRead=0x2327f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.859] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.859] ReadFile (in: hFile=0x22c, lpBuffer=0x2327fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2327f85c, lpOverlapped=0x0 | out: lpBuffer=0x2327fb34*, lpNumberOfBytesRead=0x2327f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.859] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.861] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.861] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x2327f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0165.861] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x2327f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x2327f828, pbKeyObject=0x0) returned 0x0 [0165.861] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2327f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2327f500) returned 0x0 [0165.861] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.862] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2327f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2327f500) returned 0x0 [0165.866] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.868] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.869] WriteFile (in: hFile=0x22c, lpBuffer=0x2327fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2327f830, lpOverlapped=0x0 | out: lpBuffer=0x2327fb34*, lpNumberOfBytesWritten=0x2327f830*=0x428, lpOverlapped=0x0) returned 1 [0165.869] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.869] ReadFile (in: hFile=0x22c, lpBuffer=0x4f50000, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x2327f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x2327f61c*=0xe6c, lpOverlapped=0x0) returned 1 [0165.869] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffff194, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.869] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4f50000, cbInput=0xe6c, pPaddingInfo=0x0, pbIV=0x2327f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x2327f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2327f848, pbOutput=0x4f50000, pcbResult=0x2327f618) returned 0x0 [0165.869] WriteFile (in: hFile=0x22c, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2327f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x2327f61c*=0xe70, lpOverlapped=0x0) returned 1 [0165.869] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2327f60c | out: lpNewFilePointer=0x0) returned 1 [0165.869] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.869] WriteFile (in: hFile=0x22c, lpBuffer=0x2327f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2327f61c, lpOverlapped=0x0 | out: lpBuffer=0x2327f83c*, lpNumberOfBytesWritten=0x2327f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.870] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xe70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.870] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.870] CloseHandle (hObject=0x22c) returned 1 [0166.043] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27880000 [0166.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.play")) returned 1 [0166.341] VirtualFree (lpAddress=0x27880000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1968 os_tid = 0x1da4 [0165.368] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.368] ReadFile (in: hFile=0x6f4, lpBuffer=0x233bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x233bf85c, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesRead=0x233bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.846] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.846] ReadFile (in: hFile=0x6f4, lpBuffer=0x233bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x233bf85c, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesRead=0x233bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.846] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.849] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x233bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0165.849] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x233bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x233bf828, pbKeyObject=0x0) returned 0x0 [0165.849] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x233bf500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x233bf500) returned 0x0 [0165.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.849] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x233bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x233bf500) returned 0x0 [0165.855] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.857] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.857] WriteFile (in: hFile=0x6f4, lpBuffer=0x233bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x233bf830, lpOverlapped=0x0 | out: lpBuffer=0x233bfb34*, lpNumberOfBytesWritten=0x233bf830*=0x428, lpOverlapped=0x0) returned 1 [0165.858] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.858] ReadFile (in: hFile=0x6f4, lpBuffer=0x5050000, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x233bf61c*=0xe30, lpOverlapped=0x0) returned 1 [0165.858] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xfffff1d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.858] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5050000, cbInput=0xe30, pPaddingInfo=0x0, pbIV=0x233bf848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x233bf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x233bf848, pbOutput=0x5050000, pcbResult=0x233bf618) returned 0x0 [0165.858] WriteFile (in: hFile=0x6f4, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x233bf61c*=0xe40, lpOverlapped=0x0) returned 1 [0165.859] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x233bf60c | out: lpNewFilePointer=0x0) returned 1 [0165.859] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.859] WriteFile (in: hFile=0x6f4, lpBuffer=0x233bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x233bf61c, lpOverlapped=0x0 | out: lpBuffer=0x233bf83c*, lpNumberOfBytesWritten=0x233bf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.859] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xe40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.859] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.859] CloseHandle (hObject=0x6f4) returned 1 [0166.041] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27870000 [0166.043] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.play")) returned 1 [0166.344] VirtualFree (lpAddress=0x27870000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1969 os_tid = 0x1da8 [0165.369] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.369] ReadFile (in: hFile=0x6ec, lpBuffer=0x234ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x234ff85c, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesRead=0x234ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.826] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.826] ReadFile (in: hFile=0x6ec, lpBuffer=0x234ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x234ff85c, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesRead=0x234ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.826] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.828] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.828] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x234ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0165.828] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x234ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x234ff828, pbKeyObject=0x0) returned 0x0 [0165.828] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x234ff500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x234ff500) returned 0x0 [0165.828] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.828] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x234ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x234ff500) returned 0x0 [0165.833] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.844] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.844] WriteFile (in: hFile=0x6ec, lpBuffer=0x234ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x234ff830, lpOverlapped=0x0 | out: lpBuffer=0x234ffb34*, lpNumberOfBytesWritten=0x234ff830*=0x428, lpOverlapped=0x0) returned 1 [0165.845] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.845] ReadFile (in: hFile=0x6ec, lpBuffer=0x5150000, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x234ff61c*=0xe20, lpOverlapped=0x0) returned 1 [0165.845] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xfffff1e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.845] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5150000, cbInput=0xe20, pPaddingInfo=0x0, pbIV=0x234ff848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x234ff618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x234ff848, pbOutput=0x5150000, pcbResult=0x234ff618) returned 0x0 [0165.845] WriteFile (in: hFile=0x6ec, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x234ff61c*=0xe30, lpOverlapped=0x0) returned 1 [0165.845] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234ff60c | out: lpNewFilePointer=0x0) returned 1 [0165.846] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.846] WriteFile (in: hFile=0x6ec, lpBuffer=0x234ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x234ff61c, lpOverlapped=0x0 | out: lpBuffer=0x234ff83c*, lpNumberOfBytesWritten=0x234ff61c*=0x8, lpOverlapped=0x0) returned 1 [0165.846] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xe30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.846] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.846] CloseHandle (hObject=0x6ec) returned 1 [0166.040] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27860000 [0166.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.play")) returned 1 [0166.346] VirtualFree (lpAddress=0x27860000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1970 os_tid = 0x1dac [0165.370] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.371] ReadFile (in: hFile=0x6e4, lpBuffer=0x2363fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2363f85c, lpOverlapped=0x0 | out: lpBuffer=0x2363fb34*, lpNumberOfBytesRead=0x2363f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.814] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.814] ReadFile (in: hFile=0x6e4, lpBuffer=0x2363fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2363f85c, lpOverlapped=0x0 | out: lpBuffer=0x2363fb34*, lpNumberOfBytesRead=0x2363f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.814] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.816] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.816] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x2363f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0165.816] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x2363f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x2363f828, pbKeyObject=0x0) returned 0x0 [0165.816] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2363f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2363f500) returned 0x0 [0165.816] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.816] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2363f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2363f500) returned 0x0 [0165.822] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.824] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.824] WriteFile (in: hFile=0x6e4, lpBuffer=0x2363fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2363f830, lpOverlapped=0x0 | out: lpBuffer=0x2363fb34*, lpNumberOfBytesWritten=0x2363f830*=0x428, lpOverlapped=0x0) returned 1 [0165.825] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.825] ReadFile (in: hFile=0x6e4, lpBuffer=0x5350000, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x2363f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x2363f61c*=0x85c, lpOverlapped=0x0) returned 1 [0165.825] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0xfffff7a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.825] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5350000, cbInput=0x85c, pPaddingInfo=0x0, pbIV=0x2363f848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x2363f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2363f848, pbOutput=0x5350000, pcbResult=0x2363f618) returned 0x0 [0165.825] WriteFile (in: hFile=0x6e4, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2363f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x2363f61c*=0x860, lpOverlapped=0x0) returned 1 [0165.825] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2363f60c | out: lpNewFilePointer=0x0) returned 1 [0165.825] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.825] WriteFile (in: hFile=0x6e4, lpBuffer=0x2363f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2363f61c, lpOverlapped=0x0 | out: lpBuffer=0x2363f83c*, lpNumberOfBytesWritten=0x2363f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.826] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.826] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.826] CloseHandle (hObject=0x6e4) returned 1 [0166.038] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27850000 [0166.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.play")) returned 1 [0166.352] VirtualFree (lpAddress=0x27850000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1971 os_tid = 0x1db0 [0165.372] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.372] ReadFile (in: hFile=0x450, lpBuffer=0x2377fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2377f85c, lpOverlapped=0x0 | out: lpBuffer=0x2377fb34*, lpNumberOfBytesRead=0x2377f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.905] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.905] ReadFile (in: hFile=0x450, lpBuffer=0x2377fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2377f85c, lpOverlapped=0x0 | out: lpBuffer=0x2377fb34*, lpNumberOfBytesRead=0x2377f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.905] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.907] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.907] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x2377f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0165.907] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x2377f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x2377f828, pbKeyObject=0x0) returned 0x0 [0165.907] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2377f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2377f500) returned 0x0 [0165.907] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.907] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2377f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2377f500) returned 0x0 [0165.912] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.915] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.915] WriteFile (in: hFile=0x450, lpBuffer=0x2377fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2377f830, lpOverlapped=0x0 | out: lpBuffer=0x2377fb34*, lpNumberOfBytesWritten=0x2377f830*=0x428, lpOverlapped=0x0) returned 1 [0165.916] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.916] ReadFile (in: hFile=0x450, lpBuffer=0x5450000, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x2377f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x2377f61c*=0xadc, lpOverlapped=0x0) returned 1 [0165.916] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffff524, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.916] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5450000, cbInput=0xadc, pPaddingInfo=0x0, pbIV=0x2377f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x2377f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2377f848, pbOutput=0x5450000, pcbResult=0x2377f618) returned 0x0 [0165.916] WriteFile (in: hFile=0x450, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2377f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x2377f61c*=0xae0, lpOverlapped=0x0) returned 1 [0165.916] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2377f60c | out: lpNewFilePointer=0x0) returned 1 [0165.916] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.916] WriteFile (in: hFile=0x450, lpBuffer=0x2377f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2377f61c, lpOverlapped=0x0 | out: lpBuffer=0x2377f83c*, lpNumberOfBytesWritten=0x2377f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.916] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.917] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.917] CloseHandle (hObject=0x450) returned 1 [0166.051] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x278d0000 [0166.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.play")) returned 1 [0166.329] VirtualFree (lpAddress=0x278d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1972 os_tid = 0x1db4 [0165.373] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.373] ReadFile (in: hFile=0x638, lpBuffer=0x238bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x238bf85c, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesRead=0x238bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.894] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.894] ReadFile (in: hFile=0x638, lpBuffer=0x238bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x238bf85c, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesRead=0x238bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.894] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.896] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.896] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x238bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0165.896] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x238bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x238bf828, pbKeyObject=0x0) returned 0x0 [0165.896] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x238bf500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x238bf500) returned 0x0 [0165.896] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.897] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x238bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x238bf500) returned 0x0 [0165.901] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.903] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.904] WriteFile (in: hFile=0x638, lpBuffer=0x238bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x238bf830, lpOverlapped=0x0 | out: lpBuffer=0x238bfb34*, lpNumberOfBytesWritten=0x238bf830*=0x428, lpOverlapped=0x0) returned 1 [0165.904] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.904] ReadFile (in: hFile=0x638, lpBuffer=0x5550000, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x238bf61c*=0xaec, lpOverlapped=0x0) returned 1 [0165.904] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0xfffff514, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.904] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5550000, cbInput=0xaec, pPaddingInfo=0x0, pbIV=0x238bf848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x238bf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x238bf848, pbOutput=0x5550000, pcbResult=0x238bf618) returned 0x0 [0165.904] WriteFile (in: hFile=0x638, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x238bf61c*=0xaf0, lpOverlapped=0x0) returned 1 [0165.904] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238bf60c | out: lpNewFilePointer=0x0) returned 1 [0165.904] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.905] WriteFile (in: hFile=0x638, lpBuffer=0x238bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238bf61c, lpOverlapped=0x0 | out: lpBuffer=0x238bf83c*, lpNumberOfBytesWritten=0x238bf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.905] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0xaf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.905] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.905] CloseHandle (hObject=0x638) returned 1 [0166.050] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x278c0000 [0166.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.play")) returned 1 [0166.332] VirtualFree (lpAddress=0x278c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1973 os_tid = 0x1db8 [0165.374] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.374] ReadFile (in: hFile=0x62c, lpBuffer=0x239ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x239ff85c, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesRead=0x239ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.772] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.772] ReadFile (in: hFile=0x62c, lpBuffer=0x239ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x239ff85c, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesRead=0x239ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.772] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.775] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.776] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x239ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0165.776] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x239ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x239ff828, pbKeyObject=0x0) returned 0x0 [0165.776] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x239ff500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x239ff500) returned 0x0 [0165.776] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.776] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x239ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x239ff500) returned 0x0 [0165.782] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.785] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.785] WriteFile (in: hFile=0x62c, lpBuffer=0x239ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x239ff830, lpOverlapped=0x0 | out: lpBuffer=0x239ffb34*, lpNumberOfBytesWritten=0x239ff830*=0x428, lpOverlapped=0x0) returned 1 [0165.786] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.786] ReadFile (in: hFile=0x62c, lpBuffer=0x5650000, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x239ff61c*=0xb90, lpOverlapped=0x0) returned 1 [0165.787] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0xfffff470, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.787] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x5650000, cbInput=0xb90, pPaddingInfo=0x0, pbIV=0x239ff848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x239ff618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x239ff848, pbOutput=0x5650000, pcbResult=0x239ff618) returned 0x0 [0165.787] WriteFile (in: hFile=0x62c, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x239ff61c*=0xba0, lpOverlapped=0x0) returned 1 [0165.787] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239ff60c | out: lpNewFilePointer=0x0) returned 1 [0165.787] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.787] WriteFile (in: hFile=0x62c, lpBuffer=0x239ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x239ff61c, lpOverlapped=0x0 | out: lpBuffer=0x239ff83c*, lpNumberOfBytesWritten=0x239ff61c*=0x8, lpOverlapped=0x0) returned 1 [0165.787] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0xba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.787] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.787] CloseHandle (hObject=0x62c) returned 1 [0166.036] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27840000 [0166.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.play")) returned 1 [0166.355] VirtualFree (lpAddress=0x27840000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1974 os_tid = 0x1dbc [0165.376] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.376] ReadFile (in: hFile=0xb4c, lpBuffer=0x23b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesRead=0x23b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.883] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.883] ReadFile (in: hFile=0xb4c, lpBuffer=0x23b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesRead=0x23b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.883] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.885] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.885] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x23b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0165.885] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x23b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x23b3f828, pbKeyObject=0x0) returned 0x0 [0165.885] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x23b3f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x23b3f500) returned 0x0 [0165.885] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.886] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x23b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x23b3f500) returned 0x0 [0165.890] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.893] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.893] WriteFile (in: hFile=0xb4c, lpBuffer=0x23b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23b3f830, lpOverlapped=0x0 | out: lpBuffer=0x23b3fb34*, lpNumberOfBytesWritten=0x23b3f830*=0x428, lpOverlapped=0x0) returned 1 [0165.893] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.893] ReadFile (in: hFile=0xb4c, lpBuffer=0x5750000, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x23b3f61c*=0xb90, lpOverlapped=0x0) returned 1 [0165.893] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffff470, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.893] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5750000, cbInput=0xb90, pPaddingInfo=0x0, pbIV=0x23b3f848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x23b3f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x23b3f848, pbOutput=0x5750000, pcbResult=0x23b3f618) returned 0x0 [0165.893] WriteFile (in: hFile=0xb4c, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x23b3f61c*=0xba0, lpOverlapped=0x0) returned 1 [0165.893] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23b3f60c | out: lpNewFilePointer=0x0) returned 1 [0165.894] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.894] WriteFile (in: hFile=0xb4c, lpBuffer=0x23b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x23b3f83c*, lpNumberOfBytesWritten=0x23b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.894] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0xba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.894] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.894] CloseHandle (hObject=0xb4c) returned 1 [0166.048] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x278b0000 [0166.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.play")) returned 1 [0166.334] VirtualFree (lpAddress=0x278b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1975 os_tid = 0x1dc0 [0165.377] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.377] ReadFile (in: hFile=0xdbc, lpBuffer=0x23c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x23c7fb34*, lpNumberOfBytesRead=0x23c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.872] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.872] ReadFile (in: hFile=0xdbc, lpBuffer=0x23c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x23c7fb34*, lpNumberOfBytesRead=0x23c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.872] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.874] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.874] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x23c7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0165.874] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x23c7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x23c7f828, pbKeyObject=0x0) returned 0x0 [0165.874] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x23c7f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x23c7f500) returned 0x0 [0165.874] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.874] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x23c7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x23c7f500) returned 0x0 [0165.879] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.881] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.881] WriteFile (in: hFile=0xdbc, lpBuffer=0x23c7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23c7f830, lpOverlapped=0x0 | out: lpBuffer=0x23c7fb34*, lpNumberOfBytesWritten=0x23c7f830*=0x428, lpOverlapped=0x0) returned 1 [0165.882] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.882] ReadFile (in: hFile=0xdbc, lpBuffer=0x5850000, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x23c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x23c7f61c*=0xe04, lpOverlapped=0x0) returned 1 [0165.882] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xfffff1fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.882] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5850000, cbInput=0xe04, pPaddingInfo=0x0, pbIV=0x23c7f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x23c7f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x23c7f848, pbOutput=0x5850000, pcbResult=0x23c7f618) returned 0x0 [0165.882] WriteFile (in: hFile=0xdbc, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x23c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x23c7f61c*=0xe10, lpOverlapped=0x0) returned 1 [0165.883] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23c7f60c | out: lpNewFilePointer=0x0) returned 1 [0165.883] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.883] WriteFile (in: hFile=0xdbc, lpBuffer=0x23c7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x23c7f83c*, lpNumberOfBytesWritten=0x23c7f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.883] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xe10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.883] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.883] CloseHandle (hObject=0xdbc) returned 1 [0166.046] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x278a0000 [0166.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.play")) returned 1 [0166.337] VirtualFree (lpAddress=0x278a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1976 os_tid = 0x1dc4 [0165.378] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.378] ReadFile (in: hFile=0xdc4, lpBuffer=0x23dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x23dbfb34*, lpNumberOfBytesRead=0x23dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.758] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.758] ReadFile (in: hFile=0xdc4, lpBuffer=0x23dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x23dbfb34*, lpNumberOfBytesRead=0x23dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.758] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.760] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x23dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0165.760] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x23dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x23dbf828, pbKeyObject=0x0) returned 0x0 [0165.760] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x23dbf500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x23dbf500) returned 0x0 [0165.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.760] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x23dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x23dbf500) returned 0x0 [0165.764] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.768] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.768] WriteFile (in: hFile=0xdc4, lpBuffer=0x23dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23dbf830, lpOverlapped=0x0 | out: lpBuffer=0x23dbfb34*, lpNumberOfBytesWritten=0x23dbf830*=0x428, lpOverlapped=0x0) returned 1 [0165.769] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.769] ReadFile (in: hFile=0xdc4, lpBuffer=0x5950000, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x23dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x23dbf61c*=0x8b4, lpOverlapped=0x0) returned 1 [0165.769] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0xfffff74c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.769] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x5950000, cbInput=0x8b4, pPaddingInfo=0x0, pbIV=0x23dbf848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x23dbf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x23dbf848, pbOutput=0x5950000, pcbResult=0x23dbf618) returned 0x0 [0165.769] WriteFile (in: hFile=0xdc4, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x23dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x23dbf61c*=0x8c0, lpOverlapped=0x0) returned 1 [0165.770] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dbf60c | out: lpNewFilePointer=0x0) returned 1 [0165.770] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.770] WriteFile (in: hFile=0xdc4, lpBuffer=0x23dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x23dbf83c*, lpNumberOfBytesWritten=0x23dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.770] SetFilePointerEx (in: hFile=0xdc4, liDistanceToMove=0x8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.770] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.770] CloseHandle (hObject=0xdc4) returned 1 [0166.034] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27830000 [0166.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.play")) returned 1 [0166.357] VirtualFree (lpAddress=0x27830000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1977 os_tid = 0x1dc8 [0165.380] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.380] ReadFile (in: hFile=0xdcc, lpBuffer=0x23effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23eff85c, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesRead=0x23eff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.744] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.744] ReadFile (in: hFile=0xdcc, lpBuffer=0x23effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x23eff85c, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesRead=0x23eff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.744] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.749] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.749] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x23eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0165.749] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x23eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x23eff828, pbKeyObject=0x0) returned 0x0 [0165.749] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x23eff500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x23eff500) returned 0x0 [0165.750] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.750] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x23eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x23eff500) returned 0x0 [0165.753] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.756] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.756] WriteFile (in: hFile=0xdcc, lpBuffer=0x23effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x23eff830, lpOverlapped=0x0 | out: lpBuffer=0x23effb34*, lpNumberOfBytesWritten=0x23eff830*=0x428, lpOverlapped=0x0) returned 1 [0165.757] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.757] ReadFile (in: hFile=0xdcc, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x23eff61c*=0x8fc, lpOverlapped=0x0) returned 1 [0165.757] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffff704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.757] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x5a50000, cbInput=0x8fc, pPaddingInfo=0x0, pbIV=0x23eff848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x23eff618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x23eff848, pbOutput=0x5a50000, pcbResult=0x23eff618) returned 0x0 [0165.757] WriteFile (in: hFile=0xdcc, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x23eff61c*=0x900, lpOverlapped=0x0) returned 1 [0165.757] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23eff60c | out: lpNewFilePointer=0x0) returned 1 [0165.758] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.758] WriteFile (in: hFile=0xdcc, lpBuffer=0x23eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23eff61c, lpOverlapped=0x0 | out: lpBuffer=0x23eff83c*, lpNumberOfBytesWritten=0x23eff61c*=0x8, lpOverlapped=0x0) returned 1 [0165.758] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.758] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.758] CloseHandle (hObject=0xdcc) returned 1 [0166.033] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27820000 [0166.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.play")) returned 1 [0166.360] VirtualFree (lpAddress=0x27820000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1978 os_tid = 0x1dcc [0165.381] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.381] ReadFile (in: hFile=0xdd4, lpBuffer=0x2403fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2403f85c, lpOverlapped=0x0 | out: lpBuffer=0x2403fb34*, lpNumberOfBytesRead=0x2403f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.608] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.608] ReadFile (in: hFile=0xdd4, lpBuffer=0x2403fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2403f85c, lpOverlapped=0x0 | out: lpBuffer=0x2403fb34*, lpNumberOfBytesRead=0x2403f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.608] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.610] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x2403f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0165.610] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x2403f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x2403f828, pbKeyObject=0x0) returned 0x0 [0165.610] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2403f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2403f500) returned 0x0 [0165.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.610] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2403f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2403f500) returned 0x0 [0165.613] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.615] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.615] WriteFile (in: hFile=0xdd4, lpBuffer=0x2403fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2403f830, lpOverlapped=0x0 | out: lpBuffer=0x2403fb34*, lpNumberOfBytesWritten=0x2403f830*=0x428, lpOverlapped=0x0) returned 1 [0165.616] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.616] ReadFile (in: hFile=0xdd4, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x2403f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x2403f61c*=0x8fc, lpOverlapped=0x0) returned 1 [0165.616] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffff704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.616] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x5b50000, cbInput=0x8fc, pPaddingInfo=0x0, pbIV=0x2403f848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x2403f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x2403f848, pbOutput=0x5b50000, pcbResult=0x2403f618) returned 0x0 [0165.616] WriteFile (in: hFile=0xdd4, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2403f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x2403f61c*=0x900, lpOverlapped=0x0) returned 1 [0165.616] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2403f60c | out: lpNewFilePointer=0x0) returned 1 [0165.616] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.616] WriteFile (in: hFile=0xdd4, lpBuffer=0x2403f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2403f61c, lpOverlapped=0x0 | out: lpBuffer=0x2403f83c*, lpNumberOfBytesWritten=0x2403f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.616] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.616] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.744] CloseHandle (hObject=0xdd4) returned 1 [0166.031] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27810000 [0166.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.play")) returned 1 [0166.561] VirtualFree (lpAddress=0x27810000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1979 os_tid = 0x1dd0 [0165.383] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.383] ReadFile (in: hFile=0xddc, lpBuffer=0x2417fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2417f85c, lpOverlapped=0x0 | out: lpBuffer=0x2417fb34*, lpNumberOfBytesRead=0x2417f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.927] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.928] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.929] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x2417f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0165.929] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x2417f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x2417f828, pbKeyObject=0x0) returned 0x0 [0165.929] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2417f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2417f500) returned 0x0 [0165.929] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.929] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2417f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2417f500) returned 0x0 [0165.932] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.934] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.934] WriteFile (in: hFile=0xddc, lpBuffer=0x2417fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2417f830, lpOverlapped=0x0 | out: lpBuffer=0x2417fb34*, lpNumberOfBytesWritten=0x2417f830*=0x428, lpOverlapped=0x0) returned 1 [0165.935] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.935] ReadFile (in: hFile=0xddc, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x2417f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x2417f61c*=0x820, lpOverlapped=0x0) returned 1 [0165.935] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xfffff7e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.935] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5c50000, cbInput=0x820, pPaddingInfo=0x0, pbIV=0x2417f848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x2417f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2417f848, pbOutput=0x5c50000, pcbResult=0x2417f618) returned 0x0 [0165.935] WriteFile (in: hFile=0xddc, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2417f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x2417f61c*=0x830, lpOverlapped=0x0) returned 1 [0165.935] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2417f60c | out: lpNewFilePointer=0x0) returned 1 [0165.935] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.935] WriteFile (in: hFile=0xddc, lpBuffer=0x2417f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2417f61c, lpOverlapped=0x0 | out: lpBuffer=0x2417f83c*, lpNumberOfBytesWritten=0x2417f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.935] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x830, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.935] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.935] CloseHandle (hObject=0xddc) returned 1 [0166.055] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x278f0000 [0166.057] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.play")) returned 1 [0166.324] VirtualFree (lpAddress=0x278f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1980 os_tid = 0x1dd4 [0165.384] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.384] ReadFile (in: hFile=0xde4, lpBuffer=0x242bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x242bf85c, lpOverlapped=0x0 | out: lpBuffer=0x242bfb34*, lpNumberOfBytesRead=0x242bf85c*=0x428, lpOverlapped=0x0) returned 1 [0165.591] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.593] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.593] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x242bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0165.593] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x242bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x242bf828, pbKeyObject=0x0) returned 0x0 [0165.593] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x242bf500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x242bf500) returned 0x0 [0165.593] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.593] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x242bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x242bf500) returned 0x0 [0165.597] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.599] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.599] WriteFile (in: hFile=0xde4, lpBuffer=0x242bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x242bf830, lpOverlapped=0x0 | out: lpBuffer=0x242bfb34*, lpNumberOfBytesWritten=0x242bf830*=0x428, lpOverlapped=0x0) returned 1 [0165.599] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.599] ReadFile (in: hFile=0xde4, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x242bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x242bf61c*=0x820, lpOverlapped=0x0) returned 1 [0165.599] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0xfffff7e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.599] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x5d50000, cbInput=0x820, pPaddingInfo=0x0, pbIV=0x242bf848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x242bf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x242bf848, pbOutput=0x5d50000, pcbResult=0x242bf618) returned 0x0 [0165.599] WriteFile (in: hFile=0xde4, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x242bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x242bf61c*=0x830, lpOverlapped=0x0) returned 1 [0165.600] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x242bf60c | out: lpNewFilePointer=0x0) returned 1 [0165.600] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.600] WriteFile (in: hFile=0xde4, lpBuffer=0x242bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x242bf61c, lpOverlapped=0x0 | out: lpBuffer=0x242bf83c*, lpNumberOfBytesWritten=0x242bf61c*=0x8, lpOverlapped=0x0) returned 1 [0165.600] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x830, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.600] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.600] CloseHandle (hObject=0xde4) returned 1 [0166.026] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bf0000 [0166.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.play")) returned 1 [0166.567] VirtualFree (lpAddress=0x17bf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1981 os_tid = 0x1dd8 [0165.385] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.385] ReadFile (in: hFile=0xa40, lpBuffer=0x243ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x243ff85c, lpOverlapped=0x0 | out: lpBuffer=0x243ffb34*, lpNumberOfBytesRead=0x243ff85c*=0x428, lpOverlapped=0x0) returned 1 [0165.600] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.602] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x243ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0165.602] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x243ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x243ff828, pbKeyObject=0x0) returned 0x0 [0165.602] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x243ff500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x243ff500) returned 0x0 [0165.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.602] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x243ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x243ff500) returned 0x0 [0165.605] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.607] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.607] WriteFile (in: hFile=0xa40, lpBuffer=0x243ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x243ff830, lpOverlapped=0x0 | out: lpBuffer=0x243ffb34*, lpNumberOfBytesWritten=0x243ff830*=0x428, lpOverlapped=0x0) returned 1 [0165.608] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.608] ReadFile (in: hFile=0xa40, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x243ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x243ff61c*=0x7d4, lpOverlapped=0x0) returned 1 [0165.608] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xfffff82c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.608] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x5e50000, cbInput=0x7d4, pPaddingInfo=0x0, pbIV=0x243ff848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x243ff618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x243ff848, pbOutput=0x5e50000, pcbResult=0x243ff618) returned 0x0 [0165.608] WriteFile (in: hFile=0xa40, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x243ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x243ff61c*=0x7e0, lpOverlapped=0x0) returned 1 [0165.608] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243ff60c | out: lpNewFilePointer=0x0) returned 1 [0165.608] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.608] WriteFile (in: hFile=0xa40, lpBuffer=0x243ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x243ff61c, lpOverlapped=0x0 | out: lpBuffer=0x243ff83c*, lpNumberOfBytesWritten=0x243ff61c*=0x8, lpOverlapped=0x0) returned 1 [0165.608] SetFilePointerEx (in: hFile=0xa40, liDistanceToMove=0x7e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.608] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0165.608] CloseHandle (hObject=0xa40) returned 1 [0166.028] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27800000 [0166.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.play")) returned 1 [0166.564] VirtualFree (lpAddress=0x27800000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1982 os_tid = 0x1ddc [0165.386] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.386] ReadFile (in: hFile=0xd54, lpBuffer=0x2453fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2453f85c, lpOverlapped=0x0 | out: lpBuffer=0x2453fb34*, lpNumberOfBytesRead=0x2453f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.919] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.919] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x2453f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0165.919] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x2453f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x2453f828, pbKeyObject=0x0) returned 0x0 [0165.919] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2453f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2453f500) returned 0x0 [0165.919] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.919] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2453f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2453f500) returned 0x0 [0165.924] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.926] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.926] WriteFile (in: hFile=0xd54, lpBuffer=0x2453fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2453f830, lpOverlapped=0x0 | out: lpBuffer=0x2453fb34*, lpNumberOfBytesWritten=0x2453f830*=0x428, lpOverlapped=0x0) returned 1 [0165.926] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.926] ReadFile (in: hFile=0xd54, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x2453f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x2453f61c*=0x7e4, lpOverlapped=0x0) returned 1 [0165.926] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffff81c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.926] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x5f50000, cbInput=0x7e4, pPaddingInfo=0x0, pbIV=0x2453f848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x2453f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2453f848, pbOutput=0x5f50000, pcbResult=0x2453f618) returned 0x0 [0165.926] WriteFile (in: hFile=0xd54, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2453f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x2453f61c*=0x7f0, lpOverlapped=0x0) returned 1 [0165.926] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2453f60c | out: lpNewFilePointer=0x0) returned 1 [0165.926] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.926] WriteFile (in: hFile=0xd54, lpBuffer=0x2453f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2453f61c, lpOverlapped=0x0 | out: lpBuffer=0x2453f83c*, lpNumberOfBytesWritten=0x2453f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.927] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x7f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.927] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.927] CloseHandle (hObject=0xd54) returned 1 [0166.053] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x278e0000 [0166.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.play")) returned 1 [0166.326] VirtualFree (lpAddress=0x278e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1983 os_tid = 0x1de0 [0165.388] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.388] ReadFile (in: hFile=0x1300, lpBuffer=0x2467fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2467f85c, lpOverlapped=0x0 | out: lpBuffer=0x2467fb34*, lpNumberOfBytesRead=0x2467f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.935] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.936] ReadFile (in: hFile=0x1300, lpBuffer=0x2467fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2467f85c, lpOverlapped=0x0 | out: lpBuffer=0x2467fb34*, lpNumberOfBytesRead=0x2467f85c*=0x428, lpOverlapped=0x0) returned 1 [0165.936] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x17be0000 [0165.937] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x17be0000) returned 0x0 [0165.937] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x2467f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0165.937] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x2467f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x17be0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x2467f828, pbKeyObject=0x0) returned 0x0 [0165.938] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x17be0000, cbOutput=0x230, pcbResult=0x2467f500, dwFlags=0x0 | out: pbOutput=0x17be0000, pcbResult=0x2467f500) returned 0x0 [0165.938] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x17be0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x17be0230) returned 0x0 [0165.938] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x17be0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x17be0000, cbOutput=0x400, pcbResult=0x2467f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x17be0000, pcbResult=0x2467f500) returned 0x0 [0165.942] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.944] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.944] WriteFile (in: hFile=0x1300, lpBuffer=0x2467fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2467f830, lpOverlapped=0x0 | out: lpBuffer=0x2467fb34*, lpNumberOfBytesWritten=0x2467f830*=0x428, lpOverlapped=0x0) returned 1 [0165.944] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.945] ReadFile (in: hFile=0x1300, lpBuffer=0x6050000, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x2467f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x2467f61c*=0x964, lpOverlapped=0x0) returned 1 [0165.945] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xfffff69c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.945] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x6050000, cbInput=0x964, pPaddingInfo=0x0, pbIV=0x2467f848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x2467f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2467f848, pbOutput=0x6050000, pcbResult=0x2467f618) returned 0x0 [0165.945] WriteFile (in: hFile=0x1300, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2467f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x2467f61c*=0x970, lpOverlapped=0x0) returned 1 [0165.945] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2467f60c | out: lpNewFilePointer=0x0) returned 1 [0165.945] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.945] WriteFile (in: hFile=0x1300, lpBuffer=0x2467f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2467f61c, lpOverlapped=0x0 | out: lpBuffer=0x2467f83c*, lpNumberOfBytesWritten=0x2467f61c*=0x8, lpOverlapped=0x0) returned 1 [0165.945] SetFilePointerEx (in: hFile=0x1300, liDistanceToMove=0x970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.946] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0165.946] CloseHandle (hObject=0x1300) returned 1 [0166.057] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x27900000 [0166.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.play")) returned 1 [0166.318] VirtualFree (lpAddress=0x27900000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1984 os_tid = 0x1de4 [0165.390] VirtualAlloc (lpAddress=0x0, dwSize=0xf4, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0165.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0165.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f090c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0165.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1460 [0165.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0924, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec [0165.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1430 [0165.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f093c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13bc [0165.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0165.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0954, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1458 [0165.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c [0165.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f096c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440 [0165.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310 [0165.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0984, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1380 [0165.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1450 [0165.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f099c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d4 [0165.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410 [0165.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4 [0165.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1398 [0165.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1110 [0165.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0165.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328 [0165.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354 [0165.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc [0165.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0165.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0165.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334 [0165.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0165.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0165.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x125c [0165.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1254 [0165.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264 [0165.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274 [0165.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a74, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0165.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x123c [0165.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a8c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c [0165.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0165.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234 [0165.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0165.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0abc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c [0165.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0165.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ad4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0165.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0165.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0165.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c [0165.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b04, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0165.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0165.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0165.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0165.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0165.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0165.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c [0165.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0165.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8 [0165.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0165.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084 [0165.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1298 [0165.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b94, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0165.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c [0165.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0165.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c [0165.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bc4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0165.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0165.419] WaitForMultipleObjects (nCount=0x3d, lpHandles=0x6f0000*=0x43c, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0166.961] CloseHandle (hObject=0x43c) returned 1 [0166.961] CloseHandle (hObject=0x10c0) returned 1 [0166.961] CloseHandle (hObject=0x1460) returned 1 [0166.961] CloseHandle (hObject=0x13ec) returned 1 [0166.962] CloseHandle (hObject=0x1430) returned 1 [0166.962] CloseHandle (hObject=0x13bc) returned 1 [0166.962] CloseHandle (hObject=0x10e0) returned 1 [0166.962] CloseHandle (hObject=0x1458) returned 1 [0166.962] CloseHandle (hObject=0x135c) returned 1 [0166.962] CloseHandle (hObject=0x1440) returned 1 [0166.962] CloseHandle (hObject=0x1310) returned 1 [0166.962] CloseHandle (hObject=0x1380) returned 1 [0166.962] CloseHandle (hObject=0x1450) returned 1 [0166.962] CloseHandle (hObject=0x13d4) returned 1 [0166.962] CloseHandle (hObject=0x1410) returned 1 [0166.962] CloseHandle (hObject=0x13b4) returned 1 [0166.962] CloseHandle (hObject=0x1398) returned 1 [0166.962] CloseHandle (hObject=0x1110) returned 1 [0166.962] CloseHandle (hObject=0x13e4) returned 1 [0166.962] CloseHandle (hObject=0x1328) returned 1 [0166.962] CloseHandle (hObject=0x1354) returned 1 [0166.962] CloseHandle (hObject=0x13cc) returned 1 [0166.962] CloseHandle (hObject=0x4b4) returned 1 [0166.962] CloseHandle (hObject=0x1308) returned 1 [0166.962] CloseHandle (hObject=0x1334) returned 1 [0166.963] CloseHandle (hObject=0x12e0) returned 1 [0166.963] CloseHandle (hObject=0x614) returned 1 [0166.963] CloseHandle (hObject=0x125c) returned 1 [0166.963] CloseHandle (hObject=0x1254) returned 1 [0166.963] CloseHandle (hObject=0x1264) returned 1 [0166.963] CloseHandle (hObject=0x1274) returned 1 [0166.963] CloseHandle (hObject=0x1244) returned 1 [0166.963] CloseHandle (hObject=0x123c) returned 1 [0166.963] CloseHandle (hObject=0x128c) returned 1 [0166.963] CloseHandle (hObject=0x126c) returned 1 [0166.963] CloseHandle (hObject=0x1234) returned 1 [0166.963] CloseHandle (hObject=0x1024) returned 1 [0166.963] CloseHandle (hObject=0x100c) returned 1 [0166.963] CloseHandle (hObject=0x1054) returned 1 [0166.963] CloseHandle (hObject=0x108c) returned 1 [0166.963] CloseHandle (hObject=0x11e4) returned 1 [0166.963] CloseHandle (hObject=0xfe0) returned 1 [0166.963] CloseHandle (hObject=0xa8c) returned 1 [0166.963] CloseHandle (hObject=0x1224) returned 1 [0166.963] CloseHandle (hObject=0x11f4) returned 1 [0166.963] CloseHandle (hObject=0x121c) returned 1 [0166.963] CloseHandle (hObject=0x1204) returned 1 [0166.964] CloseHandle (hObject=0x1284) returned 1 [0166.964] CloseHandle (hObject=0x127c) returned 1 [0166.964] CloseHandle (hObject=0x122c) returned 1 [0166.964] CloseHandle (hObject=0x12d0) returned 1 [0166.964] CloseHandle (hObject=0x12b8) returned 1 [0166.964] CloseHandle (hObject=0x12c0) returned 1 [0166.964] CloseHandle (hObject=0x1084) returned 1 [0166.964] CloseHandle (hObject=0x1298) returned 1 [0166.964] CloseHandle (hObject=0x103c) returned 1 [0166.964] CloseHandle (hObject=0x101c) returned 1 [0166.964] CloseHandle (hObject=0xd8c) returned 1 [0166.964] CloseHandle (hObject=0x124c) returned 1 [0166.964] CloseHandle (hObject=0x1064) returned 1 [0166.964] CloseHandle (hObject=0x12c8) returned 1 [0166.964] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 1985 os_tid = 0x1de8 [0165.432] GetLastError () returned 0x57 [0165.432] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c9c48 [0165.432] SetLastError (dwErrCode=0x57) [0165.432] IcmpCreateFile () returned 0x7ba730 [0165.432] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b6e8 [0165.432] IcmpSendEcho2 (IcmpHandle=0x7ba730, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc200a8c0, RequestData=0xe9ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b6e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1986 os_tid = 0x1dec [0165.434] GetLastError () returned 0x57 [0165.434] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c9fd0 [0165.434] SetLastError (dwErrCode=0x57) [0165.434] IcmpCreateFile () returned 0x7ba4c8 [0165.434] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b738 [0165.434] IcmpSendEcho2 (IcmpHandle=0x7ba4c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc300a8c0, RequestData=0xb74ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b738, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1987 os_tid = 0x1df0 [0165.435] GetLastError () returned 0x57 [0165.435] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ca358 [0165.435] SetLastError (dwErrCode=0x57) [0165.435] IcmpCreateFile () returned 0x7ba500 [0165.436] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bd28 [0165.436] IcmpSendEcho2 (IcmpHandle=0x7ba500, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc400a8c0, RequestData=0xb88ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bd28, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1988 os_tid = 0x1df4 [0165.436] GetLastError () returned 0x57 [0165.437] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ca6e0 [0165.437] SetLastError (dwErrCode=0x57) [0165.437] IcmpCreateFile () returned 0x7ba538 [0165.437] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bdc8 [0165.437] IcmpSendEcho2 (IcmpHandle=0x7ba538, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc500a8c0, RequestData=0xd30ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bdc8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1989 os_tid = 0x1df8 [0165.438] GetLastError () returned 0x57 [0165.438] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7cadf0 [0165.438] SetLastError (dwErrCode=0x57) [0165.438] IcmpCreateFile () returned 0x7ba570 [0165.438] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fe00 [0165.438] IcmpSendEcho2 (IcmpHandle=0x7ba570, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc600a8c0, RequestData=0xd44ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fe00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1990 os_tid = 0x1dfc [0165.439] GetLastError () returned 0x57 [0165.439] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7cb178 [0165.439] SetLastError (dwErrCode=0x57) [0165.439] IcmpCreateFile () returned 0x7ba5a8 [0165.439] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78ff40 [0165.439] IcmpSendEcho2 (IcmpHandle=0x7ba5a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc700a8c0, RequestData=0xd58ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78ff40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1991 os_tid = 0x1e00 [0165.440] GetLastError () returned 0x57 [0165.440] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4400 [0165.441] SetLastError (dwErrCode=0x57) [0165.441] IcmpCreateFile () returned 0x7ba5e0 [0165.441] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78ff90 [0165.441] IcmpSendEcho2 (IcmpHandle=0x7ba5e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc800a8c0, RequestData=0xd6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78ff90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1992 os_tid = 0x1e04 [0165.442] GetLastError () returned 0x57 [0165.442] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4788 [0165.442] SetLastError (dwErrCode=0x57) [0165.442] IcmpCreateFile () returned 0x7ba618 [0165.442] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78ffe0 [0165.442] IcmpSendEcho2 (IcmpHandle=0x7ba618, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc900a8c0, RequestData=0xd80ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78ffe0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1993 os_tid = 0x1e08 [0165.443] GetLastError () returned 0x57 [0165.443] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4b10 [0165.443] SetLastError (dwErrCode=0x57) [0165.443] IcmpCreateFile () returned 0x7ba650 [0165.443] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790030 [0165.443] IcmpSendEcho2 (IcmpHandle=0x7ba650, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xca00a8c0, RequestData=0xd94ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790030, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1994 os_tid = 0x1e0c [0165.444] GetLastError () returned 0x57 [0165.444] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c4e98 [0165.444] SetLastError (dwErrCode=0x57) [0165.444] IcmpCreateFile () returned 0x7ba688 [0165.444] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790080 [0165.444] IcmpSendEcho2 (IcmpHandle=0x7ba688, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcb00a8c0, RequestData=0xda8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790080, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1995 os_tid = 0x1e10 [0165.445] GetLastError () returned 0x57 [0165.445] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c5220 [0165.446] SetLastError (dwErrCode=0x57) [0165.446] IcmpCreateFile () returned 0x7ba6c0 [0165.446] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7900d0 [0165.446] IcmpSendEcho2 (IcmpHandle=0x7ba6c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcc00a8c0, RequestData=0xdbcff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7900d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1996 os_tid = 0x1e14 [0165.447] GetLastError () returned 0x57 [0165.447] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c55a8 [0165.447] SetLastError (dwErrCode=0x57) [0165.447] IcmpCreateFile () returned 0x7ba6f8 [0165.447] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790120 [0165.447] IcmpSendEcho2 (IcmpHandle=0x7ba6f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcd00a8c0, RequestData=0xdd0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790120, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1997 os_tid = 0x1e18 [0165.448] GetLastError () returned 0x57 [0165.448] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c5930 [0165.448] SetLastError (dwErrCode=0x57) [0165.448] IcmpCreateFile () returned 0x7ba768 [0165.448] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790170 [0165.448] IcmpSendEcho2 (IcmpHandle=0x7ba768, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xce00a8c0, RequestData=0xde4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790170, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1998 os_tid = 0x1e1c [0165.449] GetLastError () returned 0x57 [0165.449] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c5cb8 [0165.449] SetLastError (dwErrCode=0x57) [0165.449] IcmpCreateFile () returned 0x7ba7d8 [0165.449] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7901c0 [0165.449] IcmpSendEcho2 (IcmpHandle=0x7ba7d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcf00a8c0, RequestData=0xe18ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7901c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 1999 os_tid = 0x1e20 [0165.450] GetLastError () returned 0x57 [0165.450] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c6040 [0165.451] SetLastError (dwErrCode=0x57) [0165.451] IcmpCreateFile () returned 0x7ba810 [0165.451] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fdb0 [0165.451] IcmpSendEcho2 (IcmpHandle=0x7ba810, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd000a8c0, RequestData=0xe28ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fdb0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2000 os_tid = 0x1e24 [0165.452] GetLastError () returned 0x57 [0165.453] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c63c8 [0165.453] SetLastError (dwErrCode=0x57) [0165.453] IcmpCreateFile () returned 0x7ba490 [0165.453] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790210 [0165.453] IcmpSendEcho2 (IcmpHandle=0x7ba490, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd100a8c0, RequestData=0xe38ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790210, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2001 os_tid = 0x1e28 [0165.454] GetLastError () returned 0x57 [0165.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c6750 [0165.454] SetLastError (dwErrCode=0x57) [0165.454] IcmpCreateFile () returned 0x7ba848 [0165.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790260 [0165.454] IcmpSendEcho2 (IcmpHandle=0x7ba848, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd200a8c0, RequestData=0x2057ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790260, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2002 os_tid = 0x1e2c [0165.455] GetLastError () returned 0x57 [0165.455] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c6ad8 [0165.455] SetLastError (dwErrCode=0x57) [0165.455] IcmpCreateFile () returned 0x7ba880 [0165.455] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7902b0 [0165.455] IcmpSendEcho2 (IcmpHandle=0x7ba880, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd300a8c0, RequestData=0x2067ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7902b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2003 os_tid = 0x1e30 [0165.456] GetLastError () returned 0x57 [0165.457] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c6e60 [0165.457] SetLastError (dwErrCode=0x57) [0165.457] IcmpCreateFile () returned 0x7ba8b8 [0165.457] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fd60 [0165.457] IcmpSendEcho2 (IcmpHandle=0x7ba8b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd400a8c0, RequestData=0x2077ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fd60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2004 os_tid = 0x1e34 [0165.458] GetLastError () returned 0x57 [0165.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c71e8 [0165.458] SetLastError (dwErrCode=0x57) [0165.458] IcmpCreateFile () returned 0x7ba2d0 [0165.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fe50 [0165.458] IcmpSendEcho2 (IcmpHandle=0x7ba2d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd500a8c0, RequestData=0x2087ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fe50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2005 os_tid = 0x1e38 [0165.459] GetLastError () returned 0x57 [0165.459] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c7570 [0165.459] SetLastError (dwErrCode=0x57) [0165.459] IcmpCreateFile () returned 0x7ba308 [0165.459] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fea0 [0165.459] IcmpSendEcho2 (IcmpHandle=0x7ba308, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd600a8c0, RequestData=0x20cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fea0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2006 os_tid = 0x1e3c [0165.461] GetLastError () returned 0x57 [0165.461] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c78f8 [0165.461] SetLastError (dwErrCode=0x57) [0165.461] IcmpCreateFile () returned 0x7ba340 [0165.461] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fef0 [0165.461] IcmpSendEcho2 (IcmpHandle=0x7ba340, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd700a8c0, RequestData=0x2137ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fef0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2007 os_tid = 0x1e40 [0165.462] GetLastError () returned 0x57 [0165.462] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c7c80 [0165.462] SetLastError (dwErrCode=0x57) [0165.462] IcmpCreateFile () returned 0x7ba378 [0165.462] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fb80 [0165.462] IcmpSendEcho2 (IcmpHandle=0x7ba378, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd800a8c0, RequestData=0x21c3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fb80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2008 os_tid = 0x1e44 [0165.463] GetLastError () returned 0x57 [0165.463] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c8008 [0165.463] SetLastError (dwErrCode=0x57) [0165.463] IcmpCreateFile () returned 0x7ba3b0 [0165.464] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fbd0 [0165.464] IcmpSendEcho2 (IcmpHandle=0x7ba3b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd900a8c0, RequestData=0x247bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fbd0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2009 os_tid = 0x1e48 [0165.465] GetLastError () returned 0x57 [0165.465] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c8390 [0165.465] SetLastError (dwErrCode=0x57) [0165.465] IcmpCreateFile () returned 0x7ba3e8 [0165.465] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fc20 [0165.465] IcmpSendEcho2 (IcmpHandle=0x7ba3e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xda00a8c0, RequestData=0x248fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fc20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2010 os_tid = 0x1e4c [0165.466] GetLastError () returned 0x57 [0165.466] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7c8718 [0165.466] SetLastError (dwErrCode=0x57) [0165.466] IcmpCreateFile () returned 0x7ba420 [0165.466] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fc70 [0165.466] IcmpSendEcho2 (IcmpHandle=0x7ba420, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdb00a8c0, RequestData=0x24a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fc70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2011 os_tid = 0x1e50 [0165.467] GetLastError () returned 0x57 [0165.467] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7cbf98 [0165.467] SetLastError (dwErrCode=0x57) [0165.467] IcmpCreateFile () returned 0x7ba458 [0165.467] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fcc0 [0165.467] IcmpSendEcho2 (IcmpHandle=0x7ba458, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdc00a8c0, RequestData=0x24b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fcc0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2012 os_tid = 0x1e54 [0165.468] GetLastError () returned 0x57 [0165.469] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7cb500 [0165.469] SetLastError (dwErrCode=0x57) [0165.469] IcmpCreateFile () returned 0x7baa40 [0165.469] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fd10 [0165.469] IcmpSendEcho2 (IcmpHandle=0x7baa40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdd00a8c0, RequestData=0x24cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fd10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2013 os_tid = 0x1e58 [0165.470] GetLastError () returned 0x57 [0165.470] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7cb888 [0165.470] SetLastError (dwErrCode=0x57) [0165.470] IcmpCreateFile () returned 0x7baa78 [0165.470] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f360 [0165.470] IcmpSendEcho2 (IcmpHandle=0x7baa78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xde00a8c0, RequestData=0x24dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f360, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2014 os_tid = 0x1e5c [0165.471] GetLastError () returned 0x57 [0165.471] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7cbc10 [0165.471] SetLastError (dwErrCode=0x57) [0165.471] IcmpCreateFile () returned 0x7baab0 [0165.471] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f3b0 [0165.471] IcmpSendEcho2 (IcmpHandle=0x7baab0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdf00a8c0, RequestData=0x24f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f3b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2015 os_tid = 0x1e60 [0166.110] GetLastError () returned 0x57 [0166.110] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6ac0 [0166.110] SetLastError (dwErrCode=0x57) [0166.110] IcmpCreateFile () returned 0x7baa08 [0166.110] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f400 [0166.110] IcmpSendEcho2 (IcmpHandle=0x7baa08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe000a8c0, RequestData=0x2507ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f400, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2016 os_tid = 0x1e64 [0166.112] GetLastError () returned 0x57 [0166.112] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6e48 [0166.112] SetLastError (dwErrCode=0x57) [0166.112] IcmpCreateFile () returned 0x7baae8 [0166.112] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f450 [0166.112] IcmpSendEcho2 (IcmpHandle=0x7baae8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe100a8c0, RequestData=0x251bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f450, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2017 os_tid = 0x1e68 [0166.113] GetLastError () returned 0x57 [0166.113] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0b10 [0166.115] SetLastError (dwErrCode=0x57) [0166.115] IcmpCreateFile () returned 0x7bab20 [0166.115] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f4a0 [0166.115] IcmpSendEcho2 (IcmpHandle=0x7bab20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe200a8c0, RequestData=0x254fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f4a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2018 os_tid = 0x1e6c [0166.117] GetLastError () returned 0x57 [0166.117] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c5c48 [0166.117] SetLastError (dwErrCode=0x57) [0166.117] IcmpCreateFile () returned 0x7bab58 [0166.117] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f4f0 [0166.117] IcmpSendEcho2 (IcmpHandle=0x7bab58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe300a8c0, RequestData=0x2563ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f4f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2019 os_tid = 0x1e70 [0166.118] GetLastError () returned 0x57 [0166.118] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c5fd0 [0166.118] SetLastError (dwErrCode=0x57) [0166.118] IcmpCreateFile () returned 0x7ba9d0 [0166.118] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f540 [0166.118] IcmpSendEcho2 (IcmpHandle=0x7ba9d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe400a8c0, RequestData=0x2577ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f540, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2020 os_tid = 0x1e74 [0166.119] GetLastError () returned 0x57 [0166.119] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c6358 [0166.119] SetLastError (dwErrCode=0x57) [0166.119] IcmpCreateFile () returned 0x7ba228 [0166.119] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f590 [0166.119] IcmpSendEcho2 (IcmpHandle=0x7ba228, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe500a8c0, RequestData=0x258bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f590, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2021 os_tid = 0x1e78 [0166.120] GetLastError () returned 0x57 [0166.120] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0e98 [0166.121] SetLastError (dwErrCode=0x57) [0166.121] IcmpCreateFile () returned 0x7b9d58 [0166.121] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f5e0 [0166.121] IcmpSendEcho2 (IcmpHandle=0x7b9d58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe600a8c0, RequestData=0x259fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f5e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2022 os_tid = 0x1e7c [0166.122] GetLastError () returned 0x57 [0166.122] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4008 [0166.122] SetLastError (dwErrCode=0x57) [0166.122] IcmpCreateFile () returned 0x7ba260 [0166.122] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f630 [0166.122] IcmpSendEcho2 (IcmpHandle=0x7ba260, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe700a8c0, RequestData=0x25b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f630, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2023 os_tid = 0x1e80 [0166.123] GetLastError () returned 0x57 [0166.123] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4390 [0166.123] SetLastError (dwErrCode=0x57) [0166.123] IcmpCreateFile () returned 0x7ba298 [0166.123] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f680 [0166.123] IcmpSendEcho2 (IcmpHandle=0x7ba298, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe800a8c0, RequestData=0x25c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f680, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2024 os_tid = 0x1e84 [0166.124] GetLastError () returned 0x57 [0166.124] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4718 [0166.124] SetLastError (dwErrCode=0x57) [0166.124] IcmpCreateFile () returned 0x7b9bd0 [0166.124] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f6d0 [0166.124] IcmpSendEcho2 (IcmpHandle=0x7b9bd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe900a8c0, RequestData=0x25dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f6d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2025 os_tid = 0x1e88 [0166.125] GetLastError () returned 0x57 [0166.125] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4aa0 [0166.125] SetLastError (dwErrCode=0x57) [0166.125] IcmpCreateFile () returned 0x7b9c08 [0166.125] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f720 [0166.125] IcmpSendEcho2 (IcmpHandle=0x7b9c08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xea00a8c0, RequestData=0x25efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f720, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2026 os_tid = 0x1e8c [0166.126] GetLastError () returned 0x57 [0166.126] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c4e28 [0166.127] SetLastError (dwErrCode=0x57) [0166.127] IcmpCreateFile () returned 0x7b9c40 [0166.127] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f770 [0166.127] IcmpSendEcho2 (IcmpHandle=0x7b9c40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xeb00a8c0, RequestData=0x2603ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f770, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2027 os_tid = 0x1e90 [0166.127] GetLastError () returned 0x57 [0166.128] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c51b0 [0166.128] SetLastError (dwErrCode=0x57) [0166.128] IcmpCreateFile () returned 0x7b9c78 [0166.128] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f7c0 [0166.128] IcmpSendEcho2 (IcmpHandle=0x7b9c78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xec00a8c0, RequestData=0x2617ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f7c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2028 os_tid = 0x1e94 [0166.129] GetLastError () returned 0x57 [0166.129] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c5538 [0166.129] SetLastError (dwErrCode=0x57) [0166.129] IcmpCreateFile () returned 0x7b9cb0 [0166.129] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f810 [0166.129] IcmpSendEcho2 (IcmpHandle=0x7b9cb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xed00a8c0, RequestData=0x262bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f810, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2029 os_tid = 0x1e98 [0166.130] GetLastError () returned 0x57 [0166.130] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c58c0 [0166.130] SetLastError (dwErrCode=0x57) [0166.130] IcmpCreateFile () returned 0x7b9ce8 [0166.130] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f860 [0166.130] IcmpSendEcho2 (IcmpHandle=0x7b9ce8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xee00a8c0, RequestData=0x263fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f860, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2030 os_tid = 0x1e9c [0166.131] GetLastError () returned 0x57 [0166.131] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c66e0 [0166.131] SetLastError (dwErrCode=0x57) [0166.131] IcmpCreateFile () returned 0x7b9d20 [0166.131] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f8b0 [0166.132] IcmpSendEcho2 (IcmpHandle=0x7b9d20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xef00a8c0, RequestData=0x2653ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f8b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2031 os_tid = 0x1ea0 [0166.133] GetLastError () returned 0x57 [0166.133] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c6a68 [0166.133] SetLastError (dwErrCode=0x57) [0166.133] IcmpCreateFile () returned 0x7b9d90 [0166.133] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f900 [0166.133] IcmpSendEcho2 (IcmpHandle=0x7b9d90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf000a8c0, RequestData=0x2667ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f900, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2032 os_tid = 0x1ea4 [0166.134] GetLastError () returned 0x57 [0166.134] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c1220 [0166.134] SetLastError (dwErrCode=0x57) [0166.134] IcmpCreateFile () returned 0x7b9dc8 [0166.134] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f950 [0166.134] IcmpSendEcho2 (IcmpHandle=0x7b9dc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf100a8c0, RequestData=0x267bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f950, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2033 os_tid = 0x1ea8 [0166.135] GetLastError () returned 0x57 [0166.135] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c6df0 [0166.135] SetLastError (dwErrCode=0x57) [0166.135] IcmpCreateFile () returned 0x7ba0d8 [0166.135] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f9a0 [0166.135] IcmpSendEcho2 (IcmpHandle=0x7ba0d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf200a8c0, RequestData=0x268fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f9a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2034 os_tid = 0x1eac [0166.136] GetLastError () returned 0x57 [0166.136] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0078 [0166.137] SetLastError (dwErrCode=0x57) [0166.137] IcmpCreateFile () returned 0x7ba110 [0166.137] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78f9f0 [0166.137] IcmpSendEcho2 (IcmpHandle=0x7ba110, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf300a8c0, RequestData=0x26a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78f9f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2035 os_tid = 0x1eb0 [0166.138] GetLastError () returned 0x57 [0166.138] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0400 [0166.138] SetLastError (dwErrCode=0x57) [0166.138] IcmpCreateFile () returned 0x7ba148 [0166.138] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fa40 [0166.138] IcmpSendEcho2 (IcmpHandle=0x7ba148, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf400a8c0, RequestData=0x26b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fa40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2036 os_tid = 0x1eb4 [0166.139] GetLastError () returned 0x57 [0166.139] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c0788 [0166.139] SetLastError (dwErrCode=0x57) [0166.139] IcmpCreateFile () returned 0x7ba180 [0166.139] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fa90 [0166.139] IcmpSendEcho2 (IcmpHandle=0x7ba180, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf500a8c0, RequestData=0x26cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fa90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2037 os_tid = 0x1eb8 [0166.140] GetLastError () returned 0x57 [0166.140] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c15a8 [0166.140] SetLastError (dwErrCode=0x57) [0166.140] IcmpCreateFile () returned 0x7ba1b8 [0166.140] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fae0 [0166.140] IcmpSendEcho2 (IcmpHandle=0x7ba1b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf600a8c0, RequestData=0x26dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fae0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2038 os_tid = 0x1ebc [0166.141] GetLastError () returned 0x57 [0166.141] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c1930 [0166.141] SetLastError (dwErrCode=0x57) [0166.141] IcmpCreateFile () returned 0x7ba1f0 [0166.141] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x78fb30 [0166.142] IcmpSendEcho2 (IcmpHandle=0x7ba1f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf700a8c0, RequestData=0x26f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x78fb30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2039 os_tid = 0x1ec0 [0166.149] GetLastError () returned 0x57 [0166.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c1cb8 [0166.149] SetLastError (dwErrCode=0x57) [0166.149] IcmpCreateFile () returned 0x7b9e00 [0166.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798ec0 [0166.149] IcmpSendEcho2 (IcmpHandle=0x7b9e00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf800a8c0, RequestData=0x2707ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798ec0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2040 os_tid = 0x1ec4 [0166.150] GetLastError () returned 0x57 [0166.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2040 [0166.150] SetLastError (dwErrCode=0x57) [0166.150] IcmpCreateFile () returned 0x7b9ff8 [0166.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798e20 [0166.150] IcmpSendEcho2 (IcmpHandle=0x7b9ff8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf900a8c0, RequestData=0x271bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798e20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2041 os_tid = 0x1ec8 [0166.151] GetLastError () returned 0x57 [0166.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c23c8 [0166.151] SetLastError (dwErrCode=0x57) [0166.151] IcmpCreateFile () returned 0x7ba030 [0166.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798e70 [0166.151] IcmpSendEcho2 (IcmpHandle=0x7ba030, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfa00a8c0, RequestData=0x272fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798e70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2042 os_tid = 0x1ecc [0166.152] GetLastError () returned 0x57 [0166.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2750 [0166.153] SetLastError (dwErrCode=0x57) [0166.153] IcmpCreateFile () returned 0x7ba068 [0166.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798f10 [0166.153] IcmpSendEcho2 (IcmpHandle=0x7ba068, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfb00a8c0, RequestData=0x2743ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798f10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2043 os_tid = 0x1ed0 [0166.154] GetLastError () returned 0x57 [0166.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2ad8 [0166.154] SetLastError (dwErrCode=0x57) [0166.154] IcmpCreateFile () returned 0x7ba0a0 [0166.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798f60 [0166.154] IcmpSendEcho2 (IcmpHandle=0x7ba0a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfc00a8c0, RequestData=0x2757ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798f60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2044 os_tid = 0x1ed4 [0166.155] GetLastError () returned 0x57 [0166.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c2e60 [0166.155] SetLastError (dwErrCode=0x57) [0166.155] IcmpCreateFile () returned 0x7b9e38 [0166.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798fb0 [0166.155] IcmpSendEcho2 (IcmpHandle=0x7b9e38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfd00a8c0, RequestData=0x276bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798fb0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2045 os_tid = 0x1ed8 [0166.156] GetLastError () returned 0x57 [0166.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c31e8 [0166.156] SetLastError (dwErrCode=0x57) [0166.156] IcmpCreateFile () returned 0x7b9e70 [0166.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x799000 [0166.156] IcmpSendEcho2 (IcmpHandle=0x7b9e70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfe00a8c0, RequestData=0x277fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x799000, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2046 os_tid = 0x1edc [0166.162] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.162] ReadFile (in: hFile=0x548, lpBuffer=0x2213fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2213f85c, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesRead=0x2213f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.164] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4d0000 [0166.166] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4d0000) returned 0x0 [0166.166] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x2213f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0166.166] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x2213f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x2213f828, pbKeyObject=0x0) returned 0x0 [0166.166] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4d0000, cbOutput=0x230, pcbResult=0x2213f500, dwFlags=0x0 | out: pbOutput=0xb4d0000, pcbResult=0x2213f500) returned 0x0 [0166.166] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4d0230) returned 0x0 [0166.166] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4d0000, cbOutput=0x400, pcbResult=0x2213f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4d0000, pcbResult=0x2213f500) returned 0x0 [0166.169] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.172] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.172] WriteFile (in: hFile=0x548, lpBuffer=0x2213fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2213f830, lpOverlapped=0x0 | out: lpBuffer=0x2213fb34*, lpNumberOfBytesWritten=0x2213f830*=0x428, lpOverlapped=0x0) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.173] ReadFile (in: hFile=0x548, lpBuffer=0x6150000, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x2213f61c*=0x804, lpOverlapped=0x0) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xfffff7fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.173] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x6150000, cbInput=0x804, pPaddingInfo=0x0, pbIV=0x2213f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x2213f618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x2213f848, pbOutput=0x6150000, pcbResult=0x2213f618) returned 0x0 [0166.173] WriteFile (in: hFile=0x548, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x2213f61c*=0x810, lpOverlapped=0x0) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2213f60c | out: lpNewFilePointer=0x0) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.173] WriteFile (in: hFile=0x548, lpBuffer=0x2213f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2213f61c, lpOverlapped=0x0 | out: lpBuffer=0x2213f83c*, lpNumberOfBytesWritten=0x2213f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.173] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0166.173] CloseHandle (hObject=0x548) returned 1 [0166.245] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4d0000 [0166.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.play")) returned 1 [0166.315] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2047 os_tid = 0x1ee0 [0166.174] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.174] ReadFile (in: hFile=0xdd4, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0166.175] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.176] ReadFile (in: hFile=0xdd4, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0166.176] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4d0000 [0166.177] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4d0000) returned 0x0 [0166.178] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x210ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0166.178] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x210ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x210ff828, pbKeyObject=0x0) returned 0x0 [0166.178] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4d0000, cbOutput=0x230, pcbResult=0x210ff500, dwFlags=0x0 | out: pbOutput=0xb4d0000, pcbResult=0x210ff500) returned 0x0 [0166.178] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4d0230) returned 0x0 [0166.178] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4d0000, cbOutput=0x400, pcbResult=0x210ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4d0000, pcbResult=0x210ff500) returned 0x0 [0166.181] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.184] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] WriteFile (in: hFile=0xdd4, lpBuffer=0x210ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210ff830, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesWritten=0x210ff830*=0x428, lpOverlapped=0x0) returned 1 [0166.184] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] ReadFile (in: hFile=0xdd4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x210ff61c*=0x8b8, lpOverlapped=0x0) returned 1 [0166.185] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffff748, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.185] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2750000, cbInput=0x8b8, pPaddingInfo=0x0, pbIV=0x210ff848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x210ff618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x210ff848, pbOutput=0x2750000, pcbResult=0x210ff618) returned 0x0 [0166.185] WriteFile (in: hFile=0xdd4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x210ff61c*=0x8c0, lpOverlapped=0x0) returned 1 [0166.185] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210ff60c | out: lpNewFilePointer=0x0) returned 1 [0166.185] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.185] WriteFile (in: hFile=0xdd4, lpBuffer=0x210ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x210ff83c*, lpNumberOfBytesWritten=0x210ff61c*=0x8, lpOverlapped=0x0) returned 1 [0166.185] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.186] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0166.186] CloseHandle (hObject=0xdd4) returned 1 [0166.247] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4e0000 [0166.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.play")) returned 1 [0166.313] VirtualFree (lpAddress=0xb4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2048 os_tid = 0x1ee4 [0166.186] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.186] ReadFile (in: hFile=0xdcc, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.187] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4d0000 [0166.189] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4d0000) returned 0x0 [0166.189] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x214bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0166.189] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x214bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x214bf828, pbKeyObject=0x0) returned 0x0 [0166.189] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4d0000, cbOutput=0x230, pcbResult=0x214bf500, dwFlags=0x0 | out: pbOutput=0xb4d0000, pcbResult=0x214bf500) returned 0x0 [0166.189] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4d0230) returned 0x0 [0166.190] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4d0000, cbOutput=0x400, pcbResult=0x214bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4d0000, pcbResult=0x214bf500) returned 0x0 [0166.193] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.196] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.196] WriteFile (in: hFile=0xdcc, lpBuffer=0x214bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x214bf830, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesWritten=0x214bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.197] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.197] ReadFile (in: hFile=0xdcc, lpBuffer=0x2850000, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x214bf61c*=0x70c, lpOverlapped=0x0) returned 1 [0166.197] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffff8f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.197] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2850000, cbInput=0x70c, pPaddingInfo=0x0, pbIV=0x214bf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x214bf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x214bf848, pbOutput=0x2850000, pcbResult=0x214bf618) returned 0x0 [0166.197] WriteFile (in: hFile=0xdcc, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x214bf61c*=0x710, lpOverlapped=0x0) returned 1 [0166.197] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x214bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.197] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.197] WriteFile (in: hFile=0xdcc, lpBuffer=0x214bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x214bf83c*, lpNumberOfBytesWritten=0x214bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.197] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.197] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.197] CloseHandle (hObject=0xdcc) returned 1 [0166.249] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4f0000 [0166.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.play")) returned 1 [0166.310] VirtualFree (lpAddress=0xb4f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2049 os_tid = 0x1ee8 [0166.198] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.198] ReadFile (in: hFile=0xde4, lpBuffer=0x21d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesRead=0x21d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.200] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4d0000 [0166.201] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4d0000) returned 0x0 [0166.201] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x21d7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0166.201] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x21d7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x21d7f828, pbKeyObject=0x0) returned 0x0 [0166.201] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4d0000, cbOutput=0x230, pcbResult=0x21d7f500, dwFlags=0x0 | out: pbOutput=0xb4d0000, pcbResult=0x21d7f500) returned 0x0 [0166.202] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4d0230) returned 0x0 [0166.202] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4d0000, cbOutput=0x400, pcbResult=0x21d7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4d0000, pcbResult=0x21d7f500) returned 0x0 [0166.205] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.207] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.207] WriteFile (in: hFile=0xde4, lpBuffer=0x21d7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d7f830, lpOverlapped=0x0 | out: lpBuffer=0x21d7fb34*, lpNumberOfBytesWritten=0x21d7f830*=0x428, lpOverlapped=0x0) returned 1 [0166.208] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.208] ReadFile (in: hFile=0xde4, lpBuffer=0x2950000, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x21d7f61c*=0x760, lpOverlapped=0x0) returned 1 [0166.208] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0xfffff8a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.208] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x2950000, cbInput=0x760, pPaddingInfo=0x0, pbIV=0x21d7f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x21d7f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x21d7f848, pbOutput=0x2950000, pcbResult=0x21d7f618) returned 0x0 [0166.208] WriteFile (in: hFile=0xde4, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x21d7f61c*=0x770, lpOverlapped=0x0) returned 1 [0166.208] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d7f60c | out: lpNewFilePointer=0x0) returned 1 [0166.208] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.208] WriteFile (in: hFile=0xde4, lpBuffer=0x21d7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d7f83c*, lpNumberOfBytesWritten=0x21d7f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.208] SetFilePointerEx (in: hFile=0xde4, liDistanceToMove=0x770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.208] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0166.208] CloseHandle (hObject=0xde4) returned 1 [0166.251] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb500000 [0166.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.play")) returned 1 [0166.308] VirtualFree (lpAddress=0xb500000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2050 os_tid = 0x1eec [0166.209] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.209] ReadFile (in: hFile=0x10e8, lpBuffer=0x27a8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27a8f85c, lpOverlapped=0x0 | out: lpBuffer=0x27a8fb34*, lpNumberOfBytesRead=0x27a8f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.210] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.210] ReadFile (in: hFile=0x10e8, lpBuffer=0x27a8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27a8f85c, lpOverlapped=0x0 | out: lpBuffer=0x27a8fb34*, lpNumberOfBytesRead=0x27a8f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.210] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4d0000 [0166.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4d0000) returned 0x0 [0166.212] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x27a8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0166.212] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x27a8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x27a8f828, pbKeyObject=0x0) returned 0x0 [0166.212] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4d0000, cbOutput=0x230, pcbResult=0x27a8f500, dwFlags=0x0 | out: pbOutput=0xb4d0000, pcbResult=0x27a8f500) returned 0x0 [0166.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4d0230) returned 0x0 [0166.213] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4d0000, cbOutput=0x400, pcbResult=0x27a8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4d0000, pcbResult=0x27a8f500) returned 0x0 [0166.216] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.218] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.218] WriteFile (in: hFile=0x10e8, lpBuffer=0x27a8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27a8f830, lpOverlapped=0x0 | out: lpBuffer=0x27a8fb34*, lpNumberOfBytesWritten=0x27a8f830*=0x428, lpOverlapped=0x0) returned 1 [0166.219] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.219] ReadFile (in: hFile=0x10e8, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x27a8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x27a8f61c*=0xed4, lpOverlapped=0x0) returned 1 [0166.219] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffff12c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.219] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2a50000, cbInput=0xed4, pPaddingInfo=0x0, pbIV=0x27a8f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x27a8f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x27a8f848, pbOutput=0x2a50000, pcbResult=0x27a8f618) returned 0x0 [0166.219] WriteFile (in: hFile=0x10e8, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x27a8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x27a8f61c*=0xee0, lpOverlapped=0x0) returned 1 [0166.219] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27a8f60c | out: lpNewFilePointer=0x0) returned 1 [0166.219] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.219] WriteFile (in: hFile=0x10e8, lpBuffer=0x27a8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27a8f61c, lpOverlapped=0x0 | out: lpBuffer=0x27a8f83c*, lpNumberOfBytesWritten=0x27a8f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.219] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.219] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.219] CloseHandle (hObject=0x10e8) returned 1 [0166.252] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb510000 [0166.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.play")) returned 1 [0166.281] VirtualFree (lpAddress=0xb510000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2051 os_tid = 0x1ef0 [0166.220] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.220] ReadFile (in: hFile=0x146c, lpBuffer=0x27bcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27bcf85c, lpOverlapped=0x0 | out: lpBuffer=0x27bcfb34*, lpNumberOfBytesRead=0x27bcf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.440] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.442] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.442] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x27bcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0166.443] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x27bcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x27bcf828, pbKeyObject=0x0) returned 0x0 [0166.443] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x27bcf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x27bcf500) returned 0x0 [0166.443] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.443] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x27bcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x27bcf500) returned 0x0 [0166.448] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.451] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.451] WriteFile (in: hFile=0x146c, lpBuffer=0x27bcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27bcf830, lpOverlapped=0x0 | out: lpBuffer=0x27bcfb34*, lpNumberOfBytesWritten=0x27bcf830*=0x428, lpOverlapped=0x0) returned 1 [0166.452] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.452] ReadFile (in: hFile=0x146c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x27bcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x27bcf61c*=0x7e8, lpOverlapped=0x0) returned 1 [0166.452] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0xfffff818, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.452] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2b50000, cbInput=0x7e8, pPaddingInfo=0x0, pbIV=0x27bcf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x27bcf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x27bcf848, pbOutput=0x2b50000, pcbResult=0x27bcf618) returned 0x0 [0166.452] WriteFile (in: hFile=0x146c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x27bcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x27bcf61c*=0x7f0, lpOverlapped=0x0) returned 1 [0166.452] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27bcf60c | out: lpNewFilePointer=0x0) returned 1 [0166.452] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.452] WriteFile (in: hFile=0x146c, lpBuffer=0x27bcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27bcf61c, lpOverlapped=0x0 | out: lpBuffer=0x27bcf83c*, lpNumberOfBytesWritten=0x27bcf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.452] SetFilePointerEx (in: hFile=0x146c, liDistanceToMove=0x7f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.453] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0166.453] CloseHandle (hObject=0x146c) returned 1 [0166.532] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x570000 [0166.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.play")) returned 1 [0166.610] VirtualFree (lpAddress=0x570000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2052 os_tid = 0x1ef4 [0166.221] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.221] ReadFile (in: hFile=0x1474, lpBuffer=0x27d0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27d0f85c, lpOverlapped=0x0 | out: lpBuffer=0x27d0fb34*, lpNumberOfBytesRead=0x27d0f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.431] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x27d0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0166.431] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x27d0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x27d0f828, pbKeyObject=0x0) returned 0x0 [0166.431] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x27d0f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x27d0f500) returned 0x0 [0166.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.432] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x27d0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x27d0f500) returned 0x0 [0166.435] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.437] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.438] WriteFile (in: hFile=0x1474, lpBuffer=0x27d0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27d0f830, lpOverlapped=0x0 | out: lpBuffer=0x27d0fb34*, lpNumberOfBytesWritten=0x27d0f830*=0x428, lpOverlapped=0x0) returned 1 [0166.439] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.439] ReadFile (in: hFile=0x1474, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x27d0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x27d0f61c*=0x824, lpOverlapped=0x0) returned 1 [0166.439] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xfffff7dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.439] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2c50000, cbInput=0x824, pPaddingInfo=0x0, pbIV=0x27d0f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x27d0f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x27d0f848, pbOutput=0x2c50000, pcbResult=0x27d0f618) returned 0x0 [0166.439] WriteFile (in: hFile=0x1474, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x27d0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x27d0f61c*=0x830, lpOverlapped=0x0) returned 1 [0166.439] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27d0f60c | out: lpNewFilePointer=0x0) returned 1 [0166.439] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.439] WriteFile (in: hFile=0x1474, lpBuffer=0x27d0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27d0f61c, lpOverlapped=0x0 | out: lpBuffer=0x27d0f83c*, lpNumberOfBytesWritten=0x27d0f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.440] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0x830, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.440] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0166.440] CloseHandle (hObject=0x1474) returned 1 [0166.530] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0000 [0166.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.play")) returned 1 [0166.632] VirtualFree (lpAddress=0x1f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2053 os_tid = 0x1ef8 [0166.222] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.222] ReadFile (in: hFile=0x147c, lpBuffer=0x27e4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27e4f85c, lpOverlapped=0x0 | out: lpBuffer=0x27e4fb34*, lpNumberOfBytesRead=0x27e4f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.224] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4d0000 [0166.225] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4d0000) returned 0x0 [0166.225] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x27e4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0166.226] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x27e4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x27e4f828, pbKeyObject=0x0) returned 0x0 [0166.226] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4d0000, cbOutput=0x230, pcbResult=0x27e4f500, dwFlags=0x0 | out: pbOutput=0xb4d0000, pcbResult=0x27e4f500) returned 0x0 [0166.226] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4d0230) returned 0x0 [0166.226] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4d0000, cbOutput=0x400, pcbResult=0x27e4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4d0000, pcbResult=0x27e4f500) returned 0x0 [0166.229] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.231] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.231] WriteFile (in: hFile=0x147c, lpBuffer=0x27e4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27e4f830, lpOverlapped=0x0 | out: lpBuffer=0x27e4fb34*, lpNumberOfBytesWritten=0x27e4f830*=0x428, lpOverlapped=0x0) returned 1 [0166.232] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.232] ReadFile (in: hFile=0x147c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x27e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x27e4f61c*=0x5a8, lpOverlapped=0x0) returned 1 [0166.232] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0xfffffa58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.232] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2d50000, cbInput=0x5a8, pPaddingInfo=0x0, pbIV=0x27e4f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x27e4f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x27e4f848, pbOutput=0x2d50000, pcbResult=0x27e4f618) returned 0x0 [0166.232] WriteFile (in: hFile=0x147c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x27e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x27e4f61c*=0x5b0, lpOverlapped=0x0) returned 1 [0166.232] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27e4f60c | out: lpNewFilePointer=0x0) returned 1 [0166.232] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.232] WriteFile (in: hFile=0x147c, lpBuffer=0x27e4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x27e4f83c*, lpNumberOfBytesWritten=0x27e4f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.233] SetFilePointerEx (in: hFile=0x147c, liDistanceToMove=0x5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.233] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.233] CloseHandle (hObject=0x147c) returned 1 [0166.285] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb510000 [0166.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.play")) returned 1 [0166.288] VirtualFree (lpAddress=0xb510000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2054 os_tid = 0x1efc [0166.233] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.233] ReadFile (in: hFile=0x1484, lpBuffer=0x27f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x27f8fb34*, lpNumberOfBytesRead=0x27f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.418] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.418] ReadFile (in: hFile=0x1484, lpBuffer=0x27f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x27f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x27f8fb34*, lpNumberOfBytesRead=0x27f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.418] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.420] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.420] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x27f8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0166.420] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x27f8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x27f8f828, pbKeyObject=0x0) returned 0x0 [0166.420] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x27f8f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x27f8f500) returned 0x0 [0166.421] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.421] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x27f8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x27f8f500) returned 0x0 [0166.424] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.427] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.427] WriteFile (in: hFile=0x1484, lpBuffer=0x27f8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x27f8f830, lpOverlapped=0x0 | out: lpBuffer=0x27f8fb34*, lpNumberOfBytesWritten=0x27f8f830*=0x428, lpOverlapped=0x0) returned 1 [0166.428] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.428] ReadFile (in: hFile=0x1484, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x27f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x27f8f61c*=0xbb4, lpOverlapped=0x0) returned 1 [0166.428] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xfffff44c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.428] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2e50000, cbInput=0xbb4, pPaddingInfo=0x0, pbIV=0x27f8f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x27f8f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x27f8f848, pbOutput=0x2e50000, pcbResult=0x27f8f618) returned 0x0 [0166.428] WriteFile (in: hFile=0x1484, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x27f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x27f8f61c*=0xbc0, lpOverlapped=0x0) returned 1 [0166.428] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27f8f60c | out: lpNewFilePointer=0x0) returned 1 [0166.428] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.428] WriteFile (in: hFile=0x1484, lpBuffer=0x27f8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x27f8f83c*, lpNumberOfBytesWritten=0x27f8f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.428] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xbc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.428] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0166.429] CloseHandle (hObject=0x1484) returned 1 [0166.527] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0166.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.play")) returned 1 [0166.629] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2055 os_tid = 0x1f00 [0166.234] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.234] ReadFile (in: hFile=0x148c, lpBuffer=0x280cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x280cf85c, lpOverlapped=0x0 | out: lpBuffer=0x280cfb34*, lpNumberOfBytesRead=0x280cf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.236] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.236] ReadFile (in: hFile=0x148c, lpBuffer=0x280cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x280cf85c, lpOverlapped=0x0 | out: lpBuffer=0x280cfb34*, lpNumberOfBytesRead=0x280cf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.236] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4d0000 [0166.238] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4d0000) returned 0x0 [0166.238] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x280cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0166.238] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x280cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x280cf828, pbKeyObject=0x0) returned 0x0 [0166.238] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4d0000, cbOutput=0x230, pcbResult=0x280cf500, dwFlags=0x0 | out: pbOutput=0xb4d0000, pcbResult=0x280cf500) returned 0x0 [0166.238] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4d0230) returned 0x0 [0166.238] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4d0000, cbOutput=0x400, pcbResult=0x280cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4d0000, pcbResult=0x280cf500) returned 0x0 [0166.242] VirtualFree (lpAddress=0xb4d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.244] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.244] WriteFile (in: hFile=0x148c, lpBuffer=0x280cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x280cf830, lpOverlapped=0x0 | out: lpBuffer=0x280cfb34*, lpNumberOfBytesWritten=0x280cf830*=0x428, lpOverlapped=0x0) returned 1 [0166.291] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.291] ReadFile (in: hFile=0x148c, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x280cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x280cf61c*=0x8f8, lpOverlapped=0x0) returned 1 [0166.291] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0xfffff708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.291] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2f50000, cbInput=0x8f8, pPaddingInfo=0x0, pbIV=0x280cf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x280cf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x280cf848, pbOutput=0x2f50000, pcbResult=0x280cf618) returned 0x0 [0166.291] WriteFile (in: hFile=0x148c, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x280cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x280cf61c*=0x900, lpOverlapped=0x0) returned 1 [0166.291] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280cf60c | out: lpNewFilePointer=0x0) returned 1 [0166.291] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.291] WriteFile (in: hFile=0x148c, lpBuffer=0x280cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x280cf61c, lpOverlapped=0x0 | out: lpBuffer=0x280cf83c*, lpNumberOfBytesWritten=0x280cf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.291] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.291] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.291] CloseHandle (hObject=0x148c) returned 1 [0166.292] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb510000 [0166.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.play")) returned 1 [0166.294] VirtualFree (lpAddress=0xb510000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2056 os_tid = 0x1f04 [0166.367] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.367] ReadFile (in: hFile=0x1494, lpBuffer=0x2820fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2820f85c, lpOverlapped=0x0 | out: lpBuffer=0x2820fb34*, lpNumberOfBytesRead=0x2820f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.403] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.403] ReadFile (in: hFile=0x1494, lpBuffer=0x2820fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2820f85c, lpOverlapped=0x0 | out: lpBuffer=0x2820fb34*, lpNumberOfBytesRead=0x2820f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.403] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.406] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.406] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2820f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0166.406] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2820f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2820f828, pbKeyObject=0x0) returned 0x0 [0166.406] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2820f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2820f500) returned 0x0 [0166.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.407] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2820f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2820f500) returned 0x0 [0166.413] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.416] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.416] WriteFile (in: hFile=0x1494, lpBuffer=0x2820fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2820f830, lpOverlapped=0x0 | out: lpBuffer=0x2820fb34*, lpNumberOfBytesWritten=0x2820f830*=0x428, lpOverlapped=0x0) returned 1 [0166.418] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.418] ReadFile (in: hFile=0x1494, lpBuffer=0x3050000, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x2820f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2820f61c*=0x2174, lpOverlapped=0x0) returned 1 [0166.453] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xffffde8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.453] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3050000, cbInput=0x2174, pPaddingInfo=0x0, pbIV=0x2820f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2820f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2820f848, pbOutput=0x3050000, pcbResult=0x2820f618) returned 0x0 [0166.453] WriteFile (in: hFile=0x1494, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2820f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2820f61c*=0x2180, lpOverlapped=0x0) returned 1 [0166.453] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2820f60c | out: lpNewFilePointer=0x0) returned 1 [0166.453] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.453] WriteFile (in: hFile=0x1494, lpBuffer=0x2820f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2820f61c, lpOverlapped=0x0 | out: lpBuffer=0x2820f83c*, lpNumberOfBytesWritten=0x2820f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.453] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x2180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.453] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.453] CloseHandle (hObject=0x1494) returned 1 [0166.534] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x580000 [0166.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.play")) returned 1 [0166.580] VirtualFree (lpAddress=0x580000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2057 os_tid = 0x1f08 [0166.368] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.368] ReadFile (in: hFile=0x149c, lpBuffer=0x2834fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2834f85c, lpOverlapped=0x0 | out: lpBuffer=0x2834fb34*, lpNumberOfBytesRead=0x2834f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.394] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.396] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.396] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2834f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0166.396] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2834f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2834f828, pbKeyObject=0x0) returned 0x0 [0166.396] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2834f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2834f500) returned 0x0 [0166.396] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.396] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2834f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2834f500) returned 0x0 [0166.400] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.402] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.402] WriteFile (in: hFile=0x149c, lpBuffer=0x2834fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2834f830, lpOverlapped=0x0 | out: lpBuffer=0x2834fb34*, lpNumberOfBytesWritten=0x2834f830*=0x428, lpOverlapped=0x0) returned 1 [0166.402] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.402] ReadFile (in: hFile=0x149c, lpBuffer=0x3150000, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x2834f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2834f61c*=0x6e8, lpOverlapped=0x0) returned 1 [0166.402] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0xfffff918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.402] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3150000, cbInput=0x6e8, pPaddingInfo=0x0, pbIV=0x2834f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2834f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2834f848, pbOutput=0x3150000, pcbResult=0x2834f618) returned 0x0 [0166.402] WriteFile (in: hFile=0x149c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2834f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2834f61c*=0x6f0, lpOverlapped=0x0) returned 1 [0166.403] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2834f60c | out: lpNewFilePointer=0x0) returned 1 [0166.403] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.403] WriteFile (in: hFile=0x149c, lpBuffer=0x2834f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2834f61c, lpOverlapped=0x0 | out: lpBuffer=0x2834f83c*, lpNumberOfBytesWritten=0x2834f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.403] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x6f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.403] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.403] CloseHandle (hObject=0x149c) returned 1 [0166.525] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1d0000 [0166.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.play")) returned 1 [0166.627] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2058 os_tid = 0x1f0c [0166.369] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x21600000 [0166.371] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x21600000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x21600000) returned 0x0 [0166.371] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2848f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0166.371] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2848f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x21600000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2848f828, pbKeyObject=0x0) returned 0x0 [0166.371] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x21600000, cbOutput=0x230, pcbResult=0x2848f500, dwFlags=0x0 | out: pbOutput=0x21600000, pcbResult=0x2848f500) returned 0x0 [0166.371] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x21600230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x21600230) returned 0x0 [0166.371] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x21600000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x21600000, cbOutput=0x400, pcbResult=0x2848f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x21600000, pcbResult=0x2848f500) returned 0x0 [0166.374] VirtualFree (lpAddress=0x21600000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.376] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.376] WriteFile (in: hFile=0x14a4, lpBuffer=0x2848fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2848f830, lpOverlapped=0x0 | out: lpBuffer=0x2848fb34*, lpNumberOfBytesWritten=0x2848f830*=0x428, lpOverlapped=0x0) returned 1 [0166.506] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.506] ReadFile (in: hFile=0x14a4, lpBuffer=0x3250000, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x2848f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2848f61c*=0x384, lpOverlapped=0x0) returned 1 [0166.506] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0xfffffc7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.506] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3250000, cbInput=0x384, pPaddingInfo=0x0, pbIV=0x2848f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2848f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2848f848, pbOutput=0x3250000, pcbResult=0x2848f618) returned 0x0 [0166.506] WriteFile (in: hFile=0x14a4, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2848f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2848f61c*=0x390, lpOverlapped=0x0) returned 1 [0166.507] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2848f60c | out: lpNewFilePointer=0x0) returned 1 [0166.507] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.507] WriteFile (in: hFile=0x14a4, lpBuffer=0x2848f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2848f61c, lpOverlapped=0x0 | out: lpBuffer=0x2848f83c*, lpNumberOfBytesWritten=0x2848f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.507] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.507] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.507] CloseHandle (hObject=0x14a4) returned 1 [0166.541] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x5b0000 [0166.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.play")) returned 1 [0166.553] VirtualFree (lpAddress=0x5b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2059 os_tid = 0x1f10 [0166.383] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.383] ReadFile (in: hFile=0x444, lpBuffer=0xb60fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb60f85c, lpOverlapped=0x0 | out: lpBuffer=0xb60fb34*, lpNumberOfBytesRead=0xb60f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.385] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.385] ReadFile (in: hFile=0x444, lpBuffer=0xb60fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb60f85c, lpOverlapped=0x0 | out: lpBuffer=0xb60fb34*, lpNumberOfBytesRead=0xb60f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.385] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.387] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0xb60f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0166.387] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0xb60f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0xb60f828, pbKeyObject=0x0) returned 0x0 [0166.387] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0xb60f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0xb60f500) returned 0x0 [0166.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.387] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0xb60f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0xb60f500) returned 0x0 [0166.391] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.392] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.393] WriteFile (in: hFile=0x444, lpBuffer=0xb60fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb60f830, lpOverlapped=0x0 | out: lpBuffer=0xb60fb34*, lpNumberOfBytesWritten=0xb60f830*=0x428, lpOverlapped=0x0) returned 1 [0166.393] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.393] ReadFile (in: hFile=0x444, lpBuffer=0x3350000, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0xb60f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0xb60f61c*=0x9dc, lpOverlapped=0x0) returned 1 [0166.393] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffff624, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.393] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3350000, cbInput=0x9dc, pPaddingInfo=0x0, pbIV=0xb60f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0xb60f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xb60f848, pbOutput=0x3350000, pcbResult=0xb60f618) returned 0x0 [0166.393] WriteFile (in: hFile=0x444, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0xb60f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0xb60f61c*=0x9e0, lpOverlapped=0x0) returned 1 [0166.394] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb60f60c | out: lpNewFilePointer=0x0) returned 1 [0166.394] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.394] WriteFile (in: hFile=0x444, lpBuffer=0xb60f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb60f61c, lpOverlapped=0x0 | out: lpBuffer=0xb60f83c*, lpNumberOfBytesWritten=0xb60f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.394] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x9e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.394] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.394] CloseHandle (hObject=0x444) returned 1 [0166.521] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0166.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.play")) returned 1 [0166.625] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2060 os_tid = 0x1f14 [0166.454] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.454] ReadFile (in: hFile=0x10c8, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.507] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.507] ReadFile (in: hFile=0x10c8, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.507] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.510] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.510] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x209bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0166.510] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x209bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x209bf828, pbKeyObject=0x0) returned 0x0 [0166.510] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x209bf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x209bf500) returned 0x0 [0166.510] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.510] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x209bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x209bf500) returned 0x0 [0166.516] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.518] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.519] WriteFile (in: hFile=0x10c8, lpBuffer=0x209bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x209bf830, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesWritten=0x209bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.520] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.520] ReadFile (in: hFile=0x10c8, lpBuffer=0x2750000, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x209bf61c*=0x914, lpOverlapped=0x0) returned 1 [0166.520] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xfffff6ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.520] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2750000, cbInput=0x914, pPaddingInfo=0x0, pbIV=0x209bf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x209bf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x209bf848, pbOutput=0x2750000, pcbResult=0x209bf618) returned 0x0 [0166.520] WriteFile (in: hFile=0x10c8, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x209bf61c*=0x920, lpOverlapped=0x0) returned 1 [0166.520] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x209bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.520] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.520] WriteFile (in: hFile=0x10c8, lpBuffer=0x209bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x209bf83c*, lpNumberOfBytesWritten=0x209bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.521] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.521] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.521] CloseHandle (hObject=0x10c8) returned 1 [0166.547] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x5c0000 [0166.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.play")) returned 1 [0166.557] VirtualFree (lpAddress=0x5c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2061 os_tid = 0x1f18 [0166.455] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.455] ReadFile (in: hFile=0xddc, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0166.457] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.457] ReadFile (in: hFile=0xddc, lpBuffer=0x210ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210ff85c, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesRead=0x210ff85c*=0x428, lpOverlapped=0x0) returned 1 [0166.457] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.459] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x210ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0166.459] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x210ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x210ff828, pbKeyObject=0x0) returned 0x0 [0166.459] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x210ff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x210ff500) returned 0x0 [0166.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.459] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x210ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x210ff500) returned 0x0 [0166.463] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.466] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.466] WriteFile (in: hFile=0xddc, lpBuffer=0x210ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210ff830, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesWritten=0x210ff830*=0x428, lpOverlapped=0x0) returned 1 [0166.467] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.467] ReadFile (in: hFile=0xddc, lpBuffer=0x2850000, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x210ff61c*=0x4a7c, lpOverlapped=0x0) returned 1 [0166.467] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xffffb584, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.468] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2850000, cbInput=0x4a7c, pPaddingInfo=0x0, pbIV=0x210ff848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x210ff618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x210ff848, pbOutput=0x2850000, pcbResult=0x210ff618) returned 0x0 [0166.468] WriteFile (in: hFile=0xddc, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x210ff61c*=0x4a80, lpOverlapped=0x0) returned 1 [0166.468] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210ff60c | out: lpNewFilePointer=0x0) returned 1 [0166.468] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.468] WriteFile (in: hFile=0xddc, lpBuffer=0x210ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x210ff83c*, lpNumberOfBytesWritten=0x210ff61c*=0x8, lpOverlapped=0x0) returned 1 [0166.468] SetFilePointerEx (in: hFile=0xddc, liDistanceToMove=0x4a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.468] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.468] CloseHandle (hObject=0xddc) returned 1 [0166.536] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x590000 [0166.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.play")) returned 1 [0166.577] VirtualFree (lpAddress=0x590000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2062 os_tid = 0x1f1c [0166.469] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0166.470] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0166.470] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x214bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0166.470] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x214bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x214bf828, pbKeyObject=0x0) returned 0x0 [0166.471] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x214bf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x214bf500) returned 0x0 [0166.471] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0166.471] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x214bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x214bf500) returned 0x0 [0166.474] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.477] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.477] WriteFile (in: hFile=0x450, lpBuffer=0x214bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x214bf830, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesWritten=0x214bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.480] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.480] ReadFile (in: hFile=0x450, lpBuffer=0x2950000, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x214bf61c*=0x244, lpOverlapped=0x0) returned 1 [0166.480] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.481] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2950000, cbInput=0x244, pPaddingInfo=0x0, pbIV=0x214bf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x214bf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x214bf848, pbOutput=0x2950000, pcbResult=0x214bf618) returned 0x0 [0166.481] WriteFile (in: hFile=0x450, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x214bf61c*=0x250, lpOverlapped=0x0) returned 1 [0166.481] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x214bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.481] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.481] WriteFile (in: hFile=0x450, lpBuffer=0x214bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x214bf83c*, lpNumberOfBytesWritten=0x214bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.481] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.481] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.481] CloseHandle (hObject=0x450) returned 1 [0166.539] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x5a0000 [0166.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.play")) returned 1 [0166.574] VirtualFree (lpAddress=0x5a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2063 os_tid = 0x1f20 [0166.660] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0166.663] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0166.663] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x66f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0166.664] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x66f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x66f828, pbKeyObject=0x0) returned 0x0 [0166.664] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x66f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x66f500) returned 0x0 [0166.664] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0166.664] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x66f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x66f500) returned 0x0 [0166.668] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.672] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.672] WriteFile (in: hFile=0x490, lpBuffer=0x66fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x66f830, lpOverlapped=0x0 | out: lpBuffer=0x66fb34*, lpNumberOfBytesWritten=0x66f830*=0x428, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.693] ReadFile (in: hFile=0x490, lpBuffer=0x2750000, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x66f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x66f61c*=0x128, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffed8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.693] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2750000, cbInput=0x128, pPaddingInfo=0x0, pbIV=0x66f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x66f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x66f848, pbOutput=0x2750000, pcbResult=0x66f618) returned 0x0 [0166.693] WriteFile (in: hFile=0x490, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x66f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x66f61c*=0x130, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x66f60c | out: lpNewFilePointer=0x0) returned 1 [0166.693] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.693] WriteFile (in: hFile=0x490, lpBuffer=0x66f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x66f61c, lpOverlapped=0x0 | out: lpBuffer=0x66f83c*, lpNumberOfBytesWritten=0x66f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.693] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.693] CloseHandle (hObject=0x490) returned 1 [0166.694] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0166.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.play")) returned 1 [0167.426] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2064 os_tid = 0x1f24 [0166.681] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0166.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0166.683] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xfdf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0166.683] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xfdf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xfdf828, pbKeyObject=0x0) returned 0x0 [0166.683] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfdf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfdf500) returned 0x0 [0166.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0166.683] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfdf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfdf500) returned 0x0 [0166.687] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.688] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.689] WriteFile (in: hFile=0x14a4, lpBuffer=0xfdfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfdf830, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesWritten=0xfdf830*=0x428, lpOverlapped=0x0) returned 1 [0166.734] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.734] ReadFile (in: hFile=0x14a4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xfdf61c*=0x228, lpOverlapped=0x0) returned 1 [0166.734] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0xfffffdd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.734] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2850000, cbInput=0x228, pPaddingInfo=0x0, pbIV=0xfdf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xfdf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xfdf848, pbOutput=0x2850000, pcbResult=0xfdf618) returned 0x0 [0166.734] WriteFile (in: hFile=0x14a4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xfdf61c*=0x230, lpOverlapped=0x0) returned 1 [0166.734] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfdf60c | out: lpNewFilePointer=0x0) returned 1 [0166.734] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.734] WriteFile (in: hFile=0x14a4, lpBuffer=0xfdf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0xfdf83c*, lpNumberOfBytesWritten=0xfdf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.734] SetFilePointerEx (in: hFile=0x14a4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.734] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.734] CloseHandle (hObject=0x14a4) returned 1 [0166.780] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0166.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.play")) returned 1 [0167.111] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2065 os_tid = 0x1f28 [0166.691] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.691] ReadFile (in: hFile=0x1100, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.697] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.697] ReadFile (in: hFile=0x1100, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.697] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0166.699] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0166.699] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x125f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0166.699] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x125f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x125f828, pbKeyObject=0x0) returned 0x0 [0166.699] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x125f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x125f500) returned 0x0 [0166.699] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0166.699] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x125f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x125f500) returned 0x0 [0166.702] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.705] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.706] WriteFile (in: hFile=0x1100, lpBuffer=0x125fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x125f830, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesWritten=0x125f830*=0x428, lpOverlapped=0x0) returned 1 [0166.707] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.707] ReadFile (in: hFile=0x1100, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x125f61c*=0x1034, lpOverlapped=0x0) returned 1 [0166.707] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xffffefcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.707] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2950000, cbInput=0x1034, pPaddingInfo=0x0, pbIV=0x125f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x125f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x125f848, pbOutput=0x2950000, pcbResult=0x125f618) returned 0x0 [0166.707] WriteFile (in: hFile=0x1100, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x125f61c*=0x1040, lpOverlapped=0x0) returned 1 [0166.708] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125f60c | out: lpNewFilePointer=0x0) returned 1 [0166.708] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.708] WriteFile (in: hFile=0x1100, lpBuffer=0x125f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x125f83c*, lpNumberOfBytesWritten=0x125f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.708] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x1040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.708] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.709] CloseHandle (hObject=0x1100) returned 1 [0166.709] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0166.713] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.play")) returned 1 [0166.714] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2066 os_tid = 0x1f2c [0166.721] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.721] ReadFile (in: hFile=0x134c, lpBuffer=0xb04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb04f85c, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesRead=0xb04f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.723] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.723] ReadFile (in: hFile=0x134c, lpBuffer=0xb04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb04f85c, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesRead=0xb04f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.723] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0166.725] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0166.725] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xb04f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0166.725] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xb04f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xb04f828, pbKeyObject=0x0) returned 0x0 [0166.725] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xb04f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xb04f500) returned 0x0 [0166.725] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0166.725] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xb04f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xb04f500) returned 0x0 [0166.729] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.732] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.732] WriteFile (in: hFile=0x134c, lpBuffer=0xb04fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb04f830, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesWritten=0xb04f830*=0x428, lpOverlapped=0x0) returned 1 [0166.733] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.733] ReadFile (in: hFile=0x134c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xb04f61c*=0x8fc, lpOverlapped=0x0) returned 1 [0166.733] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.733] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2a50000, cbInput=0x8fc, pPaddingInfo=0x0, pbIV=0xb04f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xb04f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xb04f848, pbOutput=0x2a50000, pcbResult=0xb04f618) returned 0x0 [0166.733] WriteFile (in: hFile=0x134c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xb04f61c*=0x900, lpOverlapped=0x0) returned 1 [0166.733] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb04f60c | out: lpNewFilePointer=0x0) returned 1 [0166.733] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.733] WriteFile (in: hFile=0x134c, lpBuffer=0xb04f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0xb04f83c*, lpNumberOfBytesWritten=0xb04f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.733] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.733] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.733] CloseHandle (hObject=0x134c) returned 1 [0166.778] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0166.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.play")) returned 1 [0167.879] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2067 os_tid = 0x1f30 [0166.735] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.735] ReadFile (in: hFile=0x49c, lpBuffer=0xb14fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb14f85c, lpOverlapped=0x0 | out: lpBuffer=0xb14fb34*, lpNumberOfBytesRead=0xb14f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.801] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.801] ReadFile (in: hFile=0x49c, lpBuffer=0xb14fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb14f85c, lpOverlapped=0x0 | out: lpBuffer=0xb14fb34*, lpNumberOfBytesRead=0xb14f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.801] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.803] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.803] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xb14f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0166.803] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xb14f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xb14f828, pbKeyObject=0x0) returned 0x0 [0166.803] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0xb14f500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0xb14f500) returned 0x0 [0166.803] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.803] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0xb14f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0xb14f500) returned 0x0 [0166.808] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.809] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.809] WriteFile (in: hFile=0x49c, lpBuffer=0xb14fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb14f830, lpOverlapped=0x0 | out: lpBuffer=0xb14fb34*, lpNumberOfBytesWritten=0xb14f830*=0x428, lpOverlapped=0x0) returned 1 [0166.810] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.810] ReadFile (in: hFile=0x49c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0xb14f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xb14f61c*=0xcb4, lpOverlapped=0x0) returned 1 [0166.810] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffff34c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.810] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2b50000, cbInput=0xcb4, pPaddingInfo=0x0, pbIV=0xb14f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xb14f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xb14f848, pbOutput=0x2b50000, pcbResult=0xb14f618) returned 0x0 [0166.810] WriteFile (in: hFile=0x49c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0xb14f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xb14f61c*=0xcc0, lpOverlapped=0x0) returned 1 [0166.810] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb14f60c | out: lpNewFilePointer=0x0) returned 1 [0166.810] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.810] WriteFile (in: hFile=0x49c, lpBuffer=0xb14f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb14f61c, lpOverlapped=0x0 | out: lpBuffer=0xb14f83c*, lpNumberOfBytesWritten=0xb14f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.811] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.811] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.811] CloseHandle (hObject=0x49c) returned 1 [0166.886] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf870000 [0166.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.play")) returned 1 [0168.079] VirtualFree (lpAddress=0xf870000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2068 os_tid = 0x1f34 [0166.736] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.736] ReadFile (in: hFile=0xa34, lpBuffer=0xb24fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb24f85c, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesRead=0xb24f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.801] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.801] ReadFile (in: hFile=0xa34, lpBuffer=0xb24fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb24f85c, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesRead=0xb24f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.900] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf890000 [0166.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf890000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf890000) returned 0x0 [0166.902] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xb24f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0166.902] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xb24f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf890000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xb24f828, pbKeyObject=0x0) returned 0x0 [0166.902] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf890000, cbOutput=0x230, pcbResult=0xb24f500, dwFlags=0x0 | out: pbOutput=0xf890000, pcbResult=0xb24f500) returned 0x0 [0166.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf890230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf890230) returned 0x0 [0166.902] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf890000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf890000, cbOutput=0x400, pcbResult=0xb24f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf890000, pcbResult=0xb24f500) returned 0x0 [0166.905] VirtualFree (lpAddress=0xf890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.907] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.907] WriteFile (in: hFile=0xa34, lpBuffer=0xb24fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb24f830, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesWritten=0xb24f830*=0x428, lpOverlapped=0x0) returned 1 [0166.907] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.907] ReadFile (in: hFile=0xa34, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xb24f61c*=0x1815, lpOverlapped=0x0) returned 1 [0166.907] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xffffe7eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.907] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x2c50000, cbInput=0x1815, pPaddingInfo=0x0, pbIV=0xb24f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xb24f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0xb24f848, pbOutput=0x2c50000, pcbResult=0xb24f618) returned 0x0 [0166.907] WriteFile (in: hFile=0xa34, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xb24f61c*=0x1820, lpOverlapped=0x0) returned 1 [0166.907] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb24f60c | out: lpNewFilePointer=0x0) returned 1 [0166.907] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.908] WriteFile (in: hFile=0xa34, lpBuffer=0xb24f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0xb24f83c*, lpNumberOfBytesWritten=0xb24f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.908] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x1820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.908] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0166.908] CloseHandle (hObject=0xa34) returned 1 [0166.908] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0xf890000 [0166.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\east_01.mid.play")) returned 1 [0166.914] VirtualFree (lpAddress=0xf890000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2069 os_tid = 0x1f38 [0166.737] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.737] ReadFile (in: hFile=0x474, lpBuffer=0xb38fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb38f85c, lpOverlapped=0x0 | out: lpBuffer=0xb38fb34*, lpNumberOfBytesRead=0xb38f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.792] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.794] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.794] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xb38f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0166.794] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xb38f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xb38f828, pbKeyObject=0x0) returned 0x0 [0166.794] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0xb38f500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0xb38f500) returned 0x0 [0166.794] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.794] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0xb38f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0xb38f500) returned 0x0 [0166.797] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.799] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.799] WriteFile (in: hFile=0x474, lpBuffer=0xb38fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb38f830, lpOverlapped=0x0 | out: lpBuffer=0xb38fb34*, lpNumberOfBytesWritten=0xb38f830*=0x428, lpOverlapped=0x0) returned 1 [0166.800] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.800] ReadFile (in: hFile=0x474, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0xb38f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xb38f61c*=0x566, lpOverlapped=0x0) returned 1 [0166.800] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xfffffa9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.800] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2d50000, cbInput=0x566, pPaddingInfo=0x0, pbIV=0xb38f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xb38f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xb38f848, pbOutput=0x2d50000, pcbResult=0xb38f618) returned 0x0 [0166.800] WriteFile (in: hFile=0x474, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0xb38f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xb38f61c*=0x570, lpOverlapped=0x0) returned 1 [0166.800] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb38f60c | out: lpNewFilePointer=0x0) returned 1 [0166.800] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.800] WriteFile (in: hFile=0x474, lpBuffer=0xb38f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb38f61c, lpOverlapped=0x0 | out: lpBuffer=0xb38f83c*, lpNumberOfBytesWritten=0xb38f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.800] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.800] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.800] CloseHandle (hObject=0x474) returned 1 [0166.885] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf860000 [0166.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.play")) returned 1 [0168.082] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2070 os_tid = 0x1f3c [0166.739] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.739] ReadFile (in: hFile=0x4bc, lpBuffer=0xb4cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb4cf85c, lpOverlapped=0x0 | out: lpBuffer=0xb4cfb34*, lpNumberOfBytesRead=0xb4cf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.819] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.819] ReadFile (in: hFile=0x4bc, lpBuffer=0xb4cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb4cf85c, lpOverlapped=0x0 | out: lpBuffer=0xb4cfb34*, lpNumberOfBytesRead=0xb4cf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.819] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.821] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.821] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0xb4cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0166.821] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0xb4cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0xb4cf828, pbKeyObject=0x0) returned 0x0 [0166.821] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0xb4cf500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0xb4cf500) returned 0x0 [0166.822] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.822] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0xb4cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0xb4cf500) returned 0x0 [0166.825] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.826] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.827] WriteFile (in: hFile=0x4bc, lpBuffer=0xb4cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb4cf830, lpOverlapped=0x0 | out: lpBuffer=0xb4cfb34*, lpNumberOfBytesWritten=0xb4cf830*=0x428, lpOverlapped=0x0) returned 1 [0166.827] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.827] ReadFile (in: hFile=0x4bc, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0xb4cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0xb4cf61c*=0x32f2, lpOverlapped=0x0) returned 1 [0166.923] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xffffcd0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.924] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2e50000, cbInput=0x32f2, pPaddingInfo=0x0, pbIV=0xb4cf848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0xb4cf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xb4cf848, pbOutput=0x2e50000, pcbResult=0xb4cf618) returned 0x0 [0166.924] WriteFile (in: hFile=0x4bc, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0xb4cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0xb4cf61c*=0x3300, lpOverlapped=0x0) returned 1 [0166.924] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb4cf60c | out: lpNewFilePointer=0x0) returned 1 [0166.924] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.924] WriteFile (in: hFile=0x4bc, lpBuffer=0xb4cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb4cf61c, lpOverlapped=0x0 | out: lpBuffer=0xb4cf83c*, lpNumberOfBytesWritten=0xb4cf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.924] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x3300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.924] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.924] CloseHandle (hObject=0x4bc) returned 1 [0166.924] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf890000 [0166.926] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.play")) returned 1 [0166.931] VirtualFree (lpAddress=0xf890000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2071 os_tid = 0x1f40 [0166.740] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.740] ReadFile (in: hFile=0x450, lpBuffer=0xb60fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb60f85c, lpOverlapped=0x0 | out: lpBuffer=0xb60fb34*, lpNumberOfBytesRead=0xb60f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.811] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.811] ReadFile (in: hFile=0x450, lpBuffer=0xb60fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb60f85c, lpOverlapped=0x0 | out: lpBuffer=0xb60fb34*, lpNumberOfBytesRead=0xb60f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.811] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.812] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.812] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0xb60f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0166.812] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0xb60f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0xb60f828, pbKeyObject=0x0) returned 0x0 [0166.812] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0xb60f500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0xb60f500) returned 0x0 [0166.813] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.813] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0xb60f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0xb60f500) returned 0x0 [0166.816] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.818] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.818] WriteFile (in: hFile=0x450, lpBuffer=0xb60fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb60f830, lpOverlapped=0x0 | out: lpBuffer=0xb60fb34*, lpNumberOfBytesWritten=0xb60f830*=0x428, lpOverlapped=0x0) returned 1 [0166.818] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.818] ReadFile (in: hFile=0x450, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0xb60f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0xb60f61c*=0xa8c, lpOverlapped=0x0) returned 1 [0166.818] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffff574, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.819] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x2f50000, cbInput=0xa8c, pPaddingInfo=0x0, pbIV=0xb60f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0xb60f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xb60f848, pbOutput=0x2f50000, pcbResult=0xb60f618) returned 0x0 [0166.819] WriteFile (in: hFile=0x450, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0xb60f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0xb60f61c*=0xa90, lpOverlapped=0x0) returned 1 [0166.819] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb60f60c | out: lpNewFilePointer=0x0) returned 1 [0166.819] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.819] WriteFile (in: hFile=0x450, lpBuffer=0xb60f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb60f61c, lpOverlapped=0x0 | out: lpBuffer=0xb60f83c*, lpNumberOfBytesWritten=0xb60f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.819] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xa90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.819] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0166.819] CloseHandle (hObject=0x450) returned 1 [0166.888] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf880000 [0166.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.play")) returned 1 [0167.550] VirtualFree (lpAddress=0xf880000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2072 os_tid = 0x1f44 [0166.741] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.741] ReadFile (in: hFile=0x1494, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.743] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.743] ReadFile (in: hFile=0x1494, lpBuffer=0x209bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x209bf85c, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesRead=0x209bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.743] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0166.745] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0166.745] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x209bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0166.745] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x209bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x209bf828, pbKeyObject=0x0) returned 0x0 [0166.745] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x209bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x209bf500) returned 0x0 [0166.745] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0166.745] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x209bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x209bf500) returned 0x0 [0166.748] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.750] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.750] WriteFile (in: hFile=0x1494, lpBuffer=0x209bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x209bf830, lpOverlapped=0x0 | out: lpBuffer=0x209bfb34*, lpNumberOfBytesWritten=0x209bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.751] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.751] ReadFile (in: hFile=0x1494, lpBuffer=0x3050000, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x209bf61c*=0x1b2e, lpOverlapped=0x0) returned 1 [0166.751] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xffffe4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.751] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3050000, cbInput=0x1b2e, pPaddingInfo=0x0, pbIV=0x209bf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x209bf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x209bf848, pbOutput=0x3050000, pcbResult=0x209bf618) returned 0x0 [0166.751] WriteFile (in: hFile=0x1494, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x209bf61c*=0x1b30, lpOverlapped=0x0) returned 1 [0166.752] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x209bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.752] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.752] WriteFile (in: hFile=0x1494, lpBuffer=0x209bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x209bf61c, lpOverlapped=0x0 | out: lpBuffer=0x209bf83c*, lpNumberOfBytesWritten=0x209bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.752] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x1b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.752] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.752] CloseHandle (hObject=0x1494) returned 1 [0166.785] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf850000 [0166.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.play")) returned 1 [0168.085] VirtualFree (lpAddress=0xf850000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2073 os_tid = 0x1f48 [0166.756] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.756] ReadFile (in: hFile=0x36c, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.851] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.851] ReadFile (in: hFile=0x36c, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.944] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb390000 [0166.946] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb390000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb390000) returned 0x0 [0166.946] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0xf70f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0166.946] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0xf70f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb390000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0xf70f828, pbKeyObject=0x0) returned 0x0 [0166.946] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb390000, cbOutput=0x230, pcbResult=0xf70f500, dwFlags=0x0 | out: pbOutput=0xb390000, pcbResult=0xf70f500) returned 0x0 [0166.946] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb390230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb390230) returned 0x0 [0166.946] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb390000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb390000, cbOutput=0x400, pcbResult=0xf70f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb390000, pcbResult=0xf70f500) returned 0x0 [0166.949] VirtualFree (lpAddress=0xb390000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.951] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.951] WriteFile (in: hFile=0x36c, lpBuffer=0xf70fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf70f830, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesWritten=0xf70f830*=0x428, lpOverlapped=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.952] ReadFile (in: hFile=0x36c, lpBuffer=0x3150000, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0xf70f61c*=0x3670, lpOverlapped=0x0) returned 1 [0167.149] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xffffc990, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.149] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3150000, cbInput=0x3670, pPaddingInfo=0x0, pbIV=0xf70f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0xf70f618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0xf70f848, pbOutput=0x3150000, pcbResult=0xf70f618) returned 0x0 [0167.149] WriteFile (in: hFile=0x36c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0xf70f61c*=0x3680, lpOverlapped=0x0) returned 1 [0167.149] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf70f60c | out: lpNewFilePointer=0x0) returned 1 [0167.149] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.149] WriteFile (in: hFile=0x36c, lpBuffer=0xf70f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0xf70f83c*, lpNumberOfBytesWritten=0xf70f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.149] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x3680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.149] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0167.149] CloseHandle (hObject=0x36c) returned 1 [0167.149] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x28df0000 [0167.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.play")) returned 1 [0167.156] VirtualFree (lpAddress=0x28df0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2074 os_tid = 0x1f4c [0166.758] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.758] ReadFile (in: hFile=0x10a8, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.859] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.859] ReadFile (in: hFile=0x10a8, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.859] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.861] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.861] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x20dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0166.861] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x20dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x20dbf828, pbKeyObject=0x0) returned 0x0 [0166.861] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0x20dbf500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0x20dbf500) returned 0x0 [0166.861] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.861] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0x20dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0x20dbf500) returned 0x0 [0166.865] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.867] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.867] WriteFile (in: hFile=0x10a8, lpBuffer=0x20dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20dbf830, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesWritten=0x20dbf830*=0x428, lpOverlapped=0x0) returned 1 [0166.867] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.868] ReadFile (in: hFile=0x10a8, lpBuffer=0x3250000, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x20dbf61c*=0x1b1a, lpOverlapped=0x0) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xffffe4e6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.968] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3250000, cbInput=0x1b1a, pPaddingInfo=0x0, pbIV=0x20dbf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x20dbf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x20dbf848, pbOutput=0x3250000, pcbResult=0x20dbf618) returned 0x0 [0166.968] WriteFile (in: hFile=0x10a8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x20dbf61c*=0x1b20, lpOverlapped=0x0) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20dbf60c | out: lpNewFilePointer=0x0) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.968] WriteFile (in: hFile=0x10a8, lpBuffer=0x20dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20dbf83c*, lpNumberOfBytesWritten=0x20dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x1b20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.968] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0166.968] CloseHandle (hObject=0x10a8) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf980000 [0167.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.play")) returned 1 [0167.870] VirtualFree (lpAddress=0xf980000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2075 os_tid = 0x1f50 [0166.759] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.759] ReadFile (in: hFile=0x1474, lpBuffer=0x20ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesRead=0x20ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.852] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.852] ReadFile (in: hFile=0x1474, lpBuffer=0x20ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesRead=0x20ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.852] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.853] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.853] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x20ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0166.853] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x20ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x20ebf828, pbKeyObject=0x0) returned 0x0 [0166.853] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0x20ebf500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0x20ebf500) returned 0x0 [0166.853] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.853] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0x20ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0x20ebf500) returned 0x0 [0166.857] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.858] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.858] WriteFile (in: hFile=0x1474, lpBuffer=0x20ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20ebf830, lpOverlapped=0x0 | out: lpBuffer=0x20ebfb34*, lpNumberOfBytesWritten=0x20ebf830*=0x428, lpOverlapped=0x0) returned 1 [0166.859] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.859] ReadFile (in: hFile=0x1474, lpBuffer=0x3350000, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x20ebf61c*=0x3044, lpOverlapped=0x0) returned 1 [0166.954] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xffffcfbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.954] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x3350000, cbInput=0x3044, pPaddingInfo=0x0, pbIV=0x20ebf848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x20ebf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x20ebf848, pbOutput=0x3350000, pcbResult=0x20ebf618) returned 0x0 [0166.954] WriteFile (in: hFile=0x1474, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x20ebf61c*=0x3050, lpOverlapped=0x0) returned 1 [0166.954] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20ebf60c | out: lpNewFilePointer=0x0) returned 1 [0166.954] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.954] WriteFile (in: hFile=0x1474, lpBuffer=0x20ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x20ebf83c*, lpNumberOfBytesWritten=0x20ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.954] SetFilePointerEx (in: hFile=0x1474, liDistanceToMove=0x3050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.954] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0166.954] CloseHandle (hObject=0x1474) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf970000 [0167.119] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.play")) returned 1 [0168.240] VirtualFree (lpAddress=0xf970000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2076 os_tid = 0x1f54 [0166.760] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.761] ReadFile (in: hFile=0x1484, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.842] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.842] ReadFile (in: hFile=0x1484, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.842] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.844] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x20fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0166.844] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x20fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x20fbf828, pbKeyObject=0x0) returned 0x0 [0166.844] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0x20fbf500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0x20fbf500) returned 0x0 [0166.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.844] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0x20fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0x20fbf500) returned 0x0 [0166.848] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.850] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.850] WriteFile (in: hFile=0x1484, lpBuffer=0x20fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20fbf830, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesWritten=0x20fbf830*=0x428, lpOverlapped=0x0) returned 1 [0166.851] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.851] ReadFile (in: hFile=0x1484, lpBuffer=0x3450000, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x20fbf61c*=0x1a7c, lpOverlapped=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xffffe584, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.952] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3450000, cbInput=0x1a7c, pPaddingInfo=0x0, pbIV=0x20fbf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x20fbf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x20fbf848, pbOutput=0x3450000, pcbResult=0x20fbf618) returned 0x0 [0166.952] WriteFile (in: hFile=0x1484, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x20fbf61c*=0x1a80, lpOverlapped=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20fbf60c | out: lpNewFilePointer=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.952] WriteFile (in: hFile=0x1484, lpBuffer=0x20fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20fbf83c*, lpNumberOfBytesWritten=0x20fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0x1484, liDistanceToMove=0x1a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.953] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0166.953] CloseHandle (hObject=0x1484) returned 1 [0167.108] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf890000 [0167.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.play")) returned 1 [0167.876] VirtualFree (lpAddress=0xf890000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2077 os_tid = 0x1f58 [0166.762] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.762] ReadFile (in: hFile=0x1100, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.827] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.827] ReadFile (in: hFile=0x1100, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.827] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.829] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.829] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x125f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0166.829] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x125f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x125f828, pbKeyObject=0x0) returned 0x0 [0166.829] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0x125f500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0x125f500) returned 0x0 [0166.829] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.829] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0x125f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0x125f500) returned 0x0 [0166.833] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.834] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.834] WriteFile (in: hFile=0x1100, lpBuffer=0x125fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x125f830, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesWritten=0x125f830*=0x428, lpOverlapped=0x0) returned 1 [0166.835] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.835] ReadFile (in: hFile=0x1100, lpBuffer=0x3550000, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x125f61c*=0x8e8, lpOverlapped=0x0) returned 1 [0166.835] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffff718, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.835] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3550000, cbInput=0x8e8, pPaddingInfo=0x0, pbIV=0x125f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x125f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x125f848, pbOutput=0x3550000, pcbResult=0x125f618) returned 0x0 [0166.835] WriteFile (in: hFile=0x1100, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x125f61c*=0x8f0, lpOverlapped=0x0) returned 1 [0166.835] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125f60c | out: lpNewFilePointer=0x0) returned 1 [0166.835] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.842] WriteFile (in: hFile=0x1100, lpBuffer=0x125f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x125f83c*, lpNumberOfBytesWritten=0x125f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.842] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x8f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.842] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0166.842] CloseHandle (hObject=0x1100) returned 1 [0166.889] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf890000 [0166.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.play")) returned 1 [0166.892] VirtualFree (lpAddress=0xf890000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2078 os_tid = 0x1f5c [0166.764] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0166.765] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0166.766] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x210ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0166.766] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x210ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x210ff828, pbKeyObject=0x0) returned 0x0 [0166.766] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x210ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x210ff500) returned 0x0 [0166.766] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0166.766] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x210ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x210ff500) returned 0x0 [0166.769] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.771] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.771] WriteFile (in: hFile=0x4ac, lpBuffer=0x210ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210ff830, lpOverlapped=0x0 | out: lpBuffer=0x210ffb34*, lpNumberOfBytesWritten=0x210ff830*=0x428, lpOverlapped=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] ReadFile (in: hFile=0x4ac, lpBuffer=0x2950000, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x210ff61c*=0x2e0, lpOverlapped=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xfffffd20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.884] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2950000, cbInput=0x2e0, pPaddingInfo=0x0, pbIV=0x210ff848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x210ff618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x210ff848, pbOutput=0x2950000, pcbResult=0x210ff618) returned 0x0 [0166.884] WriteFile (in: hFile=0x4ac, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x210ff61c*=0x2f0, lpOverlapped=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210ff60c | out: lpNewFilePointer=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.884] WriteFile (in: hFile=0x4ac, lpBuffer=0x210ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210ff61c, lpOverlapped=0x0 | out: lpBuffer=0x210ff83c*, lpNumberOfBytesWritten=0x210ff61c*=0x8, lpOverlapped=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.884] CloseHandle (hObject=0x4ac) returned 1 [0166.894] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1120000 [0166.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.play")) returned 1 [0166.896] VirtualFree (lpAddress=0x1120000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2079 os_tid = 0x1f60 [0166.773] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.773] ReadFile (in: hFile=0xdbc, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.876] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.876] ReadFile (in: hFile=0xdbc, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.877] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.877] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2123f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0166.877] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2123f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2123f828, pbKeyObject=0x0) returned 0x0 [0166.877] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0x2123f500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0x2123f500) returned 0x0 [0166.877] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.877] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0x2123f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0x2123f500) returned 0x0 [0166.881] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.882] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.882] WriteFile (in: hFile=0xdbc, lpBuffer=0x2123fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2123f830, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesWritten=0x2123f830*=0x428, lpOverlapped=0x0) returned 1 [0166.883] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.883] ReadFile (in: hFile=0xdbc, lpBuffer=0x3650000, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2123f61c*=0x439c, lpOverlapped=0x0) returned 1 [0166.980] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xffffbc64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.980] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3650000, cbInput=0x439c, pPaddingInfo=0x0, pbIV=0x2123f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2123f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x2123f848, pbOutput=0x3650000, pcbResult=0x2123f618) returned 0x0 [0166.980] WriteFile (in: hFile=0xdbc, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2123f61c*=0x43a0, lpOverlapped=0x0) returned 1 [0166.980] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2123f60c | out: lpNewFilePointer=0x0) returned 1 [0166.981] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.981] WriteFile (in: hFile=0xdbc, lpBuffer=0x2123f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x2123f83c*, lpNumberOfBytesWritten=0x2123f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.981] SetFilePointerEx (in: hFile=0xdbc, liDistanceToMove=0x43a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.981] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0166.981] CloseHandle (hObject=0xdbc) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bf0000 [0167.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.play")) returned 1 [0167.699] VirtualFree (lpAddress=0x17bf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2080 os_tid = 0x1f64 [0166.774] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.774] ReadFile (in: hFile=0x22c, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.868] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.868] ReadFile (in: hFile=0x22c, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.868] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf860000 [0166.869] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf860000) returned 0x0 [0166.869] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x214bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0166.869] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x214bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf860000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x214bf828, pbKeyObject=0x0) returned 0x0 [0166.869] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf860000, cbOutput=0x230, pcbResult=0x214bf500, dwFlags=0x0 | out: pbOutput=0xf860000, pcbResult=0x214bf500) returned 0x0 [0166.870] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf860230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf860230) returned 0x0 [0166.870] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf860000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf860000, cbOutput=0x400, pcbResult=0x214bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf860000, pcbResult=0x214bf500) returned 0x0 [0166.873] VirtualFree (lpAddress=0xf860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.875] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.875] WriteFile (in: hFile=0x22c, lpBuffer=0x214bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x214bf830, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesWritten=0x214bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.875] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.875] ReadFile (in: hFile=0x22c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x214bf61c*=0x1f08, lpOverlapped=0x0) returned 1 [0166.969] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xffffe0f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.969] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x3750000, cbInput=0x1f08, pPaddingInfo=0x0, pbIV=0x214bf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x214bf618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x214bf848, pbOutput=0x3750000, pcbResult=0x214bf618) returned 0x0 [0166.969] WriteFile (in: hFile=0x22c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x214bf61c*=0x1f10, lpOverlapped=0x0) returned 1 [0166.969] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x214bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.969] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.969] WriteFile (in: hFile=0x22c, lpBuffer=0x214bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x214bf83c*, lpNumberOfBytesWritten=0x214bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.969] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1f10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.969] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0166.969] CloseHandle (hObject=0x22c) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0167.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.play")) returned 1 [0168.187] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2081 os_tid = 0x1f68 [0166.934] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.934] ReadFile (in: hFile=0x1494, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.936] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.936] ReadFile (in: hFile=0x1494, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.936] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb390000 [0166.937] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb390000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb390000) returned 0x0 [0166.937] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0xf84f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0166.937] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0xf84f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb390000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0xf84f828, pbKeyObject=0x0) returned 0x0 [0166.937] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb390000, cbOutput=0x230, pcbResult=0xf84f500, dwFlags=0x0 | out: pbOutput=0xb390000, pcbResult=0xf84f500) returned 0x0 [0166.938] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb390230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb390230) returned 0x0 [0166.938] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb390000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb390000, cbOutput=0x400, pcbResult=0xf84f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb390000, pcbResult=0xf84f500) returned 0x0 [0166.941] VirtualFree (lpAddress=0xb390000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.943] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.943] WriteFile (in: hFile=0x1494, lpBuffer=0xf84fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf84f830, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesWritten=0xf84f830*=0x428, lpOverlapped=0x0) returned 1 [0166.944] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.944] ReadFile (in: hFile=0x1494, lpBuffer=0x3850000, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0xf84f61c*=0x2942, lpOverlapped=0x0) returned 1 [0166.953] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xffffd6be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.953] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x3850000, cbInput=0x2942, pPaddingInfo=0x0, pbIV=0xf84f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0xf84f618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0xf84f848, pbOutput=0x3850000, pcbResult=0xf84f618) returned 0x0 [0166.953] WriteFile (in: hFile=0x1494, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0xf84f61c*=0x2950, lpOverlapped=0x0) returned 1 [0166.953] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf84f60c | out: lpNewFilePointer=0x0) returned 1 [0166.953] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.953] WriteFile (in: hFile=0x1494, lpBuffer=0xf84f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0xf84f83c*, lpNumberOfBytesWritten=0xf84f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.953] SetFilePointerEx (in: hFile=0x1494, liDistanceToMove=0x2950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.953] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0166.954] CloseHandle (hObject=0x1494) returned 1 [0167.108] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0167.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\explr_01.mid.play")) returned 1 [0167.873] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2082 os_tid = 0x1f6c [0166.968] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.968] ReadFile (in: hFile=0x49c, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.971] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.971] ReadFile (in: hFile=0x49c, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0166.971] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0166.973] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0166.973] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x125f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0166.973] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x125f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x125f828, pbKeyObject=0x0) returned 0x0 [0166.973] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x125f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x125f500) returned 0x0 [0166.973] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0166.973] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x125f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x125f500) returned 0x0 [0166.976] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.978] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.978] WriteFile (in: hFile=0x49c, lpBuffer=0x125fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x125f830, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesWritten=0x125f830*=0x428, lpOverlapped=0x0) returned 1 [0166.979] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.979] ReadFile (in: hFile=0x49c, lpBuffer=0x3950000, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x125f61c*=0x12ee, lpOverlapped=0x0) returned 1 [0166.979] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xffffed12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.979] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3950000, cbInput=0x12ee, pPaddingInfo=0x0, pbIV=0x125f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x125f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x125f848, pbOutput=0x3950000, pcbResult=0x125f618) returned 0x0 [0166.979] WriteFile (in: hFile=0x49c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x125f61c*=0x12f0, lpOverlapped=0x0) returned 1 [0166.979] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125f60c | out: lpNewFilePointer=0x0) returned 1 [0166.979] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.979] WriteFile (in: hFile=0x49c, lpBuffer=0x125f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x125f83c*, lpNumberOfBytesWritten=0x125f61c*=0x8, lpOverlapped=0x0) returned 1 [0166.979] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x12f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.979] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.979] CloseHandle (hObject=0x49c) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x17be0000 [0167.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fall_01.mid.play")) returned 1 [0168.183] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2083 os_tid = 0x1f70 [0166.981] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.981] ReadFile (in: hFile=0x8a4, lpBuffer=0xfccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfccf85c, lpOverlapped=0x0 | out: lpBuffer=0xfccfb34*, lpNumberOfBytesRead=0xfccf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.161] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.161] ReadFile (in: hFile=0x8a4, lpBuffer=0xfccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfccf85c, lpOverlapped=0x0 | out: lpBuffer=0xfccfb34*, lpNumberOfBytesRead=0xfccf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.440] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1d0000 [0167.442] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1d0000) returned 0x0 [0167.442] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xfccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0167.442] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xfccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xfccf828, pbKeyObject=0x0) returned 0x0 [0167.442] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1d0000, cbOutput=0x230, pcbResult=0xfccf500, dwFlags=0x0 | out: pbOutput=0x1d0000, pcbResult=0xfccf500) returned 0x0 [0167.442] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1d0230) returned 0x0 [0167.442] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1d0000, cbOutput=0x400, pcbResult=0xfccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1d0000, pcbResult=0xfccf500) returned 0x0 [0167.445] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.453] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.453] WriteFile (in: hFile=0x8a4, lpBuffer=0xfccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfccf830, lpOverlapped=0x0 | out: lpBuffer=0xfccfb34*, lpNumberOfBytesWritten=0xfccf830*=0x428, lpOverlapped=0x0) returned 1 [0167.454] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.454] ReadFile (in: hFile=0x8a4, lpBuffer=0x2950000, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0xfccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xfccf61c*=0x45ba, lpOverlapped=0x0) returned 1 [0167.520] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xffffba46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.520] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x2950000, cbInput=0x45ba, pPaddingInfo=0x0, pbIV=0xfccf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xfccf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0xfccf848, pbOutput=0x2950000, pcbResult=0xfccf618) returned 0x0 [0167.520] WriteFile (in: hFile=0x8a4, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0xfccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xfccf61c*=0x45c0, lpOverlapped=0x0) returned 1 [0167.520] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfccf60c | out: lpNewFilePointer=0x0) returned 1 [0167.521] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.521] WriteFile (in: hFile=0x8a4, lpBuffer=0xfccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfccf61c, lpOverlapped=0x0 | out: lpBuffer=0xfccf83c*, lpNumberOfBytesWritten=0xfccf61c*=0x8, lpOverlapped=0x0) returned 1 [0167.521] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x45c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.521] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0167.521] CloseHandle (hObject=0x8a4) returned 1 [0167.535] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x580000 [0167.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.play")) returned 1 [0167.554] VirtualFree (lpAddress=0x580000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2084 os_tid = 0x1f74 [0166.982] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.982] ReadFile (in: hFile=0x150c, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.984] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.984] ReadFile (in: hFile=0x150c, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0166.984] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0166.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0166.986] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x210bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0166.986] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x210bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x210bf828, pbKeyObject=0x0) returned 0x0 [0166.986] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x210bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x210bf500) returned 0x0 [0166.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0166.986] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x210bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x210bf500) returned 0x0 [0166.990] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.995] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.995] WriteFile (in: hFile=0x150c, lpBuffer=0x210bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210bf830, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesWritten=0x210bf830*=0x428, lpOverlapped=0x0) returned 1 [0166.996] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.996] ReadFile (in: hFile=0x150c, lpBuffer=0x3550000, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x210bf61c*=0x2eda, lpOverlapped=0x0) returned 1 [0166.996] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0xffffd126, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.996] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3550000, cbInput=0x2eda, pPaddingInfo=0x0, pbIV=0x210bf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x210bf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x210bf848, pbOutput=0x3550000, pcbResult=0x210bf618) returned 0x0 [0166.996] WriteFile (in: hFile=0x150c, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x210bf61c*=0x2ee0, lpOverlapped=0x0) returned 1 [0166.997] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210bf60c | out: lpNewFilePointer=0x0) returned 1 [0166.997] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.997] WriteFile (in: hFile=0x150c, lpBuffer=0x210bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x210bf83c*, lpNumberOfBytesWritten=0x210bf61c*=0x8, lpOverlapped=0x0) returned 1 [0166.997] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x2ee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.997] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0166.997] CloseHandle (hObject=0x150c) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x28c80000 [0167.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.play")) returned 1 [0168.180] VirtualFree (lpAddress=0x28c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2085 os_tid = 0x1f78 [0166.997] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.997] ReadFile (in: hFile=0xa34, lpBuffer=0x215bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215bf85c, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesRead=0x215bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.221] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.221] ReadFile (in: hFile=0xa34, lpBuffer=0x215bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215bf85c, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesRead=0x215bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.502] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1d0000 [0167.505] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1d0000) returned 0x0 [0167.505] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x215bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0167.505] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x215bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x215bf828, pbKeyObject=0x0) returned 0x0 [0167.505] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1d0000, cbOutput=0x230, pcbResult=0x215bf500, dwFlags=0x0 | out: pbOutput=0x1d0000, pcbResult=0x215bf500) returned 0x0 [0167.505] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1d0230) returned 0x0 [0167.505] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1d0000, cbOutput=0x400, pcbResult=0x215bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1d0000, pcbResult=0x215bf500) returned 0x0 [0167.510] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.515] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.516] WriteFile (in: hFile=0xa34, lpBuffer=0x215bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x215bf830, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesWritten=0x215bf830*=0x428, lpOverlapped=0x0) returned 1 [0167.516] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.516] ReadFile (in: hFile=0xa34, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x215bf61c*=0x7620, lpOverlapped=0x0) returned 1 [0167.582] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xffff89e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.582] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3a50000, cbInput=0x7620, pPaddingInfo=0x0, pbIV=0x215bf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x215bf618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x215bf848, pbOutput=0x3a50000, pcbResult=0x215bf618) returned 0x0 [0167.583] WriteFile (in: hFile=0xa34, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x215bf61c*=0x7630, lpOverlapped=0x0) returned 1 [0167.583] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x215bf60c | out: lpNewFilePointer=0x0) returned 1 [0167.583] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.583] WriteFile (in: hFile=0xa34, lpBuffer=0x215bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x215bf83c*, lpNumberOfBytesWritten=0x215bf61c*=0x8, lpOverlapped=0x0) returned 1 [0167.583] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x7630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.583] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0167.583] CloseHandle (hObject=0xa34) returned 1 [0167.583] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0167.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.play")) returned 1 [0167.587] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2086 os_tid = 0x1f7c [0166.999] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.999] ReadFile (in: hFile=0x10e8, lpBuffer=0xb24fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb24f85c, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesRead=0xb24f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.210] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.210] ReadFile (in: hFile=0x10e8, lpBuffer=0xb24fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb24f85c, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesRead=0xb24f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.210] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x11c50000 [0167.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x11c50000) returned 0x0 [0167.212] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0xb24f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0167.212] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0xb24f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x11c50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0xb24f828, pbKeyObject=0x0) returned 0x0 [0167.212] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x11c50000, cbOutput=0x230, pcbResult=0xb24f500, dwFlags=0x0 | out: pbOutput=0x11c50000, pcbResult=0xb24f500) returned 0x0 [0167.213] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x11c50230) returned 0x0 [0167.213] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x11c50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x11c50000, cbOutput=0x400, pcbResult=0xb24f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x11c50000, pcbResult=0xb24f500) returned 0x0 [0167.216] VirtualFree (lpAddress=0x11c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.218] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.218] WriteFile (in: hFile=0x10e8, lpBuffer=0xb24fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb24f830, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesWritten=0xb24f830*=0x428, lpOverlapped=0x0) returned 1 [0167.219] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.219] ReadFile (in: hFile=0x10e8, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0xb24f61c*=0x721c, lpOverlapped=0x0) returned 1 [0167.517] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xffff8de4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.517] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x3b50000, cbInput=0x721c, pPaddingInfo=0x0, pbIV=0xb24f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0xb24f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0xb24f848, pbOutput=0x3b50000, pcbResult=0xb24f618) returned 0x0 [0167.517] WriteFile (in: hFile=0x10e8, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0xb24f61c*=0x7220, lpOverlapped=0x0) returned 1 [0167.517] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb24f60c | out: lpNewFilePointer=0x0) returned 1 [0167.518] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.518] WriteFile (in: hFile=0x10e8, lpBuffer=0xb24f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0xb24f83c*, lpNumberOfBytesWritten=0xb24f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.518] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x7220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.518] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0167.518] CloseHandle (hObject=0x10e8) returned 1 [0167.526] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0167.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.play")) returned 1 [0167.570] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2087 os_tid = 0x1f80 [0167.000] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.000] ReadFile (in: hFile=0xdcc, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.209] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.210] ReadFile (in: hFile=0xdcc, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.406] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x11c50000 [0167.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x11c50000) returned 0x0 [0167.415] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x216bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0167.415] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x216bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x11c50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x216bf828, pbKeyObject=0x0) returned 0x0 [0167.415] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x11c50000, cbOutput=0x230, pcbResult=0x216bf500, dwFlags=0x0 | out: pbOutput=0x11c50000, pcbResult=0x216bf500) returned 0x0 [0167.416] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x11c50230) returned 0x0 [0167.416] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x11c50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x11c50000, cbOutput=0x400, pcbResult=0x216bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x11c50000, pcbResult=0x216bf500) returned 0x0 [0167.419] VirtualFree (lpAddress=0x11c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.422] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.422] WriteFile (in: hFile=0xdcc, lpBuffer=0x216bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x216bf830, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesWritten=0x216bf830*=0x428, lpOverlapped=0x0) returned 1 [0167.423] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.423] ReadFile (in: hFile=0xdcc, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x216bf61c*=0x3772, lpOverlapped=0x0) returned 1 [0167.519] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xffffc88e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.519] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x2c50000, cbInput=0x3772, pPaddingInfo=0x0, pbIV=0x216bf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x216bf618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x216bf848, pbOutput=0x2c50000, pcbResult=0x216bf618) returned 0x0 [0167.519] WriteFile (in: hFile=0xdcc, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x216bf61c*=0x3780, lpOverlapped=0x0) returned 1 [0167.519] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x216bf60c | out: lpNewFilePointer=0x0) returned 1 [0167.519] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.520] WriteFile (in: hFile=0xdcc, lpBuffer=0x216bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x216bf83c*, lpNumberOfBytesWritten=0x216bf61c*=0x8, lpOverlapped=0x0) returned 1 [0167.520] SetFilePointerEx (in: hFile=0xdcc, liDistanceToMove=0x3780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.520] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0167.520] CloseHandle (hObject=0xdcc) returned 1 [0167.533] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x570000 [0167.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.play")) returned 1 [0167.561] VirtualFree (lpAddress=0x570000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2088 os_tid = 0x1f84 [0167.001] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.002] ReadFile (in: hFile=0x10b8, lpBuffer=0x217bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x217bf85c, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesRead=0x217bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.199] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.199] ReadFile (in: hFile=0x10b8, lpBuffer=0x217bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x217bf85c, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesRead=0x217bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.199] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x11c50000 [0167.201] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x11c50000) returned 0x0 [0167.201] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x217bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0167.201] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x217bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x11c50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x217bf828, pbKeyObject=0x0) returned 0x0 [0167.201] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x11c50000, cbOutput=0x230, pcbResult=0x217bf500, dwFlags=0x0 | out: pbOutput=0x11c50000, pcbResult=0x217bf500) returned 0x0 [0167.201] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x11c50230) returned 0x0 [0167.202] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x11c50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x11c50000, cbOutput=0x400, pcbResult=0x217bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x11c50000, pcbResult=0x217bf500) returned 0x0 [0167.205] VirtualFree (lpAddress=0x11c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.207] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.207] WriteFile (in: hFile=0x10b8, lpBuffer=0x217bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x217bf830, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesWritten=0x217bf830*=0x428, lpOverlapped=0x0) returned 1 [0167.208] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.208] ReadFile (in: hFile=0x10b8, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x217bf61c*=0x920e, lpOverlapped=0x0) returned 1 [0167.425] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xffff6df2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.425] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3c50000, cbInput=0x920e, pPaddingInfo=0x0, pbIV=0x217bf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x217bf618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x217bf848, pbOutput=0x3c50000, pcbResult=0x217bf618) returned 0x0 [0167.425] WriteFile (in: hFile=0x10b8, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x217bf61c*=0x9210, lpOverlapped=0x0) returned 1 [0167.426] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x217bf60c | out: lpNewFilePointer=0x0) returned 1 [0167.426] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.426] WriteFile (in: hFile=0x10b8, lpBuffer=0x217bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x217bf83c*, lpNumberOfBytesWritten=0x217bf61c*=0x8, lpOverlapped=0x0) returned 1 [0167.426] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x9210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.426] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0167.426] CloseHandle (hObject=0x10b8) returned 1 [0167.437] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0167.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.play")) returned 1 [0168.219] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2089 os_tid = 0x1f88 [0167.003] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.003] ReadFile (in: hFile=0x10d0, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.004] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.004] ReadFile (in: hFile=0x10d0, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.004] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0167.006] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0167.006] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x218ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0167.006] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x218ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x218ff828, pbKeyObject=0x0) returned 0x0 [0167.006] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x218ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x218ff500) returned 0x0 [0167.006] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0167.006] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x218ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x218ff500) returned 0x0 [0167.010] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.012] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.012] WriteFile (in: hFile=0x10d0, lpBuffer=0x218ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x218ff830, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesWritten=0x218ff830*=0x428, lpOverlapped=0x0) returned 1 [0167.013] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.013] ReadFile (in: hFile=0x10d0, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x218ff61c*=0x3df0, lpOverlapped=0x0) returned 1 [0167.013] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xffffc210, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.013] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x3d50000, cbInput=0x3df0, pPaddingInfo=0x0, pbIV=0x218ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x218ff618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x218ff848, pbOutput=0x3d50000, pcbResult=0x218ff618) returned 0x0 [0167.013] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x218ff61c*=0x3e00, lpOverlapped=0x0) returned 1 [0167.013] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x218ff60c | out: lpNewFilePointer=0x0) returned 1 [0167.013] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.014] WriteFile (in: hFile=0x10d0, lpBuffer=0x218ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x218ff83c*, lpNumberOfBytesWritten=0x218ff61c*=0x8, lpOverlapped=0x0) returned 1 [0167.014] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x3e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.014] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0167.014] CloseHandle (hObject=0x10d0) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x28c90000 [0167.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.play")) returned 1 [0168.177] VirtualFree (lpAddress=0x28c90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2090 os_tid = 0x1f8c [0167.014] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.014] ReadFile (in: hFile=0xdd4, lpBuffer=0x21a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21a3fb34*, lpNumberOfBytesRead=0x21a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.221] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.221] ReadFile (in: hFile=0xdd4, lpBuffer=0x21a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21a3fb34*, lpNumberOfBytesRead=0x21a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.454] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1d0000 [0167.457] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1d0000) returned 0x0 [0167.458] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x21a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0167.458] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x21a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x21a3f828, pbKeyObject=0x0) returned 0x0 [0167.458] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1d0000, cbOutput=0x230, pcbResult=0x21a3f500, dwFlags=0x0 | out: pbOutput=0x1d0000, pcbResult=0x21a3f500) returned 0x0 [0167.458] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1d0230) returned 0x0 [0167.458] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1d0000, cbOutput=0x400, pcbResult=0x21a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1d0000, pcbResult=0x21a3f500) returned 0x0 [0167.463] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.468] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.468] WriteFile (in: hFile=0xdd4, lpBuffer=0x21a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21a3f830, lpOverlapped=0x0 | out: lpBuffer=0x21a3fb34*, lpNumberOfBytesWritten=0x21a3f830*=0x428, lpOverlapped=0x0) returned 1 [0167.469] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.469] ReadFile (in: hFile=0xdd4, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x21a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x21a3f61c*=0x4712, lpOverlapped=0x0) returned 1 [0167.521] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xffffb8ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.521] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3e50000, cbInput=0x4712, pPaddingInfo=0x0, pbIV=0x21a3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x21a3f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x21a3f848, pbOutput=0x3e50000, pcbResult=0x21a3f618) returned 0x0 [0167.521] WriteFile (in: hFile=0xdd4, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x21a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x21a3f61c*=0x4720, lpOverlapped=0x0) returned 1 [0167.521] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21a3f60c | out: lpNewFilePointer=0x0) returned 1 [0167.521] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.521] WriteFile (in: hFile=0xdd4, lpBuffer=0x21a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21a3f83c*, lpNumberOfBytesWritten=0x21a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.522] SetFilePointerEx (in: hFile=0xdd4, liDistanceToMove=0x4720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.522] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0167.522] CloseHandle (hObject=0xdd4) returned 1 [0167.538] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x590000 [0167.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.play")) returned 1 [0167.546] VirtualFree (lpAddress=0x590000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2091 os_tid = 0x1f90 [0167.015] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.015] ReadFile (in: hFile=0x964, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.222] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.222] ReadFile (in: hFile=0x964, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.485] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1d0000 [0167.488] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1d0000) returned 0x0 [0167.488] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x21d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0167.488] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x21d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x21d3f828, pbKeyObject=0x0) returned 0x0 [0167.488] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1d0000, cbOutput=0x230, pcbResult=0x21d3f500, dwFlags=0x0 | out: pbOutput=0x1d0000, pcbResult=0x21d3f500) returned 0x0 [0167.488] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1d0230) returned 0x0 [0167.488] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1d0000, cbOutput=0x400, pcbResult=0x21d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1d0000, pcbResult=0x21d3f500) returned 0x0 [0167.493] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.500] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.500] WriteFile (in: hFile=0x964, lpBuffer=0x21d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d3f830, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesWritten=0x21d3f830*=0x428, lpOverlapped=0x0) returned 1 [0167.501] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.501] ReadFile (in: hFile=0x964, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x21d3f61c*=0xb6de, lpOverlapped=0x0) returned 1 [0167.522] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xffff4922, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.522] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x3f50000, cbInput=0xb6de, pPaddingInfo=0x0, pbIV=0x21d3f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x21d3f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x21d3f848, pbOutput=0x3f50000, pcbResult=0x21d3f618) returned 0x0 [0167.522] WriteFile (in: hFile=0x964, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x21d3f61c*=0xb6e0, lpOverlapped=0x0) returned 1 [0167.523] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d3f60c | out: lpNewFilePointer=0x0) returned 1 [0167.523] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.523] WriteFile (in: hFile=0x964, lpBuffer=0x21d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d3f83c*, lpNumberOfBytesWritten=0x21d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.523] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xb6e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.523] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0167.523] CloseHandle (hObject=0x964) returned 1 [0167.574] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0167.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.play")) returned 1 [0167.577] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2092 os_tid = 0x1f94 [0167.017] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.017] ReadFile (in: hFile=0x1530, lpBuffer=0x21e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesRead=0x21e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.221] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.221] ReadFile (in: hFile=0x1530, lpBuffer=0x21e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesRead=0x21e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.470] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1d0000 [0167.472] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1d0000) returned 0x0 [0167.472] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x21e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0167.472] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x21e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x21e3f828, pbKeyObject=0x0) returned 0x0 [0167.472] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1d0000, cbOutput=0x230, pcbResult=0x21e3f500, dwFlags=0x0 | out: pbOutput=0x1d0000, pcbResult=0x21e3f500) returned 0x0 [0167.472] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1d0230) returned 0x0 [0167.473] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1d0000, cbOutput=0x400, pcbResult=0x21e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1d0000, pcbResult=0x21e3f500) returned 0x0 [0167.478] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.481] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.481] WriteFile (in: hFile=0x1530, lpBuffer=0x21e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21e3f830, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesWritten=0x21e3f830*=0x428, lpOverlapped=0x0) returned 1 [0167.484] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.484] ReadFile (in: hFile=0x1530, lpBuffer=0x4050000, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x21e3f61c*=0x17b4, lpOverlapped=0x0) returned 1 [0167.484] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0xffffe84c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.484] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x4050000, cbInput=0x17b4, pPaddingInfo=0x0, pbIV=0x21e3f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x21e3f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x21e3f848, pbOutput=0x4050000, pcbResult=0x21e3f618) returned 0x0 [0167.484] WriteFile (in: hFile=0x1530, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x21e3f61c*=0x17c0, lpOverlapped=0x0) returned 1 [0167.485] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21e3f60c | out: lpNewFilePointer=0x0) returned 1 [0167.485] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.485] WriteFile (in: hFile=0x1530, lpBuffer=0x21e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21e3f83c*, lpNumberOfBytesWritten=0x21e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.485] SetFilePointerEx (in: hFile=0x1530, liDistanceToMove=0x17c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.485] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0167.485] CloseHandle (hObject=0x1530) returned 1 [0167.523] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1d0000 [0167.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.play")) returned 1 [0168.191] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2093 os_tid = 0x1f98 [0167.018] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.018] ReadFile (in: hFile=0x1538, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.020] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.020] ReadFile (in: hFile=0x1538, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.020] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0167.021] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0167.021] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x21f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0167.022] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x21f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x21f3f828, pbKeyObject=0x0) returned 0x0 [0167.022] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x21f3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x21f3f500) returned 0x0 [0167.022] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0167.022] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x21f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x21f3f500) returned 0x0 [0167.025] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.027] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.027] WriteFile (in: hFile=0x1538, lpBuffer=0x21f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21f3f830, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesWritten=0x21f3f830*=0x428, lpOverlapped=0x0) returned 1 [0167.028] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.028] ReadFile (in: hFile=0x1538, lpBuffer=0x4150000, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x21f3f61c*=0xfea, lpOverlapped=0x0) returned 1 [0167.028] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0xfffff016, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.028] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4150000, cbInput=0xfea, pPaddingInfo=0x0, pbIV=0x21f3f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x21f3f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x21f3f848, pbOutput=0x4150000, pcbResult=0x21f3f618) returned 0x0 [0167.028] WriteFile (in: hFile=0x1538, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x21f3f61c*=0xff0, lpOverlapped=0x0) returned 1 [0167.028] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21f3f60c | out: lpNewFilePointer=0x0) returned 1 [0167.028] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.028] WriteFile (in: hFile=0x1538, lpBuffer=0x21f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21f3f83c*, lpNumberOfBytesWritten=0x21f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.028] SetFilePointerEx (in: hFile=0x1538, liDistanceToMove=0xff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.028] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0167.028] CloseHandle (hObject=0x1538) returned 1 [0167.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x28ca0000 [0167.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.play")) returned 1 [0168.172] VirtualFree (lpAddress=0x28ca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2094 os_tid = 0x1f9c [0167.029] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.029] ReadFile (in: hFile=0x1540, lpBuffer=0x2207fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2207f85c, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesRead=0x2207f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.030] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.030] ReadFile (in: hFile=0x1540, lpBuffer=0x2207fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2207f85c, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesRead=0x2207f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.030] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0167.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0167.032] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x2207f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0167.032] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x2207f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x2207f828, pbKeyObject=0x0) returned 0x0 [0167.032] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2207f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2207f500) returned 0x0 [0167.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0167.032] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2207f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2207f500) returned 0x0 [0167.035] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.037] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.037] WriteFile (in: hFile=0x1540, lpBuffer=0x2207fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2207f830, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesWritten=0x2207f830*=0x428, lpOverlapped=0x0) returned 1 [0167.038] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.038] ReadFile (in: hFile=0x1540, lpBuffer=0x4250000, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x2207f61c*=0x2168, lpOverlapped=0x0) returned 1 [0167.039] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xffffde98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.039] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4250000, cbInput=0x2168, pPaddingInfo=0x0, pbIV=0x2207f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x2207f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2207f848, pbOutput=0x4250000, pcbResult=0x2207f618) returned 0x0 [0167.039] WriteFile (in: hFile=0x1540, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x2207f61c*=0x2170, lpOverlapped=0x0) returned 1 [0167.039] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2207f60c | out: lpNewFilePointer=0x0) returned 1 [0167.039] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.039] WriteFile (in: hFile=0x1540, lpBuffer=0x2207f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x2207f83c*, lpNumberOfBytesWritten=0x2207f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.039] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x2170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.039] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0167.039] CloseHandle (hObject=0x1540) returned 1 [0167.110] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x28cb0000 [0167.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.play")) returned 1 [0167.141] VirtualFree (lpAddress=0x28cb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2095 os_tid = 0x1fa0 [0167.039] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.040] ReadFile (in: hFile=0x1548, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.237] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.237] ReadFile (in: hFile=0x1548, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.237] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x11c50000 [0167.314] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x11c50000) returned 0x0 [0167.314] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x230ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0167.314] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x230ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x11c50000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x230ff828, pbKeyObject=0x0) returned 0x0 [0167.314] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x11c50000, cbOutput=0x230, pcbResult=0x230ff500, dwFlags=0x0 | out: pbOutput=0x11c50000, pcbResult=0x230ff500) returned 0x0 [0167.315] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x11c50230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x11c50230) returned 0x0 [0167.315] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x11c50000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x11c50000, cbOutput=0x400, pcbResult=0x230ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x11c50000, pcbResult=0x230ff500) returned 0x0 [0167.401] VirtualFree (lpAddress=0x11c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.404] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.405] WriteFile (in: hFile=0x1548, lpBuffer=0x230ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x230ff830, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesWritten=0x230ff830*=0x428, lpOverlapped=0x0) returned 1 [0167.405] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.405] ReadFile (in: hFile=0x1548, lpBuffer=0x4350000, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x230ff61c*=0x20e8, lpOverlapped=0x0) returned 1 [0167.518] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xffffdf18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.518] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4350000, cbInput=0x20e8, pPaddingInfo=0x0, pbIV=0x230ff848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x230ff618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x230ff848, pbOutput=0x4350000, pcbResult=0x230ff618) returned 0x0 [0167.518] WriteFile (in: hFile=0x1548, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x230ff61c*=0x20f0, lpOverlapped=0x0) returned 1 [0167.518] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230ff60c | out: lpNewFilePointer=0x0) returned 1 [0167.518] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.518] WriteFile (in: hFile=0x1548, lpBuffer=0x230ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x230ff83c*, lpNumberOfBytesWritten=0x230ff61c*=0x8, lpOverlapped=0x0) returned 1 [0167.519] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x20f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.519] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0167.519] CloseHandle (hObject=0x1548) returned 1 [0167.530] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0000 [0167.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.play")) returned 1 [0167.565] VirtualFree (lpAddress=0x1f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2096 os_tid = 0x1fa4 [0167.041] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.041] ReadFile (in: hFile=0x4bc, lpBuffer=0x231ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x231ff85c, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesRead=0x231ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.042] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.042] ReadFile (in: hFile=0x4bc, lpBuffer=0x231ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x231ff85c, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesRead=0x231ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.042] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0167.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0167.044] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x231ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0167.044] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x231ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x231ff828, pbKeyObject=0x0) returned 0x0 [0167.044] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x231ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x231ff500) returned 0x0 [0167.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0167.044] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x231ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x231ff500) returned 0x0 [0167.047] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.049] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.049] WriteFile (in: hFile=0x4bc, lpBuffer=0x231ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x231ff830, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesWritten=0x231ff830*=0x428, lpOverlapped=0x0) returned 1 [0167.050] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.050] ReadFile (in: hFile=0x4bc, lpBuffer=0x4450000, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x231ff61c*=0x2a40, lpOverlapped=0x0) returned 1 [0167.050] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xffffd5c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.050] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x4450000, cbInput=0x2a40, pPaddingInfo=0x0, pbIV=0x231ff848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x231ff618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x231ff848, pbOutput=0x4450000, pcbResult=0x231ff618) returned 0x0 [0167.050] WriteFile (in: hFile=0x4bc, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x231ff61c*=0x2a50, lpOverlapped=0x0) returned 1 [0167.051] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x231ff60c | out: lpNewFilePointer=0x0) returned 1 [0167.051] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.051] WriteFile (in: hFile=0x4bc, lpBuffer=0x231ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x231ff83c*, lpNumberOfBytesWritten=0x231ff61c*=0x8, lpOverlapped=0x0) returned 1 [0167.051] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x2a50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.051] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0167.051] CloseHandle (hObject=0x4bc) returned 1 [0167.177] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x28df0000 [0167.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.play")) returned 1 [0168.223] VirtualFree (lpAddress=0x28df0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2097 os_tid = 0x1fa8 [0167.088] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0167.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0167.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f000c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0167.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0167.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0024, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0167.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0167.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f003c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0167.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0167.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0054, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0 [0167.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c [0167.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f006c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0167.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0167.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0084, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0167.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8 [0167.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f009c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0167.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0167.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c [0167.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0167.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c [0167.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0167.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1298 [0167.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084 [0167.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0167.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8 [0167.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0114, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0167.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c [0167.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f012c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0167.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0167.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0144, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0167.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0167.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f015c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0167.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0167.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0174, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c [0167.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0167.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f018c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0167.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0167.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0167.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c [0167.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0167.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4 [0167.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0167.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0167.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0167.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0167.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0204, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0167.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0167.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f021c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0167.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0167.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0234, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0167.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc [0167.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f024c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0167.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0167.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0264, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0167.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0167.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f027c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0 [0167.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0167.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0294, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1584 [0168.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0168.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0168.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x157c [0168.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1574 [0168.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0168.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548 [0168.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0168.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440 [0168.748] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x538, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0171.877] CloseHandle (hObject=0x538) returned 1 [0171.877] CloseHandle (hObject=0x1538) returned 1 [0171.878] CloseHandle (hObject=0x2a4) returned 1 [0171.878] CloseHandle (hObject=0x374) returned 1 [0171.878] CloseHandle (hObject=0x4bc) returned 1 [0171.878] CloseHandle (hObject=0x974) returned 1 [0171.878] CloseHandle (hObject=0x568) returned 1 [0171.878] CloseHandle (hObject=0x10d0) returned 1 [0171.878] CloseHandle (hObject=0x150c) returned 1 [0171.878] CloseHandle (hObject=0xdbc) returned 1 [0171.878] CloseHandle (hObject=0x49c) returned 1 [0171.878] CloseHandle (hObject=0x22c) returned 1 [0171.878] CloseHandle (hObject=0x10a8) returned 1 [0171.878] CloseHandle (hObject=0x12c8) returned 1 [0171.878] CloseHandle (hObject=0x1064) returned 1 [0171.878] CloseHandle (hObject=0x124c) returned 1 [0171.878] CloseHandle (hObject=0xd8c) returned 1 [0171.878] CloseHandle (hObject=0x101c) returned 1 [0171.878] CloseHandle (hObject=0x103c) returned 1 [0171.878] CloseHandle (hObject=0x1298) returned 1 [0171.878] CloseHandle (hObject=0x1084) returned 1 [0171.878] CloseHandle (hObject=0x12c0) returned 1 [0171.878] CloseHandle (hObject=0x12b8) returned 1 [0171.879] CloseHandle (hObject=0x12d0) returned 1 [0171.879] CloseHandle (hObject=0x122c) returned 1 [0171.879] CloseHandle (hObject=0x127c) returned 1 [0171.879] CloseHandle (hObject=0x1284) returned 1 [0171.879] CloseHandle (hObject=0x1204) returned 1 [0171.879] CloseHandle (hObject=0x121c) returned 1 [0171.879] CloseHandle (hObject=0x11f4) returned 1 [0171.879] CloseHandle (hObject=0x1224) returned 1 [0171.879] CloseHandle (hObject=0xa8c) returned 1 [0171.879] CloseHandle (hObject=0xfe0) returned 1 [0171.879] CloseHandle (hObject=0x11e4) returned 1 [0171.879] CloseHandle (hObject=0x108c) returned 1 [0171.879] CloseHandle (hObject=0x1054) returned 1 [0171.879] CloseHandle (hObject=0x100c) returned 1 [0171.879] CloseHandle (hObject=0x1024) returned 1 [0171.879] CloseHandle (hObject=0x16a4) returned 1 [0171.879] CloseHandle (hObject=0x16a8) returned 1 [0171.879] CloseHandle (hObject=0x16ac) returned 1 [0171.879] CloseHandle (hObject=0x16b0) returned 1 [0171.879] CloseHandle (hObject=0x16b4) returned 1 [0171.879] CloseHandle (hObject=0x16b8) returned 1 [0171.879] CloseHandle (hObject=0x16bc) returned 1 [0171.880] CloseHandle (hObject=0x16c0) returned 1 [0171.880] CloseHandle (hObject=0x16c4) returned 1 [0171.880] CloseHandle (hObject=0x16c8) returned 1 [0171.880] CloseHandle (hObject=0x16cc) returned 1 [0171.880] CloseHandle (hObject=0x16d0) returned 1 [0171.880] CloseHandle (hObject=0x16d4) returned 1 [0171.880] CloseHandle (hObject=0x16d8) returned 1 [0171.880] CloseHandle (hObject=0x16dc) returned 1 [0171.880] CloseHandle (hObject=0x16e0) returned 1 [0171.880] CloseHandle (hObject=0x16e4) returned 1 [0171.880] CloseHandle (hObject=0x1584) returned 1 [0171.880] CloseHandle (hObject=0xa34) returned 1 [0171.880] CloseHandle (hObject=0x8a4) returned 1 [0171.880] CloseHandle (hObject=0x157c) returned 1 [0171.880] CloseHandle (hObject=0x1574) returned 1 [0171.881] CloseHandle (hObject=0x10e8) returned 1 [0171.881] CloseHandle (hObject=0x1548) returned 1 [0171.881] CloseHandle (hObject=0x2e8) returned 1 [0171.881] CloseHandle (hObject=0x1440) returned 1 [0171.881] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2098 os_tid = 0x1fac [0167.184] GetLastError () returned 0x57 [0167.184] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c3570 [0167.184] SetLastError (dwErrCode=0x57) [0167.184] IcmpCreateFile () returned 0x7b9ea8 [0167.184] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x799050 [0167.184] IcmpSendEcho2 (IcmpHandle=0x7b9ea8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x100a8c0, RequestData=0xd1cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x799050, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2099 os_tid = 0x1fb0 [0167.185] GetLastError () returned 0x57 [0167.185] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c38f8 [0167.185] SetLastError (dwErrCode=0x57) [0167.185] IcmpCreateFile () returned 0x7b9ee0 [0167.185] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7990a0 [0167.185] IcmpSendEcho2 (IcmpHandle=0x7b9ee0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x200a8c0, RequestData=0xf5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7990a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2100 os_tid = 0x1fb4 [0167.186] GetLastError () returned 0x57 [0167.186] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c3c80 [0167.187] SetLastError (dwErrCode=0x57) [0167.187] IcmpCreateFile () returned 0x7b9f18 [0167.187] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7990f0 [0167.187] IcmpSendEcho2 (IcmpHandle=0x7b9f18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x300a8c0, RequestData=0xff8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7990f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2101 os_tid = 0x1fb8 [0167.188] GetLastError () returned 0x57 [0167.188] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cbf28 [0167.188] SetLastError (dwErrCode=0x57) [0167.188] IcmpCreateFile () returned 0x7b9f50 [0167.188] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x799140 [0167.188] IcmpSendEcho2 (IcmpHandle=0x7b9f50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x400a8c0, RequestData=0x1020ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x799140, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2102 os_tid = 0x1fbc [0167.189] GetLastError () returned 0x57 [0167.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cc2b0 [0167.189] SetLastError (dwErrCode=0x57) [0167.189] IcmpCreateFile () returned 0x7b9f88 [0167.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x799190 [0167.189] IcmpSendEcho2 (IcmpHandle=0x7b9f88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x500a8c0, RequestData=0x1098ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x799190, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2103 os_tid = 0x1fc0 [0167.190] GetLastError () returned 0x57 [0167.190] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cc638 [0167.190] SetLastError (dwErrCode=0x57) [0167.190] IcmpCreateFile () returned 0x7b9fc0 [0167.191] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7991e0 [0167.191] IcmpSendEcho2 (IcmpHandle=0x7b9fc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x600a8c0, RequestData=0x11c4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7991e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2104 os_tid = 0x1fc4 [0167.192] GetLastError () returned 0x57 [0167.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cc9c0 [0167.192] SetLastError (dwErrCode=0x57) [0167.192] IcmpCreateFile () returned 0x728b00 [0167.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x799230 [0167.192] IcmpSendEcho2 (IcmpHandle=0x728b00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x700a8c0, RequestData=0x232fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x799230, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2105 os_tid = 0x1fc8 [0167.193] GetLastError () returned 0x57 [0167.193] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ccd48 [0167.193] SetLastError (dwErrCode=0x57) [0167.193] IcmpCreateFile () returned 0x728b38 [0167.193] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x799280 [0167.193] IcmpSendEcho2 (IcmpHandle=0x728b38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x800a8c0, RequestData=0x2343ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x799280, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2106 os_tid = 0x1fcc [0167.194] GetLastError () returned 0x57 [0167.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cd0d0 [0167.195] SetLastError (dwErrCode=0x57) [0167.195] IcmpCreateFile () returned 0x728ba8 [0167.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7992d0 [0167.195] IcmpSendEcho2 (IcmpHandle=0x728ba8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x900a8c0, RequestData=0x2357ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7992d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2107 os_tid = 0x1fd0 [0167.196] GetLastError () returned 0x57 [0167.196] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cd458 [0167.196] SetLastError (dwErrCode=0x57) [0167.196] IcmpCreateFile () returned 0x728c18 [0167.196] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798d80 [0167.196] IcmpSendEcho2 (IcmpHandle=0x728c18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa00a8c0, RequestData=0x236bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798d80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2108 os_tid = 0x1fd4 [0167.197] GetLastError () returned 0x57 [0167.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cd7e0 [0167.197] SetLastError (dwErrCode=0x57) [0167.197] IcmpCreateFile () returned 0x728cc0 [0167.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798dd0 [0167.197] IcmpSendEcho2 (IcmpHandle=0x728cc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb00a8c0, RequestData=0x237fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798dd0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2109 os_tid = 0x1fd8 [0167.222] GetLastError () returned 0x57 [0167.222] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cdb68 [0167.223] SetLastError (dwErrCode=0x57) [0167.223] IcmpCreateFile () returned 0x728cf8 [0167.660] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7984c0 [0167.660] IcmpSendEcho2 (IcmpHandle=0x728cf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc00a8c0, RequestData=0x2393ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7984c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2110 os_tid = 0x1fdc [0167.661] GetLastError () returned 0x57 [0167.661] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cdef0 [0167.661] SetLastError (dwErrCode=0x57) [0167.661] IcmpCreateFile () returned 0x728d30 [0167.661] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798510 [0167.661] IcmpSendEcho2 (IcmpHandle=0x728d30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd00a8c0, RequestData=0x23a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798510, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2111 os_tid = 0x1fe0 [0167.662] GetLastError () returned 0x57 [0167.662] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7178 [0167.662] SetLastError (dwErrCode=0x57) [0167.662] IcmpCreateFile () returned 0x7289b0 [0167.662] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798560 [0167.663] IcmpSendEcho2 (IcmpHandle=0x7289b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe00a8c0, RequestData=0x23bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798560, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2112 os_tid = 0x1fe4 [0167.663] GetLastError () returned 0x57 [0167.663] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7500 [0167.664] SetLastError (dwErrCode=0x57) [0167.664] IcmpCreateFile () returned 0x728a90 [0167.664] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7985b0 [0167.664] IcmpSendEcho2 (IcmpHandle=0x728a90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf00a8c0, RequestData=0x23cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7985b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2113 os_tid = 0x1fe8 [0167.665] GetLastError () returned 0x57 [0167.665] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7888 [0167.665] SetLastError (dwErrCode=0x57) [0167.665] IcmpCreateFile () returned 0x728ac8 [0167.665] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798600 [0167.665] IcmpSendEcho2 (IcmpHandle=0x728ac8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1000a8c0, RequestData=0x23e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798600, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2114 os_tid = 0x1fec [0167.666] GetLastError () returned 0x57 [0167.666] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7c10 [0167.666] SetLastError (dwErrCode=0x57) [0167.666] IcmpCreateFile () returned 0x75d498 [0167.666] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798650 [0167.666] IcmpSendEcho2 (IcmpHandle=0x75d498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1100a8c0, RequestData=0x23f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798650, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2115 os_tid = 0x1ff0 [0167.671] GetLastError () returned 0x57 [0167.671] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c7f98 [0167.671] SetLastError (dwErrCode=0x57) [0167.671] IcmpCreateFile () returned 0x75d508 [0167.671] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7986a0 [0167.671] IcmpSendEcho2 (IcmpHandle=0x75d508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1200a8c0, RequestData=0x240bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7986a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2116 os_tid = 0x1ff4 [0167.672] GetLastError () returned 0x57 [0167.672] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8320 [0167.672] SetLastError (dwErrCode=0x57) [0167.673] IcmpCreateFile () returned 0x75d540 [0167.673] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7986f0 [0167.673] IcmpSendEcho2 (IcmpHandle=0x75d540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1300a8c0, RequestData=0x241fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7986f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2117 os_tid = 0x1ff8 [0167.674] GetLastError () returned 0x57 [0167.674] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c86a8 [0167.674] SetLastError (dwErrCode=0x57) [0167.674] IcmpCreateFile () returned 0x75d578 [0167.674] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798740 [0167.674] IcmpSendEcho2 (IcmpHandle=0x75d578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1400a8c0, RequestData=0x2433ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798740, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2118 os_tid = 0x1ffc [0167.675] GetLastError () returned 0x57 [0167.675] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8a30 [0167.676] SetLastError (dwErrCode=0x57) [0167.676] IcmpCreateFile () returned 0x75d620 [0167.676] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798790 [0167.676] IcmpSendEcho2 (IcmpHandle=0x75d620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1500a8c0, RequestData=0x2447ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798790, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2119 os_tid = 0x15e0 [0167.677] GetLastError () returned 0x57 [0167.677] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c8db8 [0167.677] SetLastError (dwErrCode=0x57) [0167.677] IcmpCreateFile () returned 0x75d310 [0167.677] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7987e0 [0167.677] IcmpSendEcho2 (IcmpHandle=0x75d310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1600a8c0, RequestData=0x245bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7987e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2120 os_tid = 0x19d0 [0167.680] GetLastError () returned 0x57 [0167.680] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c9140 [0167.680] SetLastError (dwErrCode=0x57) [0167.680] IcmpCreateFile () returned 0x75d348 [0167.680] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798830 [0167.681] IcmpSendEcho2 (IcmpHandle=0x75d348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1700a8c0, RequestData=0x278fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798830, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2121 os_tid = 0x15dc [0167.682] GetLastError () returned 0x57 [0167.682] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c94c8 [0167.682] SetLastError (dwErrCode=0x57) [0167.682] IcmpCreateFile () returned 0x75d3b8 [0167.682] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798880 [0167.682] IcmpSendEcho2 (IcmpHandle=0x75d3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1800a8c0, RequestData=0x279fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798880, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2122 os_tid = 0x15d8 [0167.683] GetLastError () returned 0x57 [0167.683] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c9850 [0167.684] SetLastError (dwErrCode=0x57) [0167.684] IcmpCreateFile () returned 0x75d3f0 [0167.684] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7988d0 [0167.684] IcmpSendEcho2 (IcmpHandle=0x75d3f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1900a8c0, RequestData=0x27afff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7988d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2123 os_tid = 0x15d4 [0167.685] GetLastError () returned 0x57 [0167.685] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c9bd8 [0167.685] SetLastError (dwErrCode=0x57) [0167.685] IcmpCreateFile () returned 0x75d428 [0167.685] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798920 [0167.685] IcmpSendEcho2 (IcmpHandle=0x75d428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1a00a8c0, RequestData=0x27c3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798920, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2124 os_tid = 0xe74 [0167.686] GetLastError () returned 0x57 [0167.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6c9f60 [0167.686] SetLastError (dwErrCode=0x57) [0167.686] IcmpCreateFile () returned 0x7ccef8 [0167.687] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7989c0 [0167.687] IcmpSendEcho2 (IcmpHandle=0x7ccef8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b00a8c0, RequestData=0x27d7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7989c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2125 os_tid = 0x15cc [0167.688] GetLastError () returned 0x57 [0167.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ca2e8 [0167.688] SetLastError (dwErrCode=0x57) [0167.688] IcmpCreateFile () returned 0x7ccb08 [0167.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798b50 [0167.688] IcmpSendEcho2 (IcmpHandle=0x7ccb08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1c00a8c0, RequestData=0x27ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798b50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2126 os_tid = 0x15c8 [0167.689] GetLastError () returned 0x57 [0167.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ca670 [0167.689] SetLastError (dwErrCode=0x57) [0167.689] IcmpCreateFile () returned 0x7ccb40 [0167.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798ba0 [0167.689] IcmpSendEcho2 (IcmpHandle=0x7ccb40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1d00a8c0, RequestData=0x27ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798ba0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2127 os_tid = 0x15c4 [0167.690] GetLastError () returned 0x57 [0167.690] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ca9f8 [0167.691] SetLastError (dwErrCode=0x57) [0167.691] IcmpCreateFile () returned 0x7ccb78 [0167.691] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798bf0 [0167.691] IcmpSendEcho2 (IcmpHandle=0x7ccb78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1e00a8c0, RequestData=0x2813ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798bf0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2128 os_tid = 0x15c0 [0167.692] GetLastError () returned 0x57 [0167.692] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cad80 [0167.692] SetLastError (dwErrCode=0x57) [0167.692] IcmpCreateFile () returned 0x7ccbb0 [0167.692] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798c40 [0167.692] IcmpSendEcho2 (IcmpHandle=0x7ccbb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1f00a8c0, RequestData=0x2827ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798c40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2129 os_tid = 0x15bc [0167.693] GetLastError () returned 0x57 [0167.693] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cb108 [0167.693] SetLastError (dwErrCode=0x57) [0167.693] IcmpCreateFile () returned 0x7ccf30 [0167.693] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798a10 [0167.693] IcmpSendEcho2 (IcmpHandle=0x7ccf30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2000a8c0, RequestData=0x283bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798a10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2130 os_tid = 0x15b8 [0167.694] GetLastError () returned 0x57 [0167.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cb490 [0167.695] SetLastError (dwErrCode=0x57) [0167.695] IcmpCreateFile () returned 0x7ccf68 [0167.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798a60 [0167.695] IcmpSendEcho2 (IcmpHandle=0x7ccf68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2100a8c0, RequestData=0x284fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798a60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2131 os_tid = 0x16a8 [0167.770] GetLastError () returned 0x57 [0167.770] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cb818 [0167.771] SetLastError (dwErrCode=0x57) [0167.771] IcmpCreateFile () returned 0x7ccbe8 [0167.771] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798c90 [0167.771] IcmpSendEcho2 (IcmpHandle=0x7ccbe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2200a8c0, RequestData=0x2863ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798c90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2132 os_tid = 0x16ac [0167.773] GetLastError () returned 0x57 [0167.773] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cbba0 [0167.773] SetLastError (dwErrCode=0x57) [0167.773] IcmpCreateFile () returned 0x7ccc20 [0167.773] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798ce0 [0167.773] IcmpSendEcho2 (IcmpHandle=0x7ccc20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2300a8c0, RequestData=0x2877ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798ce0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2133 os_tid = 0x16b0 [0167.775] GetLastError () returned 0x57 [0167.775] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cf7a8 [0167.775] SetLastError (dwErrCode=0x57) [0167.775] IcmpCreateFile () returned 0x7ccc58 [0167.775] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798d30 [0167.775] IcmpSendEcho2 (IcmpHandle=0x7ccc58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2400a8c0, RequestData=0x288bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798d30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2134 os_tid = 0x16b4 [0167.776] GetLastError () returned 0x57 [0167.776] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cfb30 [0167.777] SetLastError (dwErrCode=0x57) [0167.777] IcmpCreateFile () returned 0x7ccc90 [0167.777] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798380 [0167.777] IcmpSendEcho2 (IcmpHandle=0x7ccc90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2500a8c0, RequestData=0x289fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798380, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2135 os_tid = 0xfc4 [0167.778] GetLastError () returned 0x57 [0167.778] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ce278 [0167.778] SetLastError (dwErrCode=0x57) [0167.778] IcmpCreateFile () returned 0x7cccc8 [0167.778] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7983d0 [0167.778] IcmpSendEcho2 (IcmpHandle=0x7cccc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2600a8c0, RequestData=0x28b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7983d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2136 os_tid = 0x1de4 [0167.800] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.800] ReadFile (in: hFile=0x614, lpBuffer=0x2207fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2207f85c, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesRead=0x2207f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.802] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.802] ReadFile (in: hFile=0x614, lpBuffer=0x2207fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2207f85c, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesRead=0x2207f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.802] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1e0000 [0167.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1e0000) returned 0x0 [0167.804] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2207f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0167.804] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2207f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1e0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2207f828, pbKeyObject=0x0) returned 0x0 [0167.804] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1e0000, cbOutput=0x230, pcbResult=0x2207f500, dwFlags=0x0 | out: pbOutput=0x1e0000, pcbResult=0x2207f500) returned 0x0 [0167.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1e0230) returned 0x0 [0167.804] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1e0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1e0000, cbOutput=0x400, pcbResult=0x2207f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1e0000, pcbResult=0x2207f500) returned 0x0 [0167.808] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.810] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.810] WriteFile (in: hFile=0x614, lpBuffer=0x2207fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2207f830, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesWritten=0x2207f830*=0x428, lpOverlapped=0x0) returned 1 [0167.811] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.811] ReadFile (in: hFile=0x614, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2207f61c*=0x1ec6, lpOverlapped=0x0) returned 1 [0167.812] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xffffe13a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.812] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x2e50000, cbInput=0x1ec6, pPaddingInfo=0x0, pbIV=0x2207f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2207f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2207f848, pbOutput=0x2e50000, pcbResult=0x2207f618) returned 0x0 [0167.812] WriteFile (in: hFile=0x614, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2207f61c*=0x1ed0, lpOverlapped=0x0) returned 1 [0167.813] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2207f60c | out: lpNewFilePointer=0x0) returned 1 [0167.813] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.813] WriteFile (in: hFile=0x614, lpBuffer=0x2207f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x2207f83c*, lpNumberOfBytesWritten=0x2207f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.813] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x1ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.813] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0167.813] CloseHandle (hObject=0x614) returned 1 [0167.882] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0167.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.play")) returned 1 [0168.215] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2137 os_tid = 0xd84 [0167.813] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.813] ReadFile (in: hFile=0x1334, lpBuffer=0x28defb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28def85c, lpOverlapped=0x0 | out: lpBuffer=0x28defb34*, lpNumberOfBytesRead=0x28def85c*=0x428, lpOverlapped=0x0) returned 1 [0167.815] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.815] ReadFile (in: hFile=0x1334, lpBuffer=0x28defb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28def85c, lpOverlapped=0x0 | out: lpBuffer=0x28defb34*, lpNumberOfBytesRead=0x28def85c*=0x428, lpOverlapped=0x0) returned 1 [0167.815] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1e0000 [0167.817] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1e0000) returned 0x0 [0167.817] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x28def57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0167.817] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x28def828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1e0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x28def828, pbKeyObject=0x0) returned 0x0 [0167.817] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1e0000, cbOutput=0x230, pcbResult=0x28def500, dwFlags=0x0 | out: pbOutput=0x1e0000, pcbResult=0x28def500) returned 0x0 [0167.817] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1e0230) returned 0x0 [0167.817] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1e0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1e0000, cbOutput=0x400, pcbResult=0x28def500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1e0000, pcbResult=0x28def500) returned 0x0 [0167.820] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.822] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.822] WriteFile (in: hFile=0x1334, lpBuffer=0x28defb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28def830, lpOverlapped=0x0 | out: lpBuffer=0x28defb34*, lpNumberOfBytesWritten=0x28def830*=0x428, lpOverlapped=0x0) returned 1 [0167.823] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.824] ReadFile (in: hFile=0x1334, lpBuffer=0x4250000, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x28def61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x28def61c*=0x2afa, lpOverlapped=0x0) returned 1 [0167.824] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xffffd506, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.824] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4250000, cbInput=0x2afa, pPaddingInfo=0x0, pbIV=0x28def848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x28def618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x28def848, pbOutput=0x4250000, pcbResult=0x28def618) returned 0x0 [0167.824] WriteFile (in: hFile=0x1334, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x28def61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x28def61c*=0x2b00, lpOverlapped=0x0) returned 1 [0167.824] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28def60c | out: lpNewFilePointer=0x0) returned 1 [0167.824] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.825] WriteFile (in: hFile=0x1334, lpBuffer=0x28def83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28def61c, lpOverlapped=0x0 | out: lpBuffer=0x28def83c*, lpNumberOfBytesWritten=0x28def61c*=0x8, lpOverlapped=0x0) returned 1 [0167.825] SetFilePointerEx (in: hFile=0x1334, liDistanceToMove=0x2b00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.825] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0167.825] CloseHandle (hObject=0x1334) returned 1 [0167.884] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0000 [0167.885] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.play")) returned 1 [0168.210] VirtualFree (lpAddress=0x1f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2138 os_tid = 0xd88 [0167.826] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.826] ReadFile (in: hFile=0x4b4, lpBuffer=0x28f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x28f3fb34*, lpNumberOfBytesRead=0x28f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.828] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.828] ReadFile (in: hFile=0x4b4, lpBuffer=0x28f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x28f3fb34*, lpNumberOfBytesRead=0x28f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.828] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1e0000 [0167.829] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1e0000) returned 0x0 [0167.830] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x28f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0167.830] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x28f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1e0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x28f3f828, pbKeyObject=0x0) returned 0x0 [0167.830] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1e0000, cbOutput=0x230, pcbResult=0x28f3f500, dwFlags=0x0 | out: pbOutput=0x1e0000, pcbResult=0x28f3f500) returned 0x0 [0167.830] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1e0230) returned 0x0 [0167.830] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1e0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1e0000, cbOutput=0x400, pcbResult=0x28f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1e0000, pcbResult=0x28f3f500) returned 0x0 [0167.833] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.835] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.835] WriteFile (in: hFile=0x4b4, lpBuffer=0x28f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28f3f830, lpOverlapped=0x0 | out: lpBuffer=0x28f3fb34*, lpNumberOfBytesWritten=0x28f3f830*=0x428, lpOverlapped=0x0) returned 1 [0167.836] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.836] ReadFile (in: hFile=0x4b4, lpBuffer=0x4550000, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x28f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x28f3f61c*=0x400c, lpOverlapped=0x0) returned 1 [0167.844] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xffffbff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.844] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4550000, cbInput=0x400c, pPaddingInfo=0x0, pbIV=0x28f3f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x28f3f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x28f3f848, pbOutput=0x4550000, pcbResult=0x28f3f618) returned 0x0 [0167.844] WriteFile (in: hFile=0x4b4, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x28f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x28f3f61c*=0x4010, lpOverlapped=0x0) returned 1 [0167.844] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28f3f60c | out: lpNewFilePointer=0x0) returned 1 [0167.844] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.844] WriteFile (in: hFile=0x4b4, lpBuffer=0x28f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x28f3f83c*, lpNumberOfBytesWritten=0x28f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.844] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x4010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.844] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0167.844] CloseHandle (hObject=0x4b4) returned 1 [0167.886] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0167.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.play")) returned 1 [0167.896] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2139 os_tid = 0xd94 [0167.845] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.845] ReadFile (in: hFile=0x1354, lpBuffer=0x2907fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2907f85c, lpOverlapped=0x0 | out: lpBuffer=0x2907fb34*, lpNumberOfBytesRead=0x2907f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.979] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.979] ReadFile (in: hFile=0x1354, lpBuffer=0x2907fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2907f85c, lpOverlapped=0x0 | out: lpBuffer=0x2907fb34*, lpNumberOfBytesRead=0x2907f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.979] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0167.981] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0167.981] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x2907f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0167.981] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x2907f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x2907f828, pbKeyObject=0x0) returned 0x0 [0167.981] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2907f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2907f500) returned 0x0 [0167.981] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0167.981] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2907f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2907f500) returned 0x0 [0167.984] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.986] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.986] WriteFile (in: hFile=0x1354, lpBuffer=0x2907fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2907f830, lpOverlapped=0x0 | out: lpBuffer=0x2907fb34*, lpNumberOfBytesWritten=0x2907f830*=0x428, lpOverlapped=0x0) returned 1 [0167.987] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.987] ReadFile (in: hFile=0x1354, lpBuffer=0x4650000, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x2907f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x2907f61c*=0x12bc, lpOverlapped=0x0) returned 1 [0167.987] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xffffed44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.987] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x4650000, cbInput=0x12bc, pPaddingInfo=0x0, pbIV=0x2907f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x2907f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2907f848, pbOutput=0x4650000, pcbResult=0x2907f618) returned 0x0 [0167.987] WriteFile (in: hFile=0x1354, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2907f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x2907f61c*=0x12c0, lpOverlapped=0x0) returned 1 [0167.987] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2907f60c | out: lpNewFilePointer=0x0) returned 1 [0167.987] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.987] WriteFile (in: hFile=0x1354, lpBuffer=0x2907f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2907f61c, lpOverlapped=0x0 | out: lpBuffer=0x2907f83c*, lpNumberOfBytesWritten=0x2907f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.988] SetFilePointerEx (in: hFile=0x1354, liDistanceToMove=0x12c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.988] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0167.988] CloseHandle (hObject=0x1354) returned 1 [0168.096] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x12b0000 [0168.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.play")) returned 1 [0168.237] VirtualFree (lpAddress=0x12b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2140 os_tid = 0x2004 [0167.847] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.847] ReadFile (in: hFile=0x36c, lpBuffer=0x291bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x291bf85c, lpOverlapped=0x0 | out: lpBuffer=0x291bfb34*, lpNumberOfBytesRead=0x291bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.848] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.848] ReadFile (in: hFile=0x36c, lpBuffer=0x291bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x291bf85c, lpOverlapped=0x0 | out: lpBuffer=0x291bfb34*, lpNumberOfBytesRead=0x291bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.848] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1e0000 [0167.851] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1e0000) returned 0x0 [0167.851] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x291bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0167.851] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x291bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1e0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x291bf828, pbKeyObject=0x0) returned 0x0 [0167.851] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1e0000, cbOutput=0x230, pcbResult=0x291bf500, dwFlags=0x0 | out: pbOutput=0x1e0000, pcbResult=0x291bf500) returned 0x0 [0167.851] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1e0230) returned 0x0 [0167.851] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1e0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1e0000, cbOutput=0x400, pcbResult=0x291bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1e0000, pcbResult=0x291bf500) returned 0x0 [0167.855] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.857] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.857] WriteFile (in: hFile=0x36c, lpBuffer=0x291bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x291bf830, lpOverlapped=0x0 | out: lpBuffer=0x291bfb34*, lpNumberOfBytesWritten=0x291bf830*=0x428, lpOverlapped=0x0) returned 1 [0167.858] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.858] ReadFile (in: hFile=0x36c, lpBuffer=0x4750000, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x291bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x291bf61c*=0x83c, lpOverlapped=0x0) returned 1 [0167.858] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffff7c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.858] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4750000, cbInput=0x83c, pPaddingInfo=0x0, pbIV=0x291bf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x291bf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x291bf848, pbOutput=0x4750000, pcbResult=0x291bf618) returned 0x0 [0167.858] WriteFile (in: hFile=0x36c, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x291bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x291bf61c*=0x840, lpOverlapped=0x0) returned 1 [0167.858] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x291bf60c | out: lpNewFilePointer=0x0) returned 1 [0167.858] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.858] WriteFile (in: hFile=0x36c, lpBuffer=0x291bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x291bf61c, lpOverlapped=0x0 | out: lpBuffer=0x291bf83c*, lpNumberOfBytesWritten=0x291bf61c*=0x8, lpOverlapped=0x0) returned 1 [0167.858] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x840, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.858] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0167.858] CloseHandle (hObject=0x36c) returned 1 [0167.888] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0167.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.play")) returned 1 [0167.892] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2141 os_tid = 0x2008 [0167.859] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.859] ReadFile (in: hFile=0x1110, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.860] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.861] ReadFile (in: hFile=0x1110, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1e0000 [0167.862] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1e0000) returned 0x0 [0167.862] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0xf70f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0167.862] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0xf70f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1e0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0xf70f828, pbKeyObject=0x0) returned 0x0 [0167.862] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1e0000, cbOutput=0x230, pcbResult=0xf70f500, dwFlags=0x0 | out: pbOutput=0x1e0000, pcbResult=0xf70f500) returned 0x0 [0167.863] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1e0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1e0230) returned 0x0 [0167.863] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1e0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1e0000, cbOutput=0x400, pcbResult=0xf70f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1e0000, pcbResult=0xf70f500) returned 0x0 [0167.866] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.868] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.868] WriteFile (in: hFile=0x1110, lpBuffer=0xf70fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf70f830, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesWritten=0xf70f830*=0x428, lpOverlapped=0x0) returned 1 [0167.869] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.869] ReadFile (in: hFile=0x1110, lpBuffer=0x4850000, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0xf70f61c*=0x13ea, lpOverlapped=0x0) returned 1 [0167.869] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xffffec16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.869] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4850000, cbInput=0x13ea, pPaddingInfo=0x0, pbIV=0xf70f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0xf70f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0xf70f848, pbOutput=0x4850000, pcbResult=0xf70f618) returned 0x0 [0167.869] WriteFile (in: hFile=0x1110, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0xf70f61c*=0x13f0, lpOverlapped=0x0) returned 1 [0167.869] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf70f60c | out: lpNewFilePointer=0x0) returned 1 [0167.869] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.869] WriteFile (in: hFile=0x1110, lpBuffer=0xf70f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0xf70f83c*, lpNumberOfBytesWritten=0xf70f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.869] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x13f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.870] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0167.870] CloseHandle (hObject=0x1110) returned 1 [0167.898] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0167.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.play")) returned 1 [0167.901] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2142 os_tid = 0x200c [0167.916] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.916] ReadFile (in: hFile=0x13b4, lpBuffer=0x292ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x292ff85c, lpOverlapped=0x0 | out: lpBuffer=0x292ffb34*, lpNumberOfBytesRead=0x292ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.918] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.918] ReadFile (in: hFile=0x13b4, lpBuffer=0x292ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x292ff85c, lpOverlapped=0x0 | out: lpBuffer=0x292ffb34*, lpNumberOfBytesRead=0x292ff85c*=0x428, lpOverlapped=0x0) returned 1 [0167.918] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0167.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0167.921] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x292ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0167.921] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x292ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x292ff828, pbKeyObject=0x0) returned 0x0 [0167.921] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x292ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x292ff500) returned 0x0 [0167.921] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0167.921] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x292ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x292ff500) returned 0x0 [0167.924] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.927] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x13b4, lpBuffer=0x292ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x292ff830, lpOverlapped=0x0 | out: lpBuffer=0x292ffb34*, lpNumberOfBytesWritten=0x292ff830*=0x428, lpOverlapped=0x0) returned 1 [0167.928] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.928] ReadFile (in: hFile=0x13b4, lpBuffer=0x3150000, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x292ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x292ff61c*=0x22de, lpOverlapped=0x0) returned 1 [0167.929] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xffffdd22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.929] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3150000, cbInput=0x22de, pPaddingInfo=0x0, pbIV=0x292ff848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x292ff618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x292ff848, pbOutput=0x3150000, pcbResult=0x292ff618) returned 0x0 [0167.929] WriteFile (in: hFile=0x13b4, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x292ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x292ff61c*=0x22e0, lpOverlapped=0x0) returned 1 [0167.930] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292ff60c | out: lpNewFilePointer=0x0) returned 1 [0167.930] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.930] WriteFile (in: hFile=0x13b4, lpBuffer=0x292ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x292ff61c, lpOverlapped=0x0 | out: lpBuffer=0x292ff83c*, lpNumberOfBytesWritten=0x292ff61c*=0x8, lpOverlapped=0x0) returned 1 [0167.930] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x22e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.930] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0167.930] CloseHandle (hObject=0x13b4) returned 1 [0168.088] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0168.090] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.play")) returned 1 [0168.225] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2143 os_tid = 0x2010 [0167.930] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.931] ReadFile (in: hFile=0x13d4, lpBuffer=0x2943fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2943f85c, lpOverlapped=0x0 | out: lpBuffer=0x2943fb34*, lpNumberOfBytesRead=0x2943f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.932] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.932] ReadFile (in: hFile=0x13d4, lpBuffer=0x2943fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2943f85c, lpOverlapped=0x0 | out: lpBuffer=0x2943fb34*, lpNumberOfBytesRead=0x2943f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.932] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0167.934] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0167.934] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x2943f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0167.934] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x2943f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x2943f828, pbKeyObject=0x0) returned 0x0 [0167.935] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2943f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2943f500) returned 0x0 [0167.935] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0167.935] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2943f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2943f500) returned 0x0 [0167.938] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.940] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.941] WriteFile (in: hFile=0x13d4, lpBuffer=0x2943fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2943f830, lpOverlapped=0x0 | out: lpBuffer=0x2943fb34*, lpNumberOfBytesWritten=0x2943f830*=0x428, lpOverlapped=0x0) returned 1 [0167.941] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.941] ReadFile (in: hFile=0x13d4, lpBuffer=0x4950000, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x2943f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x2943f61c*=0x43fe, lpOverlapped=0x0) returned 1 [0167.942] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xffffbc02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.942] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4950000, cbInput=0x43fe, pPaddingInfo=0x0, pbIV=0x2943f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x2943f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2943f848, pbOutput=0x4950000, pcbResult=0x2943f618) returned 0x0 [0167.942] WriteFile (in: hFile=0x13d4, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2943f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x2943f61c*=0x4400, lpOverlapped=0x0) returned 1 [0167.942] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2943f60c | out: lpNewFilePointer=0x0) returned 1 [0167.942] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.942] WriteFile (in: hFile=0x13d4, lpBuffer=0x2943f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2943f61c, lpOverlapped=0x0 | out: lpBuffer=0x2943f83c*, lpNumberOfBytesWritten=0x2943f61c*=0x8, lpOverlapped=0x0) returned 1 [0167.942] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x4400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.943] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0167.943] CloseHandle (hObject=0x13d4) returned 1 [0168.091] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0168.092] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.play")) returned 1 [0168.228] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2144 os_tid = 0x2014 [0167.943] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.943] ReadFile (in: hFile=0x1380, lpBuffer=0x2957fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2957f85c, lpOverlapped=0x0 | out: lpBuffer=0x2957fb34*, lpNumberOfBytesRead=0x2957f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.051] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0168.054] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0168.054] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x2957f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0168.054] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x2957f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x2957f828, pbKeyObject=0x0) returned 0x0 [0168.054] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2957f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2957f500) returned 0x0 [0168.055] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0168.055] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2957f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2957f500) returned 0x0 [0168.059] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.061] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.062] WriteFile (in: hFile=0x1380, lpBuffer=0x2957fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2957f830, lpOverlapped=0x0 | out: lpBuffer=0x2957fb34*, lpNumberOfBytesWritten=0x2957f830*=0x428, lpOverlapped=0x0) returned 1 [0168.062] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.062] ReadFile (in: hFile=0x1380, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2957f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x2957f61c*=0x5c0, lpOverlapped=0x0) returned 1 [0168.062] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffffa40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.062] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x4a50000, cbInput=0x5c0, pPaddingInfo=0x0, pbIV=0x2957f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x2957f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x2957f848, pbOutput=0x4a50000, pcbResult=0x2957f618) returned 0x0 [0168.062] WriteFile (in: hFile=0x1380, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2957f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x2957f61c*=0x5d0, lpOverlapped=0x0) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2957f60c | out: lpNewFilePointer=0x0) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.063] WriteFile (in: hFile=0x1380, lpBuffer=0x2957f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2957f61c, lpOverlapped=0x0 | out: lpBuffer=0x2957f83c*, lpNumberOfBytesWritten=0x2957f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x1380, liDistanceToMove=0x5d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.063] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0168.063] CloseHandle (hObject=0x1380) returned 1 [0168.100] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x12d0000 [0168.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.play")) returned 1 [0168.104] VirtualFree (lpAddress=0x12d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2145 os_tid = 0x2018 [0167.945] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.945] ReadFile (in: hFile=0x1440, lpBuffer=0x296bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x296bf85c, lpOverlapped=0x0 | out: lpBuffer=0x296bfb34*, lpNumberOfBytesRead=0x296bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.946] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.946] ReadFile (in: hFile=0x1440, lpBuffer=0x296bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x296bf85c, lpOverlapped=0x0 | out: lpBuffer=0x296bfb34*, lpNumberOfBytesRead=0x296bf85c*=0x428, lpOverlapped=0x0) returned 1 [0167.947] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0167.949] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0167.949] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x296bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0167.949] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x296bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x296bf828, pbKeyObject=0x0) returned 0x0 [0167.949] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x296bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x296bf500) returned 0x0 [0167.949] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0167.949] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x296bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x296bf500) returned 0x0 [0167.953] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.955] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.955] WriteFile (in: hFile=0x1440, lpBuffer=0x296bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x296bf830, lpOverlapped=0x0 | out: lpBuffer=0x296bfb34*, lpNumberOfBytesWritten=0x296bf830*=0x428, lpOverlapped=0x0) returned 1 [0167.956] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.956] ReadFile (in: hFile=0x1440, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x296bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x296bf61c*=0x148c, lpOverlapped=0x0) returned 1 [0167.956] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xffffeb74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.956] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4b50000, cbInput=0x148c, pPaddingInfo=0x0, pbIV=0x296bf848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x296bf618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x296bf848, pbOutput=0x4b50000, pcbResult=0x296bf618) returned 0x0 [0167.956] WriteFile (in: hFile=0x1440, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x296bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x296bf61c*=0x1490, lpOverlapped=0x0) returned 1 [0167.956] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296bf60c | out: lpNewFilePointer=0x0) returned 1 [0167.956] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.956] WriteFile (in: hFile=0x1440, lpBuffer=0x296bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x296bf61c, lpOverlapped=0x0 | out: lpBuffer=0x296bf83c*, lpNumberOfBytesWritten=0x296bf61c*=0x8, lpOverlapped=0x0) returned 1 [0167.956] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x1490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.956] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0167.956] CloseHandle (hObject=0x1440) returned 1 [0168.093] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0168.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.play")) returned 1 [0168.231] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2146 os_tid = 0x201c [0167.957] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0167.958] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0167.958] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x297ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0167.958] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x297ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x297ff828, pbKeyObject=0x0) returned 0x0 [0167.958] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x297ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x297ff500) returned 0x0 [0167.959] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0167.959] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x297ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x297ff500) returned 0x0 [0167.962] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.964] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.964] WriteFile (in: hFile=0x1458, lpBuffer=0x297ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x297ff830, lpOverlapped=0x0 | out: lpBuffer=0x297ffb34*, lpNumberOfBytesWritten=0x297ff830*=0x428, lpOverlapped=0x0) returned 1 [0167.966] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.966] ReadFile (in: hFile=0x1458, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x297ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x297ff61c*=0x380, lpOverlapped=0x0) returned 1 [0167.966] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffc80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.966] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4c50000, cbInput=0x380, pPaddingInfo=0x0, pbIV=0x297ff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x297ff618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x297ff848, pbOutput=0x4c50000, pcbResult=0x297ff618) returned 0x0 [0167.966] WriteFile (in: hFile=0x1458, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x297ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x297ff61c*=0x390, lpOverlapped=0x0) returned 1 [0167.967] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x297ff60c | out: lpNewFilePointer=0x0) returned 1 [0167.967] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.967] WriteFile (in: hFile=0x1458, lpBuffer=0x297ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x297ff61c, lpOverlapped=0x0 | out: lpBuffer=0x297ff83c*, lpNumberOfBytesWritten=0x297ff61c*=0x8, lpOverlapped=0x0) returned 1 [0167.967] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.967] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0167.967] CloseHandle (hObject=0x1458) returned 1 [0168.095] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x12a0000 [0168.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.play")) returned 1 [0168.234] VirtualFree (lpAddress=0x12a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2147 os_tid = 0x2020 [0167.967] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0167.969] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0167.969] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x2993f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0167.969] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x2993f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x2993f828, pbKeyObject=0x0) returned 0x0 [0167.969] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2993f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2993f500) returned 0x0 [0167.969] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0167.970] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2993f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2993f500) returned 0x0 [0167.973] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.975] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x13bc, lpBuffer=0x2993fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2993f830, lpOverlapped=0x0 | out: lpBuffer=0x2993fb34*, lpNumberOfBytesWritten=0x2993f830*=0x428, lpOverlapped=0x0) returned 1 [0168.050] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.050] ReadFile (in: hFile=0x13bc, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x2993f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x2993f61c*=0x2f0, lpOverlapped=0x0) returned 1 [0168.050] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffd10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.050] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x4d50000, cbInput=0x2f0, pPaddingInfo=0x0, pbIV=0x2993f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x2993f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2993f848, pbOutput=0x4d50000, pcbResult=0x2993f618) returned 0x0 [0168.051] WriteFile (in: hFile=0x13bc, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2993f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x2993f61c*=0x300, lpOverlapped=0x0) returned 1 [0168.051] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2993f60c | out: lpNewFilePointer=0x0) returned 1 [0168.051] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.051] WriteFile (in: hFile=0x13bc, lpBuffer=0x2993f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2993f61c, lpOverlapped=0x0 | out: lpBuffer=0x2993f83c*, lpNumberOfBytesWritten=0x2993f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.051] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.051] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0168.051] CloseHandle (hObject=0x13bc) returned 1 [0168.098] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x12c0000 [0168.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.play")) returned 1 [0168.243] VirtualFree (lpAddress=0x12c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2148 os_tid = 0x2024 [0167.976] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.976] ReadFile (in: hFile=0x13ec, lpBuffer=0x29a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a7fb34*, lpNumberOfBytesRead=0x29a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.988] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.988] ReadFile (in: hFile=0x13ec, lpBuffer=0x29a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a7fb34*, lpNumberOfBytesRead=0x29a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0167.988] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0167.990] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0167.990] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x29a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0167.990] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x29a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x29a7f828, pbKeyObject=0x0) returned 0x0 [0167.990] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29a7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29a7f500) returned 0x0 [0167.990] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0167.990] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29a7f500) returned 0x0 [0167.993] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.995] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.048] WriteFile (in: hFile=0x13ec, lpBuffer=0x29a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29a7f830, lpOverlapped=0x0 | out: lpBuffer=0x29a7fb34*, lpNumberOfBytesWritten=0x29a7f830*=0x428, lpOverlapped=0x0) returned 1 [0168.049] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.049] ReadFile (in: hFile=0x13ec, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x29a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x29a7f61c*=0x2b90, lpOverlapped=0x0) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xffffd470, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.063] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4e50000, cbInput=0x2b90, pPaddingInfo=0x0, pbIV=0x29a7f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x29a7f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x29a7f848, pbOutput=0x4e50000, pcbResult=0x29a7f618) returned 0x0 [0168.063] WriteFile (in: hFile=0x13ec, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x29a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x29a7f61c*=0x2ba0, lpOverlapped=0x0) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29a7f60c | out: lpNewFilePointer=0x0) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.063] WriteFile (in: hFile=0x13ec, lpBuffer=0x29a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x29a7f83c*, lpNumberOfBytesWritten=0x29a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.064] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x2ba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.064] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.064] CloseHandle (hObject=0x13ec) returned 1 [0168.110] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x12d0000 [0168.113] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.play")) returned 1 [0168.114] VirtualFree (lpAddress=0x12d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2149 os_tid = 0x2028 [0167.978] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.978] ReadFile (in: hFile=0x10c0, lpBuffer=0x29bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x29bbfb34*, lpNumberOfBytesRead=0x29bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.119] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.119] ReadFile (in: hFile=0x10c0, lpBuffer=0x29bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x29bbfb34*, lpNumberOfBytesRead=0x29bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.119] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x12d0000 [0168.121] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x12d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x12d0000) returned 0x0 [0168.121] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x29bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0168.121] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x29bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x12d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x29bbf828, pbKeyObject=0x0) returned 0x0 [0168.121] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x12d0000, cbOutput=0x230, pcbResult=0x29bbf500, dwFlags=0x0 | out: pbOutput=0x12d0000, pcbResult=0x29bbf500) returned 0x0 [0168.121] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x12d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x12d0230) returned 0x0 [0168.121] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x12d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x12d0000, cbOutput=0x400, pcbResult=0x29bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x12d0000, pcbResult=0x29bbf500) returned 0x0 [0168.125] VirtualFree (lpAddress=0x12d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.127] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.127] WriteFile (in: hFile=0x10c0, lpBuffer=0x29bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29bbf830, lpOverlapped=0x0 | out: lpBuffer=0x29bbfb34*, lpNumberOfBytesWritten=0x29bbf830*=0x428, lpOverlapped=0x0) returned 1 [0168.128] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.128] ReadFile (in: hFile=0x10c0, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x29bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x29bbf61c*=0x2332, lpOverlapped=0x0) returned 1 [0168.132] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xffffdcce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.132] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4f50000, cbInput=0x2332, pPaddingInfo=0x0, pbIV=0x29bbf848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x29bbf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x29bbf848, pbOutput=0x4f50000, pcbResult=0x29bbf618) returned 0x0 [0168.132] WriteFile (in: hFile=0x10c0, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x29bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x29bbf61c*=0x2340, lpOverlapped=0x0) returned 1 [0168.132] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29bbf60c | out: lpNewFilePointer=0x0) returned 1 [0168.132] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.132] WriteFile (in: hFile=0x10c0, lpBuffer=0x29bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x29bbf83c*, lpNumberOfBytesWritten=0x29bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0168.132] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x2340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.132] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0168.132] CloseHandle (hObject=0x10c0) returned 1 [0168.132] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb090000 [0168.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.play")) returned 1 [0168.150] VirtualFree (lpAddress=0xb090000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2150 os_tid = 0x202c [0168.065] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.065] ReadFile (in: hFile=0x200, lpBuffer=0x29cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29cff85c, lpOverlapped=0x0 | out: lpBuffer=0x29cffb34*, lpNumberOfBytesRead=0x29cff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.068] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.068] ReadFile (in: hFile=0x200, lpBuffer=0x29cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29cff85c, lpOverlapped=0x0 | out: lpBuffer=0x29cffb34*, lpNumberOfBytesRead=0x29cff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.068] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0168.070] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0168.070] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x29cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0168.070] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x29cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x29cff828, pbKeyObject=0x0) returned 0x0 [0168.070] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29cff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29cff500) returned 0x0 [0168.071] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0168.071] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29cff500) returned 0x0 [0168.075] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.077] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.077] WriteFile (in: hFile=0x200, lpBuffer=0x29cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29cff830, lpOverlapped=0x0 | out: lpBuffer=0x29cffb34*, lpNumberOfBytesWritten=0x29cff830*=0x428, lpOverlapped=0x0) returned 1 [0168.078] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.078] ReadFile (in: hFile=0x200, lpBuffer=0x5050000, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x29cff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x29cff61c*=0x3690, lpOverlapped=0x0) returned 1 [0168.128] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xffffc970, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.128] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5050000, cbInput=0x3690, pPaddingInfo=0x0, pbIV=0x29cff848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x29cff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x29cff848, pbOutput=0x5050000, pcbResult=0x29cff618) returned 0x0 [0168.128] WriteFile (in: hFile=0x200, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x29cff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x29cff61c*=0x36a0, lpOverlapped=0x0) returned 1 [0168.128] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29cff60c | out: lpNewFilePointer=0x0) returned 1 [0168.128] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.129] WriteFile (in: hFile=0x200, lpBuffer=0x29cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29cff61c, lpOverlapped=0x0 | out: lpBuffer=0x29cff83c*, lpNumberOfBytesWritten=0x29cff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.129] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x36a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.129] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.129] CloseHandle (hObject=0x200) returned 1 [0168.129] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x12d0000 [0168.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.play")) returned 1 [0168.144] VirtualFree (lpAddress=0x12d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2151 os_tid = 0x2030 [0168.254] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.254] ReadFile (in: hFile=0xa34, lpBuffer=0xb24fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb24f85c, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesRead=0xb24f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.290] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.290] ReadFile (in: hFile=0xa34, lpBuffer=0xb24fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb24f85c, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesRead=0xb24f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.317] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.319] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.319] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0xb24f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0168.319] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0xb24f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0xb24f828, pbKeyObject=0x0) returned 0x0 [0168.319] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0xb24f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0xb24f500) returned 0x0 [0168.319] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.319] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0xb24f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0xb24f500) returned 0x0 [0168.323] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.325] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.325] WriteFile (in: hFile=0xa34, lpBuffer=0xb24fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb24f830, lpOverlapped=0x0 | out: lpBuffer=0xb24fb34*, lpNumberOfBytesWritten=0xb24f830*=0x428, lpOverlapped=0x0) returned 1 [0168.325] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.325] ReadFile (in: hFile=0xa34, lpBuffer=0x5150000, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0xb24f61c*=0xa6d0, lpOverlapped=0x0) returned 1 [0168.365] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xffff5930, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.365] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x5150000, cbInput=0xa6d0, pPaddingInfo=0x0, pbIV=0xb24f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0xb24f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0xb24f848, pbOutput=0x5150000, pcbResult=0xb24f618) returned 0x0 [0168.365] WriteFile (in: hFile=0xa34, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0xb24f61c*=0xa6e0, lpOverlapped=0x0) returned 1 [0168.366] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb24f60c | out: lpNewFilePointer=0x0) returned 1 [0168.366] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.366] WriteFile (in: hFile=0xa34, lpBuffer=0xb24f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb24f61c, lpOverlapped=0x0 | out: lpBuffer=0xb24f83c*, lpNumberOfBytesWritten=0xb24f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.366] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xa6e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.366] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0168.366] CloseHandle (hObject=0xa34) returned 1 [0168.366] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.play")) returned 1 [0168.368] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2152 os_tid = 0x2034 [0168.255] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.255] ReadFile (in: hFile=0x8a4, lpBuffer=0xb5cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb5cf85c, lpOverlapped=0x0 | out: lpBuffer=0xb5cfb34*, lpNumberOfBytesRead=0xb5cf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.290] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.290] ReadFile (in: hFile=0x8a4, lpBuffer=0xb5cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb5cf85c, lpOverlapped=0x0 | out: lpBuffer=0xb5cfb34*, lpNumberOfBytesRead=0xb5cf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.290] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.292] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.292] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xb5cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0168.292] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xb5cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xb5cf828, pbKeyObject=0x0) returned 0x0 [0168.309] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0xb5cf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0xb5cf500) returned 0x0 [0168.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.309] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0xb5cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0xb5cf500) returned 0x0 [0168.313] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.316] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.316] WriteFile (in: hFile=0x8a4, lpBuffer=0xb5cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb5cf830, lpOverlapped=0x0 | out: lpBuffer=0xb5cfb34*, lpNumberOfBytesWritten=0xb5cf830*=0x428, lpOverlapped=0x0) returned 1 [0168.317] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.317] ReadFile (in: hFile=0x8a4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0xb5cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xb5cf61c*=0x3b3c, lpOverlapped=0x0) returned 1 [0168.358] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xffffc4c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.358] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2750000, cbInput=0x3b3c, pPaddingInfo=0x0, pbIV=0xb5cf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xb5cf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xb5cf848, pbOutput=0x2750000, pcbResult=0xb5cf618) returned 0x0 [0168.359] WriteFile (in: hFile=0x8a4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0xb5cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xb5cf61c*=0x3b40, lpOverlapped=0x0) returned 1 [0168.359] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb5cf60c | out: lpNewFilePointer=0x0) returned 1 [0168.359] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.359] WriteFile (in: hFile=0x8a4, lpBuffer=0xb5cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb5cf61c, lpOverlapped=0x0 | out: lpBuffer=0xb5cf83c*, lpNumberOfBytesWritten=0xb5cf61c*=0x8, lpOverlapped=0x0) returned 1 [0168.359] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x3b40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.359] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.359] CloseHandle (hObject=0x8a4) returned 1 [0168.359] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.play")) returned 1 [0168.362] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2153 os_tid = 0x2038 [0168.257] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.257] ReadFile (in: hFile=0x1548, lpBuffer=0xfccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfccf85c, lpOverlapped=0x0 | out: lpBuffer=0xfccfb34*, lpNumberOfBytesRead=0xfccf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.258] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.258] ReadFile (in: hFile=0x1548, lpBuffer=0xfccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfccf85c, lpOverlapped=0x0 | out: lpBuffer=0xfccfb34*, lpNumberOfBytesRead=0xfccf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.258] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.261] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xfccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0168.261] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xfccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xfccf828, pbKeyObject=0x0) returned 0x0 [0168.261] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0xfccf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0xfccf500) returned 0x0 [0168.261] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.262] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0xfccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0xfccf500) returned 0x0 [0168.265] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.267] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.267] WriteFile (in: hFile=0x1548, lpBuffer=0xfccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfccf830, lpOverlapped=0x0 | out: lpBuffer=0xfccfb34*, lpNumberOfBytesWritten=0xfccf830*=0x428, lpOverlapped=0x0) returned 1 [0168.268] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.268] ReadFile (in: hFile=0x1548, lpBuffer=0x2950000, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0xfccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xfccf61c*=0x121a, lpOverlapped=0x0) returned 1 [0168.268] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xffffede6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.268] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2950000, cbInput=0x121a, pPaddingInfo=0x0, pbIV=0xfccf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xfccf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0xfccf848, pbOutput=0x2950000, pcbResult=0xfccf618) returned 0x0 [0168.268] WriteFile (in: hFile=0x1548, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0xfccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xfccf61c*=0x1220, lpOverlapped=0x0) returned 1 [0168.268] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfccf60c | out: lpNewFilePointer=0x0) returned 1 [0168.268] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.268] WriteFile (in: hFile=0x1548, lpBuffer=0xfccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfccf61c, lpOverlapped=0x0 | out: lpBuffer=0xfccf83c*, lpNumberOfBytesWritten=0xfccf61c*=0x8, lpOverlapped=0x0) returned 1 [0168.268] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x1220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.268] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.268] CloseHandle (hObject=0x1548) returned 1 [0168.268] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.play")) returned 1 [0168.271] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2154 os_tid = 0x203c [0168.274] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.274] ReadFile (in: hFile=0x10e8, lpBuffer=0x11d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x11d4fb34*, lpNumberOfBytesRead=0x11d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.276] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.276] ReadFile (in: hFile=0x10e8, lpBuffer=0x11d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x11d4fb34*, lpNumberOfBytesRead=0x11d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.276] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.278] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.278] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x11d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0168.278] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x11d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x11d4f828, pbKeyObject=0x0) returned 0x0 [0168.278] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x11d4f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x11d4f500) returned 0x0 [0168.279] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.279] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x11d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x11d4f500) returned 0x0 [0168.282] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.284] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.284] WriteFile (in: hFile=0x10e8, lpBuffer=0x11d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11d4f830, lpOverlapped=0x0 | out: lpBuffer=0x11d4fb34*, lpNumberOfBytesWritten=0x11d4f830*=0x428, lpOverlapped=0x0) returned 1 [0168.284] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.284] ReadFile (in: hFile=0x10e8, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x11d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x11d4f61c*=0x96c, lpOverlapped=0x0) returned 1 [0168.284] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffff694, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.284] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x2c50000, cbInput=0x96c, pPaddingInfo=0x0, pbIV=0x11d4f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x11d4f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x11d4f848, pbOutput=0x2c50000, pcbResult=0x11d4f618) returned 0x0 [0168.284] WriteFile (in: hFile=0x10e8, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x11d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x11d4f61c*=0x970, lpOverlapped=0x0) returned 1 [0168.285] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11d4f60c | out: lpNewFilePointer=0x0) returned 1 [0168.285] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.285] WriteFile (in: hFile=0x10e8, lpBuffer=0x11d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x11d4f83c*, lpNumberOfBytesWritten=0x11d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.285] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.285] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.285] CloseHandle (hObject=0x10e8) returned 1 [0168.285] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.play")) returned 1 [0168.287] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2155 os_tid = 0x2040 [0168.326] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.326] ReadFile (in: hFile=0x1574, lpBuffer=0x215bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215bf85c, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesRead=0x215bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.328] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.328] ReadFile (in: hFile=0x1574, lpBuffer=0x215bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215bf85c, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesRead=0x215bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.328] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.330] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.330] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x215bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0168.330] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x215bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x215bf828, pbKeyObject=0x0) returned 0x0 [0168.330] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x215bf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x215bf500) returned 0x0 [0168.330] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.330] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x215bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x215bf500) returned 0x0 [0168.333] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.335] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.335] WriteFile (in: hFile=0x1574, lpBuffer=0x215bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x215bf830, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesWritten=0x215bf830*=0x428, lpOverlapped=0x0) returned 1 [0168.336] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.336] ReadFile (in: hFile=0x1574, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x215bf61c*=0x1378, lpOverlapped=0x0) returned 1 [0168.336] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xffffec88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.336] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x2f50000, cbInput=0x1378, pPaddingInfo=0x0, pbIV=0x215bf848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x215bf618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x215bf848, pbOutput=0x2f50000, pcbResult=0x215bf618) returned 0x0 [0168.336] WriteFile (in: hFile=0x1574, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x215bf61c*=0x1380, lpOverlapped=0x0) returned 1 [0168.336] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x215bf60c | out: lpNewFilePointer=0x0) returned 1 [0168.336] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.336] WriteFile (in: hFile=0x1574, lpBuffer=0x215bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x215bf83c*, lpNumberOfBytesWritten=0x215bf61c*=0x8, lpOverlapped=0x0) returned 1 [0168.337] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x1380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.337] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0168.337] CloseHandle (hObject=0x1574) returned 1 [0168.337] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.play")) returned 1 [0168.339] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2156 os_tid = 0x2044 [0168.342] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.342] ReadFile (in: hFile=0x157c, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.343] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.343] ReadFile (in: hFile=0x157c, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.343] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.345] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.345] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x216bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0168.345] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x216bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x216bf828, pbKeyObject=0x0) returned 0x0 [0168.345] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x216bf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x216bf500) returned 0x0 [0168.345] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.345] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x216bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x216bf500) returned 0x0 [0168.349] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.350] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.351] WriteFile (in: hFile=0x157c, lpBuffer=0x216bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x216bf830, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesWritten=0x216bf830*=0x428, lpOverlapped=0x0) returned 1 [0168.351] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.351] ReadFile (in: hFile=0x157c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x216bf61c*=0xf7c, lpOverlapped=0x0) returned 1 [0168.351] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0xfffff084, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.351] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3a50000, cbInput=0xf7c, pPaddingInfo=0x0, pbIV=0x216bf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x216bf618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x216bf848, pbOutput=0x3a50000, pcbResult=0x216bf618) returned 0x0 [0168.351] WriteFile (in: hFile=0x157c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x216bf61c*=0xf80, lpOverlapped=0x0) returned 1 [0168.352] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x216bf60c | out: lpNewFilePointer=0x0) returned 1 [0168.352] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.352] WriteFile (in: hFile=0x157c, lpBuffer=0x216bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x216bf83c*, lpNumberOfBytesWritten=0x216bf61c*=0x8, lpOverlapped=0x0) returned 1 [0168.352] SetFilePointerEx (in: hFile=0x157c, liDistanceToMove=0xf80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.352] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0168.352] CloseHandle (hObject=0x157c) returned 1 [0168.352] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.play")) returned 1 [0168.355] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2157 os_tid = 0x2048 [0168.371] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.371] ReadFile (in: hFile=0x1584, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.373] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.374] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.374] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0168.374] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0168.375] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x219ff500) returned 0x0 [0168.375] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.375] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x219ff500) returned 0x0 [0168.378] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.380] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.380] WriteFile (in: hFile=0x1584, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0168.381] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.381] ReadFile (in: hFile=0x1584, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x219ff61c*=0x488, lpOverlapped=0x0) returned 1 [0168.381] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xfffffb78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.381] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3b50000, cbInput=0x488, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x219ff848, pbOutput=0x3b50000, pcbResult=0x219ff618) returned 0x0 [0168.381] WriteFile (in: hFile=0x1584, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x219ff61c*=0x490, lpOverlapped=0x0) returned 1 [0168.381] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0168.381] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.381] WriteFile (in: hFile=0x1584, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.381] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.381] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.381] CloseHandle (hObject=0x1584) returned 1 [0168.381] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.play")) returned 1 [0168.384] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2158 os_tid = 0x204c [0168.387] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.387] ReadFile (in: hFile=0x158c, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.428] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.428] ReadFile (in: hFile=0x158c, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.428] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.430] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.430] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x21d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0168.430] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x21d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x21d3f828, pbKeyObject=0x0) returned 0x0 [0168.430] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x21d3f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x21d3f500) returned 0x0 [0168.430] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.430] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x21d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x21d3f500) returned 0x0 [0168.434] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.437] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.437] WriteFile (in: hFile=0x158c, lpBuffer=0x21d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d3f830, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesWritten=0x21d3f830*=0x428, lpOverlapped=0x0) returned 1 [0168.437] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.437] ReadFile (in: hFile=0x158c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x21d3f61c*=0x91c, lpOverlapped=0x0) returned 1 [0168.437] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0xfffff6e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.438] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x3e50000, cbInput=0x91c, pPaddingInfo=0x0, pbIV=0x21d3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x21d3f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0x21d3f848, pbOutput=0x3e50000, pcbResult=0x21d3f618) returned 0x0 [0168.438] WriteFile (in: hFile=0x158c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x21d3f61c*=0x920, lpOverlapped=0x0) returned 1 [0168.438] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d3f60c | out: lpNewFilePointer=0x0) returned 1 [0168.438] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.438] WriteFile (in: hFile=0x158c, lpBuffer=0x21d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d3f83c*, lpNumberOfBytesWritten=0x21d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.438] SetFilePointerEx (in: hFile=0x158c, liDistanceToMove=0x920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.438] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0168.438] CloseHandle (hObject=0x158c) returned 1 [0168.438] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.play")) returned 1 [0168.441] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2159 os_tid = 0x2050 [0168.388] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.388] ReadFile (in: hFile=0x1594, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.420] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.420] ReadFile (in: hFile=0x1594, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.420] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.421] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.422] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x230ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0168.422] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x230ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x230ff828, pbKeyObject=0x0) returned 0x0 [0168.422] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x230ff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x230ff500) returned 0x0 [0168.422] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.422] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x230ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x230ff500) returned 0x0 [0168.425] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.427] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.427] WriteFile (in: hFile=0x1594, lpBuffer=0x230ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x230ff830, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesWritten=0x230ff830*=0x428, lpOverlapped=0x0) returned 1 [0168.428] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.428] ReadFile (in: hFile=0x1594, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x230ff61c*=0x284c, lpOverlapped=0x0) returned 1 [0168.459] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0xffffd7b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.459] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x3f50000, cbInput=0x284c, pPaddingInfo=0x0, pbIV=0x230ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x230ff618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x230ff848, pbOutput=0x3f50000, pcbResult=0x230ff618) returned 0x0 [0168.459] WriteFile (in: hFile=0x1594, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x230ff61c*=0x2850, lpOverlapped=0x0) returned 1 [0168.459] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230ff60c | out: lpNewFilePointer=0x0) returned 1 [0168.459] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.459] WriteFile (in: hFile=0x1594, lpBuffer=0x230ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x230ff83c*, lpNumberOfBytesWritten=0x230ff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.459] SetFilePointerEx (in: hFile=0x1594, liDistanceToMove=0x2850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.459] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0168.459] CloseHandle (hObject=0x1594) returned 1 [0168.459] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.play")) returned 1 [0168.465] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2160 os_tid = 0x2054 [0168.389] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.389] ReadFile (in: hFile=0x159c, lpBuffer=0x29dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29dff85c, lpOverlapped=0x0 | out: lpBuffer=0x29dffb34*, lpNumberOfBytesRead=0x29dff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.391] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.391] ReadFile (in: hFile=0x159c, lpBuffer=0x29dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29dff85c, lpOverlapped=0x0 | out: lpBuffer=0x29dffb34*, lpNumberOfBytesRead=0x29dff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.391] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.393] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.393] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x29dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0168.393] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x29dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x29dff828, pbKeyObject=0x0) returned 0x0 [0168.393] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x29dff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x29dff500) returned 0x0 [0168.393] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.393] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x29dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x29dff500) returned 0x0 [0168.397] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.399] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.399] WriteFile (in: hFile=0x159c, lpBuffer=0x29dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29dff830, lpOverlapped=0x0 | out: lpBuffer=0x29dffb34*, lpNumberOfBytesWritten=0x29dff830*=0x428, lpOverlapped=0x0) returned 1 [0168.399] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.399] ReadFile (in: hFile=0x159c, lpBuffer=0x4350000, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x29dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x29dff61c*=0x76ce, lpOverlapped=0x0) returned 1 [0168.400] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0xffff8932, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.400] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x4350000, cbInput=0x76ce, pPaddingInfo=0x0, pbIV=0x29dff848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x29dff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x29dff848, pbOutput=0x4350000, pcbResult=0x29dff618) returned 0x0 [0168.400] WriteFile (in: hFile=0x159c, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x29dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x29dff61c*=0x76d0, lpOverlapped=0x0) returned 1 [0168.401] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dff60c | out: lpNewFilePointer=0x0) returned 1 [0168.401] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.401] WriteFile (in: hFile=0x159c, lpBuffer=0x29dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dff61c, lpOverlapped=0x0 | out: lpBuffer=0x29dff83c*, lpNumberOfBytesWritten=0x29dff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.401] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x76d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.401] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.401] CloseHandle (hObject=0x159c) returned 1 [0168.401] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.play")) returned 1 [0168.404] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2161 os_tid = 0x2058 [0168.407] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.407] ReadFile (in: hFile=0x15a4, lpBuffer=0x29effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29eff85c, lpOverlapped=0x0 | out: lpBuffer=0x29effb34*, lpNumberOfBytesRead=0x29eff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.419] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.419] ReadFile (in: hFile=0x15a4, lpBuffer=0x29effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29eff85c, lpOverlapped=0x0 | out: lpBuffer=0x29effb34*, lpNumberOfBytesRead=0x29eff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.449] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.451] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x29eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0168.451] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x29eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x29eff828, pbKeyObject=0x0) returned 0x0 [0168.451] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x29eff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x29eff500) returned 0x0 [0168.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.451] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x29eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x29eff500) returned 0x0 [0168.454] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.457] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.457] WriteFile (in: hFile=0x15a4, lpBuffer=0x29effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29eff830, lpOverlapped=0x0 | out: lpBuffer=0x29effb34*, lpNumberOfBytesWritten=0x29eff830*=0x428, lpOverlapped=0x0) returned 1 [0168.457] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.457] ReadFile (in: hFile=0x15a4, lpBuffer=0x5250000, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x29eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x29eff61c*=0x4604, lpOverlapped=0x0) returned 1 [0168.468] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xffffb9fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.468] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5250000, cbInput=0x4604, pPaddingInfo=0x0, pbIV=0x29eff848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x29eff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x29eff848, pbOutput=0x5250000, pcbResult=0x29eff618) returned 0x0 [0168.468] WriteFile (in: hFile=0x15a4, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x29eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x29eff61c*=0x4610, lpOverlapped=0x0) returned 1 [0168.468] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29eff60c | out: lpNewFilePointer=0x0) returned 1 [0168.468] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.468] WriteFile (in: hFile=0x15a4, lpBuffer=0x29eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29eff61c, lpOverlapped=0x0 | out: lpBuffer=0x29eff83c*, lpNumberOfBytesWritten=0x29eff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.469] SetFilePointerEx (in: hFile=0x15a4, liDistanceToMove=0x4610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.469] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.469] CloseHandle (hObject=0x15a4) returned 1 [0168.469] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.play")) returned 1 [0168.471] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2162 os_tid = 0x205c [0168.408] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.408] ReadFile (in: hFile=0x15ac, lpBuffer=0x29fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29fff85c, lpOverlapped=0x0 | out: lpBuffer=0x29fffb34*, lpNumberOfBytesRead=0x29fff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.410] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.410] ReadFile (in: hFile=0x15ac, lpBuffer=0x29fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29fff85c, lpOverlapped=0x0 | out: lpBuffer=0x29fffb34*, lpNumberOfBytesRead=0x29fff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.410] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.411] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.412] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x29fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0168.412] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x29fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x29fff828, pbKeyObject=0x0) returned 0x0 [0168.412] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x29fff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x29fff500) returned 0x0 [0168.412] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.412] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x29fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x29fff500) returned 0x0 [0168.416] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.418] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.418] WriteFile (in: hFile=0x15ac, lpBuffer=0x29fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29fff830, lpOverlapped=0x0 | out: lpBuffer=0x29fffb34*, lpNumberOfBytesWritten=0x29fff830*=0x428, lpOverlapped=0x0) returned 1 [0168.419] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.419] ReadFile (in: hFile=0x15ac, lpBuffer=0x5350000, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x29fff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x29fff61c*=0x79cc, lpOverlapped=0x0) returned 1 [0168.443] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0xffff8634, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.444] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5350000, cbInput=0x79cc, pPaddingInfo=0x0, pbIV=0x29fff848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x29fff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x29fff848, pbOutput=0x5350000, pcbResult=0x29fff618) returned 0x0 [0168.444] WriteFile (in: hFile=0x15ac, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x29fff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x29fff61c*=0x79d0, lpOverlapped=0x0) returned 1 [0168.444] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29fff60c | out: lpNewFilePointer=0x0) returned 1 [0168.444] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.444] WriteFile (in: hFile=0x15ac, lpBuffer=0x29fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29fff61c, lpOverlapped=0x0 | out: lpBuffer=0x29fff83c*, lpNumberOfBytesWritten=0x29fff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.444] SetFilePointerEx (in: hFile=0x15ac, liDistanceToMove=0x79d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.444] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.444] CloseHandle (hObject=0x15ac) returned 1 [0168.444] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.play")) returned 1 [0168.446] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2163 os_tid = 0x2060 [0168.474] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.474] ReadFile (in: hFile=0x15b4, lpBuffer=0x2a0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a0ffb34*, lpNumberOfBytesRead=0x2a0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.475] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.475] ReadFile (in: hFile=0x15b4, lpBuffer=0x2a0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a0ffb34*, lpNumberOfBytesRead=0x2a0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.476] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.477] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.477] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x2a0ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0168.477] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x2a0ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x2a0ff828, pbKeyObject=0x0) returned 0x0 [0168.477] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a0ff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a0ff500) returned 0x0 [0168.478] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.478] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a0ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a0ff500) returned 0x0 [0168.481] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.483] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.483] WriteFile (in: hFile=0x15b4, lpBuffer=0x2a0ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a0ff830, lpOverlapped=0x0 | out: lpBuffer=0x2a0ffb34*, lpNumberOfBytesWritten=0x2a0ff830*=0x428, lpOverlapped=0x0) returned 1 [0168.484] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.484] ReadFile (in: hFile=0x15b4, lpBuffer=0x5450000, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x2a0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x2a0ff61c*=0x329e, lpOverlapped=0x0) returned 1 [0168.484] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0xffffcd62, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.485] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5450000, cbInput=0x329e, pPaddingInfo=0x0, pbIV=0x2a0ff848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x2a0ff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a0ff848, pbOutput=0x5450000, pcbResult=0x2a0ff618) returned 0x0 [0168.485] WriteFile (in: hFile=0x15b4, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2a0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x2a0ff61c*=0x32a0, lpOverlapped=0x0) returned 1 [0168.485] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0ff60c | out: lpNewFilePointer=0x0) returned 1 [0168.485] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.485] WriteFile (in: hFile=0x15b4, lpBuffer=0x2a0ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a0ff83c*, lpNumberOfBytesWritten=0x2a0ff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.485] SetFilePointerEx (in: hFile=0x15b4, liDistanceToMove=0x32a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.485] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.485] CloseHandle (hObject=0x15b4) returned 1 [0168.485] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.play")) returned 1 [0168.487] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2164 os_tid = 0x2064 [0168.491] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.492] ReadFile (in: hFile=0x15bc, lpBuffer=0x2a23fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a23f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a23fb34*, lpNumberOfBytesRead=0x2a23f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.493] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.493] ReadFile (in: hFile=0x15bc, lpBuffer=0x2a23fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a23f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a23fb34*, lpNumberOfBytesRead=0x2a23f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.493] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.495] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.495] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x2a23f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0168.495] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x2a23f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x2a23f828, pbKeyObject=0x0) returned 0x0 [0168.495] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a23f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a23f500) returned 0x0 [0168.496] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.497] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a23f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a23f500) returned 0x0 [0168.500] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.502] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.502] WriteFile (in: hFile=0x15bc, lpBuffer=0x2a23fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a23f830, lpOverlapped=0x0 | out: lpBuffer=0x2a23fb34*, lpNumberOfBytesWritten=0x2a23f830*=0x428, lpOverlapped=0x0) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.503] ReadFile (in: hFile=0x15bc, lpBuffer=0x5550000, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x2a23f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x2a23f61c*=0x9b8, lpOverlapped=0x0) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0xfffff648, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.503] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5550000, cbInput=0x9b8, pPaddingInfo=0x0, pbIV=0x2a23f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x2a23f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a23f848, pbOutput=0x5550000, pcbResult=0x2a23f618) returned 0x0 [0168.503] WriteFile (in: hFile=0x15bc, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2a23f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x2a23f61c*=0x9c0, lpOverlapped=0x0) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a23f60c | out: lpNewFilePointer=0x0) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.503] WriteFile (in: hFile=0x15bc, lpBuffer=0x2a23f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a23f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a23f83c*, lpNumberOfBytesWritten=0x2a23f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x9c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.503] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.503] CloseHandle (hObject=0x15bc) returned 1 [0168.503] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.play")) returned 1 [0168.506] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2165 os_tid = 0x2068 [0168.509] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.509] ReadFile (in: hFile=0x15c4, lpBuffer=0x2a37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a37fb34*, lpNumberOfBytesRead=0x2a37f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.510] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.510] ReadFile (in: hFile=0x15c4, lpBuffer=0x2a37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a37fb34*, lpNumberOfBytesRead=0x2a37f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.510] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.512] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x2a37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0168.512] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x2a37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x2a37f828, pbKeyObject=0x0) returned 0x0 [0168.512] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a37f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a37f500) returned 0x0 [0168.513] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.513] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a37f500) returned 0x0 [0168.516] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.518] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.518] WriteFile (in: hFile=0x15c4, lpBuffer=0x2a37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a37f830, lpOverlapped=0x0 | out: lpBuffer=0x2a37fb34*, lpNumberOfBytesWritten=0x2a37f830*=0x428, lpOverlapped=0x0) returned 1 [0168.518] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.518] ReadFile (in: hFile=0x15c4, lpBuffer=0x5650000, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x2a37f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x2a37f61c*=0x88c, lpOverlapped=0x0) returned 1 [0168.518] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0xfffff774, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.519] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5650000, cbInput=0x88c, pPaddingInfo=0x0, pbIV=0x2a37f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x2a37f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a37f848, pbOutput=0x5650000, pcbResult=0x2a37f618) returned 0x0 [0168.519] WriteFile (in: hFile=0x15c4, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2a37f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x2a37f61c*=0x890, lpOverlapped=0x0) returned 1 [0168.519] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a37f60c | out: lpNewFilePointer=0x0) returned 1 [0168.519] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.519] WriteFile (in: hFile=0x15c4, lpBuffer=0x2a37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a37f83c*, lpNumberOfBytesWritten=0x2a37f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.519] SetFilePointerEx (in: hFile=0x15c4, liDistanceToMove=0x890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.519] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.519] CloseHandle (hObject=0x15c4) returned 1 [0168.519] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.play")) returned 1 [0168.521] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2166 os_tid = 0x206c [0168.524] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.524] ReadFile (in: hFile=0x15cc, lpBuffer=0x2a4bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a4bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2a4bfb34*, lpNumberOfBytesRead=0x2a4bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.526] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.526] ReadFile (in: hFile=0x15cc, lpBuffer=0x2a4bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a4bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2a4bfb34*, lpNumberOfBytesRead=0x2a4bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.526] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.528] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.528] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x2a4bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0168.528] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x2a4bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x2a4bf828, pbKeyObject=0x0) returned 0x0 [0168.528] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a4bf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a4bf500) returned 0x0 [0168.528] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.528] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a4bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a4bf500) returned 0x0 [0168.531] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.533] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.533] WriteFile (in: hFile=0x15cc, lpBuffer=0x2a4bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a4bf830, lpOverlapped=0x0 | out: lpBuffer=0x2a4bfb34*, lpNumberOfBytesWritten=0x2a4bf830*=0x428, lpOverlapped=0x0) returned 1 [0168.534] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.534] ReadFile (in: hFile=0x15cc, lpBuffer=0x5750000, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x2a4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x2a4bf61c*=0x112c, lpOverlapped=0x0) returned 1 [0168.534] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0xffffeed4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.534] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5750000, cbInput=0x112c, pPaddingInfo=0x0, pbIV=0x2a4bf848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x2a4bf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a4bf848, pbOutput=0x5750000, pcbResult=0x2a4bf618) returned 0x0 [0168.534] WriteFile (in: hFile=0x15cc, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2a4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x2a4bf61c*=0x1130, lpOverlapped=0x0) returned 1 [0168.534] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a4bf60c | out: lpNewFilePointer=0x0) returned 1 [0168.534] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.534] WriteFile (in: hFile=0x15cc, lpBuffer=0x2a4bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a4bf83c*, lpNumberOfBytesWritten=0x2a4bf61c*=0x8, lpOverlapped=0x0) returned 1 [0168.534] SetFilePointerEx (in: hFile=0x15cc, liDistanceToMove=0x1130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.534] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.535] CloseHandle (hObject=0x15cc) returned 1 [0168.535] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.play")) returned 1 [0168.537] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2167 os_tid = 0x2070 [0168.540] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.540] ReadFile (in: hFile=0x15d4, lpBuffer=0x2a5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a5ffb34*, lpNumberOfBytesRead=0x2a5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.541] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.541] ReadFile (in: hFile=0x15d4, lpBuffer=0x2a5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a5ffb34*, lpNumberOfBytesRead=0x2a5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.543] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.543] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x2a5ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0168.543] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x2a5ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x2a5ff828, pbKeyObject=0x0) returned 0x0 [0168.543] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a5ff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a5ff500) returned 0x0 [0168.543] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.543] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a5ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a5ff500) returned 0x0 [0168.547] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.549] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.549] WriteFile (in: hFile=0x15d4, lpBuffer=0x2a5ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a5ff830, lpOverlapped=0x0 | out: lpBuffer=0x2a5ffb34*, lpNumberOfBytesWritten=0x2a5ff830*=0x428, lpOverlapped=0x0) returned 1 [0168.550] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.550] ReadFile (in: hFile=0x15d4, lpBuffer=0x5850000, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x2a5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x2a5ff61c*=0xe70, lpOverlapped=0x0) returned 1 [0168.550] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0xfffff190, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.550] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5850000, cbInput=0xe70, pPaddingInfo=0x0, pbIV=0x2a5ff848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x2a5ff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a5ff848, pbOutput=0x5850000, pcbResult=0x2a5ff618) returned 0x0 [0168.550] WriteFile (in: hFile=0x15d4, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2a5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x2a5ff61c*=0xe80, lpOverlapped=0x0) returned 1 [0168.550] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a5ff60c | out: lpNewFilePointer=0x0) returned 1 [0168.550] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.550] WriteFile (in: hFile=0x15d4, lpBuffer=0x2a5ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a5ff83c*, lpNumberOfBytesWritten=0x2a5ff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.550] SetFilePointerEx (in: hFile=0x15d4, liDistanceToMove=0xe80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.550] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.550] CloseHandle (hObject=0x15d4) returned 1 [0168.550] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.play")) returned 1 [0168.553] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2168 os_tid = 0x2074 [0168.556] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.556] ReadFile (in: hFile=0x15dc, lpBuffer=0x2a73fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a73f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a73fb34*, lpNumberOfBytesRead=0x2a73f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.559] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.560] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.560] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x2a73f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0168.560] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x2a73f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x2a73f828, pbKeyObject=0x0) returned 0x0 [0168.560] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a73f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a73f500) returned 0x0 [0168.561] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.561] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a73f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a73f500) returned 0x0 [0168.564] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.566] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.566] WriteFile (in: hFile=0x15dc, lpBuffer=0x2a73fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a73f830, lpOverlapped=0x0 | out: lpBuffer=0x2a73fb34*, lpNumberOfBytesWritten=0x2a73f830*=0x428, lpOverlapped=0x0) returned 1 [0168.567] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.567] ReadFile (in: hFile=0x15dc, lpBuffer=0x5950000, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x2a73f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x2a73f61c*=0x61c, lpOverlapped=0x0) returned 1 [0168.567] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0xfffff9e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.567] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5950000, cbInput=0x61c, pPaddingInfo=0x0, pbIV=0x2a73f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x2a73f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a73f848, pbOutput=0x5950000, pcbResult=0x2a73f618) returned 0x0 [0168.567] WriteFile (in: hFile=0x15dc, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a73f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x2a73f61c*=0x620, lpOverlapped=0x0) returned 1 [0168.567] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a73f60c | out: lpNewFilePointer=0x0) returned 1 [0168.567] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.567] WriteFile (in: hFile=0x15dc, lpBuffer=0x2a73f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a73f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a73f83c*, lpNumberOfBytesWritten=0x2a73f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.568] SetFilePointerEx (in: hFile=0x15dc, liDistanceToMove=0x620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.568] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.568] CloseHandle (hObject=0x15dc) returned 1 [0168.568] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.play")) returned 1 [0168.570] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2169 os_tid = 0x2078 [0168.574] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.574] ReadFile (in: hFile=0x15e4, lpBuffer=0x2a87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a87f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a87fb34*, lpNumberOfBytesRead=0x2a87f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.575] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.576] ReadFile (in: hFile=0x15e4, lpBuffer=0x2a87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a87f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a87fb34*, lpNumberOfBytesRead=0x2a87f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.576] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.577] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.577] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x2a87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0168.577] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x2a87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x2a87f828, pbKeyObject=0x0) returned 0x0 [0168.577] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a87f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a87f500) returned 0x0 [0168.578] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.578] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a87f500) returned 0x0 [0168.581] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.583] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.583] WriteFile (in: hFile=0x15e4, lpBuffer=0x2a87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a87f830, lpOverlapped=0x0 | out: lpBuffer=0x2a87fb34*, lpNumberOfBytesWritten=0x2a87f830*=0x428, lpOverlapped=0x0) returned 1 [0168.584] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.584] ReadFile (in: hFile=0x15e4, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x2a87f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x2a87f61c*=0x1234, lpOverlapped=0x0) returned 1 [0168.584] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0xffffedcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.584] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5a50000, cbInput=0x1234, pPaddingInfo=0x0, pbIV=0x2a87f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x2a87f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a87f848, pbOutput=0x5a50000, pcbResult=0x2a87f618) returned 0x0 [0168.584] WriteFile (in: hFile=0x15e4, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2a87f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x2a87f61c*=0x1240, lpOverlapped=0x0) returned 1 [0168.585] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a87f60c | out: lpNewFilePointer=0x0) returned 1 [0168.585] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.585] WriteFile (in: hFile=0x15e4, lpBuffer=0x2a87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a87f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a87f83c*, lpNumberOfBytesWritten=0x2a87f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.585] SetFilePointerEx (in: hFile=0x15e4, liDistanceToMove=0x1240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.585] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.585] CloseHandle (hObject=0x15e4) returned 1 [0168.585] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.play")) returned 1 [0168.587] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2170 os_tid = 0x207c [0168.591] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.591] ReadFile (in: hFile=0x1274, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.592] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.592] ReadFile (in: hFile=0x1274, lpBuffer=0x2123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2123f85c, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesRead=0x2123f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.592] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.594] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2123f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0168.594] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2123f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2123f828, pbKeyObject=0x0) returned 0x0 [0168.595] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2123f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2123f500) returned 0x0 [0168.595] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.595] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2123f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2123f500) returned 0x0 [0168.600] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.603] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.603] WriteFile (in: hFile=0x1274, lpBuffer=0x2123fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2123f830, lpOverlapped=0x0 | out: lpBuffer=0x2123fb34*, lpNumberOfBytesWritten=0x2123f830*=0x428, lpOverlapped=0x0) returned 1 [0168.604] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.604] ReadFile (in: hFile=0x1274, lpBuffer=0x3650000, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2123f61c*=0xf94, lpOverlapped=0x0) returned 1 [0168.604] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfffff06c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.604] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x3650000, cbInput=0xf94, pPaddingInfo=0x0, pbIV=0x2123f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2123f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2123f848, pbOutput=0x3650000, pcbResult=0x2123f618) returned 0x0 [0168.604] WriteFile (in: hFile=0x1274, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2123f61c*=0xfa0, lpOverlapped=0x0) returned 1 [0168.604] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2123f60c | out: lpNewFilePointer=0x0) returned 1 [0168.605] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.605] WriteFile (in: hFile=0x1274, lpBuffer=0x2123f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2123f61c, lpOverlapped=0x0 | out: lpBuffer=0x2123f83c*, lpNumberOfBytesWritten=0x2123f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.605] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0xfa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.605] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.605] CloseHandle (hObject=0x1274) returned 1 [0168.605] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.play")) returned 1 [0168.608] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2171 os_tid = 0x2080 [0168.612] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.612] ReadFile (in: hFile=0x1648, lpBuffer=0x2a9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2a9bfb34*, lpNumberOfBytesRead=0x2a9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.614] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.614] ReadFile (in: hFile=0x1648, lpBuffer=0x2a9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2a9bfb34*, lpNumberOfBytesRead=0x2a9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.614] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.616] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.616] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x2a9bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0168.616] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x2a9bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x2a9bf828, pbKeyObject=0x0) returned 0x0 [0168.616] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2a9bf500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2a9bf500) returned 0x0 [0168.616] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.616] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2a9bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2a9bf500) returned 0x0 [0168.623] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.625] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.625] WriteFile (in: hFile=0x1648, lpBuffer=0x2a9bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a9bf830, lpOverlapped=0x0 | out: lpBuffer=0x2a9bfb34*, lpNumberOfBytesWritten=0x2a9bf830*=0x428, lpOverlapped=0x0) returned 1 [0168.626] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.626] ReadFile (in: hFile=0x1648, lpBuffer=0x5b50000, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x2a9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x2a9bf61c*=0xa4c, lpOverlapped=0x0) returned 1 [0168.626] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0xfffff5b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.626] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5b50000, cbInput=0xa4c, pPaddingInfo=0x0, pbIV=0x2a9bf848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x2a9bf618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2a9bf848, pbOutput=0x5b50000, pcbResult=0x2a9bf618) returned 0x0 [0168.626] WriteFile (in: hFile=0x1648, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2a9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x2a9bf61c*=0xa50, lpOverlapped=0x0) returned 1 [0168.626] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9bf60c | out: lpNewFilePointer=0x0) returned 1 [0168.626] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.627] WriteFile (in: hFile=0x1648, lpBuffer=0x2a9bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a9bf83c*, lpNumberOfBytesWritten=0x2a9bf61c*=0x8, lpOverlapped=0x0) returned 1 [0168.627] SetFilePointerEx (in: hFile=0x1648, liDistanceToMove=0xa50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.627] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.627] CloseHandle (hObject=0x1648) returned 1 [0168.627] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.629] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.play")) returned 1 [0168.630] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2172 os_tid = 0x2084 [0168.634] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.634] ReadFile (in: hFile=0x1650, lpBuffer=0x2aaffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2aaff85c, lpOverlapped=0x0 | out: lpBuffer=0x2aaffb34*, lpNumberOfBytesRead=0x2aaff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.635] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.636] ReadFile (in: hFile=0x1650, lpBuffer=0x2aaffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2aaff85c, lpOverlapped=0x0 | out: lpBuffer=0x2aaffb34*, lpNumberOfBytesRead=0x2aaff85c*=0x428, lpOverlapped=0x0) returned 1 [0168.637] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.639] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.639] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x2aaff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0168.639] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x2aaff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x2aaff828, pbKeyObject=0x0) returned 0x0 [0168.639] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2aaff500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2aaff500) returned 0x0 [0168.639] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.640] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2aaff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2aaff500) returned 0x0 [0168.645] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.648] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.648] WriteFile (in: hFile=0x1650, lpBuffer=0x2aaffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2aaff830, lpOverlapped=0x0 | out: lpBuffer=0x2aaffb34*, lpNumberOfBytesWritten=0x2aaff830*=0x428, lpOverlapped=0x0) returned 1 [0168.649] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.649] ReadFile (in: hFile=0x1650, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x2aaff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x2aaff61c*=0x1510, lpOverlapped=0x0) returned 1 [0168.649] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0xffffeaf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.650] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5c50000, cbInput=0x1510, pPaddingInfo=0x0, pbIV=0x2aaff848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x2aaff618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2aaff848, pbOutput=0x5c50000, pcbResult=0x2aaff618) returned 0x0 [0168.650] WriteFile (in: hFile=0x1650, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2aaff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x2aaff61c*=0x1520, lpOverlapped=0x0) returned 1 [0168.650] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aaff60c | out: lpNewFilePointer=0x0) returned 1 [0168.650] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.650] WriteFile (in: hFile=0x1650, lpBuffer=0x2aaff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2aaff61c, lpOverlapped=0x0 | out: lpBuffer=0x2aaff83c*, lpNumberOfBytesWritten=0x2aaff61c*=0x8, lpOverlapped=0x0) returned 1 [0168.650] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x1520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.650] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.650] CloseHandle (hObject=0x1650) returned 1 [0168.650] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.play")) returned 1 [0168.654] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2173 os_tid = 0x2088 [0168.659] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.659] ReadFile (in: hFile=0x1658, lpBuffer=0x2ac3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ac3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ac3fb34*, lpNumberOfBytesRead=0x2ac3f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.661] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.663] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.663] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x2ac3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0168.663] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x2ac3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x2ac3f828, pbKeyObject=0x0) returned 0x0 [0168.663] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2ac3f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2ac3f500) returned 0x0 [0168.663] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.663] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2ac3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2ac3f500) returned 0x0 [0168.669] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.671] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.671] WriteFile (in: hFile=0x1658, lpBuffer=0x2ac3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ac3f830, lpOverlapped=0x0 | out: lpBuffer=0x2ac3fb34*, lpNumberOfBytesWritten=0x2ac3f830*=0x428, lpOverlapped=0x0) returned 1 [0168.672] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.672] ReadFile (in: hFile=0x1658, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x2ac3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x2ac3f61c*=0x670, lpOverlapped=0x0) returned 1 [0168.672] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0xfffff990, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.672] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5d50000, cbInput=0x670, pPaddingInfo=0x0, pbIV=0x2ac3f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x2ac3f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2ac3f848, pbOutput=0x5d50000, pcbResult=0x2ac3f618) returned 0x0 [0168.672] WriteFile (in: hFile=0x1658, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2ac3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x2ac3f61c*=0x680, lpOverlapped=0x0) returned 1 [0168.673] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ac3f60c | out: lpNewFilePointer=0x0) returned 1 [0168.673] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.673] WriteFile (in: hFile=0x1658, lpBuffer=0x2ac3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ac3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ac3f83c*, lpNumberOfBytesWritten=0x2ac3f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.673] SetFilePointerEx (in: hFile=0x1658, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.673] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.673] CloseHandle (hObject=0x1658) returned 1 [0168.673] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.play")) returned 1 [0168.676] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2174 os_tid = 0x208c [0168.680] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.680] ReadFile (in: hFile=0x1660, lpBuffer=0x2ad7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ad7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ad7fb34*, lpNumberOfBytesRead=0x2ad7f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.681] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.681] ReadFile (in: hFile=0x1660, lpBuffer=0x2ad7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ad7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ad7fb34*, lpNumberOfBytesRead=0x2ad7f85c*=0x428, lpOverlapped=0x0) returned 1 [0168.681] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x1c0000 [0168.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x1c0000) returned 0x0 [0168.683] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x2ad7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0168.683] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x2ad7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x1c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x2ad7f828, pbKeyObject=0x0) returned 0x0 [0168.683] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x1c0000, cbOutput=0x230, pcbResult=0x2ad7f500, dwFlags=0x0 | out: pbOutput=0x1c0000, pcbResult=0x2ad7f500) returned 0x0 [0168.684] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x1c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x1c0230) returned 0x0 [0168.684] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x1c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x1c0000, cbOutput=0x400, pcbResult=0x2ad7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x1c0000, pcbResult=0x2ad7f500) returned 0x0 [0168.687] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.689] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.689] WriteFile (in: hFile=0x1660, lpBuffer=0x2ad7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ad7f830, lpOverlapped=0x0 | out: lpBuffer=0x2ad7fb34*, lpNumberOfBytesWritten=0x2ad7f830*=0x428, lpOverlapped=0x0) returned 1 [0168.690] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.690] ReadFile (in: hFile=0x1660, lpBuffer=0x5e50000, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x2ad7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x2ad7f61c*=0xc38, lpOverlapped=0x0) returned 1 [0168.690] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0xfffff3c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.690] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x5e50000, cbInput=0xc38, pPaddingInfo=0x0, pbIV=0x2ad7f848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x2ad7f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2ad7f848, pbOutput=0x5e50000, pcbResult=0x2ad7f618) returned 0x0 [0168.690] WriteFile (in: hFile=0x1660, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2ad7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x2ad7f61c*=0xc40, lpOverlapped=0x0) returned 1 [0168.691] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ad7f60c | out: lpNewFilePointer=0x0) returned 1 [0168.691] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.691] WriteFile (in: hFile=0x1660, lpBuffer=0x2ad7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ad7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ad7f83c*, lpNumberOfBytesWritten=0x2ad7f61c*=0x8, lpOverlapped=0x0) returned 1 [0168.691] SetFilePointerEx (in: hFile=0x1660, liDistanceToMove=0xc40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.691] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0168.691] CloseHandle (hObject=0x1660) returned 1 [0168.691] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0168.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.play")) returned 1 [0168.694] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2175 os_tid = 0x2090 [0168.698] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.698] ReadFile (in: hFile=0x1668, lpBuffer=0x2aebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2aebf85c, lpOverlapped=0x0 | out: lpBuffer=0x2aebfb34*, lpNumberOfBytesRead=0x2aebf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.044] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.045] ReadFile (in: hFile=0x1668, lpBuffer=0x2aebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2aebf85c, lpOverlapped=0x0 | out: lpBuffer=0x2aebfb34*, lpNumberOfBytesRead=0x2aebf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.045] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.047] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.047] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x2aebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0169.047] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x2aebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x2aebf828, pbKeyObject=0x0) returned 0x0 [0169.047] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2aebf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2aebf500) returned 0x0 [0169.047] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.048] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2aebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2aebf500) returned 0x0 [0169.051] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.053] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.053] WriteFile (in: hFile=0x1668, lpBuffer=0x2aebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2aebf830, lpOverlapped=0x0 | out: lpBuffer=0x2aebfb34*, lpNumberOfBytesWritten=0x2aebf830*=0x428, lpOverlapped=0x0) returned 1 [0169.054] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.054] ReadFile (in: hFile=0x1668, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x2aebf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x2aebf61c*=0x32b5, lpOverlapped=0x0) returned 1 [0169.522] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xffffcd4b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.523] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x5f50000, cbInput=0x32b5, pPaddingInfo=0x0, pbIV=0x2aebf848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x2aebf618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2aebf848, pbOutput=0x5f50000, pcbResult=0x2aebf618) returned 0x0 [0169.523] WriteFile (in: hFile=0x1668, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2aebf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x2aebf61c*=0x32c0, lpOverlapped=0x0) returned 1 [0169.523] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aebf60c | out: lpNewFilePointer=0x0) returned 1 [0169.523] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.523] WriteFile (in: hFile=0x1668, lpBuffer=0x2aebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2aebf61c, lpOverlapped=0x0 | out: lpBuffer=0x2aebf83c*, lpNumberOfBytesWritten=0x2aebf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.523] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x32c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.523] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0169.523] CloseHandle (hObject=0x1668) returned 1 [0169.703] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x211f0000 [0169.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.play")) returned 1 [0169.713] VirtualFree (lpAddress=0x211f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2176 os_tid = 0x2094 [0168.700] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.700] ReadFile (in: hFile=0x1670, lpBuffer=0x2afffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2afff85c, lpOverlapped=0x0 | out: lpBuffer=0x2afffb34*, lpNumberOfBytesRead=0x2afff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.044] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.044] ReadFile (in: hFile=0x1670, lpBuffer=0x2afffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2afff85c, lpOverlapped=0x0 | out: lpBuffer=0x2afffb34*, lpNumberOfBytesRead=0x2afff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.510] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.513] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.513] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x2afff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0169.513] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x2afff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x2afff828, pbKeyObject=0x0) returned 0x0 [0169.513] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2afff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2afff500) returned 0x0 [0169.513] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.513] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2afff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2afff500) returned 0x0 [0169.517] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.520] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.521] WriteFile (in: hFile=0x1670, lpBuffer=0x2afffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2afff830, lpOverlapped=0x0 | out: lpBuffer=0x2afffb34*, lpNumberOfBytesWritten=0x2afff830*=0x428, lpOverlapped=0x0) returned 1 [0169.521] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.522] ReadFile (in: hFile=0x1670, lpBuffer=0x6050000, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x2afff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x2afff61c*=0x2466, lpOverlapped=0x0) returned 1 [0169.620] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0xffffdb9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.620] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x6050000, cbInput=0x2466, pPaddingInfo=0x0, pbIV=0x2afff848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x2afff618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x2afff848, pbOutput=0x6050000, pcbResult=0x2afff618) returned 0x0 [0169.620] WriteFile (in: hFile=0x1670, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2afff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x2afff61c*=0x2470, lpOverlapped=0x0) returned 1 [0169.620] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2afff60c | out: lpNewFilePointer=0x0) returned 1 [0169.620] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.621] WriteFile (in: hFile=0x1670, lpBuffer=0x2afff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2afff61c, lpOverlapped=0x0 | out: lpBuffer=0x2afff83c*, lpNumberOfBytesWritten=0x2afff61c*=0x8, lpOverlapped=0x0) returned 1 [0169.621] SetFilePointerEx (in: hFile=0x1670, liDistanceToMove=0x2470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.621] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.621] CloseHandle (hObject=0x1670) returned 1 [0169.864] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xea0000 [0169.866] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.play")) returned 1 [0169.870] VirtualFree (lpAddress=0xea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2177 os_tid = 0x2098 [0168.702] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.702] ReadFile (in: hFile=0x1678, lpBuffer=0x2b13fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b13f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b13fb34*, lpNumberOfBytesRead=0x2b13f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.033] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0169.034] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0169.035] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x2b13f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0169.035] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x2b13f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x2b13f828, pbKeyObject=0x0) returned 0x0 [0169.035] BCryptExportKey (in: hKey=0x1a6d9750, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b13f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b13f500) returned 0x0 [0169.035] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0169.035] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b13f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b13f500) returned 0x0 [0169.038] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.040] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.040] WriteFile (in: hFile=0x1678, lpBuffer=0x2b13fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b13f830, lpOverlapped=0x0 | out: lpBuffer=0x2b13fb34*, lpNumberOfBytesWritten=0x2b13f830*=0x428, lpOverlapped=0x0) returned 1 [0169.041] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.041] ReadFile (in: hFile=0x1678, lpBuffer=0x6150000, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x2b13f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x2b13f61c*=0x816, lpOverlapped=0x0) returned 1 [0169.041] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffff7ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.041] BCryptEncrypt (in: hKey=0x1a6d9750, pbInput=0x6150000, cbInput=0x816, pPaddingInfo=0x0, pbIV=0x2b13f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x2b13f618, dwFlags=0x1 | out: hKey=0x1a6d9750, pbIV=0x2b13f848, pbOutput=0x6150000, pcbResult=0x2b13f618) returned 0x0 [0169.041] WriteFile (in: hFile=0x1678, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2b13f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x2b13f61c*=0x820, lpOverlapped=0x0) returned 1 [0169.041] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b13f60c | out: lpNewFilePointer=0x0) returned 1 [0169.041] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.042] WriteFile (in: hFile=0x1678, lpBuffer=0x2b13f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b13f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b13f83c*, lpNumberOfBytesWritten=0x2b13f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.042] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.042] BCryptDestroyKey (in: hKey=0x1a6d9750 | out: hKey=0x1a6d9750) returned 0x0 [0169.042] CloseHandle (hObject=0x1678) returned 1 [0169.042] VirtualAlloc (lpAddress=0x0, dwSize=0x97, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0169.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\flap.wmf.play")) returned 1 [0169.950] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2178 os_tid = 0x209c [0168.703] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.703] ReadFile (in: hFile=0x1680, lpBuffer=0x2b27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b27f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b27fb34*, lpNumberOfBytesRead=0x2b27f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.015] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.015] ReadFile (in: hFile=0x1680, lpBuffer=0x2b27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b27f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b27fb34*, lpNumberOfBytesRead=0x2b27f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.015] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0169.025] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0169.025] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x2b27f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0169.025] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x2b27f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x2b27f828, pbKeyObject=0x0) returned 0x0 [0169.025] BCryptExportKey (in: hKey=0x1a6d94c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b27f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b27f500) returned 0x0 [0169.025] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0169.025] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b27f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b27f500) returned 0x0 [0169.028] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.031] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.031] WriteFile (in: hFile=0x1680, lpBuffer=0x2b27fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b27f830, lpOverlapped=0x0 | out: lpBuffer=0x2b27fb34*, lpNumberOfBytesWritten=0x2b27f830*=0x428, lpOverlapped=0x0) returned 1 [0169.032] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.032] ReadFile (in: hFile=0x1680, lpBuffer=0x6250000, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x2b27f61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x2b27f61c*=0x1d8f, lpOverlapped=0x0) returned 1 [0169.509] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0xffffe271, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.509] BCryptEncrypt (in: hKey=0x1a6d94c0, pbInput=0x6250000, cbInput=0x1d8f, pPaddingInfo=0x0, pbIV=0x2b27f848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x2b27f618, dwFlags=0x1 | out: hKey=0x1a6d94c0, pbIV=0x2b27f848, pbOutput=0x6250000, pcbResult=0x2b27f618) returned 0x0 [0169.509] WriteFile (in: hFile=0x1680, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2b27f61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x2b27f61c*=0x1d90, lpOverlapped=0x0) returned 1 [0169.509] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b27f60c | out: lpNewFilePointer=0x0) returned 1 [0169.510] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.510] WriteFile (in: hFile=0x1680, lpBuffer=0x2b27f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b27f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b27f83c*, lpNumberOfBytesWritten=0x2b27f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.510] SetFilePointerEx (in: hFile=0x1680, liDistanceToMove=0x1d90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.510] BCryptDestroyKey (in: hKey=0x1a6d94c0 | out: hKey=0x1a6d94c0) returned 0x0 [0169.510] CloseHandle (hObject=0x1680) returned 1 [0169.662] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11fa0000 [0169.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\grden_01.mid.play")) returned 1 [0169.777] VirtualFree (lpAddress=0x11fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2179 os_tid = 0x20a0 [0168.705] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.705] ReadFile (in: hFile=0x1688, lpBuffer=0x2b3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2b3bfb34*, lpNumberOfBytesRead=0x2b3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.869] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.870] ReadFile (in: hFile=0x1688, lpBuffer=0x2b3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2b3bfb34*, lpNumberOfBytesRead=0x2b3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0168.870] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0168.872] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0168.872] BCryptSetProperty (in: hObject=0x732d30, pszProperty="ChainingMode", pbInput=0x2b3bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732d30) returned 0x0 [0168.873] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732d30, phKey=0x2b3bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732d30, phKey=0x2b3bf828, pbKeyObject=0x0) returned 0x0 [0168.873] BCryptExportKey (in: hKey=0x1a6d9240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b3bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b3bf500) returned 0x0 [0168.873] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0168.873] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b3bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b3bf500) returned 0x0 [0168.982] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.989] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.989] WriteFile (in: hFile=0x1688, lpBuffer=0x2b3bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b3bf830, lpOverlapped=0x0 | out: lpBuffer=0x2b3bfb34*, lpNumberOfBytesWritten=0x2b3bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.015] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.015] ReadFile (in: hFile=0x1688, lpBuffer=0x6350000, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x2b3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x2b3bf61c*=0x18bb, lpOverlapped=0x0) returned 1 [0169.508] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xffffe745, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.509] BCryptEncrypt (in: hKey=0x1a6d9240, pbInput=0x6350000, cbInput=0x18bb, pPaddingInfo=0x0, pbIV=0x2b3bf848, cbIV=0x10, pbOutput=0x6350000, cbOutput=0x100000, pcbResult=0x2b3bf618, dwFlags=0x1 | out: hKey=0x1a6d9240, pbIV=0x2b3bf848, pbOutput=0x6350000, pcbResult=0x2b3bf618) returned 0x0 [0169.509] WriteFile (in: hFile=0x1688, lpBuffer=0x6350000*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2b3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesWritten=0x2b3bf61c*=0x18c0, lpOverlapped=0x0) returned 1 [0169.509] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.509] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.509] WriteFile (in: hFile=0x1688, lpBuffer=0x2b3bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b3bf83c*, lpNumberOfBytesWritten=0x2b3bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.509] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x18c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.509] BCryptDestroyKey (in: hKey=0x1a6d9240 | out: hKey=0x1a6d9240) returned 0x0 [0169.509] CloseHandle (hObject=0x1688) returned 1 [0169.659] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x11f90000 [0169.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\grid_01.mid.play")) returned 1 [0169.781] VirtualFree (lpAddress=0x11f90000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2180 os_tid = 0x20a4 [0168.707] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.707] ReadFile (in: hFile=0x1690, lpBuffer=0x2b4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2b4ffb34*, lpNumberOfBytesRead=0x2b4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.054] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.054] ReadFile (in: hFile=0x1690, lpBuffer=0x2b4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2b4ffb34*, lpNumberOfBytesRead=0x2b4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.054] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.056] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.056] BCryptSetProperty (in: hObject=0x731d60, pszProperty="ChainingMode", pbInput=0x2b4ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731d60) returned 0x0 [0169.056] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731d60, phKey=0x2b4ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731d60, phKey=0x2b4ff828, pbKeyObject=0x0) returned 0x0 [0169.056] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2b4ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2b4ff500) returned 0x0 [0169.056] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.056] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2b4ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2b4ff500) returned 0x0 [0169.094] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.097] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.097] WriteFile (in: hFile=0x1690, lpBuffer=0x2b4ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b4ff830, lpOverlapped=0x0 | out: lpBuffer=0x2b4ffb34*, lpNumberOfBytesWritten=0x2b4ff830*=0x428, lpOverlapped=0x0) returned 1 [0169.098] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.098] ReadFile (in: hFile=0x1690, lpBuffer=0x6450000, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x2b4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesRead=0x2b4ff61c*=0xeb4, lpOverlapped=0x0) returned 1 [0169.098] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xfffff14c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.099] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x6450000, cbInput=0xeb4, pPaddingInfo=0x0, pbIV=0x2b4ff848, cbIV=0x10, pbOutput=0x6450000, cbOutput=0x100000, pcbResult=0x2b4ff618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2b4ff848, pbOutput=0x6450000, pcbResult=0x2b4ff618) returned 0x0 [0169.099] WriteFile (in: hFile=0x1690, lpBuffer=0x6450000*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2b4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesWritten=0x2b4ff61c*=0xec0, lpOverlapped=0x0) returned 1 [0169.099] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4ff60c | out: lpNewFilePointer=0x0) returned 1 [0169.099] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.099] WriteFile (in: hFile=0x1690, lpBuffer=0x2b4ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2b4ff83c*, lpNumberOfBytesWritten=0x2b4ff61c*=0x8, lpOverlapped=0x0) returned 1 [0169.099] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.099] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.099] CloseHandle (hObject=0x1690) returned 1 [0169.530] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb220000 [0169.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.play")) returned 1 [0169.860] VirtualFree (lpAddress=0xb220000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2181 os_tid = 0x20a8 [0168.708] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.709] ReadFile (in: hFile=0x1698, lpBuffer=0x2b63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b63fb34*, lpNumberOfBytesRead=0x2b63f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.099] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.099] ReadFile (in: hFile=0x1698, lpBuffer=0x2b63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b63fb34*, lpNumberOfBytesRead=0x2b63f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.099] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.101] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.101] BCryptSetProperty (in: hObject=0x7329c0, pszProperty="ChainingMode", pbInput=0x2b63f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7329c0) returned 0x0 [0169.102] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7329c0, phKey=0x2b63f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7329c0, phKey=0x2b63f828, pbKeyObject=0x0) returned 0x0 [0169.102] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2b63f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2b63f500) returned 0x0 [0169.102] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.102] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2b63f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2b63f500) returned 0x0 [0169.105] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.108] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.108] WriteFile (in: hFile=0x1698, lpBuffer=0x2b63fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b63f830, lpOverlapped=0x0 | out: lpBuffer=0x2b63fb34*, lpNumberOfBytesWritten=0x2b63f830*=0x428, lpOverlapped=0x0) returned 1 [0169.108] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.109] ReadFile (in: hFile=0x1698, lpBuffer=0x6550000, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x2b63f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesRead=0x2b63f61c*=0x9a8, lpOverlapped=0x0) returned 1 [0169.109] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0xfffff658, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.109] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x6550000, cbInput=0x9a8, pPaddingInfo=0x0, pbIV=0x2b63f848, cbIV=0x10, pbOutput=0x6550000, cbOutput=0x100000, pcbResult=0x2b63f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2b63f848, pbOutput=0x6550000, pcbResult=0x2b63f618) returned 0x0 [0169.109] WriteFile (in: hFile=0x1698, lpBuffer=0x6550000*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2b63f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesWritten=0x2b63f61c*=0x9b0, lpOverlapped=0x0) returned 1 [0169.109] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b63f60c | out: lpNewFilePointer=0x0) returned 1 [0169.109] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.109] WriteFile (in: hFile=0x1698, lpBuffer=0x2b63f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b63f83c*, lpNumberOfBytesWritten=0x2b63f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.109] SetFilePointerEx (in: hFile=0x1698, liDistanceToMove=0x9b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.109] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.109] CloseHandle (hObject=0x1698) returned 1 [0169.532] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb230000 [0169.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.play")) returned 1 [0169.856] VirtualFree (lpAddress=0xb230000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2182 os_tid = 0xd74 [0168.710] GetLastError () returned 0x57 [0168.710] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ce600 [0168.710] SetLastError (dwErrCode=0x57) [0168.710] IcmpCreateFile () returned 0x7ccd00 [0168.710] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798420 [0168.710] IcmpSendEcho2 (IcmpHandle=0x7ccd00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2700a8c0, RequestData=0x28c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798420, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2183 os_tid = 0x20ac [0168.712] GetLastError () returned 0x57 [0168.712] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ce988 [0168.712] SetLastError (dwErrCode=0x57) [0168.712] IcmpCreateFile () returned 0x7ccd38 [0168.712] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798470 [0168.712] IcmpSendEcho2 (IcmpHandle=0x7ccd38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2800a8c0, RequestData=0x2b77ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798470, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2184 os_tid = 0x20b0 [0168.714] GetLastError () returned 0x57 [0168.714] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ced10 [0168.714] SetLastError (dwErrCode=0x57) [0168.714] IcmpCreateFile () returned 0x7ccd70 [0168.714] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798970 [0168.714] IcmpSendEcho2 (IcmpHandle=0x7ccd70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2900a8c0, RequestData=0x2b8bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798970, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2185 os_tid = 0x20b4 [0168.715] GetLastError () returned 0x57 [0168.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cf098 [0168.716] SetLastError (dwErrCode=0x57) [0168.716] IcmpCreateFile () returned 0x7ccda8 [0168.716] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798ab0 [0168.716] IcmpSendEcho2 (IcmpHandle=0x7ccda8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2a00a8c0, RequestData=0x2b9fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798ab0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2186 os_tid = 0x20b8 [0168.717] GetLastError () returned 0x57 [0168.717] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6cf420 [0168.717] SetLastError (dwErrCode=0x57) [0168.717] IcmpCreateFile () returned 0x7ccde0 [0168.717] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x798b00 [0168.717] IcmpSendEcho2 (IcmpHandle=0x7ccde0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2b00a8c0, RequestData=0x2bb3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x798b00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2187 os_tid = 0x20bc [0168.719] GetLastError () returned 0x57 [0168.719] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9c30 [0168.719] SetLastError (dwErrCode=0x57) [0168.719] IcmpCreateFile () returned 0x7cce18 [0168.719] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76baf8 [0168.719] IcmpSendEcho2 (IcmpHandle=0x7cce18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2c00a8c0, RequestData=0x2bc7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76baf8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2188 os_tid = 0x20c0 [0168.720] GetLastError () returned 0x57 [0168.720] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e9fb8 [0168.721] SetLastError (dwErrCode=0x57) [0168.721] IcmpCreateFile () returned 0x7cce50 [0168.721] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb48 [0168.721] IcmpSendEcho2 (IcmpHandle=0x7cce50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2d00a8c0, RequestData=0x2bdbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb48, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2189 os_tid = 0x20c4 [0168.722] GetLastError () returned 0x57 [0168.722] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea340 [0168.722] SetLastError (dwErrCode=0x57) [0168.722] IcmpCreateFile () returned 0x7cce88 [0168.722] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bb98 [0168.722] IcmpSendEcho2 (IcmpHandle=0x7cce88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2e00a8c0, RequestData=0x2befff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bb98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2190 os_tid = 0x20c8 [0168.724] GetLastError () returned 0x57 [0168.724] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ea6c8 [0168.724] SetLastError (dwErrCode=0x57) [0168.724] IcmpCreateFile () returned 0x7ccec0 [0168.724] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bbe8 [0168.724] IcmpSendEcho2 (IcmpHandle=0x7ccec0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2f00a8c0, RequestData=0x2c03ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bbe8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2191 os_tid = 0x20cc [0168.725] GetLastError () returned 0x57 [0168.725] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eaa50 [0168.726] SetLastError (dwErrCode=0x57) [0168.726] IcmpCreateFile () returned 0x7ccfa0 [0168.726] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba08 [0168.726] IcmpSendEcho2 (IcmpHandle=0x7ccfa0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3000a8c0, RequestData=0x2c17ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2192 os_tid = 0x20d0 [0168.727] GetLastError () returned 0x57 [0168.727] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eadd8 [0168.727] SetLastError (dwErrCode=0x57) [0168.727] IcmpCreateFile () returned 0x7ccfd8 [0168.727] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76ba58 [0168.727] IcmpSendEcho2 (IcmpHandle=0x7ccfd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3100a8c0, RequestData=0x2c2bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76ba58, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2193 os_tid = 0x20d4 [0168.729] GetLastError () returned 0x57 [0168.729] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb160 [0168.729] SetLastError (dwErrCode=0x57) [0168.729] IcmpCreateFile () returned 0x7cd010 [0168.729] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76baa8 [0168.729] IcmpSendEcho2 (IcmpHandle=0x7cd010, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3200a8c0, RequestData=0x2c3fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76baa8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2194 os_tid = 0x20d8 [0168.730] GetLastError () returned 0x57 [0168.730] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb4e8 [0168.731] SetLastError (dwErrCode=0x57) [0168.731] IcmpCreateFile () returned 0x7cd048 [0168.731] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc38 [0168.731] IcmpSendEcho2 (IcmpHandle=0x7cd048, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3300a8c0, RequestData=0x2c53ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc38, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2195 os_tid = 0x20dc [0168.737] GetLastError () returned 0x57 [0168.737] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eb870 [0168.738] SetLastError (dwErrCode=0x57) [0168.738] IcmpCreateFile () returned 0x7cd080 [0168.738] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b788 [0168.738] IcmpSendEcho2 (IcmpHandle=0x7cd080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3400a8c0, RequestData=0x2c67ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b788, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2196 os_tid = 0x20e0 [0168.739] GetLastError () returned 0x57 [0168.739] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ebbf8 [0168.739] SetLastError (dwErrCode=0x57) [0168.739] IcmpCreateFile () returned 0x7cd0b8 [0168.739] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76bc88 [0168.739] IcmpSendEcho2 (IcmpHandle=0x7cd0b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3500a8c0, RequestData=0x2c7bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76bc88, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2197 os_tid = 0x20e4 [0168.740] GetLastError () returned 0x57 [0168.741] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ebf80 [0168.741] SetLastError (dwErrCode=0x57) [0168.741] IcmpCreateFile () returned 0x7cd0f0 [0168.741] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b7d8 [0168.741] IcmpSendEcho2 (IcmpHandle=0x7cd0f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3600a8c0, RequestData=0x2c8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b7d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2198 os_tid = 0x20e8 [0168.742] GetLastError () returned 0x57 [0168.742] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0620 [0168.742] SetLastError (dwErrCode=0x57) [0168.742] IcmpCreateFile () returned 0x7cd128 [0168.742] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b828 [0168.743] IcmpSendEcho2 (IcmpHandle=0x7cd128, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3700a8c0, RequestData=0x2ca3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b828, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2199 os_tid = 0x20f0 [0168.749] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.749] ReadFile (in: hFile=0x4b4, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.482] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.482] ReadFile (in: hFile=0x4b4, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.484] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.485] BCryptSetProperty (in: hObject=0x732020, pszProperty="ChainingMode", pbInput=0xfdf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732020) returned 0x0 [0169.485] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732020, phKey=0xfdf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732020, phKey=0xfdf828, pbKeyObject=0x0) returned 0x0 [0169.485] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xfdf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xfdf500) returned 0x0 [0169.485] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.485] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xfdf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xfdf500) returned 0x0 [0169.490] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.495] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.495] WriteFile (in: hFile=0x4b4, lpBuffer=0xfdfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfdf830, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesWritten=0xfdf830*=0x428, lpOverlapped=0x0) returned 1 [0169.506] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.507] ReadFile (in: hFile=0x4b4, lpBuffer=0x6650000, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesRead=0xfdf61c*=0x8b8, lpOverlapped=0x0) returned 1 [0169.507] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffff748, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.507] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x6650000, cbInput=0x8b8, pPaddingInfo=0x0, pbIV=0xfdf848, cbIV=0x10, pbOutput=0x6650000, cbOutput=0x100000, pcbResult=0xfdf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0xfdf848, pbOutput=0x6650000, pcbResult=0xfdf618) returned 0x0 [0169.507] WriteFile (in: hFile=0x4b4, lpBuffer=0x6650000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesWritten=0xfdf61c*=0x8c0, lpOverlapped=0x0) returned 1 [0169.507] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfdf60c | out: lpNewFilePointer=0x0) returned 1 [0169.507] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.507] WriteFile (in: hFile=0x4b4, lpBuffer=0xfdf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0xfdf83c*, lpNumberOfBytesWritten=0xfdf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.507] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.507] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.507] CloseHandle (hObject=0x4b4) returned 1 [0169.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f80000 [0169.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.play")) returned 1 [0169.784] VirtualFree (lpAddress=0x11f80000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2200 os_tid = 0x20f4 [0168.751] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0168.754] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0168.754] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0xb04f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0168.754] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0xb04f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0xb04f828, pbKeyObject=0x0) returned 0x0 [0168.754] BCryptExportKey (in: hKey=0x1a6d8590, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xb04f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xb04f500) returned 0x0 [0168.754] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0168.754] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xb04f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xb04f500) returned 0x0 [0168.759] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.763] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.764] WriteFile (in: hFile=0x614, lpBuffer=0xb04fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb04f830, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesWritten=0xb04f830*=0x428, lpOverlapped=0x0) returned 1 [0169.481] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.481] ReadFile (in: hFile=0x614, lpBuffer=0x2850000, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0xb04f61c*=0x402, lpOverlapped=0x0) returned 1 [0169.481] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbfe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.481] BCryptEncrypt (in: hKey=0x1a6d8590, pbInput=0x2850000, cbInput=0x402, pPaddingInfo=0x0, pbIV=0xb04f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0xb04f618, dwFlags=0x1 | out: hKey=0x1a6d8590, pbIV=0xb04f848, pbOutput=0x2850000, pcbResult=0xb04f618) returned 0x0 [0169.481] WriteFile (in: hFile=0x614, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0xb04f61c*=0x410, lpOverlapped=0x0) returned 1 [0169.481] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb04f60c | out: lpNewFilePointer=0x0) returned 1 [0169.481] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.481] WriteFile (in: hFile=0x614, lpBuffer=0xb04f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0xb04f83c*, lpNumberOfBytesWritten=0xb04f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.481] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.482] BCryptDestroyKey (in: hKey=0x1a6d8590 | out: hKey=0x1a6d8590) returned 0x0 [0169.482] CloseHandle (hObject=0x614) returned 1 [0169.655] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f70000 [0169.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.play")) returned 1 [0169.787] VirtualFree (lpAddress=0x11f70000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2201 os_tid = 0x20f8 [0168.765] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.765] ReadFile (in: hFile=0x16ec, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.466] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.466] ReadFile (in: hFile=0x16ec, lpBuffer=0xf70fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf70f85c, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesRead=0xf70f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.466] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.469] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.469] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xf70f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0169.469] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xf70f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xf70f828, pbKeyObject=0x0) returned 0x0 [0169.469] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xf70f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xf70f500) returned 0x0 [0169.469] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.469] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xf70f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xf70f500) returned 0x0 [0169.474] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.477] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.477] WriteFile (in: hFile=0x16ec, lpBuffer=0xf70fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf70f830, lpOverlapped=0x0 | out: lpBuffer=0xf70fb34*, lpNumberOfBytesWritten=0xf70f830*=0x428, lpOverlapped=0x0) returned 1 [0169.479] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.479] ReadFile (in: hFile=0x16ec, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xf70f61c*=0xcd6, lpOverlapped=0x0) returned 1 [0169.479] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffff32a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.479] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x2a50000, cbInput=0xcd6, pPaddingInfo=0x0, pbIV=0xf70f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xf70f618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0xf70f848, pbOutput=0x2a50000, pcbResult=0xf70f618) returned 0x0 [0169.479] WriteFile (in: hFile=0x16ec, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xf70f61c*=0xce0, lpOverlapped=0x0) returned 1 [0169.479] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf70f60c | out: lpNewFilePointer=0x0) returned 1 [0169.479] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.479] WriteFile (in: hFile=0x16ec, lpBuffer=0xf70f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf70f61c, lpOverlapped=0x0 | out: lpBuffer=0xf70f83c*, lpNumberOfBytesWritten=0xf70f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.479] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.479] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.480] CloseHandle (hObject=0x16ec) returned 1 [0169.653] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f60000 [0169.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.play")) returned 1 [0169.790] VirtualFree (lpAddress=0x11f60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2202 os_tid = 0x20fc [0168.767] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.767] ReadFile (in: hFile=0x16f4, lpBuffer=0xf84fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf84f85c, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesRead=0xf84f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.454] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.456] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.456] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0xf84f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0169.456] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0xf84f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0xf84f828, pbKeyObject=0x0) returned 0x0 [0169.456] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xf84f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xf84f500) returned 0x0 [0169.456] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.457] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xf84f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xf84f500) returned 0x0 [0169.461] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.464] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.464] WriteFile (in: hFile=0x16f4, lpBuffer=0xf84fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf84f830, lpOverlapped=0x0 | out: lpBuffer=0xf84fb34*, lpNumberOfBytesWritten=0xf84f830*=0x428, lpOverlapped=0x0) returned 1 [0169.465] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.465] ReadFile (in: hFile=0x16f4, lpBuffer=0x3250000, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0xf84f61c*=0x7a8, lpOverlapped=0x0) returned 1 [0169.465] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0xfffff858, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.465] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x3250000, cbInput=0x7a8, pPaddingInfo=0x0, pbIV=0xf84f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0xf84f618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0xf84f848, pbOutput=0x3250000, pcbResult=0xf84f618) returned 0x0 [0169.466] WriteFile (in: hFile=0x16f4, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0xf84f61c*=0x7b0, lpOverlapped=0x0) returned 1 [0169.466] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf84f60c | out: lpNewFilePointer=0x0) returned 1 [0169.466] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.466] WriteFile (in: hFile=0x16f4, lpBuffer=0xf84f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf84f61c, lpOverlapped=0x0 | out: lpBuffer=0xf84f83c*, lpNumberOfBytesWritten=0xf84f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.466] SetFilePointerEx (in: hFile=0x16f4, liDistanceToMove=0x7b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.466] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.466] CloseHandle (hObject=0x16f4) returned 1 [0169.650] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f50000 [0169.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.play")) returned 1 [0169.794] VirtualFree (lpAddress=0x11f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2203 os_tid = 0x2100 [0168.768] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.768] ReadFile (in: hFile=0x16fc, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.441] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.441] ReadFile (in: hFile=0x16fc, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.441] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.443] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.444] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x20dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0169.444] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x20dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x20dbf828, pbKeyObject=0x0) returned 0x0 [0169.444] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x20dbf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x20dbf500) returned 0x0 [0169.444] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.444] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x20dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x20dbf500) returned 0x0 [0169.449] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.452] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.452] WriteFile (in: hFile=0x16fc, lpBuffer=0x20dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20dbf830, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesWritten=0x20dbf830*=0x428, lpOverlapped=0x0) returned 1 [0169.453] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.453] ReadFile (in: hFile=0x16fc, lpBuffer=0x3450000, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x20dbf61c*=0xe4e, lpOverlapped=0x0) returned 1 [0169.453] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfffff1b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.453] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x3450000, cbInput=0xe4e, pPaddingInfo=0x0, pbIV=0x20dbf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x20dbf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x20dbf848, pbOutput=0x3450000, pcbResult=0x20dbf618) returned 0x0 [0169.453] WriteFile (in: hFile=0x16fc, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x20dbf61c*=0xe50, lpOverlapped=0x0) returned 1 [0169.453] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20dbf60c | out: lpNewFilePointer=0x0) returned 1 [0169.453] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.453] WriteFile (in: hFile=0x16fc, lpBuffer=0x20dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20dbf83c*, lpNumberOfBytesWritten=0x20dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.453] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xe50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.453] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.454] CloseHandle (hObject=0x16fc) returned 1 [0169.648] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f40000 [0169.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.play")) returned 1 [0169.797] VirtualFree (lpAddress=0x11f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2204 os_tid = 0x2104 [0168.770] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.770] ReadFile (in: hFile=0x1704, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.429] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.429] ReadFile (in: hFile=0x1704, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.431] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x20fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0169.432] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x20fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x20fbf828, pbKeyObject=0x0) returned 0x0 [0169.432] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x20fbf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x20fbf500) returned 0x0 [0169.432] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.432] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x20fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x20fbf500) returned 0x0 [0169.437] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.439] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.439] WriteFile (in: hFile=0x1704, lpBuffer=0x20fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20fbf830, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesWritten=0x20fbf830*=0x428, lpOverlapped=0x0) returned 1 [0169.440] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.440] ReadFile (in: hFile=0x1704, lpBuffer=0x3850000, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x20fbf61c*=0xbc8, lpOverlapped=0x0) returned 1 [0169.440] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0xfffff438, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.440] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x3850000, cbInput=0xbc8, pPaddingInfo=0x0, pbIV=0x20fbf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x20fbf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x20fbf848, pbOutput=0x3850000, pcbResult=0x20fbf618) returned 0x0 [0169.440] WriteFile (in: hFile=0x1704, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x20fbf61c*=0xbd0, lpOverlapped=0x0) returned 1 [0169.441] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20fbf60c | out: lpNewFilePointer=0x0) returned 1 [0169.441] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.441] WriteFile (in: hFile=0x1704, lpBuffer=0x20fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20fbf83c*, lpNumberOfBytesWritten=0x20fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.441] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0xbd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.441] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.441] CloseHandle (hObject=0x1704) returned 1 [0169.645] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f30000 [0169.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.play")) returned 1 [0169.800] VirtualFree (lpAddress=0x11f30000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2205 os_tid = 0x2108 [0168.772] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.772] ReadFile (in: hFile=0x170c, lpBuffer=0x28f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x28f3fb34*, lpNumberOfBytesRead=0x28f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.417] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.419] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.420] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x28f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0169.420] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x28f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x28f3f828, pbKeyObject=0x0) returned 0x0 [0169.420] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x28f3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x28f3f500) returned 0x0 [0169.420] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.420] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x28f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x28f3f500) returned 0x0 [0169.425] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.427] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.427] WriteFile (in: hFile=0x170c, lpBuffer=0x28f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28f3f830, lpOverlapped=0x0 | out: lpBuffer=0x28f3fb34*, lpNumberOfBytesWritten=0x28f3f830*=0x428, lpOverlapped=0x0) returned 1 [0169.428] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.428] ReadFile (in: hFile=0x170c, lpBuffer=0x4550000, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x28f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x28f3f61c*=0x5f8, lpOverlapped=0x0) returned 1 [0169.428] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffa08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.428] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x4550000, cbInput=0x5f8, pPaddingInfo=0x0, pbIV=0x28f3f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x28f3f618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x28f3f848, pbOutput=0x4550000, pcbResult=0x28f3f618) returned 0x0 [0169.428] WriteFile (in: hFile=0x170c, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x28f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x28f3f61c*=0x600, lpOverlapped=0x0) returned 1 [0169.428] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28f3f60c | out: lpNewFilePointer=0x0) returned 1 [0169.428] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.429] WriteFile (in: hFile=0x170c, lpBuffer=0x28f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x28f3f83c*, lpNumberOfBytesWritten=0x28f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.429] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.429] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.429] CloseHandle (hObject=0x170c) returned 1 [0169.643] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f20000 [0169.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.play")) returned 1 [0169.804] VirtualFree (lpAddress=0x11f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2206 os_tid = 0x210c [0168.773] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.773] ReadFile (in: hFile=0x1714, lpBuffer=0x291bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x291bf85c, lpOverlapped=0x0 | out: lpBuffer=0x291bfb34*, lpNumberOfBytesRead=0x291bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.404] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.404] ReadFile (in: hFile=0x1714, lpBuffer=0x291bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x291bf85c, lpOverlapped=0x0 | out: lpBuffer=0x291bfb34*, lpNumberOfBytesRead=0x291bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.404] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.406] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.406] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x291bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0169.407] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x291bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x291bf828, pbKeyObject=0x0) returned 0x0 [0169.407] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x291bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x291bf500) returned 0x0 [0169.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.407] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x291bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x291bf500) returned 0x0 [0169.412] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.415] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.415] WriteFile (in: hFile=0x1714, lpBuffer=0x291bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x291bf830, lpOverlapped=0x0 | out: lpBuffer=0x291bfb34*, lpNumberOfBytesWritten=0x291bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.416] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.416] ReadFile (in: hFile=0x1714, lpBuffer=0x4750000, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x291bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x291bf61c*=0xce2, lpOverlapped=0x0) returned 1 [0169.416] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0xfffff31e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.416] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x4750000, cbInput=0xce2, pPaddingInfo=0x0, pbIV=0x291bf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x291bf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x291bf848, pbOutput=0x4750000, pcbResult=0x291bf618) returned 0x0 [0169.416] WriteFile (in: hFile=0x1714, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x291bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x291bf61c*=0xcf0, lpOverlapped=0x0) returned 1 [0169.416] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x291bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.416] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.416] WriteFile (in: hFile=0x1714, lpBuffer=0x291bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x291bf61c, lpOverlapped=0x0 | out: lpBuffer=0x291bf83c*, lpNumberOfBytesWritten=0x291bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.416] SetFilePointerEx (in: hFile=0x1714, liDistanceToMove=0xcf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.417] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0169.417] CloseHandle (hObject=0x1714) returned 1 [0169.641] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f10000 [0169.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.play")) returned 1 [0169.807] VirtualFree (lpAddress=0x11f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2207 os_tid = 0x2110 [0168.775] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0168.778] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0168.778] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x2ccbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0168.778] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x2ccbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x2ccbf828, pbKeyObject=0x0) returned 0x0 [0168.778] BCryptExportKey (in: hKey=0x1a6d8820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ccbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ccbf500) returned 0x0 [0168.778] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0168.778] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ccbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ccbf500) returned 0x0 [0168.783] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.786] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.786] WriteFile (in: hFile=0x171c, lpBuffer=0x2ccbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ccbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ccbfb34*, lpNumberOfBytesWritten=0x2ccbf830*=0x428, lpOverlapped=0x0) returned 1 [0169.403] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.403] ReadFile (in: hFile=0x171c, lpBuffer=0x4850000, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x2ccbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x2ccbf61c*=0x332, lpOverlapped=0x0) returned 1 [0169.403] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0xfffffcce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.403] BCryptEncrypt (in: hKey=0x1a6d8820, pbInput=0x4850000, cbInput=0x332, pPaddingInfo=0x0, pbIV=0x2ccbf848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x2ccbf618, dwFlags=0x1 | out: hKey=0x1a6d8820, pbIV=0x2ccbf848, pbOutput=0x4850000, pcbResult=0x2ccbf618) returned 0x0 [0169.403] WriteFile (in: hFile=0x171c, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ccbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x2ccbf61c*=0x340, lpOverlapped=0x0) returned 1 [0169.403] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccbf60c | out: lpNewFilePointer=0x0) returned 1 [0169.403] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.403] WriteFile (in: hFile=0x171c, lpBuffer=0x2ccbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ccbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ccbf83c*, lpNumberOfBytesWritten=0x2ccbf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.403] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.404] BCryptDestroyKey (in: hKey=0x1a6d8820 | out: hKey=0x1a6d8820) returned 0x0 [0169.404] CloseHandle (hObject=0x171c) returned 1 [0169.638] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11f00000 [0169.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.play")) returned 1 [0169.813] VirtualFree (lpAddress=0x11f00000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2208 os_tid = 0x2114 [0168.788] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.788] ReadFile (in: hFile=0x13d4, lpBuffer=0xb34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb34f85c, lpOverlapped=0x0 | out: lpBuffer=0xb34fb34*, lpNumberOfBytesRead=0xb34f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.387] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.387] ReadFile (in: hFile=0x13d4, lpBuffer=0xb34fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb34f85c, lpOverlapped=0x0 | out: lpBuffer=0xb34fb34*, lpNumberOfBytesRead=0xb34f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.387] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.390] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.390] BCryptSetProperty (in: hObject=0x732a70, pszProperty="ChainingMode", pbInput=0xb34f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732a70) returned 0x0 [0169.390] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732a70, phKey=0xb34f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732a70, phKey=0xb34f828, pbKeyObject=0x0) returned 0x0 [0169.390] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0xb34f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0xb34f500) returned 0x0 [0169.390] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.390] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0xb34f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0xb34f500) returned 0x0 [0169.395] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.398] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.398] WriteFile (in: hFile=0x13d4, lpBuffer=0xb34fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb34f830, lpOverlapped=0x0 | out: lpBuffer=0xb34fb34*, lpNumberOfBytesWritten=0xb34f830*=0x428, lpOverlapped=0x0) returned 1 [0169.399] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.399] ReadFile (in: hFile=0x13d4, lpBuffer=0x6750000, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0xb34f61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesRead=0xb34f61c*=0x3960, lpOverlapped=0x0) returned 1 [0169.605] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xffffc6a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.605] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6750000, cbInput=0x3960, pPaddingInfo=0x0, pbIV=0xb34f848, cbIV=0x10, pbOutput=0x6750000, cbOutput=0x100000, pcbResult=0xb34f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xb34f848, pbOutput=0x6750000, pcbResult=0xb34f618) returned 0x0 [0169.605] WriteFile (in: hFile=0x13d4, lpBuffer=0x6750000*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0xb34f61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesWritten=0xb34f61c*=0x3970, lpOverlapped=0x0) returned 1 [0169.605] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb34f60c | out: lpNewFilePointer=0x0) returned 1 [0169.605] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.605] WriteFile (in: hFile=0x13d4, lpBuffer=0xb34f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb34f61c, lpOverlapped=0x0 | out: lpBuffer=0xb34f83c*, lpNumberOfBytesWritten=0xb34f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.605] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x3970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.605] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0169.605] CloseHandle (hObject=0x13d4) returned 1 [0169.698] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x211e0000 [0169.700] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.play")) returned 1 [0169.706] VirtualFree (lpAddress=0x211e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2209 os_tid = 0x2118 [0168.789] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.790] ReadFile (in: hFile=0x134c, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.401] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.401] ReadFile (in: hFile=0x134c, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.606] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf8d0000 [0169.608] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf8d0000) returned 0x0 [0169.608] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x2097f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0169.609] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x2097f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf8d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x2097f828, pbKeyObject=0x0) returned 0x0 [0169.609] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf8d0000, cbOutput=0x230, pcbResult=0x2097f500, dwFlags=0x0 | out: pbOutput=0xf8d0000, pcbResult=0x2097f500) returned 0x0 [0169.609] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf8d0230) returned 0x0 [0169.609] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf8d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf8d0000, cbOutput=0x400, pcbResult=0x2097f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf8d0000, pcbResult=0x2097f500) returned 0x0 [0169.614] VirtualFree (lpAddress=0xf8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.617] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.617] WriteFile (in: hFile=0x134c, lpBuffer=0x2097fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2097f830, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesWritten=0x2097f830*=0x428, lpOverlapped=0x0) returned 1 [0169.618] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.618] ReadFile (in: hFile=0x134c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x2097f61c*=0x34e2, lpOverlapped=0x0) returned 1 [0169.711] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xffffcb1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.711] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2b50000, cbInput=0x34e2, pPaddingInfo=0x0, pbIV=0x2097f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x2097f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2097f848, pbOutput=0x2b50000, pcbResult=0x2097f618) returned 0x0 [0169.711] WriteFile (in: hFile=0x134c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x2097f61c*=0x34f0, lpOverlapped=0x0) returned 1 [0169.711] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2097f60c | out: lpNewFilePointer=0x0) returned 1 [0169.712] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.712] WriteFile (in: hFile=0x134c, lpBuffer=0x2097f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x2097f83c*, lpNumberOfBytesWritten=0x2097f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.712] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x34f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.712] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0169.712] CloseHandle (hObject=0x134c) returned 1 [0169.721] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb060000 [0169.723] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.play")) returned 1 [0169.726] VirtualFree (lpAddress=0xb060000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2210 os_tid = 0x211c [0168.791] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.791] ReadFile (in: hFile=0x1100, lpBuffer=0x2953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2953f85c, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesRead=0x2953f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.161] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.161] ReadFile (in: hFile=0x1100, lpBuffer=0x2953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2953f85c, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesRead=0x2953f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.537] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf8d0000 [0169.539] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf8d0000) returned 0x0 [0169.539] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2953f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0169.539] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2953f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf8d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2953f828, pbKeyObject=0x0) returned 0x0 [0169.539] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf8d0000, cbOutput=0x230, pcbResult=0x2953f500, dwFlags=0x0 | out: pbOutput=0xf8d0000, pcbResult=0x2953f500) returned 0x0 [0169.540] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf8d0230) returned 0x0 [0169.540] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf8d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf8d0000, cbOutput=0x400, pcbResult=0x2953f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf8d0000, pcbResult=0x2953f500) returned 0x0 [0169.545] VirtualFree (lpAddress=0xf8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.548] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.548] WriteFile (in: hFile=0x1100, lpBuffer=0x2953fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2953f830, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesWritten=0x2953f830*=0x428, lpOverlapped=0x0) returned 1 [0169.549] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.549] ReadFile (in: hFile=0x1100, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2953f61c*=0x16a6, lpOverlapped=0x0) returned 1 [0169.549] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xffffe95a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.550] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x2d50000, cbInput=0x16a6, pPaddingInfo=0x0, pbIV=0x2953f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2953f618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x2953f848, pbOutput=0x2d50000, pcbResult=0x2953f618) returned 0x0 [0169.550] WriteFile (in: hFile=0x1100, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2953f61c*=0x16b0, lpOverlapped=0x0) returned 1 [0169.550] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2953f60c | out: lpNewFilePointer=0x0) returned 1 [0169.550] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.550] WriteFile (in: hFile=0x1100, lpBuffer=0x2953f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x2953f83c*, lpNumberOfBytesWritten=0x2953f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.550] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x16b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.550] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0169.550] CloseHandle (hObject=0x1100) returned 1 [0169.664] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11fb0000 [0169.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.play")) returned 1 [0169.773] VirtualFree (lpAddress=0x11fb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2211 os_tid = 0x2120 [0168.793] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.793] ReadFile (in: hFile=0x1728, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.152] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.152] ReadFile (in: hFile=0x1728, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.152] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.153] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.154] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x29a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0169.154] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x29a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x29a3f828, pbKeyObject=0x0) returned 0x0 [0169.154] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x29a3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x29a3f500) returned 0x0 [0169.154] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.154] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x29a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x29a3f500) returned 0x0 [0169.157] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.160] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.160] WriteFile (in: hFile=0x1728, lpBuffer=0x29a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29a3f830, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesWritten=0x29a3f830*=0x428, lpOverlapped=0x0) returned 1 [0169.160] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.160] ReadFile (in: hFile=0x1728, lpBuffer=0x3050000, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x29a3f61c*=0xe86, lpOverlapped=0x0) returned 1 [0169.161] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0xfffff17a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.161] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3050000, cbInput=0xe86, pPaddingInfo=0x0, pbIV=0x29a3f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x29a3f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x29a3f848, pbOutput=0x3050000, pcbResult=0x29a3f618) returned 0x0 [0169.161] WriteFile (in: hFile=0x1728, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x29a3f61c*=0xe90, lpOverlapped=0x0) returned 1 [0169.161] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29a3f60c | out: lpNewFilePointer=0x0) returned 1 [0169.161] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.161] WriteFile (in: hFile=0x1728, lpBuffer=0x29a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29a3f83c*, lpNumberOfBytesWritten=0x29a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.161] SetFilePointerEx (in: hFile=0x1728, liDistanceToMove=0xe90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.161] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0169.161] CloseHandle (hObject=0x1728) returned 1 [0169.527] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb090000 [0169.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.play")) returned 1 [0169.866] VirtualFree (lpAddress=0xb090000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2212 os_tid = 0x2124 [0168.795] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.795] ReadFile (in: hFile=0x1730, lpBuffer=0x2cdbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cdbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2cdbfb34*, lpNumberOfBytesRead=0x2cdbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.142] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.144] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.144] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x2cdbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0169.144] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x2cdbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x2cdbf828, pbKeyObject=0x0) returned 0x0 [0169.144] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2cdbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2cdbf500) returned 0x0 [0169.144] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.144] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2cdbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2cdbf500) returned 0x0 [0169.148] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.150] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.150] WriteFile (in: hFile=0x1730, lpBuffer=0x2cdbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2cdbf830, lpOverlapped=0x0 | out: lpBuffer=0x2cdbfb34*, lpNumberOfBytesWritten=0x2cdbf830*=0x428, lpOverlapped=0x0) returned 1 [0169.150] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.150] ReadFile (in: hFile=0x1730, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x2cdbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x2cdbf61c*=0x5bc, lpOverlapped=0x0) returned 1 [0169.151] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0xfffffa44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.151] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4a50000, cbInput=0x5bc, pPaddingInfo=0x0, pbIV=0x2cdbf848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x2cdbf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2cdbf848, pbOutput=0x4a50000, pcbResult=0x2cdbf618) returned 0x0 [0169.151] WriteFile (in: hFile=0x1730, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2cdbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x2cdbf61c*=0x5c0, lpOverlapped=0x0) returned 1 [0169.151] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cdbf60c | out: lpNewFilePointer=0x0) returned 1 [0169.151] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.151] WriteFile (in: hFile=0x1730, lpBuffer=0x2cdbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cdbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2cdbf83c*, lpNumberOfBytesWritten=0x2cdbf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.151] SetFilePointerEx (in: hFile=0x1730, liDistanceToMove=0x5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.151] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.151] CloseHandle (hObject=0x1730) returned 1 [0169.524] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0169.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.play")) returned 1 [0169.874] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2213 os_tid = 0x2128 [0168.796] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.796] ReadFile (in: hFile=0x10c0, lpBuffer=0x29cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x29cbfb34*, lpNumberOfBytesRead=0x29cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.370] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.372] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.373] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x29cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0169.373] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x29cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x29cbf828, pbKeyObject=0x0) returned 0x0 [0169.373] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x29cbf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x29cbf500) returned 0x0 [0169.373] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.373] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x29cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x29cbf500) returned 0x0 [0169.378] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.380] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.381] WriteFile (in: hFile=0x10c0, lpBuffer=0x29cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29cbf830, lpOverlapped=0x0 | out: lpBuffer=0x29cbfb34*, lpNumberOfBytesWritten=0x29cbf830*=0x428, lpOverlapped=0x0) returned 1 [0169.381] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.381] ReadFile (in: hFile=0x10c0, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x29cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x29cbf61c*=0x578, lpOverlapped=0x0) returned 1 [0169.381] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffffa88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.382] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4e50000, cbInput=0x578, pPaddingInfo=0x0, pbIV=0x29cbf848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x29cbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29cbf848, pbOutput=0x4e50000, pcbResult=0x29cbf618) returned 0x0 [0169.382] WriteFile (in: hFile=0x10c0, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x29cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x29cbf61c*=0x580, lpOverlapped=0x0) returned 1 [0169.382] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29cbf60c | out: lpNewFilePointer=0x0) returned 1 [0169.382] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.382] WriteFile (in: hFile=0x10c0, lpBuffer=0x29cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x29cbf83c*, lpNumberOfBytesWritten=0x29cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.387] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.387] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0169.387] CloseHandle (hObject=0x10c0) returned 1 [0169.635] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11ef0000 [0169.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.play")) returned 1 [0169.816] VirtualFree (lpAddress=0x11ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2214 os_tid = 0x212c [0168.798] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.798] ReadFile (in: hFile=0x1738, lpBuffer=0x29b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesRead=0x29b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.357] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.357] ReadFile (in: hFile=0x1738, lpBuffer=0x29b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesRead=0x29b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.357] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.360] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x29b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0169.360] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x29b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x29b3f828, pbKeyObject=0x0) returned 0x0 [0169.360] BCryptExportKey (in: hKey=0x7f1260, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x29b3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x29b3f500) returned 0x0 [0169.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.361] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x29b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x29b3f500) returned 0x0 [0169.365] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.368] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.368] WriteFile (in: hFile=0x1738, lpBuffer=0x29b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29b3f830, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesWritten=0x29b3f830*=0x428, lpOverlapped=0x0) returned 1 [0169.369] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.369] ReadFile (in: hFile=0x1738, lpBuffer=0x5050000, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x29b3f61c*=0x3158, lpOverlapped=0x0) returned 1 [0169.603] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0xffffcea8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.603] BCryptEncrypt (in: hKey=0x7f1260, pbInput=0x5050000, cbInput=0x3158, pPaddingInfo=0x0, pbIV=0x29b3f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x29b3f618, dwFlags=0x1 | out: hKey=0x7f1260, pbIV=0x29b3f848, pbOutput=0x5050000, pcbResult=0x29b3f618) returned 0x0 [0169.603] WriteFile (in: hFile=0x1738, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x29b3f61c*=0x3160, lpOverlapped=0x0) returned 1 [0169.604] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29b3f60c | out: lpNewFilePointer=0x0) returned 1 [0169.604] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.604] WriteFile (in: hFile=0x1738, lpBuffer=0x29b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29b3f83c*, lpNumberOfBytesWritten=0x29b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.604] SetFilePointerEx (in: hFile=0x1738, liDistanceToMove=0x3160, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.604] BCryptDestroyKey (in: hKey=0x7f1260 | out: hKey=0x7f1260) returned 0x0 [0169.604] CloseHandle (hObject=0x1738) returned 1 [0169.696] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x211d0000 [0169.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.play")) returned 1 [0169.731] VirtualFree (lpAddress=0x211d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2215 os_tid = 0x2130 [0168.799] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.800] ReadFile (in: hFile=0x1740, lpBuffer=0x2cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x2cebfb34*, lpNumberOfBytesRead=0x2cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.344] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.344] ReadFile (in: hFile=0x1740, lpBuffer=0x2cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x2cebfb34*, lpNumberOfBytesRead=0x2cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.344] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.347] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.347] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x2cebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0169.347] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x2cebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x2cebf828, pbKeyObject=0x0) returned 0x0 [0169.347] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2cebf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2cebf500) returned 0x0 [0169.347] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.347] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2cebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2cebf500) returned 0x0 [0169.352] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.355] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.356] WriteFile (in: hFile=0x1740, lpBuffer=0x2cebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2cebf830, lpOverlapped=0x0 | out: lpBuffer=0x2cebfb34*, lpNumberOfBytesWritten=0x2cebf830*=0x428, lpOverlapped=0x0) returned 1 [0169.356] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.357] ReadFile (in: hFile=0x1740, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x2cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x2cebf61c*=0x2994, lpOverlapped=0x0) returned 1 [0169.602] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xffffd66c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.602] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x4f50000, cbInput=0x2994, pPaddingInfo=0x0, pbIV=0x2cebf848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x2cebf618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x2cebf848, pbOutput=0x4f50000, pcbResult=0x2cebf618) returned 0x0 [0169.602] WriteFile (in: hFile=0x1740, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x2cebf61c*=0x29a0, lpOverlapped=0x0) returned 1 [0169.603] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cebf60c | out: lpNewFilePointer=0x0) returned 1 [0169.603] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.603] WriteFile (in: hFile=0x1740, lpBuffer=0x2cebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x2cebf83c*, lpNumberOfBytesWritten=0x2cebf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.603] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x29a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.603] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0169.603] CloseHandle (hObject=0x1740) returned 1 [0169.693] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x211c0000 [0169.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.play")) returned 1 [0169.735] VirtualFree (lpAddress=0x211c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2216 os_tid = 0x2134 [0168.801] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.801] ReadFile (in: hFile=0x1748, lpBuffer=0x2cfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2cfbfb34*, lpNumberOfBytesRead=0x2cfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.313] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.313] ReadFile (in: hFile=0x1748, lpBuffer=0x2cfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2cfbfb34*, lpNumberOfBytesRead=0x2cfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.313] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.316] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.316] BCryptSetProperty (in: hObject=0x732bd0, pszProperty="ChainingMode", pbInput=0x2cfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732bd0) returned 0x0 [0169.316] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732bd0, phKey=0x2cfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732bd0, phKey=0x2cfbf828, pbKeyObject=0x0) returned 0x0 [0169.316] BCryptExportKey (in: hKey=0x1a6d8fb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2cfbf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2cfbf500) returned 0x0 [0169.316] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.316] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2cfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2cfbf500) returned 0x0 [0169.321] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.342] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.342] WriteFile (in: hFile=0x1748, lpBuffer=0x2cfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2cfbf830, lpOverlapped=0x0 | out: lpBuffer=0x2cfbfb34*, lpNumberOfBytesWritten=0x2cfbf830*=0x428, lpOverlapped=0x0) returned 1 [0169.343] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.343] ReadFile (in: hFile=0x1748, lpBuffer=0x6850000, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x2cfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesRead=0x2cfbf61c*=0x844, lpOverlapped=0x0) returned 1 [0169.343] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffff7bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.343] BCryptEncrypt (in: hKey=0x1a6d8fb0, pbInput=0x6850000, cbInput=0x844, pPaddingInfo=0x0, pbIV=0x2cfbf848, cbIV=0x10, pbOutput=0x6850000, cbOutput=0x100000, pcbResult=0x2cfbf618, dwFlags=0x1 | out: hKey=0x1a6d8fb0, pbIV=0x2cfbf848, pbOutput=0x6850000, pcbResult=0x2cfbf618) returned 0x0 [0169.343] WriteFile (in: hFile=0x1748, lpBuffer=0x6850000*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2cfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesWritten=0x2cfbf61c*=0x850, lpOverlapped=0x0) returned 1 [0169.343] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cfbf60c | out: lpNewFilePointer=0x0) returned 1 [0169.343] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.343] WriteFile (in: hFile=0x1748, lpBuffer=0x2cfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2cfbf83c*, lpNumberOfBytesWritten=0x2cfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.343] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.343] BCryptDestroyKey (in: hKey=0x1a6d8fb0 | out: hKey=0x1a6d8fb0) returned 0x0 [0169.343] CloseHandle (hObject=0x1748) returned 1 [0169.633] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11ee0000 [0169.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.play")) returned 1 [0169.820] VirtualFree (lpAddress=0x11ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2217 os_tid = 0x2138 [0168.803] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.803] ReadFile (in: hFile=0x1750, lpBuffer=0x2d0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d0bfb34*, lpNumberOfBytesRead=0x2d0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.132] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.134] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.134] BCryptSetProperty (in: hObject=0x733200, pszProperty="ChainingMode", pbInput=0x2d0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733200) returned 0x0 [0169.134] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733200, phKey=0x2d0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733200, phKey=0x2d0bf828, pbKeyObject=0x0) returned 0x0 [0169.134] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d0bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d0bf500) returned 0x0 [0169.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.135] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d0bf500) returned 0x0 [0169.138] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.140] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.140] WriteFile (in: hFile=0x1750, lpBuffer=0x2d0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d0bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d0bfb34*, lpNumberOfBytesWritten=0x2d0bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.141] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.141] ReadFile (in: hFile=0x1750, lpBuffer=0x6950000, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x2d0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesRead=0x2d0bf61c*=0x620, lpOverlapped=0x0) returned 1 [0169.141] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0xfffff9e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.141] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x6950000, cbInput=0x620, pPaddingInfo=0x0, pbIV=0x2d0bf848, cbIV=0x10, pbOutput=0x6950000, cbOutput=0x100000, pcbResult=0x2d0bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2d0bf848, pbOutput=0x6950000, pcbResult=0x2d0bf618) returned 0x0 [0169.141] WriteFile (in: hFile=0x1750, lpBuffer=0x6950000*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2d0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesWritten=0x2d0bf61c*=0x630, lpOverlapped=0x0) returned 1 [0169.142] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.142] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.142] WriteFile (in: hFile=0x1750, lpBuffer=0x2d0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d0bf83c*, lpNumberOfBytesWritten=0x2d0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.142] SetFilePointerEx (in: hFile=0x1750, liDistanceToMove=0x630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.142] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.142] CloseHandle (hObject=0x1750) returned 1 [0169.162] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0169.164] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.play")) returned 1 [0169.880] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2218 os_tid = 0x213c [0168.805] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.805] ReadFile (in: hFile=0x1758, lpBuffer=0x2d1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d1ffb34*, lpNumberOfBytesRead=0x2d1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.300] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.300] ReadFile (in: hFile=0x1758, lpBuffer=0x2d1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d1ffb34*, lpNumberOfBytesRead=0x2d1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.303] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.303] BCryptSetProperty (in: hObject=0x731cb0, pszProperty="ChainingMode", pbInput=0x2d1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731cb0) returned 0x0 [0169.303] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731cb0, phKey=0x2d1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731cb0, phKey=0x2d1ff828, pbKeyObject=0x0) returned 0x0 [0169.303] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d1ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d1ff500) returned 0x0 [0169.303] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.303] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d1ff500) returned 0x0 [0169.308] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.311] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.311] WriteFile (in: hFile=0x1758, lpBuffer=0x2d1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d1ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d1ffb34*, lpNumberOfBytesWritten=0x2d1ff830*=0x428, lpOverlapped=0x0) returned 1 [0169.312] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.312] ReadFile (in: hFile=0x1758, lpBuffer=0x6a50000, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x2d1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesRead=0x2d1ff61c*=0x2ce2, lpOverlapped=0x0) returned 1 [0169.601] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xffffd31e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.601] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x6a50000, cbInput=0x2ce2, pPaddingInfo=0x0, pbIV=0x2d1ff848, cbIV=0x10, pbOutput=0x6a50000, cbOutput=0x100000, pcbResult=0x2d1ff618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x2d1ff848, pbOutput=0x6a50000, pcbResult=0x2d1ff618) returned 0x0 [0169.601] WriteFile (in: hFile=0x1758, lpBuffer=0x6a50000*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesWritten=0x2d1ff61c*=0x2cf0, lpOverlapped=0x0) returned 1 [0169.602] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1ff60c | out: lpNewFilePointer=0x0) returned 1 [0169.602] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.602] WriteFile (in: hFile=0x1758, lpBuffer=0x2d1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d1ff83c*, lpNumberOfBytesWritten=0x2d1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0169.602] SetFilePointerEx (in: hFile=0x1758, liDistanceToMove=0x2cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.602] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0169.602] CloseHandle (hObject=0x1758) returned 1 [0169.690] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bf0000 [0169.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.play")) returned 1 [0169.738] VirtualFree (lpAddress=0x17bf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2219 os_tid = 0x2140 [0168.806] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.807] ReadFile (in: hFile=0x1760, lpBuffer=0x2d33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d33fb34*, lpNumberOfBytesRead=0x2d33f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.300] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.300] ReadFile (in: hFile=0x1760, lpBuffer=0x2d33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d33fb34*, lpNumberOfBytesRead=0x2d33f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.582] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf8d0000 [0169.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf8d0000) returned 0x0 [0169.585] BCryptSetProperty (in: hObject=0x732230, pszProperty="ChainingMode", pbInput=0x2d33f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732230) returned 0x0 [0169.585] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732230, phKey=0x2d33f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf8d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732230, phKey=0x2d33f828, pbKeyObject=0x0) returned 0x0 [0169.585] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf8d0000, cbOutput=0x230, pcbResult=0x2d33f500, dwFlags=0x0 | out: pbOutput=0xf8d0000, pcbResult=0x2d33f500) returned 0x0 [0169.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf8d0230) returned 0x0 [0169.585] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf8d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf8d0000, cbOutput=0x400, pcbResult=0x2d33f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf8d0000, pcbResult=0x2d33f500) returned 0x0 [0169.596] VirtualFree (lpAddress=0xf8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.599] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.600] WriteFile (in: hFile=0x1760, lpBuffer=0x2d33fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d33f830, lpOverlapped=0x0 | out: lpBuffer=0x2d33fb34*, lpNumberOfBytesWritten=0x2d33f830*=0x428, lpOverlapped=0x0) returned 1 [0169.600] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.600] ReadFile (in: hFile=0x1760, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x2d33f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x2d33f61c*=0x2454, lpOverlapped=0x0) returned 1 [0169.710] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xffffdbac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.710] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x6b50000, cbInput=0x2454, pPaddingInfo=0x0, pbIV=0x2d33f848, cbIV=0x10, pbOutput=0x6b50000, cbOutput=0x100000, pcbResult=0x2d33f618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x2d33f848, pbOutput=0x6b50000, pcbResult=0x2d33f618) returned 0x0 [0169.710] WriteFile (in: hFile=0x1760, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d33f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x2d33f61c*=0x2460, lpOverlapped=0x0) returned 1 [0169.711] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d33f60c | out: lpNewFilePointer=0x0) returned 1 [0169.711] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.711] WriteFile (in: hFile=0x1760, lpBuffer=0x2d33f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d33f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d33f83c*, lpNumberOfBytesWritten=0x2d33f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.711] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x2460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.711] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0169.711] CloseHandle (hObject=0x1760) returned 1 [0169.716] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb050000 [0169.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.play")) returned 1 [0169.723] VirtualFree (lpAddress=0xb050000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2220 os_tid = 0x2144 [0168.808] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.808] ReadFile (in: hFile=0x1768, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.109] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.117] ReadFile (in: hFile=0x1768, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.117] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.119] BCryptSetProperty (in: hObject=0x732440, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732440) returned 0x0 [0169.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732440, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732440, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0169.119] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d47f500) returned 0x0 [0169.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.119] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d47f500) returned 0x0 [0169.123] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.125] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.125] WriteFile (in: hFile=0x1768, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0169.126] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.126] ReadFile (in: hFile=0x1768, lpBuffer=0x6c50000, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesRead=0x2d47f61c*=0xfc0, lpOverlapped=0x0) returned 1 [0169.128] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffff040, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.128] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x6c50000, cbInput=0xfc0, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x6c50000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2d47f848, pbOutput=0x6c50000, pcbResult=0x2d47f618) returned 0x0 [0169.128] WriteFile (in: hFile=0x1768, lpBuffer=0x6c50000*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesWritten=0x2d47f61c*=0xfd0, lpOverlapped=0x0) returned 1 [0169.128] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0169.128] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.128] WriteFile (in: hFile=0x1768, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.128] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.128] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.128] CloseHandle (hObject=0x1768) returned 1 [0169.878] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0169.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.play")) returned 1 [0169.884] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2221 os_tid = 0x2148 [0168.810] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.810] ReadFile (in: hFile=0x964, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.285] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.286] ReadFile (in: hFile=0x964, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.286] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.288] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.288] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x125f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0169.288] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x125f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x125f828, pbKeyObject=0x0) returned 0x0 [0169.288] BCryptExportKey (in: hKey=0x1a6d8d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x125f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x125f500) returned 0x0 [0169.288] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.288] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x125f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x125f500) returned 0x0 [0169.294] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.296] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.296] WriteFile (in: hFile=0x964, lpBuffer=0x125fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x125f830, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesWritten=0x125f830*=0x428, lpOverlapped=0x0) returned 1 [0169.297] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.297] ReadFile (in: hFile=0x964, lpBuffer=0x3550000, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x125f61c*=0x10f4, lpOverlapped=0x0) returned 1 [0169.298] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xffffef0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.298] BCryptEncrypt (in: hKey=0x1a6d8d30, pbInput=0x3550000, cbInput=0x10f4, pPaddingInfo=0x0, pbIV=0x125f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x125f618, dwFlags=0x1 | out: hKey=0x1a6d8d30, pbIV=0x125f848, pbOutput=0x3550000, pcbResult=0x125f618) returned 0x0 [0169.298] WriteFile (in: hFile=0x964, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x125f61c*=0x1100, lpOverlapped=0x0) returned 1 [0169.298] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125f60c | out: lpNewFilePointer=0x0) returned 1 [0169.298] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.298] WriteFile (in: hFile=0x964, lpBuffer=0x125f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x125f83c*, lpNumberOfBytesWritten=0x125f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.298] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x1100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.298] BCryptDestroyKey (in: hKey=0x1a6d8d30 | out: hKey=0x1a6d8d30) returned 0x0 [0169.298] CloseHandle (hObject=0x964) returned 1 [0169.631] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11ed0000 [0169.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.play")) returned 1 [0169.824] VirtualFree (lpAddress=0x11ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2222 os_tid = 0x214c [0168.811] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.811] ReadFile (in: hFile=0x123c, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.274] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.274] ReadFile (in: hFile=0x123c, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.274] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.276] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.276] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x210bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0169.276] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x210bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x210bf828, pbKeyObject=0x0) returned 0x0 [0169.276] BCryptExportKey (in: hKey=0x1a6d8aa0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x210bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x210bf500) returned 0x0 [0169.276] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.276] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x210bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x210bf500) returned 0x0 [0169.281] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.284] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.284] WriteFile (in: hFile=0x123c, lpBuffer=0x210bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210bf830, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesWritten=0x210bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.285] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.285] ReadFile (in: hFile=0x123c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x210bf61c*=0x1bac, lpOverlapped=0x0) returned 1 [0169.581] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xffffe454, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.581] BCryptEncrypt (in: hKey=0x1a6d8aa0, pbInput=0x3750000, cbInput=0x1bac, pPaddingInfo=0x0, pbIV=0x210bf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x210bf618, dwFlags=0x1 | out: hKey=0x1a6d8aa0, pbIV=0x210bf848, pbOutput=0x3750000, pcbResult=0x210bf618) returned 0x0 [0169.581] WriteFile (in: hFile=0x123c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x210bf61c*=0x1bb0, lpOverlapped=0x0) returned 1 [0169.582] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.582] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.582] WriteFile (in: hFile=0x123c, lpBuffer=0x210bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x210bf83c*, lpNumberOfBytesWritten=0x210bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.582] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x1bb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.582] BCryptDestroyKey (in: hKey=0x1a6d8aa0 | out: hKey=0x1a6d8aa0) returned 0x0 [0169.582] CloseHandle (hObject=0x123c) returned 1 [0169.680] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17be0000 [0169.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.play")) returned 1 [0169.742] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2223 os_tid = 0x2150 [0168.813] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.813] ReadFile (in: hFile=0x1264, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.208] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.208] ReadFile (in: hFile=0x1264, lpBuffer=0x214bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x214bf85c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesRead=0x214bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.208] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.210] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x214bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0169.210] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x214bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x214bf828, pbKeyObject=0x0) returned 0x0 [0169.210] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x214bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x214bf500) returned 0x0 [0169.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.211] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x214bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x214bf500) returned 0x0 [0169.216] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.219] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.219] WriteFile (in: hFile=0x1264, lpBuffer=0x214bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x214bf830, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesWritten=0x214bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.220] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.220] ReadFile (in: hFile=0x1264, lpBuffer=0x3950000, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x214bf61c*=0x1bba, lpOverlapped=0x0) returned 1 [0169.550] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xffffe446, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.551] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x3950000, cbInput=0x1bba, pPaddingInfo=0x0, pbIV=0x214bf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x214bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x214bf848, pbOutput=0x3950000, pcbResult=0x214bf618) returned 0x0 [0169.551] WriteFile (in: hFile=0x1264, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x214bf61c*=0x1bc0, lpOverlapped=0x0) returned 1 [0169.551] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x214bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.551] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.551] WriteFile (in: hFile=0x1264, lpBuffer=0x214bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x214bf61c, lpOverlapped=0x0 | out: lpBuffer=0x214bf83c*, lpNumberOfBytesWritten=0x214bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.551] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x1bc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.551] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.551] CloseHandle (hObject=0x1264) returned 1 [0169.666] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11fc0000 [0169.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.play")) returned 1 [0169.769] VirtualFree (lpAddress=0x11fc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2224 os_tid = 0x2154 [0168.815] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.815] ReadFile (in: hFile=0x125c, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.249] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.249] ReadFile (in: hFile=0x125c, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.249] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.252] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.252] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x218ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0169.252] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x218ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x218ff828, pbKeyObject=0x0) returned 0x0 [0169.252] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x218ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x218ff500) returned 0x0 [0169.252] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.252] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x218ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x218ff500) returned 0x0 [0169.257] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.260] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.260] WriteFile (in: hFile=0x125c, lpBuffer=0x218ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x218ff830, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesWritten=0x218ff830*=0x428, lpOverlapped=0x0) returned 1 [0169.262] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.262] ReadFile (in: hFile=0x125c, lpBuffer=0x3d50000, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x218ff61c*=0xb20, lpOverlapped=0x0) returned 1 [0169.262] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffff4e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.262] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x3d50000, cbInput=0xb20, pPaddingInfo=0x0, pbIV=0x218ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x218ff618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x218ff848, pbOutput=0x3d50000, pcbResult=0x218ff618) returned 0x0 [0169.262] WriteFile (in: hFile=0x125c, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x218ff61c*=0xb30, lpOverlapped=0x0) returned 1 [0169.262] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x218ff60c | out: lpNewFilePointer=0x0) returned 1 [0169.263] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.263] WriteFile (in: hFile=0x125c, lpBuffer=0x218ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x218ff83c*, lpNumberOfBytesWritten=0x218ff61c*=0x8, lpOverlapped=0x0) returned 1 [0169.263] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xb30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.263] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0169.263] CloseHandle (hObject=0x125c) returned 1 [0169.629] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf980000 [0169.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.play")) returned 1 [0169.828] VirtualFree (lpAddress=0xf980000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2225 os_tid = 0x2158 [0168.816] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.817] ReadFile (in: hFile=0x1774, lpBuffer=0x21e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesRead=0x21e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.197] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.199] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x21e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0169.199] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x21e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x21e3f828, pbKeyObject=0x0) returned 0x0 [0169.199] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x21e3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x21e3f500) returned 0x0 [0169.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.199] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x21e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x21e3f500) returned 0x0 [0169.202] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.205] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.206] WriteFile (in: hFile=0x1774, lpBuffer=0x21e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21e3f830, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesWritten=0x21e3f830*=0x428, lpOverlapped=0x0) returned 1 [0169.206] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.206] ReadFile (in: hFile=0x1774, lpBuffer=0x4050000, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x21e3f61c*=0x47c, lpOverlapped=0x0) returned 1 [0169.207] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0xfffffb84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.207] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4050000, cbInput=0x47c, pPaddingInfo=0x0, pbIV=0x21e3f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x21e3f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x21e3f848, pbOutput=0x4050000, pcbResult=0x21e3f618) returned 0x0 [0169.207] WriteFile (in: hFile=0x1774, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x21e3f61c*=0x480, lpOverlapped=0x0) returned 1 [0169.207] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21e3f60c | out: lpNewFilePointer=0x0) returned 1 [0169.207] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.207] WriteFile (in: hFile=0x1774, lpBuffer=0x21e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21e3f83c*, lpNumberOfBytesWritten=0x21e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.207] SetFilePointerEx (in: hFile=0x1774, liDistanceToMove=0x480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.207] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.207] CloseHandle (hObject=0x1774) returned 1 [0169.627] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf970000 [0169.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.play")) returned 1 [0169.831] VirtualFree (lpAddress=0xf970000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2226 os_tid = 0x215c [0168.818] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.818] ReadFile (in: hFile=0x177c, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.186] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.186] ReadFile (in: hFile=0x177c, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.186] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.188] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x21f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0169.188] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x21f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x21f3f828, pbKeyObject=0x0) returned 0x0 [0169.188] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x21f3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x21f3f500) returned 0x0 [0169.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.189] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x21f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x21f3f500) returned 0x0 [0169.192] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.194] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.194] WriteFile (in: hFile=0x177c, lpBuffer=0x21f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21f3f830, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesWritten=0x21f3f830*=0x428, lpOverlapped=0x0) returned 1 [0169.195] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.195] ReadFile (in: hFile=0x177c, lpBuffer=0x4150000, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x21f3f61c*=0xac4, lpOverlapped=0x0) returned 1 [0169.195] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xfffff53c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.195] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x4150000, cbInput=0xac4, pPaddingInfo=0x0, pbIV=0x21f3f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x21f3f618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x21f3f848, pbOutput=0x4150000, pcbResult=0x21f3f618) returned 0x0 [0169.195] WriteFile (in: hFile=0x177c, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x21f3f61c*=0xad0, lpOverlapped=0x0) returned 1 [0169.195] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21f3f60c | out: lpNewFilePointer=0x0) returned 1 [0169.195] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.195] WriteFile (in: hFile=0x177c, lpBuffer=0x21f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21f3f83c*, lpNumberOfBytesWritten=0x21f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.195] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.195] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.195] CloseHandle (hObject=0x177c) returned 1 [0169.624] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0169.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.play")) returned 1 [0169.834] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2227 os_tid = 0x2160 [0168.819] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.820] ReadFile (in: hFile=0x1784, lpBuffer=0x2d5bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d5bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d5bfb34*, lpNumberOfBytesRead=0x2d5bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.175] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.178] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.178] BCryptSetProperty (in: hObject=0x7324f0, pszProperty="ChainingMode", pbInput=0x2d5bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7324f0) returned 0x0 [0169.178] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7324f0, phKey=0x2d5bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7324f0, phKey=0x2d5bf828, pbKeyObject=0x0) returned 0x0 [0169.178] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d5bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d5bf500) returned 0x0 [0169.178] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.178] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d5bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d5bf500) returned 0x0 [0169.182] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.185] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.185] WriteFile (in: hFile=0x1784, lpBuffer=0x2d5bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d5bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d5bfb34*, lpNumberOfBytesWritten=0x2d5bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.185] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.185] ReadFile (in: hFile=0x1784, lpBuffer=0x6d50000, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x2d5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesRead=0x2d5bf61c*=0x4f4, lpOverlapped=0x0) returned 1 [0169.185] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0xfffffb0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.186] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x6d50000, cbInput=0x4f4, pPaddingInfo=0x0, pbIV=0x2d5bf848, cbIV=0x10, pbOutput=0x6d50000, cbOutput=0x100000, pcbResult=0x2d5bf618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2d5bf848, pbOutput=0x6d50000, pcbResult=0x2d5bf618) returned 0x0 [0169.186] WriteFile (in: hFile=0x1784, lpBuffer=0x6d50000*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2d5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesWritten=0x2d5bf61c*=0x500, lpOverlapped=0x0) returned 1 [0169.186] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.186] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.186] WriteFile (in: hFile=0x1784, lpBuffer=0x2d5bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d5bf83c*, lpNumberOfBytesWritten=0x2d5bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.186] SetFilePointerEx (in: hFile=0x1784, liDistanceToMove=0x500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.186] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.186] CloseHandle (hObject=0x1784) returned 1 [0169.621] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf8d0000 [0169.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.play")) returned 1 [0169.848] VirtualFree (lpAddress=0xf8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2228 os_tid = 0x2164 [0168.826] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.826] ReadFile (in: hFile=0x178c, lpBuffer=0x2d6ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6ffb34*, lpNumberOfBytesRead=0x2d6ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.164] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.164] ReadFile (in: hFile=0x178c, lpBuffer=0x2d6ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6ffb34*, lpNumberOfBytesRead=0x2d6ff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.164] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.166] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.166] BCryptSetProperty (in: hObject=0x7325a0, pszProperty="ChainingMode", pbInput=0x2d6ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7325a0) returned 0x0 [0169.166] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7325a0, phKey=0x2d6ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7325a0, phKey=0x2d6ff828, pbKeyObject=0x0) returned 0x0 [0169.166] BCryptExportKey (in: hKey=0x1a6d99d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d6ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d6ff500) returned 0x0 [0169.167] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.167] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d6ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d6ff500) returned 0x0 [0169.170] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.173] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.173] WriteFile (in: hFile=0x178c, lpBuffer=0x2d6ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d6ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d6ffb34*, lpNumberOfBytesWritten=0x2d6ff830*=0x428, lpOverlapped=0x0) returned 1 [0169.174] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.174] ReadFile (in: hFile=0x178c, lpBuffer=0x6e50000, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x2d6ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesRead=0x2d6ff61c*=0x1388, lpOverlapped=0x0) returned 1 [0169.174] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0xffffec78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.174] BCryptEncrypt (in: hKey=0x1a6d99d0, pbInput=0x6e50000, cbInput=0x1388, pPaddingInfo=0x0, pbIV=0x2d6ff848, cbIV=0x10, pbOutput=0x6e50000, cbOutput=0x100000, pcbResult=0x2d6ff618, dwFlags=0x1 | out: hKey=0x1a6d99d0, pbIV=0x2d6ff848, pbOutput=0x6e50000, pcbResult=0x2d6ff618) returned 0x0 [0169.175] WriteFile (in: hFile=0x178c, lpBuffer=0x6e50000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d6ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesWritten=0x2d6ff61c*=0x1390, lpOverlapped=0x0) returned 1 [0169.175] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6ff60c | out: lpNewFilePointer=0x0) returned 1 [0169.175] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.175] WriteFile (in: hFile=0x178c, lpBuffer=0x2d6ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d6ff83c*, lpNumberOfBytesWritten=0x2d6ff61c*=0x8, lpOverlapped=0x0) returned 1 [0169.175] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.175] BCryptDestroyKey (in: hKey=0x1a6d99d0 | out: hKey=0x1a6d99d0) returned 0x0 [0169.175] CloseHandle (hObject=0x178c) returned 1 [0169.535] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb240000 [0169.537] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.play")) returned 1 [0169.852] VirtualFree (lpAddress=0xb240000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2229 os_tid = 0x2168 [0168.827] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.828] ReadFile (in: hFile=0x1794, lpBuffer=0x2d83fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d83f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d83fb34*, lpNumberOfBytesRead=0x2d83f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.263] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.263] ReadFile (in: hFile=0x1794, lpBuffer=0x2d83fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d83f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d83fb34*, lpNumberOfBytesRead=0x2d83f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.263] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.265] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.265] BCryptSetProperty (in: hObject=0x736300, pszProperty="ChainingMode", pbInput=0x2d83f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736300) returned 0x0 [0169.265] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736300, phKey=0x2d83f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736300, phKey=0x2d83f828, pbKeyObject=0x0) returned 0x0 [0169.265] BCryptExportKey (in: hKey=0x1a6d8310, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d83f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d83f500) returned 0x0 [0169.265] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.265] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d83f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d83f500) returned 0x0 [0169.269] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.271] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.271] WriteFile (in: hFile=0x1794, lpBuffer=0x2d83fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d83f830, lpOverlapped=0x0 | out: lpBuffer=0x2d83fb34*, lpNumberOfBytesWritten=0x2d83f830*=0x428, lpOverlapped=0x0) returned 1 [0169.272] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.272] ReadFile (in: hFile=0x1794, lpBuffer=0x6f50000, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x2d83f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesRead=0x2d83f61c*=0x1cac, lpOverlapped=0x0) returned 1 [0169.580] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0xffffe354, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.581] BCryptEncrypt (in: hKey=0x1a6d8310, pbInput=0x6f50000, cbInput=0x1cac, pPaddingInfo=0x0, pbIV=0x2d83f848, cbIV=0x10, pbOutput=0x6f50000, cbOutput=0x100000, pcbResult=0x2d83f618, dwFlags=0x1 | out: hKey=0x1a6d8310, pbIV=0x2d83f848, pbOutput=0x6f50000, pcbResult=0x2d83f618) returned 0x0 [0169.581] WriteFile (in: hFile=0x1794, lpBuffer=0x6f50000*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2d83f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesWritten=0x2d83f61c*=0x1cb0, lpOverlapped=0x0) returned 1 [0169.581] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d83f60c | out: lpNewFilePointer=0x0) returned 1 [0169.581] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.581] WriteFile (in: hFile=0x1794, lpBuffer=0x2d83f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d83f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d83f83c*, lpNumberOfBytesWritten=0x2d83f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.581] SetFilePointerEx (in: hFile=0x1794, liDistanceToMove=0x1cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.581] BCryptDestroyKey (in: hKey=0x1a6d8310 | out: hKey=0x1a6d8310) returned 0x0 [0169.581] CloseHandle (hObject=0x1794) returned 1 [0169.678] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0169.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.play")) returned 1 [0169.746] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2230 os_tid = 0x216c [0168.829] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.829] ReadFile (in: hFile=0x179c, lpBuffer=0x2d97fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d97f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d97fb34*, lpNumberOfBytesRead=0x2d97f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.236] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.236] ReadFile (in: hFile=0x179c, lpBuffer=0x2d97fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d97f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d97fb34*, lpNumberOfBytesRead=0x2d97f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.236] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.239] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.239] BCryptSetProperty (in: hObject=0x736250, pszProperty="ChainingMode", pbInput=0x2d97f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736250) returned 0x0 [0169.239] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736250, phKey=0x2d97f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736250, phKey=0x2d97f828, pbKeyObject=0x0) returned 0x0 [0169.239] BCryptExportKey (in: hKey=0x1a6d8080, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d97f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d97f500) returned 0x0 [0169.239] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.239] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d97f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d97f500) returned 0x0 [0169.244] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.247] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.247] WriteFile (in: hFile=0x179c, lpBuffer=0x2d97fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d97f830, lpOverlapped=0x0 | out: lpBuffer=0x2d97fb34*, lpNumberOfBytesWritten=0x2d97f830*=0x428, lpOverlapped=0x0) returned 1 [0169.248] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.248] ReadFile (in: hFile=0x179c, lpBuffer=0x7050000, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x2d97f61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesRead=0x2d97f61c*=0x3dbe, lpOverlapped=0x0) returned 1 [0169.565] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xffffc242, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.565] BCryptEncrypt (in: hKey=0x1a6d8080, pbInput=0x7050000, cbInput=0x3dbe, pPaddingInfo=0x0, pbIV=0x2d97f848, cbIV=0x10, pbOutput=0x7050000, cbOutput=0x100000, pcbResult=0x2d97f618, dwFlags=0x1 | out: hKey=0x1a6d8080, pbIV=0x2d97f848, pbOutput=0x7050000, pcbResult=0x2d97f618) returned 0x0 [0169.565] WriteFile (in: hFile=0x179c, lpBuffer=0x7050000*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2d97f61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesWritten=0x2d97f61c*=0x3dc0, lpOverlapped=0x0) returned 1 [0169.566] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d97f60c | out: lpNewFilePointer=0x0) returned 1 [0169.566] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.566] WriteFile (in: hFile=0x179c, lpBuffer=0x2d97f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d97f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d97f83c*, lpNumberOfBytesWritten=0x2d97f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.566] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x3dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.566] BCryptDestroyKey (in: hKey=0x1a6d8080 | out: hKey=0x1a6d8080) returned 0x0 [0169.566] CloseHandle (hObject=0x179c) returned 1 [0169.671] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11fe0000 [0169.673] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.play")) returned 1 [0169.761] VirtualFree (lpAddress=0x11fe0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2231 os_tid = 0x2170 [0168.830] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.830] ReadFile (in: hFile=0x17a4, lpBuffer=0x2dabfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dabf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dabfb34*, lpNumberOfBytesRead=0x2dabf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.236] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.236] ReadFile (in: hFile=0x17a4, lpBuffer=0x2dabfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dabf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dabfb34*, lpNumberOfBytesRead=0x2dabf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.551] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf8d0000 [0169.554] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf8d0000) returned 0x0 [0169.554] BCryptSetProperty (in: hObject=0x7361a0, pszProperty="ChainingMode", pbInput=0x2dabf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7361a0) returned 0x0 [0169.554] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7361a0, phKey=0x2dabf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf8d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7361a0, phKey=0x2dabf828, pbKeyObject=0x0) returned 0x0 [0169.554] BCryptExportKey (in: hKey=0x7f14f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf8d0000, cbOutput=0x230, pcbResult=0x2dabf500, dwFlags=0x0 | out: pbOutput=0xf8d0000, pcbResult=0x2dabf500) returned 0x0 [0169.554] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf8d0230) returned 0x0 [0169.555] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf8d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf8d0000, cbOutput=0x400, pcbResult=0x2dabf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf8d0000, pcbResult=0x2dabf500) returned 0x0 [0169.560] VirtualFree (lpAddress=0xf8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.563] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.563] WriteFile (in: hFile=0x17a4, lpBuffer=0x2dabfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dabf830, lpOverlapped=0x0 | out: lpBuffer=0x2dabfb34*, lpNumberOfBytesWritten=0x2dabf830*=0x428, lpOverlapped=0x0) returned 1 [0169.564] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.564] ReadFile (in: hFile=0x17a4, lpBuffer=0x7150000, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x2dabf61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesRead=0x2dabf61c*=0x1780, lpOverlapped=0x0) returned 1 [0169.564] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0xffffe880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.564] BCryptEncrypt (in: hKey=0x7f14f0, pbInput=0x7150000, cbInput=0x1780, pPaddingInfo=0x0, pbIV=0x2dabf848, cbIV=0x10, pbOutput=0x7150000, cbOutput=0x100000, pcbResult=0x2dabf618, dwFlags=0x1 | out: hKey=0x7f14f0, pbIV=0x2dabf848, pbOutput=0x7150000, pcbResult=0x2dabf618) returned 0x0 [0169.564] WriteFile (in: hFile=0x17a4, lpBuffer=0x7150000*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2dabf61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesWritten=0x2dabf61c*=0x1790, lpOverlapped=0x0) returned 1 [0169.565] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dabf60c | out: lpNewFilePointer=0x0) returned 1 [0169.565] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.565] WriteFile (in: hFile=0x17a4, lpBuffer=0x2dabf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dabf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dabf83c*, lpNumberOfBytesWritten=0x2dabf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.565] SetFilePointerEx (in: hFile=0x17a4, liDistanceToMove=0x1790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.565] BCryptDestroyKey (in: hKey=0x7f14f0 | out: hKey=0x7f14f0) returned 0x0 [0169.565] CloseHandle (hObject=0x17a4) returned 1 [0169.669] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11fd0000 [0169.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.play")) returned 1 [0169.765] VirtualFree (lpAddress=0x11fd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2232 os_tid = 0x2174 [0168.832] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.832] ReadFile (in: hFile=0x17ac, lpBuffer=0x2dbffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dbff85c, lpOverlapped=0x0 | out: lpBuffer=0x2dbffb34*, lpNumberOfBytesRead=0x2dbff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.235] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.235] ReadFile (in: hFile=0x17ac, lpBuffer=0x2dbffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dbff85c, lpOverlapped=0x0 | out: lpBuffer=0x2dbffb34*, lpNumberOfBytesRead=0x2dbff85c*=0x428, lpOverlapped=0x0) returned 1 [0169.567] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf8d0000 [0169.570] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf8d0000) returned 0x0 [0169.570] BCryptSetProperty (in: hObject=0x7363b0, pszProperty="ChainingMode", pbInput=0x2dbff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7363b0) returned 0x0 [0169.570] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7363b0, phKey=0x2dbff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf8d0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7363b0, phKey=0x2dbff828, pbKeyObject=0x0) returned 0x0 [0169.570] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf8d0000, cbOutput=0x230, pcbResult=0x2dbff500, dwFlags=0x0 | out: pbOutput=0xf8d0000, pcbResult=0x2dbff500) returned 0x0 [0169.570] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf8d0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf8d0230) returned 0x0 [0169.570] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf8d0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf8d0000, cbOutput=0x400, pcbResult=0x2dbff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf8d0000, pcbResult=0x2dbff500) returned 0x0 [0169.575] VirtualFree (lpAddress=0xf8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.578] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.578] WriteFile (in: hFile=0x17ac, lpBuffer=0x2dbffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dbff830, lpOverlapped=0x0 | out: lpBuffer=0x2dbffb34*, lpNumberOfBytesWritten=0x2dbff830*=0x428, lpOverlapped=0x0) returned 1 [0169.579] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.579] ReadFile (in: hFile=0x17ac, lpBuffer=0x7250000, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x2dbff61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesRead=0x2dbff61c*=0x1746, lpOverlapped=0x0) returned 1 [0169.580] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xffffe8ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.580] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x7250000, cbInput=0x1746, pPaddingInfo=0x0, pbIV=0x2dbff848, cbIV=0x10, pbOutput=0x7250000, cbOutput=0x100000, pcbResult=0x2dbff618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x2dbff848, pbOutput=0x7250000, pcbResult=0x2dbff618) returned 0x0 [0169.580] WriteFile (in: hFile=0x17ac, lpBuffer=0x7250000*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2dbff61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesWritten=0x2dbff61c*=0x1750, lpOverlapped=0x0) returned 1 [0169.580] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbff60c | out: lpNewFilePointer=0x0) returned 1 [0169.580] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.580] WriteFile (in: hFile=0x17ac, lpBuffer=0x2dbff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dbff61c, lpOverlapped=0x0 | out: lpBuffer=0x2dbff83c*, lpNumberOfBytesWritten=0x2dbff61c*=0x8, lpOverlapped=0x0) returned 1 [0169.580] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x1750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.580] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0169.580] CloseHandle (hObject=0x17ac) returned 1 [0169.676] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x12000000 [0169.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.play")) returned 1 [0169.750] VirtualFree (lpAddress=0x12000000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2233 os_tid = 0x2178 [0168.833] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.833] ReadFile (in: hFile=0x17b4, lpBuffer=0x2dd3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dd3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dd3fb34*, lpNumberOfBytesRead=0x2dd3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.221] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.221] ReadFile (in: hFile=0x17b4, lpBuffer=0x2dd3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dd3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dd3fb34*, lpNumberOfBytesRead=0x2dd3f85c*=0x428, lpOverlapped=0x0) returned 1 [0169.221] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0169.224] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0169.224] BCryptSetProperty (in: hObject=0x735f90, pszProperty="ChainingMode", pbInput=0x2dd3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735f90) returned 0x0 [0169.224] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735f90, phKey=0x2dd3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735f90, phKey=0x2dd3f828, pbKeyObject=0x0) returned 0x0 [0169.224] BCryptExportKey (in: hKey=0x1a6d9c60, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2dd3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2dd3f500) returned 0x0 [0169.224] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0169.225] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2dd3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2dd3f500) returned 0x0 [0169.229] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.233] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.233] WriteFile (in: hFile=0x17b4, lpBuffer=0x2dd3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dd3f830, lpOverlapped=0x0 | out: lpBuffer=0x2dd3fb34*, lpNumberOfBytesWritten=0x2dd3f830*=0x428, lpOverlapped=0x0) returned 1 [0169.234] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.235] ReadFile (in: hFile=0x17b4, lpBuffer=0x7350000, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x2dd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesRead=0x2dd3f61c*=0x1c80, lpOverlapped=0x0) returned 1 [0169.566] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0xffffe380, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.566] BCryptEncrypt (in: hKey=0x1a6d9c60, pbInput=0x7350000, cbInput=0x1c80, pPaddingInfo=0x0, pbIV=0x2dd3f848, cbIV=0x10, pbOutput=0x7350000, cbOutput=0x100000, pcbResult=0x2dd3f618, dwFlags=0x1 | out: hKey=0x1a6d9c60, pbIV=0x2dd3f848, pbOutput=0x7350000, pcbResult=0x2dd3f618) returned 0x0 [0169.566] WriteFile (in: hFile=0x17b4, lpBuffer=0x7350000*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2dd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesWritten=0x2dd3f61c*=0x1c90, lpOverlapped=0x0) returned 1 [0169.566] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dd3f60c | out: lpNewFilePointer=0x0) returned 1 [0169.567] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.567] WriteFile (in: hFile=0x17b4, lpBuffer=0x2dd3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2dd3f83c*, lpNumberOfBytesWritten=0x2dd3f61c*=0x8, lpOverlapped=0x0) returned 1 [0169.567] SetFilePointerEx (in: hFile=0x17b4, liDistanceToMove=0x1c90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.567] BCryptDestroyKey (in: hKey=0x1a6d9c60 | out: hKey=0x1a6d9c60) returned 0x0 [0169.567] CloseHandle (hObject=0x17b4) returned 1 [0169.673] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x11ff0000 [0169.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.play")) returned 1 [0169.753] VirtualFree (lpAddress=0x11ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2234 os_tid = 0x20ec [0168.849] GetLastError () returned 0x57 [0168.849] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ec308 [0168.849] SetLastError (dwErrCode=0x57) [0168.849] IcmpCreateFile () returned 0x7cd160 [0168.849] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b968 [0168.849] IcmpSendEcho2 (IcmpHandle=0x7cd160, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3800a8c0, RequestData=0x2cb7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b968, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2235 os_tid = 0x217c [0168.850] GetLastError () returned 0x57 [0168.850] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1440 [0168.850] SetLastError (dwErrCode=0x57) [0168.850] IcmpCreateFile () returned 0x7cd198 [0168.850] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b9b8 [0168.851] IcmpSendEcho2 (IcmpHandle=0x7cd198, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3900a8c0, RequestData=0x66ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b9b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2236 os_tid = 0x2180 [0168.851] GetLastError () returned 0x57 [0168.852] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f1b50 [0168.852] SetLastError (dwErrCode=0x57) [0168.852] IcmpCreateFile () returned 0x7cd1d0 [0168.852] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b878 [0168.852] IcmpSendEcho2 (IcmpHandle=0x7cd1d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3a00a8c0, RequestData=0xb21ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b878, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2237 os_tid = 0x2184 [0168.853] GetLastError () returned 0x57 [0168.853] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0298 [0168.853] SetLastError (dwErrCode=0x57) [0168.853] IcmpCreateFile () returned 0x7cd358 [0168.853] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b8c8 [0168.853] IcmpSendEcho2 (IcmpHandle=0x7cd358, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3b00a8c0, RequestData=0xb5cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b8c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2238 os_tid = 0x2188 [0168.854] GetLastError () returned 0x57 [0168.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f09a8 [0168.854] SetLastError (dwErrCode=0x57) [0168.855] IcmpCreateFile () returned 0x7cd390 [0168.855] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x76b918 [0168.855] IcmpSendEcho2 (IcmpHandle=0x7cd390, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3c00a8c0, RequestData=0xfccff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x76b918, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2239 os_tid = 0x218c [0168.856] GetLastError () returned 0x57 [0168.856] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f0d30 [0168.856] SetLastError (dwErrCode=0x57) [0168.856] IcmpCreateFile () returned 0x7cd208 [0168.856] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de28 [0168.856] IcmpSendEcho2 (IcmpHandle=0x7cd208, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3d00a8c0, RequestData=0x11d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de28, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2240 os_tid = 0x2190 [0168.857] GetLastError () returned 0x57 [0168.857] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f10b8 [0168.857] SetLastError (dwErrCode=0x57) [0168.857] IcmpCreateFile () returned 0x7cd240 [0168.857] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73de78 [0168.857] IcmpSendEcho2 (IcmpHandle=0x7cd240, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3e00a8c0, RequestData=0x11e4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73de78, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2241 os_tid = 0x2194 [0168.858] GetLastError () returned 0x57 [0168.858] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6e6738 [0168.858] SetLastError (dwErrCode=0x57) [0168.858] IcmpCreateFile () returned 0x7cd278 [0168.858] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73df68 [0168.859] IcmpSendEcho2 (IcmpHandle=0x7cd278, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3f00a8c0, RequestData=0x20ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73df68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2242 os_tid = 0x2198 [0168.860] GetLastError () returned 0x57 [0168.860] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e4858 [0168.863] SetLastError (dwErrCode=0x57) [0168.863] IcmpCreateFile () returned 0x7cd2b0 [0168.863] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7120 [0168.863] IcmpSendEcho2 (IcmpHandle=0x7cd2b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4000a8c0, RequestData=0x211bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7120, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2243 os_tid = 0x219c [0169.887] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.888] ReadFile (in: hFile=0x1458, lpBuffer=0x215bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215bf85c, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesRead=0x215bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.889] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.889] ReadFile (in: hFile=0x1458, lpBuffer=0x215bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x215bf85c, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesRead=0x215bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.890] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.891] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.891] BCryptSetProperty (in: hObject=0x735ac0, pszProperty="ChainingMode", pbInput=0x215bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ac0) returned 0x0 [0169.891] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ac0, phKey=0x215bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ac0, phKey=0x215bf828, pbKeyObject=0x0) returned 0x0 [0169.891] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x215bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x215bf500) returned 0x0 [0169.892] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.892] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x215bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x215bf500) returned 0x0 [0169.895] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.897] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.897] WriteFile (in: hFile=0x1458, lpBuffer=0x215bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x215bf830, lpOverlapped=0x0 | out: lpBuffer=0x215bfb34*, lpNumberOfBytesWritten=0x215bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.898] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.898] ReadFile (in: hFile=0x1458, lpBuffer=0x7450000, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesRead=0x215bf61c*=0x1526, lpOverlapped=0x0) returned 1 [0169.898] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xffffeada, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.898] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7450000, cbInput=0x1526, pPaddingInfo=0x0, pbIV=0x215bf848, cbIV=0x10, pbOutput=0x7450000, cbOutput=0x100000, pcbResult=0x215bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x215bf848, pbOutput=0x7450000, pcbResult=0x215bf618) returned 0x0 [0169.898] WriteFile (in: hFile=0x1458, lpBuffer=0x7450000*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesWritten=0x215bf61c*=0x1530, lpOverlapped=0x0) returned 1 [0169.898] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x215bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.898] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.898] WriteFile (in: hFile=0x1458, lpBuffer=0x215bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x215bf61c, lpOverlapped=0x0 | out: lpBuffer=0x215bf83c*, lpNumberOfBytesWritten=0x215bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.898] SetFilePointerEx (in: hFile=0x1458, liDistanceToMove=0x1530, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.899] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0169.899] CloseHandle (hObject=0x1458) returned 1 [0169.954] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0169.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.play")) returned 1 [0169.960] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2244 os_tid = 0x21a0 [0169.899] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.899] ReadFile (in: hFile=0x13bc, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.900] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.901] ReadFile (in: hFile=0x13bc, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0169.901] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0169.903] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0169.903] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x216bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0169.903] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x216bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x216bf828, pbKeyObject=0x0) returned 0x0 [0169.903] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x216bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x216bf500) returned 0x0 [0169.903] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0169.903] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x216bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x216bf500) returned 0x0 [0169.908] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.911] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.911] WriteFile (in: hFile=0x13bc, lpBuffer=0x216bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x216bf830, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesWritten=0x216bf830*=0x428, lpOverlapped=0x0) returned 1 [0169.912] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.912] ReadFile (in: hFile=0x13bc, lpBuffer=0x2750000, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x216bf61c*=0xa38, lpOverlapped=0x0) returned 1 [0169.912] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffff5c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.912] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2750000, cbInput=0xa38, pPaddingInfo=0x0, pbIV=0x216bf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x216bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x216bf848, pbOutput=0x2750000, pcbResult=0x216bf618) returned 0x0 [0169.912] WriteFile (in: hFile=0x13bc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x216bf61c*=0xa40, lpOverlapped=0x0) returned 1 [0169.912] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x216bf60c | out: lpNewFilePointer=0x0) returned 1 [0169.912] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.912] WriteFile (in: hFile=0x13bc, lpBuffer=0x216bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x216bf83c*, lpNumberOfBytesWritten=0x216bf61c*=0x8, lpOverlapped=0x0) returned 1 [0169.913] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xa40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.913] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0169.913] CloseHandle (hObject=0x13bc) returned 1 [0169.987] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0169.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.play")) returned 1 [0170.020] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2245 os_tid = 0x21a4 [0169.998] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.999] ReadFile (in: hFile=0x368, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.001] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.001] ReadFile (in: hFile=0x368, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.001] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0170.003] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0170.003] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xfdf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0170.003] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xfdf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xfdf828, pbKeyObject=0x0) returned 0x0 [0170.003] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0xfdf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0xfdf500) returned 0x0 [0170.003] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0170.004] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0xfdf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0xfdf500) returned 0x0 [0170.008] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.010] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.011] WriteFile (in: hFile=0x368, lpBuffer=0xfdfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfdf830, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesWritten=0xfdf830*=0x428, lpOverlapped=0x0) returned 1 [0170.012] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.012] ReadFile (in: hFile=0x368, lpBuffer=0x2950000, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xfdf61c*=0x6852, lpOverlapped=0x0) returned 1 [0170.012] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xffff97ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.012] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2950000, cbInput=0x6852, pPaddingInfo=0x0, pbIV=0xfdf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xfdf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xfdf848, pbOutput=0x2950000, pcbResult=0xfdf618) returned 0x0 [0170.013] WriteFile (in: hFile=0x368, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xfdf61c*=0x6860, lpOverlapped=0x0) returned 1 [0170.013] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfdf60c | out: lpNewFilePointer=0x0) returned 1 [0170.013] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.013] WriteFile (in: hFile=0x368, lpBuffer=0xfdf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0xfdf83c*, lpNumberOfBytesWritten=0xfdf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.013] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x6860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.013] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.013] CloseHandle (hObject=0x368) returned 1 [0170.014] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0170.015] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.play")) returned 1 [0170.016] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2246 os_tid = 0x21a8 [0170.081] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.081] ReadFile (in: hFile=0x7dc, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.083] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.083] ReadFile (in: hFile=0x7dc, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.087] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.087] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x125f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0170.087] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x125f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x125f828, pbKeyObject=0x0) returned 0x0 [0170.087] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x125f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x125f500) returned 0x0 [0170.087] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.088] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x125f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x125f500) returned 0x0 [0170.093] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.096] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.096] WriteFile (in: hFile=0x7dc, lpBuffer=0x125fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x125f830, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesWritten=0x125f830*=0x428, lpOverlapped=0x0) returned 1 [0170.097] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.097] ReadFile (in: hFile=0x7dc, lpBuffer=0x2850000, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x125f61c*=0xa90, lpOverlapped=0x0) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff570, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.098] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2850000, cbInput=0xa90, pPaddingInfo=0x0, pbIV=0x125f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x125f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x125f848, pbOutput=0x2850000, pcbResult=0x125f618) returned 0x0 [0170.098] WriteFile (in: hFile=0x7dc, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x125f61c*=0xaa0, lpOverlapped=0x0) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125f60c | out: lpNewFilePointer=0x0) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.098] WriteFile (in: hFile=0x7dc, lpBuffer=0x125f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x125f83c*, lpNumberOfBytesWritten=0x125f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xaa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.098] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.098] CloseHandle (hObject=0x7dc) returned 1 [0170.098] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.101] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.play")) returned 1 [0170.102] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2247 os_tid = 0x21ac [0170.117] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.117] ReadFile (in: hFile=0x1678, lpBuffer=0xb04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb04f85c, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesRead=0xb04f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.178] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.184] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.185] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xb04f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0170.185] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xb04f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xb04f828, pbKeyObject=0x0) returned 0x0 [0170.185] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xb04f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xb04f500) returned 0x0 [0170.185] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.185] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xb04f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xb04f500) returned 0x0 [0170.190] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.193] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.193] WriteFile (in: hFile=0x1678, lpBuffer=0xb04fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb04f830, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesWritten=0xb04f830*=0x428, lpOverlapped=0x0) returned 1 [0170.194] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.194] ReadFile (in: hFile=0x1678, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xb04f61c*=0x52c, lpOverlapped=0x0) returned 1 [0170.194] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffad4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.194] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2a50000, cbInput=0x52c, pPaddingInfo=0x0, pbIV=0xb04f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xb04f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xb04f848, pbOutput=0x2a50000, pcbResult=0xb04f618) returned 0x0 [0170.195] WriteFile (in: hFile=0x1678, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xb04f61c*=0x530, lpOverlapped=0x0) returned 1 [0170.195] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb04f60c | out: lpNewFilePointer=0x0) returned 1 [0170.195] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.195] WriteFile (in: hFile=0x1678, lpBuffer=0xb04f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0xb04f83c*, lpNumberOfBytesWritten=0xb04f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.195] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x530, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.195] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.195] CloseHandle (hObject=0x1678) returned 1 [0170.195] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.play")) returned 1 [0170.199] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2248 os_tid = 0x21b0 [0170.239] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.239] ReadFile (in: hFile=0x1668, lpBuffer=0xb31fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb31f85c, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesRead=0xb31f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.241] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.241] ReadFile (in: hFile=0x1668, lpBuffer=0xb31fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb31f85c, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesRead=0xb31f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.241] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.246] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.246] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xb31f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0170.246] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xb31f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xb31f828, pbKeyObject=0x0) returned 0x0 [0170.246] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xb31f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xb31f500) returned 0x0 [0170.246] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.247] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xb31f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xb31f500) returned 0x0 [0170.252] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.255] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.255] WriteFile (in: hFile=0x1668, lpBuffer=0xb31fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb31f830, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesWritten=0xb31f830*=0x428, lpOverlapped=0x0) returned 1 [0170.256] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.256] ReadFile (in: hFile=0x1668, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xb31f61c*=0x1efc, lpOverlapped=0x0) returned 1 [0170.257] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xffffe104, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.257] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2b50000, cbInput=0x1efc, pPaddingInfo=0x0, pbIV=0xb31f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xb31f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xb31f848, pbOutput=0x2b50000, pcbResult=0xb31f618) returned 0x0 [0170.257] WriteFile (in: hFile=0x1668, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xb31f61c*=0x1f00, lpOverlapped=0x0) returned 1 [0170.257] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb31f60c | out: lpNewFilePointer=0x0) returned 1 [0170.257] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.257] WriteFile (in: hFile=0x1668, lpBuffer=0xb31f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0xb31f83c*, lpNumberOfBytesWritten=0xb31f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.258] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x1f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.258] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.258] CloseHandle (hObject=0x1668) returned 1 [0170.258] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.play")) returned 1 [0170.263] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2249 os_tid = 0x21b4 [0170.304] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.304] ReadFile (in: hFile=0x1688, lpBuffer=0xf6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesRead=0xf6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.306] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.306] ReadFile (in: hFile=0x1688, lpBuffer=0xf6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesRead=0xf6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.312] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.312] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xf6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0170.312] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xf6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xf6cf828, pbKeyObject=0x0) returned 0x0 [0170.312] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf6cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf6cf500) returned 0x0 [0170.312] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.313] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf6cf500) returned 0x0 [0170.318] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.321] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.321] WriteFile (in: hFile=0x1688, lpBuffer=0xf6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf6cf830, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesWritten=0xf6cf830*=0x428, lpOverlapped=0x0) returned 1 [0170.322] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.322] ReadFile (in: hFile=0x1688, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xf6cf61c*=0x15b0, lpOverlapped=0x0) returned 1 [0170.322] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xffffea50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.322] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2c50000, cbInput=0x15b0, pPaddingInfo=0x0, pbIV=0xf6cf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xf6cf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xf6cf848, pbOutput=0x2c50000, pcbResult=0xf6cf618) returned 0x0 [0170.322] WriteFile (in: hFile=0x1688, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xf6cf61c*=0x15c0, lpOverlapped=0x0) returned 1 [0170.323] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf6cf60c | out: lpNewFilePointer=0x0) returned 1 [0170.323] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.323] WriteFile (in: hFile=0x1688, lpBuffer=0xf6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf6cf83c*, lpNumberOfBytesWritten=0xf6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.323] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x15c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.323] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.323] CloseHandle (hObject=0x1688) returned 1 [0170.324] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.play")) returned 1 [0170.329] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2250 os_tid = 0x21b8 [0170.342] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.343] ReadFile (in: hFile=0x614, lpBuffer=0xf7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf7cfb34*, lpNumberOfBytesRead=0xf7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.344] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.344] ReadFile (in: hFile=0x614, lpBuffer=0xf7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf7cfb34*, lpNumberOfBytesRead=0xf7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.345] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.348] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.348] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xf7cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0170.348] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xf7cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xf7cf828, pbKeyObject=0x0) returned 0x0 [0170.348] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xf7cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xf7cf500) returned 0x0 [0170.348] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.348] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xf7cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xf7cf500) returned 0x0 [0170.353] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.357] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.357] WriteFile (in: hFile=0x614, lpBuffer=0xf7cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf7cf830, lpOverlapped=0x0 | out: lpBuffer=0xf7cfb34*, lpNumberOfBytesWritten=0xf7cf830*=0x428, lpOverlapped=0x0) returned 1 [0170.358] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.358] ReadFile (in: hFile=0x614, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0xf7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xf7cf61c*=0x136a, lpOverlapped=0x0) returned 1 [0170.358] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xffffec96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.358] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2d50000, cbInput=0x136a, pPaddingInfo=0x0, pbIV=0xf7cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xf7cf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xf7cf848, pbOutput=0x2d50000, pcbResult=0xf7cf618) returned 0x0 [0170.358] WriteFile (in: hFile=0x614, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0xf7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xf7cf61c*=0x1370, lpOverlapped=0x0) returned 1 [0170.358] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf7cf60c | out: lpNewFilePointer=0x0) returned 1 [0170.358] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.358] WriteFile (in: hFile=0x614, lpBuffer=0xf7cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf7cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf7cf83c*, lpNumberOfBytesWritten=0xf7cf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.359] SetFilePointerEx (in: hFile=0x614, liDistanceToMove=0x1370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.359] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.359] CloseHandle (hObject=0x614) returned 1 [0170.359] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.play")) returned 1 [0170.362] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2251 os_tid = 0x21bc [0170.367] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.367] ReadFile (in: hFile=0x13d4, lpBuffer=0x11f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x11f8fb34*, lpNumberOfBytesRead=0x11f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.369] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.369] ReadFile (in: hFile=0x13d4, lpBuffer=0x11f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x11f8fb34*, lpNumberOfBytesRead=0x11f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.369] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.449] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.449] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x11f8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0170.449] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x11f8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x11f8f828, pbKeyObject=0x0) returned 0x0 [0170.449] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x11f8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x11f8f500) returned 0x0 [0170.449] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.449] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x11f8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x11f8f500) returned 0x0 [0170.452] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.455] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.455] WriteFile (in: hFile=0x13d4, lpBuffer=0x11f8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11f8f830, lpOverlapped=0x0 | out: lpBuffer=0x11f8fb34*, lpNumberOfBytesWritten=0x11f8f830*=0x428, lpOverlapped=0x0) returned 1 [0170.456] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.456] ReadFile (in: hFile=0x13d4, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x11f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x11f8f61c*=0xc0a, lpOverlapped=0x0) returned 1 [0170.456] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff3f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.456] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2e50000, cbInput=0xc0a, pPaddingInfo=0x0, pbIV=0x11f8f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x11f8f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x11f8f848, pbOutput=0x2e50000, pcbResult=0x11f8f618) returned 0x0 [0170.456] WriteFile (in: hFile=0x13d4, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x11f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x11f8f61c*=0xc10, lpOverlapped=0x0) returned 1 [0170.456] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11f8f60c | out: lpNewFilePointer=0x0) returned 1 [0170.457] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.457] WriteFile (in: hFile=0x13d4, lpBuffer=0x11f8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x11f8f83c*, lpNumberOfBytesWritten=0x11f8f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.457] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xc10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.457] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.457] CloseHandle (hObject=0x13d4) returned 1 [0170.457] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.459] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.play")) returned 1 [0170.460] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2252 os_tid = 0x21c0 [0170.463] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.463] ReadFile (in: hFile=0x1740, lpBuffer=0x1208fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1208f85c, lpOverlapped=0x0 | out: lpBuffer=0x1208fb34*, lpNumberOfBytesRead=0x1208f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.468] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.468] ReadFile (in: hFile=0x1740, lpBuffer=0x1208fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1208f85c, lpOverlapped=0x0 | out: lpBuffer=0x1208fb34*, lpNumberOfBytesRead=0x1208f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.469] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.471] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.471] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1208f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0170.471] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1208f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1208f828, pbKeyObject=0x0) returned 0x0 [0170.471] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1208f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1208f500) returned 0x0 [0170.471] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.471] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1208f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1208f500) returned 0x0 [0170.474] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.477] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.477] WriteFile (in: hFile=0x1740, lpBuffer=0x1208fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1208f830, lpOverlapped=0x0 | out: lpBuffer=0x1208fb34*, lpNumberOfBytesWritten=0x1208f830*=0x428, lpOverlapped=0x0) returned 1 [0170.478] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.478] ReadFile (in: hFile=0x1740, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x1208f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1208f61c*=0x5b04, lpOverlapped=0x0) returned 1 [0170.479] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xffffa4fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.479] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2f50000, cbInput=0x5b04, pPaddingInfo=0x0, pbIV=0x1208f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1208f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x1208f848, pbOutput=0x2f50000, pcbResult=0x1208f618) returned 0x0 [0170.479] WriteFile (in: hFile=0x1740, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x1208f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1208f61c*=0x5b10, lpOverlapped=0x0) returned 1 [0170.479] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1208f60c | out: lpNewFilePointer=0x0) returned 1 [0170.479] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.479] WriteFile (in: hFile=0x1740, lpBuffer=0x1208f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1208f61c, lpOverlapped=0x0 | out: lpBuffer=0x1208f83c*, lpNumberOfBytesWritten=0x1208f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.479] SetFilePointerEx (in: hFile=0x1740, liDistanceToMove=0x5b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.480] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.480] CloseHandle (hObject=0x1740) returned 1 [0170.480] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.482] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.play")) returned 1 [0170.483] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2253 os_tid = 0x21c4 [0170.486] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.486] ReadFile (in: hFile=0x123c, lpBuffer=0x1218fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1218f85c, lpOverlapped=0x0 | out: lpBuffer=0x1218fb34*, lpNumberOfBytesRead=0x1218f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.488] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.488] ReadFile (in: hFile=0x123c, lpBuffer=0x1218fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1218f85c, lpOverlapped=0x0 | out: lpBuffer=0x1218fb34*, lpNumberOfBytesRead=0x1218f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.488] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.490] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.490] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1218f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0170.490] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1218f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1218f828, pbKeyObject=0x0) returned 0x0 [0170.490] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1218f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1218f500) returned 0x0 [0170.490] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.491] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1218f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1218f500) returned 0x0 [0170.494] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.497] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.498] WriteFile (in: hFile=0x123c, lpBuffer=0x1218fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1218f830, lpOverlapped=0x0 | out: lpBuffer=0x1218fb34*, lpNumberOfBytesWritten=0x1218f830*=0x428, lpOverlapped=0x0) returned 1 [0170.498] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.498] ReadFile (in: hFile=0x123c, lpBuffer=0x3050000, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x1218f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1218f61c*=0x5664, lpOverlapped=0x0) returned 1 [0170.499] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xffffa99c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.499] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3050000, cbInput=0x5664, pPaddingInfo=0x0, pbIV=0x1218f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1218f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x1218f848, pbOutput=0x3050000, pcbResult=0x1218f618) returned 0x0 [0170.499] WriteFile (in: hFile=0x123c, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x1218f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1218f61c*=0x5670, lpOverlapped=0x0) returned 1 [0170.499] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1218f60c | out: lpNewFilePointer=0x0) returned 1 [0170.499] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.500] WriteFile (in: hFile=0x123c, lpBuffer=0x1218f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1218f61c, lpOverlapped=0x0 | out: lpBuffer=0x1218f83c*, lpNumberOfBytesWritten=0x1218f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.500] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x5670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.500] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.500] CloseHandle (hObject=0x123c) returned 1 [0170.500] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.play")) returned 1 [0170.503] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2254 os_tid = 0x21c8 [0170.507] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.507] ReadFile (in: hFile=0x17ac, lpBuffer=0x1228fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1228f85c, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesRead=0x1228f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.509] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.509] ReadFile (in: hFile=0x17ac, lpBuffer=0x1228fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1228f85c, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesRead=0x1228f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.509] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.511] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.511] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x1228f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0170.511] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x1228f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x1228f828, pbKeyObject=0x0) returned 0x0 [0170.511] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1228f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1228f500) returned 0x0 [0170.511] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.512] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1228f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1228f500) returned 0x0 [0170.515] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.517] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.517] WriteFile (in: hFile=0x17ac, lpBuffer=0x1228fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1228f830, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesWritten=0x1228f830*=0x428, lpOverlapped=0x0) returned 1 [0170.518] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.518] ReadFile (in: hFile=0x17ac, lpBuffer=0x3150000, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x1228f61c*=0x3dec, lpOverlapped=0x0) returned 1 [0170.519] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xffffc214, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.519] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3150000, cbInput=0x3dec, pPaddingInfo=0x0, pbIV=0x1228f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x1228f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x1228f848, pbOutput=0x3150000, pcbResult=0x1228f618) returned 0x0 [0170.519] WriteFile (in: hFile=0x17ac, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x1228f61c*=0x3df0, lpOverlapped=0x0) returned 1 [0170.519] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1228f60c | out: lpNewFilePointer=0x0) returned 1 [0170.519] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.519] WriteFile (in: hFile=0x17ac, lpBuffer=0x1228f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x1228f83c*, lpNumberOfBytesWritten=0x1228f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.519] SetFilePointerEx (in: hFile=0x17ac, liDistanceToMove=0x3df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.519] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.519] CloseHandle (hObject=0x17ac) returned 1 [0170.520] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.play")) returned 1 [0170.522] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2255 os_tid = 0x21cc [0170.508] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.525] ReadFile (in: hFile=0x179c, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.527] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.527] ReadFile (in: hFile=0x179c, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.527] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.529] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.529] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2097f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0170.529] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2097f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2097f828, pbKeyObject=0x0) returned 0x0 [0170.529] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2097f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2097f500) returned 0x0 [0170.529] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.529] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2097f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2097f500) returned 0x0 [0170.532] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.535] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.535] WriteFile (in: hFile=0x179c, lpBuffer=0x2097fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2097f830, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesWritten=0x2097f830*=0x428, lpOverlapped=0x0) returned 1 [0170.535] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.536] ReadFile (in: hFile=0x179c, lpBuffer=0x3250000, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2097f61c*=0xb10, lpOverlapped=0x0) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffff4f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.536] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3250000, cbInput=0xb10, pPaddingInfo=0x0, pbIV=0x2097f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2097f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2097f848, pbOutput=0x3250000, pcbResult=0x2097f618) returned 0x0 [0170.536] WriteFile (in: hFile=0x179c, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2097f61c*=0xb20, lpOverlapped=0x0) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2097f60c | out: lpNewFilePointer=0x0) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.536] WriteFile (in: hFile=0x179c, lpBuffer=0x2097f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x2097f83c*, lpNumberOfBytesWritten=0x2097f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.536] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.536] CloseHandle (hObject=0x179c) returned 1 [0170.536] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.play")) returned 1 [0170.539] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2256 os_tid = 0x21d0 [0170.544] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.544] ReadFile (in: hFile=0x1264, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.546] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.546] ReadFile (in: hFile=0x1264, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.548] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.548] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x20dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0170.548] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x20dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x20dbf828, pbKeyObject=0x0) returned 0x0 [0170.548] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x20dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x20dbf500) returned 0x0 [0170.548] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.548] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x20dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x20dbf500) returned 0x0 [0170.551] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.554] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.554] WriteFile (in: hFile=0x1264, lpBuffer=0x20dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20dbf830, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesWritten=0x20dbf830*=0x428, lpOverlapped=0x0) returned 1 [0170.555] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.555] ReadFile (in: hFile=0x1264, lpBuffer=0x3350000, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x20dbf61c*=0x10ca8, lpOverlapped=0x0) returned 1 [0170.556] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffef358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.556] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3350000, cbInput=0x10ca8, pPaddingInfo=0x0, pbIV=0x20dbf848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x20dbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x20dbf848, pbOutput=0x3350000, pcbResult=0x20dbf618) returned 0x0 [0170.557] WriteFile (in: hFile=0x1264, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x20dbf61c*=0x10cb0, lpOverlapped=0x0) returned 1 [0170.557] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20dbf60c | out: lpNewFilePointer=0x0) returned 1 [0170.557] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.557] WriteFile (in: hFile=0x1264, lpBuffer=0x20dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20dbf83c*, lpNumberOfBytesWritten=0x20dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.557] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x10cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.557] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.557] CloseHandle (hObject=0x1264) returned 1 [0170.557] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.play")) returned 1 [0170.560] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2257 os_tid = 0x21d4 [0170.563] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.564] ReadFile (in: hFile=0x16ec, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.566] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.566] ReadFile (in: hFile=0x16ec, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.566] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.568] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.568] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x20fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0170.568] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x20fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x20fbf828, pbKeyObject=0x0) returned 0x0 [0170.568] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x20fbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x20fbf500) returned 0x0 [0170.568] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.568] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x20fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x20fbf500) returned 0x0 [0170.571] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.574] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.574] WriteFile (in: hFile=0x16ec, lpBuffer=0x20fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20fbf830, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesWritten=0x20fbf830*=0x428, lpOverlapped=0x0) returned 1 [0170.575] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.575] ReadFile (in: hFile=0x16ec, lpBuffer=0x3450000, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x20fbf61c*=0x1c0a, lpOverlapped=0x0) returned 1 [0170.576] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xffffe3f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.576] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3450000, cbInput=0x1c0a, pPaddingInfo=0x0, pbIV=0x20fbf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x20fbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x20fbf848, pbOutput=0x3450000, pcbResult=0x20fbf618) returned 0x0 [0170.576] WriteFile (in: hFile=0x16ec, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x20fbf61c*=0x1c10, lpOverlapped=0x0) returned 1 [0170.576] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20fbf60c | out: lpNewFilePointer=0x0) returned 1 [0170.576] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.576] WriteFile (in: hFile=0x16ec, lpBuffer=0x20fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20fbf83c*, lpNumberOfBytesWritten=0x20fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.576] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x1c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.576] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.576] CloseHandle (hObject=0x16ec) returned 1 [0170.576] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\htech_01.mid.play")) returned 1 [0170.579] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2258 os_tid = 0x21d8 [0170.582] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.583] ReadFile (in: hFile=0x16fc, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.584] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.586] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.586] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x210bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0170.586] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x210bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x210bf828, pbKeyObject=0x0) returned 0x0 [0170.586] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x210bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x210bf500) returned 0x0 [0170.587] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.587] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x210bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x210bf500) returned 0x0 [0170.590] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.592] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.592] WriteFile (in: hFile=0x16fc, lpBuffer=0x210bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210bf830, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesWritten=0x210bf830*=0x428, lpOverlapped=0x0) returned 1 [0170.593] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.593] ReadFile (in: hFile=0x16fc, lpBuffer=0x3550000, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x210bf61c*=0x486, lpOverlapped=0x0) returned 1 [0170.593] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfffffb7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.593] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3550000, cbInput=0x486, pPaddingInfo=0x0, pbIV=0x210bf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x210bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x210bf848, pbOutput=0x3550000, pcbResult=0x210bf618) returned 0x0 [0170.593] WriteFile (in: hFile=0x16fc, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x210bf61c*=0x490, lpOverlapped=0x0) returned 1 [0170.593] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210bf60c | out: lpNewFilePointer=0x0) returned 1 [0170.593] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.593] WriteFile (in: hFile=0x16fc, lpBuffer=0x210bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x210bf83c*, lpNumberOfBytesWritten=0x210bf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.593] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.593] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.594] CloseHandle (hObject=0x16fc) returned 1 [0170.594] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.play")) returned 1 [0170.596] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2259 os_tid = 0x21dc [0170.599] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.601] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.601] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2147f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0170.601] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2147f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2147f828, pbKeyObject=0x0) returned 0x0 [0170.601] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2147f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2147f500) returned 0x0 [0170.601] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.601] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2147f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2147f500) returned 0x0 [0170.605] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.607] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.607] WriteFile (in: hFile=0x170c, lpBuffer=0x2147fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2147f830, lpOverlapped=0x0 | out: lpBuffer=0x2147fb34*, lpNumberOfBytesWritten=0x2147f830*=0x428, lpOverlapped=0x0) returned 1 [0170.609] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.609] ReadFile (in: hFile=0x170c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2147f61c*=0x318, lpOverlapped=0x0) returned 1 [0170.609] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffce8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.609] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3650000, cbInput=0x318, pPaddingInfo=0x0, pbIV=0x2147f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2147f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2147f848, pbOutput=0x3650000, pcbResult=0x2147f618) returned 0x0 [0170.609] WriteFile (in: hFile=0x170c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2147f61c*=0x320, lpOverlapped=0x0) returned 1 [0170.610] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2147f60c | out: lpNewFilePointer=0x0) returned 1 [0170.610] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.610] WriteFile (in: hFile=0x170c, lpBuffer=0x2147f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x2147f83c*, lpNumberOfBytesWritten=0x2147f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.610] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.610] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.610] CloseHandle (hObject=0x170c) returned 1 [0170.610] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.play")) returned 1 [0170.612] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2260 os_tid = 0x21e0 [0170.616] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.617] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.617] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2157f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0170.617] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2157f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2157f828, pbKeyObject=0x0) returned 0x0 [0170.617] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2157f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2157f500) returned 0x0 [0170.618] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.618] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2157f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2157f500) returned 0x0 [0170.621] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.623] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.624] WriteFile (in: hFile=0x171c, lpBuffer=0x2157fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2157f830, lpOverlapped=0x0 | out: lpBuffer=0x2157fb34*, lpNumberOfBytesWritten=0x2157f830*=0x428, lpOverlapped=0x0) returned 1 [0170.626] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.626] ReadFile (in: hFile=0x171c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x2157f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2157f61c*=0x432, lpOverlapped=0x0) returned 1 [0170.626] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0xfffffbce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.626] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3750000, cbInput=0x432, pPaddingInfo=0x0, pbIV=0x2157f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2157f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2157f848, pbOutput=0x3750000, pcbResult=0x2157f618) returned 0x0 [0170.626] WriteFile (in: hFile=0x171c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2157f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2157f61c*=0x440, lpOverlapped=0x0) returned 1 [0170.626] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2157f60c | out: lpNewFilePointer=0x0) returned 1 [0170.626] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.626] WriteFile (in: hFile=0x171c, lpBuffer=0x2157f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2157f61c, lpOverlapped=0x0 | out: lpBuffer=0x2157f83c*, lpNumberOfBytesWritten=0x2157f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.626] SetFilePointerEx (in: hFile=0x171c, liDistanceToMove=0x440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.626] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.626] CloseHandle (hObject=0x171c) returned 1 [0170.626] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.play")) returned 1 [0170.629] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2261 os_tid = 0x21e4 [0170.632] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.632] ReadFile (in: hFile=0x1748, lpBuffer=0x217bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x217bf85c, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesRead=0x217bf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.633] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.635] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.635] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x217bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0170.635] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x217bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x217bf828, pbKeyObject=0x0) returned 0x0 [0170.635] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x217bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x217bf500) returned 0x0 [0170.635] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.635] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x217bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x217bf500) returned 0x0 [0170.639] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.641] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.641] WriteFile (in: hFile=0x1748, lpBuffer=0x217bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x217bf830, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesWritten=0x217bf830*=0x428, lpOverlapped=0x0) returned 1 [0170.642] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.642] ReadFile (in: hFile=0x1748, lpBuffer=0x3850000, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x217bf61c*=0x738, lpOverlapped=0x0) returned 1 [0170.642] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffff8c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.642] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3850000, cbInput=0x738, pPaddingInfo=0x0, pbIV=0x217bf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x217bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x217bf848, pbOutput=0x3850000, pcbResult=0x217bf618) returned 0x0 [0170.642] WriteFile (in: hFile=0x1748, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x217bf61c*=0x740, lpOverlapped=0x0) returned 1 [0170.642] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x217bf60c | out: lpNewFilePointer=0x0) returned 1 [0170.642] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.642] WriteFile (in: hFile=0x1748, lpBuffer=0x217bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x217bf83c*, lpNumberOfBytesWritten=0x217bf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.642] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.642] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.642] CloseHandle (hObject=0x1748) returned 1 [0170.642] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.play")) returned 1 [0170.645] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2262 os_tid = 0x21e8 [0170.649] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.649] ReadFile (in: hFile=0x125c, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.650] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.650] ReadFile (in: hFile=0x125c, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.650] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.652] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.652] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x218ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0170.652] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x218ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x218ff828, pbKeyObject=0x0) returned 0x0 [0170.652] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x218ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x218ff500) returned 0x0 [0170.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.653] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x218ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x218ff500) returned 0x0 [0170.656] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.658] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.658] WriteFile (in: hFile=0x125c, lpBuffer=0x218ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x218ff830, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesWritten=0x218ff830*=0x428, lpOverlapped=0x0) returned 1 [0170.659] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.659] ReadFile (in: hFile=0x125c, lpBuffer=0x3950000, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x218ff61c*=0x2bb6, lpOverlapped=0x0) returned 1 [0170.661] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xffffd44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.661] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3950000, cbInput=0x2bb6, pPaddingInfo=0x0, pbIV=0x218ff848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x218ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x218ff848, pbOutput=0x3950000, pcbResult=0x218ff618) returned 0x0 [0170.661] WriteFile (in: hFile=0x125c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x218ff61c*=0x2bc0, lpOverlapped=0x0) returned 1 [0170.661] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x218ff60c | out: lpNewFilePointer=0x0) returned 1 [0170.661] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.661] WriteFile (in: hFile=0x125c, lpBuffer=0x218ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x218ff83c*, lpNumberOfBytesWritten=0x218ff61c*=0x8, lpOverlapped=0x0) returned 1 [0170.661] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x2bc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.661] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.662] CloseHandle (hObject=0x125c) returned 1 [0170.662] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.663] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.play")) returned 1 [0170.668] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2263 os_tid = 0x21ec [0170.671] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.671] ReadFile (in: hFile=0x177c, lpBuffer=0x21a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21a3fb34*, lpNumberOfBytesRead=0x21a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.672] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.674] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.674] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x21a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0170.674] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x21a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x21a3f828, pbKeyObject=0x0) returned 0x0 [0170.674] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21a3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21a3f500) returned 0x0 [0170.675] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.675] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21a3f500) returned 0x0 [0170.678] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.680] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.681] WriteFile (in: hFile=0x177c, lpBuffer=0x21a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21a3f830, lpOverlapped=0x0 | out: lpBuffer=0x21a3fb34*, lpNumberOfBytesWritten=0x21a3f830*=0x428, lpOverlapped=0x0) returned 1 [0170.681] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.681] ReadFile (in: hFile=0x177c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x21a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x21a3f61c*=0x764, lpOverlapped=0x0) returned 1 [0170.681] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xfffff89c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.681] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3a50000, cbInput=0x764, pPaddingInfo=0x0, pbIV=0x21a3f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x21a3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x21a3f848, pbOutput=0x3a50000, pcbResult=0x21a3f618) returned 0x0 [0170.682] WriteFile (in: hFile=0x177c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x21a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x21a3f61c*=0x770, lpOverlapped=0x0) returned 1 [0170.682] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21a3f60c | out: lpNewFilePointer=0x0) returned 1 [0170.682] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.682] WriteFile (in: hFile=0x177c, lpBuffer=0x21a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21a3f83c*, lpNumberOfBytesWritten=0x21a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.682] SetFilePointerEx (in: hFile=0x177c, liDistanceToMove=0x770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.682] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.682] CloseHandle (hObject=0x177c) returned 1 [0170.682] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.684] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.play")) returned 1 [0170.685] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2264 os_tid = 0x21f0 [0170.688] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.690] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.690] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x21d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0170.690] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x21d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x21d3f828, pbKeyObject=0x0) returned 0x0 [0170.690] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21d3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21d3f500) returned 0x0 [0170.690] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.690] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21d3f500) returned 0x0 [0170.694] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.696] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.696] WriteFile (in: hFile=0x178c, lpBuffer=0x21d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d3f830, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesWritten=0x21d3f830*=0x428, lpOverlapped=0x0) returned 1 [0170.699] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.699] ReadFile (in: hFile=0x178c, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x21d3f61c*=0x2b8, lpOverlapped=0x0) returned 1 [0170.699] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0xfffffd48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.699] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3b50000, cbInput=0x2b8, pPaddingInfo=0x0, pbIV=0x21d3f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x21d3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x21d3f848, pbOutput=0x3b50000, pcbResult=0x21d3f618) returned 0x0 [0170.699] WriteFile (in: hFile=0x178c, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x21d3f61c*=0x2c0, lpOverlapped=0x0) returned 1 [0170.700] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d3f60c | out: lpNewFilePointer=0x0) returned 1 [0170.700] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.700] WriteFile (in: hFile=0x178c, lpBuffer=0x21d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d3f83c*, lpNumberOfBytesWritten=0x21d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.700] SetFilePointerEx (in: hFile=0x178c, liDistanceToMove=0x2c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.700] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.700] CloseHandle (hObject=0x178c) returned 1 [0170.700] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.play")) returned 1 [0170.703] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2265 os_tid = 0x21f4 [0170.716] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.716] ReadFile (in: hFile=0x134c, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.717] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.720] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.720] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0xfdf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0170.720] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0xfdf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0xfdf828, pbKeyObject=0x0) returned 0x0 [0170.720] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfdf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfdf500) returned 0x0 [0170.720] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.720] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfdf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfdf500) returned 0x0 [0170.723] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.726] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.726] WriteFile (in: hFile=0x134c, lpBuffer=0xfdfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfdf830, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesWritten=0xfdf830*=0x428, lpOverlapped=0x0) returned 1 [0170.727] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.727] ReadFile (in: hFile=0x134c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0xfdf61c*=0x788, lpOverlapped=0x0) returned 1 [0170.728] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff878, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.728] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3c50000, cbInput=0x788, pPaddingInfo=0x0, pbIV=0xfdf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0xfdf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xfdf848, pbOutput=0x3c50000, pcbResult=0xfdf618) returned 0x0 [0170.728] WriteFile (in: hFile=0x134c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0xfdf61c*=0x790, lpOverlapped=0x0) returned 1 [0170.728] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfdf60c | out: lpNewFilePointer=0x0) returned 1 [0170.728] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.728] WriteFile (in: hFile=0x134c, lpBuffer=0xfdf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0xfdf83c*, lpNumberOfBytesWritten=0xfdf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.728] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.728] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.728] CloseHandle (hObject=0x134c) returned 1 [0170.728] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.play")) returned 1 [0170.732] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2266 os_tid = 0x21f8 [0170.736] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.736] ReadFile (in: hFile=0x1760, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.738] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.738] ReadFile (in: hFile=0x1760, lpBuffer=0x216bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x216bf85c, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesRead=0x216bf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.738] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.740] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.740] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x216bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0170.740] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x216bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x216bf828, pbKeyObject=0x0) returned 0x0 [0170.740] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x216bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x216bf500) returned 0x0 [0170.740] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.741] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x216bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x216bf500) returned 0x0 [0170.745] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.748] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.748] WriteFile (in: hFile=0x1760, lpBuffer=0x216bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x216bf830, lpOverlapped=0x0 | out: lpBuffer=0x216bfb34*, lpNumberOfBytesWritten=0x216bf830*=0x428, lpOverlapped=0x0) returned 1 [0170.749] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.749] ReadFile (in: hFile=0x1760, lpBuffer=0x2750000, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x216bf61c*=0x23d4, lpOverlapped=0x0) returned 1 [0170.751] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xffffdc2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.751] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2750000, cbInput=0x23d4, pPaddingInfo=0x0, pbIV=0x216bf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x216bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x216bf848, pbOutput=0x2750000, pcbResult=0x216bf618) returned 0x0 [0170.751] WriteFile (in: hFile=0x1760, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x216bf61c*=0x23e0, lpOverlapped=0x0) returned 1 [0170.751] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x216bf60c | out: lpNewFilePointer=0x0) returned 1 [0170.751] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.752] WriteFile (in: hFile=0x1760, lpBuffer=0x216bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x216bf61c, lpOverlapped=0x0 | out: lpBuffer=0x216bf83c*, lpNumberOfBytesWritten=0x216bf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.752] SetFilePointerEx (in: hFile=0x1760, liDistanceToMove=0x23e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.752] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.752] CloseHandle (hObject=0x1760) returned 1 [0170.752] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.play")) returned 1 [0170.755] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2267 os_tid = 0x21fc [0170.759] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.759] ReadFile (in: hFile=0x1768, lpBuffer=0x21e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesRead=0x21e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.761] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.761] ReadFile (in: hFile=0x1768, lpBuffer=0x21e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesRead=0x21e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.761] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.764] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.764] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x21e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0170.764] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x21e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x21e3f828, pbKeyObject=0x0) returned 0x0 [0170.764] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21e3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21e3f500) returned 0x0 [0170.764] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.764] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21e3f500) returned 0x0 [0170.769] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.772] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.772] WriteFile (in: hFile=0x1768, lpBuffer=0x21e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21e3f830, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesWritten=0x21e3f830*=0x428, lpOverlapped=0x0) returned 1 [0170.773] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.773] ReadFile (in: hFile=0x1768, lpBuffer=0x2950000, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x21e3f61c*=0x31cc, lpOverlapped=0x0) returned 1 [0170.774] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xffffce34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.774] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2950000, cbInput=0x31cc, pPaddingInfo=0x0, pbIV=0x21e3f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x21e3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x21e3f848, pbOutput=0x2950000, pcbResult=0x21e3f618) returned 0x0 [0170.774] WriteFile (in: hFile=0x1768, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x21e3f61c*=0x31d0, lpOverlapped=0x0) returned 1 [0170.774] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21e3f60c | out: lpNewFilePointer=0x0) returned 1 [0170.774] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.774] WriteFile (in: hFile=0x1768, lpBuffer=0x21e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21e3f83c*, lpNumberOfBytesWritten=0x21e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.774] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x31d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.774] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.774] CloseHandle (hObject=0x1768) returned 1 [0170.774] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.play")) returned 1 [0170.778] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2268 os_tid = 0x2200 [0170.782] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.782] ReadFile (in: hFile=0x1690, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.784] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.784] ReadFile (in: hFile=0x1690, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.784] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.786] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.786] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x21f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0170.786] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x21f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x21f3f828, pbKeyObject=0x0) returned 0x0 [0170.786] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21f3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21f3f500) returned 0x0 [0170.786] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.786] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21f3f500) returned 0x0 [0170.791] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.793] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.794] WriteFile (in: hFile=0x1690, lpBuffer=0x21f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21f3f830, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesWritten=0x21f3f830*=0x428, lpOverlapped=0x0) returned 1 [0170.794] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.794] ReadFile (in: hFile=0x1690, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x21f3f61c*=0x1b08, lpOverlapped=0x0) returned 1 [0170.796] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xffffe4f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.796] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3d50000, cbInput=0x1b08, pPaddingInfo=0x0, pbIV=0x21f3f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x21f3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x21f3f848, pbOutput=0x3d50000, pcbResult=0x21f3f618) returned 0x0 [0170.796] WriteFile (in: hFile=0x1690, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x21f3f61c*=0x1b10, lpOverlapped=0x0) returned 1 [0170.796] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21f3f60c | out: lpNewFilePointer=0x0) returned 1 [0170.796] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.797] WriteFile (in: hFile=0x1690, lpBuffer=0x21f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21f3f83c*, lpNumberOfBytesWritten=0x21f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.797] SetFilePointerEx (in: hFile=0x1690, liDistanceToMove=0x1b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.797] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.797] CloseHandle (hObject=0x1690) returned 1 [0170.797] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.play")) returned 1 [0170.800] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2269 os_tid = 0x2204 [0170.803] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.803] ReadFile (in: hFile=0x17cc, lpBuffer=0x2207fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2207f85c, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesRead=0x2207f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.805] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.807] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.807] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2207f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0170.807] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2207f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2207f828, pbKeyObject=0x0) returned 0x0 [0170.807] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2207f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2207f500) returned 0x0 [0170.807] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.807] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2207f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2207f500) returned 0x0 [0170.811] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.813] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.813] WriteFile (in: hFile=0x17cc, lpBuffer=0x2207fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2207f830, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesWritten=0x2207f830*=0x428, lpOverlapped=0x0) returned 1 [0170.814] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.814] ReadFile (in: hFile=0x17cc, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2207f61c*=0x4e8, lpOverlapped=0x0) returned 1 [0170.814] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffffb18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.814] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3e50000, cbInput=0x4e8, pPaddingInfo=0x0, pbIV=0x2207f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2207f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2207f848, pbOutput=0x3e50000, pcbResult=0x2207f618) returned 0x0 [0170.814] WriteFile (in: hFile=0x17cc, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2207f61c*=0x4f0, lpOverlapped=0x0) returned 1 [0170.814] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2207f60c | out: lpNewFilePointer=0x0) returned 1 [0170.814] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.814] WriteFile (in: hFile=0x17cc, lpBuffer=0x2207f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x2207f83c*, lpNumberOfBytesWritten=0x2207f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.814] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x4f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.814] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.814] CloseHandle (hObject=0x17cc) returned 1 [0170.814] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.816] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.play")) returned 1 [0170.817] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2270 os_tid = 0x2208 [0170.820] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.821] ReadFile (in: hFile=0x17d4, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.822] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.822] ReadFile (in: hFile=0x17d4, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.822] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.824] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x230ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0170.824] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x230ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x230ff828, pbKeyObject=0x0) returned 0x0 [0170.824] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x230ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x230ff500) returned 0x0 [0170.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.824] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x230ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x230ff500) returned 0x0 [0170.828] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.829] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.830] WriteFile (in: hFile=0x17d4, lpBuffer=0x230ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x230ff830, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesWritten=0x230ff830*=0x428, lpOverlapped=0x0) returned 1 [0170.830] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.830] ReadFile (in: hFile=0x17d4, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x230ff61c*=0xb80, lpOverlapped=0x0) returned 1 [0170.830] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0xfffff480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.830] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3f50000, cbInput=0xb80, pPaddingInfo=0x0, pbIV=0x230ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x230ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x230ff848, pbOutput=0x3f50000, pcbResult=0x230ff618) returned 0x0 [0170.830] WriteFile (in: hFile=0x17d4, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x230ff61c*=0xb90, lpOverlapped=0x0) returned 1 [0170.830] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230ff60c | out: lpNewFilePointer=0x0) returned 1 [0170.831] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.831] WriteFile (in: hFile=0x17d4, lpBuffer=0x230ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x230ff83c*, lpNumberOfBytesWritten=0x230ff61c*=0x8, lpOverlapped=0x0) returned 1 [0170.831] SetFilePointerEx (in: hFile=0x17d4, liDistanceToMove=0xb90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.831] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.831] CloseHandle (hObject=0x17d4) returned 1 [0170.831] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.play")) returned 1 [0170.833] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2271 os_tid = 0x220c [0170.836] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.837] ReadFile (in: hFile=0x17dc, lpBuffer=0x231ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x231ff85c, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesRead=0x231ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.847] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.847] ReadFile (in: hFile=0x17dc, lpBuffer=0x231ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x231ff85c, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesRead=0x231ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.847] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.849] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x231ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0170.849] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x231ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x231ff828, pbKeyObject=0x0) returned 0x0 [0170.849] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x231ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x231ff500) returned 0x0 [0170.850] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.850] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x231ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x231ff500) returned 0x0 [0170.853] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.856] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.856] WriteFile (in: hFile=0x17dc, lpBuffer=0x231ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x231ff830, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesWritten=0x231ff830*=0x428, lpOverlapped=0x0) returned 1 [0170.857] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.857] ReadFile (in: hFile=0x17dc, lpBuffer=0x4050000, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x231ff61c*=0x2178, lpOverlapped=0x0) returned 1 [0170.862] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xffffde88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.862] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4050000, cbInput=0x2178, pPaddingInfo=0x0, pbIV=0x231ff848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x231ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x231ff848, pbOutput=0x4050000, pcbResult=0x231ff618) returned 0x0 [0170.863] WriteFile (in: hFile=0x17dc, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x231ff61c*=0x2180, lpOverlapped=0x0) returned 1 [0170.863] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x231ff60c | out: lpNewFilePointer=0x0) returned 1 [0170.863] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.863] WriteFile (in: hFile=0x17dc, lpBuffer=0x231ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x231ff83c*, lpNumberOfBytesWritten=0x231ff61c*=0x8, lpOverlapped=0x0) returned 1 [0170.863] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x2180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.863] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.863] CloseHandle (hObject=0x17dc) returned 1 [0170.863] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.865] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\indst_01.mid.play")) returned 1 [0170.866] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2272 os_tid = 0x2210 [0170.870] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.870] ReadFile (in: hFile=0x17e4, lpBuffer=0x28dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x28dbfb34*, lpNumberOfBytesRead=0x28dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.872] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.874] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.874] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x28dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0170.874] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x28dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x28dbf828, pbKeyObject=0x0) returned 0x0 [0170.874] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28dbf500) returned 0x0 [0170.874] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.875] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28dbf500) returned 0x0 [0170.878] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.880] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.880] WriteFile (in: hFile=0x17e4, lpBuffer=0x28dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28dbf830, lpOverlapped=0x0 | out: lpBuffer=0x28dbfb34*, lpNumberOfBytesWritten=0x28dbf830*=0x428, lpOverlapped=0x0) returned 1 [0170.881] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.881] ReadFile (in: hFile=0x17e4, lpBuffer=0x4150000, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x28dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x28dbf61c*=0x4c4, lpOverlapped=0x0) returned 1 [0170.881] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0xfffffb3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.881] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4150000, cbInput=0x4c4, pPaddingInfo=0x0, pbIV=0x28dbf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x28dbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x28dbf848, pbOutput=0x4150000, pcbResult=0x28dbf618) returned 0x0 [0170.881] WriteFile (in: hFile=0x17e4, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x28dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x28dbf61c*=0x4d0, lpOverlapped=0x0) returned 1 [0170.881] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dbf60c | out: lpNewFilePointer=0x0) returned 1 [0170.881] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.882] WriteFile (in: hFile=0x17e4, lpBuffer=0x28dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x28dbf83c*, lpNumberOfBytesWritten=0x28dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.882] SetFilePointerEx (in: hFile=0x17e4, liDistanceToMove=0x4d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.882] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.882] CloseHandle (hObject=0x17e4) returned 1 [0170.882] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0075478.gif.play")) returned 1 [0170.885] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2273 os_tid = 0x2214 [0170.888] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.888] ReadFile (in: hFile=0x17ec, lpBuffer=0x28effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28eff85c, lpOverlapped=0x0 | out: lpBuffer=0x28effb34*, lpNumberOfBytesRead=0x28eff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.890] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.890] ReadFile (in: hFile=0x17ec, lpBuffer=0x28effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28eff85c, lpOverlapped=0x0 | out: lpBuffer=0x28effb34*, lpNumberOfBytesRead=0x28eff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.893] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.893] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x28eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0170.893] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x28eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x28eff828, pbKeyObject=0x0) returned 0x0 [0170.893] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28eff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28eff500) returned 0x0 [0170.893] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.893] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28eff500) returned 0x0 [0170.896] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.899] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.899] WriteFile (in: hFile=0x17ec, lpBuffer=0x28effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28eff830, lpOverlapped=0x0 | out: lpBuffer=0x28effb34*, lpNumberOfBytesWritten=0x28eff830*=0x428, lpOverlapped=0x0) returned 1 [0170.899] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.900] ReadFile (in: hFile=0x17ec, lpBuffer=0x4250000, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x28eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x28eff61c*=0x2606, lpOverlapped=0x0) returned 1 [0170.900] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xffffd9fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.900] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4250000, cbInput=0x2606, pPaddingInfo=0x0, pbIV=0x28eff848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x28eff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x28eff848, pbOutput=0x4250000, pcbResult=0x28eff618) returned 0x0 [0170.900] WriteFile (in: hFile=0x17ec, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x28eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x28eff61c*=0x2610, lpOverlapped=0x0) returned 1 [0170.901] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28eff60c | out: lpNewFilePointer=0x0) returned 1 [0170.901] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.901] WriteFile (in: hFile=0x17ec, lpBuffer=0x28eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28eff61c, lpOverlapped=0x0 | out: lpBuffer=0x28eff83c*, lpNumberOfBytesWritten=0x28eff61c*=0x8, lpOverlapped=0x0) returned 1 [0170.901] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x2610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.901] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.901] CloseHandle (hObject=0x17ec) returned 1 [0170.901] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.play")) returned 1 [0170.904] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2274 os_tid = 0x2218 [0170.890] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.900] ReadFile (in: hFile=0x17f4, lpBuffer=0x2903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2903f85c, lpOverlapped=0x0 | out: lpBuffer=0x2903fb34*, lpNumberOfBytesRead=0x2903f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.908] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.908] ReadFile (in: hFile=0x17f4, lpBuffer=0x2903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2903f85c, lpOverlapped=0x0 | out: lpBuffer=0x2903fb34*, lpNumberOfBytesRead=0x2903f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.909] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.911] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.911] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x2903f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0170.911] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x2903f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x2903f828, pbKeyObject=0x0) returned 0x0 [0170.911] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2903f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2903f500) returned 0x0 [0170.911] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.911] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2903f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2903f500) returned 0x0 [0170.914] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.917] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.917] WriteFile (in: hFile=0x17f4, lpBuffer=0x2903fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2903f830, lpOverlapped=0x0 | out: lpBuffer=0x2903fb34*, lpNumberOfBytesWritten=0x2903f830*=0x428, lpOverlapped=0x0) returned 1 [0170.918] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.918] ReadFile (in: hFile=0x17f4, lpBuffer=0x4350000, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x2903f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x2903f61c*=0x257c, lpOverlapped=0x0) returned 1 [0170.921] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0xffffda84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.921] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4350000, cbInput=0x257c, pPaddingInfo=0x0, pbIV=0x2903f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x2903f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2903f848, pbOutput=0x4350000, pcbResult=0x2903f618) returned 0x0 [0170.921] WriteFile (in: hFile=0x17f4, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2903f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x2903f61c*=0x2580, lpOverlapped=0x0) returned 1 [0170.921] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2903f60c | out: lpNewFilePointer=0x0) returned 1 [0170.921] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.921] WriteFile (in: hFile=0x17f4, lpBuffer=0x2903f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2903f61c, lpOverlapped=0x0 | out: lpBuffer=0x2903f83c*, lpNumberOfBytesWritten=0x2903f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.921] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x2580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.921] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.922] CloseHandle (hObject=0x17f4) returned 1 [0170.922] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.play")) returned 1 [0170.925] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2275 os_tid = 0x221c [0170.908] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.921] ReadFile (in: hFile=0x17fc, lpBuffer=0x2917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2917f85c, lpOverlapped=0x0 | out: lpBuffer=0x2917fb34*, lpNumberOfBytesRead=0x2917f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.929] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.929] ReadFile (in: hFile=0x17fc, lpBuffer=0x2917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2917f85c, lpOverlapped=0x0 | out: lpBuffer=0x2917fb34*, lpNumberOfBytesRead=0x2917f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.929] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.931] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.931] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x2917f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0170.931] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x2917f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x2917f828, pbKeyObject=0x0) returned 0x0 [0170.931] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2917f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2917f500) returned 0x0 [0170.931] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.932] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2917f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2917f500) returned 0x0 [0170.935] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.937] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.937] WriteFile (in: hFile=0x17fc, lpBuffer=0x2917fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2917f830, lpOverlapped=0x0 | out: lpBuffer=0x2917fb34*, lpNumberOfBytesWritten=0x2917f830*=0x428, lpOverlapped=0x0) returned 1 [0170.938] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.938] ReadFile (in: hFile=0x17fc, lpBuffer=0x4450000, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x2917f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x2917f61c*=0x4278, lpOverlapped=0x0) returned 1 [0170.940] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xffffbd88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.941] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4450000, cbInput=0x4278, pPaddingInfo=0x0, pbIV=0x2917f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x2917f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2917f848, pbOutput=0x4450000, pcbResult=0x2917f618) returned 0x0 [0170.941] WriteFile (in: hFile=0x17fc, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2917f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x2917f61c*=0x4280, lpOverlapped=0x0) returned 1 [0170.941] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2917f60c | out: lpNewFilePointer=0x0) returned 1 [0170.941] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.941] WriteFile (in: hFile=0x17fc, lpBuffer=0x2917f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2917f61c, lpOverlapped=0x0 | out: lpBuffer=0x2917f83c*, lpNumberOfBytesWritten=0x2917f61c*=0x8, lpOverlapped=0x0) returned 1 [0170.941] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x4280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.941] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.942] CloseHandle (hObject=0x17fc) returned 1 [0170.942] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.play")) returned 1 [0170.944] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2276 os_tid = 0x2220 [0170.938] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.939] ReadFile (in: hFile=0x1808, lpBuffer=0x292bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x292bf85c, lpOverlapped=0x0 | out: lpBuffer=0x292bfb34*, lpNumberOfBytesRead=0x292bf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.940] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.940] ReadFile (in: hFile=0x1808, lpBuffer=0x292bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x292bf85c, lpOverlapped=0x0 | out: lpBuffer=0x292bfb34*, lpNumberOfBytesRead=0x292bf85c*=0x428, lpOverlapped=0x0) returned 1 [0170.947] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.949] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.949] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x292bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0170.949] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x292bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x292bf828, pbKeyObject=0x0) returned 0x0 [0170.949] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x292bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x292bf500) returned 0x0 [0170.949] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.949] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x292bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x292bf500) returned 0x0 [0170.953] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.955] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.955] WriteFile (in: hFile=0x1808, lpBuffer=0x292bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x292bf830, lpOverlapped=0x0 | out: lpBuffer=0x292bfb34*, lpNumberOfBytesWritten=0x292bf830*=0x428, lpOverlapped=0x0) returned 1 [0170.956] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.956] ReadFile (in: hFile=0x1808, lpBuffer=0x4550000, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x292bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x292bf61c*=0x5516, lpOverlapped=0x0) returned 1 [0170.957] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0xffffaaea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.957] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4550000, cbInput=0x5516, pPaddingInfo=0x0, pbIV=0x292bf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x292bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x292bf848, pbOutput=0x4550000, pcbResult=0x292bf618) returned 0x0 [0170.957] WriteFile (in: hFile=0x1808, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x292bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x292bf61c*=0x5520, lpOverlapped=0x0) returned 1 [0170.957] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292bf60c | out: lpNewFilePointer=0x0) returned 1 [0170.957] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.957] WriteFile (in: hFile=0x1808, lpBuffer=0x292bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x292bf61c, lpOverlapped=0x0 | out: lpBuffer=0x292bf83c*, lpNumberOfBytesWritten=0x292bf61c*=0x8, lpOverlapped=0x0) returned 1 [0170.957] SetFilePointerEx (in: hFile=0x1808, liDistanceToMove=0x5520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.957] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.958] CloseHandle (hObject=0x1808) returned 1 [0170.958] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.play")) returned 1 [0170.960] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2277 os_tid = 0x2224 [0170.964] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.964] ReadFile (in: hFile=0x1810, lpBuffer=0x293ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x293ff85c, lpOverlapped=0x0 | out: lpBuffer=0x293ffb34*, lpNumberOfBytesRead=0x293ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.966] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.966] ReadFile (in: hFile=0x1810, lpBuffer=0x293ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x293ff85c, lpOverlapped=0x0 | out: lpBuffer=0x293ffb34*, lpNumberOfBytesRead=0x293ff85c*=0x428, lpOverlapped=0x0) returned 1 [0170.966] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.968] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.968] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x293ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0170.968] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x293ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x293ff828, pbKeyObject=0x0) returned 0x0 [0170.968] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x293ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x293ff500) returned 0x0 [0170.968] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.968] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x293ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x293ff500) returned 0x0 [0170.971] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.974] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.974] WriteFile (in: hFile=0x1810, lpBuffer=0x293ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x293ff830, lpOverlapped=0x0 | out: lpBuffer=0x293ffb34*, lpNumberOfBytesWritten=0x293ff830*=0x428, lpOverlapped=0x0) returned 1 [0170.974] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.975] ReadFile (in: hFile=0x1810, lpBuffer=0x4650000, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x293ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x293ff61c*=0x8a12, lpOverlapped=0x0) returned 1 [0170.976] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xffff75ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.976] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4650000, cbInput=0x8a12, pPaddingInfo=0x0, pbIV=0x293ff848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x293ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x293ff848, pbOutput=0x4650000, pcbResult=0x293ff618) returned 0x0 [0170.976] WriteFile (in: hFile=0x1810, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x293ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x293ff61c*=0x8a20, lpOverlapped=0x0) returned 1 [0170.976] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x293ff60c | out: lpNewFilePointer=0x0) returned 1 [0170.976] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.976] WriteFile (in: hFile=0x1810, lpBuffer=0x293ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x293ff61c, lpOverlapped=0x0 | out: lpBuffer=0x293ff83c*, lpNumberOfBytesWritten=0x293ff61c*=0x8, lpOverlapped=0x0) returned 1 [0170.976] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x8a20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.976] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0170.976] CloseHandle (hObject=0x1810) returned 1 [0170.976] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0170.978] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.play")) returned 1 [0170.979] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2278 os_tid = 0x2228 [0170.975] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.975] ReadFile (in: hFile=0x1818, lpBuffer=0x2953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2953f85c, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesRead=0x2953f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.986] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.986] ReadFile (in: hFile=0x1818, lpBuffer=0x2953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2953f85c, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesRead=0x2953f85c*=0x428, lpOverlapped=0x0) returned 1 [0170.986] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0170.988] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0170.988] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x2953f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0170.988] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x2953f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x2953f828, pbKeyObject=0x0) returned 0x0 [0170.988] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2953f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2953f500) returned 0x0 [0170.988] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0170.989] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2953f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2953f500) returned 0x0 [0170.992] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.998] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.999] WriteFile (in: hFile=0x1818, lpBuffer=0x2953fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2953f830, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesWritten=0x2953f830*=0x428, lpOverlapped=0x0) returned 1 [0171.000] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.000] ReadFile (in: hFile=0x1818, lpBuffer=0x4750000, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x2953f61c*=0x829a, lpOverlapped=0x0) returned 1 [0171.001] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0xffff7d66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.001] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4750000, cbInput=0x829a, pPaddingInfo=0x0, pbIV=0x2953f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x2953f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2953f848, pbOutput=0x4750000, pcbResult=0x2953f618) returned 0x0 [0171.002] WriteFile (in: hFile=0x1818, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x2953f61c*=0x82a0, lpOverlapped=0x0) returned 1 [0171.002] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2953f60c | out: lpNewFilePointer=0x0) returned 1 [0171.002] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.002] WriteFile (in: hFile=0x1818, lpBuffer=0x2953f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x2953f83c*, lpNumberOfBytesWritten=0x2953f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.002] SetFilePointerEx (in: hFile=0x1818, liDistanceToMove=0x82a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.002] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.002] CloseHandle (hObject=0x1818) returned 1 [0171.002] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.play")) returned 1 [0171.007] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2279 os_tid = 0x222c [0171.001] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.006] ReadFile (in: hFile=0x1820, lpBuffer=0x2967fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2967f85c, lpOverlapped=0x0 | out: lpBuffer=0x2967fb34*, lpNumberOfBytesRead=0x2967f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.011] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.011] ReadFile (in: hFile=0x1820, lpBuffer=0x2967fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2967f85c, lpOverlapped=0x0 | out: lpBuffer=0x2967fb34*, lpNumberOfBytesRead=0x2967f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.012] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.014] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.014] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x2967f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0171.014] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x2967f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x2967f828, pbKeyObject=0x0) returned 0x0 [0171.014] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2967f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2967f500) returned 0x0 [0171.014] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.015] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2967f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2967f500) returned 0x0 [0171.018] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.020] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.020] WriteFile (in: hFile=0x1820, lpBuffer=0x2967fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2967f830, lpOverlapped=0x0 | out: lpBuffer=0x2967fb34*, lpNumberOfBytesWritten=0x2967f830*=0x428, lpOverlapped=0x0) returned 1 [0171.021] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.021] ReadFile (in: hFile=0x1820, lpBuffer=0x4850000, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x2967f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x2967f61c*=0x375e, lpOverlapped=0x0) returned 1 [0171.022] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xffffc8a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.022] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4850000, cbInput=0x375e, pPaddingInfo=0x0, pbIV=0x2967f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x2967f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2967f848, pbOutput=0x4850000, pcbResult=0x2967f618) returned 0x0 [0171.022] WriteFile (in: hFile=0x1820, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2967f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x2967f61c*=0x3760, lpOverlapped=0x0) returned 1 [0171.022] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2967f60c | out: lpNewFilePointer=0x0) returned 1 [0171.022] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.022] WriteFile (in: hFile=0x1820, lpBuffer=0x2967f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2967f61c, lpOverlapped=0x0 | out: lpBuffer=0x2967f83c*, lpNumberOfBytesWritten=0x2967f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.022] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x3760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.022] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.022] CloseHandle (hObject=0x1820) returned 1 [0171.022] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.play")) returned 1 [0171.026] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2280 os_tid = 0x2230 [0171.029] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.029] ReadFile (in: hFile=0x1828, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.030] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.030] ReadFile (in: hFile=0x1828, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.030] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.032] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x297bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0171.032] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x297bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x297bf828, pbKeyObject=0x0) returned 0x0 [0171.032] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x297bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x297bf500) returned 0x0 [0171.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.032] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x297bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x297bf500) returned 0x0 [0171.036] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.038] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.038] WriteFile (in: hFile=0x1828, lpBuffer=0x297bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x297bf830, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesWritten=0x297bf830*=0x428, lpOverlapped=0x0) returned 1 [0171.039] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.039] ReadFile (in: hFile=0x1828, lpBuffer=0x4950000, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x297bf61c*=0x4dba, lpOverlapped=0x0) returned 1 [0171.039] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0xffffb246, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.040] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4950000, cbInput=0x4dba, pPaddingInfo=0x0, pbIV=0x297bf848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x297bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x297bf848, pbOutput=0x4950000, pcbResult=0x297bf618) returned 0x0 [0171.040] WriteFile (in: hFile=0x1828, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x297bf61c*=0x4dc0, lpOverlapped=0x0) returned 1 [0171.040] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x297bf60c | out: lpNewFilePointer=0x0) returned 1 [0171.040] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.040] WriteFile (in: hFile=0x1828, lpBuffer=0x297bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x297bf83c*, lpNumberOfBytesWritten=0x297bf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.040] SetFilePointerEx (in: hFile=0x1828, liDistanceToMove=0x4dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.040] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.040] CloseHandle (hObject=0x1828) returned 1 [0171.040] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.042] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.play")) returned 1 [0171.043] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2281 os_tid = 0x2234 [0171.046] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.046] ReadFile (in: hFile=0x1830, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.048] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.048] ReadFile (in: hFile=0x1830, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.048] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.049] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.050] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x298ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0171.050] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x298ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x298ff828, pbKeyObject=0x0) returned 0x0 [0171.050] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x298ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x298ff500) returned 0x0 [0171.050] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.050] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x298ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x298ff500) returned 0x0 [0171.053] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.055] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.055] WriteFile (in: hFile=0x1830, lpBuffer=0x298ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x298ff830, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesWritten=0x298ff830*=0x428, lpOverlapped=0x0) returned 1 [0171.059] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.059] ReadFile (in: hFile=0x1830, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x298ff61c*=0x3d40, lpOverlapped=0x0) returned 1 [0171.060] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xffffc2c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.060] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4a50000, cbInput=0x3d40, pPaddingInfo=0x0, pbIV=0x298ff848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x298ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x298ff848, pbOutput=0x4a50000, pcbResult=0x298ff618) returned 0x0 [0171.060] WriteFile (in: hFile=0x1830, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x298ff61c*=0x3d50, lpOverlapped=0x0) returned 1 [0171.060] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298ff60c | out: lpNewFilePointer=0x0) returned 1 [0171.060] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.060] WriteFile (in: hFile=0x1830, lpBuffer=0x298ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x298ff83c*, lpNumberOfBytesWritten=0x298ff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.060] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x3d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.060] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.060] CloseHandle (hObject=0x1830) returned 1 [0171.060] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.play")) returned 1 [0171.064] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2282 os_tid = 0x2238 [0171.068] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.068] ReadFile (in: hFile=0x1838, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.069] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.069] ReadFile (in: hFile=0x1838, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.069] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.071] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.072] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x29a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0171.072] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x29a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x29a3f828, pbKeyObject=0x0) returned 0x0 [0171.072] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29a3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29a3f500) returned 0x0 [0171.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.072] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29a3f500) returned 0x0 [0171.075] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.078] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.078] WriteFile (in: hFile=0x1838, lpBuffer=0x29a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29a3f830, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesWritten=0x29a3f830*=0x428, lpOverlapped=0x0) returned 1 [0171.079] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.079] ReadFile (in: hFile=0x1838, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x29a3f61c*=0x5314, lpOverlapped=0x0) returned 1 [0171.080] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0xffffacec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.080] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4b50000, cbInput=0x5314, pPaddingInfo=0x0, pbIV=0x29a3f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x29a3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29a3f848, pbOutput=0x4b50000, pcbResult=0x29a3f618) returned 0x0 [0171.080] WriteFile (in: hFile=0x1838, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x29a3f61c*=0x5320, lpOverlapped=0x0) returned 1 [0171.080] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29a3f60c | out: lpNewFilePointer=0x0) returned 1 [0171.080] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.080] WriteFile (in: hFile=0x1838, lpBuffer=0x29a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29a3f83c*, lpNumberOfBytesWritten=0x29a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.080] SetFilePointerEx (in: hFile=0x1838, liDistanceToMove=0x5320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.080] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.080] CloseHandle (hObject=0x1838) returned 1 [0171.080] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.play")) returned 1 [0171.083] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2283 os_tid = 0x223c [0171.086] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.086] ReadFile (in: hFile=0x1840, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.088] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.088] ReadFile (in: hFile=0x1840, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.088] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.090] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.090] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x29b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0171.090] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x29b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x29b7f828, pbKeyObject=0x0) returned 0x0 [0171.091] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29b7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29b7f500) returned 0x0 [0171.091] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.091] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29b7f500) returned 0x0 [0171.094] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.099] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.099] WriteFile (in: hFile=0x1840, lpBuffer=0x29b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29b7f830, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesWritten=0x29b7f830*=0x428, lpOverlapped=0x0) returned 1 [0171.101] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.101] ReadFile (in: hFile=0x1840, lpBuffer=0x4c50000, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x29b7f61c*=0xb758, lpOverlapped=0x0) returned 1 [0171.103] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xffff48a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.103] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4c50000, cbInput=0xb758, pPaddingInfo=0x0, pbIV=0x29b7f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x29b7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29b7f848, pbOutput=0x4c50000, pcbResult=0x29b7f618) returned 0x0 [0171.103] WriteFile (in: hFile=0x1840, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x29b7f61c*=0xb760, lpOverlapped=0x0) returned 1 [0171.104] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29b7f60c | out: lpNewFilePointer=0x0) returned 1 [0171.104] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.104] WriteFile (in: hFile=0x1840, lpBuffer=0x29b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x29b7f83c*, lpNumberOfBytesWritten=0x29b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.104] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xb760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.104] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.105] CloseHandle (hObject=0x1840) returned 1 [0171.105] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.play")) returned 1 [0171.109] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2284 os_tid = 0x2240 [0171.113] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.113] ReadFile (in: hFile=0x1848, lpBuffer=0x29cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x29cbfb34*, lpNumberOfBytesRead=0x29cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.116] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.116] ReadFile (in: hFile=0x1848, lpBuffer=0x29cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x29cbfb34*, lpNumberOfBytesRead=0x29cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.118] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.118] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x29cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0171.118] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x29cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x29cbf828, pbKeyObject=0x0) returned 0x0 [0171.118] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29cbf500) returned 0x0 [0171.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.119] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29cbf500) returned 0x0 [0171.122] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.124] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.124] WriteFile (in: hFile=0x1848, lpBuffer=0x29cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29cbf830, lpOverlapped=0x0 | out: lpBuffer=0x29cbfb34*, lpNumberOfBytesWritten=0x29cbf830*=0x428, lpOverlapped=0x0) returned 1 [0171.125] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.125] ReadFile (in: hFile=0x1848, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x29cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x29cbf61c*=0x3d90, lpOverlapped=0x0) returned 1 [0171.126] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0xffffc270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.126] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4d50000, cbInput=0x3d90, pPaddingInfo=0x0, pbIV=0x29cbf848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x29cbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29cbf848, pbOutput=0x4d50000, pcbResult=0x29cbf618) returned 0x0 [0171.126] WriteFile (in: hFile=0x1848, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x29cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x29cbf61c*=0x3da0, lpOverlapped=0x0) returned 1 [0171.126] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29cbf60c | out: lpNewFilePointer=0x0) returned 1 [0171.126] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.126] WriteFile (in: hFile=0x1848, lpBuffer=0x29cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x29cbf83c*, lpNumberOfBytesWritten=0x29cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.126] SetFilePointerEx (in: hFile=0x1848, liDistanceToMove=0x3da0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.127] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.127] CloseHandle (hObject=0x1848) returned 1 [0171.127] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.play")) returned 1 [0171.129] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2285 os_tid = 0x2244 [0171.132] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.133] ReadFile (in: hFile=0x1850, lpBuffer=0x29dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29dff85c, lpOverlapped=0x0 | out: lpBuffer=0x29dffb34*, lpNumberOfBytesRead=0x29dff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.134] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.134] ReadFile (in: hFile=0x1850, lpBuffer=0x29dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29dff85c, lpOverlapped=0x0 | out: lpBuffer=0x29dffb34*, lpNumberOfBytesRead=0x29dff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.134] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.136] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.136] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x29dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0171.136] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x29dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x29dff828, pbKeyObject=0x0) returned 0x0 [0171.137] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29dff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29dff500) returned 0x0 [0171.137] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.137] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29dff500) returned 0x0 [0171.140] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.142] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.143] WriteFile (in: hFile=0x1850, lpBuffer=0x29dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29dff830, lpOverlapped=0x0 | out: lpBuffer=0x29dffb34*, lpNumberOfBytesWritten=0x29dff830*=0x428, lpOverlapped=0x0) returned 1 [0171.144] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.144] ReadFile (in: hFile=0x1850, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x29dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x29dff61c*=0x6e34, lpOverlapped=0x0) returned 1 [0171.145] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xffff91cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.145] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4e50000, cbInput=0x6e34, pPaddingInfo=0x0, pbIV=0x29dff848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x29dff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29dff848, pbOutput=0x4e50000, pcbResult=0x29dff618) returned 0x0 [0171.145] WriteFile (in: hFile=0x1850, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x29dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x29dff61c*=0x6e40, lpOverlapped=0x0) returned 1 [0171.145] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29dff60c | out: lpNewFilePointer=0x0) returned 1 [0171.145] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.145] WriteFile (in: hFile=0x1850, lpBuffer=0x29dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dff61c, lpOverlapped=0x0 | out: lpBuffer=0x29dff83c*, lpNumberOfBytesWritten=0x29dff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.145] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x6e40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.146] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.146] CloseHandle (hObject=0x1850) returned 1 [0171.146] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.play")) returned 1 [0171.149] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2286 os_tid = 0x2248 [0171.152] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.152] ReadFile (in: hFile=0x1858, lpBuffer=0x29f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29f3fb34*, lpNumberOfBytesRead=0x29f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.154] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.154] ReadFile (in: hFile=0x1858, lpBuffer=0x29f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29f3fb34*, lpNumberOfBytesRead=0x29f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.154] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.156] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.156] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x29f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0171.156] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x29f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x29f3f828, pbKeyObject=0x0) returned 0x0 [0171.156] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29f3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29f3f500) returned 0x0 [0171.157] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.157] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29f3f500) returned 0x0 [0171.160] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.162] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.162] WriteFile (in: hFile=0x1858, lpBuffer=0x29f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29f3f830, lpOverlapped=0x0 | out: lpBuffer=0x29f3fb34*, lpNumberOfBytesWritten=0x29f3f830*=0x428, lpOverlapped=0x0) returned 1 [0171.163] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.163] ReadFile (in: hFile=0x1858, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x29f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x29f3f61c*=0x44e6, lpOverlapped=0x0) returned 1 [0171.164] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0xffffbb1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.164] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4f50000, cbInput=0x44e6, pPaddingInfo=0x0, pbIV=0x29f3f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x29f3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29f3f848, pbOutput=0x4f50000, pcbResult=0x29f3f618) returned 0x0 [0171.164] WriteFile (in: hFile=0x1858, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x29f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x29f3f61c*=0x44f0, lpOverlapped=0x0) returned 1 [0171.164] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29f3f60c | out: lpNewFilePointer=0x0) returned 1 [0171.164] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.164] WriteFile (in: hFile=0x1858, lpBuffer=0x29f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29f3f83c*, lpNumberOfBytesWritten=0x29f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.164] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x44f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.164] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.164] CloseHandle (hObject=0x1858) returned 1 [0171.165] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.play")) returned 1 [0171.169] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2287 os_tid = 0x224c [0171.172] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.172] ReadFile (in: hFile=0x1860, lpBuffer=0x2a07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a07fb34*, lpNumberOfBytesRead=0x2a07f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.173] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.173] ReadFile (in: hFile=0x1860, lpBuffer=0x2a07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a07fb34*, lpNumberOfBytesRead=0x2a07f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.175] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.175] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x2a07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0171.175] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x2a07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x2a07f828, pbKeyObject=0x0) returned 0x0 [0171.175] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a07f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a07f500) returned 0x0 [0171.175] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.176] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a07f500) returned 0x0 [0171.179] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.181] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.181] WriteFile (in: hFile=0x1860, lpBuffer=0x2a07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a07f830, lpOverlapped=0x0 | out: lpBuffer=0x2a07fb34*, lpNumberOfBytesWritten=0x2a07f830*=0x428, lpOverlapped=0x0) returned 1 [0171.182] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.182] ReadFile (in: hFile=0x1860, lpBuffer=0x5050000, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x2a07f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x2a07f61c*=0xd04, lpOverlapped=0x0) returned 1 [0171.182] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xfffff2fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.182] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5050000, cbInput=0xd04, pPaddingInfo=0x0, pbIV=0x2a07f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x2a07f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a07f848, pbOutput=0x5050000, pcbResult=0x2a07f618) returned 0x0 [0171.182] WriteFile (in: hFile=0x1860, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2a07f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x2a07f61c*=0xd10, lpOverlapped=0x0) returned 1 [0171.182] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a07f60c | out: lpNewFilePointer=0x0) returned 1 [0171.182] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.183] WriteFile (in: hFile=0x1860, lpBuffer=0x2a07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a07f83c*, lpNumberOfBytesWritten=0x2a07f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.183] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.183] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.183] CloseHandle (hObject=0x1860) returned 1 [0171.183] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.play")) returned 1 [0171.185] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2288 os_tid = 0x2250 [0171.188] SetFilePointerEx (in: hFile=0x1868, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.189] ReadFile (in: hFile=0x1868, lpBuffer=0x2a1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2a1bfb34*, lpNumberOfBytesRead=0x2a1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.190] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.192] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.192] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x2a1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0171.192] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x2a1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x2a1bf828, pbKeyObject=0x0) returned 0x0 [0171.192] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a1bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a1bf500) returned 0x0 [0171.192] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.192] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a1bf500) returned 0x0 [0171.196] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.197] SetFilePointerEx (in: hFile=0x1868, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.198] WriteFile (in: hFile=0x1868, lpBuffer=0x2a1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2a1bfb34*, lpNumberOfBytesWritten=0x2a1bf830*=0x428, lpOverlapped=0x0) returned 1 [0171.198] SetFilePointerEx (in: hFile=0x1868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.198] ReadFile (in: hFile=0x1868, lpBuffer=0x5150000, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x2a1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x2a1bf61c*=0x5b0, lpOverlapped=0x0) returned 1 [0171.199] SetFilePointerEx (in: hFile=0x1868, liDistanceToMove=0xfffffa50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.199] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5150000, cbInput=0x5b0, pPaddingInfo=0x0, pbIV=0x2a1bf848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x2a1bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a1bf848, pbOutput=0x5150000, pcbResult=0x2a1bf618) returned 0x0 [0171.199] WriteFile (in: hFile=0x1868, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2a1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x2a1bf61c*=0x5c0, lpOverlapped=0x0) returned 1 [0171.199] SetFilePointerEx (in: hFile=0x1868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1bf60c | out: lpNewFilePointer=0x0) returned 1 [0171.199] SetFilePointerEx (in: hFile=0x1868, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.199] WriteFile (in: hFile=0x1868, lpBuffer=0x2a1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a1bf83c*, lpNumberOfBytesWritten=0x2a1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.199] SetFilePointerEx (in: hFile=0x1868, liDistanceToMove=0x5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.199] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.199] CloseHandle (hObject=0x1868) returned 1 [0171.199] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.play")) returned 1 [0171.202] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2289 os_tid = 0x2254 [0171.204] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.205] ReadFile (in: hFile=0x1870, lpBuffer=0x2a2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a2ffb34*, lpNumberOfBytesRead=0x2a2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.206] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.206] ReadFile (in: hFile=0x1870, lpBuffer=0x2a2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a2ffb34*, lpNumberOfBytesRead=0x2a2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.207] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.209] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x2a2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0171.209] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x2a2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x2a2ff828, pbKeyObject=0x0) returned 0x0 [0171.209] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a2ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a2ff500) returned 0x0 [0171.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.209] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a2ff500) returned 0x0 [0171.213] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.215] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.215] WriteFile (in: hFile=0x1870, lpBuffer=0x2a2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2a2ffb34*, lpNumberOfBytesWritten=0x2a2ff830*=0x428, lpOverlapped=0x0) returned 1 [0171.216] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.216] ReadFile (in: hFile=0x1870, lpBuffer=0x5250000, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x2a2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x2a2ff61c*=0x14c2, lpOverlapped=0x0) returned 1 [0171.216] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xffffeb3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.216] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5250000, cbInput=0x14c2, pPaddingInfo=0x0, pbIV=0x2a2ff848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x2a2ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a2ff848, pbOutput=0x5250000, pcbResult=0x2a2ff618) returned 0x0 [0171.216] WriteFile (in: hFile=0x1870, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2a2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x2a2ff61c*=0x14d0, lpOverlapped=0x0) returned 1 [0171.216] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a2ff60c | out: lpNewFilePointer=0x0) returned 1 [0171.216] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.216] WriteFile (in: hFile=0x1870, lpBuffer=0x2a2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a2ff83c*, lpNumberOfBytesWritten=0x2a2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.216] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x14d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.216] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.216] CloseHandle (hObject=0x1870) returned 1 [0171.216] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.218] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.play")) returned 1 [0171.219] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2290 os_tid = 0x2258 [0171.207] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.222] ReadFile (in: hFile=0x1878, lpBuffer=0x2a43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a43fb34*, lpNumberOfBytesRead=0x2a43f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.223] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.223] ReadFile (in: hFile=0x1878, lpBuffer=0x2a43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a43fb34*, lpNumberOfBytesRead=0x2a43f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.223] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.225] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.225] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x2a43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0171.225] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x2a43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x2a43f828, pbKeyObject=0x0) returned 0x0 [0171.225] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a43f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a43f500) returned 0x0 [0171.225] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.225] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a43f500) returned 0x0 [0171.228] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.231] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.231] WriteFile (in: hFile=0x1878, lpBuffer=0x2a43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a43f830, lpOverlapped=0x0 | out: lpBuffer=0x2a43fb34*, lpNumberOfBytesWritten=0x2a43f830*=0x428, lpOverlapped=0x0) returned 1 [0171.232] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.232] ReadFile (in: hFile=0x1878, lpBuffer=0x5350000, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x2a43f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x2a43f61c*=0x1b16, lpOverlapped=0x0) returned 1 [0171.232] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xffffe4ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.232] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5350000, cbInput=0x1b16, pPaddingInfo=0x0, pbIV=0x2a43f848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x2a43f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a43f848, pbOutput=0x5350000, pcbResult=0x2a43f618) returned 0x0 [0171.233] WriteFile (in: hFile=0x1878, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2a43f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x2a43f61c*=0x1b20, lpOverlapped=0x0) returned 1 [0171.233] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a43f60c | out: lpNewFilePointer=0x0) returned 1 [0171.233] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.233] WriteFile (in: hFile=0x1878, lpBuffer=0x2a43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a43f83c*, lpNumberOfBytesWritten=0x2a43f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.233] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x1b20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.233] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.233] CloseHandle (hObject=0x1878) returned 1 [0171.233] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.play")) returned 1 [0171.236] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2291 os_tid = 0x225c [0171.248] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.248] ReadFile (in: hFile=0x7dc, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.249] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.249] ReadFile (in: hFile=0x7dc, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.250] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.252] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.252] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x125f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0171.252] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x125f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x125f828, pbKeyObject=0x0) returned 0x0 [0171.252] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x125f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x125f500) returned 0x0 [0171.253] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.253] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x125f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x125f500) returned 0x0 [0171.256] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.258] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.258] WriteFile (in: hFile=0x7dc, lpBuffer=0x125fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x125f830, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesWritten=0x125f830*=0x428, lpOverlapped=0x0) returned 1 [0171.259] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.259] ReadFile (in: hFile=0x7dc, lpBuffer=0x5450000, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x125f61c*=0xa442, lpOverlapped=0x0) returned 1 [0171.260] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xffff5bbe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.260] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5450000, cbInput=0xa442, pPaddingInfo=0x0, pbIV=0x125f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x125f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x125f848, pbOutput=0x5450000, pcbResult=0x125f618) returned 0x0 [0171.260] WriteFile (in: hFile=0x7dc, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x125f61c*=0xa450, lpOverlapped=0x0) returned 1 [0171.260] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125f60c | out: lpNewFilePointer=0x0) returned 1 [0171.261] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.261] WriteFile (in: hFile=0x7dc, lpBuffer=0x125f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x125f83c*, lpNumberOfBytesWritten=0x125f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.261] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xa450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.261] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.261] CloseHandle (hObject=0x7dc) returned 1 [0171.261] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.play")) returned 1 [0171.264] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2292 os_tid = 0x2260 [0171.268] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.268] ReadFile (in: hFile=0x1880, lpBuffer=0x123cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x123cf85c, lpOverlapped=0x0 | out: lpBuffer=0x123cfb34*, lpNumberOfBytesRead=0x123cf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.269] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.269] ReadFile (in: hFile=0x1880, lpBuffer=0x123cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x123cf85c, lpOverlapped=0x0 | out: lpBuffer=0x123cfb34*, lpNumberOfBytesRead=0x123cf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.269] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.271] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.271] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x123cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0171.271] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x123cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x123cf828, pbKeyObject=0x0) returned 0x0 [0171.271] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x123cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x123cf500) returned 0x0 [0171.271] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.271] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x123cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x123cf500) returned 0x0 [0171.275] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.277] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.277] WriteFile (in: hFile=0x1880, lpBuffer=0x123cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x123cf830, lpOverlapped=0x0 | out: lpBuffer=0x123cfb34*, lpNumberOfBytesWritten=0x123cf830*=0x428, lpOverlapped=0x0) returned 1 [0171.278] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.278] ReadFile (in: hFile=0x1880, lpBuffer=0x2850000, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x123cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x123cf61c*=0x136a, lpOverlapped=0x0) returned 1 [0171.278] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0xffffec96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.278] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2850000, cbInput=0x136a, pPaddingInfo=0x0, pbIV=0x123cf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x123cf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x123cf848, pbOutput=0x2850000, pcbResult=0x123cf618) returned 0x0 [0171.278] WriteFile (in: hFile=0x1880, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x123cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x123cf61c*=0x1370, lpOverlapped=0x0) returned 1 [0171.278] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x123cf60c | out: lpNewFilePointer=0x0) returned 1 [0171.278] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.278] WriteFile (in: hFile=0x1880, lpBuffer=0x123cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x123cf61c, lpOverlapped=0x0 | out: lpBuffer=0x123cf83c*, lpNumberOfBytesWritten=0x123cf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.278] SetFilePointerEx (in: hFile=0x1880, liDistanceToMove=0x1370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.279] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.279] CloseHandle (hObject=0x1880) returned 1 [0171.279] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.play")) returned 1 [0171.281] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2293 os_tid = 0x2264 [0171.285] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.285] ReadFile (in: hFile=0x1888, lpBuffer=0x2a57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a57fb34*, lpNumberOfBytesRead=0x2a57f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.286] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.286] ReadFile (in: hFile=0x1888, lpBuffer=0x2a57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a57fb34*, lpNumberOfBytesRead=0x2a57f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.286] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.288] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.288] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x2a57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0171.288] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x2a57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x2a57f828, pbKeyObject=0x0) returned 0x0 [0171.288] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a57f500) returned 0x0 [0171.288] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.288] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a57f500) returned 0x0 [0171.292] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.294] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.295] WriteFile (in: hFile=0x1888, lpBuffer=0x2a57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a57f830, lpOverlapped=0x0 | out: lpBuffer=0x2a57fb34*, lpNumberOfBytesWritten=0x2a57f830*=0x428, lpOverlapped=0x0) returned 1 [0171.295] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.295] ReadFile (in: hFile=0x1888, lpBuffer=0x5550000, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x2a57f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x2a57f61c*=0x60b7, lpOverlapped=0x0) returned 1 [0171.296] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0xffff9f49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.296] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5550000, cbInput=0x60b7, pPaddingInfo=0x0, pbIV=0x2a57f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x2a57f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a57f848, pbOutput=0x5550000, pcbResult=0x2a57f618) returned 0x0 [0171.296] WriteFile (in: hFile=0x1888, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2a57f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x2a57f61c*=0x60c0, lpOverlapped=0x0) returned 1 [0171.297] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a57f60c | out: lpNewFilePointer=0x0) returned 1 [0171.297] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.297] WriteFile (in: hFile=0x1888, lpBuffer=0x2a57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a57f83c*, lpNumberOfBytesWritten=0x2a57f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.297] SetFilePointerEx (in: hFile=0x1888, liDistanceToMove=0x60c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.297] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.297] CloseHandle (hObject=0x1888) returned 1 [0171.297] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.play")) returned 1 [0171.300] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2294 os_tid = 0x2268 [0171.303] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.303] ReadFile (in: hFile=0x1890, lpBuffer=0x2a6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2a6bfb34*, lpNumberOfBytesRead=0x2a6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.305] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.305] ReadFile (in: hFile=0x1890, lpBuffer=0x2a6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2a6bfb34*, lpNumberOfBytesRead=0x2a6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.305] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.307] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.307] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x2a6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0171.307] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x2a6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x2a6bf828, pbKeyObject=0x0) returned 0x0 [0171.307] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a6bf500) returned 0x0 [0171.307] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.311] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a6bf500) returned 0x0 [0171.315] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.318] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.318] WriteFile (in: hFile=0x1890, lpBuffer=0x2a6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2a6bfb34*, lpNumberOfBytesWritten=0x2a6bf830*=0x428, lpOverlapped=0x0) returned 1 [0171.319] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.319] ReadFile (in: hFile=0x1890, lpBuffer=0x5650000, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x2a6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x2a6bf61c*=0x40d4, lpOverlapped=0x0) returned 1 [0171.320] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0xffffbf2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.320] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5650000, cbInput=0x40d4, pPaddingInfo=0x0, pbIV=0x2a6bf848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x2a6bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a6bf848, pbOutput=0x5650000, pcbResult=0x2a6bf618) returned 0x0 [0171.320] WriteFile (in: hFile=0x1890, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2a6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x2a6bf61c*=0x40e0, lpOverlapped=0x0) returned 1 [0171.320] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a6bf60c | out: lpNewFilePointer=0x0) returned 1 [0171.320] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.320] WriteFile (in: hFile=0x1890, lpBuffer=0x2a6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2a6bf83c*, lpNumberOfBytesWritten=0x2a6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.321] SetFilePointerEx (in: hFile=0x1890, liDistanceToMove=0x40e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.321] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.321] CloseHandle (hObject=0x1890) returned 1 [0171.321] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.play")) returned 1 [0171.324] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2295 os_tid = 0x226c [0171.327] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.328] ReadFile (in: hFile=0x1898, lpBuffer=0x2a7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a7ffb34*, lpNumberOfBytesRead=0x2a7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.329] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.329] ReadFile (in: hFile=0x1898, lpBuffer=0x2a7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2a7ffb34*, lpNumberOfBytesRead=0x2a7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.329] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.331] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.331] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x2a7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0171.331] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x2a7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x2a7ff828, pbKeyObject=0x0) returned 0x0 [0171.331] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a7ff500) returned 0x0 [0171.331] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.332] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a7ff500) returned 0x0 [0171.335] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.337] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.337] WriteFile (in: hFile=0x1898, lpBuffer=0x2a7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2a7ffb34*, lpNumberOfBytesWritten=0x2a7ff830*=0x428, lpOverlapped=0x0) returned 1 [0171.338] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.338] ReadFile (in: hFile=0x1898, lpBuffer=0x5750000, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x2a7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x2a7ff61c*=0x5f39, lpOverlapped=0x0) returned 1 [0171.339] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xffffa0c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.339] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5750000, cbInput=0x5f39, pPaddingInfo=0x0, pbIV=0x2a7ff848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x2a7ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a7ff848, pbOutput=0x5750000, pcbResult=0x2a7ff618) returned 0x0 [0171.339] WriteFile (in: hFile=0x1898, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2a7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x2a7ff61c*=0x5f40, lpOverlapped=0x0) returned 1 [0171.340] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7ff60c | out: lpNewFilePointer=0x0) returned 1 [0171.340] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.340] WriteFile (in: hFile=0x1898, lpBuffer=0x2a7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a7ff83c*, lpNumberOfBytesWritten=0x2a7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.340] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x5f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.340] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.340] CloseHandle (hObject=0x1898) returned 1 [0171.340] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.play")) returned 1 [0171.343] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2296 os_tid = 0x2270 [0171.346] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.346] ReadFile (in: hFile=0x18a0, lpBuffer=0x2a93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a93fb34*, lpNumberOfBytesRead=0x2a93f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.347] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.347] ReadFile (in: hFile=0x18a0, lpBuffer=0x2a93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2a93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2a93fb34*, lpNumberOfBytesRead=0x2a93f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.348] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.350] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.350] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x2a93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0171.350] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x2a93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x2a93f828, pbKeyObject=0x0) returned 0x0 [0171.350] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2a93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2a93f500) returned 0x0 [0171.350] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.350] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2a93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2a93f500) returned 0x0 [0171.353] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.356] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.356] WriteFile (in: hFile=0x18a0, lpBuffer=0x2a93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2a93f830, lpOverlapped=0x0 | out: lpBuffer=0x2a93fb34*, lpNumberOfBytesWritten=0x2a93f830*=0x428, lpOverlapped=0x0) returned 1 [0171.357] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.357] ReadFile (in: hFile=0x18a0, lpBuffer=0x5850000, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x2a93f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x2a93f61c*=0x4752, lpOverlapped=0x0) returned 1 [0171.357] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0xffffb8ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.358] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5850000, cbInput=0x4752, pPaddingInfo=0x0, pbIV=0x2a93f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x2a93f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2a93f848, pbOutput=0x5850000, pcbResult=0x2a93f618) returned 0x0 [0171.358] WriteFile (in: hFile=0x18a0, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a93f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x2a93f61c*=0x4760, lpOverlapped=0x0) returned 1 [0171.358] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a93f60c | out: lpNewFilePointer=0x0) returned 1 [0171.358] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.358] WriteFile (in: hFile=0x18a0, lpBuffer=0x2a93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a93f83c*, lpNumberOfBytesWritten=0x2a93f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.358] SetFilePointerEx (in: hFile=0x18a0, liDistanceToMove=0x4760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.358] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.358] CloseHandle (hObject=0x18a0) returned 1 [0171.358] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.play")) returned 1 [0171.361] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2297 os_tid = 0x2274 [0171.364] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.364] ReadFile (in: hFile=0x18a8, lpBuffer=0x2aa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2aa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2aa7fb34*, lpNumberOfBytesRead=0x2aa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.366] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.366] ReadFile (in: hFile=0x18a8, lpBuffer=0x2aa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2aa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2aa7fb34*, lpNumberOfBytesRead=0x2aa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.366] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.368] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x2aa7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0171.368] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x2aa7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x2aa7f828, pbKeyObject=0x0) returned 0x0 [0171.368] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2aa7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2aa7f500) returned 0x0 [0171.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.369] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2aa7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2aa7f500) returned 0x0 [0171.372] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.374] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.374] WriteFile (in: hFile=0x18a8, lpBuffer=0x2aa7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2aa7f830, lpOverlapped=0x0 | out: lpBuffer=0x2aa7fb34*, lpNumberOfBytesWritten=0x2aa7f830*=0x428, lpOverlapped=0x0) returned 1 [0171.375] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.375] ReadFile (in: hFile=0x18a8, lpBuffer=0x5950000, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x2aa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x2aa7f61c*=0x11dfe, lpOverlapped=0x0) returned 1 [0171.377] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffee202, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.377] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5950000, cbInput=0x11dfe, pPaddingInfo=0x0, pbIV=0x2aa7f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x2aa7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2aa7f848, pbOutput=0x5950000, pcbResult=0x2aa7f618) returned 0x0 [0171.377] WriteFile (in: hFile=0x18a8, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2aa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x2aa7f61c*=0x11e00, lpOverlapped=0x0) returned 1 [0171.378] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aa7f60c | out: lpNewFilePointer=0x0) returned 1 [0171.378] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.378] WriteFile (in: hFile=0x18a8, lpBuffer=0x2aa7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2aa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2aa7f83c*, lpNumberOfBytesWritten=0x2aa7f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.378] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0x11e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.378] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.378] CloseHandle (hObject=0x18a8) returned 1 [0171.378] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.play")) returned 1 [0171.385] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2298 os_tid = 0x2278 [0171.381] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.381] ReadFile (in: hFile=0x18b0, lpBuffer=0x2abbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2abbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2abbfb34*, lpNumberOfBytesRead=0x2abbf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.388] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.388] ReadFile (in: hFile=0x18b0, lpBuffer=0x2abbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2abbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2abbfb34*, lpNumberOfBytesRead=0x2abbf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.399] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.401] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.401] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x2abbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0171.401] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x2abbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x2abbf828, pbKeyObject=0x0) returned 0x0 [0171.401] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2abbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2abbf500) returned 0x0 [0171.401] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.401] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2abbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2abbf500) returned 0x0 [0171.405] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.407] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.407] WriteFile (in: hFile=0x18b0, lpBuffer=0x2abbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2abbf830, lpOverlapped=0x0 | out: lpBuffer=0x2abbfb34*, lpNumberOfBytesWritten=0x2abbf830*=0x428, lpOverlapped=0x0) returned 1 [0171.408] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.408] ReadFile (in: hFile=0x18b0, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x2abbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x2abbf61c*=0x559a, lpOverlapped=0x0) returned 1 [0171.415] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xffffaa66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.415] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x5a50000, cbInput=0x559a, pPaddingInfo=0x0, pbIV=0x2abbf848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x2abbf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x2abbf848, pbOutput=0x5a50000, pcbResult=0x2abbf618) returned 0x0 [0171.415] WriteFile (in: hFile=0x18b0, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2abbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x2abbf61c*=0x55a0, lpOverlapped=0x0) returned 1 [0171.415] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2abbf60c | out: lpNewFilePointer=0x0) returned 1 [0171.416] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.416] WriteFile (in: hFile=0x18b0, lpBuffer=0x2abbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2abbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2abbf83c*, lpNumberOfBytesWritten=0x2abbf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.416] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x55a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.416] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0171.416] CloseHandle (hObject=0x18b0) returned 1 [0171.416] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.play")) returned 1 [0171.419] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2299 os_tid = 0x227c [0171.382] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.382] ReadFile (in: hFile=0x18b8, lpBuffer=0x2acffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2acff85c, lpOverlapped=0x0 | out: lpBuffer=0x2acffb34*, lpNumberOfBytesRead=0x2acff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.389] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.389] ReadFile (in: hFile=0x18b8, lpBuffer=0x2acffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2acff85c, lpOverlapped=0x0 | out: lpBuffer=0x2acffb34*, lpNumberOfBytesRead=0x2acff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.390] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.391] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.392] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x2acff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0171.392] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x2acff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x2acff828, pbKeyObject=0x0) returned 0x0 [0171.392] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2acff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2acff500) returned 0x0 [0171.392] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.392] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2acff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2acff500) returned 0x0 [0171.395] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.398] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.398] WriteFile (in: hFile=0x18b8, lpBuffer=0x2acffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2acff830, lpOverlapped=0x0 | out: lpBuffer=0x2acffb34*, lpNumberOfBytesWritten=0x2acff830*=0x428, lpOverlapped=0x0) returned 1 [0171.398] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.398] ReadFile (in: hFile=0x18b8, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x2acff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x2acff61c*=0x65e6, lpOverlapped=0x0) returned 1 [0171.408] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0xffff9a1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.409] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5b50000, cbInput=0x65e6, pPaddingInfo=0x0, pbIV=0x2acff848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x2acff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2acff848, pbOutput=0x5b50000, pcbResult=0x2acff618) returned 0x0 [0171.409] WriteFile (in: hFile=0x18b8, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2acff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x2acff61c*=0x65f0, lpOverlapped=0x0) returned 1 [0171.409] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acff60c | out: lpNewFilePointer=0x0) returned 1 [0171.409] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.409] WriteFile (in: hFile=0x18b8, lpBuffer=0x2acff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2acff61c, lpOverlapped=0x0 | out: lpBuffer=0x2acff83c*, lpNumberOfBytesWritten=0x2acff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.409] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0x65f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.409] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.409] CloseHandle (hObject=0x18b8) returned 1 [0171.409] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.411] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.play")) returned 1 [0171.412] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2300 os_tid = 0x2280 [0171.423] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.423] ReadFile (in: hFile=0x18c0, lpBuffer=0x2ae3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ae3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ae3fb34*, lpNumberOfBytesRead=0x2ae3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.424] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.424] ReadFile (in: hFile=0x18c0, lpBuffer=0x2ae3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ae3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ae3fb34*, lpNumberOfBytesRead=0x2ae3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.424] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.426] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.426] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x2ae3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0171.426] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x2ae3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x2ae3f828, pbKeyObject=0x0) returned 0x0 [0171.426] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ae3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ae3f500) returned 0x0 [0171.426] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.426] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ae3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ae3f500) returned 0x0 [0171.429] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.432] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.432] WriteFile (in: hFile=0x18c0, lpBuffer=0x2ae3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ae3f830, lpOverlapped=0x0 | out: lpBuffer=0x2ae3fb34*, lpNumberOfBytesWritten=0x2ae3f830*=0x428, lpOverlapped=0x0) returned 1 [0171.433] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.433] ReadFile (in: hFile=0x18c0, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x2ae3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x2ae3f61c*=0x2dae, lpOverlapped=0x0) returned 1 [0171.433] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0xffffd252, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.434] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5c50000, cbInput=0x2dae, pPaddingInfo=0x0, pbIV=0x2ae3f848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x2ae3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2ae3f848, pbOutput=0x5c50000, pcbResult=0x2ae3f618) returned 0x0 [0171.434] WriteFile (in: hFile=0x18c0, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2ae3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x2ae3f61c*=0x2db0, lpOverlapped=0x0) returned 1 [0171.434] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ae3f60c | out: lpNewFilePointer=0x0) returned 1 [0171.434] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.434] WriteFile (in: hFile=0x18c0, lpBuffer=0x2ae3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ae3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ae3f83c*, lpNumberOfBytesWritten=0x2ae3f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.434] SetFilePointerEx (in: hFile=0x18c0, liDistanceToMove=0x2db0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.434] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.434] CloseHandle (hObject=0x18c0) returned 1 [0171.434] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.play")) returned 1 [0171.440] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2301 os_tid = 0x2284 [0171.446] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.446] ReadFile (in: hFile=0x18c8, lpBuffer=0x2af7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2af7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2af7fb34*, lpNumberOfBytesRead=0x2af7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.448] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.448] ReadFile (in: hFile=0x18c8, lpBuffer=0x2af7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2af7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2af7fb34*, lpNumberOfBytesRead=0x2af7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.468] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.471] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.471] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x2af7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0171.471] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x2af7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x2af7f828, pbKeyObject=0x0) returned 0x0 [0171.471] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2af7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2af7f500) returned 0x0 [0171.471] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.471] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2af7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2af7f500) returned 0x0 [0171.475] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.478] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.478] WriteFile (in: hFile=0x18c8, lpBuffer=0x2af7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2af7f830, lpOverlapped=0x0 | out: lpBuffer=0x2af7fb34*, lpNumberOfBytesWritten=0x2af7f830*=0x428, lpOverlapped=0x0) returned 1 [0171.479] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.479] ReadFile (in: hFile=0x18c8, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x2af7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x2af7f61c*=0x3632, lpOverlapped=0x0) returned 1 [0171.481] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xffffc9ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.481] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5d50000, cbInput=0x3632, pPaddingInfo=0x0, pbIV=0x2af7f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x2af7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2af7f848, pbOutput=0x5d50000, pcbResult=0x2af7f618) returned 0x0 [0171.482] WriteFile (in: hFile=0x18c8, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2af7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x2af7f61c*=0x3640, lpOverlapped=0x0) returned 1 [0171.482] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2af7f60c | out: lpNewFilePointer=0x0) returned 1 [0171.482] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.482] WriteFile (in: hFile=0x18c8, lpBuffer=0x2af7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2af7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2af7f83c*, lpNumberOfBytesWritten=0x2af7f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.482] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0x3640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.482] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.482] CloseHandle (hObject=0x18c8) returned 1 [0171.482] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.play")) returned 1 [0171.488] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2302 os_tid = 0x2288 [0171.492] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.492] ReadFile (in: hFile=0x18d0, lpBuffer=0x2b0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2b0bfb34*, lpNumberOfBytesRead=0x2b0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.494] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.494] ReadFile (in: hFile=0x18d0, lpBuffer=0x2b0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2b0bfb34*, lpNumberOfBytesRead=0x2b0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.494] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.497] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.497] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x2b0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0171.497] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x2b0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x2b0bf828, pbKeyObject=0x0) returned 0x0 [0171.497] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b0bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b0bf500) returned 0x0 [0171.497] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.497] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b0bf500) returned 0x0 [0171.502] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.505] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.506] WriteFile (in: hFile=0x18d0, lpBuffer=0x2b0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b0bf830, lpOverlapped=0x0 | out: lpBuffer=0x2b0bfb34*, lpNumberOfBytesWritten=0x2b0bf830*=0x428, lpOverlapped=0x0) returned 1 [0171.507] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.507] ReadFile (in: hFile=0x18d0, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x2b0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x2b0bf61c*=0x1b11, lpOverlapped=0x0) returned 1 [0171.510] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0xffffe4ef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.510] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5e50000, cbInput=0x1b11, pPaddingInfo=0x0, pbIV=0x2b0bf848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x2b0bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2b0bf848, pbOutput=0x5e50000, pcbResult=0x2b0bf618) returned 0x0 [0171.510] WriteFile (in: hFile=0x18d0, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2b0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x2b0bf61c*=0x1b20, lpOverlapped=0x0) returned 1 [0171.510] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0bf60c | out: lpNewFilePointer=0x0) returned 1 [0171.510] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.510] WriteFile (in: hFile=0x18d0, lpBuffer=0x2b0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b0bf83c*, lpNumberOfBytesWritten=0x2b0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.510] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0x1b20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.511] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.511] CloseHandle (hObject=0x18d0) returned 1 [0171.511] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.play")) returned 1 [0171.515] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2303 os_tid = 0x228c [0171.519] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.519] ReadFile (in: hFile=0x18d8, lpBuffer=0x2b1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2b1ffb34*, lpNumberOfBytesRead=0x2b1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.520] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.521] ReadFile (in: hFile=0x18d8, lpBuffer=0x2b1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2b1ffb34*, lpNumberOfBytesRead=0x2b1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.521] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.523] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x2b1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0171.523] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x2b1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x2b1ff828, pbKeyObject=0x0) returned 0x0 [0171.523] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b1ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b1ff500) returned 0x0 [0171.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.524] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b1ff500) returned 0x0 [0171.527] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.530] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.530] WriteFile (in: hFile=0x18d8, lpBuffer=0x2b1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b1ff830, lpOverlapped=0x0 | out: lpBuffer=0x2b1ffb34*, lpNumberOfBytesWritten=0x2b1ff830*=0x428, lpOverlapped=0x0) returned 1 [0171.531] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.531] ReadFile (in: hFile=0x18d8, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x2b1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x2b1ff61c*=0x227a, lpOverlapped=0x0) returned 1 [0171.532] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xffffdd86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.532] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5f50000, cbInput=0x227a, pPaddingInfo=0x0, pbIV=0x2b1ff848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x2b1ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2b1ff848, pbOutput=0x5f50000, pcbResult=0x2b1ff618) returned 0x0 [0171.532] WriteFile (in: hFile=0x18d8, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2b1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x2b1ff61c*=0x2280, lpOverlapped=0x0) returned 1 [0171.532] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1ff60c | out: lpNewFilePointer=0x0) returned 1 [0171.532] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.532] WriteFile (in: hFile=0x18d8, lpBuffer=0x2b1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2b1ff83c*, lpNumberOfBytesWritten=0x2b1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.532] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x2280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.532] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.532] CloseHandle (hObject=0x18d8) returned 1 [0171.532] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.play")) returned 1 [0171.536] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2304 os_tid = 0x2290 [0171.540] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.540] ReadFile (in: hFile=0x18e0, lpBuffer=0x2b33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b33fb34*, lpNumberOfBytesRead=0x2b33f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.542] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.542] ReadFile (in: hFile=0x18e0, lpBuffer=0x2b33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b33fb34*, lpNumberOfBytesRead=0x2b33f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.543] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.545] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.545] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x2b33f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0171.545] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x2b33f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x2b33f828, pbKeyObject=0x0) returned 0x0 [0171.546] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b33f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b33f500) returned 0x0 [0171.546] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.546] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b33f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b33f500) returned 0x0 [0171.551] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.554] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.554] WriteFile (in: hFile=0x18e0, lpBuffer=0x2b33fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b33f830, lpOverlapped=0x0 | out: lpBuffer=0x2b33fb34*, lpNumberOfBytesWritten=0x2b33f830*=0x428, lpOverlapped=0x0) returned 1 [0171.555] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.555] ReadFile (in: hFile=0x18e0, lpBuffer=0x6050000, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x2b33f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x2b33f61c*=0x3682, lpOverlapped=0x0) returned 1 [0171.556] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0xffffc97e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.556] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6050000, cbInput=0x3682, pPaddingInfo=0x0, pbIV=0x2b33f848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x2b33f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2b33f848, pbOutput=0x6050000, pcbResult=0x2b33f618) returned 0x0 [0171.556] WriteFile (in: hFile=0x18e0, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2b33f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x2b33f61c*=0x3690, lpOverlapped=0x0) returned 1 [0171.556] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b33f60c | out: lpNewFilePointer=0x0) returned 1 [0171.556] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.556] WriteFile (in: hFile=0x18e0, lpBuffer=0x2b33f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b33f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b33f83c*, lpNumberOfBytesWritten=0x2b33f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.557] SetFilePointerEx (in: hFile=0x18e0, liDistanceToMove=0x3690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.557] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.557] CloseHandle (hObject=0x18e0) returned 1 [0171.557] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.play")) returned 1 [0171.622] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2305 os_tid = 0x2294 [0171.658] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.659] ReadFile (in: hFile=0x18e8, lpBuffer=0x2b47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b47fb34*, lpNumberOfBytesRead=0x2b47f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.660] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.660] ReadFile (in: hFile=0x18e8, lpBuffer=0x2b47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b47fb34*, lpNumberOfBytesRead=0x2b47f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.661] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.663] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.663] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x2b47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0171.663] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x2b47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x2b47f828, pbKeyObject=0x0) returned 0x0 [0171.663] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b47f500) returned 0x0 [0171.663] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.663] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b47f500) returned 0x0 [0171.667] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.670] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.671] WriteFile (in: hFile=0x18e8, lpBuffer=0x2b47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b47f830, lpOverlapped=0x0 | out: lpBuffer=0x2b47fb34*, lpNumberOfBytesWritten=0x2b47f830*=0x428, lpOverlapped=0x0) returned 1 [0171.671] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.672] ReadFile (in: hFile=0x18e8, lpBuffer=0x6150000, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x2b47f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x2b47f61c*=0x25c7, lpOverlapped=0x0) returned 1 [0171.672] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xffffda39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.672] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6150000, cbInput=0x25c7, pPaddingInfo=0x0, pbIV=0x2b47f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x2b47f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2b47f848, pbOutput=0x6150000, pcbResult=0x2b47f618) returned 0x0 [0171.672] WriteFile (in: hFile=0x18e8, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2b47f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x2b47f61c*=0x25d0, lpOverlapped=0x0) returned 1 [0171.673] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b47f60c | out: lpNewFilePointer=0x0) returned 1 [0171.673] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.673] WriteFile (in: hFile=0x18e8, lpBuffer=0x2b47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b47f83c*, lpNumberOfBytesWritten=0x2b47f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.673] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0x25d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.673] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.673] CloseHandle (hObject=0x18e8) returned 1 [0171.673] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.play")) returned 1 [0171.677] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2306 os_tid = 0x2298 [0171.681] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.681] ReadFile (in: hFile=0x18f0, lpBuffer=0x2b5bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b5bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2b5bfb34*, lpNumberOfBytesRead=0x2b5bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.683] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.683] ReadFile (in: hFile=0x18f0, lpBuffer=0x2b5bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2b5bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2b5bfb34*, lpNumberOfBytesRead=0x2b5bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.684] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.686] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x2b5bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0171.686] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x2b5bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x2b5bf828, pbKeyObject=0x0) returned 0x0 [0171.686] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2b5bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2b5bf500) returned 0x0 [0171.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.686] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2b5bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2b5bf500) returned 0x0 [0171.691] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.694] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.694] WriteFile (in: hFile=0x18f0, lpBuffer=0x2b5bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2b5bf830, lpOverlapped=0x0 | out: lpBuffer=0x2b5bfb34*, lpNumberOfBytesWritten=0x2b5bf830*=0x428, lpOverlapped=0x0) returned 1 [0171.695] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.695] ReadFile (in: hFile=0x18f0, lpBuffer=0x6250000, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x2b5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x2b5bf61c*=0x6630, lpOverlapped=0x0) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xffff99d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.696] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6250000, cbInput=0x6630, pPaddingInfo=0x0, pbIV=0x2b5bf848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x2b5bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2b5bf848, pbOutput=0x6250000, pcbResult=0x2b5bf618) returned 0x0 [0171.696] WriteFile (in: hFile=0x18f0, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2b5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x2b5bf61c*=0x6640, lpOverlapped=0x0) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5bf60c | out: lpNewFilePointer=0x0) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.696] WriteFile (in: hFile=0x18f0, lpBuffer=0x2b5bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b5bf83c*, lpNumberOfBytesWritten=0x2b5bf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x6640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.696] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.696] CloseHandle (hObject=0x18f0) returned 1 [0171.697] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.play")) returned 1 [0171.705] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2307 os_tid = 0x229c [0171.711] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.711] ReadFile (in: hFile=0x18f8, lpBuffer=0x2cc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2cc7fb34*, lpNumberOfBytesRead=0x2cc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.713] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.713] ReadFile (in: hFile=0x18f8, lpBuffer=0x2cc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2cc7fb34*, lpNumberOfBytesRead=0x2cc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.713] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.715] BCryptSetProperty (in: hObject=0x732d30, pszProperty="ChainingMode", pbInput=0x2cc7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732d30) returned 0x0 [0171.715] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732d30, phKey=0x2cc7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732d30, phKey=0x2cc7f828, pbKeyObject=0x0) returned 0x0 [0171.715] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2cc7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2cc7f500) returned 0x0 [0171.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.716] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2cc7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2cc7f500) returned 0x0 [0171.720] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.723] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.723] WriteFile (in: hFile=0x18f8, lpBuffer=0x2cc7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2cc7f830, lpOverlapped=0x0 | out: lpBuffer=0x2cc7fb34*, lpNumberOfBytesWritten=0x2cc7f830*=0x428, lpOverlapped=0x0) returned 1 [0171.724] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.724] ReadFile (in: hFile=0x18f8, lpBuffer=0x6350000, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x2cc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x2cc7f61c*=0x6b9a, lpOverlapped=0x0) returned 1 [0171.725] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0xffff9466, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.725] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6350000, cbInput=0x6b9a, pPaddingInfo=0x0, pbIV=0x2cc7f848, cbIV=0x10, pbOutput=0x6350000, cbOutput=0x100000, pcbResult=0x2cc7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2cc7f848, pbOutput=0x6350000, pcbResult=0x2cc7f618) returned 0x0 [0171.725] WriteFile (in: hFile=0x18f8, lpBuffer=0x6350000*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2cc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesWritten=0x2cc7f61c*=0x6ba0, lpOverlapped=0x0) returned 1 [0171.726] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cc7f60c | out: lpNewFilePointer=0x0) returned 1 [0171.726] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.726] WriteFile (in: hFile=0x18f8, lpBuffer=0x2cc7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2cc7f83c*, lpNumberOfBytesWritten=0x2cc7f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.726] SetFilePointerEx (in: hFile=0x18f8, liDistanceToMove=0x6ba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.726] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.726] CloseHandle (hObject=0x18f8) returned 1 [0171.727] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.729] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.play")) returned 1 [0171.730] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2308 os_tid = 0x22a0 [0171.733] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.733] ReadFile (in: hFile=0x1900, lpBuffer=0x2cd7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cd7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2cd7fb34*, lpNumberOfBytesRead=0x2cd7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.735] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.735] ReadFile (in: hFile=0x1900, lpBuffer=0x2cd7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cd7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2cd7fb34*, lpNumberOfBytesRead=0x2cd7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.735] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.737] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.738] BCryptSetProperty (in: hObject=0x731d60, pszProperty="ChainingMode", pbInput=0x2cd7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731d60) returned 0x0 [0171.738] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731d60, phKey=0x2cd7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731d60, phKey=0x2cd7f828, pbKeyObject=0x0) returned 0x0 [0171.738] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2cd7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2cd7f500) returned 0x0 [0171.738] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.738] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2cd7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2cd7f500) returned 0x0 [0171.742] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.745] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.745] WriteFile (in: hFile=0x1900, lpBuffer=0x2cd7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2cd7f830, lpOverlapped=0x0 | out: lpBuffer=0x2cd7fb34*, lpNumberOfBytesWritten=0x2cd7f830*=0x428, lpOverlapped=0x0) returned 1 [0171.746] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.746] ReadFile (in: hFile=0x1900, lpBuffer=0x6450000, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x2cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesRead=0x2cd7f61c*=0x3b29, lpOverlapped=0x0) returned 1 [0171.747] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xffffc4d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.747] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6450000, cbInput=0x3b29, pPaddingInfo=0x0, pbIV=0x2cd7f848, cbIV=0x10, pbOutput=0x6450000, cbOutput=0x100000, pcbResult=0x2cd7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2cd7f848, pbOutput=0x6450000, pcbResult=0x2cd7f618) returned 0x0 [0171.747] WriteFile (in: hFile=0x1900, lpBuffer=0x6450000*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesWritten=0x2cd7f61c*=0x3b30, lpOverlapped=0x0) returned 1 [0171.748] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cd7f60c | out: lpNewFilePointer=0x0) returned 1 [0171.748] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.748] WriteFile (in: hFile=0x1900, lpBuffer=0x2cd7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2cd7f83c*, lpNumberOfBytesWritten=0x2cd7f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.748] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0x3b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.748] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.748] CloseHandle (hObject=0x1900) returned 1 [0171.748] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.play")) returned 1 [0171.751] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2309 os_tid = 0x22a4 [0171.755] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.755] ReadFile (in: hFile=0x1908, lpBuffer=0x2cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x2cebfb34*, lpNumberOfBytesRead=0x2cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.757] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.757] ReadFile (in: hFile=0x1908, lpBuffer=0x2cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x2cebfb34*, lpNumberOfBytesRead=0x2cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.757] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.759] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.759] BCryptSetProperty (in: hObject=0x7329c0, pszProperty="ChainingMode", pbInput=0x2cebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7329c0) returned 0x0 [0171.759] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7329c0, phKey=0x2cebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7329c0, phKey=0x2cebf828, pbKeyObject=0x0) returned 0x0 [0171.759] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2cebf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2cebf500) returned 0x0 [0171.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.760] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2cebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2cebf500) returned 0x0 [0171.764] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.766] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.766] WriteFile (in: hFile=0x1908, lpBuffer=0x2cebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2cebf830, lpOverlapped=0x0 | out: lpBuffer=0x2cebfb34*, lpNumberOfBytesWritten=0x2cebf830*=0x428, lpOverlapped=0x0) returned 1 [0171.767] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.767] ReadFile (in: hFile=0x1908, lpBuffer=0x6550000, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x2cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesRead=0x2cebf61c*=0x1bf2, lpOverlapped=0x0) returned 1 [0171.772] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0xffffe40e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.772] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6550000, cbInput=0x1bf2, pPaddingInfo=0x0, pbIV=0x2cebf848, cbIV=0x10, pbOutput=0x6550000, cbOutput=0x100000, pcbResult=0x2cebf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2cebf848, pbOutput=0x6550000, pcbResult=0x2cebf618) returned 0x0 [0171.772] WriteFile (in: hFile=0x1908, lpBuffer=0x6550000*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesWritten=0x2cebf61c*=0x1c00, lpOverlapped=0x0) returned 1 [0171.772] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cebf60c | out: lpNewFilePointer=0x0) returned 1 [0171.772] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.772] WriteFile (in: hFile=0x1908, lpBuffer=0x2cebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x2cebf83c*, lpNumberOfBytesWritten=0x2cebf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.772] SetFilePointerEx (in: hFile=0x1908, liDistanceToMove=0x1c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.772] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.772] CloseHandle (hObject=0x1908) returned 1 [0171.772] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.play")) returned 1 [0171.775] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2310 os_tid = 0x22a8 [0171.778] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.778] ReadFile (in: hFile=0x1910, lpBuffer=0x2cfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cfff85c, lpOverlapped=0x0 | out: lpBuffer=0x2cfffb34*, lpNumberOfBytesRead=0x2cfff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.780] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.780] ReadFile (in: hFile=0x1910, lpBuffer=0x2cfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2cfff85c, lpOverlapped=0x0 | out: lpBuffer=0x2cfffb34*, lpNumberOfBytesRead=0x2cfff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.780] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.781] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.781] BCryptSetProperty (in: hObject=0x732020, pszProperty="ChainingMode", pbInput=0x2cfff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732020) returned 0x0 [0171.782] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732020, phKey=0x2cfff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732020, phKey=0x2cfff828, pbKeyObject=0x0) returned 0x0 [0171.782] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2cfff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2cfff500) returned 0x0 [0171.782] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.782] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2cfff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2cfff500) returned 0x0 [0171.785] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.787] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.787] WriteFile (in: hFile=0x1910, lpBuffer=0x2cfffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2cfff830, lpOverlapped=0x0 | out: lpBuffer=0x2cfffb34*, lpNumberOfBytesWritten=0x2cfff830*=0x428, lpOverlapped=0x0) returned 1 [0171.788] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.788] ReadFile (in: hFile=0x1910, lpBuffer=0x6650000, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x2cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesRead=0x2cfff61c*=0x4cc8, lpOverlapped=0x0) returned 1 [0171.789] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xffffb338, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.789] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6650000, cbInput=0x4cc8, pPaddingInfo=0x0, pbIV=0x2cfff848, cbIV=0x10, pbOutput=0x6650000, cbOutput=0x100000, pcbResult=0x2cfff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2cfff848, pbOutput=0x6650000, pcbResult=0x2cfff618) returned 0x0 [0171.789] WriteFile (in: hFile=0x1910, lpBuffer=0x6650000*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesWritten=0x2cfff61c*=0x4cd0, lpOverlapped=0x0) returned 1 [0171.789] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cfff60c | out: lpNewFilePointer=0x0) returned 1 [0171.789] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.789] WriteFile (in: hFile=0x1910, lpBuffer=0x2cfff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x2cfff83c*, lpNumberOfBytesWritten=0x2cfff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.790] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x4cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.790] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.790] CloseHandle (hObject=0x1910) returned 1 [0171.790] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.791] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.play")) returned 1 [0171.792] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2311 os_tid = 0x22ac [0171.796] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.796] ReadFile (in: hFile=0x1918, lpBuffer=0x2d13fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d13f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d13fb34*, lpNumberOfBytesRead=0x2d13f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.798] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.798] ReadFile (in: hFile=0x1918, lpBuffer=0x2d13fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d13f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d13fb34*, lpNumberOfBytesRead=0x2d13f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.798] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.800] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.800] BCryptSetProperty (in: hObject=0x732a70, pszProperty="ChainingMode", pbInput=0x2d13f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732a70) returned 0x0 [0171.800] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732a70, phKey=0x2d13f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732a70, phKey=0x2d13f828, pbKeyObject=0x0) returned 0x0 [0171.800] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d13f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d13f500) returned 0x0 [0171.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.801] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d13f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d13f500) returned 0x0 [0171.804] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.806] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.806] WriteFile (in: hFile=0x1918, lpBuffer=0x2d13fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d13f830, lpOverlapped=0x0 | out: lpBuffer=0x2d13fb34*, lpNumberOfBytesWritten=0x2d13f830*=0x428, lpOverlapped=0x0) returned 1 [0171.807] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.807] ReadFile (in: hFile=0x1918, lpBuffer=0x6750000, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x2d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesRead=0x2d13f61c*=0x5754, lpOverlapped=0x0) returned 1 [0171.807] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0xffffa8ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.808] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6750000, cbInput=0x5754, pPaddingInfo=0x0, pbIV=0x2d13f848, cbIV=0x10, pbOutput=0x6750000, cbOutput=0x100000, pcbResult=0x2d13f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d13f848, pbOutput=0x6750000, pcbResult=0x2d13f618) returned 0x0 [0171.808] WriteFile (in: hFile=0x1918, lpBuffer=0x6750000*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesWritten=0x2d13f61c*=0x5760, lpOverlapped=0x0) returned 1 [0171.808] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d13f60c | out: lpNewFilePointer=0x0) returned 1 [0171.808] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.808] WriteFile (in: hFile=0x1918, lpBuffer=0x2d13f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d13f83c*, lpNumberOfBytesWritten=0x2d13f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.808] SetFilePointerEx (in: hFile=0x1918, liDistanceToMove=0x5760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.808] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.808] CloseHandle (hObject=0x1918) returned 1 [0171.808] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.play")) returned 1 [0171.811] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2312 os_tid = 0x22b0 [0171.814] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.814] ReadFile (in: hFile=0x1920, lpBuffer=0x2d27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d27f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d27fb34*, lpNumberOfBytesRead=0x2d27f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.816] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.816] ReadFile (in: hFile=0x1920, lpBuffer=0x2d27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d27f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d27fb34*, lpNumberOfBytesRead=0x2d27f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.816] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.818] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.818] BCryptSetProperty (in: hObject=0x732bd0, pszProperty="ChainingMode", pbInput=0x2d27f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732bd0) returned 0x0 [0171.818] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732bd0, phKey=0x2d27f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732bd0, phKey=0x2d27f828, pbKeyObject=0x0) returned 0x0 [0171.818] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d27f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d27f500) returned 0x0 [0171.818] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.818] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d27f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d27f500) returned 0x0 [0171.822] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.824] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.824] WriteFile (in: hFile=0x1920, lpBuffer=0x2d27fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d27f830, lpOverlapped=0x0 | out: lpBuffer=0x2d27fb34*, lpNumberOfBytesWritten=0x2d27f830*=0x428, lpOverlapped=0x0) returned 1 [0171.825] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.825] ReadFile (in: hFile=0x1920, lpBuffer=0x6850000, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x2d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesRead=0x2d27f61c*=0x55ba, lpOverlapped=0x0) returned 1 [0171.825] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0xffffaa46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.825] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6850000, cbInput=0x55ba, pPaddingInfo=0x0, pbIV=0x2d27f848, cbIV=0x10, pbOutput=0x6850000, cbOutput=0x100000, pcbResult=0x2d27f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d27f848, pbOutput=0x6850000, pcbResult=0x2d27f618) returned 0x0 [0171.825] WriteFile (in: hFile=0x1920, lpBuffer=0x6850000*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesWritten=0x2d27f61c*=0x55c0, lpOverlapped=0x0) returned 1 [0171.826] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d27f60c | out: lpNewFilePointer=0x0) returned 1 [0171.826] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.826] WriteFile (in: hFile=0x1920, lpBuffer=0x2d27f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d27f83c*, lpNumberOfBytesWritten=0x2d27f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.826] SetFilePointerEx (in: hFile=0x1920, liDistanceToMove=0x55c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.826] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.826] CloseHandle (hObject=0x1920) returned 1 [0171.826] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.play")) returned 1 [0171.829] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2313 os_tid = 0x22b4 [0171.832] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.832] ReadFile (in: hFile=0x1928, lpBuffer=0x2d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesRead=0x2d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.833] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.833] ReadFile (in: hFile=0x1928, lpBuffer=0x2d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesRead=0x2d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.834] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.835] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.835] BCryptSetProperty (in: hObject=0x733200, pszProperty="ChainingMode", pbInput=0x2d3bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733200) returned 0x0 [0171.836] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733200, phKey=0x2d3bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733200, phKey=0x2d3bf828, pbKeyObject=0x0) returned 0x0 [0171.836] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d3bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d3bf500) returned 0x0 [0171.836] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.836] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d3bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d3bf500) returned 0x0 [0171.846] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.849] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.849] WriteFile (in: hFile=0x1928, lpBuffer=0x2d3bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d3bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesWritten=0x2d3bf830*=0x428, lpOverlapped=0x0) returned 1 [0171.850] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.850] ReadFile (in: hFile=0x1928, lpBuffer=0x6950000, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesRead=0x2d3bf61c*=0xc53a, lpOverlapped=0x0) returned 1 [0171.851] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xffff3ac6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.851] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6950000, cbInput=0xc53a, pPaddingInfo=0x0, pbIV=0x2d3bf848, cbIV=0x10, pbOutput=0x6950000, cbOutput=0x100000, pcbResult=0x2d3bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d3bf848, pbOutput=0x6950000, pcbResult=0x2d3bf618) returned 0x0 [0171.851] WriteFile (in: hFile=0x1928, lpBuffer=0x6950000*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesWritten=0x2d3bf61c*=0xc540, lpOverlapped=0x0) returned 1 [0171.852] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3bf60c | out: lpNewFilePointer=0x0) returned 1 [0171.852] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.852] WriteFile (in: hFile=0x1928, lpBuffer=0x2d3bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bf83c*, lpNumberOfBytesWritten=0x2d3bf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.852] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xc540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.852] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.852] CloseHandle (hObject=0x1928) returned 1 [0171.852] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.play")) returned 1 [0171.855] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2314 os_tid = 0x22b8 [0171.858] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.858] ReadFile (in: hFile=0x1930, lpBuffer=0x2d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesRead=0x2d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.860] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.860] ReadFile (in: hFile=0x1930, lpBuffer=0x2d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesRead=0x2d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.860] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0171.862] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0171.862] BCryptSetProperty (in: hObject=0x731cb0, pszProperty="ChainingMode", pbInput=0x2d4ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731cb0) returned 0x0 [0171.862] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731cb0, phKey=0x2d4ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731cb0, phKey=0x2d4ff828, pbKeyObject=0x0) returned 0x0 [0171.862] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d4ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d4ff500) returned 0x0 [0171.862] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0171.862] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d4ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d4ff500) returned 0x0 [0171.866] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.868] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.868] WriteFile (in: hFile=0x1930, lpBuffer=0x2d4ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d4ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesWritten=0x2d4ff830*=0x428, lpOverlapped=0x0) returned 1 [0171.869] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.869] ReadFile (in: hFile=0x1930, lpBuffer=0x6a50000, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesRead=0x2d4ff61c*=0xfcff, lpOverlapped=0x0) returned 1 [0171.870] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0xffff0301, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.870] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6a50000, cbInput=0xfcff, pPaddingInfo=0x0, pbIV=0x2d4ff848, cbIV=0x10, pbOutput=0x6a50000, cbOutput=0x100000, pcbResult=0x2d4ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d4ff848, pbOutput=0x6a50000, pcbResult=0x2d4ff618) returned 0x0 [0171.870] WriteFile (in: hFile=0x1930, lpBuffer=0x6a50000*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesWritten=0x2d4ff61c*=0xfd00, lpOverlapped=0x0) returned 1 [0171.871] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4ff60c | out: lpNewFilePointer=0x0) returned 1 [0171.871] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.871] WriteFile (in: hFile=0x1930, lpBuffer=0x2d4ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ff83c*, lpNumberOfBytesWritten=0x2d4ff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.871] SetFilePointerEx (in: hFile=0x1930, liDistanceToMove=0xfd00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.871] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.871] CloseHandle (hObject=0x1930) returned 1 [0171.871] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0171.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.play")) returned 1 [0171.874] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2315 os_tid = 0x22bc [0171.884] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.884] ReadFile (in: hFile=0x1938, lpBuffer=0x2d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesRead=0x2d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.886] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.886] ReadFile (in: hFile=0x1938, lpBuffer=0x2d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesRead=0x2d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.886] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0171.888] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0171.888] BCryptSetProperty (in: hObject=0x732230, pszProperty="ChainingMode", pbInput=0x2d63f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732230) returned 0x0 [0171.888] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732230, phKey=0x2d63f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732230, phKey=0x2d63f828, pbKeyObject=0x0) returned 0x0 [0171.888] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d63f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d63f500) returned 0x0 [0171.888] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0171.889] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d63f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d63f500) returned 0x0 [0171.892] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.894] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.894] WriteFile (in: hFile=0x1938, lpBuffer=0x2d63fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d63f830, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesWritten=0x2d63f830*=0x428, lpOverlapped=0x0) returned 1 [0171.895] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.895] ReadFile (in: hFile=0x1938, lpBuffer=0x6b50000, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x2d63f61c*=0xabad, lpOverlapped=0x0) returned 1 [0171.897] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0xffff5453, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.897] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6b50000, cbInput=0xabad, pPaddingInfo=0x0, pbIV=0x2d63f848, cbIV=0x10, pbOutput=0x6b50000, cbOutput=0x100000, pcbResult=0x2d63f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d63f848, pbOutput=0x6b50000, pcbResult=0x2d63f618) returned 0x0 [0171.897] WriteFile (in: hFile=0x1938, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x2d63f61c*=0xabb0, lpOverlapped=0x0) returned 1 [0171.897] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d63f60c | out: lpNewFilePointer=0x0) returned 1 [0171.898] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.898] WriteFile (in: hFile=0x1938, lpBuffer=0x2d63f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d63f83c*, lpNumberOfBytesWritten=0x2d63f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.898] SetFilePointerEx (in: hFile=0x1938, liDistanceToMove=0xabb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.898] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.898] CloseHandle (hObject=0x1938) returned 1 [0171.898] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0171.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.play")) returned 1 [0171.901] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2316 os_tid = 0x22c0 [0171.904] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.904] ReadFile (in: hFile=0x1940, lpBuffer=0x2d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesRead=0x2d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.906] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.906] ReadFile (in: hFile=0x1940, lpBuffer=0x2d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesRead=0x2d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.906] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0171.908] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0171.908] BCryptSetProperty (in: hObject=0x732440, pszProperty="ChainingMode", pbInput=0x2d77f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732440) returned 0x0 [0171.908] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732440, phKey=0x2d77f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732440, phKey=0x2d77f828, pbKeyObject=0x0) returned 0x0 [0171.908] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d77f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d77f500) returned 0x0 [0171.908] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0171.908] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d77f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d77f500) returned 0x0 [0171.911] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.913] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.914] WriteFile (in: hFile=0x1940, lpBuffer=0x2d77fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d77f830, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesWritten=0x2d77f830*=0x428, lpOverlapped=0x0) returned 1 [0171.914] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.915] ReadFile (in: hFile=0x1940, lpBuffer=0x6c50000, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesRead=0x2d77f61c*=0x4ed3, lpOverlapped=0x0) returned 1 [0171.916] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xffffb12d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.916] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6c50000, cbInput=0x4ed3, pPaddingInfo=0x0, pbIV=0x2d77f848, cbIV=0x10, pbOutput=0x6c50000, cbOutput=0x100000, pcbResult=0x2d77f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d77f848, pbOutput=0x6c50000, pcbResult=0x2d77f618) returned 0x0 [0171.916] WriteFile (in: hFile=0x1940, lpBuffer=0x6c50000*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesWritten=0x2d77f61c*=0x4ee0, lpOverlapped=0x0) returned 1 [0171.916] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d77f60c | out: lpNewFilePointer=0x0) returned 1 [0171.916] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.917] WriteFile (in: hFile=0x1940, lpBuffer=0x2d77f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d77f83c*, lpNumberOfBytesWritten=0x2d77f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.917] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0x4ee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.917] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.917] CloseHandle (hObject=0x1940) returned 1 [0171.917] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0171.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.play")) returned 1 [0171.920] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2317 os_tid = 0x22c4 [0171.923] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.923] ReadFile (in: hFile=0x1948, lpBuffer=0x2d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesRead=0x2d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.924] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.924] ReadFile (in: hFile=0x1948, lpBuffer=0x2d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesRead=0x2d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.925] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0171.927] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0171.927] BCryptSetProperty (in: hObject=0x7324f0, pszProperty="ChainingMode", pbInput=0x2d8bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7324f0) returned 0x0 [0171.927] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7324f0, phKey=0x2d8bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7324f0, phKey=0x2d8bf828, pbKeyObject=0x0) returned 0x0 [0171.927] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d8bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d8bf500) returned 0x0 [0171.927] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0171.927] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d8bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d8bf500) returned 0x0 [0171.930] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.932] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] WriteFile (in: hFile=0x1948, lpBuffer=0x2d8bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesWritten=0x2d8bf830*=0x428, lpOverlapped=0x0) returned 1 [0171.933] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.933] ReadFile (in: hFile=0x1948, lpBuffer=0x6d50000, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesRead=0x2d8bf61c*=0x27d0, lpOverlapped=0x0) returned 1 [0171.934] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0xffffd830, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.934] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6d50000, cbInput=0x27d0, pPaddingInfo=0x0, pbIV=0x2d8bf848, cbIV=0x10, pbOutput=0x6d50000, cbOutput=0x100000, pcbResult=0x2d8bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d8bf848, pbOutput=0x6d50000, pcbResult=0x2d8bf618) returned 0x0 [0171.934] WriteFile (in: hFile=0x1948, lpBuffer=0x6d50000*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesWritten=0x2d8bf61c*=0x27e0, lpOverlapped=0x0) returned 1 [0171.934] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8bf60c | out: lpNewFilePointer=0x0) returned 1 [0171.934] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.934] WriteFile (in: hFile=0x1948, lpBuffer=0x2d8bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bf83c*, lpNumberOfBytesWritten=0x2d8bf61c*=0x8, lpOverlapped=0x0) returned 1 [0171.934] SetFilePointerEx (in: hFile=0x1948, liDistanceToMove=0x27e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.934] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.934] CloseHandle (hObject=0x1948) returned 1 [0171.934] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0171.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.play")) returned 1 [0171.937] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2318 os_tid = 0x22c8 [0171.940] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.940] ReadFile (in: hFile=0x1950, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.941] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.941] ReadFile (in: hFile=0x1950, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0171.941] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0171.943] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0171.943] BCryptSetProperty (in: hObject=0x7325a0, pszProperty="ChainingMode", pbInput=0x2d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7325a0) returned 0x0 [0171.943] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7325a0, phKey=0x2d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7325a0, phKey=0x2d9ff828, pbKeyObject=0x0) returned 0x0 [0171.943] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d9ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d9ff500) returned 0x0 [0171.943] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0171.943] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d9ff500) returned 0x0 [0171.947] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.949] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.949] WriteFile (in: hFile=0x1950, lpBuffer=0x2d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesWritten=0x2d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0171.950] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.950] ReadFile (in: hFile=0x1950, lpBuffer=0x6e50000, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesRead=0x2d9ff61c*=0x5ee4, lpOverlapped=0x0) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xffffa11c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.951] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6e50000, cbInput=0x5ee4, pPaddingInfo=0x0, pbIV=0x2d9ff848, cbIV=0x10, pbOutput=0x6e50000, cbOutput=0x100000, pcbResult=0x2d9ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d9ff848, pbOutput=0x6e50000, pcbResult=0x2d9ff618) returned 0x0 [0171.951] WriteFile (in: hFile=0x1950, lpBuffer=0x6e50000*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesWritten=0x2d9ff61c*=0x5ef0, lpOverlapped=0x0) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.951] WriteFile (in: hFile=0x1950, lpBuffer=0x2d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ff83c*, lpNumberOfBytesWritten=0x2d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0x5ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.951] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.951] CloseHandle (hObject=0x1950) returned 1 [0171.952] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0171.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.play")) returned 1 [0171.954] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2319 os_tid = 0x22cc [0171.957] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.957] ReadFile (in: hFile=0x1958, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.959] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.959] ReadFile (in: hFile=0x1958, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.959] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0171.960] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0171.961] BCryptSetProperty (in: hObject=0x736300, pszProperty="ChainingMode", pbInput=0x2db3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736300) returned 0x0 [0171.961] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736300, phKey=0x2db3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736300, phKey=0x2db3f828, pbKeyObject=0x0) returned 0x0 [0171.961] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2db3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2db3f500) returned 0x0 [0171.961] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0171.961] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2db3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2db3f500) returned 0x0 [0171.964] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.966] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.966] WriteFile (in: hFile=0x1958, lpBuffer=0x2db3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db3f830, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesWritten=0x2db3f830*=0x428, lpOverlapped=0x0) returned 1 [0171.967] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.967] ReadFile (in: hFile=0x1958, lpBuffer=0x6f50000, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesRead=0x2db3f61c*=0x2232, lpOverlapped=0x0) returned 1 [0171.968] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0xffffddce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.968] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x6f50000, cbInput=0x2232, pPaddingInfo=0x0, pbIV=0x2db3f848, cbIV=0x10, pbOutput=0x6f50000, cbOutput=0x100000, pcbResult=0x2db3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2db3f848, pbOutput=0x6f50000, pcbResult=0x2db3f618) returned 0x0 [0171.968] WriteFile (in: hFile=0x1958, lpBuffer=0x6f50000*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesWritten=0x2db3f61c*=0x2240, lpOverlapped=0x0) returned 1 [0171.968] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db3f60c | out: lpNewFilePointer=0x0) returned 1 [0171.968] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.968] WriteFile (in: hFile=0x1958, lpBuffer=0x2db3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db3f83c*, lpNumberOfBytesWritten=0x2db3f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.968] SetFilePointerEx (in: hFile=0x1958, liDistanceToMove=0x2240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.968] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.968] CloseHandle (hObject=0x1958) returned 1 [0171.969] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0171.970] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.play")) returned 1 [0171.971] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2320 os_tid = 0x22d0 [0171.974] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.974] ReadFile (in: hFile=0x1960, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.975] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.975] ReadFile (in: hFile=0x1960, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0171.975] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0171.977] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0171.977] BCryptSetProperty (in: hObject=0x736250, pszProperty="ChainingMode", pbInput=0x2dc7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736250) returned 0x0 [0171.977] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736250, phKey=0x2dc7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736250, phKey=0x2dc7f828, pbKeyObject=0x0) returned 0x0 [0171.977] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2dc7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2dc7f500) returned 0x0 [0171.977] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0171.977] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2dc7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2dc7f500) returned 0x0 [0171.981] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.983] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.983] WriteFile (in: hFile=0x1960, lpBuffer=0x2dc7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dc7f830, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesWritten=0x2dc7f830*=0x428, lpOverlapped=0x0) returned 1 [0171.984] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.984] ReadFile (in: hFile=0x1960, lpBuffer=0x7050000, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesRead=0x2dc7f61c*=0xe392, lpOverlapped=0x0) returned 1 [0171.985] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xffff1c6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.985] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7050000, cbInput=0xe392, pPaddingInfo=0x0, pbIV=0x2dc7f848, cbIV=0x10, pbOutput=0x7050000, cbOutput=0x100000, pcbResult=0x2dc7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2dc7f848, pbOutput=0x7050000, pcbResult=0x2dc7f618) returned 0x0 [0171.985] WriteFile (in: hFile=0x1960, lpBuffer=0x7050000*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesWritten=0x2dc7f61c*=0xe3a0, lpOverlapped=0x0) returned 1 [0171.985] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dc7f60c | out: lpNewFilePointer=0x0) returned 1 [0171.985] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.985] WriteFile (in: hFile=0x1960, lpBuffer=0x2dc7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7f83c*, lpNumberOfBytesWritten=0x2dc7f61c*=0x8, lpOverlapped=0x0) returned 1 [0171.986] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xe3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.986] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0171.986] CloseHandle (hObject=0x1960) returned 1 [0171.986] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0171.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.play")) returned 1 [0171.988] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2321 os_tid = 0x22d4 [0171.992] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.992] ReadFile (in: hFile=0x1968, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.994] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.994] ReadFile (in: hFile=0x1968, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0171.994] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0171.996] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0171.996] BCryptSetProperty (in: hObject=0x7361a0, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7361a0) returned 0x0 [0171.997] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7361a0, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7361a0, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0171.997] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2ddbf500) returned 0x0 [0171.997] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0171.997] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2ddbf500) returned 0x0 [0172.002] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.004] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.005] WriteFile (in: hFile=0x1968, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0172.006] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.006] ReadFile (in: hFile=0x1968, lpBuffer=0x7150000, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesRead=0x2ddbf61c*=0x9114, lpOverlapped=0x0) returned 1 [0172.007] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0xffff6eec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.007] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7150000, cbInput=0x9114, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x7150000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2ddbf848, pbOutput=0x7150000, pcbResult=0x2ddbf618) returned 0x0 [0172.007] WriteFile (in: hFile=0x1968, lpBuffer=0x7150000*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x9120, lpOverlapped=0x0) returned 1 [0172.007] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0172.007] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.007] WriteFile (in: hFile=0x1968, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.007] SetFilePointerEx (in: hFile=0x1968, liDistanceToMove=0x9120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.008] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.008] CloseHandle (hObject=0x1968) returned 1 [0172.008] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.010] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.play")) returned 1 [0172.012] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2322 os_tid = 0x22d8 [0172.016] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.017] ReadFile (in: hFile=0x1970, lpBuffer=0x2deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2deff85c, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesRead=0x2deff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.018] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.018] ReadFile (in: hFile=0x1970, lpBuffer=0x2deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2deff85c, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesRead=0x2deff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.018] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.021] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.021] BCryptSetProperty (in: hObject=0x7363b0, pszProperty="ChainingMode", pbInput=0x2deff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7363b0) returned 0x0 [0172.021] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7363b0, phKey=0x2deff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7363b0, phKey=0x2deff828, pbKeyObject=0x0) returned 0x0 [0172.021] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2deff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2deff500) returned 0x0 [0172.021] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.021] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2deff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2deff500) returned 0x0 [0172.026] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.029] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.029] WriteFile (in: hFile=0x1970, lpBuffer=0x2deffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2deff830, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesWritten=0x2deff830*=0x428, lpOverlapped=0x0) returned 1 [0172.030] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.030] ReadFile (in: hFile=0x1970, lpBuffer=0x7250000, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesRead=0x2deff61c*=0x1846, lpOverlapped=0x0) returned 1 [0172.031] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xffffe7ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.031] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7250000, cbInput=0x1846, pPaddingInfo=0x0, pbIV=0x2deff848, cbIV=0x10, pbOutput=0x7250000, cbOutput=0x100000, pcbResult=0x2deff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2deff848, pbOutput=0x7250000, pcbResult=0x2deff618) returned 0x0 [0172.031] WriteFile (in: hFile=0x1970, lpBuffer=0x7250000*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesWritten=0x2deff61c*=0x1850, lpOverlapped=0x0) returned 1 [0172.032] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2deff60c | out: lpNewFilePointer=0x0) returned 1 [0172.032] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.032] WriteFile (in: hFile=0x1970, lpBuffer=0x2deff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x2deff83c*, lpNumberOfBytesWritten=0x2deff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.032] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0x1850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.032] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.032] CloseHandle (hObject=0x1970) returned 1 [0172.032] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.play")) returned 1 [0172.036] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2323 os_tid = 0x22dc [0172.040] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.040] ReadFile (in: hFile=0x1978, lpBuffer=0x2e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesRead=0x2e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.041] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.042] ReadFile (in: hFile=0x1978, lpBuffer=0x2e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesRead=0x2e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.042] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.045] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.045] BCryptSetProperty (in: hObject=0x735f90, pszProperty="ChainingMode", pbInput=0x2e03f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735f90) returned 0x0 [0172.045] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735f90, phKey=0x2e03f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735f90, phKey=0x2e03f828, pbKeyObject=0x0) returned 0x0 [0172.045] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e03f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e03f500) returned 0x0 [0172.045] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.045] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e03f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e03f500) returned 0x0 [0172.050] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.053] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.053] WriteFile (in: hFile=0x1978, lpBuffer=0x2e03fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e03f830, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesWritten=0x2e03f830*=0x428, lpOverlapped=0x0) returned 1 [0172.054] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.055] ReadFile (in: hFile=0x1978, lpBuffer=0x7350000, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesRead=0x2e03f61c*=0x2610, lpOverlapped=0x0) returned 1 [0172.055] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0xffffd9f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.055] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7350000, cbInput=0x2610, pPaddingInfo=0x0, pbIV=0x2e03f848, cbIV=0x10, pbOutput=0x7350000, cbOutput=0x100000, pcbResult=0x2e03f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e03f848, pbOutput=0x7350000, pcbResult=0x2e03f618) returned 0x0 [0172.056] WriteFile (in: hFile=0x1978, lpBuffer=0x7350000*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesWritten=0x2e03f61c*=0x2620, lpOverlapped=0x0) returned 1 [0172.056] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e03f60c | out: lpNewFilePointer=0x0) returned 1 [0172.056] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.056] WriteFile (in: hFile=0x1978, lpBuffer=0x2e03f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e03f83c*, lpNumberOfBytesWritten=0x2e03f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.056] SetFilePointerEx (in: hFile=0x1978, liDistanceToMove=0x2620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.056] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.056] CloseHandle (hObject=0x1978) returned 1 [0172.056] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.play")) returned 1 [0172.060] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2324 os_tid = 0x22e0 [0172.064] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.064] ReadFile (in: hFile=0x1980, lpBuffer=0x2e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesRead=0x2e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.066] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.066] ReadFile (in: hFile=0x1980, lpBuffer=0x2e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesRead=0x2e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.066] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.068] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.068] BCryptSetProperty (in: hObject=0x735ac0, pszProperty="ChainingMode", pbInput=0x2e17f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ac0) returned 0x0 [0172.068] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ac0, phKey=0x2e17f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ac0, phKey=0x2e17f828, pbKeyObject=0x0) returned 0x0 [0172.068] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e17f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e17f500) returned 0x0 [0172.069] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.069] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e17f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e17f500) returned 0x0 [0172.074] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.077] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.077] WriteFile (in: hFile=0x1980, lpBuffer=0x2e17fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e17f830, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesWritten=0x2e17f830*=0x428, lpOverlapped=0x0) returned 1 [0172.078] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.078] ReadFile (in: hFile=0x1980, lpBuffer=0x7450000, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesRead=0x2e17f61c*=0x9b8, lpOverlapped=0x0) returned 1 [0172.078] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xfffff648, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.078] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7450000, cbInput=0x9b8, pPaddingInfo=0x0, pbIV=0x2e17f848, cbIV=0x10, pbOutput=0x7450000, cbOutput=0x100000, pcbResult=0x2e17f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e17f848, pbOutput=0x7450000, pcbResult=0x2e17f618) returned 0x0 [0172.078] WriteFile (in: hFile=0x1980, lpBuffer=0x7450000*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesWritten=0x2e17f61c*=0x9c0, lpOverlapped=0x0) returned 1 [0172.078] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e17f60c | out: lpNewFilePointer=0x0) returned 1 [0172.078] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.079] WriteFile (in: hFile=0x1980, lpBuffer=0x2e17f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e17f83c*, lpNumberOfBytesWritten=0x2e17f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.079] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x9c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.079] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.079] CloseHandle (hObject=0x1980) returned 1 [0172.079] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.play")) returned 1 [0172.082] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2325 os_tid = 0x22e4 [0172.086] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.086] ReadFile (in: hFile=0x1988, lpBuffer=0x2e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesRead=0x2e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.088] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.088] ReadFile (in: hFile=0x1988, lpBuffer=0x2e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesRead=0x2e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.092] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.094] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.095] BCryptSetProperty (in: hObject=0x735d80, pszProperty="ChainingMode", pbInput=0x2e2bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735d80) returned 0x0 [0172.095] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735d80, phKey=0x2e2bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735d80, phKey=0x2e2bf828, pbKeyObject=0x0) returned 0x0 [0172.095] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e2bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e2bf500) returned 0x0 [0172.095] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.095] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e2bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e2bf500) returned 0x0 [0172.100] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.103] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.103] WriteFile (in: hFile=0x1988, lpBuffer=0x2e2bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesWritten=0x2e2bf830*=0x428, lpOverlapped=0x0) returned 1 [0172.104] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.104] ReadFile (in: hFile=0x1988, lpBuffer=0x7550000, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesRead=0x2e2bf61c*=0x150a, lpOverlapped=0x0) returned 1 [0172.104] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0xffffeaf6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.104] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7550000, cbInput=0x150a, pPaddingInfo=0x0, pbIV=0x2e2bf848, cbIV=0x10, pbOutput=0x7550000, cbOutput=0x100000, pcbResult=0x2e2bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e2bf848, pbOutput=0x7550000, pcbResult=0x2e2bf618) returned 0x0 [0172.104] WriteFile (in: hFile=0x1988, lpBuffer=0x7550000*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesWritten=0x2e2bf61c*=0x1510, lpOverlapped=0x0) returned 1 [0172.104] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2bf60c | out: lpNewFilePointer=0x0) returned 1 [0172.105] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.105] WriteFile (in: hFile=0x1988, lpBuffer=0x2e2bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bf83c*, lpNumberOfBytesWritten=0x2e2bf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.105] SetFilePointerEx (in: hFile=0x1988, liDistanceToMove=0x1510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.105] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.105] CloseHandle (hObject=0x1988) returned 1 [0172.105] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.play")) returned 1 [0172.109] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2326 os_tid = 0x22e8 [0172.113] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.113] ReadFile (in: hFile=0x1990, lpBuffer=0x2e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesRead=0x2e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.116] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.116] ReadFile (in: hFile=0x1990, lpBuffer=0x2e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesRead=0x2e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.119] BCryptSetProperty (in: hObject=0x735cd0, pszProperty="ChainingMode", pbInput=0x2e3ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735cd0) returned 0x0 [0172.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735cd0, phKey=0x2e3ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735cd0, phKey=0x2e3ff828, pbKeyObject=0x0) returned 0x0 [0172.119] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e3ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e3ff500) returned 0x0 [0172.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.119] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e3ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e3ff500) returned 0x0 [0172.124] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.127] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.127] WriteFile (in: hFile=0x1990, lpBuffer=0x2e3ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e3ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesWritten=0x2e3ff830*=0x428, lpOverlapped=0x0) returned 1 [0172.129] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.129] ReadFile (in: hFile=0x1990, lpBuffer=0x7650000, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesRead=0x2e3ff61c*=0xe16, lpOverlapped=0x0) returned 1 [0172.129] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xfffff1ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.129] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7650000, cbInput=0xe16, pPaddingInfo=0x0, pbIV=0x2e3ff848, cbIV=0x10, pbOutput=0x7650000, cbOutput=0x100000, pcbResult=0x2e3ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e3ff848, pbOutput=0x7650000, pcbResult=0x2e3ff618) returned 0x0 [0172.129] WriteFile (in: hFile=0x1990, lpBuffer=0x7650000*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesWritten=0x2e3ff61c*=0xe20, lpOverlapped=0x0) returned 1 [0172.129] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3ff60c | out: lpNewFilePointer=0x0) returned 1 [0172.129] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.129] WriteFile (in: hFile=0x1990, lpBuffer=0x2e3ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ff83c*, lpNumberOfBytesWritten=0x2e3ff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.129] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.129] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.130] CloseHandle (hObject=0x1990) returned 1 [0172.130] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.play")) returned 1 [0172.133] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2327 os_tid = 0x22ec [0172.138] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.138] ReadFile (in: hFile=0x1998, lpBuffer=0x2e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesRead=0x2e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.140] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.140] ReadFile (in: hFile=0x1998, lpBuffer=0x2e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesRead=0x2e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.140] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.143] BCryptSetProperty (in: hObject=0x735b70, pszProperty="ChainingMode", pbInput=0x2e53f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735b70) returned 0x0 [0172.143] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735b70, phKey=0x2e53f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735b70, phKey=0x2e53f828, pbKeyObject=0x0) returned 0x0 [0172.143] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e53f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e53f500) returned 0x0 [0172.143] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.143] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e53f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e53f500) returned 0x0 [0172.148] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.151] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.151] WriteFile (in: hFile=0x1998, lpBuffer=0x2e53fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e53f830, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesWritten=0x2e53f830*=0x428, lpOverlapped=0x0) returned 1 [0172.152] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.152] ReadFile (in: hFile=0x1998, lpBuffer=0x7750000, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x7750000*, lpNumberOfBytesRead=0x2e53f61c*=0x23c2, lpOverlapped=0x0) returned 1 [0172.153] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0xffffdc3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.153] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7750000, cbInput=0x23c2, pPaddingInfo=0x0, pbIV=0x2e53f848, cbIV=0x10, pbOutput=0x7750000, cbOutput=0x100000, pcbResult=0x2e53f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e53f848, pbOutput=0x7750000, pcbResult=0x2e53f618) returned 0x0 [0172.153] WriteFile (in: hFile=0x1998, lpBuffer=0x7750000*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x7750000*, lpNumberOfBytesWritten=0x2e53f61c*=0x23d0, lpOverlapped=0x0) returned 1 [0172.153] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e53f60c | out: lpNewFilePointer=0x0) returned 1 [0172.153] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.153] WriteFile (in: hFile=0x1998, lpBuffer=0x2e53f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e53f83c*, lpNumberOfBytesWritten=0x2e53f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.153] SetFilePointerEx (in: hFile=0x1998, liDistanceToMove=0x23d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.153] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.153] CloseHandle (hObject=0x1998) returned 1 [0172.154] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.156] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.play")) returned 1 [0172.157] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2328 os_tid = 0x22f0 [0172.160] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.160] ReadFile (in: hFile=0x19a0, lpBuffer=0x2e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesRead=0x2e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.162] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.162] ReadFile (in: hFile=0x19a0, lpBuffer=0x2e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesRead=0x2e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.162] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.164] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.165] BCryptSetProperty (in: hObject=0x736040, pszProperty="ChainingMode", pbInput=0x2e67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736040) returned 0x0 [0172.165] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736040, phKey=0x2e67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736040, phKey=0x2e67f828, pbKeyObject=0x0) returned 0x0 [0172.165] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e67f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e67f500) returned 0x0 [0172.165] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.165] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e67f500) returned 0x0 [0172.171] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.173] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.174] WriteFile (in: hFile=0x19a0, lpBuffer=0x2e67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e67f830, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesWritten=0x2e67f830*=0x428, lpOverlapped=0x0) returned 1 [0172.175] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.175] ReadFile (in: hFile=0x19a0, lpBuffer=0x7850000, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x7850000*, lpNumberOfBytesRead=0x2e67f61c*=0xd42, lpOverlapped=0x0) returned 1 [0172.175] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xfffff2be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.175] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7850000, cbInput=0xd42, pPaddingInfo=0x0, pbIV=0x2e67f848, cbIV=0x10, pbOutput=0x7850000, cbOutput=0x100000, pcbResult=0x2e67f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e67f848, pbOutput=0x7850000, pcbResult=0x2e67f618) returned 0x0 [0172.175] WriteFile (in: hFile=0x19a0, lpBuffer=0x7850000*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x7850000*, lpNumberOfBytesWritten=0x2e67f61c*=0xd50, lpOverlapped=0x0) returned 1 [0172.175] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e67f60c | out: lpNewFilePointer=0x0) returned 1 [0172.175] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.176] WriteFile (in: hFile=0x19a0, lpBuffer=0x2e67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e67f83c*, lpNumberOfBytesWritten=0x2e67f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.176] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xd50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.176] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.176] CloseHandle (hObject=0x19a0) returned 1 [0172.176] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.play")) returned 1 [0172.179] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2329 os_tid = 0x22f4 [0172.183] SetFilePointerEx (in: hFile=0x19a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.184] ReadFile (in: hFile=0x19a8, lpBuffer=0x2e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesRead=0x2e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.185] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.188] BCryptSetProperty (in: hObject=0x735ee0, pszProperty="ChainingMode", pbInput=0x2e7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ee0) returned 0x0 [0172.188] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ee0, phKey=0x2e7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ee0, phKey=0x2e7bf828, pbKeyObject=0x0) returned 0x0 [0172.188] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e7bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e7bf500) returned 0x0 [0172.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.188] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e7bf500) returned 0x0 [0172.193] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.196] SetFilePointerEx (in: hFile=0x19a8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.196] WriteFile (in: hFile=0x19a8, lpBuffer=0x2e7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesWritten=0x2e7bf830*=0x428, lpOverlapped=0x0) returned 1 [0172.197] SetFilePointerEx (in: hFile=0x19a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.197] ReadFile (in: hFile=0x19a8, lpBuffer=0x7950000, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7950000*, lpNumberOfBytesRead=0x2e7bf61c*=0x4ae, lpOverlapped=0x0) returned 1 [0172.198] SetFilePointerEx (in: hFile=0x19a8, liDistanceToMove=0xfffffb52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.198] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7950000, cbInput=0x4ae, pPaddingInfo=0x0, pbIV=0x2e7bf848, cbIV=0x10, pbOutput=0x7950000, cbOutput=0x100000, pcbResult=0x2e7bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e7bf848, pbOutput=0x7950000, pcbResult=0x2e7bf618) returned 0x0 [0172.198] WriteFile (in: hFile=0x19a8, lpBuffer=0x7950000*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7950000*, lpNumberOfBytesWritten=0x2e7bf61c*=0x4b0, lpOverlapped=0x0) returned 1 [0172.198] SetFilePointerEx (in: hFile=0x19a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7bf60c | out: lpNewFilePointer=0x0) returned 1 [0172.198] SetFilePointerEx (in: hFile=0x19a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.198] WriteFile (in: hFile=0x19a8, lpBuffer=0x2e7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bf83c*, lpNumberOfBytesWritten=0x2e7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.199] SetFilePointerEx (in: hFile=0x19a8, liDistanceToMove=0x4b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.199] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.199] CloseHandle (hObject=0x19a8) returned 1 [0172.199] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.play")) returned 1 [0172.202] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2330 os_tid = 0x22f8 [0172.206] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.207] ReadFile (in: hFile=0x19b0, lpBuffer=0x2e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesRead=0x2e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.208] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.209] ReadFile (in: hFile=0x19b0, lpBuffer=0x2e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesRead=0x2e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.209] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.211] BCryptSetProperty (in: hObject=0x735c20, pszProperty="ChainingMode", pbInput=0x2e8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735c20) returned 0x0 [0172.211] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735c20, phKey=0x2e8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735c20, phKey=0x2e8ff828, pbKeyObject=0x0) returned 0x0 [0172.211] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e8ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e8ff500) returned 0x0 [0172.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.211] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e8ff500) returned 0x0 [0172.216] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.219] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.219] WriteFile (in: hFile=0x19b0, lpBuffer=0x2e8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesWritten=0x2e8ff830*=0x428, lpOverlapped=0x0) returned 1 [0172.221] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.221] ReadFile (in: hFile=0x19b0, lpBuffer=0x7a50000, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7a50000*, lpNumberOfBytesRead=0x2e8ff61c*=0xf00, lpOverlapped=0x0) returned 1 [0172.221] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xfffff100, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.221] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7a50000, cbInput=0xf00, pPaddingInfo=0x0, pbIV=0x2e8ff848, cbIV=0x10, pbOutput=0x7a50000, cbOutput=0x100000, pcbResult=0x2e8ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2e8ff848, pbOutput=0x7a50000, pcbResult=0x2e8ff618) returned 0x0 [0172.221] WriteFile (in: hFile=0x19b0, lpBuffer=0x7a50000*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7a50000*, lpNumberOfBytesWritten=0x2e8ff61c*=0xf10, lpOverlapped=0x0) returned 1 [0172.221] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8ff60c | out: lpNewFilePointer=0x0) returned 1 [0172.221] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.221] WriteFile (in: hFile=0x19b0, lpBuffer=0x2e8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ff83c*, lpNumberOfBytesWritten=0x2e8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.221] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xf10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.221] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.221] CloseHandle (hObject=0x19b0) returned 1 [0172.222] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.play")) returned 1 [0172.225] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2331 os_tid = 0x22fc [0172.230] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.230] ReadFile (in: hFile=0x19b8, lpBuffer=0x2ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesRead=0x2ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.232] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.232] ReadFile (in: hFile=0x19b8, lpBuffer=0x2ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesRead=0x2ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.232] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.234] BCryptSetProperty (in: hObject=0x735e30, pszProperty="ChainingMode", pbInput=0x2ea3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735e30) returned 0x0 [0172.234] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735e30, phKey=0x2ea3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735e30, phKey=0x2ea3f828, pbKeyObject=0x0) returned 0x0 [0172.234] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2ea3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2ea3f500) returned 0x0 [0172.235] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.235] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2ea3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2ea3f500) returned 0x0 [0172.240] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.243] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.243] WriteFile (in: hFile=0x19b8, lpBuffer=0x2ea3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ea3f830, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesWritten=0x2ea3f830*=0x428, lpOverlapped=0x0) returned 1 [0172.244] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.244] ReadFile (in: hFile=0x19b8, lpBuffer=0x7b50000, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7b50000*, lpNumberOfBytesRead=0x2ea3f61c*=0x1352, lpOverlapped=0x0) returned 1 [0172.244] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0xffffecae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.244] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7b50000, cbInput=0x1352, pPaddingInfo=0x0, pbIV=0x2ea3f848, cbIV=0x10, pbOutput=0x7b50000, cbOutput=0x100000, pcbResult=0x2ea3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2ea3f848, pbOutput=0x7b50000, pcbResult=0x2ea3f618) returned 0x0 [0172.244] WriteFile (in: hFile=0x19b8, lpBuffer=0x7b50000*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7b50000*, lpNumberOfBytesWritten=0x2ea3f61c*=0x1360, lpOverlapped=0x0) returned 1 [0172.244] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea3f60c | out: lpNewFilePointer=0x0) returned 1 [0172.244] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.244] WriteFile (in: hFile=0x19b8, lpBuffer=0x2ea3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3f83c*, lpNumberOfBytesWritten=0x2ea3f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.244] SetFilePointerEx (in: hFile=0x19b8, liDistanceToMove=0x1360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.244] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.244] CloseHandle (hObject=0x19b8) returned 1 [0172.245] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.play")) returned 1 [0172.249] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2332 os_tid = 0x2300 [0172.253] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.253] ReadFile (in: hFile=0x1678, lpBuffer=0xb04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb04f85c, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesRead=0xb04f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.255] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.255] ReadFile (in: hFile=0x1678, lpBuffer=0xb04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb04f85c, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesRead=0xb04f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.255] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.258] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.258] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xb04f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0172.258] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xb04f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xb04f828, pbKeyObject=0x0) returned 0x0 [0172.258] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xb04f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xb04f500) returned 0x0 [0172.258] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.258] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xb04f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xb04f500) returned 0x0 [0172.263] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.266] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.267] WriteFile (in: hFile=0x1678, lpBuffer=0xb04fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb04f830, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesWritten=0xb04f830*=0x428, lpOverlapped=0x0) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.268] ReadFile (in: hFile=0x1678, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xb04f61c*=0x1016, lpOverlapped=0x0) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xffffefea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.268] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2a50000, cbInput=0x1016, pPaddingInfo=0x0, pbIV=0xb04f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xb04f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xb04f848, pbOutput=0x2a50000, pcbResult=0xb04f618) returned 0x0 [0172.268] WriteFile (in: hFile=0x1678, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xb04f61c*=0x1020, lpOverlapped=0x0) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb04f60c | out: lpNewFilePointer=0x0) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.268] WriteFile (in: hFile=0x1678, lpBuffer=0xb04f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0xb04f83c*, lpNumberOfBytesWritten=0xb04f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x1020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.268] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.269] CloseHandle (hObject=0x1678) returned 1 [0172.269] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.play")) returned 1 [0172.272] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2333 os_tid = 0x2304 [0172.277] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.277] ReadFile (in: hFile=0x19c4, lpBuffer=0x2eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesRead=0x2eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.279] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.279] ReadFile (in: hFile=0x19c4, lpBuffer=0x2eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesRead=0x2eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.279] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.282] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.282] BCryptSetProperty (in: hObject=0x7360f0, pszProperty="ChainingMode", pbInput=0x2eb7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7360f0) returned 0x0 [0172.282] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7360f0, phKey=0x2eb7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7360f0, phKey=0x2eb7f828, pbKeyObject=0x0) returned 0x0 [0172.282] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2eb7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2eb7f500) returned 0x0 [0172.282] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.282] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2eb7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2eb7f500) returned 0x0 [0172.287] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.290] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.291] WriteFile (in: hFile=0x19c4, lpBuffer=0x2eb7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2eb7f830, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesWritten=0x2eb7f830*=0x428, lpOverlapped=0x0) returned 1 [0172.292] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.292] ReadFile (in: hFile=0x19c4, lpBuffer=0x7c50000, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x2eb7f61c*=0xcd2, lpOverlapped=0x0) returned 1 [0172.293] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0xfffff32e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.293] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7c50000, cbInput=0xcd2, pPaddingInfo=0x0, pbIV=0x2eb7f848, cbIV=0x10, pbOutput=0x7c50000, cbOutput=0x100000, pcbResult=0x2eb7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2eb7f848, pbOutput=0x7c50000, pcbResult=0x2eb7f618) returned 0x0 [0172.293] WriteFile (in: hFile=0x19c4, lpBuffer=0x7c50000*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesWritten=0x2eb7f61c*=0xce0, lpOverlapped=0x0) returned 1 [0172.293] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eb7f60c | out: lpNewFilePointer=0x0) returned 1 [0172.293] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.293] WriteFile (in: hFile=0x19c4, lpBuffer=0x2eb7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7f83c*, lpNumberOfBytesWritten=0x2eb7f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.293] SetFilePointerEx (in: hFile=0x19c4, liDistanceToMove=0xce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.293] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.293] CloseHandle (hObject=0x19c4) returned 1 [0172.294] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.play")) returned 1 [0172.297] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2334 os_tid = 0x2308 [0172.301] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.301] ReadFile (in: hFile=0x19cc, lpBuffer=0x2ecbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ecbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ecbfb34*, lpNumberOfBytesRead=0x2ecbf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.304] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.304] ReadFile (in: hFile=0x19cc, lpBuffer=0x2ecbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ecbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ecbfb34*, lpNumberOfBytesRead=0x2ecbf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.304] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.306] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.306] BCryptSetProperty (in: hObject=0x734af0, pszProperty="ChainingMode", pbInput=0x2ecbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734af0) returned 0x0 [0172.307] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734af0, phKey=0x2ecbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734af0, phKey=0x2ecbf828, pbKeyObject=0x0) returned 0x0 [0172.307] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2ecbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2ecbf500) returned 0x0 [0172.307] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.307] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2ecbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2ecbf500) returned 0x0 [0172.312] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.315] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.315] WriteFile (in: hFile=0x19cc, lpBuffer=0x2ecbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ecbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ecbfb34*, lpNumberOfBytesWritten=0x2ecbf830*=0x428, lpOverlapped=0x0) returned 1 [0172.316] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.316] ReadFile (in: hFile=0x19cc, lpBuffer=0x7d50000, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x2ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7d50000*, lpNumberOfBytesRead=0x2ecbf61c*=0x4162, lpOverlapped=0x0) returned 1 [0172.317] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0xffffbe9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.317] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7d50000, cbInput=0x4162, pPaddingInfo=0x0, pbIV=0x2ecbf848, cbIV=0x10, pbOutput=0x7d50000, cbOutput=0x100000, pcbResult=0x2ecbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2ecbf848, pbOutput=0x7d50000, pcbResult=0x2ecbf618) returned 0x0 [0172.317] WriteFile (in: hFile=0x19cc, lpBuffer=0x7d50000*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7d50000*, lpNumberOfBytesWritten=0x2ecbf61c*=0x4170, lpOverlapped=0x0) returned 1 [0172.317] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecbf60c | out: lpNewFilePointer=0x0) returned 1 [0172.317] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.317] WriteFile (in: hFile=0x19cc, lpBuffer=0x2ecbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ecbf83c*, lpNumberOfBytesWritten=0x2ecbf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.317] SetFilePointerEx (in: hFile=0x19cc, liDistanceToMove=0x4170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.317] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.318] CloseHandle (hObject=0x19cc) returned 1 [0172.318] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.320] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.play")) returned 1 [0172.321] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2335 os_tid = 0x230c [0172.324] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.325] ReadFile (in: hFile=0x19d4, lpBuffer=0x2edffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2edff85c, lpOverlapped=0x0 | out: lpBuffer=0x2edffb34*, lpNumberOfBytesRead=0x2edff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.327] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.327] ReadFile (in: hFile=0x19d4, lpBuffer=0x2edffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2edff85c, lpOverlapped=0x0 | out: lpBuffer=0x2edffb34*, lpNumberOfBytesRead=0x2edff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.327] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.329] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.329] BCryptSetProperty (in: hObject=0x7358b0, pszProperty="ChainingMode", pbInput=0x2edff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7358b0) returned 0x0 [0172.329] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7358b0, phKey=0x2edff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7358b0, phKey=0x2edff828, pbKeyObject=0x0) returned 0x0 [0172.329] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2edff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2edff500) returned 0x0 [0172.329] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.329] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2edff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2edff500) returned 0x0 [0172.334] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.336] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.337] WriteFile (in: hFile=0x19d4, lpBuffer=0x2edffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2edff830, lpOverlapped=0x0 | out: lpBuffer=0x2edffb34*, lpNumberOfBytesWritten=0x2edff830*=0x428, lpOverlapped=0x0) returned 1 [0172.337] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.338] ReadFile (in: hFile=0x19d4, lpBuffer=0x7e50000, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x2edff61c, lpOverlapped=0x0 | out: lpBuffer=0x7e50000*, lpNumberOfBytesRead=0x2edff61c*=0x5fd0, lpOverlapped=0x0) returned 1 [0172.340] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xffffa030, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.340] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7e50000, cbInput=0x5fd0, pPaddingInfo=0x0, pbIV=0x2edff848, cbIV=0x10, pbOutput=0x7e50000, cbOutput=0x100000, pcbResult=0x2edff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2edff848, pbOutput=0x7e50000, pcbResult=0x2edff618) returned 0x0 [0172.340] WriteFile (in: hFile=0x19d4, lpBuffer=0x7e50000*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2edff61c, lpOverlapped=0x0 | out: lpBuffer=0x7e50000*, lpNumberOfBytesWritten=0x2edff61c*=0x5fe0, lpOverlapped=0x0) returned 1 [0172.340] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edff60c | out: lpNewFilePointer=0x0) returned 1 [0172.340] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.340] WriteFile (in: hFile=0x19d4, lpBuffer=0x2edff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2edff61c, lpOverlapped=0x0 | out: lpBuffer=0x2edff83c*, lpNumberOfBytesWritten=0x2edff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.340] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x5fe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.341] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.341] CloseHandle (hObject=0x19d4) returned 1 [0172.341] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.play")) returned 1 [0172.348] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2336 os_tid = 0x2310 [0172.352] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.352] ReadFile (in: hFile=0x19dc, lpBuffer=0x2ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ef3fb34*, lpNumberOfBytesRead=0x2ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.354] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.354] ReadFile (in: hFile=0x19dc, lpBuffer=0x2ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ef3fb34*, lpNumberOfBytesRead=0x2ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.354] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.356] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.357] BCryptSetProperty (in: hObject=0x7346d0, pszProperty="ChainingMode", pbInput=0x2ef3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7346d0) returned 0x0 [0172.357] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7346d0, phKey=0x2ef3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7346d0, phKey=0x2ef3f828, pbKeyObject=0x0) returned 0x0 [0172.357] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2ef3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2ef3f500) returned 0x0 [0172.357] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.357] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2ef3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2ef3f500) returned 0x0 [0172.362] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.364] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.364] WriteFile (in: hFile=0x19dc, lpBuffer=0x2ef3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ef3f830, lpOverlapped=0x0 | out: lpBuffer=0x2ef3fb34*, lpNumberOfBytesWritten=0x2ef3f830*=0x428, lpOverlapped=0x0) returned 1 [0172.365] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.365] ReadFile (in: hFile=0x19dc, lpBuffer=0x7f50000, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x2ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7f50000*, lpNumberOfBytesRead=0x2ef3f61c*=0x2378, lpOverlapped=0x0) returned 1 [0172.366] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0xffffdc88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.366] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x7f50000, cbInput=0x2378, pPaddingInfo=0x0, pbIV=0x2ef3f848, cbIV=0x10, pbOutput=0x7f50000, cbOutput=0x100000, pcbResult=0x2ef3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2ef3f848, pbOutput=0x7f50000, pcbResult=0x2ef3f618) returned 0x0 [0172.366] WriteFile (in: hFile=0x19dc, lpBuffer=0x7f50000*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7f50000*, lpNumberOfBytesWritten=0x2ef3f61c*=0x2380, lpOverlapped=0x0) returned 1 [0172.366] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ef3f60c | out: lpNewFilePointer=0x0) returned 1 [0172.366] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.366] WriteFile (in: hFile=0x19dc, lpBuffer=0x2ef3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ef3f83c*, lpNumberOfBytesWritten=0x2ef3f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.366] SetFilePointerEx (in: hFile=0x19dc, liDistanceToMove=0x2380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.366] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.367] CloseHandle (hObject=0x19dc) returned 1 [0172.367] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.play")) returned 1 [0172.370] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2337 os_tid = 0x2314 [0172.373] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.374] ReadFile (in: hFile=0x19e4, lpBuffer=0x2f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f07fb34*, lpNumberOfBytesRead=0x2f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.375] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.375] ReadFile (in: hFile=0x19e4, lpBuffer=0x2f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f07fb34*, lpNumberOfBytesRead=0x2f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.375] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.377] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.377] BCryptSetProperty (in: hObject=0x7344c0, pszProperty="ChainingMode", pbInput=0x2f07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7344c0) returned 0x0 [0172.378] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7344c0, phKey=0x2f07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7344c0, phKey=0x2f07f828, pbKeyObject=0x0) returned 0x0 [0172.378] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f07f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f07f500) returned 0x0 [0172.378] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.378] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f07f500) returned 0x0 [0172.383] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.385] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.385] WriteFile (in: hFile=0x19e4, lpBuffer=0x2f07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f07f830, lpOverlapped=0x0 | out: lpBuffer=0x2f07fb34*, lpNumberOfBytesWritten=0x2f07f830*=0x428, lpOverlapped=0x0) returned 1 [0172.387] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.387] ReadFile (in: hFile=0x19e4, lpBuffer=0x8050000, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x2f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x8050000*, lpNumberOfBytesRead=0x2f07f61c*=0x1f8c, lpOverlapped=0x0) returned 1 [0172.387] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xffffe074, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.387] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8050000, cbInput=0x1f8c, pPaddingInfo=0x0, pbIV=0x2f07f848, cbIV=0x10, pbOutput=0x8050000, cbOutput=0x100000, pcbResult=0x2f07f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f07f848, pbOutput=0x8050000, pcbResult=0x2f07f618) returned 0x0 [0172.387] WriteFile (in: hFile=0x19e4, lpBuffer=0x8050000*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x8050000*, lpNumberOfBytesWritten=0x2f07f61c*=0x1f90, lpOverlapped=0x0) returned 1 [0172.388] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f07f60c | out: lpNewFilePointer=0x0) returned 1 [0172.388] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.388] WriteFile (in: hFile=0x19e4, lpBuffer=0x2f07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f07f83c*, lpNumberOfBytesWritten=0x2f07f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.388] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0x1f90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.388] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.388] CloseHandle (hObject=0x19e4) returned 1 [0172.388] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.play")) returned 1 [0172.391] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2338 os_tid = 0x2318 [0172.395] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.395] ReadFile (in: hFile=0x19ec, lpBuffer=0x2f1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfb34*, lpNumberOfBytesRead=0x2f1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.397] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.397] ReadFile (in: hFile=0x19ec, lpBuffer=0x2f1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfb34*, lpNumberOfBytesRead=0x2f1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.397] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.399] BCryptSetProperty (in: hObject=0x735800, pszProperty="ChainingMode", pbInput=0x2f1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735800) returned 0x0 [0172.399] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735800, phKey=0x2f1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735800, phKey=0x2f1bf828, pbKeyObject=0x0) returned 0x0 [0172.399] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f1bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f1bf500) returned 0x0 [0172.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.400] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f1bf500) returned 0x0 [0172.405] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.407] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.408] WriteFile (in: hFile=0x19ec, lpBuffer=0x2f1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfb34*, lpNumberOfBytesWritten=0x2f1bf830*=0x428, lpOverlapped=0x0) returned 1 [0172.408] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.409] ReadFile (in: hFile=0x19ec, lpBuffer=0x8150000, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x2f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8150000*, lpNumberOfBytesRead=0x2f1bf61c*=0xab74, lpOverlapped=0x0) returned 1 [0172.410] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0xffff548c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.410] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8150000, cbInput=0xab74, pPaddingInfo=0x0, pbIV=0x2f1bf848, cbIV=0x10, pbOutput=0x8150000, cbOutput=0x100000, pcbResult=0x2f1bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f1bf848, pbOutput=0x8150000, pcbResult=0x2f1bf618) returned 0x0 [0172.410] WriteFile (in: hFile=0x19ec, lpBuffer=0x8150000*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8150000*, lpNumberOfBytesWritten=0x2f1bf61c*=0xab80, lpOverlapped=0x0) returned 1 [0172.410] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1bf60c | out: lpNewFilePointer=0x0) returned 1 [0172.410] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.410] WriteFile (in: hFile=0x19ec, lpBuffer=0x2f1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f1bf83c*, lpNumberOfBytesWritten=0x2f1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.410] SetFilePointerEx (in: hFile=0x19ec, liDistanceToMove=0xab80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.410] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.411] CloseHandle (hObject=0x19ec) returned 1 [0172.411] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.play")) returned 1 [0172.414] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2339 os_tid = 0x231c [0172.421] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.422] ReadFile (in: hFile=0x19f4, lpBuffer=0x2f2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ffb34*, lpNumberOfBytesRead=0x2f2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.425] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.425] ReadFile (in: hFile=0x19f4, lpBuffer=0x2f2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ffb34*, lpNumberOfBytesRead=0x2f2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.425] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.427] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.428] BCryptSetProperty (in: hObject=0x7356a0, pszProperty="ChainingMode", pbInput=0x2f2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7356a0) returned 0x0 [0172.428] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7356a0, phKey=0x2f2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7356a0, phKey=0x2f2ff828, pbKeyObject=0x0) returned 0x0 [0172.428] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f2ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f2ff500) returned 0x0 [0172.428] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.428] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f2ff500) returned 0x0 [0172.435] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.440] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.440] WriteFile (in: hFile=0x19f4, lpBuffer=0x2f2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2f2ffb34*, lpNumberOfBytesWritten=0x2f2ff830*=0x428, lpOverlapped=0x0) returned 1 [0172.442] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.442] ReadFile (in: hFile=0x19f4, lpBuffer=0x8250000, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x2f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8250000*, lpNumberOfBytesRead=0x2f2ff61c*=0xf39f, lpOverlapped=0x0) returned 1 [0172.444] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xffff0c61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.444] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8250000, cbInput=0xf39f, pPaddingInfo=0x0, pbIV=0x2f2ff848, cbIV=0x10, pbOutput=0x8250000, cbOutput=0x100000, pcbResult=0x2f2ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f2ff848, pbOutput=0x8250000, pcbResult=0x2f2ff618) returned 0x0 [0172.444] WriteFile (in: hFile=0x19f4, lpBuffer=0x8250000*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8250000*, lpNumberOfBytesWritten=0x2f2ff61c*=0xf3a0, lpOverlapped=0x0) returned 1 [0172.445] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2ff60c | out: lpNewFilePointer=0x0) returned 1 [0172.445] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.445] WriteFile (in: hFile=0x19f4, lpBuffer=0x2f2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ff83c*, lpNumberOfBytesWritten=0x2f2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.445] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xf3a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.445] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.445] CloseHandle (hObject=0x19f4) returned 1 [0172.446] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.play")) returned 1 [0172.450] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2340 os_tid = 0x2320 [0172.454] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.454] ReadFile (in: hFile=0x19fc, lpBuffer=0x2f43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f43fb34*, lpNumberOfBytesRead=0x2f43f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.456] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.456] ReadFile (in: hFile=0x19fc, lpBuffer=0x2f43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f43fb34*, lpNumberOfBytesRead=0x2f43f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.457] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.459] BCryptSetProperty (in: hObject=0x735540, pszProperty="ChainingMode", pbInput=0x2f43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735540) returned 0x0 [0172.459] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735540, phKey=0x2f43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735540, phKey=0x2f43f828, pbKeyObject=0x0) returned 0x0 [0172.459] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f43f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f43f500) returned 0x0 [0172.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.459] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f43f500) returned 0x0 [0172.464] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.467] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.467] WriteFile (in: hFile=0x19fc, lpBuffer=0x2f43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f43f830, lpOverlapped=0x0 | out: lpBuffer=0x2f43fb34*, lpNumberOfBytesWritten=0x2f43f830*=0x428, lpOverlapped=0x0) returned 1 [0172.467] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.468] ReadFile (in: hFile=0x19fc, lpBuffer=0x8350000, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x2f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x8350000*, lpNumberOfBytesRead=0x2f43f61c*=0x462c, lpOverlapped=0x0) returned 1 [0172.500] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0xffffb9d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.500] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8350000, cbInput=0x462c, pPaddingInfo=0x0, pbIV=0x2f43f848, cbIV=0x10, pbOutput=0x8350000, cbOutput=0x100000, pcbResult=0x2f43f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f43f848, pbOutput=0x8350000, pcbResult=0x2f43f618) returned 0x0 [0172.501] WriteFile (in: hFile=0x19fc, lpBuffer=0x8350000*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x8350000*, lpNumberOfBytesWritten=0x2f43f61c*=0x4630, lpOverlapped=0x0) returned 1 [0172.501] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f43f60c | out: lpNewFilePointer=0x0) returned 1 [0172.501] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.501] WriteFile (in: hFile=0x19fc, lpBuffer=0x2f43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f43f83c*, lpNumberOfBytesWritten=0x2f43f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.501] SetFilePointerEx (in: hFile=0x19fc, liDistanceToMove=0x4630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.501] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.501] CloseHandle (hObject=0x19fc) returned 1 [0172.501] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099192.gif.play")) returned 1 [0172.505] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2341 os_tid = 0x2324 [0172.456] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.468] ReadFile (in: hFile=0x1a04, lpBuffer=0x2f57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f57fb34*, lpNumberOfBytesRead=0x2f57f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.510] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.511] ReadFile (in: hFile=0x1a04, lpBuffer=0x2f57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f57fb34*, lpNumberOfBytesRead=0x2f57f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.513] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.513] BCryptSetProperty (in: hObject=0x734ba0, pszProperty="ChainingMode", pbInput=0x2f57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734ba0) returned 0x0 [0172.513] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734ba0, phKey=0x2f57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734ba0, phKey=0x2f57f828, pbKeyObject=0x0) returned 0x0 [0172.513] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f57f500) returned 0x0 [0172.513] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.513] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f57f500) returned 0x0 [0172.519] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.521] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.521] WriteFile (in: hFile=0x1a04, lpBuffer=0x2f57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f57f830, lpOverlapped=0x0 | out: lpBuffer=0x2f57fb34*, lpNumberOfBytesWritten=0x2f57f830*=0x428, lpOverlapped=0x0) returned 1 [0172.522] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.522] ReadFile (in: hFile=0x1a04, lpBuffer=0x8450000, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x2f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x8450000*, lpNumberOfBytesRead=0x2f57f61c*=0x8ada, lpOverlapped=0x0) returned 1 [0172.524] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xffff7526, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.524] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8450000, cbInput=0x8ada, pPaddingInfo=0x0, pbIV=0x2f57f848, cbIV=0x10, pbOutput=0x8450000, cbOutput=0x100000, pcbResult=0x2f57f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f57f848, pbOutput=0x8450000, pcbResult=0x2f57f618) returned 0x0 [0172.524] WriteFile (in: hFile=0x1a04, lpBuffer=0x8450000*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x8450000*, lpNumberOfBytesWritten=0x2f57f61c*=0x8ae0, lpOverlapped=0x0) returned 1 [0172.524] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f57f60c | out: lpNewFilePointer=0x0) returned 1 [0172.524] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.524] WriteFile (in: hFile=0x1a04, lpBuffer=0x2f57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f57f83c*, lpNumberOfBytesWritten=0x2f57f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.524] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x8ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.524] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.524] CloseHandle (hObject=0x1a04) returned 1 [0172.525] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099193.gif.play")) returned 1 [0172.528] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2342 os_tid = 0x2328 [0172.531] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.531] ReadFile (in: hFile=0x1a0c, lpBuffer=0x2f6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfb34*, lpNumberOfBytesRead=0x2f6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.533] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.533] ReadFile (in: hFile=0x1a0c, lpBuffer=0x2f6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfb34*, lpNumberOfBytesRead=0x2f6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.533] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.535] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.535] BCryptSetProperty (in: hObject=0x735a10, pszProperty="ChainingMode", pbInput=0x2f6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735a10) returned 0x0 [0172.535] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735a10, phKey=0x2f6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735a10, phKey=0x2f6bf828, pbKeyObject=0x0) returned 0x0 [0172.535] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f6bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f6bf500) returned 0x0 [0172.536] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.536] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f6bf500) returned 0x0 [0172.541] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.543] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.543] WriteFile (in: hFile=0x1a0c, lpBuffer=0x2f6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfb34*, lpNumberOfBytesWritten=0x2f6bf830*=0x428, lpOverlapped=0x0) returned 1 [0172.544] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.544] ReadFile (in: hFile=0x1a0c, lpBuffer=0x8550000, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x2f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8550000*, lpNumberOfBytesRead=0x2f6bf61c*=0x62b1, lpOverlapped=0x0) returned 1 [0172.547] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0xffff9d4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.547] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8550000, cbInput=0x62b1, pPaddingInfo=0x0, pbIV=0x2f6bf848, cbIV=0x10, pbOutput=0x8550000, cbOutput=0x100000, pcbResult=0x2f6bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f6bf848, pbOutput=0x8550000, pcbResult=0x2f6bf618) returned 0x0 [0172.547] WriteFile (in: hFile=0x1a0c, lpBuffer=0x8550000*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8550000*, lpNumberOfBytesWritten=0x2f6bf61c*=0x62c0, lpOverlapped=0x0) returned 1 [0172.547] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f6bf60c | out: lpNewFilePointer=0x0) returned 1 [0172.548] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.548] WriteFile (in: hFile=0x1a0c, lpBuffer=0x2f6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f6bf83c*, lpNumberOfBytesWritten=0x2f6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.548] SetFilePointerEx (in: hFile=0x1a0c, liDistanceToMove=0x62c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.548] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.548] CloseHandle (hObject=0x1a0c) returned 1 [0172.548] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099194.gif.play")) returned 1 [0172.552] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2343 os_tid = 0x232c [0172.555] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.556] ReadFile (in: hFile=0x1a14, lpBuffer=0x2f7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f7ffb34*, lpNumberOfBytesRead=0x2f7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.557] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.557] ReadFile (in: hFile=0x1a14, lpBuffer=0x2f7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f7ffb34*, lpNumberOfBytesRead=0x2f7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.557] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.559] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.560] BCryptSetProperty (in: hObject=0x735960, pszProperty="ChainingMode", pbInput=0x2f7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735960) returned 0x0 [0172.560] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735960, phKey=0x2f7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735960, phKey=0x2f7ff828, pbKeyObject=0x0) returned 0x0 [0172.560] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f7ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f7ff500) returned 0x0 [0172.560] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.560] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f7ff500) returned 0x0 [0172.565] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.568] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.568] WriteFile (in: hFile=0x1a14, lpBuffer=0x2f7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2f7ffb34*, lpNumberOfBytesWritten=0x2f7ff830*=0x428, lpOverlapped=0x0) returned 1 [0172.569] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.569] ReadFile (in: hFile=0x1a14, lpBuffer=0x8650000, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x2f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8650000*, lpNumberOfBytesRead=0x2f7ff61c*=0x4dd3, lpOverlapped=0x0) returned 1 [0172.570] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xffffb22d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.570] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8650000, cbInput=0x4dd3, pPaddingInfo=0x0, pbIV=0x2f7ff848, cbIV=0x10, pbOutput=0x8650000, cbOutput=0x100000, pcbResult=0x2f7ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f7ff848, pbOutput=0x8650000, pcbResult=0x2f7ff618) returned 0x0 [0172.570] WriteFile (in: hFile=0x1a14, lpBuffer=0x8650000*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8650000*, lpNumberOfBytesWritten=0x2f7ff61c*=0x4de0, lpOverlapped=0x0) returned 1 [0172.570] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f7ff60c | out: lpNewFilePointer=0x0) returned 1 [0172.570] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.570] WriteFile (in: hFile=0x1a14, lpBuffer=0x2f7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f7ff83c*, lpNumberOfBytesWritten=0x2f7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.570] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x4de0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.570] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.570] CloseHandle (hObject=0x1a14) returned 1 [0172.570] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099195.gif.play")) returned 1 [0172.573] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2344 os_tid = 0x2330 [0172.576] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.576] ReadFile (in: hFile=0x1a1c, lpBuffer=0x2f93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f93fb34*, lpNumberOfBytesRead=0x2f93f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.578] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.578] ReadFile (in: hFile=0x1a1c, lpBuffer=0x2f93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f93fb34*, lpNumberOfBytesRead=0x2f93f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.579] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.581] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.581] BCryptSetProperty (in: hObject=0x735330, pszProperty="ChainingMode", pbInput=0x2f93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735330) returned 0x0 [0172.581] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735330, phKey=0x2f93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735330, phKey=0x2f93f828, pbKeyObject=0x0) returned 0x0 [0172.581] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2f93f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2f93f500) returned 0x0 [0172.581] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.582] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2f93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2f93f500) returned 0x0 [0172.586] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.589] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.589] WriteFile (in: hFile=0x1a1c, lpBuffer=0x2f93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f93f830, lpOverlapped=0x0 | out: lpBuffer=0x2f93fb34*, lpNumberOfBytesWritten=0x2f93f830*=0x428, lpOverlapped=0x0) returned 1 [0172.590] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.590] ReadFile (in: hFile=0x1a1c, lpBuffer=0x8750000, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x2f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x8750000*, lpNumberOfBytesRead=0x2f93f61c*=0x3801, lpOverlapped=0x0) returned 1 [0172.591] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0xffffc7ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.591] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8750000, cbInput=0x3801, pPaddingInfo=0x0, pbIV=0x2f93f848, cbIV=0x10, pbOutput=0x8750000, cbOutput=0x100000, pcbResult=0x2f93f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2f93f848, pbOutput=0x8750000, pcbResult=0x2f93f618) returned 0x0 [0172.591] WriteFile (in: hFile=0x1a1c, lpBuffer=0x8750000*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x8750000*, lpNumberOfBytesWritten=0x2f93f61c*=0x3810, lpOverlapped=0x0) returned 1 [0172.591] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f93f60c | out: lpNewFilePointer=0x0) returned 1 [0172.591] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.591] WriteFile (in: hFile=0x1a1c, lpBuffer=0x2f93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f93f83c*, lpNumberOfBytesWritten=0x2f93f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.591] SetFilePointerEx (in: hFile=0x1a1c, liDistanceToMove=0x3810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.591] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.591] CloseHandle (hObject=0x1a1c) returned 1 [0172.592] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099196.gif.play")) returned 1 [0172.595] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2345 os_tid = 0x2334 [0172.598] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.599] ReadFile (in: hFile=0x1a24, lpBuffer=0x2fa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fa7fb34*, lpNumberOfBytesRead=0x2fa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.600] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.600] ReadFile (in: hFile=0x1a24, lpBuffer=0x2fa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fa7fb34*, lpNumberOfBytesRead=0x2fa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.600] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.603] BCryptSetProperty (in: hObject=0x734570, pszProperty="ChainingMode", pbInput=0x2fa7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734570) returned 0x0 [0172.603] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734570, phKey=0x2fa7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734570, phKey=0x2fa7f828, pbKeyObject=0x0) returned 0x0 [0172.603] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2fa7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2fa7f500) returned 0x0 [0172.603] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.603] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2fa7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2fa7f500) returned 0x0 [0172.608] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.611] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.611] WriteFile (in: hFile=0x1a24, lpBuffer=0x2fa7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fa7f830, lpOverlapped=0x0 | out: lpBuffer=0x2fa7fb34*, lpNumberOfBytesWritten=0x2fa7f830*=0x428, lpOverlapped=0x0) returned 1 [0172.612] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.612] ReadFile (in: hFile=0x1a24, lpBuffer=0x8850000, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x2fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8850000*, lpNumberOfBytesRead=0x2fa7f61c*=0x2a92, lpOverlapped=0x0) returned 1 [0172.613] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xffffd56e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.613] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8850000, cbInput=0x2a92, pPaddingInfo=0x0, pbIV=0x2fa7f848, cbIV=0x10, pbOutput=0x8850000, cbOutput=0x100000, pcbResult=0x2fa7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2fa7f848, pbOutput=0x8850000, pcbResult=0x2fa7f618) returned 0x0 [0172.614] WriteFile (in: hFile=0x1a24, lpBuffer=0x8850000*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8850000*, lpNumberOfBytesWritten=0x2fa7f61c*=0x2aa0, lpOverlapped=0x0) returned 1 [0172.614] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fa7f60c | out: lpNewFilePointer=0x0) returned 1 [0172.614] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.614] WriteFile (in: hFile=0x1a24, lpBuffer=0x2fa7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2fa7f83c*, lpNumberOfBytesWritten=0x2fa7f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.614] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0x2aa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.614] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.614] CloseHandle (hObject=0x1a24) returned 1 [0172.614] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099197.gif.play")) returned 1 [0172.617] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2346 os_tid = 0x2338 [0172.621] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.621] ReadFile (in: hFile=0x1a2c, lpBuffer=0x2fbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fbbfb34*, lpNumberOfBytesRead=0x2fbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.623] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.623] ReadFile (in: hFile=0x1a2c, lpBuffer=0x2fbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fbbfb34*, lpNumberOfBytesRead=0x2fbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.624] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.626] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.626] BCryptSetProperty (in: hObject=0x734fc0, pszProperty="ChainingMode", pbInput=0x2fbbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734fc0) returned 0x0 [0172.626] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734fc0, phKey=0x2fbbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734fc0, phKey=0x2fbbf828, pbKeyObject=0x0) returned 0x0 [0172.626] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2fbbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2fbbf500) returned 0x0 [0172.626] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.626] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2fbbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2fbbf500) returned 0x0 [0172.631] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.634] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.634] WriteFile (in: hFile=0x1a2c, lpBuffer=0x2fbbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fbbf830, lpOverlapped=0x0 | out: lpBuffer=0x2fbbfb34*, lpNumberOfBytesWritten=0x2fbbf830*=0x428, lpOverlapped=0x0) returned 1 [0172.635] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.636] ReadFile (in: hFile=0x1a2c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x2fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x2fbbf61c*=0x148b, lpOverlapped=0x0) returned 1 [0172.636] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0xffffeb75, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.636] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8950000, cbInput=0x148b, pPaddingInfo=0x0, pbIV=0x2fbbf848, cbIV=0x10, pbOutput=0x8950000, cbOutput=0x100000, pcbResult=0x2fbbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2fbbf848, pbOutput=0x8950000, pcbResult=0x2fbbf618) returned 0x0 [0172.636] WriteFile (in: hFile=0x1a2c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x2fbbf61c*=0x1490, lpOverlapped=0x0) returned 1 [0172.636] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbbf60c | out: lpNewFilePointer=0x0) returned 1 [0172.636] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.636] WriteFile (in: hFile=0x1a2c, lpBuffer=0x2fbbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2fbbf83c*, lpNumberOfBytesWritten=0x2fbbf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.636] SetFilePointerEx (in: hFile=0x1a2c, liDistanceToMove=0x1490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.636] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.636] CloseHandle (hObject=0x1a2c) returned 1 [0172.637] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099198.gif.play")) returned 1 [0172.641] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2347 os_tid = 0x233c [0172.721] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.721] ReadFile (in: hFile=0x1a34, lpBuffer=0x2fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x2fcffb34*, lpNumberOfBytesRead=0x2fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.723] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.723] ReadFile (in: hFile=0x1a34, lpBuffer=0x2fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x2fcffb34*, lpNumberOfBytesRead=0x2fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.724] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.726] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.726] BCryptSetProperty (in: hObject=0x734620, pszProperty="ChainingMode", pbInput=0x2fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734620) returned 0x0 [0172.726] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734620, phKey=0x2fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734620, phKey=0x2fcff828, pbKeyObject=0x0) returned 0x0 [0172.726] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2fcff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2fcff500) returned 0x0 [0172.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.727] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2fcff500) returned 0x0 [0172.732] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.792] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.813] WriteFile (in: hFile=0x1a34, lpBuffer=0x2fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fcff830, lpOverlapped=0x0 | out: lpBuffer=0x2fcffb34*, lpNumberOfBytesWritten=0x2fcff830*=0x428, lpOverlapped=0x0) returned 1 [0172.814] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.814] ReadFile (in: hFile=0x1a34, lpBuffer=0x8a50000, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x2fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x8a50000*, lpNumberOfBytesRead=0x2fcff61c*=0x84b7, lpOverlapped=0x0) returned 1 [0172.815] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xffff7b49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.815] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8a50000, cbInput=0x84b7, pPaddingInfo=0x0, pbIV=0x2fcff848, cbIV=0x10, pbOutput=0x8a50000, cbOutput=0x100000, pcbResult=0x2fcff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2fcff848, pbOutput=0x8a50000, pcbResult=0x2fcff618) returned 0x0 [0172.815] WriteFile (in: hFile=0x1a34, lpBuffer=0x8a50000*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x8a50000*, lpNumberOfBytesWritten=0x2fcff61c*=0x84c0, lpOverlapped=0x0) returned 1 [0172.816] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcff60c | out: lpNewFilePointer=0x0) returned 1 [0172.816] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.816] WriteFile (in: hFile=0x1a34, lpBuffer=0x2fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x2fcff83c*, lpNumberOfBytesWritten=0x2fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.816] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x84c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.816] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.816] CloseHandle (hObject=0x1a34) returned 1 [0172.816] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099199.gif.play")) returned 1 [0172.821] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2348 os_tid = 0x2340 [0172.814] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.826] ReadFile (in: hFile=0x1a3c, lpBuffer=0x2fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fe3fb34*, lpNumberOfBytesRead=0x2fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.828] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.828] ReadFile (in: hFile=0x1a3c, lpBuffer=0x2fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fe3fb34*, lpNumberOfBytesRead=0x2fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.828] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.831] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.831] BCryptSetProperty (in: hObject=0x7353e0, pszProperty="ChainingMode", pbInput=0x2fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7353e0) returned 0x0 [0172.831] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7353e0, phKey=0x2fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7353e0, phKey=0x2fe3f828, pbKeyObject=0x0) returned 0x0 [0172.831] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2fe3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2fe3f500) returned 0x0 [0172.831] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.831] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2fe3f500) returned 0x0 [0172.836] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.839] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.839] WriteFile (in: hFile=0x1a3c, lpBuffer=0x2fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x2fe3fb34*, lpNumberOfBytesWritten=0x2fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0172.840] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.840] ReadFile (in: hFile=0x1a3c, lpBuffer=0x8b50000, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x2fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x8b50000*, lpNumberOfBytesRead=0x2fe3f61c*=0x409f, lpOverlapped=0x0) returned 1 [0172.850] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0xffffbf61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.850] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8b50000, cbInput=0x409f, pPaddingInfo=0x0, pbIV=0x2fe3f848, cbIV=0x10, pbOutput=0x8b50000, cbOutput=0x100000, pcbResult=0x2fe3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2fe3f848, pbOutput=0x8b50000, pcbResult=0x2fe3f618) returned 0x0 [0172.850] WriteFile (in: hFile=0x1a3c, lpBuffer=0x8b50000*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x8b50000*, lpNumberOfBytesWritten=0x2fe3f61c*=0x40a0, lpOverlapped=0x0) returned 1 [0172.851] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0172.851] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.851] WriteFile (in: hFile=0x1a3c, lpBuffer=0x2fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2fe3f83c*, lpNumberOfBytesWritten=0x2fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.851] SetFilePointerEx (in: hFile=0x1a3c, liDistanceToMove=0x40a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.851] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.851] CloseHandle (hObject=0x1a3c) returned 1 [0172.851] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099200.gif.play")) returned 1 [0172.855] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2349 os_tid = 0x2344 [0172.859] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.859] ReadFile (in: hFile=0x1a44, lpBuffer=0x2ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ff7fb34*, lpNumberOfBytesRead=0x2ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.861] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.861] ReadFile (in: hFile=0x1a44, lpBuffer=0x2ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ff7fb34*, lpNumberOfBytesRead=0x2ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.864] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.864] BCryptSetProperty (in: hObject=0x734db0, pszProperty="ChainingMode", pbInput=0x2ff7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734db0) returned 0x0 [0172.864] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734db0, phKey=0x2ff7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734db0, phKey=0x2ff7f828, pbKeyObject=0x0) returned 0x0 [0172.864] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2ff7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2ff7f500) returned 0x0 [0172.864] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.864] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2ff7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2ff7f500) returned 0x0 [0172.869] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.872] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.872] WriteFile (in: hFile=0x1a44, lpBuffer=0x2ff7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ff7f830, lpOverlapped=0x0 | out: lpBuffer=0x2ff7fb34*, lpNumberOfBytesWritten=0x2ff7f830*=0x428, lpOverlapped=0x0) returned 1 [0172.873] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.873] ReadFile (in: hFile=0x1a44, lpBuffer=0x8c50000, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x2ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8c50000*, lpNumberOfBytesRead=0x2ff7f61c*=0xc8c9, lpOverlapped=0x0) returned 1 [0172.875] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xffff3737, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.875] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8c50000, cbInput=0xc8c9, pPaddingInfo=0x0, pbIV=0x2ff7f848, cbIV=0x10, pbOutput=0x8c50000, cbOutput=0x100000, pcbResult=0x2ff7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2ff7f848, pbOutput=0x8c50000, pcbResult=0x2ff7f618) returned 0x0 [0172.875] WriteFile (in: hFile=0x1a44, lpBuffer=0x8c50000*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8c50000*, lpNumberOfBytesWritten=0x2ff7f61c*=0xc8d0, lpOverlapped=0x0) returned 1 [0172.875] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ff7f60c | out: lpNewFilePointer=0x0) returned 1 [0172.875] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.876] WriteFile (in: hFile=0x1a44, lpBuffer=0x2ff7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ff7f83c*, lpNumberOfBytesWritten=0x2ff7f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.876] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xc8d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.876] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.876] CloseHandle (hObject=0x1a44) returned 1 [0172.876] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099201.gif.play")) returned 1 [0172.880] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2350 os_tid = 0x2348 [0172.883] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.884] ReadFile (in: hFile=0x1a4c, lpBuffer=0x300bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x300bf85c, lpOverlapped=0x0 | out: lpBuffer=0x300bfb34*, lpNumberOfBytesRead=0x300bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.887] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.887] ReadFile (in: hFile=0x1a4c, lpBuffer=0x300bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x300bf85c, lpOverlapped=0x0 | out: lpBuffer=0x300bfb34*, lpNumberOfBytesRead=0x300bf85c*=0x428, lpOverlapped=0x0) returned 1 [0172.887] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.889] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.889] BCryptSetProperty (in: hObject=0x735750, pszProperty="ChainingMode", pbInput=0x300bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735750) returned 0x0 [0172.889] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735750, phKey=0x300bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735750, phKey=0x300bf828, pbKeyObject=0x0) returned 0x0 [0172.889] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x300bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x300bf500) returned 0x0 [0172.889] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.890] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x300bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x300bf500) returned 0x0 [0172.895] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.898] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.898] WriteFile (in: hFile=0x1a4c, lpBuffer=0x300bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x300bf830, lpOverlapped=0x0 | out: lpBuffer=0x300bfb34*, lpNumberOfBytesWritten=0x300bf830*=0x428, lpOverlapped=0x0) returned 1 [0172.899] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.899] ReadFile (in: hFile=0x1a4c, lpBuffer=0x8d50000, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x300bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8d50000*, lpNumberOfBytesRead=0x300bf61c*=0x1367, lpOverlapped=0x0) returned 1 [0172.899] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0xffffec99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.899] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8d50000, cbInput=0x1367, pPaddingInfo=0x0, pbIV=0x300bf848, cbIV=0x10, pbOutput=0x8d50000, cbOutput=0x100000, pcbResult=0x300bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x300bf848, pbOutput=0x8d50000, pcbResult=0x300bf618) returned 0x0 [0172.899] WriteFile (in: hFile=0x1a4c, lpBuffer=0x8d50000*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x300bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8d50000*, lpNumberOfBytesWritten=0x300bf61c*=0x1370, lpOverlapped=0x0) returned 1 [0172.899] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300bf60c | out: lpNewFilePointer=0x0) returned 1 [0172.899] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.899] WriteFile (in: hFile=0x1a4c, lpBuffer=0x300bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x300bf61c, lpOverlapped=0x0 | out: lpBuffer=0x300bf83c*, lpNumberOfBytesWritten=0x300bf61c*=0x8, lpOverlapped=0x0) returned 1 [0172.900] SetFilePointerEx (in: hFile=0x1a4c, liDistanceToMove=0x1370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.900] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.900] CloseHandle (hObject=0x1a4c) returned 1 [0172.900] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099202.gif.play")) returned 1 [0172.904] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2351 os_tid = 0x234c [0172.908] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.908] ReadFile (in: hFile=0x1a54, lpBuffer=0x301ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x301ff85c, lpOverlapped=0x0 | out: lpBuffer=0x301ffb34*, lpNumberOfBytesRead=0x301ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.910] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.910] ReadFile (in: hFile=0x1a54, lpBuffer=0x301ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x301ff85c, lpOverlapped=0x0 | out: lpBuffer=0x301ffb34*, lpNumberOfBytesRead=0x301ff85c*=0x428, lpOverlapped=0x0) returned 1 [0172.911] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.913] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.913] BCryptSetProperty (in: hObject=0x734c50, pszProperty="ChainingMode", pbInput=0x301ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734c50) returned 0x0 [0172.913] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734c50, phKey=0x301ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734c50, phKey=0x301ff828, pbKeyObject=0x0) returned 0x0 [0172.913] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x301ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x301ff500) returned 0x0 [0172.913] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.913] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x301ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x301ff500) returned 0x0 [0172.918] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.921] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.921] WriteFile (in: hFile=0x1a54, lpBuffer=0x301ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x301ff830, lpOverlapped=0x0 | out: lpBuffer=0x301ffb34*, lpNumberOfBytesWritten=0x301ff830*=0x428, lpOverlapped=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.923] ReadFile (in: hFile=0x1a54, lpBuffer=0x8e50000, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x301ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8e50000*, lpNumberOfBytesRead=0x301ff61c*=0xf40, lpOverlapped=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffff0c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.923] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8e50000, cbInput=0xf40, pPaddingInfo=0x0, pbIV=0x301ff848, cbIV=0x10, pbOutput=0x8e50000, cbOutput=0x100000, pcbResult=0x301ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x301ff848, pbOutput=0x8e50000, pcbResult=0x301ff618) returned 0x0 [0172.923] WriteFile (in: hFile=0x1a54, lpBuffer=0x8e50000*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x301ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8e50000*, lpNumberOfBytesWritten=0x301ff61c*=0xf50, lpOverlapped=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301ff60c | out: lpNewFilePointer=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.923] WriteFile (in: hFile=0x1a54, lpBuffer=0x301ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x301ff61c, lpOverlapped=0x0 | out: lpBuffer=0x301ff83c*, lpNumberOfBytesWritten=0x301ff61c*=0x8, lpOverlapped=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xf50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.923] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.923] CloseHandle (hObject=0x1a54) returned 1 [0172.924] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.926] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099203.gif.play")) returned 1 [0172.927] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2352 os_tid = 0x2350 [0172.932] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.932] ReadFile (in: hFile=0x1a5c, lpBuffer=0x3033fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3033f85c, lpOverlapped=0x0 | out: lpBuffer=0x3033fb34*, lpNumberOfBytesRead=0x3033f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.934] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.934] ReadFile (in: hFile=0x1a5c, lpBuffer=0x3033fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3033f85c, lpOverlapped=0x0 | out: lpBuffer=0x3033fb34*, lpNumberOfBytesRead=0x3033f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.934] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.937] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.937] BCryptSetProperty (in: hObject=0x735120, pszProperty="ChainingMode", pbInput=0x3033f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735120) returned 0x0 [0172.937] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735120, phKey=0x3033f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735120, phKey=0x3033f828, pbKeyObject=0x0) returned 0x0 [0172.937] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3033f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3033f500) returned 0x0 [0172.937] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.937] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3033f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3033f500) returned 0x0 [0172.942] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.945] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.945] WriteFile (in: hFile=0x1a5c, lpBuffer=0x3033fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3033f830, lpOverlapped=0x0 | out: lpBuffer=0x3033fb34*, lpNumberOfBytesWritten=0x3033f830*=0x428, lpOverlapped=0x0) returned 1 [0172.946] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.946] ReadFile (in: hFile=0x1a5c, lpBuffer=0x8f50000, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x3033f61c, lpOverlapped=0x0 | out: lpBuffer=0x8f50000*, lpNumberOfBytesRead=0x3033f61c*=0x45be, lpOverlapped=0x0) returned 1 [0172.947] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0xffffba42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.947] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x8f50000, cbInput=0x45be, pPaddingInfo=0x0, pbIV=0x3033f848, cbIV=0x10, pbOutput=0x8f50000, cbOutput=0x100000, pcbResult=0x3033f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3033f848, pbOutput=0x8f50000, pcbResult=0x3033f618) returned 0x0 [0172.947] WriteFile (in: hFile=0x1a5c, lpBuffer=0x8f50000*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x3033f61c, lpOverlapped=0x0 | out: lpBuffer=0x8f50000*, lpNumberOfBytesWritten=0x3033f61c*=0x45c0, lpOverlapped=0x0) returned 1 [0172.948] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3033f60c | out: lpNewFilePointer=0x0) returned 1 [0172.948] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.948] WriteFile (in: hFile=0x1a5c, lpBuffer=0x3033f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3033f61c, lpOverlapped=0x0 | out: lpBuffer=0x3033f83c*, lpNumberOfBytesWritten=0x3033f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.948] SetFilePointerEx (in: hFile=0x1a5c, liDistanceToMove=0x45c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.948] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.948] CloseHandle (hObject=0x1a5c) returned 1 [0172.948] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.950] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.play")) returned 1 [0172.952] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2353 os_tid = 0x2354 [0172.955] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.956] ReadFile (in: hFile=0x1668, lpBuffer=0xb31fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb31f85c, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesRead=0xb31f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.957] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.957] ReadFile (in: hFile=0x1668, lpBuffer=0xb31fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb31f85c, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesRead=0xb31f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.958] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.960] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.960] BCryptSetProperty (in: hObject=0x734780, pszProperty="ChainingMode", pbInput=0xb31f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734780) returned 0x0 [0172.960] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734780, phKey=0xb31f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734780, phKey=0xb31f828, pbKeyObject=0x0) returned 0x0 [0172.961] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xb31f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xb31f500) returned 0x0 [0172.961] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.961] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xb31f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xb31f500) returned 0x0 [0172.966] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.968] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.969] WriteFile (in: hFile=0x1668, lpBuffer=0xb31fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb31f830, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesWritten=0xb31f830*=0x428, lpOverlapped=0x0) returned 1 [0172.970] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.970] ReadFile (in: hFile=0x1668, lpBuffer=0x9050000, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0x9050000*, lpNumberOfBytesRead=0xb31f61c*=0x45be, lpOverlapped=0x0) returned 1 [0172.971] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xffffba42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.971] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9050000, cbInput=0x45be, pPaddingInfo=0x0, pbIV=0xb31f848, cbIV=0x10, pbOutput=0x9050000, cbOutput=0x100000, pcbResult=0xb31f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xb31f848, pbOutput=0x9050000, pcbResult=0xb31f618) returned 0x0 [0172.971] WriteFile (in: hFile=0x1668, lpBuffer=0x9050000*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0x9050000*, lpNumberOfBytesWritten=0xb31f61c*=0x45c0, lpOverlapped=0x0) returned 1 [0172.971] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb31f60c | out: lpNewFilePointer=0x0) returned 1 [0172.972] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.972] WriteFile (in: hFile=0x1668, lpBuffer=0xb31f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0xb31f83c*, lpNumberOfBytesWritten=0xb31f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.972] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x45c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.972] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.972] CloseHandle (hObject=0x1668) returned 1 [0172.972] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.play")) returned 1 [0172.975] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2354 os_tid = 0x2358 [0172.978] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.978] ReadFile (in: hFile=0x1a68, lpBuffer=0x3047fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3047f85c, lpOverlapped=0x0 | out: lpBuffer=0x3047fb34*, lpNumberOfBytesRead=0x3047f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.980] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.980] ReadFile (in: hFile=0x1a68, lpBuffer=0x3047fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3047f85c, lpOverlapped=0x0 | out: lpBuffer=0x3047fb34*, lpNumberOfBytesRead=0x3047f85c*=0x428, lpOverlapped=0x0) returned 1 [0172.980] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0172.982] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0172.982] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x3047f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0172.983] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x3047f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x3047f828, pbKeyObject=0x0) returned 0x0 [0172.983] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3047f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3047f500) returned 0x0 [0172.983] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0172.983] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3047f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3047f500) returned 0x0 [0172.988] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.991] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.991] WriteFile (in: hFile=0x1a68, lpBuffer=0x3047fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3047f830, lpOverlapped=0x0 | out: lpBuffer=0x3047fb34*, lpNumberOfBytesWritten=0x3047f830*=0x428, lpOverlapped=0x0) returned 1 [0172.992] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.992] ReadFile (in: hFile=0x1a68, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x3047f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x3047f61c*=0x133f8, lpOverlapped=0x0) returned 1 [0172.993] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0xfffecc08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.993] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2b50000, cbInput=0x133f8, pPaddingInfo=0x0, pbIV=0x3047f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x3047f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3047f848, pbOutput=0x2b50000, pcbResult=0x3047f618) returned 0x0 [0172.993] WriteFile (in: hFile=0x1a68, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x3047f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x3047f61c*=0x13400, lpOverlapped=0x0) returned 1 [0172.994] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3047f60c | out: lpNewFilePointer=0x0) returned 1 [0172.994] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.994] WriteFile (in: hFile=0x1a68, lpBuffer=0x3047f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3047f61c, lpOverlapped=0x0 | out: lpBuffer=0x3047f83c*, lpNumberOfBytesWritten=0x3047f61c*=0x8, lpOverlapped=0x0) returned 1 [0172.994] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x13400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.994] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0172.994] CloseHandle (hObject=0x1a68) returned 1 [0172.994] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0172.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.play")) returned 1 [0172.997] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2355 os_tid = 0x235c [0173.001] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.002] ReadFile (in: hFile=0x1a70, lpBuffer=0x305bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x305bf85c, lpOverlapped=0x0 | out: lpBuffer=0x305bfb34*, lpNumberOfBytesRead=0x305bf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.007] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.007] ReadFile (in: hFile=0x1a70, lpBuffer=0x305bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x305bf85c, lpOverlapped=0x0 | out: lpBuffer=0x305bfb34*, lpNumberOfBytesRead=0x305bf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.007] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.009] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.009] BCryptSetProperty (in: hObject=0x734830, pszProperty="ChainingMode", pbInput=0x305bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734830) returned 0x0 [0173.009] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734830, phKey=0x305bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734830, phKey=0x305bf828, pbKeyObject=0x0) returned 0x0 [0173.009] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x305bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x305bf500) returned 0x0 [0173.009] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.010] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x305bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x305bf500) returned 0x0 [0173.014] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.017] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.017] WriteFile (in: hFile=0x1a70, lpBuffer=0x305bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x305bf830, lpOverlapped=0x0 | out: lpBuffer=0x305bfb34*, lpNumberOfBytesWritten=0x305bf830*=0x428, lpOverlapped=0x0) returned 1 [0173.019] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.019] ReadFile (in: hFile=0x1a70, lpBuffer=0x9150000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x305bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9150000*, lpNumberOfBytesRead=0x305bf61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.020] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.020] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9150000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x305bf848, cbIV=0x10, pbOutput=0x9150000, cbOutput=0x100000, pcbResult=0x305bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x305bf848, pbOutput=0x9150000, pcbResult=0x305bf618) returned 0x0 [0173.020] WriteFile (in: hFile=0x1a70, lpBuffer=0x9150000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x305bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9150000*, lpNumberOfBytesWritten=0x305bf61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.020] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305bf60c | out: lpNewFilePointer=0x0) returned 1 [0173.020] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.020] WriteFile (in: hFile=0x1a70, lpBuffer=0x305bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x305bf61c, lpOverlapped=0x0 | out: lpBuffer=0x305bf83c*, lpNumberOfBytesWritten=0x305bf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.020] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.020] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.020] CloseHandle (hObject=0x1a70) returned 1 [0173.021] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.play")) returned 1 [0173.024] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2356 os_tid = 0x2360 [0173.027] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.027] ReadFile (in: hFile=0x1a78, lpBuffer=0x306ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x306ff85c, lpOverlapped=0x0 | out: lpBuffer=0x306ffb34*, lpNumberOfBytesRead=0x306ff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.029] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.029] ReadFile (in: hFile=0x1a78, lpBuffer=0x306ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x306ff85c, lpOverlapped=0x0 | out: lpBuffer=0x306ffb34*, lpNumberOfBytesRead=0x306ff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.029] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.033] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.033] BCryptSetProperty (in: hObject=0x735280, pszProperty="ChainingMode", pbInput=0x306ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735280) returned 0x0 [0173.033] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735280, phKey=0x306ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735280, phKey=0x306ff828, pbKeyObject=0x0) returned 0x0 [0173.033] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x306ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x306ff500) returned 0x0 [0173.033] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.033] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x306ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x306ff500) returned 0x0 [0173.038] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.041] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.041] WriteFile (in: hFile=0x1a78, lpBuffer=0x306ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x306ff830, lpOverlapped=0x0 | out: lpBuffer=0x306ffb34*, lpNumberOfBytesWritten=0x306ff830*=0x428, lpOverlapped=0x0) returned 1 [0173.042] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.042] ReadFile (in: hFile=0x1a78, lpBuffer=0x9250000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x306ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9250000*, lpNumberOfBytesRead=0x306ff61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.043] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.043] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9250000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x306ff848, cbIV=0x10, pbOutput=0x9250000, cbOutput=0x100000, pcbResult=0x306ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x306ff848, pbOutput=0x9250000, pcbResult=0x306ff618) returned 0x0 [0173.043] WriteFile (in: hFile=0x1a78, lpBuffer=0x9250000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x306ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9250000*, lpNumberOfBytesWritten=0x306ff61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.044] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306ff60c | out: lpNewFilePointer=0x0) returned 1 [0173.044] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.044] WriteFile (in: hFile=0x1a78, lpBuffer=0x306ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x306ff61c, lpOverlapped=0x0 | out: lpBuffer=0x306ff83c*, lpNumberOfBytesWritten=0x306ff61c*=0x8, lpOverlapped=0x0) returned 1 [0173.044] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.044] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.044] CloseHandle (hObject=0x1a78) returned 1 [0173.044] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.play")) returned 1 [0173.048] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2357 os_tid = 0x2364 [0173.052] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.052] ReadFile (in: hFile=0x1a80, lpBuffer=0x3083fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3083f85c, lpOverlapped=0x0 | out: lpBuffer=0x3083fb34*, lpNumberOfBytesRead=0x3083f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.053] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.054] ReadFile (in: hFile=0x1a80, lpBuffer=0x3083fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3083f85c, lpOverlapped=0x0 | out: lpBuffer=0x3083fb34*, lpNumberOfBytesRead=0x3083f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.054] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.056] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.056] BCryptSetProperty (in: hObject=0x7348e0, pszProperty="ChainingMode", pbInput=0x3083f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7348e0) returned 0x0 [0173.056] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7348e0, phKey=0x3083f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7348e0, phKey=0x3083f828, pbKeyObject=0x0) returned 0x0 [0173.056] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3083f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3083f500) returned 0x0 [0173.056] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.056] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3083f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3083f500) returned 0x0 [0173.061] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.064] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.064] WriteFile (in: hFile=0x1a80, lpBuffer=0x3083fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3083f830, lpOverlapped=0x0 | out: lpBuffer=0x3083fb34*, lpNumberOfBytesWritten=0x3083f830*=0x428, lpOverlapped=0x0) returned 1 [0173.065] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.065] ReadFile (in: hFile=0x1a80, lpBuffer=0x9350000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x3083f61c, lpOverlapped=0x0 | out: lpBuffer=0x9350000*, lpNumberOfBytesRead=0x3083f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.066] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.066] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9350000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x3083f848, cbIV=0x10, pbOutput=0x9350000, cbOutput=0x100000, pcbResult=0x3083f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3083f848, pbOutput=0x9350000, pcbResult=0x3083f618) returned 0x0 [0173.066] WriteFile (in: hFile=0x1a80, lpBuffer=0x9350000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x3083f61c, lpOverlapped=0x0 | out: lpBuffer=0x9350000*, lpNumberOfBytesWritten=0x3083f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0173.067] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3083f60c | out: lpNewFilePointer=0x0) returned 1 [0173.067] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.067] WriteFile (in: hFile=0x1a80, lpBuffer=0x3083f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3083f61c, lpOverlapped=0x0 | out: lpBuffer=0x3083f83c*, lpNumberOfBytesWritten=0x3083f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.067] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.067] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.067] CloseHandle (hObject=0x1a80) returned 1 [0173.067] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.play")) returned 1 [0173.071] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2358 os_tid = 0x2368 [0173.075] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.075] ReadFile (in: hFile=0x1a88, lpBuffer=0x3097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3097f85c, lpOverlapped=0x0 | out: lpBuffer=0x3097fb34*, lpNumberOfBytesRead=0x3097f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.077] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.077] ReadFile (in: hFile=0x1a88, lpBuffer=0x3097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3097f85c, lpOverlapped=0x0 | out: lpBuffer=0x3097fb34*, lpNumberOfBytesRead=0x3097f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.077] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.079] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.079] BCryptSetProperty (in: hObject=0x734990, pszProperty="ChainingMode", pbInput=0x3097f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734990) returned 0x0 [0173.079] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734990, phKey=0x3097f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734990, phKey=0x3097f828, pbKeyObject=0x0) returned 0x0 [0173.079] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3097f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3097f500) returned 0x0 [0173.079] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.080] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3097f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3097f500) returned 0x0 [0173.084] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.087] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.087] WriteFile (in: hFile=0x1a88, lpBuffer=0x3097fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3097f830, lpOverlapped=0x0 | out: lpBuffer=0x3097fb34*, lpNumberOfBytesWritten=0x3097f830*=0x428, lpOverlapped=0x0) returned 1 [0173.088] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.088] ReadFile (in: hFile=0x1a88, lpBuffer=0x9450000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x3097f61c, lpOverlapped=0x0 | out: lpBuffer=0x9450000*, lpNumberOfBytesRead=0x3097f61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.089] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.089] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9450000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x3097f848, cbIV=0x10, pbOutput=0x9450000, cbOutput=0x100000, pcbResult=0x3097f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3097f848, pbOutput=0x9450000, pcbResult=0x3097f618) returned 0x0 [0173.089] WriteFile (in: hFile=0x1a88, lpBuffer=0x9450000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x3097f61c, lpOverlapped=0x0 | out: lpBuffer=0x9450000*, lpNumberOfBytesWritten=0x3097f61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.089] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3097f60c | out: lpNewFilePointer=0x0) returned 1 [0173.089] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.090] WriteFile (in: hFile=0x1a88, lpBuffer=0x3097f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3097f83c*, lpNumberOfBytesWritten=0x3097f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.090] SetFilePointerEx (in: hFile=0x1a88, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.090] CloseHandle (hObject=0x1a88) returned 1 [0173.090] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.092] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.play")) returned 1 [0173.093] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2359 os_tid = 0x236c [0173.098] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.098] ReadFile (in: hFile=0x1a90, lpBuffer=0x30abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30abf85c, lpOverlapped=0x0 | out: lpBuffer=0x30abfb34*, lpNumberOfBytesRead=0x30abf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.100] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.100] ReadFile (in: hFile=0x1a90, lpBuffer=0x30abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30abf85c, lpOverlapped=0x0 | out: lpBuffer=0x30abfb34*, lpNumberOfBytesRead=0x30abf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.100] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.103] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.103] BCryptSetProperty (in: hObject=0x734a40, pszProperty="ChainingMode", pbInput=0x30abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734a40) returned 0x0 [0173.103] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734a40, phKey=0x30abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734a40, phKey=0x30abf828, pbKeyObject=0x0) returned 0x0 [0173.103] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30abf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30abf500) returned 0x0 [0173.103] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.103] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30abf500) returned 0x0 [0173.108] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.110] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.110] WriteFile (in: hFile=0x1a90, lpBuffer=0x30abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30abf830, lpOverlapped=0x0 | out: lpBuffer=0x30abfb34*, lpNumberOfBytesWritten=0x30abf830*=0x428, lpOverlapped=0x0) returned 1 [0173.111] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.111] ReadFile (in: hFile=0x1a90, lpBuffer=0x9550000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x30abf61c, lpOverlapped=0x0 | out: lpBuffer=0x9550000*, lpNumberOfBytesRead=0x30abf61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.112] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.112] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9550000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x30abf848, cbIV=0x10, pbOutput=0x9550000, cbOutput=0x100000, pcbResult=0x30abf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x30abf848, pbOutput=0x9550000, pcbResult=0x30abf618) returned 0x0 [0173.112] WriteFile (in: hFile=0x1a90, lpBuffer=0x9550000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x30abf61c, lpOverlapped=0x0 | out: lpBuffer=0x9550000*, lpNumberOfBytesWritten=0x30abf61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.113] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30abf60c | out: lpNewFilePointer=0x0) returned 1 [0173.113] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.113] WriteFile (in: hFile=0x1a90, lpBuffer=0x30abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30abf61c, lpOverlapped=0x0 | out: lpBuffer=0x30abf83c*, lpNumberOfBytesWritten=0x30abf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.113] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.113] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.113] CloseHandle (hObject=0x1a90) returned 1 [0173.113] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.play")) returned 1 [0173.116] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2360 os_tid = 0x2370 [0173.119] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.120] ReadFile (in: hFile=0x1a98, lpBuffer=0x30bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bff85c, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesRead=0x30bff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.122] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.122] ReadFile (in: hFile=0x1a98, lpBuffer=0x30bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bff85c, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesRead=0x30bff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.122] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.124] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.124] BCryptSetProperty (in: hObject=0x734d00, pszProperty="ChainingMode", pbInput=0x30bff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734d00) returned 0x0 [0173.124] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734d00, phKey=0x30bff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734d00, phKey=0x30bff828, pbKeyObject=0x0) returned 0x0 [0173.124] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30bff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30bff500) returned 0x0 [0173.124] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.124] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30bff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30bff500) returned 0x0 [0173.130] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.133] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.133] WriteFile (in: hFile=0x1a98, lpBuffer=0x30bffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bff830, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesWritten=0x30bff830*=0x428, lpOverlapped=0x0) returned 1 [0173.134] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.134] ReadFile (in: hFile=0x1a98, lpBuffer=0x9650000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x9650000*, lpNumberOfBytesRead=0x30bff61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.136] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.136] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9650000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x30bff848, cbIV=0x10, pbOutput=0x9650000, cbOutput=0x100000, pcbResult=0x30bff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x30bff848, pbOutput=0x9650000, pcbResult=0x30bff618) returned 0x0 [0173.137] WriteFile (in: hFile=0x1a98, lpBuffer=0x9650000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x9650000*, lpNumberOfBytesWritten=0x30bff61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.137] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bff60c | out: lpNewFilePointer=0x0) returned 1 [0173.137] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.137] WriteFile (in: hFile=0x1a98, lpBuffer=0x30bff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x30bff83c*, lpNumberOfBytesWritten=0x30bff61c*=0x8, lpOverlapped=0x0) returned 1 [0173.137] SetFilePointerEx (in: hFile=0x1a98, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.137] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.137] CloseHandle (hObject=0x1a98) returned 1 [0173.137] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.play")) returned 1 [0173.141] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2361 os_tid = 0x2374 [0173.121] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.144] ReadFile (in: hFile=0x1aa0, lpBuffer=0x30d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x30d3fb34*, lpNumberOfBytesRead=0x30d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.146] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.146] ReadFile (in: hFile=0x1aa0, lpBuffer=0x30d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x30d3fb34*, lpNumberOfBytesRead=0x30d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.146] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.148] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.149] BCryptSetProperty (in: hObject=0x7351d0, pszProperty="ChainingMode", pbInput=0x30d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7351d0) returned 0x0 [0173.149] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7351d0, phKey=0x30d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7351d0, phKey=0x30d3f828, pbKeyObject=0x0) returned 0x0 [0173.149] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30d3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30d3f500) returned 0x0 [0173.149] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.149] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30d3f500) returned 0x0 [0173.154] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.158] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.158] WriteFile (in: hFile=0x1aa0, lpBuffer=0x30d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30d3f830, lpOverlapped=0x0 | out: lpBuffer=0x30d3fb34*, lpNumberOfBytesWritten=0x30d3f830*=0x428, lpOverlapped=0x0) returned 1 [0173.159] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.159] ReadFile (in: hFile=0x1aa0, lpBuffer=0x9750000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x30d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9750000*, lpNumberOfBytesRead=0x30d3f61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.160] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.160] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9750000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x30d3f848, cbIV=0x10, pbOutput=0x9750000, cbOutput=0x100000, pcbResult=0x30d3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x30d3f848, pbOutput=0x9750000, pcbResult=0x30d3f618) returned 0x0 [0173.160] WriteFile (in: hFile=0x1aa0, lpBuffer=0x9750000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x30d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9750000*, lpNumberOfBytesWritten=0x30d3f61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.161] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30d3f60c | out: lpNewFilePointer=0x0) returned 1 [0173.161] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.161] WriteFile (in: hFile=0x1aa0, lpBuffer=0x30d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x30d3f83c*, lpNumberOfBytesWritten=0x30d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.161] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.161] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.161] CloseHandle (hObject=0x1aa0) returned 1 [0173.161] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.163] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.play")) returned 1 [0173.164] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2362 os_tid = 0x2378 [0173.168] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.168] ReadFile (in: hFile=0x1aa8, lpBuffer=0x30e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesRead=0x30e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.170] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.170] ReadFile (in: hFile=0x1aa8, lpBuffer=0x30e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesRead=0x30e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.170] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.172] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.172] BCryptSetProperty (in: hObject=0x735070, pszProperty="ChainingMode", pbInput=0x30e7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735070) returned 0x0 [0173.173] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735070, phKey=0x30e7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735070, phKey=0x30e7f828, pbKeyObject=0x0) returned 0x0 [0173.173] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30e7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30e7f500) returned 0x0 [0173.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.173] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30e7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30e7f500) returned 0x0 [0173.178] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.181] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.181] WriteFile (in: hFile=0x1aa8, lpBuffer=0x30e7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30e7f830, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesWritten=0x30e7f830*=0x428, lpOverlapped=0x0) returned 1 [0173.182] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.182] ReadFile (in: hFile=0x1aa8, lpBuffer=0x9850000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x9850000*, lpNumberOfBytesRead=0x30e7f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.185] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.185] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9850000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x30e7f848, cbIV=0x10, pbOutput=0x9850000, cbOutput=0x100000, pcbResult=0x30e7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x30e7f848, pbOutput=0x9850000, pcbResult=0x30e7f618) returned 0x0 [0173.185] WriteFile (in: hFile=0x1aa8, lpBuffer=0x9850000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x9850000*, lpNumberOfBytesWritten=0x30e7f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0173.185] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30e7f60c | out: lpNewFilePointer=0x0) returned 1 [0173.185] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.185] WriteFile (in: hFile=0x1aa8, lpBuffer=0x30e7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x30e7f83c*, lpNumberOfBytesWritten=0x30e7f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.185] SetFilePointerEx (in: hFile=0x1aa8, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.185] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.185] CloseHandle (hObject=0x1aa8) returned 1 [0173.186] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.play")) returned 1 [0173.189] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2363 os_tid = 0x237c [0173.193] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.193] ReadFile (in: hFile=0x1ab0, lpBuffer=0x30fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30fbfb34*, lpNumberOfBytesRead=0x30fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.195] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.195] ReadFile (in: hFile=0x1ab0, lpBuffer=0x30fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30fbfb34*, lpNumberOfBytesRead=0x30fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.195] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.197] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.198] BCryptSetProperty (in: hObject=0x735490, pszProperty="ChainingMode", pbInput=0x30fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735490) returned 0x0 [0173.198] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735490, phKey=0x30fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735490, phKey=0x30fbf828, pbKeyObject=0x0) returned 0x0 [0173.198] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30fbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30fbf500) returned 0x0 [0173.198] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.198] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30fbf500) returned 0x0 [0173.203] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.206] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.206] WriteFile (in: hFile=0x1ab0, lpBuffer=0x30fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30fbf830, lpOverlapped=0x0 | out: lpBuffer=0x30fbfb34*, lpNumberOfBytesWritten=0x30fbf830*=0x428, lpOverlapped=0x0) returned 1 [0173.207] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.208] ReadFile (in: hFile=0x1ab0, lpBuffer=0x9950000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x30fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x9950000*, lpNumberOfBytesRead=0x30fbf61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.209] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.209] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9950000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x30fbf848, cbIV=0x10, pbOutput=0x9950000, cbOutput=0x100000, pcbResult=0x30fbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x30fbf848, pbOutput=0x9950000, pcbResult=0x30fbf618) returned 0x0 [0173.209] WriteFile (in: hFile=0x1ab0, lpBuffer=0x9950000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x30fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x9950000*, lpNumberOfBytesWritten=0x30fbf61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.209] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30fbf60c | out: lpNewFilePointer=0x0) returned 1 [0173.209] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.209] WriteFile (in: hFile=0x1ab0, lpBuffer=0x30fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30fbf83c*, lpNumberOfBytesWritten=0x30fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.209] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.209] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.210] CloseHandle (hObject=0x1ab0) returned 1 [0173.210] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.play")) returned 1 [0173.213] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2364 os_tid = 0x2380 [0173.217] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.217] ReadFile (in: hFile=0x1ab8, lpBuffer=0x310ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x310ff85c, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesRead=0x310ff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.219] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.219] ReadFile (in: hFile=0x1ab8, lpBuffer=0x310ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x310ff85c, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesRead=0x310ff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.219] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.222] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.222] BCryptSetProperty (in: hObject=0x7355f0, pszProperty="ChainingMode", pbInput=0x310ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7355f0) returned 0x0 [0173.222] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7355f0, phKey=0x310ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7355f0, phKey=0x310ff828, pbKeyObject=0x0) returned 0x0 [0173.222] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x310ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x310ff500) returned 0x0 [0173.222] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.222] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x310ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x310ff500) returned 0x0 [0173.227] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.230] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.230] WriteFile (in: hFile=0x1ab8, lpBuffer=0x310ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x310ff830, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesWritten=0x310ff830*=0x428, lpOverlapped=0x0) returned 1 [0173.232] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.232] ReadFile (in: hFile=0x1ab8, lpBuffer=0x9a50000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9a50000*, lpNumberOfBytesRead=0x310ff61c*=0x7db8, lpOverlapped=0x0) returned 1 [0173.233] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.233] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9a50000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x310ff848, cbIV=0x10, pbOutput=0x9a50000, cbOutput=0x100000, pcbResult=0x310ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x310ff848, pbOutput=0x9a50000, pcbResult=0x310ff618) returned 0x0 [0173.233] WriteFile (in: hFile=0x1ab8, lpBuffer=0x9a50000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9a50000*, lpNumberOfBytesWritten=0x310ff61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.233] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310ff60c | out: lpNewFilePointer=0x0) returned 1 [0173.233] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.233] WriteFile (in: hFile=0x1ab8, lpBuffer=0x310ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x310ff83c*, lpNumberOfBytesWritten=0x310ff61c*=0x8, lpOverlapped=0x0) returned 1 [0173.233] SetFilePointerEx (in: hFile=0x1ab8, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.233] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.233] CloseHandle (hObject=0x1ab8) returned 1 [0173.234] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.play")) returned 1 [0173.237] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2365 os_tid = 0x2384 [0173.243] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.243] ReadFile (in: hFile=0x1ac0, lpBuffer=0x3123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3123f85c, lpOverlapped=0x0 | out: lpBuffer=0x3123fb34*, lpNumberOfBytesRead=0x3123f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.244] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.244] ReadFile (in: hFile=0x1ac0, lpBuffer=0x3123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3123f85c, lpOverlapped=0x0 | out: lpBuffer=0x3123fb34*, lpNumberOfBytesRead=0x3123f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.245] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.247] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.247] BCryptSetProperty (in: hObject=0x734e60, pszProperty="ChainingMode", pbInput=0x3123f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734e60) returned 0x0 [0173.247] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734e60, phKey=0x3123f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734e60, phKey=0x3123f828, pbKeyObject=0x0) returned 0x0 [0173.247] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3123f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3123f500) returned 0x0 [0173.247] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.247] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3123f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3123f500) returned 0x0 [0173.253] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.256] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.256] WriteFile (in: hFile=0x1ac0, lpBuffer=0x3123fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3123f830, lpOverlapped=0x0 | out: lpBuffer=0x3123fb34*, lpNumberOfBytesWritten=0x3123f830*=0x428, lpOverlapped=0x0) returned 1 [0173.257] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.257] ReadFile (in: hFile=0x1ac0, lpBuffer=0x9b50000, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x3123f61c, lpOverlapped=0x0 | out: lpBuffer=0x9b50000*, lpNumberOfBytesRead=0x3123f61c*=0x7f68, lpOverlapped=0x0) returned 1 [0173.258] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xffff8098, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.259] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9b50000, cbInput=0x7f68, pPaddingInfo=0x0, pbIV=0x3123f848, cbIV=0x10, pbOutput=0x9b50000, cbOutput=0x100000, pcbResult=0x3123f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3123f848, pbOutput=0x9b50000, pcbResult=0x3123f618) returned 0x0 [0173.259] WriteFile (in: hFile=0x1ac0, lpBuffer=0x9b50000*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x3123f61c, lpOverlapped=0x0 | out: lpBuffer=0x9b50000*, lpNumberOfBytesWritten=0x3123f61c*=0x7f70, lpOverlapped=0x0) returned 1 [0173.259] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3123f60c | out: lpNewFilePointer=0x0) returned 1 [0173.259] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.259] WriteFile (in: hFile=0x1ac0, lpBuffer=0x3123f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3123f83c*, lpNumberOfBytesWritten=0x3123f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.259] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x7f70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.259] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.259] CloseHandle (hObject=0x1ac0) returned 1 [0173.259] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.262] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.play")) returned 1 [0173.263] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2366 os_tid = 0x2388 [0173.267] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.267] ReadFile (in: hFile=0x1ac8, lpBuffer=0x3137fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3137f85c, lpOverlapped=0x0 | out: lpBuffer=0x3137fb34*, lpNumberOfBytesRead=0x3137f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.269] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.269] ReadFile (in: hFile=0x1ac8, lpBuffer=0x3137fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3137f85c, lpOverlapped=0x0 | out: lpBuffer=0x3137fb34*, lpNumberOfBytesRead=0x3137f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.269] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.271] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.271] BCryptSetProperty (in: hObject=0x734f10, pszProperty="ChainingMode", pbInput=0x3137f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734f10) returned 0x0 [0173.271] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734f10, phKey=0x3137f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734f10, phKey=0x3137f828, pbKeyObject=0x0) returned 0x0 [0173.271] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3137f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3137f500) returned 0x0 [0173.271] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.271] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3137f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3137f500) returned 0x0 [0173.276] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.279] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.279] WriteFile (in: hFile=0x1ac8, lpBuffer=0x3137fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3137f830, lpOverlapped=0x0 | out: lpBuffer=0x3137fb34*, lpNumberOfBytesWritten=0x3137f830*=0x428, lpOverlapped=0x0) returned 1 [0173.280] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.280] ReadFile (in: hFile=0x1ac8, lpBuffer=0x9c50000, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x3137f61c, lpOverlapped=0x0 | out: lpBuffer=0x9c50000*, lpNumberOfBytesRead=0x3137f61c*=0x3ee8, lpOverlapped=0x0) returned 1 [0173.282] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0xffffc118, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.283] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9c50000, cbInput=0x3ee8, pPaddingInfo=0x0, pbIV=0x3137f848, cbIV=0x10, pbOutput=0x9c50000, cbOutput=0x100000, pcbResult=0x3137f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3137f848, pbOutput=0x9c50000, pcbResult=0x3137f618) returned 0x0 [0173.283] WriteFile (in: hFile=0x1ac8, lpBuffer=0x9c50000*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x3137f61c, lpOverlapped=0x0 | out: lpBuffer=0x9c50000*, lpNumberOfBytesWritten=0x3137f61c*=0x3ef0, lpOverlapped=0x0) returned 1 [0173.283] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3137f60c | out: lpNewFilePointer=0x0) returned 1 [0173.283] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.283] WriteFile (in: hFile=0x1ac8, lpBuffer=0x3137f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3137f61c, lpOverlapped=0x0 | out: lpBuffer=0x3137f83c*, lpNumberOfBytesWritten=0x3137f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.283] SetFilePointerEx (in: hFile=0x1ac8, liDistanceToMove=0x3ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.283] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.283] CloseHandle (hObject=0x1ac8) returned 1 [0173.283] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.play")) returned 1 [0173.290] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2367 os_tid = 0x238c [0173.297] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.297] ReadFile (in: hFile=0x1ad0, lpBuffer=0x314bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314bf85c, lpOverlapped=0x0 | out: lpBuffer=0x314bfb34*, lpNumberOfBytesRead=0x314bf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.299] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.300] ReadFile (in: hFile=0x1ad0, lpBuffer=0x314bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314bf85c, lpOverlapped=0x0 | out: lpBuffer=0x314bfb34*, lpNumberOfBytesRead=0x314bf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.303] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.303] BCryptSetProperty (in: hObject=0x738c50, pszProperty="ChainingMode", pbInput=0x314bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738c50) returned 0x0 [0173.303] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738c50, phKey=0x314bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738c50, phKey=0x314bf828, pbKeyObject=0x0) returned 0x0 [0173.303] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x314bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x314bf500) returned 0x0 [0173.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.304] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x314bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x314bf500) returned 0x0 [0173.311] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.315] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.315] WriteFile (in: hFile=0x1ad0, lpBuffer=0x314bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x314bf830, lpOverlapped=0x0 | out: lpBuffer=0x314bfb34*, lpNumberOfBytesWritten=0x314bf830*=0x428, lpOverlapped=0x0) returned 1 [0173.316] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.316] ReadFile (in: hFile=0x1ad0, lpBuffer=0x9d50000, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x314bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9d50000*, lpNumberOfBytesRead=0x314bf61c*=0x3e74, lpOverlapped=0x0) returned 1 [0173.318] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xffffc18c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.318] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9d50000, cbInput=0x3e74, pPaddingInfo=0x0, pbIV=0x314bf848, cbIV=0x10, pbOutput=0x9d50000, cbOutput=0x100000, pcbResult=0x314bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x314bf848, pbOutput=0x9d50000, pcbResult=0x314bf618) returned 0x0 [0173.318] WriteFile (in: hFile=0x1ad0, lpBuffer=0x9d50000*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x314bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9d50000*, lpNumberOfBytesWritten=0x314bf61c*=0x3e80, lpOverlapped=0x0) returned 1 [0173.320] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314bf60c | out: lpNewFilePointer=0x0) returned 1 [0173.320] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.320] WriteFile (in: hFile=0x1ad0, lpBuffer=0x314bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x314bf61c, lpOverlapped=0x0 | out: lpBuffer=0x314bf83c*, lpNumberOfBytesWritten=0x314bf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.320] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x3e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.320] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.320] CloseHandle (hObject=0x1ad0) returned 1 [0173.321] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.play")) returned 1 [0173.324] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2368 os_tid = 0x2390 [0173.329] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.329] ReadFile (in: hFile=0x1ad8, lpBuffer=0x315ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x315ff85c, lpOverlapped=0x0 | out: lpBuffer=0x315ffb34*, lpNumberOfBytesRead=0x315ff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.331] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.331] ReadFile (in: hFile=0x1ad8, lpBuffer=0x315ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x315ff85c, lpOverlapped=0x0 | out: lpBuffer=0x315ffb34*, lpNumberOfBytesRead=0x315ff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.331] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.333] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.333] BCryptSetProperty (in: hObject=0x738e60, pszProperty="ChainingMode", pbInput=0x315ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738e60) returned 0x0 [0173.333] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738e60, phKey=0x315ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738e60, phKey=0x315ff828, pbKeyObject=0x0) returned 0x0 [0173.333] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x315ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x315ff500) returned 0x0 [0173.334] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.334] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x315ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x315ff500) returned 0x0 [0173.339] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.341] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.341] WriteFile (in: hFile=0x1ad8, lpBuffer=0x315ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x315ff830, lpOverlapped=0x0 | out: lpBuffer=0x315ffb34*, lpNumberOfBytesWritten=0x315ff830*=0x428, lpOverlapped=0x0) returned 1 [0173.342] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.342] ReadFile (in: hFile=0x1ad8, lpBuffer=0x9e50000, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x315ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9e50000*, lpNumberOfBytesRead=0x315ff61c*=0x6978, lpOverlapped=0x0) returned 1 [0173.345] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0xffff9688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.345] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9e50000, cbInput=0x6978, pPaddingInfo=0x0, pbIV=0x315ff848, cbIV=0x10, pbOutput=0x9e50000, cbOutput=0x100000, pcbResult=0x315ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x315ff848, pbOutput=0x9e50000, pcbResult=0x315ff618) returned 0x0 [0173.345] WriteFile (in: hFile=0x1ad8, lpBuffer=0x9e50000*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x315ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9e50000*, lpNumberOfBytesWritten=0x315ff61c*=0x6980, lpOverlapped=0x0) returned 1 [0173.345] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315ff60c | out: lpNewFilePointer=0x0) returned 1 [0173.345] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.345] WriteFile (in: hFile=0x1ad8, lpBuffer=0x315ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x315ff61c, lpOverlapped=0x0 | out: lpBuffer=0x315ff83c*, lpNumberOfBytesWritten=0x315ff61c*=0x8, lpOverlapped=0x0) returned 1 [0173.345] SetFilePointerEx (in: hFile=0x1ad8, liDistanceToMove=0x6980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.345] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.345] CloseHandle (hObject=0x1ad8) returned 1 [0173.346] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.play")) returned 1 [0173.349] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2369 os_tid = 0x2394 [0173.352] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.353] ReadFile (in: hFile=0x1ae0, lpBuffer=0x3173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3173f85c, lpOverlapped=0x0 | out: lpBuffer=0x3173fb34*, lpNumberOfBytesRead=0x3173f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.354] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.354] ReadFile (in: hFile=0x1ae0, lpBuffer=0x3173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3173f85c, lpOverlapped=0x0 | out: lpBuffer=0x3173fb34*, lpNumberOfBytesRead=0x3173f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.354] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.356] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.357] BCryptSetProperty (in: hObject=0x738af0, pszProperty="ChainingMode", pbInput=0x3173f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738af0) returned 0x0 [0173.357] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738af0, phKey=0x3173f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738af0, phKey=0x3173f828, pbKeyObject=0x0) returned 0x0 [0173.357] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3173f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3173f500) returned 0x0 [0173.357] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.357] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3173f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3173f500) returned 0x0 [0173.362] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.365] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.365] WriteFile (in: hFile=0x1ae0, lpBuffer=0x3173fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3173f830, lpOverlapped=0x0 | out: lpBuffer=0x3173fb34*, lpNumberOfBytesWritten=0x3173f830*=0x428, lpOverlapped=0x0) returned 1 [0173.367] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.367] ReadFile (in: hFile=0x1ae0, lpBuffer=0x9f50000, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x3173f61c, lpOverlapped=0x0 | out: lpBuffer=0x9f50000*, lpNumberOfBytesRead=0x3173f61c*=0x2bd0, lpOverlapped=0x0) returned 1 [0173.367] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xffffd430, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.367] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x9f50000, cbInput=0x2bd0, pPaddingInfo=0x0, pbIV=0x3173f848, cbIV=0x10, pbOutput=0x9f50000, cbOutput=0x100000, pcbResult=0x3173f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3173f848, pbOutput=0x9f50000, pcbResult=0x3173f618) returned 0x0 [0173.368] WriteFile (in: hFile=0x1ae0, lpBuffer=0x9f50000*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x3173f61c, lpOverlapped=0x0 | out: lpBuffer=0x9f50000*, lpNumberOfBytesWritten=0x3173f61c*=0x2be0, lpOverlapped=0x0) returned 1 [0173.368] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3173f60c | out: lpNewFilePointer=0x0) returned 1 [0173.368] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.368] WriteFile (in: hFile=0x1ae0, lpBuffer=0x3173f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3173f61c, lpOverlapped=0x0 | out: lpBuffer=0x3173f83c*, lpNumberOfBytesWritten=0x3173f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.368] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x2be0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.368] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.368] CloseHandle (hObject=0x1ae0) returned 1 [0173.368] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.play")) returned 1 [0173.371] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2370 os_tid = 0x2398 [0173.376] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.376] ReadFile (in: hFile=0x1ae8, lpBuffer=0x3187fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3187f85c, lpOverlapped=0x0 | out: lpBuffer=0x3187fb34*, lpNumberOfBytesRead=0x3187f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.377] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.377] ReadFile (in: hFile=0x1ae8, lpBuffer=0x3187fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3187f85c, lpOverlapped=0x0 | out: lpBuffer=0x3187fb34*, lpNumberOfBytesRead=0x3187f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.378] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.379] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.380] BCryptSetProperty (in: hObject=0x738d00, pszProperty="ChainingMode", pbInput=0x3187f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738d00) returned 0x0 [0173.380] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738d00, phKey=0x3187f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738d00, phKey=0x3187f828, pbKeyObject=0x0) returned 0x0 [0173.380] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3187f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3187f500) returned 0x0 [0173.380] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.380] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3187f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3187f500) returned 0x0 [0173.385] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.388] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.388] WriteFile (in: hFile=0x1ae8, lpBuffer=0x3187fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3187f830, lpOverlapped=0x0 | out: lpBuffer=0x3187fb34*, lpNumberOfBytesWritten=0x3187f830*=0x428, lpOverlapped=0x0) returned 1 [0173.389] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.389] ReadFile (in: hFile=0x1ae8, lpBuffer=0xa050000, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x3187f61c, lpOverlapped=0x0 | out: lpBuffer=0xa050000*, lpNumberOfBytesRead=0x3187f61c*=0x4290, lpOverlapped=0x0) returned 1 [0173.390] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0xffffbd70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.390] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0xa050000, cbInput=0x4290, pPaddingInfo=0x0, pbIV=0x3187f848, cbIV=0x10, pbOutput=0xa050000, cbOutput=0x100000, pcbResult=0x3187f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x3187f848, pbOutput=0xa050000, pcbResult=0x3187f618) returned 0x0 [0173.390] WriteFile (in: hFile=0x1ae8, lpBuffer=0xa050000*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x3187f61c, lpOverlapped=0x0 | out: lpBuffer=0xa050000*, lpNumberOfBytesWritten=0x3187f61c*=0x42a0, lpOverlapped=0x0) returned 1 [0173.390] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3187f60c | out: lpNewFilePointer=0x0) returned 1 [0173.390] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.391] WriteFile (in: hFile=0x1ae8, lpBuffer=0x3187f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3187f61c, lpOverlapped=0x0 | out: lpBuffer=0x3187f83c*, lpNumberOfBytesWritten=0x3187f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.391] SetFilePointerEx (in: hFile=0x1ae8, liDistanceToMove=0x42a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.391] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.391] CloseHandle (hObject=0x1ae8) returned 1 [0173.392] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.play")) returned 1 [0173.395] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2371 os_tid = 0x239c [0173.399] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.399] ReadFile (in: hFile=0x1af0, lpBuffer=0x319bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x319bf85c, lpOverlapped=0x0 | out: lpBuffer=0x319bfb34*, lpNumberOfBytesRead=0x319bf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.401] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.401] ReadFile (in: hFile=0x1af0, lpBuffer=0x319bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x319bf85c, lpOverlapped=0x0 | out: lpBuffer=0x319bfb34*, lpNumberOfBytesRead=0x319bf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.401] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.404] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.404] BCryptSetProperty (in: hObject=0x738db0, pszProperty="ChainingMode", pbInput=0x319bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738db0) returned 0x0 [0173.404] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738db0, phKey=0x319bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738db0, phKey=0x319bf828, pbKeyObject=0x0) returned 0x0 [0173.404] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x319bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x319bf500) returned 0x0 [0173.404] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.404] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x319bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x319bf500) returned 0x0 [0173.409] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.412] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.412] WriteFile (in: hFile=0x1af0, lpBuffer=0x319bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x319bf830, lpOverlapped=0x0 | out: lpBuffer=0x319bfb34*, lpNumberOfBytesWritten=0x319bf830*=0x428, lpOverlapped=0x0) returned 1 [0173.413] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.413] ReadFile (in: hFile=0x1af0, lpBuffer=0xa150000, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x319bf61c, lpOverlapped=0x0 | out: lpBuffer=0xa150000*, lpNumberOfBytesRead=0x319bf61c*=0x43c0, lpOverlapped=0x0) returned 1 [0173.414] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xffffbc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.414] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0xa150000, cbInput=0x43c0, pPaddingInfo=0x0, pbIV=0x319bf848, cbIV=0x10, pbOutput=0xa150000, cbOutput=0x100000, pcbResult=0x319bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x319bf848, pbOutput=0xa150000, pcbResult=0x319bf618) returned 0x0 [0173.414] WriteFile (in: hFile=0x1af0, lpBuffer=0xa150000*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x319bf61c, lpOverlapped=0x0 | out: lpBuffer=0xa150000*, lpNumberOfBytesWritten=0x319bf61c*=0x43d0, lpOverlapped=0x0) returned 1 [0173.414] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319bf60c | out: lpNewFilePointer=0x0) returned 1 [0173.414] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.414] WriteFile (in: hFile=0x1af0, lpBuffer=0x319bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x319bf61c, lpOverlapped=0x0 | out: lpBuffer=0x319bf83c*, lpNumberOfBytesWritten=0x319bf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.414] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x43d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.414] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.414] CloseHandle (hObject=0x1af0) returned 1 [0173.415] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.play")) returned 1 [0173.417] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2372 os_tid = 0x23a0 [0173.421] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.421] ReadFile (in: hFile=0x1af8, lpBuffer=0x31affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31aff85c, lpOverlapped=0x0 | out: lpBuffer=0x31affb34*, lpNumberOfBytesRead=0x31aff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.423] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.423] ReadFile (in: hFile=0x1af8, lpBuffer=0x31affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31aff85c, lpOverlapped=0x0 | out: lpBuffer=0x31affb34*, lpNumberOfBytesRead=0x31aff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.423] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.425] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.425] BCryptSetProperty (in: hObject=0x738f10, pszProperty="ChainingMode", pbInput=0x31aff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738f10) returned 0x0 [0173.425] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738f10, phKey=0x31aff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738f10, phKey=0x31aff828, pbKeyObject=0x0) returned 0x0 [0173.425] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x31aff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x31aff500) returned 0x0 [0173.426] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.426] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x31aff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x31aff500) returned 0x0 [0173.431] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.433] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.433] WriteFile (in: hFile=0x1af8, lpBuffer=0x31affb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31aff830, lpOverlapped=0x0 | out: lpBuffer=0x31affb34*, lpNumberOfBytesWritten=0x31aff830*=0x428, lpOverlapped=0x0) returned 1 [0173.434] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.434] ReadFile (in: hFile=0x1af8, lpBuffer=0xa250000, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x31aff61c, lpOverlapped=0x0 | out: lpBuffer=0xa250000*, lpNumberOfBytesRead=0x31aff61c*=0x3264, lpOverlapped=0x0) returned 1 [0173.435] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0xffffcd9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.436] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0xa250000, cbInput=0x3264, pPaddingInfo=0x0, pbIV=0x31aff848, cbIV=0x10, pbOutput=0xa250000, cbOutput=0x100000, pcbResult=0x31aff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x31aff848, pbOutput=0xa250000, pcbResult=0x31aff618) returned 0x0 [0173.436] WriteFile (in: hFile=0x1af8, lpBuffer=0xa250000*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x31aff61c, lpOverlapped=0x0 | out: lpBuffer=0xa250000*, lpNumberOfBytesWritten=0x31aff61c*=0x3270, lpOverlapped=0x0) returned 1 [0173.436] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31aff60c | out: lpNewFilePointer=0x0) returned 1 [0173.436] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.436] WriteFile (in: hFile=0x1af8, lpBuffer=0x31aff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31aff61c, lpOverlapped=0x0 | out: lpBuffer=0x31aff83c*, lpNumberOfBytesWritten=0x31aff61c*=0x8, lpOverlapped=0x0) returned 1 [0173.436] SetFilePointerEx (in: hFile=0x1af8, liDistanceToMove=0x3270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.436] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.436] CloseHandle (hObject=0x1af8) returned 1 [0173.436] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.play")) returned 1 [0173.440] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2373 os_tid = 0x23a4 [0173.445] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.445] ReadFile (in: hFile=0x1688, lpBuffer=0xf6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesRead=0xf6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.447] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.447] ReadFile (in: hFile=0x1688, lpBuffer=0xf6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesRead=0xf6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.447] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.449] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.449] BCryptSetProperty (in: hObject=0x738fc0, pszProperty="ChainingMode", pbInput=0xf6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738fc0) returned 0x0 [0173.449] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738fc0, phKey=0xf6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738fc0, phKey=0xf6cf828, pbKeyObject=0x0) returned 0x0 [0173.449] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf6cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf6cf500) returned 0x0 [0173.450] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.450] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf6cf500) returned 0x0 [0173.458] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.461] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.461] WriteFile (in: hFile=0x1688, lpBuffer=0xf6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf6cf830, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesWritten=0xf6cf830*=0x428, lpOverlapped=0x0) returned 1 [0173.463] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.463] ReadFile (in: hFile=0x1688, lpBuffer=0xa350000, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xa350000*, lpNumberOfBytesRead=0xf6cf61c*=0xaf94, lpOverlapped=0x0) returned 1 [0173.466] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xffff506c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.466] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0xa350000, cbInput=0xaf94, pPaddingInfo=0x0, pbIV=0xf6cf848, cbIV=0x10, pbOutput=0xa350000, cbOutput=0x100000, pcbResult=0xf6cf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xf6cf848, pbOutput=0xa350000, pcbResult=0xf6cf618) returned 0x0 [0173.467] WriteFile (in: hFile=0x1688, lpBuffer=0xa350000*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xa350000*, lpNumberOfBytesWritten=0xf6cf61c*=0xafa0, lpOverlapped=0x0) returned 1 [0173.484] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf6cf60c | out: lpNewFilePointer=0x0) returned 1 [0173.484] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.484] WriteFile (in: hFile=0x1688, lpBuffer=0xf6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf6cf83c*, lpNumberOfBytesWritten=0xf6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.484] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xafa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.485] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.485] CloseHandle (hObject=0x1688) returned 1 [0173.488] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.play")) returned 1 [0173.492] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2374 os_tid = 0x23a8 [0173.464] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.465] ReadFile (in: hFile=0x1b04, lpBuffer=0x31c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31c3fb34*, lpNumberOfBytesRead=0x31c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.497] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.497] ReadFile (in: hFile=0x1b04, lpBuffer=0x31c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31c3fb34*, lpNumberOfBytesRead=0x31c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.498] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.500] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.500] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x31c3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0173.500] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x31c3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x31c3f828, pbKeyObject=0x0) returned 0x0 [0173.500] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x31c3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x31c3f500) returned 0x0 [0173.500] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.500] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x31c3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x31c3f500) returned 0x0 [0173.505] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.508] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.508] WriteFile (in: hFile=0x1b04, lpBuffer=0x31c3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31c3f830, lpOverlapped=0x0 | out: lpBuffer=0x31c3fb34*, lpNumberOfBytesWritten=0x31c3f830*=0x428, lpOverlapped=0x0) returned 1 [0173.509] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.509] ReadFile (in: hFile=0x1b04, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x31c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x31c3f61c*=0x1714, lpOverlapped=0x0) returned 1 [0173.509] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0xffffe8ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.509] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2c50000, cbInput=0x1714, pPaddingInfo=0x0, pbIV=0x31c3f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x31c3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x31c3f848, pbOutput=0x2c50000, pcbResult=0x31c3f618) returned 0x0 [0173.509] WriteFile (in: hFile=0x1b04, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x31c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x31c3f61c*=0x1720, lpOverlapped=0x0) returned 1 [0173.510] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31c3f60c | out: lpNewFilePointer=0x0) returned 1 [0173.510] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.510] WriteFile (in: hFile=0x1b04, lpBuffer=0x31c3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x31c3f83c*, lpNumberOfBytesWritten=0x31c3f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.510] SetFilePointerEx (in: hFile=0x1b04, liDistanceToMove=0x1720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.510] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.510] CloseHandle (hObject=0x1b04) returned 1 [0173.510] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.512] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.play")) returned 1 [0173.513] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2375 os_tid = 0x23ac [0173.517] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.517] ReadFile (in: hFile=0x1b0c, lpBuffer=0x31d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31d7fb34*, lpNumberOfBytesRead=0x31d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.519] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.519] ReadFile (in: hFile=0x1b0c, lpBuffer=0x31d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31d7fb34*, lpNumberOfBytesRead=0x31d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.519] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.521] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.521] BCryptSetProperty (in: hObject=0x7386d0, pszProperty="ChainingMode", pbInput=0x31d7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7386d0) returned 0x0 [0173.521] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7386d0, phKey=0x31d7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7386d0, phKey=0x31d7f828, pbKeyObject=0x0) returned 0x0 [0173.521] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x31d7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x31d7f500) returned 0x0 [0173.522] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.522] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x31d7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x31d7f500) returned 0x0 [0173.527] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.530] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.530] WriteFile (in: hFile=0x1b0c, lpBuffer=0x31d7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31d7f830, lpOverlapped=0x0 | out: lpBuffer=0x31d7fb34*, lpNumberOfBytesWritten=0x31d7f830*=0x428, lpOverlapped=0x0) returned 1 [0173.531] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.531] ReadFile (in: hFile=0x1b0c, lpBuffer=0xa450000, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x31d7f61c, lpOverlapped=0x0 | out: lpBuffer=0xa450000*, lpNumberOfBytesRead=0x31d7f61c*=0x5c2c, lpOverlapped=0x0) returned 1 [0173.532] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xffffa3d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.532] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0xa450000, cbInput=0x5c2c, pPaddingInfo=0x0, pbIV=0x31d7f848, cbIV=0x10, pbOutput=0xa450000, cbOutput=0x100000, pcbResult=0x31d7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x31d7f848, pbOutput=0xa450000, pcbResult=0x31d7f618) returned 0x0 [0173.533] WriteFile (in: hFile=0x1b0c, lpBuffer=0xa450000*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x31d7f61c, lpOverlapped=0x0 | out: lpBuffer=0xa450000*, lpNumberOfBytesWritten=0x31d7f61c*=0x5c30, lpOverlapped=0x0) returned 1 [0173.533] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31d7f60c | out: lpNewFilePointer=0x0) returned 1 [0173.533] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.533] WriteFile (in: hFile=0x1b0c, lpBuffer=0x31d7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x31d7f83c*, lpNumberOfBytesWritten=0x31d7f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.533] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x5c30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.533] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.533] CloseHandle (hObject=0x1b0c) returned 1 [0173.533] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.play")) returned 1 [0173.536] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2376 os_tid = 0x23b0 [0173.540] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.540] ReadFile (in: hFile=0x1b14, lpBuffer=0x31ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x31ebfb34*, lpNumberOfBytesRead=0x31ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.542] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.542] ReadFile (in: hFile=0x1b14, lpBuffer=0x31ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x31ebfb34*, lpNumberOfBytesRead=0x31ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.546] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.546] BCryptSetProperty (in: hObject=0x738780, pszProperty="ChainingMode", pbInput=0x31ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738780) returned 0x0 [0173.546] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738780, phKey=0x31ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738780, phKey=0x31ebf828, pbKeyObject=0x0) returned 0x0 [0173.546] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x31ebf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x31ebf500) returned 0x0 [0173.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.547] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x31ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x31ebf500) returned 0x0 [0173.550] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.553] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.553] WriteFile (in: hFile=0x1b14, lpBuffer=0x31ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31ebf830, lpOverlapped=0x0 | out: lpBuffer=0x31ebfb34*, lpNumberOfBytesWritten=0x31ebf830*=0x428, lpOverlapped=0x0) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.554] ReadFile (in: hFile=0x1b14, lpBuffer=0xa550000, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x31ebf61c, lpOverlapped=0x0 | out: lpBuffer=0xa550000*, lpNumberOfBytesRead=0x31ebf61c*=0x1434, lpOverlapped=0x0) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xffffebcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.554] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0xa550000, cbInput=0x1434, pPaddingInfo=0x0, pbIV=0x31ebf848, cbIV=0x10, pbOutput=0xa550000, cbOutput=0x100000, pcbResult=0x31ebf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x31ebf848, pbOutput=0xa550000, pcbResult=0x31ebf618) returned 0x0 [0173.554] WriteFile (in: hFile=0x1b14, lpBuffer=0xa550000*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x31ebf61c, lpOverlapped=0x0 | out: lpBuffer=0xa550000*, lpNumberOfBytesWritten=0x31ebf61c*=0x1440, lpOverlapped=0x0) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ebf60c | out: lpNewFilePointer=0x0) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.554] WriteFile (in: hFile=0x1b14, lpBuffer=0x31ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x31ebf83c*, lpNumberOfBytesWritten=0x31ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x1b14, liDistanceToMove=0x1440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.554] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.555] CloseHandle (hObject=0x1b14) returned 1 [0173.555] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.play")) returned 1 [0173.558] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2377 os_tid = 0x23b4 [0173.562] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.562] ReadFile (in: hFile=0x1b1c, lpBuffer=0x31fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31fff85c, lpOverlapped=0x0 | out: lpBuffer=0x31fffb34*, lpNumberOfBytesRead=0x31fff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.564] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.564] ReadFile (in: hFile=0x1b1c, lpBuffer=0x31fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31fff85c, lpOverlapped=0x0 | out: lpBuffer=0x31fffb34*, lpNumberOfBytesRead=0x31fff85c*=0x428, lpOverlapped=0x0) returned 1 [0173.564] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.567] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.567] BCryptSetProperty (in: hObject=0x738830, pszProperty="ChainingMode", pbInput=0x31fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x738830) returned 0x0 [0173.567] BCryptGenerateSymmetricKey (in: hAlgorithm=0x738830, phKey=0x31fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x738830, phKey=0x31fff828, pbKeyObject=0x0) returned 0x0 [0173.567] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x31fff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x31fff500) returned 0x0 [0173.567] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.567] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x31fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x31fff500) returned 0x0 [0173.572] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.575] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.575] WriteFile (in: hFile=0x1b1c, lpBuffer=0x31fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31fff830, lpOverlapped=0x0 | out: lpBuffer=0x31fffb34*, lpNumberOfBytesWritten=0x31fff830*=0x428, lpOverlapped=0x0) returned 1 [0173.576] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.576] ReadFile (in: hFile=0x1b1c, lpBuffer=0xa650000, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x31fff61c, lpOverlapped=0x0 | out: lpBuffer=0xa650000*, lpNumberOfBytesRead=0x31fff61c*=0x1600, lpOverlapped=0x0) returned 1 [0173.576] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xffffea00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.576] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0xa650000, cbInput=0x1600, pPaddingInfo=0x0, pbIV=0x31fff848, cbIV=0x10, pbOutput=0xa650000, cbOutput=0x100000, pcbResult=0x31fff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x31fff848, pbOutput=0xa650000, pcbResult=0x31fff618) returned 0x0 [0173.576] WriteFile (in: hFile=0x1b1c, lpBuffer=0xa650000*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x31fff61c, lpOverlapped=0x0 | out: lpBuffer=0xa650000*, lpNumberOfBytesWritten=0x31fff61c*=0x1610, lpOverlapped=0x0) returned 1 [0173.576] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31fff60c | out: lpNewFilePointer=0x0) returned 1 [0173.576] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.577] WriteFile (in: hFile=0x1b1c, lpBuffer=0x31fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31fff61c, lpOverlapped=0x0 | out: lpBuffer=0x31fff83c*, lpNumberOfBytesWritten=0x31fff61c*=0x8, lpOverlapped=0x0) returned 1 [0173.577] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x1610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.577] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.577] CloseHandle (hObject=0x1b1c) returned 1 [0173.577] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.579] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.play")) returned 1 [0173.580] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2378 os_tid = 0x23b8 [0173.648] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.648] ReadFile (in: hFile=0x1b1c, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.650] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.650] ReadFile (in: hFile=0x1b1c, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.650] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.655] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xfdf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0173.655] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xfdf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xfdf828, pbKeyObject=0x0) returned 0x0 [0173.655] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xfdf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xfdf500) returned 0x0 [0173.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.656] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xfdf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xfdf500) returned 0x0 [0173.660] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.664] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.664] WriteFile (in: hFile=0x1b1c, lpBuffer=0xfdfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfdf830, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesWritten=0xfdf830*=0x428, lpOverlapped=0x0) returned 1 [0173.665] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.665] ReadFile (in: hFile=0x1b1c, lpBuffer=0x2750000, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xfdf61c*=0xd74, lpOverlapped=0x0) returned 1 [0173.665] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffff28c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.665] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2750000, cbInput=0xd74, pPaddingInfo=0x0, pbIV=0xfdf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xfdf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xfdf848, pbOutput=0x2750000, pcbResult=0xfdf618) returned 0x0 [0173.665] WriteFile (in: hFile=0x1b1c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xfdf61c*=0xd80, lpOverlapped=0x0) returned 1 [0173.665] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfdf60c | out: lpNewFilePointer=0x0) returned 1 [0173.665] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.666] WriteFile (in: hFile=0x1b1c, lpBuffer=0xfdf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0xfdf83c*, lpNumberOfBytesWritten=0xfdf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.666] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xd80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.666] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.666] CloseHandle (hObject=0x1b1c) returned 1 [0173.666] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.play")) returned 1 [0173.670] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2379 os_tid = 0x23bc [0173.711] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.712] ReadFile (in: hFile=0x1b0c, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.713] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.713] ReadFile (in: hFile=0x1b0c, lpBuffer=0x125fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x125f85c, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesRead=0x125f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.713] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.717] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.718] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x125f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0173.718] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x125f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x125f828, pbKeyObject=0x0) returned 0x0 [0173.718] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x125f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x125f500) returned 0x0 [0173.718] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.718] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x125f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x125f500) returned 0x0 [0173.723] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.731] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.731] WriteFile (in: hFile=0x1b0c, lpBuffer=0x125fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x125f830, lpOverlapped=0x0 | out: lpBuffer=0x125fb34*, lpNumberOfBytesWritten=0x125f830*=0x428, lpOverlapped=0x0) returned 1 [0173.731] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.731] ReadFile (in: hFile=0x1b0c, lpBuffer=0x2850000, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x125f61c*=0x4314, lpOverlapped=0x0) returned 1 [0173.732] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xffffbcec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.732] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2850000, cbInput=0x4314, pPaddingInfo=0x0, pbIV=0x125f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x125f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x125f848, pbOutput=0x2850000, pcbResult=0x125f618) returned 0x0 [0173.732] WriteFile (in: hFile=0x1b0c, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x125f61c*=0x4320, lpOverlapped=0x0) returned 1 [0173.732] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125f60c | out: lpNewFilePointer=0x0) returned 1 [0173.732] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.732] WriteFile (in: hFile=0x1b0c, lpBuffer=0x125f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125f61c, lpOverlapped=0x0 | out: lpBuffer=0x125f83c*, lpNumberOfBytesWritten=0x125f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.733] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x4320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.733] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.733] CloseHandle (hObject=0x1b0c) returned 1 [0173.733] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.735] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.play")) returned 1 [0173.736] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2380 os_tid = 0x23c0 [0173.744] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.744] ReadFile (in: hFile=0x1688, lpBuffer=0xb04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb04f85c, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesRead=0xb04f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.746] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.746] ReadFile (in: hFile=0x1688, lpBuffer=0xb04fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb04f85c, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesRead=0xb04f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.746] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.748] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.749] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0xb04f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0173.749] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0xb04f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0xb04f828, pbKeyObject=0x0) returned 0x0 [0173.749] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xb04f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xb04f500) returned 0x0 [0173.749] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.749] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xb04f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xb04f500) returned 0x0 [0173.754] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.761] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.761] WriteFile (in: hFile=0x1688, lpBuffer=0xb04fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb04f830, lpOverlapped=0x0 | out: lpBuffer=0xb04fb34*, lpNumberOfBytesWritten=0xb04f830*=0x428, lpOverlapped=0x0) returned 1 [0173.762] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.762] ReadFile (in: hFile=0x1688, lpBuffer=0x2950000, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0xb04f61c*=0x2d0c, lpOverlapped=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xffffd2f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.778] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2950000, cbInput=0x2d0c, pPaddingInfo=0x0, pbIV=0xb04f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0xb04f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xb04f848, pbOutput=0x2950000, pcbResult=0xb04f618) returned 0x0 [0173.778] WriteFile (in: hFile=0x1688, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0xb04f61c*=0x2d10, lpOverlapped=0x0) returned 1 [0173.778] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb04f60c | out: lpNewFilePointer=0x0) returned 1 [0173.778] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.778] WriteFile (in: hFile=0x1688, lpBuffer=0xb04f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb04f61c, lpOverlapped=0x0 | out: lpBuffer=0xb04f83c*, lpNumberOfBytesWritten=0xb04f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.778] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x2d10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.778] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.778] CloseHandle (hObject=0x1688) returned 1 [0173.778] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.play")) returned 1 [0173.782] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2381 os_tid = 0x23c4 [0173.762] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.763] ReadFile (in: hFile=0x1af0, lpBuffer=0xb31fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb31f85c, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesRead=0xb31f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.765] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.766] ReadFile (in: hFile=0x1af0, lpBuffer=0xb31fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb31f85c, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesRead=0xb31f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.766] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.768] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.768] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0xb31f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0173.768] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0xb31f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0xb31f828, pbKeyObject=0x0) returned 0x0 [0173.768] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xb31f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xb31f500) returned 0x0 [0173.768] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.769] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xb31f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xb31f500) returned 0x0 [0173.773] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.776] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.776] WriteFile (in: hFile=0x1af0, lpBuffer=0xb31fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb31f830, lpOverlapped=0x0 | out: lpBuffer=0xb31fb34*, lpNumberOfBytesWritten=0xb31f830*=0x428, lpOverlapped=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.777] ReadFile (in: hFile=0x1af0, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0xb31f61c*=0x2bdc, lpOverlapped=0x0) returned 1 [0173.785] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xffffd424, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.785] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x2a50000, cbInput=0x2bdc, pPaddingInfo=0x0, pbIV=0xb31f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0xb31f618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0xb31f848, pbOutput=0x2a50000, pcbResult=0xb31f618) returned 0x0 [0173.785] WriteFile (in: hFile=0x1af0, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0xb31f61c*=0x2be0, lpOverlapped=0x0) returned 1 [0173.786] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb31f60c | out: lpNewFilePointer=0x0) returned 1 [0173.786] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.786] WriteFile (in: hFile=0x1af0, lpBuffer=0xb31f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb31f61c, lpOverlapped=0x0 | out: lpBuffer=0xb31f83c*, lpNumberOfBytesWritten=0xb31f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.786] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x2be0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.786] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0173.786] CloseHandle (hObject=0x1af0) returned 1 [0173.786] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.play")) returned 1 [0173.790] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2382 os_tid = 0x23c8 [0173.764] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.764] ReadFile (in: hFile=0x1ae0, lpBuffer=0xb41fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb41f85c, lpOverlapped=0x0 | out: lpBuffer=0xb41fb34*, lpNumberOfBytesRead=0xb41f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.794] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.794] ReadFile (in: hFile=0x1ae0, lpBuffer=0xb41fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xb41f85c, lpOverlapped=0x0 | out: lpBuffer=0xb41fb34*, lpNumberOfBytesRead=0xb41f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.794] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.796] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.797] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0xb41f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0173.797] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0xb41f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0xb41f828, pbKeyObject=0x0) returned 0x0 [0173.797] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xb41f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xb41f500) returned 0x0 [0173.797] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.797] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xb41f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xb41f500) returned 0x0 [0173.802] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.804] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.805] WriteFile (in: hFile=0x1ae0, lpBuffer=0xb41fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xb41f830, lpOverlapped=0x0 | out: lpBuffer=0xb41fb34*, lpNumberOfBytesWritten=0xb41f830*=0x428, lpOverlapped=0x0) returned 1 [0173.805] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.805] ReadFile (in: hFile=0x1ae0, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0xb41f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0xb41f61c*=0x4b80, lpOverlapped=0x0) returned 1 [0173.806] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xffffb480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.806] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2b50000, cbInput=0x4b80, pPaddingInfo=0x0, pbIV=0xb41f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0xb41f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xb41f848, pbOutput=0x2b50000, pcbResult=0xb41f618) returned 0x0 [0173.806] WriteFile (in: hFile=0x1ae0, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0xb41f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0xb41f61c*=0x4b90, lpOverlapped=0x0) returned 1 [0173.806] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb41f60c | out: lpNewFilePointer=0x0) returned 1 [0173.807] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.807] WriteFile (in: hFile=0x1ae0, lpBuffer=0xb41f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb41f61c, lpOverlapped=0x0 | out: lpBuffer=0xb41f83c*, lpNumberOfBytesWritten=0xb41f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.807] SetFilePointerEx (in: hFile=0x1ae0, liDistanceToMove=0x4b90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.807] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.807] CloseHandle (hObject=0x1ae0) returned 1 [0173.807] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.play")) returned 1 [0173.810] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2383 os_tid = 0x23cc [0173.815] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.815] ReadFile (in: hFile=0x1ad0, lpBuffer=0xf6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesRead=0xf6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.816] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.817] ReadFile (in: hFile=0x1ad0, lpBuffer=0xf6cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf6cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesRead=0xf6cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.817] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.819] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.819] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0xf6cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0173.819] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0xf6cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0xf6cf828, pbKeyObject=0x0) returned 0x0 [0173.819] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf6cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf6cf500) returned 0x0 [0173.819] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.820] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf6cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf6cf500) returned 0x0 [0173.824] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.827] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.827] WriteFile (in: hFile=0x1ad0, lpBuffer=0xf6cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf6cf830, lpOverlapped=0x0 | out: lpBuffer=0xf6cfb34*, lpNumberOfBytesWritten=0xf6cf830*=0x428, lpOverlapped=0x0) returned 1 [0173.828] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.828] ReadFile (in: hFile=0x1ad0, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0xf6cf61c*=0x1214, lpOverlapped=0x0) returned 1 [0173.828] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xffffedec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.828] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2c50000, cbInput=0x1214, pPaddingInfo=0x0, pbIV=0xf6cf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0xf6cf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xf6cf848, pbOutput=0x2c50000, pcbResult=0xf6cf618) returned 0x0 [0173.828] WriteFile (in: hFile=0x1ad0, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0xf6cf61c*=0x1220, lpOverlapped=0x0) returned 1 [0173.828] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf6cf60c | out: lpNewFilePointer=0x0) returned 1 [0173.828] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.828] WriteFile (in: hFile=0x1ad0, lpBuffer=0xf6cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf6cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf6cf83c*, lpNumberOfBytesWritten=0xf6cf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.828] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x1220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.829] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.829] CloseHandle (hObject=0x1ad0) returned 1 [0173.829] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.play")) returned 1 [0173.832] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2384 os_tid = 0x23d0 [0173.836] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.836] ReadFile (in: hFile=0x1ac0, lpBuffer=0xf7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf7cfb34*, lpNumberOfBytesRead=0xf7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.838] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.838] ReadFile (in: hFile=0x1ac0, lpBuffer=0xf7cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xf7cf85c, lpOverlapped=0x0 | out: lpBuffer=0xf7cfb34*, lpNumberOfBytesRead=0xf7cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.839] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.841] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.841] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0xf7cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0173.841] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0xf7cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0xf7cf828, pbKeyObject=0x0) returned 0x0 [0173.841] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0xf7cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0xf7cf500) returned 0x0 [0173.842] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.842] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0xf7cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0xf7cf500) returned 0x0 [0173.846] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.849] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.850] WriteFile (in: hFile=0x1ac0, lpBuffer=0xf7cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xf7cf830, lpOverlapped=0x0 | out: lpBuffer=0xf7cfb34*, lpNumberOfBytesWritten=0xf7cf830*=0x428, lpOverlapped=0x0) returned 1 [0173.850] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.850] ReadFile (in: hFile=0x1ac0, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0xf7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0xf7cf61c*=0x1714, lpOverlapped=0x0) returned 1 [0173.850] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xffffe8ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.850] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2d50000, cbInput=0x1714, pPaddingInfo=0x0, pbIV=0xf7cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0xf7cf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xf7cf848, pbOutput=0x2d50000, pcbResult=0xf7cf618) returned 0x0 [0173.850] WriteFile (in: hFile=0x1ac0, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0xf7cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0xf7cf61c*=0x1720, lpOverlapped=0x0) returned 1 [0173.850] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf7cf60c | out: lpNewFilePointer=0x0) returned 1 [0173.850] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.850] WriteFile (in: hFile=0x1ac0, lpBuffer=0xf7cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf7cf61c, lpOverlapped=0x0 | out: lpBuffer=0xf7cf83c*, lpNumberOfBytesWritten=0xf7cf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.851] SetFilePointerEx (in: hFile=0x1ac0, liDistanceToMove=0x1720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.851] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.851] CloseHandle (hObject=0x1ac0) returned 1 [0173.851] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.play")) returned 1 [0173.864] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2385 os_tid = 0x23d4 [0173.870] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.870] ReadFile (in: hFile=0x1ab0, lpBuffer=0x11f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x11f8fb34*, lpNumberOfBytesRead=0x11f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.872] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.872] ReadFile (in: hFile=0x1ab0, lpBuffer=0x11f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x11f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x11f8fb34*, lpNumberOfBytesRead=0x11f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.873] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.875] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.876] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x11f8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0173.876] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x11f8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x11f8f828, pbKeyObject=0x0) returned 0x0 [0173.876] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x11f8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x11f8f500) returned 0x0 [0173.876] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.876] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x11f8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x11f8f500) returned 0x0 [0173.881] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.884] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.884] WriteFile (in: hFile=0x1ab0, lpBuffer=0x11f8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x11f8f830, lpOverlapped=0x0 | out: lpBuffer=0x11f8fb34*, lpNumberOfBytesWritten=0x11f8f830*=0x428, lpOverlapped=0x0) returned 1 [0173.884] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.885] ReadFile (in: hFile=0x1ab0, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x11f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x11f8f61c*=0x4540, lpOverlapped=0x0) returned 1 [0173.885] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xffffbac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.885] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2e50000, cbInput=0x4540, pPaddingInfo=0x0, pbIV=0x11f8f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x11f8f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x11f8f848, pbOutput=0x2e50000, pcbResult=0x11f8f618) returned 0x0 [0173.886] WriteFile (in: hFile=0x1ab0, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x11f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x11f8f61c*=0x4550, lpOverlapped=0x0) returned 1 [0173.886] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11f8f60c | out: lpNewFilePointer=0x0) returned 1 [0173.886] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.886] WriteFile (in: hFile=0x1ab0, lpBuffer=0x11f8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x11f8f83c*, lpNumberOfBytesWritten=0x11f8f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.886] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x4550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.886] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.886] CloseHandle (hObject=0x1ab0) returned 1 [0173.886] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.play")) returned 1 [0173.890] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2386 os_tid = 0x23d8 [0173.894] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.894] ReadFile (in: hFile=0x1aa0, lpBuffer=0x1208fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1208f85c, lpOverlapped=0x0 | out: lpBuffer=0x1208fb34*, lpNumberOfBytesRead=0x1208f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.896] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.896] ReadFile (in: hFile=0x1aa0, lpBuffer=0x1208fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1208f85c, lpOverlapped=0x0 | out: lpBuffer=0x1208fb34*, lpNumberOfBytesRead=0x1208f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.896] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.898] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.898] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1208f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0173.898] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1208f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1208f828, pbKeyObject=0x0) returned 0x0 [0173.898] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1208f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1208f500) returned 0x0 [0173.898] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.899] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1208f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1208f500) returned 0x0 [0173.904] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.906] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.907] WriteFile (in: hFile=0x1aa0, lpBuffer=0x1208fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1208f830, lpOverlapped=0x0 | out: lpBuffer=0x1208fb34*, lpNumberOfBytesWritten=0x1208f830*=0x428, lpOverlapped=0x0) returned 1 [0173.907] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.907] ReadFile (in: hFile=0x1aa0, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x1208f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1208f61c*=0x4b28, lpOverlapped=0x0) returned 1 [0173.908] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xffffb4d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.908] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2f50000, cbInput=0x4b28, pPaddingInfo=0x0, pbIV=0x1208f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1208f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x1208f848, pbOutput=0x2f50000, pcbResult=0x1208f618) returned 0x0 [0173.908] WriteFile (in: hFile=0x1aa0, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x1208f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1208f61c*=0x4b30, lpOverlapped=0x0) returned 1 [0173.908] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1208f60c | out: lpNewFilePointer=0x0) returned 1 [0173.908] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.908] WriteFile (in: hFile=0x1aa0, lpBuffer=0x1208f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1208f61c, lpOverlapped=0x0 | out: lpBuffer=0x1208f83c*, lpNumberOfBytesWritten=0x1208f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.908] SetFilePointerEx (in: hFile=0x1aa0, liDistanceToMove=0x4b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.909] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.909] CloseHandle (hObject=0x1aa0) returned 1 [0173.909] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.play")) returned 1 [0173.912] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2387 os_tid = 0x23dc [0173.915] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.915] ReadFile (in: hFile=0x1a90, lpBuffer=0x1218fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1218f85c, lpOverlapped=0x0 | out: lpBuffer=0x1218fb34*, lpNumberOfBytesRead=0x1218f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.917] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.917] ReadFile (in: hFile=0x1a90, lpBuffer=0x1218fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1218f85c, lpOverlapped=0x0 | out: lpBuffer=0x1218fb34*, lpNumberOfBytesRead=0x1218f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.919] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.919] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1218f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0173.919] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1218f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1218f828, pbKeyObject=0x0) returned 0x0 [0173.919] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1218f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1218f500) returned 0x0 [0173.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.920] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1218f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1218f500) returned 0x0 [0173.924] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.927] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.927] WriteFile (in: hFile=0x1a90, lpBuffer=0x1218fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1218f830, lpOverlapped=0x0 | out: lpBuffer=0x1218fb34*, lpNumberOfBytesWritten=0x1218f830*=0x428, lpOverlapped=0x0) returned 1 [0173.927] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.927] ReadFile (in: hFile=0x1a90, lpBuffer=0x3050000, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x1218f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1218f61c*=0x2d14, lpOverlapped=0x0) returned 1 [0173.928] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xffffd2ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.928] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3050000, cbInput=0x2d14, pPaddingInfo=0x0, pbIV=0x1218f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1218f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x1218f848, pbOutput=0x3050000, pcbResult=0x1218f618) returned 0x0 [0173.928] WriteFile (in: hFile=0x1a90, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x1218f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1218f61c*=0x2d20, lpOverlapped=0x0) returned 1 [0173.928] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1218f60c | out: lpNewFilePointer=0x0) returned 1 [0173.928] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.928] WriteFile (in: hFile=0x1a90, lpBuffer=0x1218f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1218f61c, lpOverlapped=0x0 | out: lpBuffer=0x1218f83c*, lpNumberOfBytesWritten=0x1218f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.928] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x2d20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.928] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.929] CloseHandle (hObject=0x1a90) returned 1 [0173.929] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.play")) returned 1 [0173.933] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2388 os_tid = 0x23e0 [0173.939] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.939] ReadFile (in: hFile=0x1a80, lpBuffer=0x1228fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1228f85c, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesRead=0x1228f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.942] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.942] ReadFile (in: hFile=0x1a80, lpBuffer=0x1228fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1228f85c, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesRead=0x1228f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.942] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.945] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.945] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x1228f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0173.945] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x1228f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x1228f828, pbKeyObject=0x0) returned 0x0 [0173.945] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1228f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1228f500) returned 0x0 [0173.946] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.946] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1228f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1228f500) returned 0x0 [0173.950] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.952] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.952] WriteFile (in: hFile=0x1a80, lpBuffer=0x1228fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1228f830, lpOverlapped=0x0 | out: lpBuffer=0x1228fb34*, lpNumberOfBytesWritten=0x1228f830*=0x428, lpOverlapped=0x0) returned 1 [0173.953] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.953] ReadFile (in: hFile=0x1a80, lpBuffer=0x3150000, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x1228f61c*=0x12bc, lpOverlapped=0x0) returned 1 [0173.953] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xffffed44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.953] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3150000, cbInput=0x12bc, pPaddingInfo=0x0, pbIV=0x1228f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x1228f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x1228f848, pbOutput=0x3150000, pcbResult=0x1228f618) returned 0x0 [0173.953] WriteFile (in: hFile=0x1a80, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x1228f61c*=0x12c0, lpOverlapped=0x0) returned 1 [0173.953] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1228f60c | out: lpNewFilePointer=0x0) returned 1 [0173.953] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.953] WriteFile (in: hFile=0x1a80, lpBuffer=0x1228f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1228f61c, lpOverlapped=0x0 | out: lpBuffer=0x1228f83c*, lpNumberOfBytesWritten=0x1228f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.953] SetFilePointerEx (in: hFile=0x1a80, liDistanceToMove=0x12c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.953] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.953] CloseHandle (hObject=0x1a80) returned 1 [0173.953] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.play")) returned 1 [0173.956] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2389 os_tid = 0x23e4 [0173.959] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.959] ReadFile (in: hFile=0x1a70, lpBuffer=0x1238fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1238f85c, lpOverlapped=0x0 | out: lpBuffer=0x1238fb34*, lpNumberOfBytesRead=0x1238f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.960] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.960] ReadFile (in: hFile=0x1a70, lpBuffer=0x1238fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1238f85c, lpOverlapped=0x0 | out: lpBuffer=0x1238fb34*, lpNumberOfBytesRead=0x1238f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.960] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.962] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.962] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x1238f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0173.962] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x1238f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x1238f828, pbKeyObject=0x0) returned 0x0 [0173.962] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1238f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1238f500) returned 0x0 [0173.962] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.962] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1238f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1238f500) returned 0x0 [0173.965] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.967] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.967] WriteFile (in: hFile=0x1a70, lpBuffer=0x1238fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1238f830, lpOverlapped=0x0 | out: lpBuffer=0x1238fb34*, lpNumberOfBytesWritten=0x1238f830*=0x428, lpOverlapped=0x0) returned 1 [0173.967] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.967] ReadFile (in: hFile=0x1a70, lpBuffer=0x3250000, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x1238f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x1238f61c*=0x19a8, lpOverlapped=0x0) returned 1 [0173.969] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xffffe658, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.969] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3250000, cbInput=0x19a8, pPaddingInfo=0x0, pbIV=0x1238f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x1238f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x1238f848, pbOutput=0x3250000, pcbResult=0x1238f618) returned 0x0 [0173.969] WriteFile (in: hFile=0x1a70, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x1238f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x1238f61c*=0x19b0, lpOverlapped=0x0) returned 1 [0173.969] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1238f60c | out: lpNewFilePointer=0x0) returned 1 [0173.969] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.969] WriteFile (in: hFile=0x1a70, lpBuffer=0x1238f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1238f61c, lpOverlapped=0x0 | out: lpBuffer=0x1238f83c*, lpNumberOfBytesWritten=0x1238f61c*=0x8, lpOverlapped=0x0) returned 1 [0173.969] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x19b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.969] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.969] CloseHandle (hObject=0x1a70) returned 1 [0173.969] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.play")) returned 1 [0173.972] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2390 os_tid = 0x23e8 [0173.975] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.975] ReadFile (in: hFile=0x1668, lpBuffer=0x124cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x124cf85c, lpOverlapped=0x0 | out: lpBuffer=0x124cfb34*, lpNumberOfBytesRead=0x124cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.976] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.976] ReadFile (in: hFile=0x1668, lpBuffer=0x124cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x124cf85c, lpOverlapped=0x0 | out: lpBuffer=0x124cfb34*, lpNumberOfBytesRead=0x124cf85c*=0x428, lpOverlapped=0x0) returned 1 [0173.976] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.977] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.978] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x124cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0173.978] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x124cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x124cf828, pbKeyObject=0x0) returned 0x0 [0173.978] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x124cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x124cf500) returned 0x0 [0173.978] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.978] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x124cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x124cf500) returned 0x0 [0173.981] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.983] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.983] WriteFile (in: hFile=0x1668, lpBuffer=0x124cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x124cf830, lpOverlapped=0x0 | out: lpBuffer=0x124cfb34*, lpNumberOfBytesWritten=0x124cf830*=0x428, lpOverlapped=0x0) returned 1 [0173.983] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.983] ReadFile (in: hFile=0x1668, lpBuffer=0x3350000, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x124cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x124cf61c*=0x3dd8, lpOverlapped=0x0) returned 1 [0173.984] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xffffc228, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.984] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3350000, cbInput=0x3dd8, pPaddingInfo=0x0, pbIV=0x124cf848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x124cf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x124cf848, pbOutput=0x3350000, pcbResult=0x124cf618) returned 0x0 [0173.984] WriteFile (in: hFile=0x1668, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x124cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x124cf61c*=0x3de0, lpOverlapped=0x0) returned 1 [0173.984] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x124cf60c | out: lpNewFilePointer=0x0) returned 1 [0173.984] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.984] WriteFile (in: hFile=0x1668, lpBuffer=0x124cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x124cf61c, lpOverlapped=0x0 | out: lpBuffer=0x124cf83c*, lpNumberOfBytesWritten=0x124cf61c*=0x8, lpOverlapped=0x0) returned 1 [0173.984] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x3de0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.984] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0173.984] CloseHandle (hObject=0x1668) returned 1 [0173.984] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0173.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.play")) returned 1 [0173.988] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2391 os_tid = 0x23ec [0173.990] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.990] ReadFile (in: hFile=0x1a54, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.991] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.991] ReadFile (in: hFile=0x1a54, lpBuffer=0x2097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2097f85c, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesRead=0x2097f85c*=0x428, lpOverlapped=0x0) returned 1 [0173.992] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0173.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0173.994] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2097f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0173.994] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2097f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2097f828, pbKeyObject=0x0) returned 0x0 [0173.994] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2097f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2097f500) returned 0x0 [0173.994] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0173.994] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2097f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2097f500) returned 0x0 [0173.997] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.999] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.999] WriteFile (in: hFile=0x1a54, lpBuffer=0x2097fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2097f830, lpOverlapped=0x0 | out: lpBuffer=0x2097fb34*, lpNumberOfBytesWritten=0x2097f830*=0x428, lpOverlapped=0x0) returned 1 [0173.999] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.999] ReadFile (in: hFile=0x1a54, lpBuffer=0x3450000, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2097f61c*=0x3a14, lpOverlapped=0x0) returned 1 [0174.000] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xffffc5ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.000] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3450000, cbInput=0x3a14, pPaddingInfo=0x0, pbIV=0x2097f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2097f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2097f848, pbOutput=0x3450000, pcbResult=0x2097f618) returned 0x0 [0174.000] WriteFile (in: hFile=0x1a54, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2097f61c*=0x3a20, lpOverlapped=0x0) returned 1 [0174.000] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2097f60c | out: lpNewFilePointer=0x0) returned 1 [0174.000] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.000] WriteFile (in: hFile=0x1a54, lpBuffer=0x2097f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2097f61c, lpOverlapped=0x0 | out: lpBuffer=0x2097f83c*, lpNumberOfBytesWritten=0x2097f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.000] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x3a20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.000] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.000] CloseHandle (hObject=0x1a54) returned 1 [0174.000] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.play")) returned 1 [0174.003] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2392 os_tid = 0x23f0 [0174.006] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.006] ReadFile (in: hFile=0x1a44, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.007] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.007] ReadFile (in: hFile=0x1a44, lpBuffer=0x20dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesRead=0x20dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.008] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.009] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.009] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x20dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0174.009] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x20dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x20dbf828, pbKeyObject=0x0) returned 0x0 [0174.009] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x20dbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x20dbf500) returned 0x0 [0174.009] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.010] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x20dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x20dbf500) returned 0x0 [0174.013] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.014] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.015] WriteFile (in: hFile=0x1a44, lpBuffer=0x20dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20dbf830, lpOverlapped=0x0 | out: lpBuffer=0x20dbfb34*, lpNumberOfBytesWritten=0x20dbf830*=0x428, lpOverlapped=0x0) returned 1 [0174.015] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.015] ReadFile (in: hFile=0x1a44, lpBuffer=0x3550000, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x20dbf61c*=0x1580, lpOverlapped=0x0) returned 1 [0174.015] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xffffea80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.015] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3550000, cbInput=0x1580, pPaddingInfo=0x0, pbIV=0x20dbf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x20dbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x20dbf848, pbOutput=0x3550000, pcbResult=0x20dbf618) returned 0x0 [0174.015] WriteFile (in: hFile=0x1a44, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x20dbf61c*=0x1590, lpOverlapped=0x0) returned 1 [0174.015] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20dbf60c | out: lpNewFilePointer=0x0) returned 1 [0174.015] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.015] WriteFile (in: hFile=0x1a44, lpBuffer=0x20dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20dbf83c*, lpNumberOfBytesWritten=0x20dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.015] SetFilePointerEx (in: hFile=0x1a44, liDistanceToMove=0x1590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.015] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.015] CloseHandle (hObject=0x1a44) returned 1 [0174.015] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.play")) returned 1 [0174.018] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2393 os_tid = 0x23f4 [0174.020] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.021] ReadFile (in: hFile=0x1a34, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.022] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.022] ReadFile (in: hFile=0x1a34, lpBuffer=0x20fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x20fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesRead=0x20fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.022] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.023] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.023] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x20fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0174.023] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x20fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x20fbf828, pbKeyObject=0x0) returned 0x0 [0174.023] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x20fbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x20fbf500) returned 0x0 [0174.024] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.024] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x20fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x20fbf500) returned 0x0 [0174.027] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.029] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.029] WriteFile (in: hFile=0x1a34, lpBuffer=0x20fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x20fbf830, lpOverlapped=0x0 | out: lpBuffer=0x20fbfb34*, lpNumberOfBytesWritten=0x20fbf830*=0x428, lpOverlapped=0x0) returned 1 [0174.029] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.029] ReadFile (in: hFile=0x1a34, lpBuffer=0x3650000, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x20fbf61c*=0x18b0, lpOverlapped=0x0) returned 1 [0174.030] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xffffe750, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.030] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3650000, cbInput=0x18b0, pPaddingInfo=0x0, pbIV=0x20fbf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x20fbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x20fbf848, pbOutput=0x3650000, pcbResult=0x20fbf618) returned 0x0 [0174.030] WriteFile (in: hFile=0x1a34, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x20fbf61c*=0x18c0, lpOverlapped=0x0) returned 1 [0174.030] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x20fbf60c | out: lpNewFilePointer=0x0) returned 1 [0174.030] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.030] WriteFile (in: hFile=0x1a34, lpBuffer=0x20fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x20fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x20fbf83c*, lpNumberOfBytesWritten=0x20fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.030] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x18c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.030] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.030] CloseHandle (hObject=0x1a34) returned 1 [0174.030] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.play")) returned 1 [0174.033] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2394 os_tid = 0x23f8 [0174.035] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.035] ReadFile (in: hFile=0x1a24, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.037] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.037] ReadFile (in: hFile=0x1a24, lpBuffer=0x210bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x210bf85c, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesRead=0x210bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.037] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.039] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.039] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x210bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0174.039] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x210bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x210bf828, pbKeyObject=0x0) returned 0x0 [0174.039] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x210bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x210bf500) returned 0x0 [0174.039] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.039] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x210bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x210bf500) returned 0x0 [0174.042] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.044] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.044] WriteFile (in: hFile=0x1a24, lpBuffer=0x210bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x210bf830, lpOverlapped=0x0 | out: lpBuffer=0x210bfb34*, lpNumberOfBytesWritten=0x210bf830*=0x428, lpOverlapped=0x0) returned 1 [0174.044] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.045] ReadFile (in: hFile=0x1a24, lpBuffer=0x3750000, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x210bf61c*=0x10e0, lpOverlapped=0x0) returned 1 [0174.045] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xffffef20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.045] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3750000, cbInput=0x10e0, pPaddingInfo=0x0, pbIV=0x210bf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x210bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x210bf848, pbOutput=0x3750000, pcbResult=0x210bf618) returned 0x0 [0174.045] WriteFile (in: hFile=0x1a24, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x210bf61c*=0x10f0, lpOverlapped=0x0) returned 1 [0174.045] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x210bf60c | out: lpNewFilePointer=0x0) returned 1 [0174.045] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.045] WriteFile (in: hFile=0x1a24, lpBuffer=0x210bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x210bf61c, lpOverlapped=0x0 | out: lpBuffer=0x210bf83c*, lpNumberOfBytesWritten=0x210bf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.045] SetFilePointerEx (in: hFile=0x1a24, liDistanceToMove=0x10f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.045] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.045] CloseHandle (hObject=0x1a24) returned 1 [0174.045] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.play")) returned 1 [0174.048] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2395 os_tid = 0x23fc [0174.050] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.050] ReadFile (in: hFile=0x1a14, lpBuffer=0x2147fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2147f85c, lpOverlapped=0x0 | out: lpBuffer=0x2147fb34*, lpNumberOfBytesRead=0x2147f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.052] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.053] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.053] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2147f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0174.053] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2147f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2147f828, pbKeyObject=0x0) returned 0x0 [0174.053] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2147f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2147f500) returned 0x0 [0174.054] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.054] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2147f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2147f500) returned 0x0 [0174.057] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.059] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.059] WriteFile (in: hFile=0x1a14, lpBuffer=0x2147fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2147f830, lpOverlapped=0x0 | out: lpBuffer=0x2147fb34*, lpNumberOfBytesWritten=0x2147f830*=0x428, lpOverlapped=0x0) returned 1 [0174.059] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.059] ReadFile (in: hFile=0x1a14, lpBuffer=0x3850000, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2147f61c*=0x7e4, lpOverlapped=0x0) returned 1 [0174.059] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffff81c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.059] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3850000, cbInput=0x7e4, pPaddingInfo=0x0, pbIV=0x2147f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2147f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2147f848, pbOutput=0x3850000, pcbResult=0x2147f618) returned 0x0 [0174.059] WriteFile (in: hFile=0x1a14, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2147f61c*=0x7f0, lpOverlapped=0x0) returned 1 [0174.059] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2147f60c | out: lpNewFilePointer=0x0) returned 1 [0174.060] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.060] WriteFile (in: hFile=0x1a14, lpBuffer=0x2147f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2147f61c, lpOverlapped=0x0 | out: lpBuffer=0x2147f83c*, lpNumberOfBytesWritten=0x2147f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.060] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x7f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.060] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.060] CloseHandle (hObject=0x1a14) returned 1 [0174.060] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.play")) returned 1 [0174.062] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2396 os_tid = 0xdb4 [0174.065] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.065] ReadFile (in: hFile=0x1a04, lpBuffer=0x2157fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2157f85c, lpOverlapped=0x0 | out: lpBuffer=0x2157fb34*, lpNumberOfBytesRead=0x2157f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.066] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.066] ReadFile (in: hFile=0x1a04, lpBuffer=0x2157fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2157f85c, lpOverlapped=0x0 | out: lpBuffer=0x2157fb34*, lpNumberOfBytesRead=0x2157f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.066] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.068] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.068] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2157f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0174.068] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2157f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2157f828, pbKeyObject=0x0) returned 0x0 [0174.068] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2157f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2157f500) returned 0x0 [0174.068] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.068] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2157f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2157f500) returned 0x0 [0174.072] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.074] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.074] WriteFile (in: hFile=0x1a04, lpBuffer=0x2157fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2157f830, lpOverlapped=0x0 | out: lpBuffer=0x2157fb34*, lpNumberOfBytesWritten=0x2157f830*=0x428, lpOverlapped=0x0) returned 1 [0174.074] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.074] ReadFile (in: hFile=0x1a04, lpBuffer=0x3950000, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x2157f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2157f61c*=0x1f38, lpOverlapped=0x0) returned 1 [0174.075] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xffffe0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.075] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3950000, cbInput=0x1f38, pPaddingInfo=0x0, pbIV=0x2157f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2157f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2157f848, pbOutput=0x3950000, pcbResult=0x2157f618) returned 0x0 [0174.075] WriteFile (in: hFile=0x1a04, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2157f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2157f61c*=0x1f40, lpOverlapped=0x0) returned 1 [0174.076] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2157f60c | out: lpNewFilePointer=0x0) returned 1 [0174.076] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.076] WriteFile (in: hFile=0x1a04, lpBuffer=0x2157f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2157f61c, lpOverlapped=0x0 | out: lpBuffer=0x2157f83c*, lpNumberOfBytesWritten=0x2157f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.076] SetFilePointerEx (in: hFile=0x1a04, liDistanceToMove=0x1f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.076] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.076] CloseHandle (hObject=0x1a04) returned 1 [0174.076] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.play")) returned 1 [0174.079] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2397 os_tid = 0xd98 [0174.081] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.081] ReadFile (in: hFile=0x19f4, lpBuffer=0x2167fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2167f85c, lpOverlapped=0x0 | out: lpBuffer=0x2167fb34*, lpNumberOfBytesRead=0x2167f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.083] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.083] ReadFile (in: hFile=0x19f4, lpBuffer=0x2167fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2167f85c, lpOverlapped=0x0 | out: lpBuffer=0x2167fb34*, lpNumberOfBytesRead=0x2167f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.085] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.085] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2167f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0174.085] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2167f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2167f828, pbKeyObject=0x0) returned 0x0 [0174.085] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2167f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2167f500) returned 0x0 [0174.085] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.085] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2167f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2167f500) returned 0x0 [0174.090] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.092] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.092] WriteFile (in: hFile=0x19f4, lpBuffer=0x2167fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2167f830, lpOverlapped=0x0 | out: lpBuffer=0x2167fb34*, lpNumberOfBytesWritten=0x2167f830*=0x428, lpOverlapped=0x0) returned 1 [0174.093] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.093] ReadFile (in: hFile=0x19f4, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x2167f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2167f61c*=0x290c, lpOverlapped=0x0) returned 1 [0174.094] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xffffd6f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.094] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3a50000, cbInput=0x290c, pPaddingInfo=0x0, pbIV=0x2167f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2167f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2167f848, pbOutput=0x3a50000, pcbResult=0x2167f618) returned 0x0 [0174.094] WriteFile (in: hFile=0x19f4, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2167f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2167f61c*=0x2910, lpOverlapped=0x0) returned 1 [0174.094] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2167f60c | out: lpNewFilePointer=0x0) returned 1 [0174.094] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.094] WriteFile (in: hFile=0x19f4, lpBuffer=0x2167f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2167f61c, lpOverlapped=0x0 | out: lpBuffer=0x2167f83c*, lpNumberOfBytesWritten=0x2167f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.095] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x2910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.095] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.095] CloseHandle (hObject=0x19f4) returned 1 [0174.095] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.play")) returned 1 [0174.100] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2398 os_tid = 0xd9c [0174.102] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.102] ReadFile (in: hFile=0x19e4, lpBuffer=0x217bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x217bf85c, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesRead=0x217bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.104] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.104] ReadFile (in: hFile=0x19e4, lpBuffer=0x217bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x217bf85c, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesRead=0x217bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.104] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.105] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.105] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x217bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0174.105] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x217bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x217bf828, pbKeyObject=0x0) returned 0x0 [0174.105] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x217bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x217bf500) returned 0x0 [0174.106] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.106] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x217bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x217bf500) returned 0x0 [0174.111] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.114] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.114] WriteFile (in: hFile=0x19e4, lpBuffer=0x217bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x217bf830, lpOverlapped=0x0 | out: lpBuffer=0x217bfb34*, lpNumberOfBytesWritten=0x217bf830*=0x428, lpOverlapped=0x0) returned 1 [0174.114] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.114] ReadFile (in: hFile=0x19e4, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x217bf61c*=0xb54, lpOverlapped=0x0) returned 1 [0174.114] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xfffff4ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.115] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3b50000, cbInput=0xb54, pPaddingInfo=0x0, pbIV=0x217bf848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x217bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x217bf848, pbOutput=0x3b50000, pcbResult=0x217bf618) returned 0x0 [0174.115] WriteFile (in: hFile=0x19e4, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x217bf61c*=0xb60, lpOverlapped=0x0) returned 1 [0174.115] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x217bf60c | out: lpNewFilePointer=0x0) returned 1 [0174.115] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.115] WriteFile (in: hFile=0x19e4, lpBuffer=0x217bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x217bf61c, lpOverlapped=0x0 | out: lpBuffer=0x217bf83c*, lpNumberOfBytesWritten=0x217bf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.115] SetFilePointerEx (in: hFile=0x19e4, liDistanceToMove=0xb60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.115] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.115] CloseHandle (hObject=0x19e4) returned 1 [0174.115] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.119] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.play")) returned 1 [0174.120] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2399 os_tid = 0xdc8 [0174.125] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.125] ReadFile (in: hFile=0x19d4, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.128] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.128] ReadFile (in: hFile=0x19d4, lpBuffer=0x218ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x218ff85c, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesRead=0x218ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.128] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0174.131] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0174.131] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x218ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0174.131] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x218ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x218ff828, pbKeyObject=0x0) returned 0x0 [0174.131] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x218ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x218ff500) returned 0x0 [0174.131] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0174.131] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x218ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x218ff500) returned 0x0 [0174.138] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.142] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.142] WriteFile (in: hFile=0x19d4, lpBuffer=0x218ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x218ff830, lpOverlapped=0x0 | out: lpBuffer=0x218ffb34*, lpNumberOfBytesWritten=0x218ff830*=0x428, lpOverlapped=0x0) returned 1 [0174.142] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.143] ReadFile (in: hFile=0x19d4, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x218ff61c*=0x2d40, lpOverlapped=0x0) returned 1 [0174.144] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xffffd2c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.144] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3c50000, cbInput=0x2d40, pPaddingInfo=0x0, pbIV=0x218ff848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x218ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x218ff848, pbOutput=0x3c50000, pcbResult=0x218ff618) returned 0x0 [0174.144] WriteFile (in: hFile=0x19d4, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x218ff61c*=0x2d50, lpOverlapped=0x0) returned 1 [0174.144] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x218ff60c | out: lpNewFilePointer=0x0) returned 1 [0174.144] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.144] WriteFile (in: hFile=0x19d4, lpBuffer=0x218ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x218ff61c, lpOverlapped=0x0 | out: lpBuffer=0x218ff83c*, lpNumberOfBytesWritten=0x218ff61c*=0x8, lpOverlapped=0x0) returned 1 [0174.144] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x2d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.144] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.145] CloseHandle (hObject=0x19d4) returned 1 [0174.145] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.147] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.play")) returned 1 [0174.150] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2400 os_tid = 0xda8 [0174.159] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0174.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0174.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f030c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0174.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4 [0174.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0324, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4 [0174.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a04 [0174.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f033c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0174.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24 [0174.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0354, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34 [0174.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0174.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f036c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54 [0174.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668 [0174.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0384, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a70 [0174.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a80 [0174.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f039c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a90 [0174.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0 [0174.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab0 [0174.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0174.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad0 [0174.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae0 [0174.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af0 [0174.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0174.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0c [0174.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0174.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0414, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0174.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0174.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f042c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0174.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0174.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0444, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0174.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0174.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f045c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4 [0174.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0174.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0474, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c [0174.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0174.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f048c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0174.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0174.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0174.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c [0174.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0174.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0174.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0174.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0174.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0174.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0174.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0174.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930 [0174.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f051c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928 [0174.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920 [0174.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0534, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0174.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910 [0174.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f054c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0174.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0174.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0564, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0174.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0174.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f057c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0174.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0174.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0594, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0174.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0174.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0174.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0174.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0174.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0174.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0174.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0174.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0174.598] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x42c, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0176.509] CloseHandle (hObject=0x42c) returned 1 [0176.509] CloseHandle (hObject=0x19d4) returned 1 [0176.509] CloseHandle (hObject=0x19e4) returned 1 [0176.509] CloseHandle (hObject=0x19f4) returned 1 [0176.509] CloseHandle (hObject=0x1a04) returned 1 [0176.509] CloseHandle (hObject=0x1a14) returned 1 [0176.509] CloseHandle (hObject=0x1a24) returned 1 [0176.509] CloseHandle (hObject=0x1a34) returned 1 [0176.509] CloseHandle (hObject=0x1a44) returned 1 [0176.509] CloseHandle (hObject=0x1a54) returned 1 [0176.509] CloseHandle (hObject=0x1668) returned 1 [0176.509] CloseHandle (hObject=0x1a70) returned 1 [0176.509] CloseHandle (hObject=0x1a80) returned 1 [0176.509] CloseHandle (hObject=0x1a90) returned 1 [0176.509] CloseHandle (hObject=0x1aa0) returned 1 [0176.509] CloseHandle (hObject=0x1ab0) returned 1 [0176.510] CloseHandle (hObject=0x1ac0) returned 1 [0176.510] CloseHandle (hObject=0x1ad0) returned 1 [0176.510] CloseHandle (hObject=0x1ae0) returned 1 [0176.510] CloseHandle (hObject=0x1af0) returned 1 [0176.510] CloseHandle (hObject=0x1688) returned 1 [0176.510] CloseHandle (hObject=0x1b0c) returned 1 [0176.510] CloseHandle (hObject=0x16c0) returned 1 [0176.510] CloseHandle (hObject=0x16bc) returned 1 [0176.510] CloseHandle (hObject=0x16b8) returned 1 [0176.510] CloseHandle (hObject=0x16b4) returned 1 [0176.510] CloseHandle (hObject=0x16b0) returned 1 [0176.510] CloseHandle (hObject=0x16ac) returned 1 [0176.510] CloseHandle (hObject=0x16a8) returned 1 [0176.510] CloseHandle (hObject=0x16a4) returned 1 [0176.510] CloseHandle (hObject=0x1024) returned 1 [0176.510] CloseHandle (hObject=0x100c) returned 1 [0176.510] CloseHandle (hObject=0x1054) returned 1 [0176.510] CloseHandle (hObject=0x108c) returned 1 [0176.511] CloseHandle (hObject=0x11e4) returned 1 [0176.511] CloseHandle (hObject=0xfe0) returned 1 [0176.511] CloseHandle (hObject=0xa8c) returned 1 [0176.511] CloseHandle (hObject=0x1224) returned 1 [0176.511] CloseHandle (hObject=0x11f4) returned 1 [0176.511] CloseHandle (hObject=0x121c) returned 1 [0176.511] CloseHandle (hObject=0x1204) returned 1 [0176.511] CloseHandle (hObject=0x1284) returned 1 [0176.511] CloseHandle (hObject=0x1538) returned 1 [0176.511] CloseHandle (hObject=0x538) returned 1 [0176.511] CloseHandle (hObject=0x1930) returned 1 [0176.511] CloseHandle (hObject=0x1928) returned 1 [0176.511] CloseHandle (hObject=0x1920) returned 1 [0176.511] CloseHandle (hObject=0x1918) returned 1 [0176.511] CloseHandle (hObject=0x1910) returned 1 [0176.511] CloseHandle (hObject=0x1908) returned 1 [0176.511] CloseHandle (hObject=0x1900) returned 1 [0176.511] CloseHandle (hObject=0x18f8) returned 1 [0176.512] CloseHandle (hObject=0x18f0) returned 1 [0176.512] CloseHandle (hObject=0x18e8) returned 1 [0176.512] CloseHandle (hObject=0x18e0) returned 1 [0176.512] CloseHandle (hObject=0x18d8) returned 1 [0176.512] CloseHandle (hObject=0x18d0) returned 1 [0176.512] CloseHandle (hObject=0x18c8) returned 1 [0176.512] CloseHandle (hObject=0x18c0) returned 1 [0176.512] CloseHandle (hObject=0x18b0) returned 1 [0176.512] CloseHandle (hObject=0x18b8) returned 1 [0176.512] CloseHandle (hObject=0x18a8) returned 1 [0176.512] CloseHandle (hObject=0x18a0) returned 1 [0176.512] CloseHandle (hObject=0x1898) returned 1 [0176.512] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2401 os_tid = 0xdb0 [0174.197] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.197] ReadFile (in: hFile=0x1b1c, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.200] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.200] ReadFile (in: hFile=0x1b1c, lpBuffer=0xfdfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0xfdf85c, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesRead=0xfdf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.200] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.205] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.205] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0xfdf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0174.205] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0xfdf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0xfdf828, pbKeyObject=0x0) returned 0x0 [0174.205] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0xfdf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0xfdf500) returned 0x0 [0174.205] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.205] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0xfdf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0xfdf500) returned 0x0 [0174.211] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.215] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.215] WriteFile (in: hFile=0x1b1c, lpBuffer=0xfdfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0xfdf830, lpOverlapped=0x0 | out: lpBuffer=0xfdfb34*, lpNumberOfBytesWritten=0xfdf830*=0x428, lpOverlapped=0x0) returned 1 [0174.215] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.215] ReadFile (in: hFile=0x1b1c, lpBuffer=0x2750000, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0xfdf61c*=0x42a4, lpOverlapped=0x0) returned 1 [0174.216] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xffffbd5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.217] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x2750000, cbInput=0x42a4, pPaddingInfo=0x0, pbIV=0xfdf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0xfdf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0xfdf848, pbOutput=0x2750000, pcbResult=0xfdf618) returned 0x0 [0174.217] WriteFile (in: hFile=0x1b1c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0xfdf61c*=0x42b0, lpOverlapped=0x0) returned 1 [0174.217] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfdf60c | out: lpNewFilePointer=0x0) returned 1 [0174.217] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.217] WriteFile (in: hFile=0x1b1c, lpBuffer=0xfdf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfdf61c, lpOverlapped=0x0 | out: lpBuffer=0xfdf83c*, lpNumberOfBytesWritten=0xfdf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.217] SetFilePointerEx (in: hFile=0x1b1c, liDistanceToMove=0x42b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.217] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.218] CloseHandle (hObject=0x1b1c) returned 1 [0174.218] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.play")) returned 1 [0174.222] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2402 os_tid = 0xdcc [0174.225] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.225] ReadFile (in: hFile=0x1678, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.227] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.227] ReadFile (in: hFile=0x1678, lpBuffer=0x21d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesRead=0x21d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.227] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.229] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.229] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x21d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0174.229] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x21d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x21d3f828, pbKeyObject=0x0) returned 0x0 [0174.229] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21d3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21d3f500) returned 0x0 [0174.229] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.229] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21d3f500) returned 0x0 [0174.232] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.235] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.235] WriteFile (in: hFile=0x1678, lpBuffer=0x21d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21d3f830, lpOverlapped=0x0 | out: lpBuffer=0x21d3fb34*, lpNumberOfBytesWritten=0x21d3f830*=0x428, lpOverlapped=0x0) returned 1 [0174.235] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.235] ReadFile (in: hFile=0x1678, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x21d3f61c*=0x229c, lpOverlapped=0x0) returned 1 [0174.235] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xffffdd64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.236] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3d50000, cbInput=0x229c, pPaddingInfo=0x0, pbIV=0x21d3f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x21d3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x21d3f848, pbOutput=0x3d50000, pcbResult=0x21d3f618) returned 0x0 [0174.236] WriteFile (in: hFile=0x1678, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x21d3f61c*=0x22a0, lpOverlapped=0x0) returned 1 [0174.236] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21d3f60c | out: lpNewFilePointer=0x0) returned 1 [0174.236] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.236] WriteFile (in: hFile=0x1678, lpBuffer=0x21d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21d3f83c*, lpNumberOfBytesWritten=0x21d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.236] SetFilePointerEx (in: hFile=0x1678, liDistanceToMove=0x22a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.236] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.236] CloseHandle (hObject=0x1678) returned 1 [0174.236] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.238] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.play")) returned 1 [0174.239] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2403 os_tid = 0x1fa8 [0174.242] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.242] ReadFile (in: hFile=0x19b0, lpBuffer=0x21e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesRead=0x21e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.244] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.244] ReadFile (in: hFile=0x19b0, lpBuffer=0x21e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesRead=0x21e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.244] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.246] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.246] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x21e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0174.246] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x21e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x21e3f828, pbKeyObject=0x0) returned 0x0 [0174.246] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21e3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21e3f500) returned 0x0 [0174.246] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.246] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21e3f500) returned 0x0 [0174.250] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.252] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.252] WriteFile (in: hFile=0x19b0, lpBuffer=0x21e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21e3f830, lpOverlapped=0x0 | out: lpBuffer=0x21e3fb34*, lpNumberOfBytesWritten=0x21e3f830*=0x428, lpOverlapped=0x0) returned 1 [0174.252] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.252] ReadFile (in: hFile=0x19b0, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x21e3f61c*=0x305c, lpOverlapped=0x0) returned 1 [0174.253] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xffffcfa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.253] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3e50000, cbInput=0x305c, pPaddingInfo=0x0, pbIV=0x21e3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x21e3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x21e3f848, pbOutput=0x3e50000, pcbResult=0x21e3f618) returned 0x0 [0174.253] WriteFile (in: hFile=0x19b0, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x21e3f61c*=0x3060, lpOverlapped=0x0) returned 1 [0174.253] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21e3f60c | out: lpNewFilePointer=0x0) returned 1 [0174.253] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.253] WriteFile (in: hFile=0x19b0, lpBuffer=0x21e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21e3f83c*, lpNumberOfBytesWritten=0x21e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.253] SetFilePointerEx (in: hFile=0x19b0, liDistanceToMove=0x3060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.253] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.253] CloseHandle (hObject=0x19b0) returned 1 [0174.253] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.255] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.play")) returned 1 [0174.257] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2404 os_tid = 0x2404 [0174.260] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.260] ReadFile (in: hFile=0x19a0, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.261] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.261] ReadFile (in: hFile=0x19a0, lpBuffer=0x21f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x21f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesRead=0x21f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.261] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.263] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.263] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x21f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0174.263] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x21f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x21f3f828, pbKeyObject=0x0) returned 0x0 [0174.263] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x21f3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x21f3f500) returned 0x0 [0174.263] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.263] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x21f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x21f3f500) returned 0x0 [0174.267] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.268] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.268] WriteFile (in: hFile=0x19a0, lpBuffer=0x21f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x21f3f830, lpOverlapped=0x0 | out: lpBuffer=0x21f3fb34*, lpNumberOfBytesWritten=0x21f3f830*=0x428, lpOverlapped=0x0) returned 1 [0174.269] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.269] ReadFile (in: hFile=0x19a0, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x21f3f61c*=0x1364, lpOverlapped=0x0) returned 1 [0174.269] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xffffec9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.269] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3f50000, cbInput=0x1364, pPaddingInfo=0x0, pbIV=0x21f3f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x21f3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x21f3f848, pbOutput=0x3f50000, pcbResult=0x21f3f618) returned 0x0 [0174.269] WriteFile (in: hFile=0x19a0, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x21f3f61c*=0x1370, lpOverlapped=0x0) returned 1 [0174.269] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21f3f60c | out: lpNewFilePointer=0x0) returned 1 [0174.269] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.269] WriteFile (in: hFile=0x19a0, lpBuffer=0x21f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x21f3f83c*, lpNumberOfBytesWritten=0x21f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.269] SetFilePointerEx (in: hFile=0x19a0, liDistanceToMove=0x1370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.269] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.269] CloseHandle (hObject=0x19a0) returned 1 [0174.269] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.play")) returned 1 [0174.272] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2405 os_tid = 0x2408 [0174.275] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.275] ReadFile (in: hFile=0x1990, lpBuffer=0x2207fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2207f85c, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesRead=0x2207f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.277] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.277] ReadFile (in: hFile=0x1990, lpBuffer=0x2207fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2207f85c, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesRead=0x2207f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.277] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.278] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.279] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2207f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0174.279] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2207f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2207f828, pbKeyObject=0x0) returned 0x0 [0174.279] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2207f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2207f500) returned 0x0 [0174.279] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.279] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2207f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2207f500) returned 0x0 [0174.282] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.284] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.284] WriteFile (in: hFile=0x1990, lpBuffer=0x2207fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2207f830, lpOverlapped=0x0 | out: lpBuffer=0x2207fb34*, lpNumberOfBytesWritten=0x2207f830*=0x428, lpOverlapped=0x0) returned 1 [0174.284] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.284] ReadFile (in: hFile=0x1990, lpBuffer=0x4050000, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2207f61c*=0x1364, lpOverlapped=0x0) returned 1 [0174.284] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xffffec9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.284] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4050000, cbInput=0x1364, pPaddingInfo=0x0, pbIV=0x2207f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2207f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2207f848, pbOutput=0x4050000, pcbResult=0x2207f618) returned 0x0 [0174.284] WriteFile (in: hFile=0x1990, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2207f61c*=0x1370, lpOverlapped=0x0) returned 1 [0174.284] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2207f60c | out: lpNewFilePointer=0x0) returned 1 [0174.285] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.285] WriteFile (in: hFile=0x1990, lpBuffer=0x2207f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2207f61c, lpOverlapped=0x0 | out: lpBuffer=0x2207f83c*, lpNumberOfBytesWritten=0x2207f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.285] SetFilePointerEx (in: hFile=0x1990, liDistanceToMove=0x1370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.285] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.285] CloseHandle (hObject=0x1990) returned 1 [0174.285] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.play")) returned 1 [0174.288] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2406 os_tid = 0x240c [0174.291] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.291] ReadFile (in: hFile=0x1980, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.293] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.293] ReadFile (in: hFile=0x1980, lpBuffer=0x230ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x230ff85c, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesRead=0x230ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.293] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.294] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.295] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x230ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0174.295] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x230ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x230ff828, pbKeyObject=0x0) returned 0x0 [0174.295] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x230ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x230ff500) returned 0x0 [0174.295] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.295] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x230ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x230ff500) returned 0x0 [0174.298] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.300] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.300] WriteFile (in: hFile=0x1980, lpBuffer=0x230ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x230ff830, lpOverlapped=0x0 | out: lpBuffer=0x230ffb34*, lpNumberOfBytesWritten=0x230ff830*=0x428, lpOverlapped=0x0) returned 1 [0174.300] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.300] ReadFile (in: hFile=0x1980, lpBuffer=0x4150000, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x230ff61c*=0x1210, lpOverlapped=0x0) returned 1 [0174.301] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xffffedf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.301] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4150000, cbInput=0x1210, pPaddingInfo=0x0, pbIV=0x230ff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x230ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x230ff848, pbOutput=0x4150000, pcbResult=0x230ff618) returned 0x0 [0174.301] WriteFile (in: hFile=0x1980, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x230ff61c*=0x1220, lpOverlapped=0x0) returned 1 [0174.301] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x230ff60c | out: lpNewFilePointer=0x0) returned 1 [0174.301] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.301] WriteFile (in: hFile=0x1980, lpBuffer=0x230ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x230ff61c, lpOverlapped=0x0 | out: lpBuffer=0x230ff83c*, lpNumberOfBytesWritten=0x230ff61c*=0x8, lpOverlapped=0x0) returned 1 [0174.301] SetFilePointerEx (in: hFile=0x1980, liDistanceToMove=0x1220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.301] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.301] CloseHandle (hObject=0x1980) returned 1 [0174.301] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.play")) returned 1 [0174.304] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2407 os_tid = 0x2410 [0174.307] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.308] ReadFile (in: hFile=0x1970, lpBuffer=0x231ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x231ff85c, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesRead=0x231ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.309] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.309] ReadFile (in: hFile=0x1970, lpBuffer=0x231ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x231ff85c, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesRead=0x231ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.309] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.311] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.311] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x231ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0174.311] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x231ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x231ff828, pbKeyObject=0x0) returned 0x0 [0174.311] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x231ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x231ff500) returned 0x0 [0174.312] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.312] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x231ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x231ff500) returned 0x0 [0174.315] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.317] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.317] WriteFile (in: hFile=0x1970, lpBuffer=0x231ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x231ff830, lpOverlapped=0x0 | out: lpBuffer=0x231ffb34*, lpNumberOfBytesWritten=0x231ff830*=0x428, lpOverlapped=0x0) returned 1 [0174.317] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.317] ReadFile (in: hFile=0x1970, lpBuffer=0x4250000, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x231ff61c*=0x16f8, lpOverlapped=0x0) returned 1 [0174.317] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xffffe908, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.317] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4250000, cbInput=0x16f8, pPaddingInfo=0x0, pbIV=0x231ff848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x231ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x231ff848, pbOutput=0x4250000, pcbResult=0x231ff618) returned 0x0 [0174.317] WriteFile (in: hFile=0x1970, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x231ff61c*=0x1700, lpOverlapped=0x0) returned 1 [0174.317] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x231ff60c | out: lpNewFilePointer=0x0) returned 1 [0174.318] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.318] WriteFile (in: hFile=0x1970, lpBuffer=0x231ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x231ff61c, lpOverlapped=0x0 | out: lpBuffer=0x231ff83c*, lpNumberOfBytesWritten=0x231ff61c*=0x8, lpOverlapped=0x0) returned 1 [0174.318] SetFilePointerEx (in: hFile=0x1970, liDistanceToMove=0x1700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.318] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.318] CloseHandle (hObject=0x1970) returned 1 [0174.318] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.play")) returned 1 [0174.321] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2408 os_tid = 0x2414 [0174.324] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.324] ReadFile (in: hFile=0x1960, lpBuffer=0x28dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x28dbfb34*, lpNumberOfBytesRead=0x28dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.325] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.325] ReadFile (in: hFile=0x1960, lpBuffer=0x28dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x28dbfb34*, lpNumberOfBytesRead=0x28dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.326] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.328] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.328] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x28dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0174.328] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x28dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x28dbf828, pbKeyObject=0x0) returned 0x0 [0174.328] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28dbf500) returned 0x0 [0174.328] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.328] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28dbf500) returned 0x0 [0174.331] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.334] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.334] WriteFile (in: hFile=0x1960, lpBuffer=0x28dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28dbf830, lpOverlapped=0x0 | out: lpBuffer=0x28dbfb34*, lpNumberOfBytesWritten=0x28dbf830*=0x428, lpOverlapped=0x0) returned 1 [0174.334] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.334] ReadFile (in: hFile=0x1960, lpBuffer=0x4350000, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x28dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x28dbf61c*=0x175c, lpOverlapped=0x0) returned 1 [0174.334] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xffffe8a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.334] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4350000, cbInput=0x175c, pPaddingInfo=0x0, pbIV=0x28dbf848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x28dbf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x28dbf848, pbOutput=0x4350000, pcbResult=0x28dbf618) returned 0x0 [0174.334] WriteFile (in: hFile=0x1960, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x28dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x28dbf61c*=0x1760, lpOverlapped=0x0) returned 1 [0174.334] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dbf60c | out: lpNewFilePointer=0x0) returned 1 [0174.334] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.334] WriteFile (in: hFile=0x1960, lpBuffer=0x28dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x28dbf83c*, lpNumberOfBytesWritten=0x28dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.334] SetFilePointerEx (in: hFile=0x1960, liDistanceToMove=0x1760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.335] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.335] CloseHandle (hObject=0x1960) returned 1 [0174.335] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.play")) returned 1 [0174.338] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2409 os_tid = 0x2418 [0174.341] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.341] ReadFile (in: hFile=0x1950, lpBuffer=0x28effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28eff85c, lpOverlapped=0x0 | out: lpBuffer=0x28effb34*, lpNumberOfBytesRead=0x28eff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.342] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.342] ReadFile (in: hFile=0x1950, lpBuffer=0x28effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x28eff85c, lpOverlapped=0x0 | out: lpBuffer=0x28effb34*, lpNumberOfBytesRead=0x28eff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.342] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.344] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.344] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x28eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0174.344] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x28eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x28eff828, pbKeyObject=0x0) returned 0x0 [0174.344] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x28eff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x28eff500) returned 0x0 [0174.344] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.344] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x28eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x28eff500) returned 0x0 [0174.348] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.350] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.350] WriteFile (in: hFile=0x1950, lpBuffer=0x28effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x28eff830, lpOverlapped=0x0 | out: lpBuffer=0x28effb34*, lpNumberOfBytesWritten=0x28eff830*=0x428, lpOverlapped=0x0) returned 1 [0174.350] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.350] ReadFile (in: hFile=0x1950, lpBuffer=0x4450000, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x28eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x28eff61c*=0x203c, lpOverlapped=0x0) returned 1 [0174.351] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xffffdfc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.351] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4450000, cbInput=0x203c, pPaddingInfo=0x0, pbIV=0x28eff848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x28eff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x28eff848, pbOutput=0x4450000, pcbResult=0x28eff618) returned 0x0 [0174.351] WriteFile (in: hFile=0x1950, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x28eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x28eff61c*=0x2040, lpOverlapped=0x0) returned 1 [0174.351] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28eff60c | out: lpNewFilePointer=0x0) returned 1 [0174.351] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.351] WriteFile (in: hFile=0x1950, lpBuffer=0x28eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x28eff61c, lpOverlapped=0x0 | out: lpBuffer=0x28eff83c*, lpNumberOfBytesWritten=0x28eff61c*=0x8, lpOverlapped=0x0) returned 1 [0174.351] SetFilePointerEx (in: hFile=0x1950, liDistanceToMove=0x2040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.351] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.351] CloseHandle (hObject=0x1950) returned 1 [0174.351] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.play")) returned 1 [0174.354] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2410 os_tid = 0x241c [0174.357] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.357] ReadFile (in: hFile=0x1940, lpBuffer=0x2903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2903f85c, lpOverlapped=0x0 | out: lpBuffer=0x2903fb34*, lpNumberOfBytesRead=0x2903f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.359] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.359] ReadFile (in: hFile=0x1940, lpBuffer=0x2903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2903f85c, lpOverlapped=0x0 | out: lpBuffer=0x2903fb34*, lpNumberOfBytesRead=0x2903f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.359] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.361] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x2903f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0174.361] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x2903f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x2903f828, pbKeyObject=0x0) returned 0x0 [0174.361] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2903f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2903f500) returned 0x0 [0174.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.361] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2903f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2903f500) returned 0x0 [0174.364] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.366] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.367] WriteFile (in: hFile=0x1940, lpBuffer=0x2903fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2903f830, lpOverlapped=0x0 | out: lpBuffer=0x2903fb34*, lpNumberOfBytesWritten=0x2903f830*=0x428, lpOverlapped=0x0) returned 1 [0174.367] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.367] ReadFile (in: hFile=0x1940, lpBuffer=0x4550000, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x2903f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x2903f61c*=0x1350, lpOverlapped=0x0) returned 1 [0174.367] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xffffecb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.367] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4550000, cbInput=0x1350, pPaddingInfo=0x0, pbIV=0x2903f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x2903f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2903f848, pbOutput=0x4550000, pcbResult=0x2903f618) returned 0x0 [0174.367] WriteFile (in: hFile=0x1940, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2903f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x2903f61c*=0x1360, lpOverlapped=0x0) returned 1 [0174.367] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2903f60c | out: lpNewFilePointer=0x0) returned 1 [0174.367] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.367] WriteFile (in: hFile=0x1940, lpBuffer=0x2903f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2903f61c, lpOverlapped=0x0 | out: lpBuffer=0x2903f83c*, lpNumberOfBytesWritten=0x2903f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.367] SetFilePointerEx (in: hFile=0x1940, liDistanceToMove=0x1360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.367] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.367] CloseHandle (hObject=0x1940) returned 1 [0174.367] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.play")) returned 1 [0174.371] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2411 os_tid = 0x2420 [0174.374] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.374] ReadFile (in: hFile=0x1440, lpBuffer=0x2917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2917f85c, lpOverlapped=0x0 | out: lpBuffer=0x2917fb34*, lpNumberOfBytesRead=0x2917f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.376] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.376] ReadFile (in: hFile=0x1440, lpBuffer=0x2917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2917f85c, lpOverlapped=0x0 | out: lpBuffer=0x2917fb34*, lpNumberOfBytesRead=0x2917f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.376] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.377] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.378] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x2917f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0174.378] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x2917f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x2917f828, pbKeyObject=0x0) returned 0x0 [0174.378] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2917f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2917f500) returned 0x0 [0174.378] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.378] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2917f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2917f500) returned 0x0 [0174.381] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.383] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.384] WriteFile (in: hFile=0x1440, lpBuffer=0x2917fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2917f830, lpOverlapped=0x0 | out: lpBuffer=0x2917fb34*, lpNumberOfBytesWritten=0x2917f830*=0x428, lpOverlapped=0x0) returned 1 [0174.384] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.384] ReadFile (in: hFile=0x1440, lpBuffer=0x4650000, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x2917f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x2917f61c*=0x2b04, lpOverlapped=0x0) returned 1 [0174.384] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xffffd4fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.385] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4650000, cbInput=0x2b04, pPaddingInfo=0x0, pbIV=0x2917f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x2917f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2917f848, pbOutput=0x4650000, pcbResult=0x2917f618) returned 0x0 [0174.385] WriteFile (in: hFile=0x1440, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2917f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x2917f61c*=0x2b10, lpOverlapped=0x0) returned 1 [0174.385] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2917f60c | out: lpNewFilePointer=0x0) returned 1 [0174.385] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.385] WriteFile (in: hFile=0x1440, lpBuffer=0x2917f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2917f61c, lpOverlapped=0x0 | out: lpBuffer=0x2917f83c*, lpNumberOfBytesWritten=0x2917f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.385] SetFilePointerEx (in: hFile=0x1440, liDistanceToMove=0x2b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.385] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.385] CloseHandle (hObject=0x1440) returned 1 [0174.385] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.play")) returned 1 [0174.388] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2412 os_tid = 0x2424 [0174.392] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.392] ReadFile (in: hFile=0x1548, lpBuffer=0x292bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x292bf85c, lpOverlapped=0x0 | out: lpBuffer=0x292bfb34*, lpNumberOfBytesRead=0x292bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.393] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.393] ReadFile (in: hFile=0x1548, lpBuffer=0x292bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x292bf85c, lpOverlapped=0x0 | out: lpBuffer=0x292bfb34*, lpNumberOfBytesRead=0x292bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.393] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.395] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.395] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x292bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0174.395] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x292bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x292bf828, pbKeyObject=0x0) returned 0x0 [0174.395] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x292bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x292bf500) returned 0x0 [0174.395] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.396] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x292bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x292bf500) returned 0x0 [0174.399] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.401] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.401] WriteFile (in: hFile=0x1548, lpBuffer=0x292bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x292bf830, lpOverlapped=0x0 | out: lpBuffer=0x292bfb34*, lpNumberOfBytesWritten=0x292bf830*=0x428, lpOverlapped=0x0) returned 1 [0174.402] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.402] ReadFile (in: hFile=0x1548, lpBuffer=0x4750000, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x292bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x292bf61c*=0xd00, lpOverlapped=0x0) returned 1 [0174.402] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffff300, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.402] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4750000, cbInput=0xd00, pPaddingInfo=0x0, pbIV=0x292bf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x292bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x292bf848, pbOutput=0x4750000, pcbResult=0x292bf618) returned 0x0 [0174.402] WriteFile (in: hFile=0x1548, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x292bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x292bf61c*=0xd10, lpOverlapped=0x0) returned 1 [0174.402] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292bf60c | out: lpNewFilePointer=0x0) returned 1 [0174.402] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.402] WriteFile (in: hFile=0x1548, lpBuffer=0x292bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x292bf61c, lpOverlapped=0x0 | out: lpBuffer=0x292bf83c*, lpNumberOfBytesWritten=0x292bf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.402] SetFilePointerEx (in: hFile=0x1548, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.402] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.402] CloseHandle (hObject=0x1548) returned 1 [0174.405] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.406] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.play")) returned 1 [0174.408] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2413 os_tid = 0x2428 [0174.411] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.411] ReadFile (in: hFile=0x1574, lpBuffer=0x293ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x293ff85c, lpOverlapped=0x0 | out: lpBuffer=0x293ffb34*, lpNumberOfBytesRead=0x293ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.412] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.412] ReadFile (in: hFile=0x1574, lpBuffer=0x293ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x293ff85c, lpOverlapped=0x0 | out: lpBuffer=0x293ffb34*, lpNumberOfBytesRead=0x293ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.412] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.414] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.414] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x293ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0174.414] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x293ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x293ff828, pbKeyObject=0x0) returned 0x0 [0174.414] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x293ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x293ff500) returned 0x0 [0174.414] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.414] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x293ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x293ff500) returned 0x0 [0174.418] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.420] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.420] WriteFile (in: hFile=0x1574, lpBuffer=0x293ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x293ff830, lpOverlapped=0x0 | out: lpBuffer=0x293ffb34*, lpNumberOfBytesWritten=0x293ff830*=0x428, lpOverlapped=0x0) returned 1 [0174.420] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.420] ReadFile (in: hFile=0x1574, lpBuffer=0x4850000, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x293ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x293ff61c*=0x4fdc, lpOverlapped=0x0) returned 1 [0174.421] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xffffb024, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.421] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4850000, cbInput=0x4fdc, pPaddingInfo=0x0, pbIV=0x293ff848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x293ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x293ff848, pbOutput=0x4850000, pcbResult=0x293ff618) returned 0x0 [0174.421] WriteFile (in: hFile=0x1574, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x293ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x293ff61c*=0x4fe0, lpOverlapped=0x0) returned 1 [0174.421] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x293ff60c | out: lpNewFilePointer=0x0) returned 1 [0174.421] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.421] WriteFile (in: hFile=0x1574, lpBuffer=0x293ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x293ff61c, lpOverlapped=0x0 | out: lpBuffer=0x293ff83c*, lpNumberOfBytesWritten=0x293ff61c*=0x8, lpOverlapped=0x0) returned 1 [0174.421] SetFilePointerEx (in: hFile=0x1574, liDistanceToMove=0x4fe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.422] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.422] CloseHandle (hObject=0x1574) returned 1 [0174.422] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.play")) returned 1 [0174.424] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2414 os_tid = 0x242c [0174.427] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.427] ReadFile (in: hFile=0x8a4, lpBuffer=0x2953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2953f85c, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesRead=0x2953f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.429] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.429] ReadFile (in: hFile=0x8a4, lpBuffer=0x2953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2953f85c, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesRead=0x2953f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.431] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x2953f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0174.431] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x2953f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x2953f828, pbKeyObject=0x0) returned 0x0 [0174.431] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2953f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2953f500) returned 0x0 [0174.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.432] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2953f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2953f500) returned 0x0 [0174.435] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.437] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.437] WriteFile (in: hFile=0x8a4, lpBuffer=0x2953fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2953f830, lpOverlapped=0x0 | out: lpBuffer=0x2953fb34*, lpNumberOfBytesWritten=0x2953f830*=0x428, lpOverlapped=0x0) returned 1 [0174.437] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.437] ReadFile (in: hFile=0x8a4, lpBuffer=0x4950000, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x2953f61c*=0x24b8, lpOverlapped=0x0) returned 1 [0174.438] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xffffdb48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.438] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4950000, cbInput=0x24b8, pPaddingInfo=0x0, pbIV=0x2953f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x2953f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2953f848, pbOutput=0x4950000, pcbResult=0x2953f618) returned 0x0 [0174.438] WriteFile (in: hFile=0x8a4, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x2953f61c*=0x24c0, lpOverlapped=0x0) returned 1 [0174.438] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2953f60c | out: lpNewFilePointer=0x0) returned 1 [0174.438] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.438] WriteFile (in: hFile=0x8a4, lpBuffer=0x2953f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2953f61c, lpOverlapped=0x0 | out: lpBuffer=0x2953f83c*, lpNumberOfBytesWritten=0x2953f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.438] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x24c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.438] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.438] CloseHandle (hObject=0x8a4) returned 1 [0174.438] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.play")) returned 1 [0174.441] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2415 os_tid = 0x2430 [0174.444] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.444] ReadFile (in: hFile=0x1584, lpBuffer=0x2967fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2967f85c, lpOverlapped=0x0 | out: lpBuffer=0x2967fb34*, lpNumberOfBytesRead=0x2967f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.445] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.446] ReadFile (in: hFile=0x1584, lpBuffer=0x2967fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2967f85c, lpOverlapped=0x0 | out: lpBuffer=0x2967fb34*, lpNumberOfBytesRead=0x2967f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.446] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.447] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.448] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x2967f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0174.448] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x2967f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x2967f828, pbKeyObject=0x0) returned 0x0 [0174.448] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2967f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2967f500) returned 0x0 [0174.448] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.448] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2967f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2967f500) returned 0x0 [0174.451] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.453] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.453] WriteFile (in: hFile=0x1584, lpBuffer=0x2967fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2967f830, lpOverlapped=0x0 | out: lpBuffer=0x2967fb34*, lpNumberOfBytesWritten=0x2967f830*=0x428, lpOverlapped=0x0) returned 1 [0174.454] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.454] ReadFile (in: hFile=0x1584, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x2967f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x2967f61c*=0x1864, lpOverlapped=0x0) returned 1 [0174.454] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xffffe79c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.454] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4a50000, cbInput=0x1864, pPaddingInfo=0x0, pbIV=0x2967f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x2967f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2967f848, pbOutput=0x4a50000, pcbResult=0x2967f618) returned 0x0 [0174.454] WriteFile (in: hFile=0x1584, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2967f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x2967f61c*=0x1870, lpOverlapped=0x0) returned 1 [0174.455] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2967f60c | out: lpNewFilePointer=0x0) returned 1 [0174.455] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.455] WriteFile (in: hFile=0x1584, lpBuffer=0x2967f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2967f61c, lpOverlapped=0x0 | out: lpBuffer=0x2967f83c*, lpNumberOfBytesWritten=0x2967f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.455] SetFilePointerEx (in: hFile=0x1584, liDistanceToMove=0x1870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.455] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.455] CloseHandle (hObject=0x1584) returned 1 [0174.455] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.play")) returned 1 [0174.458] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2416 os_tid = 0x2434 [0174.461] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.461] ReadFile (in: hFile=0x16e0, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.462] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.462] ReadFile (in: hFile=0x16e0, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.462] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.464] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.464] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x297bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0174.464] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x297bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x297bf828, pbKeyObject=0x0) returned 0x0 [0174.464] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x297bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x297bf500) returned 0x0 [0174.465] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.465] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x297bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x297bf500) returned 0x0 [0174.468] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.470] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.470] WriteFile (in: hFile=0x16e0, lpBuffer=0x297bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x297bf830, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesWritten=0x297bf830*=0x428, lpOverlapped=0x0) returned 1 [0174.471] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.471] ReadFile (in: hFile=0x16e0, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x297bf61c*=0x4928, lpOverlapped=0x0) returned 1 [0174.471] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0xffffb6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.471] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4b50000, cbInput=0x4928, pPaddingInfo=0x0, pbIV=0x297bf848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x297bf618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x297bf848, pbOutput=0x4b50000, pcbResult=0x297bf618) returned 0x0 [0174.471] WriteFile (in: hFile=0x16e0, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x297bf61c*=0x4930, lpOverlapped=0x0) returned 1 [0174.472] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x297bf60c | out: lpNewFilePointer=0x0) returned 1 [0174.472] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.472] WriteFile (in: hFile=0x16e0, lpBuffer=0x297bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x297bf83c*, lpNumberOfBytesWritten=0x297bf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.472] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x4930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.472] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.472] CloseHandle (hObject=0x16e0) returned 1 [0174.472] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.play")) returned 1 [0174.633] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2417 os_tid = 0x2438 [0174.476] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.476] ReadFile (in: hFile=0x16d8, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.478] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.478] ReadFile (in: hFile=0x16d8, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.478] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0174.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0174.480] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x298ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0174.480] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x298ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x298ff828, pbKeyObject=0x0) returned 0x0 [0174.480] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x298ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x298ff500) returned 0x0 [0174.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0174.481] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x298ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x298ff500) returned 0x0 [0174.484] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.486] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.486] WriteFile (in: hFile=0x16d8, lpBuffer=0x298ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x298ff830, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesWritten=0x298ff830*=0x428, lpOverlapped=0x0) returned 1 [0174.486] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.486] ReadFile (in: hFile=0x16d8, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x298ff61c*=0x1424, lpOverlapped=0x0) returned 1 [0174.487] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0xffffebdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.487] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4c50000, cbInput=0x1424, pPaddingInfo=0x0, pbIV=0x298ff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x298ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x298ff848, pbOutput=0x4c50000, pcbResult=0x298ff618) returned 0x0 [0174.487] WriteFile (in: hFile=0x16d8, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x298ff61c*=0x1430, lpOverlapped=0x0) returned 1 [0174.487] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298ff60c | out: lpNewFilePointer=0x0) returned 1 [0174.487] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.487] WriteFile (in: hFile=0x16d8, lpBuffer=0x298ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x298ff83c*, lpNumberOfBytesWritten=0x298ff61c*=0x8, lpOverlapped=0x0) returned 1 [0174.487] SetFilePointerEx (in: hFile=0x16d8, liDistanceToMove=0x1430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.487] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.487] CloseHandle (hObject=0x16d8) returned 1 [0174.622] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0174.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.play")) returned 1 [0174.644] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2418 os_tid = 0x243c [0174.488] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.488] ReadFile (in: hFile=0x16d0, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.489] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.489] ReadFile (in: hFile=0x16d0, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.491] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0174.506] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0174.506] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x29a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0174.506] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x29a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x29a3f828, pbKeyObject=0x0) returned 0x0 [0174.506] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x29a3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x29a3f500) returned 0x0 [0174.506] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0174.506] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x29a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x29a3f500) returned 0x0 [0174.509] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.512] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.512] WriteFile (in: hFile=0x16d0, lpBuffer=0x29a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29a3f830, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesWritten=0x29a3f830*=0x428, lpOverlapped=0x0) returned 1 [0174.512] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.512] ReadFile (in: hFile=0x16d0, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x29a3f61c*=0x1560, lpOverlapped=0x0) returned 1 [0174.512] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0xffffeaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.512] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4d50000, cbInput=0x1560, pPaddingInfo=0x0, pbIV=0x29a3f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x29a3f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29a3f848, pbOutput=0x4d50000, pcbResult=0x29a3f618) returned 0x0 [0174.512] WriteFile (in: hFile=0x16d0, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x29a3f61c*=0x1570, lpOverlapped=0x0) returned 1 [0174.513] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29a3f60c | out: lpNewFilePointer=0x0) returned 1 [0174.513] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.513] WriteFile (in: hFile=0x16d0, lpBuffer=0x29a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29a3f83c*, lpNumberOfBytesWritten=0x29a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.513] SetFilePointerEx (in: hFile=0x16d0, liDistanceToMove=0x1570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.513] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.513] CloseHandle (hObject=0x16d0) returned 1 [0174.626] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0174.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.play")) returned 1 [0174.641] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2419 os_tid = 0x2440 [0174.513] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.513] ReadFile (in: hFile=0x16c8, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.515] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.515] ReadFile (in: hFile=0x16c8, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.515] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0174.517] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0174.517] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x29b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0174.517] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x29b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x29b7f828, pbKeyObject=0x0) returned 0x0 [0174.517] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x29b7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x29b7f500) returned 0x0 [0174.517] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0174.517] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x29b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x29b7f500) returned 0x0 [0174.520] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.523] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.523] WriteFile (in: hFile=0x16c8, lpBuffer=0x29b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29b7f830, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesWritten=0x29b7f830*=0x428, lpOverlapped=0x0) returned 1 [0174.523] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.523] ReadFile (in: hFile=0x16c8, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x29b7f61c*=0x1034, lpOverlapped=0x0) returned 1 [0174.523] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0xffffefcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.523] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x4e50000, cbInput=0x1034, pPaddingInfo=0x0, pbIV=0x29b7f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x29b7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x29b7f848, pbOutput=0x4e50000, pcbResult=0x29b7f618) returned 0x0 [0174.523] WriteFile (in: hFile=0x16c8, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x29b7f61c*=0x1040, lpOverlapped=0x0) returned 1 [0174.523] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29b7f60c | out: lpNewFilePointer=0x0) returned 1 [0174.523] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.523] WriteFile (in: hFile=0x16c8, lpBuffer=0x29b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x29b7f83c*, lpNumberOfBytesWritten=0x29b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.524] SetFilePointerEx (in: hFile=0x16c8, liDistanceToMove=0x1040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.524] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0174.524] CloseHandle (hObject=0x16c8) returned 1 [0174.629] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb110000 [0174.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.play")) returned 1 [0174.637] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2420 os_tid = 0x2444 [0174.535] GetLastError () returned 0x57 [0174.535] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e5678 [0174.535] SetLastError (dwErrCode=0x57) [0174.536] IcmpCreateFile () returned 0x7cd2e8 [0174.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ef0 [0174.536] IcmpSendEcho2 (IcmpHandle=0x7cd2e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4100a8c0, RequestData=0x125ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ef0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2421 os_tid = 0x2448 [0174.537] GetLastError () returned 0x57 [0174.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e5a00 [0174.538] SetLastError (dwErrCode=0x57) [0174.538] IcmpCreateFile () returned 0x7cd320 [0174.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6f40 [0174.538] IcmpSendEcho2 (IcmpHandle=0x7cd320, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4200a8c0, RequestData=0xb04ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6f40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2422 os_tid = 0x244c [0174.539] GetLastError () returned 0x57 [0174.539] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e5d88 [0174.539] SetLastError (dwErrCode=0x57) [0174.539] IcmpCreateFile () returned 0x7cc7f8 [0174.539] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6f90 [0174.539] IcmpSendEcho2 (IcmpHandle=0x7cc7f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4300a8c0, RequestData=0xb31ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6f90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2423 os_tid = 0x2450 [0174.540] GetLastError () returned 0x57 [0174.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e6110 [0174.540] SetLastError (dwErrCode=0x57) [0174.540] IcmpCreateFile () returned 0x7cc830 [0174.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6fe0 [0174.540] IcmpSendEcho2 (IcmpHandle=0x7cc830, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4400a8c0, RequestData=0xb41ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6fe0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2424 os_tid = 0x2454 [0174.541] GetLastError () returned 0x57 [0174.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e6498 [0174.542] SetLastError (dwErrCode=0x57) [0174.542] IcmpCreateFile () returned 0x7cc868 [0174.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7030 [0174.542] IcmpSendEcho2 (IcmpHandle=0x7cc868, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4500a8c0, RequestData=0xf6cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7030, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2425 os_tid = 0x2458 [0174.543] GetLastError () returned 0x57 [0174.543] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e6820 [0174.543] SetLastError (dwErrCode=0x57) [0174.543] IcmpCreateFile () returned 0x7cc8a0 [0174.543] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7080 [0174.543] IcmpSendEcho2 (IcmpHandle=0x7cc8a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4600a8c0, RequestData=0xf7cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7080, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2426 os_tid = 0x245c [0174.544] GetLastError () returned 0x57 [0174.544] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e6ba8 [0174.544] SetLastError (dwErrCode=0x57) [0174.544] IcmpCreateFile () returned 0x7cc8d8 [0174.544] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a70d0 [0174.544] IcmpSendEcho2 (IcmpHandle=0x7cc8d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4700a8c0, RequestData=0x11f8ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a70d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2427 os_tid = 0x2460 [0174.545] GetLastError () returned 0x57 [0174.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e6f30 [0174.545] SetLastError (dwErrCode=0x57) [0174.545] IcmpCreateFile () returned 0x7cc910 [0174.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7170 [0174.545] IcmpSendEcho2 (IcmpHandle=0x7cc910, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4800a8c0, RequestData=0x1208ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7170, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2428 os_tid = 0x2464 [0174.546] GetLastError () returned 0x57 [0174.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e72b8 [0174.546] SetLastError (dwErrCode=0x57) [0174.546] IcmpCreateFile () returned 0x7cc948 [0174.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a71c0 [0174.547] IcmpSendEcho2 (IcmpHandle=0x7cc948, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4900a8c0, RequestData=0x1218ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a71c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2429 os_tid = 0x2468 [0174.547] GetLastError () returned 0x57 [0174.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e7640 [0174.548] SetLastError (dwErrCode=0x57) [0174.548] IcmpCreateFile () returned 0x7cc980 [0174.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7210 [0174.548] IcmpSendEcho2 (IcmpHandle=0x7cc980, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4a00a8c0, RequestData=0x1228ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7210, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2430 os_tid = 0x246c [0174.549] GetLastError () returned 0x57 [0174.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e79c8 [0174.549] SetLastError (dwErrCode=0x57) [0174.549] IcmpCreateFile () returned 0x7cc9b8 [0174.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7260 [0174.549] IcmpSendEcho2 (IcmpHandle=0x7cc9b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4b00a8c0, RequestData=0x1238ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7260, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2431 os_tid = 0x2470 [0174.550] GetLastError () returned 0x57 [0174.550] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e7d50 [0174.550] SetLastError (dwErrCode=0x57) [0174.550] IcmpCreateFile () returned 0x7cc9f0 [0174.550] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a72b0 [0174.550] IcmpSendEcho2 (IcmpHandle=0x7cc9f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4c00a8c0, RequestData=0x124cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a72b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2432 os_tid = 0x2474 [0174.551] GetLastError () returned 0x57 [0174.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e0fd8 [0174.551] SetLastError (dwErrCode=0x57) [0174.551] IcmpCreateFile () returned 0x7cca28 [0174.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a7300 [0174.551] IcmpSendEcho2 (IcmpHandle=0x7cca28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4d00a8c0, RequestData=0x1404ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a7300, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2433 os_tid = 0x2478 [0174.552] GetLastError () returned 0x57 [0174.552] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e1360 [0174.553] SetLastError (dwErrCode=0x57) [0174.553] IcmpCreateFile () returned 0x7cca60 [0174.553] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6db0 [0174.553] IcmpSendEcho2 (IcmpHandle=0x7cca60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4e00a8c0, RequestData=0x2097ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6db0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2434 os_tid = 0x247c [0174.554] GetLastError () returned 0x57 [0174.554] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e16e8 [0174.554] SetLastError (dwErrCode=0x57) [0174.554] IcmpCreateFile () returned 0x7cca98 [0174.554] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6e00 [0174.554] IcmpSendEcho2 (IcmpHandle=0x7cca98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4f00a8c0, RequestData=0x20dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6e00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2435 os_tid = 0x2480 [0174.555] GetLastError () returned 0x57 [0174.555] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e1a70 [0174.555] SetLastError (dwErrCode=0x57) [0174.555] IcmpCreateFile () returned 0x7ccad0 [0174.555] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6e50 [0174.555] IcmpSendEcho2 (IcmpHandle=0x7ccad0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5000a8c0, RequestData=0x20fbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6e50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2436 os_tid = 0x2484 [0174.556] GetLastError () returned 0x57 [0174.556] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e1df8 [0174.557] SetLastError (dwErrCode=0x57) [0174.557] IcmpCreateFile () returned 0x7cc408 [0174.557] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ea0 [0174.557] IcmpSendEcho2 (IcmpHandle=0x7cc408, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5100a8c0, RequestData=0x210bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ea0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2437 os_tid = 0x2488 [0174.558] GetLastError () returned 0x57 [0174.558] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e2180 [0174.558] SetLastError (dwErrCode=0x57) [0174.558] IcmpCreateFile () returned 0x7cc440 [0174.558] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6630 [0174.558] IcmpSendEcho2 (IcmpHandle=0x7cc440, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5200a8c0, RequestData=0x2147ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6630, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2438 os_tid = 0x248c [0174.559] GetLastError () returned 0x57 [0174.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e2508 [0174.559] SetLastError (dwErrCode=0x57) [0174.559] IcmpCreateFile () returned 0x7cc478 [0174.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6680 [0174.559] IcmpSendEcho2 (IcmpHandle=0x7cc478, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5300a8c0, RequestData=0x2157ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6680, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2439 os_tid = 0x2490 [0174.560] GetLastError () returned 0x57 [0174.560] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e2890 [0174.560] SetLastError (dwErrCode=0x57) [0174.560] IcmpCreateFile () returned 0x7cc4b0 [0174.560] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a66d0 [0174.560] IcmpSendEcho2 (IcmpHandle=0x7cc4b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5400a8c0, RequestData=0x2167ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a66d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2440 os_tid = 0x2494 [0174.561] GetLastError () returned 0x57 [0174.561] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e2c18 [0174.562] SetLastError (dwErrCode=0x57) [0174.562] IcmpCreateFile () returned 0x7cc4e8 [0174.562] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6720 [0174.562] IcmpSendEcho2 (IcmpHandle=0x7cc4e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5500a8c0, RequestData=0x217bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6720, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2441 os_tid = 0x2498 [0174.563] GetLastError () returned 0x57 [0174.563] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e2fa0 [0174.563] SetLastError (dwErrCode=0x57) [0174.563] IcmpCreateFile () returned 0x7cc520 [0174.563] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6770 [0174.563] IcmpSendEcho2 (IcmpHandle=0x7cc520, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5600a8c0, RequestData=0x218fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6770, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2442 os_tid = 0x249c [0174.564] GetLastError () returned 0x57 [0174.564] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e3328 [0174.564] SetLastError (dwErrCode=0x57) [0174.564] IcmpCreateFile () returned 0x7cc558 [0174.564] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a67c0 [0174.564] IcmpSendEcho2 (IcmpHandle=0x7cc558, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5700a8c0, RequestData=0x29cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a67c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2443 os_tid = 0x24a0 [0174.565] GetLastError () returned 0x57 [0174.565] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e36b0 [0174.565] SetLastError (dwErrCode=0x57) [0174.565] IcmpCreateFile () returned 0x7cc590 [0174.565] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6810 [0174.565] IcmpSendEcho2 (IcmpHandle=0x7cc590, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5800a8c0, RequestData=0x29dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6810, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2444 os_tid = 0x24a4 [0174.566] GetLastError () returned 0x57 [0174.566] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e3a38 [0174.567] SetLastError (dwErrCode=0x57) [0174.567] IcmpCreateFile () returned 0x7cc5c8 [0174.567] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6860 [0174.567] IcmpSendEcho2 (IcmpHandle=0x7cc5c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5900a8c0, RequestData=0x29f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6860, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2445 os_tid = 0x24a8 [0174.568] GetLastError () returned 0x57 [0174.568] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e3dc0 [0174.568] SetLastError (dwErrCode=0x57) [0174.568] IcmpCreateFile () returned 0x7cc600 [0174.568] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a68b0 [0174.568] IcmpSendEcho2 (IcmpHandle=0x7cc600, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5a00a8c0, RequestData=0x2a07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a68b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2446 os_tid = 0x24ac [0174.569] GetLastError () returned 0x57 [0174.569] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e4148 [0174.569] SetLastError (dwErrCode=0x57) [0174.569] IcmpCreateFile () returned 0x7cc638 [0174.569] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6900 [0174.569] IcmpSendEcho2 (IcmpHandle=0x7cc638, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5b00a8c0, RequestData=0x2a1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6900, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2447 os_tid = 0x24b0 [0174.570] GetLastError () returned 0x57 [0174.570] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e44d0 [0174.570] SetLastError (dwErrCode=0x57) [0174.570] IcmpCreateFile () returned 0x7cc670 [0174.570] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6950 [0174.570] IcmpSendEcho2 (IcmpHandle=0x7cc670, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5c00a8c0, RequestData=0x2a2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6950, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2448 os_tid = 0x24b4 [0174.571] GetLastError () returned 0x57 [0174.571] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e4be0 [0174.571] SetLastError (dwErrCode=0x57) [0174.572] IcmpCreateFile () returned 0x7cc6a8 [0174.572] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a69a0 [0174.572] IcmpSendEcho2 (IcmpHandle=0x7cc6a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5d00a8c0, RequestData=0x2a43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a69a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2449 os_tid = 0x24b8 [0174.572] GetLastError () returned 0x57 [0174.573] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e4f68 [0174.573] SetLastError (dwErrCode=0x57) [0174.573] IcmpCreateFile () returned 0x7cc6e0 [0174.573] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a69f0 [0174.573] IcmpSendEcho2 (IcmpHandle=0x7cc6e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5e00a8c0, RequestData=0x2a57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a69f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2450 os_tid = 0x24bc [0174.574] GetLastError () returned 0x57 [0174.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e52f0 [0174.574] SetLastError (dwErrCode=0x57) [0174.574] IcmpCreateFile () returned 0x7cc718 [0174.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6a40 [0174.574] IcmpSendEcho2 (IcmpHandle=0x7cc718, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5f00a8c0, RequestData=0x2a6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6a40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2451 os_tid = 0x24c0 [0174.575] GetLastError () returned 0x57 [0174.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ec778 [0174.575] SetLastError (dwErrCode=0x57) [0174.575] IcmpCreateFile () returned 0x7cc750 [0174.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6a90 [0174.575] IcmpSendEcho2 (IcmpHandle=0x7cc750, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6000a8c0, RequestData=0x2a7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6a90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2452 os_tid = 0x24c4 [0174.576] GetLastError () returned 0x57 [0174.576] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ecb00 [0174.576] SetLastError (dwErrCode=0x57) [0174.576] IcmpCreateFile () returned 0x7cc788 [0174.576] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6ae0 [0174.576] IcmpSendEcho2 (IcmpHandle=0x7cc788, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6100a8c0, RequestData=0x2a93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6ae0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2453 os_tid = 0x24c8 [0174.577] GetLastError () returned 0x57 [0174.577] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ece88 [0174.577] SetLastError (dwErrCode=0x57) [0174.578] IcmpCreateFile () returned 0x7cc7c0 [0174.578] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6b30 [0174.578] IcmpSendEcho2 (IcmpHandle=0x7cc7c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6200a8c0, RequestData=0x2aa7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6b30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2454 os_tid = 0x24cc [0174.578] GetLastError () returned 0x57 [0174.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed210 [0174.579] SetLastError (dwErrCode=0x57) [0174.579] IcmpCreateFile () returned 0x75d658 [0174.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6b80 [0174.579] IcmpSendEcho2 (IcmpHandle=0x75d658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6300a8c0, RequestData=0x2abbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6b80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2455 os_tid = 0x24d0 [0174.580] GetLastError () returned 0x57 [0174.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed598 [0174.580] SetLastError (dwErrCode=0x57) [0174.580] IcmpCreateFile () returned 0x75d690 [0174.580] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6bd0 [0174.580] IcmpSendEcho2 (IcmpHandle=0x75d690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6400a8c0, RequestData=0x2acfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6bd0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2456 os_tid = 0x24d4 [0174.581] GetLastError () returned 0x57 [0174.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ed920 [0174.581] SetLastError (dwErrCode=0x57) [0174.581] IcmpCreateFile () returned 0x75d6c8 [0174.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6c20 [0174.581] IcmpSendEcho2 (IcmpHandle=0x75d6c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6500a8c0, RequestData=0x2ae3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6c20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2457 os_tid = 0x24d8 [0174.582] GetLastError () returned 0x57 [0174.582] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7edca8 [0174.582] SetLastError (dwErrCode=0x57) [0174.582] IcmpCreateFile () returned 0x75d700 [0174.582] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6c70 [0174.582] IcmpSendEcho2 (IcmpHandle=0x75d700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6600a8c0, RequestData=0x2af7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6c70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2458 os_tid = 0x24dc [0174.583] GetLastError () returned 0x57 [0174.583] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ee030 [0174.583] SetLastError (dwErrCode=0x57) [0174.584] IcmpCreateFile () returned 0x75d070 [0174.584] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6cc0 [0174.584] IcmpSendEcho2 (IcmpHandle=0x75d070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6700a8c0, RequestData=0x2b0bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6cc0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2459 os_tid = 0x24e0 [0174.585] GetLastError () returned 0x57 [0174.585] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ee3b8 [0174.585] SetLastError (dwErrCode=0x57) [0174.585] IcmpCreateFile () returned 0x75d0a8 [0174.585] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6d10 [0174.585] IcmpSendEcho2 (IcmpHandle=0x75d0a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6800a8c0, RequestData=0x2b1fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6d10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2460 os_tid = 0x24e4 [0174.586] GetLastError () returned 0x57 [0174.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ee740 [0174.586] SetLastError (dwErrCode=0x57) [0174.586] IcmpCreateFile () returned 0x75d0e0 [0174.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6d60 [0174.586] IcmpSendEcho2 (IcmpHandle=0x75d0e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6900a8c0, RequestData=0x2b33ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6d60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2461 os_tid = 0x24e8 [0174.587] GetLastError () returned 0x57 [0174.587] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eeac8 [0174.587] SetLastError (dwErrCode=0x57) [0174.587] IcmpCreateFile () returned 0x7f5950 [0174.587] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a63b0 [0174.587] IcmpSendEcho2 (IcmpHandle=0x7f5950, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6a00a8c0, RequestData=0x2b47ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a63b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2462 os_tid = 0x24ec [0174.615] GetLastError () returned 0x57 [0174.615] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eee50 [0174.615] SetLastError (dwErrCode=0x57) [0174.615] IcmpCreateFile () returned 0x7f5aa0 [0174.615] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6400 [0174.615] IcmpSendEcho2 (IcmpHandle=0x7f5aa0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6b00a8c0, RequestData=0x2b5bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6400, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2463 os_tid = 0x24f0 [0174.616] GetLastError () returned 0x57 [0174.617] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e80d8 [0174.617] SetLastError (dwErrCode=0x57) [0174.617] IcmpCreateFile () returned 0x7f5ad8 [0174.617] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6450 [0174.617] IcmpSendEcho2 (IcmpHandle=0x7f5ad8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6c00a8c0, RequestData=0xfdff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6450, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2464 os_tid = 0x24f4 [0174.618] GetLastError () returned 0x57 [0174.618] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e8460 [0174.618] SetLastError (dwErrCode=0x57) [0174.618] IcmpCreateFile () returned 0x7f5b10 [0174.618] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a64a0 [0174.618] IcmpSendEcho2 (IcmpHandle=0x7f5b10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6d00a8c0, RequestData=0x21d3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a64a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2465 os_tid = 0x24f8 [0174.619] GetLastError () returned 0x57 [0174.619] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e87e8 [0174.620] SetLastError (dwErrCode=0x57) [0174.620] IcmpCreateFile () returned 0x7f5b48 [0174.620] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a64f0 [0174.620] IcmpSendEcho2 (IcmpHandle=0x7f5b48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6e00a8c0, RequestData=0x21e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a64f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2466 os_tid = 0x24fc [0174.621] GetLastError () returned 0x57 [0174.621] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e8b70 [0174.631] SetLastError (dwErrCode=0x57) [0174.731] IcmpCreateFile () returned 0x7f5b80 [0174.731] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6540 [0174.731] IcmpSendEcho2 (IcmpHandle=0x7f5b80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6f00a8c0, RequestData=0x21f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6540, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2467 os_tid = 0x2500 [0174.743] GetLastError () returned 0x57 [0174.743] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e8ef8 [0174.744] SetLastError (dwErrCode=0x57) [0174.744] IcmpCreateFile () returned 0x7f5bb8 [0174.744] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a6590 [0174.744] IcmpSendEcho2 (IcmpHandle=0x7f5bb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7000a8c0, RequestData=0x2207ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a6590, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2468 os_tid = 0x2504 [0174.745] GetLastError () returned 0x57 [0174.745] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e9280 [0174.746] SetLastError (dwErrCode=0x57) [0174.746] IcmpCreateFile () returned 0x7f5bf0 [0174.746] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7a65e0 [0174.746] IcmpSendEcho2 (IcmpHandle=0x7f5bf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7100a8c0, RequestData=0x230fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7a65e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2469 os_tid = 0x2508 [0174.747] GetLastError () returned 0x57 [0174.747] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e9608 [0174.747] SetLastError (dwErrCode=0x57) [0174.747] IcmpCreateFile () returned 0x7f5c28 [0174.747] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73dfb8 [0174.747] IcmpSendEcho2 (IcmpHandle=0x7f5c28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7200a8c0, RequestData=0x231fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73dfb8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2470 os_tid = 0x250c [0174.748] GetLastError () returned 0x57 [0174.748] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e9990 [0174.749] SetLastError (dwErrCode=0x57) [0174.749] IcmpCreateFile () returned 0x7f5c60 [0174.749] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e058 [0174.749] IcmpSendEcho2 (IcmpHandle=0x7f5c60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7300a8c0, RequestData=0x28dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e058, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2471 os_tid = 0x2510 [0174.750] GetLastError () returned 0x57 [0174.750] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7e9d18 [0174.750] SetLastError (dwErrCode=0x57) [0174.750] IcmpCreateFile () returned 0x7f5c98 [0174.750] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x73e0a8 [0174.750] IcmpSendEcho2 (IcmpHandle=0x7f5c98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7400a8c0, RequestData=0x28efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x73e0a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2472 os_tid = 0x2514 [0174.751] GetLastError () returned 0x57 [0174.751] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ea0a0 [0174.752] SetLastError (dwErrCode=0x57) [0174.752] IcmpCreateFile () returned 0x7f5cd0 [0174.752] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfd98 [0174.752] IcmpSendEcho2 (IcmpHandle=0x7f5cd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7500a8c0, RequestData=0x2903ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfd98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2473 os_tid = 0x2518 [0174.753] GetLastError () returned 0x57 [0174.753] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ec068 [0174.754] SetLastError (dwErrCode=0x57) [0174.754] IcmpCreateFile () returned 0x7f5988 [0174.754] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfde8 [0174.754] IcmpSendEcho2 (IcmpHandle=0x7f5988, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7600a8c0, RequestData=0x2917ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfde8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2474 os_tid = 0x251c [0174.755] GetLastError () returned 0x57 [0174.755] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb958 [0174.755] SetLastError (dwErrCode=0x57) [0174.755] IcmpCreateFile () returned 0x7f5d08 [0174.755] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfed8 [0174.755] IcmpSendEcho2 (IcmpHandle=0x7f5d08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7700a8c0, RequestData=0x292bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfed8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2475 os_tid = 0x2520 [0174.756] GetLastError () returned 0x57 [0174.757] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ec3f0 [0174.757] SetLastError (dwErrCode=0x57) [0174.757] IcmpCreateFile () returned 0x7f59c0 [0174.757] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6bc0 [0174.757] IcmpSendEcho2 (IcmpHandle=0x7f59c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7800a8c0, RequestData=0x293fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6bc0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2476 os_tid = 0x2524 [0174.758] GetLastError () returned 0x57 [0174.758] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ea428 [0174.759] SetLastError (dwErrCode=0x57) [0174.759] IcmpCreateFile () returned 0x7f58e0 [0174.759] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7020 [0174.759] IcmpSendEcho2 (IcmpHandle=0x7f58e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7900a8c0, RequestData=0x2953ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7020, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2477 os_tid = 0x2528 [0174.760] GetLastError () returned 0x57 [0174.760] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ea7b0 [0174.760] SetLastError (dwErrCode=0x57) [0174.760] IcmpCreateFile () returned 0x7f5918 [0174.760] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7070 [0174.760] IcmpSendEcho2 (IcmpHandle=0x7f5918, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7a00a8c0, RequestData=0x2967ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7070, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2478 os_tid = 0x252c [0174.761] GetLastError () returned 0x57 [0174.762] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eab38 [0174.762] SetLastError (dwErrCode=0x57) [0174.762] IcmpCreateFile () returned 0x7f59f8 [0174.762] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f70c0 [0174.762] IcmpSendEcho2 (IcmpHandle=0x7f59f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7b00a8c0, RequestData=0x2cc7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f70c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2479 os_tid = 0x2530 [0174.763] GetLastError () returned 0x57 [0174.763] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eaec0 [0174.763] SetLastError (dwErrCode=0x57) [0174.763] IcmpCreateFile () returned 0x7f5a30 [0174.763] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7110 [0174.764] IcmpSendEcho2 (IcmpHandle=0x7f5a30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7c00a8c0, RequestData=0x2cd7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7110, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2480 os_tid = 0x2534 [0174.765] GetLastError () returned 0x57 [0174.765] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb248 [0174.765] SetLastError (dwErrCode=0x57) [0174.765] IcmpCreateFile () returned 0x7f5a68 [0174.765] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7160 [0174.765] IcmpSendEcho2 (IcmpHandle=0x7f5a68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7d00a8c0, RequestData=0x2cebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7160, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2481 os_tid = 0x2538 [0174.766] GetLastError () returned 0x57 [0174.766] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7eb5d0 [0174.767] SetLastError (dwErrCode=0x57) [0174.767] IcmpCreateFile () returned 0x7f5d40 [0174.767] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f71b0 [0174.767] IcmpSendEcho2 (IcmpHandle=0x7f5d40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7e00a8c0, RequestData=0x2cffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f71b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2482 os_tid = 0x253c [0174.768] GetLastError () returned 0x57 [0174.768] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ebce0 [0174.768] SetLastError (dwErrCode=0x57) [0174.768] IcmpCreateFile () returned 0x7f5d78 [0174.768] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6800 [0174.768] IcmpSendEcho2 (IcmpHandle=0x7f5d78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7f00a8c0, RequestData=0x2d13ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6800, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2483 os_tid = 0x2540 [0174.770] GetLastError () returned 0x57 [0174.770] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef560 [0174.770] SetLastError (dwErrCode=0x57) [0174.770] IcmpCreateFile () returned 0x7f5db0 [0174.770] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6850 [0174.770] IcmpSendEcho2 (IcmpHandle=0x7f5db0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8000a8c0, RequestData=0x2d27ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6850, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2484 os_tid = 0x2544 [0174.773] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.773] ReadFile (in: hFile=0x7dc, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.775] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.775] ReadFile (in: hFile=0x7dc, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.775] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.780] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.780] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0174.780] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0174.780] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0174.780] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.780] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0174.785] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.789] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.789] WriteFile (in: hFile=0x7dc, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0174.789] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.789] ReadFile (in: hFile=0x7dc, lpBuffer=0x2750000, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x141cf61c*=0xb60, lpOverlapped=0x0) returned 1 [0174.789] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff4a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.790] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2750000, cbInput=0xb60, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x141cf848, pbOutput=0x2750000, pcbResult=0x141cf618) returned 0x0 [0174.790] WriteFile (in: hFile=0x7dc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x141cf61c*=0xb70, lpOverlapped=0x0) returned 1 [0174.790] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0174.790] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.790] WriteFile (in: hFile=0x7dc, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.790] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xb70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.791] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0174.791] CloseHandle (hObject=0x7dc) returned 1 [0174.791] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.play")) returned 1 [0174.796] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2485 os_tid = 0x2548 [0174.842] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.842] ReadFile (in: hFile=0x1878, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.843] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.843] ReadFile (in: hFile=0x1878, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0174.843] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.848] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.848] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x297bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0174.848] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x297bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x297bf828, pbKeyObject=0x0) returned 0x0 [0174.848] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x297bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x297bf500) returned 0x0 [0174.848] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.848] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x297bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x297bf500) returned 0x0 [0174.853] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.856] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.856] WriteFile (in: hFile=0x1878, lpBuffer=0x297bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x297bf830, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesWritten=0x297bf830*=0x428, lpOverlapped=0x0) returned 1 [0174.857] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.857] ReadFile (in: hFile=0x1878, lpBuffer=0x2850000, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x297bf61c*=0x7c44, lpOverlapped=0x0) returned 1 [0174.867] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xffff83bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.867] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2850000, cbInput=0x7c44, pPaddingInfo=0x0, pbIV=0x297bf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x297bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x297bf848, pbOutput=0x2850000, pcbResult=0x297bf618) returned 0x0 [0174.867] WriteFile (in: hFile=0x1878, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x297bf61c*=0x7c50, lpOverlapped=0x0) returned 1 [0174.867] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x297bf60c | out: lpNewFilePointer=0x0) returned 1 [0174.867] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.867] WriteFile (in: hFile=0x1878, lpBuffer=0x297bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x297bf83c*, lpNumberOfBytesWritten=0x297bf61c*=0x8, lpOverlapped=0x0) returned 1 [0174.867] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x7c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.867] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0174.867] CloseHandle (hObject=0x1878) returned 1 [0174.868] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.play")) returned 1 [0174.873] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2486 os_tid = 0x254c [0174.891] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.915] ReadFile (in: hFile=0x1870, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.917] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.917] ReadFile (in: hFile=0x1870, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0174.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.922] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.922] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x298ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0174.922] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x298ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x298ff828, pbKeyObject=0x0) returned 0x0 [0174.922] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x298ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x298ff500) returned 0x0 [0174.922] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.922] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x298ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x298ff500) returned 0x0 [0174.927] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.931] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.931] WriteFile (in: hFile=0x1870, lpBuffer=0x298ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x298ff830, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesWritten=0x298ff830*=0x428, lpOverlapped=0x0) returned 1 [0174.932] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.932] ReadFile (in: hFile=0x1870, lpBuffer=0x2950000, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x298ff61c*=0x43b4, lpOverlapped=0x0) returned 1 [0174.933] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xffffbc4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.933] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2950000, cbInput=0x43b4, pPaddingInfo=0x0, pbIV=0x298ff848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x298ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x298ff848, pbOutput=0x2950000, pcbResult=0x298ff618) returned 0x0 [0174.933] WriteFile (in: hFile=0x1870, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x298ff61c*=0x43c0, lpOverlapped=0x0) returned 1 [0174.933] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298ff60c | out: lpNewFilePointer=0x0) returned 1 [0174.933] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.933] WriteFile (in: hFile=0x1870, lpBuffer=0x298ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x298ff83c*, lpNumberOfBytesWritten=0x298ff61c*=0x8, lpOverlapped=0x0) returned 1 [0174.933] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x43c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.933] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0174.933] CloseHandle (hObject=0x1870) returned 1 [0174.934] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.play")) returned 1 [0174.938] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2487 os_tid = 0x2550 [0174.943] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.943] ReadFile (in: hFile=0x1860, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.945] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.945] ReadFile (in: hFile=0x1860, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.945] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.948] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x29a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0174.948] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x29a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x29a3f828, pbKeyObject=0x0) returned 0x0 [0174.948] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29a3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29a3f500) returned 0x0 [0174.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.949] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29a3f500) returned 0x0 [0174.954] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.957] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.957] WriteFile (in: hFile=0x1860, lpBuffer=0x29a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29a3f830, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesWritten=0x29a3f830*=0x428, lpOverlapped=0x0) returned 1 [0174.958] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.958] ReadFile (in: hFile=0x1860, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x29a3f61c*=0x1cd8, lpOverlapped=0x0) returned 1 [0174.959] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xffffe328, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.959] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2a50000, cbInput=0x1cd8, pPaddingInfo=0x0, pbIV=0x29a3f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x29a3f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x29a3f848, pbOutput=0x2a50000, pcbResult=0x29a3f618) returned 0x0 [0174.959] WriteFile (in: hFile=0x1860, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x29a3f61c*=0x1ce0, lpOverlapped=0x0) returned 1 [0174.960] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29a3f60c | out: lpNewFilePointer=0x0) returned 1 [0174.960] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.960] WriteFile (in: hFile=0x1860, lpBuffer=0x29a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29a3f83c*, lpNumberOfBytesWritten=0x29a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.960] SetFilePointerEx (in: hFile=0x1860, liDistanceToMove=0x1ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.960] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0174.960] CloseHandle (hObject=0x1860) returned 1 [0174.960] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.963] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.play")) returned 1 [0174.964] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2488 os_tid = 0x2554 [0174.969] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.969] ReadFile (in: hFile=0x1850, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.971] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.971] ReadFile (in: hFile=0x1850, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0174.972] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0174.975] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0174.975] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x29b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0174.975] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x29b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x29b7f828, pbKeyObject=0x0) returned 0x0 [0174.975] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29b7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29b7f500) returned 0x0 [0174.975] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0174.975] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29b7f500) returned 0x0 [0174.980] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.984] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.984] WriteFile (in: hFile=0x1850, lpBuffer=0x29b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29b7f830, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesWritten=0x29b7f830*=0x428, lpOverlapped=0x0) returned 1 [0174.984] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.984] ReadFile (in: hFile=0x1850, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x29b7f61c*=0x542c, lpOverlapped=0x0) returned 1 [0174.985] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xffffabd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.985] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2b50000, cbInput=0x542c, pPaddingInfo=0x0, pbIV=0x29b7f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x29b7f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x29b7f848, pbOutput=0x2b50000, pcbResult=0x29b7f618) returned 0x0 [0174.986] WriteFile (in: hFile=0x1850, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x29b7f61c*=0x5430, lpOverlapped=0x0) returned 1 [0174.986] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29b7f60c | out: lpNewFilePointer=0x0) returned 1 [0174.986] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.986] WriteFile (in: hFile=0x1850, lpBuffer=0x29b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x29b7f83c*, lpNumberOfBytesWritten=0x29b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0174.986] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x5430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.986] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0174.986] CloseHandle (hObject=0x1850) returned 1 [0174.986] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0174.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.play")) returned 1 [0174.990] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2489 os_tid = 0x2558 [0175.005] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.005] ReadFile (in: hFile=0x1840, lpBuffer=0x2d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesRead=0x2d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.008] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.009] ReadFile (in: hFile=0x1840, lpBuffer=0x2d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesRead=0x2d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.009] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.012] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.012] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x2d3bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0175.012] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x2d3bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x2d3bf828, pbKeyObject=0x0) returned 0x0 [0175.012] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d3bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d3bf500) returned 0x0 [0175.012] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.012] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d3bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d3bf500) returned 0x0 [0175.017] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.021] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.021] WriteFile (in: hFile=0x1840, lpBuffer=0x2d3bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d3bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesWritten=0x2d3bf830*=0x428, lpOverlapped=0x0) returned 1 [0175.021] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.021] ReadFile (in: hFile=0x1840, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x2d3bf61c*=0x21e8, lpOverlapped=0x0) returned 1 [0175.022] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xffffde18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.022] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2c50000, cbInput=0x21e8, pPaddingInfo=0x0, pbIV=0x2d3bf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x2d3bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2d3bf848, pbOutput=0x2c50000, pcbResult=0x2d3bf618) returned 0x0 [0175.022] WriteFile (in: hFile=0x1840, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x2d3bf61c*=0x21f0, lpOverlapped=0x0) returned 1 [0175.022] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3bf60c | out: lpNewFilePointer=0x0) returned 1 [0175.022] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.022] WriteFile (in: hFile=0x1840, lpBuffer=0x2d3bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bf83c*, lpNumberOfBytesWritten=0x2d3bf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.022] SetFilePointerEx (in: hFile=0x1840, liDistanceToMove=0x21f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.023] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.023] CloseHandle (hObject=0x1840) returned 1 [0175.023] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.play")) returned 1 [0175.027] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2490 os_tid = 0x255c [0175.031] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.031] ReadFile (in: hFile=0x1830, lpBuffer=0x2d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesRead=0x2d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.033] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.033] ReadFile (in: hFile=0x1830, lpBuffer=0x2d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesRead=0x2d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.034] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.036] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.036] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2d4ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0175.036] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2d4ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2d4ff828, pbKeyObject=0x0) returned 0x0 [0175.036] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d4ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d4ff500) returned 0x0 [0175.036] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.037] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d4ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d4ff500) returned 0x0 [0175.041] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.044] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.045] WriteFile (in: hFile=0x1830, lpBuffer=0x2d4ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d4ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesWritten=0x2d4ff830*=0x428, lpOverlapped=0x0) returned 1 [0175.045] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.045] ReadFile (in: hFile=0x1830, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2d4ff61c*=0x287c, lpOverlapped=0x0) returned 1 [0175.046] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xffffd784, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.046] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2d50000, cbInput=0x287c, pPaddingInfo=0x0, pbIV=0x2d4ff848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2d4ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2d4ff848, pbOutput=0x2d50000, pcbResult=0x2d4ff618) returned 0x0 [0175.046] WriteFile (in: hFile=0x1830, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2d4ff61c*=0x2880, lpOverlapped=0x0) returned 1 [0175.046] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4ff60c | out: lpNewFilePointer=0x0) returned 1 [0175.046] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.046] WriteFile (in: hFile=0x1830, lpBuffer=0x2d4ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ff83c*, lpNumberOfBytesWritten=0x2d4ff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.046] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x2880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.046] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.046] CloseHandle (hObject=0x1830) returned 1 [0175.047] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.play")) returned 1 [0175.050] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2491 os_tid = 0x2560 [0175.054] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.054] ReadFile (in: hFile=0x1820, lpBuffer=0x2d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesRead=0x2d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.056] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.056] ReadFile (in: hFile=0x1820, lpBuffer=0x2d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesRead=0x2d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.057] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.059] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.059] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2d63f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0175.059] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2d63f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2d63f828, pbKeyObject=0x0) returned 0x0 [0175.059] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d63f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d63f500) returned 0x0 [0175.060] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.060] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d63f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d63f500) returned 0x0 [0175.065] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.068] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.068] WriteFile (in: hFile=0x1820, lpBuffer=0x2d63fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d63f830, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesWritten=0x2d63f830*=0x428, lpOverlapped=0x0) returned 1 [0175.068] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.068] ReadFile (in: hFile=0x1820, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2d63f61c*=0x35f0, lpOverlapped=0x0) returned 1 [0175.069] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xffffca10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.069] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2e50000, cbInput=0x35f0, pPaddingInfo=0x0, pbIV=0x2d63f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2d63f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2d63f848, pbOutput=0x2e50000, pcbResult=0x2d63f618) returned 0x0 [0175.069] WriteFile (in: hFile=0x1820, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2d63f61c*=0x3600, lpOverlapped=0x0) returned 1 [0175.069] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d63f60c | out: lpNewFilePointer=0x0) returned 1 [0175.069] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.069] WriteFile (in: hFile=0x1820, lpBuffer=0x2d63f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d63f83c*, lpNumberOfBytesWritten=0x2d63f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.069] SetFilePointerEx (in: hFile=0x1820, liDistanceToMove=0x3600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.070] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.070] CloseHandle (hObject=0x1820) returned 1 [0175.070] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.play")) returned 1 [0175.073] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2492 os_tid = 0x2564 [0175.077] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.078] ReadFile (in: hFile=0x1810, lpBuffer=0x2d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesRead=0x2d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.079] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.079] ReadFile (in: hFile=0x1810, lpBuffer=0x2d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesRead=0x2d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.082] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.082] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d77f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0175.082] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d77f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d77f828, pbKeyObject=0x0) returned 0x0 [0175.082] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d77f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d77f500) returned 0x0 [0175.082] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.082] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d77f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d77f500) returned 0x0 [0175.087] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.091] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.091] WriteFile (in: hFile=0x1810, lpBuffer=0x2d77fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d77f830, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesWritten=0x2d77f830*=0x428, lpOverlapped=0x0) returned 1 [0175.091] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.091] ReadFile (in: hFile=0x1810, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d77f61c*=0x2030, lpOverlapped=0x0) returned 1 [0175.092] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xffffdfd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.092] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2f50000, cbInput=0x2030, pPaddingInfo=0x0, pbIV=0x2d77f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d77f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2d77f848, pbOutput=0x2f50000, pcbResult=0x2d77f618) returned 0x0 [0175.092] WriteFile (in: hFile=0x1810, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d77f61c*=0x2040, lpOverlapped=0x0) returned 1 [0175.092] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d77f60c | out: lpNewFilePointer=0x0) returned 1 [0175.093] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.093] WriteFile (in: hFile=0x1810, lpBuffer=0x2d77f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d77f83c*, lpNumberOfBytesWritten=0x2d77f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.093] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x2040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.093] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.093] CloseHandle (hObject=0x1810) returned 1 [0175.093] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.play")) returned 1 [0175.097] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2493 os_tid = 0x2568 [0175.101] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.101] ReadFile (in: hFile=0x17fc, lpBuffer=0x2d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesRead=0x2d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.103] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.103] ReadFile (in: hFile=0x17fc, lpBuffer=0x2d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesRead=0x2d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.103] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.106] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.106] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d8bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0175.106] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d8bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d8bf828, pbKeyObject=0x0) returned 0x0 [0175.106] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d8bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d8bf500) returned 0x0 [0175.106] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.106] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d8bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d8bf500) returned 0x0 [0175.111] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.115] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.115] WriteFile (in: hFile=0x17fc, lpBuffer=0x2d8bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesWritten=0x2d8bf830*=0x428, lpOverlapped=0x0) returned 1 [0175.115] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.115] ReadFile (in: hFile=0x17fc, lpBuffer=0x3050000, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d8bf61c*=0x2dc8, lpOverlapped=0x0) returned 1 [0175.117] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xffffd238, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.117] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3050000, cbInput=0x2dc8, pPaddingInfo=0x0, pbIV=0x2d8bf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d8bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2d8bf848, pbOutput=0x3050000, pcbResult=0x2d8bf618) returned 0x0 [0175.117] WriteFile (in: hFile=0x17fc, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d8bf61c*=0x2dd0, lpOverlapped=0x0) returned 1 [0175.118] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8bf60c | out: lpNewFilePointer=0x0) returned 1 [0175.118] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.118] WriteFile (in: hFile=0x17fc, lpBuffer=0x2d8bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bf83c*, lpNumberOfBytesWritten=0x2d8bf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.118] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x2dd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.118] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.118] CloseHandle (hObject=0x17fc) returned 1 [0175.118] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.play")) returned 1 [0175.122] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2494 os_tid = 0x256c [0175.127] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.127] ReadFile (in: hFile=0x17ec, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.129] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.129] ReadFile (in: hFile=0x17ec, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.129] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.131] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.132] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0175.132] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d9ff828, pbKeyObject=0x0) returned 0x0 [0175.132] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d9ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d9ff500) returned 0x0 [0175.132] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.132] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d9ff500) returned 0x0 [0175.137] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.141] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.141] WriteFile (in: hFile=0x17ec, lpBuffer=0x2d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesWritten=0x2d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0175.141] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.141] ReadFile (in: hFile=0x17ec, lpBuffer=0x3150000, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d9ff61c*=0x1204, lpOverlapped=0x0) returned 1 [0175.141] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xffffedfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.141] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3150000, cbInput=0x1204, pPaddingInfo=0x0, pbIV=0x2d9ff848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d9ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2d9ff848, pbOutput=0x3150000, pcbResult=0x2d9ff618) returned 0x0 [0175.141] WriteFile (in: hFile=0x17ec, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d9ff61c*=0x1210, lpOverlapped=0x0) returned 1 [0175.141] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0175.142] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.142] WriteFile (in: hFile=0x17ec, lpBuffer=0x2d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ff83c*, lpNumberOfBytesWritten=0x2d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.142] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x1210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.142] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.142] CloseHandle (hObject=0x17ec) returned 1 [0175.142] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.play")) returned 1 [0175.146] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2495 os_tid = 0x2570 [0175.151] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.151] ReadFile (in: hFile=0x17dc, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.152] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.153] ReadFile (in: hFile=0x17dc, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.153] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.156] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.156] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2db3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0175.156] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2db3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2db3f828, pbKeyObject=0x0) returned 0x0 [0175.156] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2db3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2db3f500) returned 0x0 [0175.156] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.156] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2db3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2db3f500) returned 0x0 [0175.161] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.164] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.165] WriteFile (in: hFile=0x17dc, lpBuffer=0x2db3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db3f830, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesWritten=0x2db3f830*=0x428, lpOverlapped=0x0) returned 1 [0175.165] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.165] ReadFile (in: hFile=0x17dc, lpBuffer=0x3250000, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2db3f61c*=0x274c, lpOverlapped=0x0) returned 1 [0175.166] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xffffd8b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.166] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3250000, cbInput=0x274c, pPaddingInfo=0x0, pbIV=0x2db3f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2db3f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2db3f848, pbOutput=0x3250000, pcbResult=0x2db3f618) returned 0x0 [0175.166] WriteFile (in: hFile=0x17dc, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2db3f61c*=0x2750, lpOverlapped=0x0) returned 1 [0175.166] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db3f60c | out: lpNewFilePointer=0x0) returned 1 [0175.166] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.166] WriteFile (in: hFile=0x17dc, lpBuffer=0x2db3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db3f83c*, lpNumberOfBytesWritten=0x2db3f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.166] SetFilePointerEx (in: hFile=0x17dc, liDistanceToMove=0x2750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.166] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.167] CloseHandle (hObject=0x17dc) returned 1 [0175.167] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.play")) returned 1 [0175.171] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2496 os_tid = 0x2574 [0175.175] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.175] ReadFile (in: hFile=0x17cc, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.177] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.177] ReadFile (in: hFile=0x17cc, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.177] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.180] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.180] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2dc7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0175.180] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2dc7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2dc7f828, pbKeyObject=0x0) returned 0x0 [0175.180] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2dc7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2dc7f500) returned 0x0 [0175.181] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.181] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2dc7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2dc7f500) returned 0x0 [0175.186] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.189] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.189] WriteFile (in: hFile=0x17cc, lpBuffer=0x2dc7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dc7f830, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesWritten=0x2dc7f830*=0x428, lpOverlapped=0x0) returned 1 [0175.189] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.189] ReadFile (in: hFile=0x17cc, lpBuffer=0x3350000, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2dc7f61c*=0x16b4, lpOverlapped=0x0) returned 1 [0175.189] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xffffe94c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.189] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3350000, cbInput=0x16b4, pPaddingInfo=0x0, pbIV=0x2dc7f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2dc7f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2dc7f848, pbOutput=0x3350000, pcbResult=0x2dc7f618) returned 0x0 [0175.189] WriteFile (in: hFile=0x17cc, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2dc7f61c*=0x16c0, lpOverlapped=0x0) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dc7f60c | out: lpNewFilePointer=0x0) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.190] WriteFile (in: hFile=0x17cc, lpBuffer=0x2dc7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7f83c*, lpNumberOfBytesWritten=0x2dc7f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x16c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.190] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.190] CloseHandle (hObject=0x17cc) returned 1 [0175.190] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.play")) returned 1 [0175.194] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2497 os_tid = 0x2578 [0175.198] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.198] ReadFile (in: hFile=0x1768, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.200] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.200] ReadFile (in: hFile=0x1768, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.200] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.203] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.203] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0175.203] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0175.203] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0175.203] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.203] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0175.206] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.209] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.210] WriteFile (in: hFile=0x1768, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0175.210] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.210] ReadFile (in: hFile=0x1768, lpBuffer=0x3450000, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2ddbf61c*=0x5bfc, lpOverlapped=0x0) returned 1 [0175.211] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xffffa404, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.211] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3450000, cbInput=0x5bfc, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2ddbf848, pbOutput=0x3450000, pcbResult=0x2ddbf618) returned 0x0 [0175.211] WriteFile (in: hFile=0x1768, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x5c00, lpOverlapped=0x0) returned 1 [0175.212] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0175.212] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.212] WriteFile (in: hFile=0x1768, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.212] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x5c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.212] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.212] CloseHandle (hObject=0x1768) returned 1 [0175.212] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.play")) returned 1 [0175.216] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2498 os_tid = 0x257c [0175.222] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.222] ReadFile (in: hFile=0x134c, lpBuffer=0x2deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2deff85c, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesRead=0x2deff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.223] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.223] ReadFile (in: hFile=0x134c, lpBuffer=0x2deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2deff85c, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesRead=0x2deff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.224] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.226] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.226] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2deff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0175.226] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2deff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2deff828, pbKeyObject=0x0) returned 0x0 [0175.226] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2deff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2deff500) returned 0x0 [0175.227] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.227] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2deff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2deff500) returned 0x0 [0175.232] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.235] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.235] WriteFile (in: hFile=0x134c, lpBuffer=0x2deffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2deff830, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesWritten=0x2deff830*=0x428, lpOverlapped=0x0) returned 1 [0175.235] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.236] ReadFile (in: hFile=0x134c, lpBuffer=0x3550000, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2deff61c*=0x2e7c, lpOverlapped=0x0) returned 1 [0175.236] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xffffd184, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.236] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3550000, cbInput=0x2e7c, pPaddingInfo=0x0, pbIV=0x2deff848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2deff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2deff848, pbOutput=0x3550000, pcbResult=0x2deff618) returned 0x0 [0175.237] WriteFile (in: hFile=0x134c, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2deff61c*=0x2e80, lpOverlapped=0x0) returned 1 [0175.237] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2deff60c | out: lpNewFilePointer=0x0) returned 1 [0175.237] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.237] WriteFile (in: hFile=0x134c, lpBuffer=0x2deff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x2deff83c*, lpNumberOfBytesWritten=0x2deff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.237] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x2e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.237] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.237] CloseHandle (hObject=0x134c) returned 1 [0175.237] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.play")) returned 1 [0175.241] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2499 os_tid = 0x2580 [0175.245] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.245] ReadFile (in: hFile=0x1748, lpBuffer=0x2e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesRead=0x2e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.247] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.247] ReadFile (in: hFile=0x1748, lpBuffer=0x2e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesRead=0x2e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.247] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.250] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.250] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2e03f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0175.250] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2e03f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2e03f828, pbKeyObject=0x0) returned 0x0 [0175.250] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e03f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e03f500) returned 0x0 [0175.250] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.250] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e03f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e03f500) returned 0x0 [0175.255] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.258] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.259] WriteFile (in: hFile=0x1748, lpBuffer=0x2e03fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e03f830, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesWritten=0x2e03f830*=0x428, lpOverlapped=0x0) returned 1 [0175.259] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.259] ReadFile (in: hFile=0x1748, lpBuffer=0x3650000, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2e03f61c*=0x4c90, lpOverlapped=0x0) returned 1 [0175.260] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xffffb370, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.260] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3650000, cbInput=0x4c90, pPaddingInfo=0x0, pbIV=0x2e03f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2e03f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e03f848, pbOutput=0x3650000, pcbResult=0x2e03f618) returned 0x0 [0175.260] WriteFile (in: hFile=0x1748, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2e03f61c*=0x4ca0, lpOverlapped=0x0) returned 1 [0175.260] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e03f60c | out: lpNewFilePointer=0x0) returned 1 [0175.260] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.261] WriteFile (in: hFile=0x1748, lpBuffer=0x2e03f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e03f83c*, lpNumberOfBytesWritten=0x2e03f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.261] SetFilePointerEx (in: hFile=0x1748, liDistanceToMove=0x4ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.261] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.261] CloseHandle (hObject=0x1748) returned 1 [0175.261] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.play")) returned 1 [0175.265] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2500 os_tid = 0x2584 [0175.269] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.269] ReadFile (in: hFile=0x170c, lpBuffer=0x2e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesRead=0x2e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.271] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.271] ReadFile (in: hFile=0x170c, lpBuffer=0x2e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesRead=0x2e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.271] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.274] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.274] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2e17f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0175.275] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2e17f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2e17f828, pbKeyObject=0x0) returned 0x0 [0175.275] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e17f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e17f500) returned 0x0 [0175.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.275] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e17f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e17f500) returned 0x0 [0175.280] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.283] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.283] WriteFile (in: hFile=0x170c, lpBuffer=0x2e17fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e17f830, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesWritten=0x2e17f830*=0x428, lpOverlapped=0x0) returned 1 [0175.283] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.283] ReadFile (in: hFile=0x170c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2e17f61c*=0x864, lpOverlapped=0x0) returned 1 [0175.283] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffff79c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.284] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3750000, cbInput=0x864, pPaddingInfo=0x0, pbIV=0x2e17f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2e17f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e17f848, pbOutput=0x3750000, pcbResult=0x2e17f618) returned 0x0 [0175.284] WriteFile (in: hFile=0x170c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2e17f61c*=0x870, lpOverlapped=0x0) returned 1 [0175.284] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e17f60c | out: lpNewFilePointer=0x0) returned 1 [0175.284] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.284] WriteFile (in: hFile=0x170c, lpBuffer=0x2e17f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e17f83c*, lpNumberOfBytesWritten=0x2e17f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.284] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.284] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.284] CloseHandle (hObject=0x170c) returned 1 [0175.284] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.play")) returned 1 [0175.288] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2501 os_tid = 0x2588 [0175.292] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.293] ReadFile (in: hFile=0x16ec, lpBuffer=0x2e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesRead=0x2e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.294] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.294] ReadFile (in: hFile=0x16ec, lpBuffer=0x2e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesRead=0x2e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.294] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.297] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.297] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2e2bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0175.297] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2e2bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2e2bf828, pbKeyObject=0x0) returned 0x0 [0175.297] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e2bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e2bf500) returned 0x0 [0175.297] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.297] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e2bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e2bf500) returned 0x0 [0175.302] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.305] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.305] WriteFile (in: hFile=0x16ec, lpBuffer=0x2e2bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesWritten=0x2e2bf830*=0x428, lpOverlapped=0x0) returned 1 [0175.306] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.306] ReadFile (in: hFile=0x16ec, lpBuffer=0x3850000, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2e2bf61c*=0xd04, lpOverlapped=0x0) returned 1 [0175.306] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffff2fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.306] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3850000, cbInput=0xd04, pPaddingInfo=0x0, pbIV=0x2e2bf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2e2bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e2bf848, pbOutput=0x3850000, pcbResult=0x2e2bf618) returned 0x0 [0175.306] WriteFile (in: hFile=0x16ec, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2e2bf61c*=0xd10, lpOverlapped=0x0) returned 1 [0175.306] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2bf60c | out: lpNewFilePointer=0x0) returned 1 [0175.306] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.306] WriteFile (in: hFile=0x16ec, lpBuffer=0x2e2bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bf83c*, lpNumberOfBytesWritten=0x2e2bf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.307] SetFilePointerEx (in: hFile=0x16ec, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.307] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.307] CloseHandle (hObject=0x16ec) returned 1 [0175.307] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.play")) returned 1 [0175.310] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2502 os_tid = 0x258c [0175.314] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.314] ReadFile (in: hFile=0x179c, lpBuffer=0x2e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesRead=0x2e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.316] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.316] ReadFile (in: hFile=0x179c, lpBuffer=0x2e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesRead=0x2e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.317] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.319] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.319] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e3ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0175.320] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e3ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e3ff828, pbKeyObject=0x0) returned 0x0 [0175.320] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e3ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e3ff500) returned 0x0 [0175.320] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.320] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e3ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e3ff500) returned 0x0 [0175.326] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.329] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.329] WriteFile (in: hFile=0x179c, lpBuffer=0x2e3ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e3ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesWritten=0x2e3ff830*=0x428, lpOverlapped=0x0) returned 1 [0175.330] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.330] ReadFile (in: hFile=0x179c, lpBuffer=0x3950000, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e3ff61c*=0x35d8, lpOverlapped=0x0) returned 1 [0175.330] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xffffca28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.331] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3950000, cbInput=0x35d8, pPaddingInfo=0x0, pbIV=0x2e3ff848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e3ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e3ff848, pbOutput=0x3950000, pcbResult=0x2e3ff618) returned 0x0 [0175.331] WriteFile (in: hFile=0x179c, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e3ff61c*=0x35e0, lpOverlapped=0x0) returned 1 [0175.331] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3ff60c | out: lpNewFilePointer=0x0) returned 1 [0175.331] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.331] WriteFile (in: hFile=0x179c, lpBuffer=0x2e3ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ff83c*, lpNumberOfBytesWritten=0x2e3ff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.331] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x35e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.331] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.331] CloseHandle (hObject=0x179c) returned 1 [0175.331] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.play")) returned 1 [0175.334] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2503 os_tid = 0x2590 [0175.338] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.338] ReadFile (in: hFile=0x123c, lpBuffer=0x2e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesRead=0x2e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.340] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.340] ReadFile (in: hFile=0x123c, lpBuffer=0x2e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesRead=0x2e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.340] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.342] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e53f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0175.342] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e53f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e53f828, pbKeyObject=0x0) returned 0x0 [0175.342] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e53f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e53f500) returned 0x0 [0175.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.343] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e53f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e53f500) returned 0x0 [0175.348] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.351] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.351] WriteFile (in: hFile=0x123c, lpBuffer=0x2e53fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e53f830, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesWritten=0x2e53f830*=0x428, lpOverlapped=0x0) returned 1 [0175.351] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.351] ReadFile (in: hFile=0x123c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e53f61c*=0xbcc, lpOverlapped=0x0) returned 1 [0175.351] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffff434, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.351] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3a50000, cbInput=0xbcc, pPaddingInfo=0x0, pbIV=0x2e53f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e53f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e53f848, pbOutput=0x3a50000, pcbResult=0x2e53f618) returned 0x0 [0175.351] WriteFile (in: hFile=0x123c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e53f61c*=0xbd0, lpOverlapped=0x0) returned 1 [0175.351] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e53f60c | out: lpNewFilePointer=0x0) returned 1 [0175.352] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.352] WriteFile (in: hFile=0x123c, lpBuffer=0x2e53f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e53f83c*, lpNumberOfBytesWritten=0x2e53f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.352] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0xbd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.352] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.352] CloseHandle (hObject=0x123c) returned 1 [0175.352] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.play")) returned 1 [0175.356] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2504 os_tid = 0x2594 [0175.360] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.360] ReadFile (in: hFile=0x13d4, lpBuffer=0x2e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesRead=0x2e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.362] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.362] ReadFile (in: hFile=0x13d4, lpBuffer=0x2e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesRead=0x2e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.362] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.364] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.365] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0175.365] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e67f828, pbKeyObject=0x0) returned 0x0 [0175.365] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e67f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e67f500) returned 0x0 [0175.365] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.365] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e67f500) returned 0x0 [0175.370] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.373] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.374] WriteFile (in: hFile=0x13d4, lpBuffer=0x2e67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e67f830, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesWritten=0x2e67f830*=0x428, lpOverlapped=0x0) returned 1 [0175.374] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.374] ReadFile (in: hFile=0x13d4, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e67f61c*=0x1dd0, lpOverlapped=0x0) returned 1 [0175.375] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xffffe230, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.375] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3b50000, cbInput=0x1dd0, pPaddingInfo=0x0, pbIV=0x2e67f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e67f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e67f848, pbOutput=0x3b50000, pcbResult=0x2e67f618) returned 0x0 [0175.375] WriteFile (in: hFile=0x13d4, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e67f61c*=0x1de0, lpOverlapped=0x0) returned 1 [0175.375] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e67f60c | out: lpNewFilePointer=0x0) returned 1 [0175.375] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.375] WriteFile (in: hFile=0x13d4, lpBuffer=0x2e67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e67f83c*, lpNumberOfBytesWritten=0x2e67f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.375] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x1de0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.376] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.376] CloseHandle (hObject=0x13d4) returned 1 [0175.376] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.play")) returned 1 [0175.380] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2505 os_tid = 0x2598 [0175.392] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.393] ReadFile (in: hFile=0x7dc, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.396] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.396] ReadFile (in: hFile=0x7dc, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.396] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.399] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0175.399] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0175.399] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0175.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.399] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0175.403] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.405] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.405] WriteFile (in: hFile=0x7dc, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0175.406] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.406] ReadFile (in: hFile=0x7dc, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x141cf61c*=0x2358, lpOverlapped=0x0) returned 1 [0175.406] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xffffdca8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.406] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3c50000, cbInput=0x2358, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x141cf848, pbOutput=0x3c50000, pcbResult=0x141cf618) returned 0x0 [0175.406] WriteFile (in: hFile=0x7dc, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x141cf61c*=0x2360, lpOverlapped=0x0) returned 1 [0175.407] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0175.407] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.407] WriteFile (in: hFile=0x7dc, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.407] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x2360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.407] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.407] CloseHandle (hObject=0x7dc) returned 1 [0175.407] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.play")) returned 1 [0175.411] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2506 os_tid = 0x259c [0175.414] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.415] ReadFile (in: hFile=0x1b68, lpBuffer=0x2e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesRead=0x2e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.416] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.416] ReadFile (in: hFile=0x1b68, lpBuffer=0x2e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesRead=0x2e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.417] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.419] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.419] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x2e7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0175.419] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x2e7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x2e7bf828, pbKeyObject=0x0) returned 0x0 [0175.419] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e7bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e7bf500) returned 0x0 [0175.419] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.419] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e7bf500) returned 0x0 [0175.423] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.425] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.425] WriteFile (in: hFile=0x1b68, lpBuffer=0x2e7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesWritten=0x2e7bf830*=0x428, lpOverlapped=0x0) returned 1 [0175.425] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.425] ReadFile (in: hFile=0x1b68, lpBuffer=0x2750000, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x2e7bf61c*=0x3734, lpOverlapped=0x0) returned 1 [0175.427] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0xffffc8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.427] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2750000, cbInput=0x3734, pPaddingInfo=0x0, pbIV=0x2e7bf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x2e7bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e7bf848, pbOutput=0x2750000, pcbResult=0x2e7bf618) returned 0x0 [0175.427] WriteFile (in: hFile=0x1b68, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x2e7bf61c*=0x3740, lpOverlapped=0x0) returned 1 [0175.427] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7bf60c | out: lpNewFilePointer=0x0) returned 1 [0175.427] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.427] WriteFile (in: hFile=0x1b68, lpBuffer=0x2e7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bf83c*, lpNumberOfBytesWritten=0x2e7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.427] SetFilePointerEx (in: hFile=0x1b68, liDistanceToMove=0x3740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.427] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.427] CloseHandle (hObject=0x1b68) returned 1 [0175.427] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.play")) returned 1 [0175.431] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2507 os_tid = 0x25a0 [0175.434] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.434] ReadFile (in: hFile=0x1b70, lpBuffer=0x2e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesRead=0x2e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.436] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.436] ReadFile (in: hFile=0x1b70, lpBuffer=0x2e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesRead=0x2e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.436] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.438] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.438] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0175.438] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e8ff828, pbKeyObject=0x0) returned 0x0 [0175.438] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e8ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e8ff500) returned 0x0 [0175.438] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.439] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e8ff500) returned 0x0 [0175.442] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.444] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.444] WriteFile (in: hFile=0x1b70, lpBuffer=0x2e8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesWritten=0x2e8ff830*=0x428, lpOverlapped=0x0) returned 1 [0175.444] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.445] ReadFile (in: hFile=0x1b70, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e8ff61c*=0x69cc, lpOverlapped=0x0) returned 1 [0175.445] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xffff9634, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.445] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3d50000, cbInput=0x69cc, pPaddingInfo=0x0, pbIV=0x2e8ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e8ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2e8ff848, pbOutput=0x3d50000, pcbResult=0x2e8ff618) returned 0x0 [0175.445] WriteFile (in: hFile=0x1b70, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e8ff61c*=0x69d0, lpOverlapped=0x0) returned 1 [0175.446] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8ff60c | out: lpNewFilePointer=0x0) returned 1 [0175.446] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.446] WriteFile (in: hFile=0x1b70, lpBuffer=0x2e8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ff83c*, lpNumberOfBytesWritten=0x2e8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.446] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x69d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.446] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.446] CloseHandle (hObject=0x1b70) returned 1 [0175.446] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.play")) returned 1 [0175.450] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2508 os_tid = 0x25a4 [0175.453] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.453] ReadFile (in: hFile=0x1b78, lpBuffer=0x2ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesRead=0x2ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.457] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.457] ReadFile (in: hFile=0x1b78, lpBuffer=0x2ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesRead=0x2ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.457] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.462] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2ea3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0175.462] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2ea3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2ea3f828, pbKeyObject=0x0) returned 0x0 [0175.462] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ea3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ea3f500) returned 0x0 [0175.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.462] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ea3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ea3f500) returned 0x0 [0175.467] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.470] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.470] WriteFile (in: hFile=0x1b78, lpBuffer=0x2ea3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ea3f830, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesWritten=0x2ea3f830*=0x428, lpOverlapped=0x0) returned 1 [0175.471] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.471] ReadFile (in: hFile=0x1b78, lpBuffer=0x3e50000, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2ea3f61c*=0xbcfc, lpOverlapped=0x0) returned 1 [0175.484] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0xffff4304, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.484] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3e50000, cbInput=0xbcfc, pPaddingInfo=0x0, pbIV=0x2ea3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2ea3f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2ea3f848, pbOutput=0x3e50000, pcbResult=0x2ea3f618) returned 0x0 [0175.484] WriteFile (in: hFile=0x1b78, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2ea3f61c*=0xbd00, lpOverlapped=0x0) returned 1 [0175.485] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea3f60c | out: lpNewFilePointer=0x0) returned 1 [0175.485] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.485] WriteFile (in: hFile=0x1b78, lpBuffer=0x2ea3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3f83c*, lpNumberOfBytesWritten=0x2ea3f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.485] SetFilePointerEx (in: hFile=0x1b78, liDistanceToMove=0xbd00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.485] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.485] CloseHandle (hObject=0x1b78) returned 1 [0175.485] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.play")) returned 1 [0175.489] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2509 os_tid = 0x25a8 [0175.454] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.454] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesRead=0x2eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.471] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.471] ReadFile (in: hFile=0x1b80, lpBuffer=0x2eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesRead=0x2eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.471] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.474] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2eb7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0175.474] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2eb7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2eb7f828, pbKeyObject=0x0) returned 0x0 [0175.474] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2eb7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2eb7f500) returned 0x0 [0175.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.474] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2eb7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2eb7f500) returned 0x0 [0175.479] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.483] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.483] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eb7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2eb7f830, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesWritten=0x2eb7f830*=0x428, lpOverlapped=0x0) returned 1 [0175.483] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.483] ReadFile (in: hFile=0x1b80, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2eb7f61c*=0xbd04, lpOverlapped=0x0) returned 1 [0175.510] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xffff42fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.510] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3f50000, cbInput=0xbd04, pPaddingInfo=0x0, pbIV=0x2eb7f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2eb7f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2eb7f848, pbOutput=0x3f50000, pcbResult=0x2eb7f618) returned 0x0 [0175.510] WriteFile (in: hFile=0x1b80, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2eb7f61c*=0xbd10, lpOverlapped=0x0) returned 1 [0175.510] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eb7f60c | out: lpNewFilePointer=0x0) returned 1 [0175.510] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.510] WriteFile (in: hFile=0x1b80, lpBuffer=0x2eb7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7f83c*, lpNumberOfBytesWritten=0x2eb7f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.510] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xbd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.511] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0175.511] CloseHandle (hObject=0x1b80) returned 1 [0175.511] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.play")) returned 1 [0175.515] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2510 os_tid = 0x25ac [0175.456] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.456] ReadFile (in: hFile=0x1b88, lpBuffer=0x2ecbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ecbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ecbfb34*, lpNumberOfBytesRead=0x2ecbf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.520] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.520] ReadFile (in: hFile=0x1b88, lpBuffer=0x2ecbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ecbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ecbfb34*, lpNumberOfBytesRead=0x2ecbf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.520] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.523] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2ecbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0175.523] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2ecbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2ecbf828, pbKeyObject=0x0) returned 0x0 [0175.523] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ecbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ecbf500) returned 0x0 [0175.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.523] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ecbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ecbf500) returned 0x0 [0175.529] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.531] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.531] WriteFile (in: hFile=0x1b88, lpBuffer=0x2ecbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ecbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ecbfb34*, lpNumberOfBytesWritten=0x2ecbf830*=0x428, lpOverlapped=0x0) returned 1 [0175.532] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.532] ReadFile (in: hFile=0x1b88, lpBuffer=0x4050000, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x2ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2ecbf61c*=0x4330, lpOverlapped=0x0) returned 1 [0175.534] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0xffffbcd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.534] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4050000, cbInput=0x4330, pPaddingInfo=0x0, pbIV=0x2ecbf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2ecbf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2ecbf848, pbOutput=0x4050000, pcbResult=0x2ecbf618) returned 0x0 [0175.534] WriteFile (in: hFile=0x1b88, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2ecbf61c*=0x4340, lpOverlapped=0x0) returned 1 [0175.534] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecbf60c | out: lpNewFilePointer=0x0) returned 1 [0175.534] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.534] WriteFile (in: hFile=0x1b88, lpBuffer=0x2ecbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ecbf83c*, lpNumberOfBytesWritten=0x2ecbf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.534] SetFilePointerEx (in: hFile=0x1b88, liDistanceToMove=0x4340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.534] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.534] CloseHandle (hObject=0x1b88) returned 1 [0175.535] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.537] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.play")) returned 1 [0175.539] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2511 os_tid = 0x25b0 [0175.544] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.544] ReadFile (in: hFile=0x1b90, lpBuffer=0x2edffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2edff85c, lpOverlapped=0x0 | out: lpBuffer=0x2edffb34*, lpNumberOfBytesRead=0x2edff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.546] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.546] ReadFile (in: hFile=0x1b90, lpBuffer=0x2edffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2edff85c, lpOverlapped=0x0 | out: lpBuffer=0x2edffb34*, lpNumberOfBytesRead=0x2edff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.549] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.549] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x2edff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0175.549] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x2edff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x2edff828, pbKeyObject=0x0) returned 0x0 [0175.549] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2edff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2edff500) returned 0x0 [0175.549] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.549] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2edff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2edff500) returned 0x0 [0175.554] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.557] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.558] WriteFile (in: hFile=0x1b90, lpBuffer=0x2edffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2edff830, lpOverlapped=0x0 | out: lpBuffer=0x2edffb34*, lpNumberOfBytesWritten=0x2edff830*=0x428, lpOverlapped=0x0) returned 1 [0175.558] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.558] ReadFile (in: hFile=0x1b90, lpBuffer=0x4150000, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x2edff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2edff61c*=0x3a94, lpOverlapped=0x0) returned 1 [0175.573] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xffffc56c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.573] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4150000, cbInput=0x3a94, pPaddingInfo=0x0, pbIV=0x2edff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2edff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2edff848, pbOutput=0x4150000, pcbResult=0x2edff618) returned 0x0 [0175.573] WriteFile (in: hFile=0x1b90, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2edff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2edff61c*=0x3aa0, lpOverlapped=0x0) returned 1 [0175.573] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edff60c | out: lpNewFilePointer=0x0) returned 1 [0175.573] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.573] WriteFile (in: hFile=0x1b90, lpBuffer=0x2edff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2edff61c, lpOverlapped=0x0 | out: lpBuffer=0x2edff83c*, lpNumberOfBytesWritten=0x2edff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.573] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x3aa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.573] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.573] CloseHandle (hObject=0x1b90) returned 1 [0175.574] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.play")) returned 1 [0175.577] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2512 os_tid = 0x25b4 [0175.545] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.546] ReadFile (in: hFile=0x1b98, lpBuffer=0x2ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ef3fb34*, lpNumberOfBytesRead=0x2ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.560] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.560] ReadFile (in: hFile=0x1b98, lpBuffer=0x2ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ef3fb34*, lpNumberOfBytesRead=0x2ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.560] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.563] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x2ef3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0175.563] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x2ef3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x2ef3f828, pbKeyObject=0x0) returned 0x0 [0175.563] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ef3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ef3f500) returned 0x0 [0175.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.563] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ef3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ef3f500) returned 0x0 [0175.568] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.571] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.571] WriteFile (in: hFile=0x1b98, lpBuffer=0x2ef3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ef3f830, lpOverlapped=0x0 | out: lpBuffer=0x2ef3fb34*, lpNumberOfBytesWritten=0x2ef3f830*=0x428, lpOverlapped=0x0) returned 1 [0175.572] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.572] ReadFile (in: hFile=0x1b98, lpBuffer=0x4250000, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x2ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x2ef3f61c*=0x4ea8, lpOverlapped=0x0) returned 1 [0175.581] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0xffffb158, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.581] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x4250000, cbInput=0x4ea8, pPaddingInfo=0x0, pbIV=0x2ef3f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x2ef3f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2ef3f848, pbOutput=0x4250000, pcbResult=0x2ef3f618) returned 0x0 [0175.581] WriteFile (in: hFile=0x1b98, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x2ef3f61c*=0x4eb0, lpOverlapped=0x0) returned 1 [0175.582] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ef3f60c | out: lpNewFilePointer=0x0) returned 1 [0175.582] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.582] WriteFile (in: hFile=0x1b98, lpBuffer=0x2ef3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ef3f83c*, lpNumberOfBytesWritten=0x2ef3f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.582] SetFilePointerEx (in: hFile=0x1b98, liDistanceToMove=0x4eb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.582] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0175.582] CloseHandle (hObject=0x1b98) returned 1 [0175.582] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.play")) returned 1 [0175.586] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2513 os_tid = 0x25b8 [0175.559] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.590] ReadFile (in: hFile=0x1ba0, lpBuffer=0x2f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f07fb34*, lpNumberOfBytesRead=0x2f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.592] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.593] ReadFile (in: hFile=0x1ba0, lpBuffer=0x2f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f07fb34*, lpNumberOfBytesRead=0x2f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.594] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.597] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.597] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x2f07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0175.597] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x2f07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x2f07f828, pbKeyObject=0x0) returned 0x0 [0175.597] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f07f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f07f500) returned 0x0 [0175.597] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.597] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f07f500) returned 0x0 [0175.602] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.606] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.606] WriteFile (in: hFile=0x1ba0, lpBuffer=0x2f07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f07f830, lpOverlapped=0x0 | out: lpBuffer=0x2f07fb34*, lpNumberOfBytesWritten=0x2f07f830*=0x428, lpOverlapped=0x0) returned 1 [0175.606] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.606] ReadFile (in: hFile=0x1ba0, lpBuffer=0x4350000, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x2f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x2f07f61c*=0x3490, lpOverlapped=0x0) returned 1 [0175.607] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xffffcb70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.607] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4350000, cbInput=0x3490, pPaddingInfo=0x0, pbIV=0x2f07f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x2f07f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f07f848, pbOutput=0x4350000, pcbResult=0x2f07f618) returned 0x0 [0175.607] WriteFile (in: hFile=0x1ba0, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x2f07f61c*=0x34a0, lpOverlapped=0x0) returned 1 [0175.607] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f07f60c | out: lpNewFilePointer=0x0) returned 1 [0175.607] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.608] WriteFile (in: hFile=0x1ba0, lpBuffer=0x2f07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f07f83c*, lpNumberOfBytesWritten=0x2f07f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.608] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x34a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.608] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.608] CloseHandle (hObject=0x1ba0) returned 1 [0175.608] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.play")) returned 1 [0175.618] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2514 os_tid = 0x25bc [0175.592] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.592] ReadFile (in: hFile=0x1ba8, lpBuffer=0x2f1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfb34*, lpNumberOfBytesRead=0x2f1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.623] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.623] ReadFile (in: hFile=0x1ba8, lpBuffer=0x2f1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfb34*, lpNumberOfBytesRead=0x2f1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.624] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.627] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x2f1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0175.627] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x2f1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x2f1bf828, pbKeyObject=0x0) returned 0x0 [0175.627] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f1bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f1bf500) returned 0x0 [0175.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.627] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f1bf500) returned 0x0 [0175.632] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.637] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.637] WriteFile (in: hFile=0x1ba8, lpBuffer=0x2f1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfb34*, lpNumberOfBytesWritten=0x2f1bf830*=0x428, lpOverlapped=0x0) returned 1 [0175.637] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.637] ReadFile (in: hFile=0x1ba8, lpBuffer=0x4450000, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x2f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x2f1bf61c*=0x5804, lpOverlapped=0x0) returned 1 [0175.639] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0xffffa7fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.639] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4450000, cbInput=0x5804, pPaddingInfo=0x0, pbIV=0x2f1bf848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x2f1bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f1bf848, pbOutput=0x4450000, pcbResult=0x2f1bf618) returned 0x0 [0175.639] WriteFile (in: hFile=0x1ba8, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x2f1bf61c*=0x5810, lpOverlapped=0x0) returned 1 [0175.639] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1bf60c | out: lpNewFilePointer=0x0) returned 1 [0175.640] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.640] WriteFile (in: hFile=0x1ba8, lpBuffer=0x2f1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f1bf83c*, lpNumberOfBytesWritten=0x2f1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.640] SetFilePointerEx (in: hFile=0x1ba8, liDistanceToMove=0x5810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.640] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.640] CloseHandle (hObject=0x1ba8) returned 1 [0175.640] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.play")) returned 1 [0175.645] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2515 os_tid = 0x25c0 [0175.612] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.612] ReadFile (in: hFile=0x1bb0, lpBuffer=0x2f2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ffb34*, lpNumberOfBytesRead=0x2f2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.649] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.649] ReadFile (in: hFile=0x1bb0, lpBuffer=0x2f2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ffb34*, lpNumberOfBytesRead=0x2f2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.650] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.653] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x2f2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0175.653] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x2f2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x2f2ff828, pbKeyObject=0x0) returned 0x0 [0175.653] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f2ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f2ff500) returned 0x0 [0175.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.653] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f2ff500) returned 0x0 [0175.658] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.661] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.661] WriteFile (in: hFile=0x1bb0, lpBuffer=0x2f2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2f2ffb34*, lpNumberOfBytesWritten=0x2f2ff830*=0x428, lpOverlapped=0x0) returned 1 [0175.662] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.662] ReadFile (in: hFile=0x1bb0, lpBuffer=0x4550000, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x2f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x2f2ff61c*=0x571c, lpOverlapped=0x0) returned 1 [0175.662] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xffffa8e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.662] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4550000, cbInput=0x571c, pPaddingInfo=0x0, pbIV=0x2f2ff848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x2f2ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f2ff848, pbOutput=0x4550000, pcbResult=0x2f2ff618) returned 0x0 [0175.663] WriteFile (in: hFile=0x1bb0, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x2f2ff61c*=0x5720, lpOverlapped=0x0) returned 1 [0175.663] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2ff60c | out: lpNewFilePointer=0x0) returned 1 [0175.663] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.663] WriteFile (in: hFile=0x1bb0, lpBuffer=0x2f2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ff83c*, lpNumberOfBytesWritten=0x2f2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.663] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x5720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.663] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.663] CloseHandle (hObject=0x1bb0) returned 1 [0175.663] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.play")) returned 1 [0175.667] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2516 os_tid = 0x25c4 [0175.672] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.672] ReadFile (in: hFile=0x1bb8, lpBuffer=0x2f43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f43fb34*, lpNumberOfBytesRead=0x2f43f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.674] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.674] ReadFile (in: hFile=0x1bb8, lpBuffer=0x2f43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f43fb34*, lpNumberOfBytesRead=0x2f43f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.674] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.676] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.677] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x2f43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0175.677] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x2f43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x2f43f828, pbKeyObject=0x0) returned 0x0 [0175.677] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f43f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f43f500) returned 0x0 [0175.677] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.677] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f43f500) returned 0x0 [0175.682] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.685] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.685] WriteFile (in: hFile=0x1bb8, lpBuffer=0x2f43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f43f830, lpOverlapped=0x0 | out: lpBuffer=0x2f43fb34*, lpNumberOfBytesWritten=0x2f43f830*=0x428, lpOverlapped=0x0) returned 1 [0175.685] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.685] ReadFile (in: hFile=0x1bb8, lpBuffer=0x4650000, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x2f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x2f43f61c*=0x614c, lpOverlapped=0x0) returned 1 [0175.686] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0xffff9eb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.686] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4650000, cbInput=0x614c, pPaddingInfo=0x0, pbIV=0x2f43f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x2f43f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f43f848, pbOutput=0x4650000, pcbResult=0x2f43f618) returned 0x0 [0175.686] WriteFile (in: hFile=0x1bb8, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x2f43f61c*=0x6150, lpOverlapped=0x0) returned 1 [0175.687] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f43f60c | out: lpNewFilePointer=0x0) returned 1 [0175.687] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.687] WriteFile (in: hFile=0x1bb8, lpBuffer=0x2f43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f43f83c*, lpNumberOfBytesWritten=0x2f43f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.687] SetFilePointerEx (in: hFile=0x1bb8, liDistanceToMove=0x6150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.687] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.687] CloseHandle (hObject=0x1bb8) returned 1 [0175.687] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.play")) returned 1 [0175.691] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2517 os_tid = 0x25c8 [0175.695] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.695] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2f57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f57fb34*, lpNumberOfBytesRead=0x2f57f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.728] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.728] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2f57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f57fb34*, lpNumberOfBytesRead=0x2f57f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.728] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.770] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.770] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x2f57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0175.770] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x2f57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x2f57f828, pbKeyObject=0x0) returned 0x0 [0175.770] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f57f500) returned 0x0 [0175.770] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.771] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f57f500) returned 0x0 [0175.817] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.820] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.820] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2f57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f57f830, lpOverlapped=0x0 | out: lpBuffer=0x2f57fb34*, lpNumberOfBytesWritten=0x2f57f830*=0x428, lpOverlapped=0x0) returned 1 [0175.820] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.821] ReadFile (in: hFile=0x1bc0, lpBuffer=0x4750000, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x2f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x2f57f61c*=0x3ee4, lpOverlapped=0x0) returned 1 [0175.823] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xffffc11c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.823] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4750000, cbInput=0x3ee4, pPaddingInfo=0x0, pbIV=0x2f57f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x2f57f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f57f848, pbOutput=0x4750000, pcbResult=0x2f57f618) returned 0x0 [0175.823] WriteFile (in: hFile=0x1bc0, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x2f57f61c*=0x3ef0, lpOverlapped=0x0) returned 1 [0175.823] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f57f60c | out: lpNewFilePointer=0x0) returned 1 [0175.823] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.823] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2f57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f57f83c*, lpNumberOfBytesWritten=0x2f57f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.823] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x3ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.823] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.823] CloseHandle (hObject=0x1bc0) returned 1 [0175.823] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.play")) returned 1 [0175.828] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2518 os_tid = 0x25cc [0175.833] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.833] ReadFile (in: hFile=0x1bc8, lpBuffer=0x2f6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfb34*, lpNumberOfBytesRead=0x2f6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.835] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.835] ReadFile (in: hFile=0x1bc8, lpBuffer=0x2f6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfb34*, lpNumberOfBytesRead=0x2f6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.835] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.838] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.838] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x2f6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0175.838] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x2f6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x2f6bf828, pbKeyObject=0x0) returned 0x0 [0175.838] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f6bf500) returned 0x0 [0175.838] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.838] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f6bf500) returned 0x0 [0175.842] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.844] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.845] WriteFile (in: hFile=0x1bc8, lpBuffer=0x2f6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfb34*, lpNumberOfBytesWritten=0x2f6bf830*=0x428, lpOverlapped=0x0) returned 1 [0175.845] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.845] ReadFile (in: hFile=0x1bc8, lpBuffer=0x4850000, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x2f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x2f6bf61c*=0x11b8, lpOverlapped=0x0) returned 1 [0175.845] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0xffffee48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.845] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4850000, cbInput=0x11b8, pPaddingInfo=0x0, pbIV=0x2f6bf848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x2f6bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f6bf848, pbOutput=0x4850000, pcbResult=0x2f6bf618) returned 0x0 [0175.845] WriteFile (in: hFile=0x1bc8, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x2f6bf61c*=0x11c0, lpOverlapped=0x0) returned 1 [0175.845] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f6bf60c | out: lpNewFilePointer=0x0) returned 1 [0175.846] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.846] WriteFile (in: hFile=0x1bc8, lpBuffer=0x2f6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2f6bf83c*, lpNumberOfBytesWritten=0x2f6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.846] SetFilePointerEx (in: hFile=0x1bc8, liDistanceToMove=0x11c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.846] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.846] CloseHandle (hObject=0x1bc8) returned 1 [0175.846] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.play")) returned 1 [0175.850] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2519 os_tid = 0x25d0 [0175.855] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.856] ReadFile (in: hFile=0x1bd0, lpBuffer=0x2f7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f7ffb34*, lpNumberOfBytesRead=0x2f7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.867] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.867] ReadFile (in: hFile=0x1bd0, lpBuffer=0x2f7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2f7ffb34*, lpNumberOfBytesRead=0x2f7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.867] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.871] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.871] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x2f7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0175.871] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x2f7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x2f7ff828, pbKeyObject=0x0) returned 0x0 [0175.871] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f7ff500) returned 0x0 [0175.871] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.872] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f7ff500) returned 0x0 [0175.876] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.880] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.880] WriteFile (in: hFile=0x1bd0, lpBuffer=0x2f7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2f7ffb34*, lpNumberOfBytesWritten=0x2f7ff830*=0x428, lpOverlapped=0x0) returned 1 [0175.881] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.881] ReadFile (in: hFile=0x1bd0, lpBuffer=0x4950000, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x2f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x2f7ff61c*=0x26f0, lpOverlapped=0x0) returned 1 [0175.883] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xffffd910, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.883] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4950000, cbInput=0x26f0, pPaddingInfo=0x0, pbIV=0x2f7ff848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x2f7ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f7ff848, pbOutput=0x4950000, pcbResult=0x2f7ff618) returned 0x0 [0175.883] WriteFile (in: hFile=0x1bd0, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x2f7ff61c*=0x2700, lpOverlapped=0x0) returned 1 [0175.884] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f7ff60c | out: lpNewFilePointer=0x0) returned 1 [0175.885] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.885] WriteFile (in: hFile=0x1bd0, lpBuffer=0x2f7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f7ff83c*, lpNumberOfBytesWritten=0x2f7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.885] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x2700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.885] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.885] CloseHandle (hObject=0x1bd0) returned 1 [0175.886] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.play")) returned 1 [0175.893] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2520 os_tid = 0x25d4 [0175.896] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.896] ReadFile (in: hFile=0x1bd8, lpBuffer=0x2f93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f93fb34*, lpNumberOfBytesRead=0x2f93f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.897] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.897] ReadFile (in: hFile=0x1bd8, lpBuffer=0x2f93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2f93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2f93fb34*, lpNumberOfBytesRead=0x2f93f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.898] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.900] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.900] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x2f93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0175.900] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x2f93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x2f93f828, pbKeyObject=0x0) returned 0x0 [0175.900] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2f93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2f93f500) returned 0x0 [0175.900] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.900] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2f93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2f93f500) returned 0x0 [0175.903] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.906] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.906] WriteFile (in: hFile=0x1bd8, lpBuffer=0x2f93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2f93f830, lpOverlapped=0x0 | out: lpBuffer=0x2f93fb34*, lpNumberOfBytesWritten=0x2f93f830*=0x428, lpOverlapped=0x0) returned 1 [0175.906] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.906] ReadFile (in: hFile=0x1bd8, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x2f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x2f93f61c*=0x4ef4, lpOverlapped=0x0) returned 1 [0175.907] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0xffffb10c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.907] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4a50000, cbInput=0x4ef4, pPaddingInfo=0x0, pbIV=0x2f93f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x2f93f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2f93f848, pbOutput=0x4a50000, pcbResult=0x2f93f618) returned 0x0 [0175.907] WriteFile (in: hFile=0x1bd8, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x2f93f61c*=0x4f00, lpOverlapped=0x0) returned 1 [0175.907] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f93f60c | out: lpNewFilePointer=0x0) returned 1 [0175.907] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.907] WriteFile (in: hFile=0x1bd8, lpBuffer=0x2f93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f93f83c*, lpNumberOfBytesWritten=0x2f93f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.907] SetFilePointerEx (in: hFile=0x1bd8, liDistanceToMove=0x4f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.907] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.908] CloseHandle (hObject=0x1bd8) returned 1 [0175.908] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.play")) returned 1 [0175.911] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2521 os_tid = 0x25d8 [0175.915] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.915] ReadFile (in: hFile=0x1be0, lpBuffer=0x2fa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fa7fb34*, lpNumberOfBytesRead=0x2fa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.917] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.917] ReadFile (in: hFile=0x1be0, lpBuffer=0x2fa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fa7fb34*, lpNumberOfBytesRead=0x2fa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.920] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x2fa7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0175.920] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x2fa7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x2fa7f828, pbKeyObject=0x0) returned 0x0 [0175.920] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2fa7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2fa7f500) returned 0x0 [0175.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.920] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2fa7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2fa7f500) returned 0x0 [0175.925] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.928] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.928] WriteFile (in: hFile=0x1be0, lpBuffer=0x2fa7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fa7f830, lpOverlapped=0x0 | out: lpBuffer=0x2fa7fb34*, lpNumberOfBytesWritten=0x2fa7f830*=0x428, lpOverlapped=0x0) returned 1 [0175.928] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.928] ReadFile (in: hFile=0x1be0, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x2fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x2fa7f61c*=0x2168, lpOverlapped=0x0) returned 1 [0175.929] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xffffde98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.929] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4b50000, cbInput=0x2168, pPaddingInfo=0x0, pbIV=0x2fa7f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x2fa7f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2fa7f848, pbOutput=0x4b50000, pcbResult=0x2fa7f618) returned 0x0 [0175.929] WriteFile (in: hFile=0x1be0, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x2fa7f61c*=0x2170, lpOverlapped=0x0) returned 1 [0175.929] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fa7f60c | out: lpNewFilePointer=0x0) returned 1 [0175.929] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.930] WriteFile (in: hFile=0x1be0, lpBuffer=0x2fa7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2fa7f83c*, lpNumberOfBytesWritten=0x2fa7f61c*=0x8, lpOverlapped=0x0) returned 1 [0175.930] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x2170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.930] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.930] CloseHandle (hObject=0x1be0) returned 1 [0175.930] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.play")) returned 1 [0175.935] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2522 os_tid = 0x25dc [0175.939] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.939] ReadFile (in: hFile=0x1be8, lpBuffer=0x2fbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fbbfb34*, lpNumberOfBytesRead=0x2fbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.940] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.941] ReadFile (in: hFile=0x1be8, lpBuffer=0x2fbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2fbbfb34*, lpNumberOfBytesRead=0x2fbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0175.941] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.943] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.943] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x2fbbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0175.943] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x2fbbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x2fbbf828, pbKeyObject=0x0) returned 0x0 [0175.943] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2fbbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2fbbf500) returned 0x0 [0175.944] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.944] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2fbbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2fbbf500) returned 0x0 [0175.949] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.952] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.952] WriteFile (in: hFile=0x1be8, lpBuffer=0x2fbbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fbbf830, lpOverlapped=0x0 | out: lpBuffer=0x2fbbfb34*, lpNumberOfBytesWritten=0x2fbbf830*=0x428, lpOverlapped=0x0) returned 1 [0175.953] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.953] ReadFile (in: hFile=0x1be8, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x2fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x2fbbf61c*=0x1f3c, lpOverlapped=0x0) returned 1 [0175.955] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0xffffe0c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.955] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4c50000, cbInput=0x1f3c, pPaddingInfo=0x0, pbIV=0x2fbbf848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x2fbbf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2fbbf848, pbOutput=0x4c50000, pcbResult=0x2fbbf618) returned 0x0 [0175.955] WriteFile (in: hFile=0x1be8, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x2fbbf61c*=0x1f40, lpOverlapped=0x0) returned 1 [0175.955] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbbf60c | out: lpNewFilePointer=0x0) returned 1 [0175.955] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.955] WriteFile (in: hFile=0x1be8, lpBuffer=0x2fbbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2fbbf83c*, lpNumberOfBytesWritten=0x2fbbf61c*=0x8, lpOverlapped=0x0) returned 1 [0175.955] SetFilePointerEx (in: hFile=0x1be8, liDistanceToMove=0x1f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.955] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.955] CloseHandle (hObject=0x1be8) returned 1 [0175.956] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.play")) returned 1 [0175.960] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2523 os_tid = 0x25e0 [0175.964] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.964] ReadFile (in: hFile=0x1bf0, lpBuffer=0x2fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x2fcffb34*, lpNumberOfBytesRead=0x2fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.966] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.966] ReadFile (in: hFile=0x1bf0, lpBuffer=0x2fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x2fcffb34*, lpNumberOfBytesRead=0x2fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0175.967] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.970] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.970] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x2fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0175.970] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x2fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x2fcff828, pbKeyObject=0x0) returned 0x0 [0175.970] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2fcff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2fcff500) returned 0x0 [0175.970] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.970] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2fcff500) returned 0x0 [0175.974] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.978] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.978] WriteFile (in: hFile=0x1bf0, lpBuffer=0x2fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fcff830, lpOverlapped=0x0 | out: lpBuffer=0x2fcffb34*, lpNumberOfBytesWritten=0x2fcff830*=0x428, lpOverlapped=0x0) returned 1 [0175.978] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.978] ReadFile (in: hFile=0x1bf0, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x2fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x2fcff61c*=0x1498, lpOverlapped=0x0) returned 1 [0175.978] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xffffeb68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.978] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4d50000, cbInput=0x1498, pPaddingInfo=0x0, pbIV=0x2fcff848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x2fcff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2fcff848, pbOutput=0x4d50000, pcbResult=0x2fcff618) returned 0x0 [0175.978] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x2fcff61c*=0x14a0, lpOverlapped=0x0) returned 1 [0175.979] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcff60c | out: lpNewFilePointer=0x0) returned 1 [0175.979] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.979] WriteFile (in: hFile=0x1bf0, lpBuffer=0x2fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x2fcff83c*, lpNumberOfBytesWritten=0x2fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0175.979] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x14a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.979] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0175.979] CloseHandle (hObject=0x1bf0) returned 1 [0175.979] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0175.982] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.play")) returned 1 [0175.983] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2524 os_tid = 0x25e4 [0175.987] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.987] ReadFile (in: hFile=0x1bf8, lpBuffer=0x2fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fe3fb34*, lpNumberOfBytesRead=0x2fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.989] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.989] ReadFile (in: hFile=0x1bf8, lpBuffer=0x2fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2fe3fb34*, lpNumberOfBytesRead=0x2fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0175.990] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0175.992] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0175.992] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x2fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0175.992] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x2fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x2fe3f828, pbKeyObject=0x0) returned 0x0 [0175.992] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2fe3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2fe3f500) returned 0x0 [0175.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0175.993] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2fe3f500) returned 0x0 [0175.997] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.000] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.000] WriteFile (in: hFile=0x1bf8, lpBuffer=0x2fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x2fe3fb34*, lpNumberOfBytesWritten=0x2fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0176.000] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.000] ReadFile (in: hFile=0x1bf8, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x2fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x2fe3f61c*=0x16ec, lpOverlapped=0x0) returned 1 [0176.000] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0xffffe914, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.000] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4e50000, cbInput=0x16ec, pPaddingInfo=0x0, pbIV=0x2fe3f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x2fe3f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2fe3f848, pbOutput=0x4e50000, pcbResult=0x2fe3f618) returned 0x0 [0176.000] WriteFile (in: hFile=0x1bf8, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x2fe3f61c*=0x16f0, lpOverlapped=0x0) returned 1 [0176.001] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0176.001] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.001] WriteFile (in: hFile=0x1bf8, lpBuffer=0x2fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2fe3f83c*, lpNumberOfBytesWritten=0x2fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.001] SetFilePointerEx (in: hFile=0x1bf8, liDistanceToMove=0x16f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.001] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.001] CloseHandle (hObject=0x1bf8) returned 1 [0176.001] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.play")) returned 1 [0176.005] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2525 os_tid = 0x25e8 [0176.010] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.010] ReadFile (in: hFile=0x1878, lpBuffer=0x2ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ff7fb34*, lpNumberOfBytesRead=0x2ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.012] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.012] ReadFile (in: hFile=0x1878, lpBuffer=0x2ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ff7fb34*, lpNumberOfBytesRead=0x2ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.012] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.014] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.014] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x2ff7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0176.014] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x2ff7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x2ff7f828, pbKeyObject=0x0) returned 0x0 [0176.015] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ff7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ff7f500) returned 0x0 [0176.015] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.015] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ff7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ff7f500) returned 0x0 [0176.020] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.022] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.022] WriteFile (in: hFile=0x1878, lpBuffer=0x2ff7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ff7f830, lpOverlapped=0x0 | out: lpBuffer=0x2ff7fb34*, lpNumberOfBytesWritten=0x2ff7f830*=0x428, lpOverlapped=0x0) returned 1 [0176.023] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.023] ReadFile (in: hFile=0x1878, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x2ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x2ff7f61c*=0x2b64, lpOverlapped=0x0) returned 1 [0176.024] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xffffd49c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.024] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x4f50000, cbInput=0x2b64, pPaddingInfo=0x0, pbIV=0x2ff7f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x2ff7f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2ff7f848, pbOutput=0x4f50000, pcbResult=0x2ff7f618) returned 0x0 [0176.024] WriteFile (in: hFile=0x1878, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x2ff7f61c*=0x2b70, lpOverlapped=0x0) returned 1 [0176.024] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ff7f60c | out: lpNewFilePointer=0x0) returned 1 [0176.024] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.024] WriteFile (in: hFile=0x1878, lpBuffer=0x2ff7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ff7f83c*, lpNumberOfBytesWritten=0x2ff7f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.024] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x2b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.024] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.024] CloseHandle (hObject=0x1878) returned 1 [0176.025] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.play")) returned 1 [0176.028] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2526 os_tid = 0x25ec [0176.032] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.032] ReadFile (in: hFile=0x1c08, lpBuffer=0x300bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x300bf85c, lpOverlapped=0x0 | out: lpBuffer=0x300bfb34*, lpNumberOfBytesRead=0x300bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.033] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.034] ReadFile (in: hFile=0x1c08, lpBuffer=0x300bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x300bf85c, lpOverlapped=0x0 | out: lpBuffer=0x300bfb34*, lpNumberOfBytesRead=0x300bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.034] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.036] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.037] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x300bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0176.037] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x300bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x300bf828, pbKeyObject=0x0) returned 0x0 [0176.037] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x300bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x300bf500) returned 0x0 [0176.037] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.037] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x300bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x300bf500) returned 0x0 [0176.041] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.043] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.043] WriteFile (in: hFile=0x1c08, lpBuffer=0x300bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x300bf830, lpOverlapped=0x0 | out: lpBuffer=0x300bfb34*, lpNumberOfBytesWritten=0x300bf830*=0x428, lpOverlapped=0x0) returned 1 [0176.043] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.043] ReadFile (in: hFile=0x1c08, lpBuffer=0x2850000, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x300bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x300bf61c*=0x3734, lpOverlapped=0x0) returned 1 [0176.044] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0xffffc8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.044] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2850000, cbInput=0x3734, pPaddingInfo=0x0, pbIV=0x300bf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x300bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x300bf848, pbOutput=0x2850000, pcbResult=0x300bf618) returned 0x0 [0176.044] WriteFile (in: hFile=0x1c08, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x300bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x300bf61c*=0x3740, lpOverlapped=0x0) returned 1 [0176.044] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300bf60c | out: lpNewFilePointer=0x0) returned 1 [0176.045] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.045] WriteFile (in: hFile=0x1c08, lpBuffer=0x300bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x300bf61c, lpOverlapped=0x0 | out: lpBuffer=0x300bf83c*, lpNumberOfBytesWritten=0x300bf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.045] SetFilePointerEx (in: hFile=0x1c08, liDistanceToMove=0x3740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.045] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.045] CloseHandle (hObject=0x1c08) returned 1 [0176.045] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.play")) returned 1 [0176.048] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2527 os_tid = 0x25f0 [0176.052] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.052] ReadFile (in: hFile=0x1c10, lpBuffer=0x301ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x301ff85c, lpOverlapped=0x0 | out: lpBuffer=0x301ffb34*, lpNumberOfBytesRead=0x301ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.055] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.055] ReadFile (in: hFile=0x1c10, lpBuffer=0x301ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x301ff85c, lpOverlapped=0x0 | out: lpBuffer=0x301ffb34*, lpNumberOfBytesRead=0x301ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.055] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.057] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.058] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x301ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0176.058] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x301ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x301ff828, pbKeyObject=0x0) returned 0x0 [0176.058] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x301ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x301ff500) returned 0x0 [0176.058] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.058] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x301ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x301ff500) returned 0x0 [0176.062] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.065] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.065] WriteFile (in: hFile=0x1c10, lpBuffer=0x301ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x301ff830, lpOverlapped=0x0 | out: lpBuffer=0x301ffb34*, lpNumberOfBytesWritten=0x301ff830*=0x428, lpOverlapped=0x0) returned 1 [0176.065] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.065] ReadFile (in: hFile=0x1c10, lpBuffer=0x5050000, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x301ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x301ff61c*=0x347c, lpOverlapped=0x0) returned 1 [0176.066] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xffffcb84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.066] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5050000, cbInput=0x347c, pPaddingInfo=0x0, pbIV=0x301ff848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x301ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x301ff848, pbOutput=0x5050000, pcbResult=0x301ff618) returned 0x0 [0176.067] WriteFile (in: hFile=0x1c10, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x301ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x301ff61c*=0x3480, lpOverlapped=0x0) returned 1 [0176.067] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301ff60c | out: lpNewFilePointer=0x0) returned 1 [0176.067] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.067] WriteFile (in: hFile=0x1c10, lpBuffer=0x301ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x301ff61c, lpOverlapped=0x0 | out: lpBuffer=0x301ff83c*, lpNumberOfBytesWritten=0x301ff61c*=0x8, lpOverlapped=0x0) returned 1 [0176.067] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x3480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.067] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.067] CloseHandle (hObject=0x1c10) returned 1 [0176.067] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.play")) returned 1 [0176.071] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2528 os_tid = 0x25f4 [0176.075] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.075] ReadFile (in: hFile=0x1c18, lpBuffer=0x3033fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3033f85c, lpOverlapped=0x0 | out: lpBuffer=0x3033fb34*, lpNumberOfBytesRead=0x3033f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.077] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.077] ReadFile (in: hFile=0x1c18, lpBuffer=0x3033fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3033f85c, lpOverlapped=0x0 | out: lpBuffer=0x3033fb34*, lpNumberOfBytesRead=0x3033f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.077] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.079] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.079] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x3033f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0176.079] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x3033f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x3033f828, pbKeyObject=0x0) returned 0x0 [0176.079] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3033f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3033f500) returned 0x0 [0176.079] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.079] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3033f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3033f500) returned 0x0 [0176.084] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.086] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.086] WriteFile (in: hFile=0x1c18, lpBuffer=0x3033fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3033f830, lpOverlapped=0x0 | out: lpBuffer=0x3033fb34*, lpNumberOfBytesWritten=0x3033f830*=0x428, lpOverlapped=0x0) returned 1 [0176.086] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.086] ReadFile (in: hFile=0x1c18, lpBuffer=0x5150000, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x3033f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x3033f61c*=0x3014, lpOverlapped=0x0) returned 1 [0176.087] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0xffffcfec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.087] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5150000, cbInput=0x3014, pPaddingInfo=0x0, pbIV=0x3033f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x3033f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x3033f848, pbOutput=0x5150000, pcbResult=0x3033f618) returned 0x0 [0176.087] WriteFile (in: hFile=0x1c18, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x3033f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x3033f61c*=0x3020, lpOverlapped=0x0) returned 1 [0176.087] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3033f60c | out: lpNewFilePointer=0x0) returned 1 [0176.087] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.087] WriteFile (in: hFile=0x1c18, lpBuffer=0x3033f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3033f61c, lpOverlapped=0x0 | out: lpBuffer=0x3033f83c*, lpNumberOfBytesWritten=0x3033f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.087] SetFilePointerEx (in: hFile=0x1c18, liDistanceToMove=0x3020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.087] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.087] CloseHandle (hObject=0x1c18) returned 1 [0176.088] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.play")) returned 1 [0176.091] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2529 os_tid = 0x25f8 [0176.093] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.094] ReadFile (in: hFile=0x1c20, lpBuffer=0x3047fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3047f85c, lpOverlapped=0x0 | out: lpBuffer=0x3047fb34*, lpNumberOfBytesRead=0x3047f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.095] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.095] ReadFile (in: hFile=0x1c20, lpBuffer=0x3047fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3047f85c, lpOverlapped=0x0 | out: lpBuffer=0x3047fb34*, lpNumberOfBytesRead=0x3047f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.095] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.097] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.097] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x3047f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0176.097] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x3047f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x3047f828, pbKeyObject=0x0) returned 0x0 [0176.097] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3047f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3047f500) returned 0x0 [0176.097] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.097] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3047f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3047f500) returned 0x0 [0176.100] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.103] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.103] WriteFile (in: hFile=0x1c20, lpBuffer=0x3047fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3047f830, lpOverlapped=0x0 | out: lpBuffer=0x3047fb34*, lpNumberOfBytesWritten=0x3047f830*=0x428, lpOverlapped=0x0) returned 1 [0176.103] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.103] ReadFile (in: hFile=0x1c20, lpBuffer=0x5250000, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x3047f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x3047f61c*=0x99c, lpOverlapped=0x0) returned 1 [0176.103] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffff664, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.103] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5250000, cbInput=0x99c, pPaddingInfo=0x0, pbIV=0x3047f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x3047f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x3047f848, pbOutput=0x5250000, pcbResult=0x3047f618) returned 0x0 [0176.103] WriteFile (in: hFile=0x1c20, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x3047f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x3047f61c*=0x9a0, lpOverlapped=0x0) returned 1 [0176.104] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3047f60c | out: lpNewFilePointer=0x0) returned 1 [0176.104] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.104] WriteFile (in: hFile=0x1c20, lpBuffer=0x3047f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3047f61c, lpOverlapped=0x0 | out: lpBuffer=0x3047f83c*, lpNumberOfBytesWritten=0x3047f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.104] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x9a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.104] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.104] CloseHandle (hObject=0x1c20) returned 1 [0176.104] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.play")) returned 1 [0176.107] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2530 os_tid = 0x25fc [0176.110] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.110] ReadFile (in: hFile=0x1c28, lpBuffer=0x305bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x305bf85c, lpOverlapped=0x0 | out: lpBuffer=0x305bfb34*, lpNumberOfBytesRead=0x305bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.112] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.112] ReadFile (in: hFile=0x1c28, lpBuffer=0x305bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x305bf85c, lpOverlapped=0x0 | out: lpBuffer=0x305bfb34*, lpNumberOfBytesRead=0x305bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.112] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.113] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.113] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x305bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0176.114] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x305bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x305bf828, pbKeyObject=0x0) returned 0x0 [0176.114] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x305bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x305bf500) returned 0x0 [0176.114] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.114] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x305bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x305bf500) returned 0x0 [0176.117] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.119] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.119] WriteFile (in: hFile=0x1c28, lpBuffer=0x305bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x305bf830, lpOverlapped=0x0 | out: lpBuffer=0x305bfb34*, lpNumberOfBytesWritten=0x305bf830*=0x428, lpOverlapped=0x0) returned 1 [0176.119] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.119] ReadFile (in: hFile=0x1c28, lpBuffer=0x5350000, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x305bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x305bf61c*=0x1028, lpOverlapped=0x0) returned 1 [0176.119] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0xffffefd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.120] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5350000, cbInput=0x1028, pPaddingInfo=0x0, pbIV=0x305bf848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x305bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x305bf848, pbOutput=0x5350000, pcbResult=0x305bf618) returned 0x0 [0176.120] WriteFile (in: hFile=0x1c28, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x305bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x305bf61c*=0x1030, lpOverlapped=0x0) returned 1 [0176.120] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305bf60c | out: lpNewFilePointer=0x0) returned 1 [0176.120] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.120] WriteFile (in: hFile=0x1c28, lpBuffer=0x305bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x305bf61c, lpOverlapped=0x0 | out: lpBuffer=0x305bf83c*, lpNumberOfBytesWritten=0x305bf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.120] SetFilePointerEx (in: hFile=0x1c28, liDistanceToMove=0x1030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.120] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.120] CloseHandle (hObject=0x1c28) returned 1 [0176.120] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.play")) returned 1 [0176.123] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2531 os_tid = 0x2600 [0176.126] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.126] ReadFile (in: hFile=0x1c30, lpBuffer=0x306ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x306ff85c, lpOverlapped=0x0 | out: lpBuffer=0x306ffb34*, lpNumberOfBytesRead=0x306ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.127] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.127] ReadFile (in: hFile=0x1c30, lpBuffer=0x306ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x306ff85c, lpOverlapped=0x0 | out: lpBuffer=0x306ffb34*, lpNumberOfBytesRead=0x306ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.127] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.129] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.129] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x306ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0176.129] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x306ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x306ff828, pbKeyObject=0x0) returned 0x0 [0176.129] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x306ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x306ff500) returned 0x0 [0176.130] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.130] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x306ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x306ff500) returned 0x0 [0176.133] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.135] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.135] WriteFile (in: hFile=0x1c30, lpBuffer=0x306ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x306ff830, lpOverlapped=0x0 | out: lpBuffer=0x306ffb34*, lpNumberOfBytesWritten=0x306ff830*=0x428, lpOverlapped=0x0) returned 1 [0176.136] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.136] ReadFile (in: hFile=0x1c30, lpBuffer=0x5450000, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x306ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x306ff61c*=0x3e10, lpOverlapped=0x0) returned 1 [0176.136] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xffffc1f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.136] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5450000, cbInput=0x3e10, pPaddingInfo=0x0, pbIV=0x306ff848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x306ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x306ff848, pbOutput=0x5450000, pcbResult=0x306ff618) returned 0x0 [0176.136] WriteFile (in: hFile=0x1c30, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x306ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x306ff61c*=0x3e20, lpOverlapped=0x0) returned 1 [0176.137] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306ff60c | out: lpNewFilePointer=0x0) returned 1 [0176.137] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.137] WriteFile (in: hFile=0x1c30, lpBuffer=0x306ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x306ff61c, lpOverlapped=0x0 | out: lpBuffer=0x306ff83c*, lpNumberOfBytesWritten=0x306ff61c*=0x8, lpOverlapped=0x0) returned 1 [0176.137] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x3e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.137] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.137] CloseHandle (hObject=0x1c30) returned 1 [0176.137] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.play")) returned 1 [0176.140] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2532 os_tid = 0x2604 [0176.142] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.143] ReadFile (in: hFile=0x1c38, lpBuffer=0x3083fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3083f85c, lpOverlapped=0x0 | out: lpBuffer=0x3083fb34*, lpNumberOfBytesRead=0x3083f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.144] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.144] ReadFile (in: hFile=0x1c38, lpBuffer=0x3083fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3083f85c, lpOverlapped=0x0 | out: lpBuffer=0x3083fb34*, lpNumberOfBytesRead=0x3083f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.144] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.146] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.146] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x3083f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0176.146] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x3083f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x3083f828, pbKeyObject=0x0) returned 0x0 [0176.146] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3083f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3083f500) returned 0x0 [0176.146] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.146] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3083f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3083f500) returned 0x0 [0176.149] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.151] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.151] WriteFile (in: hFile=0x1c38, lpBuffer=0x3083fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3083f830, lpOverlapped=0x0 | out: lpBuffer=0x3083fb34*, lpNumberOfBytesWritten=0x3083f830*=0x428, lpOverlapped=0x0) returned 1 [0176.152] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.152] ReadFile (in: hFile=0x1c38, lpBuffer=0x5550000, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x3083f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x3083f61c*=0x2a64, lpOverlapped=0x0) returned 1 [0176.152] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xffffd59c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.152] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5550000, cbInput=0x2a64, pPaddingInfo=0x0, pbIV=0x3083f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x3083f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x3083f848, pbOutput=0x5550000, pcbResult=0x3083f618) returned 0x0 [0176.152] WriteFile (in: hFile=0x1c38, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x3083f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x3083f61c*=0x2a70, lpOverlapped=0x0) returned 1 [0176.152] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3083f60c | out: lpNewFilePointer=0x0) returned 1 [0176.153] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.153] WriteFile (in: hFile=0x1c38, lpBuffer=0x3083f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3083f61c, lpOverlapped=0x0 | out: lpBuffer=0x3083f83c*, lpNumberOfBytesWritten=0x3083f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.153] SetFilePointerEx (in: hFile=0x1c38, liDistanceToMove=0x2a70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.153] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.153] CloseHandle (hObject=0x1c38) returned 1 [0176.153] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.play")) returned 1 [0176.156] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2533 os_tid = 0x2608 [0176.159] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.159] ReadFile (in: hFile=0x1c40, lpBuffer=0x3097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3097f85c, lpOverlapped=0x0 | out: lpBuffer=0x3097fb34*, lpNumberOfBytesRead=0x3097f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.161] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.161] ReadFile (in: hFile=0x1c40, lpBuffer=0x3097fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3097f85c, lpOverlapped=0x0 | out: lpBuffer=0x3097fb34*, lpNumberOfBytesRead=0x3097f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.161] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.163] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x3097f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0176.163] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x3097f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x3097f828, pbKeyObject=0x0) returned 0x0 [0176.163] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3097f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3097f500) returned 0x0 [0176.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.163] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3097f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3097f500) returned 0x0 [0176.167] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.169] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.169] WriteFile (in: hFile=0x1c40, lpBuffer=0x3097fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3097f830, lpOverlapped=0x0 | out: lpBuffer=0x3097fb34*, lpNumberOfBytesWritten=0x3097f830*=0x428, lpOverlapped=0x0) returned 1 [0176.169] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.169] ReadFile (in: hFile=0x1c40, lpBuffer=0x5650000, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x3097f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x3097f61c*=0x2c18, lpOverlapped=0x0) returned 1 [0176.170] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xffffd3e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.170] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5650000, cbInput=0x2c18, pPaddingInfo=0x0, pbIV=0x3097f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x3097f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x3097f848, pbOutput=0x5650000, pcbResult=0x3097f618) returned 0x0 [0176.170] WriteFile (in: hFile=0x1c40, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x3097f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x3097f61c*=0x2c20, lpOverlapped=0x0) returned 1 [0176.170] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3097f60c | out: lpNewFilePointer=0x0) returned 1 [0176.170] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.170] WriteFile (in: hFile=0x1c40, lpBuffer=0x3097f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3097f61c, lpOverlapped=0x0 | out: lpBuffer=0x3097f83c*, lpNumberOfBytesWritten=0x3097f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.170] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x2c20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.170] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.170] CloseHandle (hObject=0x1c40) returned 1 [0176.171] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.play")) returned 1 [0176.173] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2534 os_tid = 0x260c [0176.177] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.177] ReadFile (in: hFile=0x1c48, lpBuffer=0x30abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30abf85c, lpOverlapped=0x0 | out: lpBuffer=0x30abfb34*, lpNumberOfBytesRead=0x30abf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.178] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.178] ReadFile (in: hFile=0x1c48, lpBuffer=0x30abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30abf85c, lpOverlapped=0x0 | out: lpBuffer=0x30abfb34*, lpNumberOfBytesRead=0x30abf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.178] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.180] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.180] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x30abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0176.180] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x30abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x30abf828, pbKeyObject=0x0) returned 0x0 [0176.180] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30abf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30abf500) returned 0x0 [0176.180] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.180] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30abf500) returned 0x0 [0176.184] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.186] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.186] WriteFile (in: hFile=0x1c48, lpBuffer=0x30abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30abf830, lpOverlapped=0x0 | out: lpBuffer=0x30abfb34*, lpNumberOfBytesWritten=0x30abf830*=0x428, lpOverlapped=0x0) returned 1 [0176.186] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.186] ReadFile (in: hFile=0x1c48, lpBuffer=0x5750000, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x30abf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x30abf61c*=0x1984, lpOverlapped=0x0) returned 1 [0176.187] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0xffffe67c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.187] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5750000, cbInput=0x1984, pPaddingInfo=0x0, pbIV=0x30abf848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x30abf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x30abf848, pbOutput=0x5750000, pcbResult=0x30abf618) returned 0x0 [0176.187] WriteFile (in: hFile=0x1c48, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x30abf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x30abf61c*=0x1990, lpOverlapped=0x0) returned 1 [0176.187] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30abf60c | out: lpNewFilePointer=0x0) returned 1 [0176.187] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.187] WriteFile (in: hFile=0x1c48, lpBuffer=0x30abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30abf61c, lpOverlapped=0x0 | out: lpBuffer=0x30abf83c*, lpNumberOfBytesWritten=0x30abf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.187] SetFilePointerEx (in: hFile=0x1c48, liDistanceToMove=0x1990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.187] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.187] CloseHandle (hObject=0x1c48) returned 1 [0176.187] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.play")) returned 1 [0176.190] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2535 os_tid = 0x2610 [0176.193] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.193] ReadFile (in: hFile=0x1c50, lpBuffer=0x30bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bff85c, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesRead=0x30bff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.195] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.195] ReadFile (in: hFile=0x1c50, lpBuffer=0x30bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bff85c, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesRead=0x30bff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.195] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.197] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.197] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x30bff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0176.197] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x30bff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x30bff828, pbKeyObject=0x0) returned 0x0 [0176.197] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30bff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30bff500) returned 0x0 [0176.197] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.197] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30bff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30bff500) returned 0x0 [0176.200] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.202] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.202] WriteFile (in: hFile=0x1c50, lpBuffer=0x30bffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bff830, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesWritten=0x30bff830*=0x428, lpOverlapped=0x0) returned 1 [0176.202] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.202] ReadFile (in: hFile=0x1c50, lpBuffer=0x5850000, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x30bff61c*=0x1094, lpOverlapped=0x0) returned 1 [0176.202] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xffffef6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.203] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5850000, cbInput=0x1094, pPaddingInfo=0x0, pbIV=0x30bff848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x30bff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x30bff848, pbOutput=0x5850000, pcbResult=0x30bff618) returned 0x0 [0176.203] WriteFile (in: hFile=0x1c50, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x30bff61c*=0x10a0, lpOverlapped=0x0) returned 1 [0176.203] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bff60c | out: lpNewFilePointer=0x0) returned 1 [0176.203] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.203] WriteFile (in: hFile=0x1c50, lpBuffer=0x30bff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x30bff83c*, lpNumberOfBytesWritten=0x30bff61c*=0x8, lpOverlapped=0x0) returned 1 [0176.203] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x10a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.203] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.203] CloseHandle (hObject=0x1c50) returned 1 [0176.203] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.play")) returned 1 [0176.206] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2536 os_tid = 0x2614 [0176.208] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.208] ReadFile (in: hFile=0x1c58, lpBuffer=0x30d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x30d3fb34*, lpNumberOfBytesRead=0x30d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.210] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.210] ReadFile (in: hFile=0x1c58, lpBuffer=0x30d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x30d3fb34*, lpNumberOfBytesRead=0x30d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.210] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.212] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x30d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0176.212] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x30d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x30d3f828, pbKeyObject=0x0) returned 0x0 [0176.212] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30d3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30d3f500) returned 0x0 [0176.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.212] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30d3f500) returned 0x0 [0176.215] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.217] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.217] WriteFile (in: hFile=0x1c58, lpBuffer=0x30d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30d3f830, lpOverlapped=0x0 | out: lpBuffer=0x30d3fb34*, lpNumberOfBytesWritten=0x30d3f830*=0x428, lpOverlapped=0x0) returned 1 [0176.218] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.218] ReadFile (in: hFile=0x1c58, lpBuffer=0x5950000, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x30d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x30d3f61c*=0x13d4, lpOverlapped=0x0) returned 1 [0176.218] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0xffffec2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.218] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5950000, cbInput=0x13d4, pPaddingInfo=0x0, pbIV=0x30d3f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x30d3f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x30d3f848, pbOutput=0x5950000, pcbResult=0x30d3f618) returned 0x0 [0176.218] WriteFile (in: hFile=0x1c58, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x30d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x30d3f61c*=0x13e0, lpOverlapped=0x0) returned 1 [0176.218] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30d3f60c | out: lpNewFilePointer=0x0) returned 1 [0176.218] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.218] WriteFile (in: hFile=0x1c58, lpBuffer=0x30d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x30d3f83c*, lpNumberOfBytesWritten=0x30d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.218] SetFilePointerEx (in: hFile=0x1c58, liDistanceToMove=0x13e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.218] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.218] CloseHandle (hObject=0x1c58) returned 1 [0176.218] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.play")) returned 1 [0176.248] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2537 os_tid = 0x2618 [0176.221] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.221] ReadFile (in: hFile=0x1c60, lpBuffer=0x30e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesRead=0x30e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.222] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.222] ReadFile (in: hFile=0x1c60, lpBuffer=0x30e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesRead=0x30e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.222] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0176.224] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0176.224] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x30e7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0176.224] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x30e7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x30e7f828, pbKeyObject=0x0) returned 0x0 [0176.224] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x30e7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x30e7f500) returned 0x0 [0176.224] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0176.224] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x30e7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x30e7f500) returned 0x0 [0176.228] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.230] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.230] WriteFile (in: hFile=0x1c60, lpBuffer=0x30e7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30e7f830, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesWritten=0x30e7f830*=0x428, lpOverlapped=0x0) returned 1 [0176.230] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.230] ReadFile (in: hFile=0x1c60, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x30e7f61c*=0x5c78, lpOverlapped=0x0) returned 1 [0176.231] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0xffffa388, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.231] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5a50000, cbInput=0x5c78, pPaddingInfo=0x0, pbIV=0x30e7f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x30e7f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x30e7f848, pbOutput=0x5a50000, pcbResult=0x30e7f618) returned 0x0 [0176.231] WriteFile (in: hFile=0x1c60, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x30e7f61c*=0x5c80, lpOverlapped=0x0) returned 1 [0176.231] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30e7f60c | out: lpNewFilePointer=0x0) returned 1 [0176.231] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.231] WriteFile (in: hFile=0x1c60, lpBuffer=0x30e7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x30e7f83c*, lpNumberOfBytesWritten=0x30e7f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.232] SetFilePointerEx (in: hFile=0x1c60, liDistanceToMove=0x5c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.232] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.232] CloseHandle (hObject=0x1c60) returned 1 [0176.243] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0176.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.play")) returned 1 [0176.254] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2538 os_tid = 0x261c [0176.232] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.232] ReadFile (in: hFile=0x1c68, lpBuffer=0x30fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30fbfb34*, lpNumberOfBytesRead=0x30fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.233] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.233] ReadFile (in: hFile=0x1c68, lpBuffer=0x30fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30fbfb34*, lpNumberOfBytesRead=0x30fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.233] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0176.235] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0176.235] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x30fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0176.235] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x30fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x30fbf828, pbKeyObject=0x0) returned 0x0 [0176.235] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x30fbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x30fbf500) returned 0x0 [0176.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0176.236] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x30fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x30fbf500) returned 0x0 [0176.239] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.241] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.241] WriteFile (in: hFile=0x1c68, lpBuffer=0x30fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30fbf830, lpOverlapped=0x0 | out: lpBuffer=0x30fbfb34*, lpNumberOfBytesWritten=0x30fbf830*=0x428, lpOverlapped=0x0) returned 1 [0176.241] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.241] ReadFile (in: hFile=0x1c68, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x30fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x30fbf61c*=0x1f1c, lpOverlapped=0x0) returned 1 [0176.242] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xffffe0e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.242] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5b50000, cbInput=0x1f1c, pPaddingInfo=0x0, pbIV=0x30fbf848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x30fbf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x30fbf848, pbOutput=0x5b50000, pcbResult=0x30fbf618) returned 0x0 [0176.242] WriteFile (in: hFile=0x1c68, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x30fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x30fbf61c*=0x1f20, lpOverlapped=0x0) returned 1 [0176.242] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30fbf60c | out: lpNewFilePointer=0x0) returned 1 [0176.242] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.242] WriteFile (in: hFile=0x1c68, lpBuffer=0x30fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30fbf83c*, lpNumberOfBytesWritten=0x30fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.242] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x1f20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.243] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.243] CloseHandle (hObject=0x1c68) returned 1 [0176.245] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0176.246] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.play")) returned 1 [0176.252] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2539 os_tid = 0x2620 [0176.257] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.257] ReadFile (in: hFile=0x1c70, lpBuffer=0x310ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x310ff85c, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesRead=0x310ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.259] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.260] ReadFile (in: hFile=0x1c70, lpBuffer=0x310ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x310ff85c, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesRead=0x310ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.260] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.261] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.261] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x310ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0176.261] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x310ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x310ff828, pbKeyObject=0x0) returned 0x0 [0176.261] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x310ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x310ff500) returned 0x0 [0176.261] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.262] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x310ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x310ff500) returned 0x0 [0176.265] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.267] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.267] WriteFile (in: hFile=0x1c70, lpBuffer=0x310ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x310ff830, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesWritten=0x310ff830*=0x428, lpOverlapped=0x0) returned 1 [0176.267] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.267] ReadFile (in: hFile=0x1c70, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x310ff61c*=0x40cc, lpOverlapped=0x0) returned 1 [0176.268] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xffffbf34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.268] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5c50000, cbInput=0x40cc, pPaddingInfo=0x0, pbIV=0x310ff848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x310ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x310ff848, pbOutput=0x5c50000, pcbResult=0x310ff618) returned 0x0 [0176.268] WriteFile (in: hFile=0x1c70, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x310ff61c*=0x40d0, lpOverlapped=0x0) returned 1 [0176.268] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310ff60c | out: lpNewFilePointer=0x0) returned 1 [0176.268] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.268] WriteFile (in: hFile=0x1c70, lpBuffer=0x310ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x310ff83c*, lpNumberOfBytesWritten=0x310ff61c*=0x8, lpOverlapped=0x0) returned 1 [0176.268] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x40d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.268] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.268] CloseHandle (hObject=0x1c70) returned 1 [0176.268] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.play")) returned 1 [0176.271] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2540 os_tid = 0x2624 [0176.274] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.274] ReadFile (in: hFile=0x1c78, lpBuffer=0x3123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3123f85c, lpOverlapped=0x0 | out: lpBuffer=0x3123fb34*, lpNumberOfBytesRead=0x3123f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.275] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.275] ReadFile (in: hFile=0x1c78, lpBuffer=0x3123fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3123f85c, lpOverlapped=0x0 | out: lpBuffer=0x3123fb34*, lpNumberOfBytesRead=0x3123f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.275] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.277] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.277] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x3123f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0176.277] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x3123f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x3123f828, pbKeyObject=0x0) returned 0x0 [0176.277] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3123f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3123f500) returned 0x0 [0176.277] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.277] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3123f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3123f500) returned 0x0 [0176.280] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.282] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.283] WriteFile (in: hFile=0x1c78, lpBuffer=0x3123fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3123f830, lpOverlapped=0x0 | out: lpBuffer=0x3123fb34*, lpNumberOfBytesWritten=0x3123f830*=0x428, lpOverlapped=0x0) returned 1 [0176.283] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.283] ReadFile (in: hFile=0x1c78, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x3123f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x3123f61c*=0x2ce4, lpOverlapped=0x0) returned 1 [0176.283] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0xffffd31c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.283] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5d50000, cbInput=0x2ce4, pPaddingInfo=0x0, pbIV=0x3123f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x3123f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x3123f848, pbOutput=0x5d50000, pcbResult=0x3123f618) returned 0x0 [0176.283] WriteFile (in: hFile=0x1c78, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x3123f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x3123f61c*=0x2cf0, lpOverlapped=0x0) returned 1 [0176.284] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3123f60c | out: lpNewFilePointer=0x0) returned 1 [0176.284] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.284] WriteFile (in: hFile=0x1c78, lpBuffer=0x3123f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3123f61c, lpOverlapped=0x0 | out: lpBuffer=0x3123f83c*, lpNumberOfBytesWritten=0x3123f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.284] SetFilePointerEx (in: hFile=0x1c78, liDistanceToMove=0x2cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.284] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.284] CloseHandle (hObject=0x1c78) returned 1 [0176.284] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.play")) returned 1 [0176.286] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2541 os_tid = 0x2628 [0176.289] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.290] ReadFile (in: hFile=0x1c80, lpBuffer=0x3137fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3137f85c, lpOverlapped=0x0 | out: lpBuffer=0x3137fb34*, lpNumberOfBytesRead=0x3137f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.292] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.292] ReadFile (in: hFile=0x1c80, lpBuffer=0x3137fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3137f85c, lpOverlapped=0x0 | out: lpBuffer=0x3137fb34*, lpNumberOfBytesRead=0x3137f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.292] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.294] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.294] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x3137f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0176.294] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x3137f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x3137f828, pbKeyObject=0x0) returned 0x0 [0176.294] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3137f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3137f500) returned 0x0 [0176.294] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.294] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3137f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3137f500) returned 0x0 [0176.297] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.299] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.299] WriteFile (in: hFile=0x1c80, lpBuffer=0x3137fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3137f830, lpOverlapped=0x0 | out: lpBuffer=0x3137fb34*, lpNumberOfBytesWritten=0x3137f830*=0x428, lpOverlapped=0x0) returned 1 [0176.300] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.300] ReadFile (in: hFile=0x1c80, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x3137f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x3137f61c*=0x7680, lpOverlapped=0x0) returned 1 [0176.300] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xffff8980, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.300] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5e50000, cbInput=0x7680, pPaddingInfo=0x0, pbIV=0x3137f848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x3137f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x3137f848, pbOutput=0x5e50000, pcbResult=0x3137f618) returned 0x0 [0176.300] WriteFile (in: hFile=0x1c80, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x3137f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x3137f61c*=0x7690, lpOverlapped=0x0) returned 1 [0176.301] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3137f60c | out: lpNewFilePointer=0x0) returned 1 [0176.301] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.301] WriteFile (in: hFile=0x1c80, lpBuffer=0x3137f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3137f61c, lpOverlapped=0x0 | out: lpBuffer=0x3137f83c*, lpNumberOfBytesWritten=0x3137f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.301] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x7690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.301] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.301] CloseHandle (hObject=0x1c80) returned 1 [0176.301] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.play")) returned 1 [0176.304] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2542 os_tid = 0x262c [0176.400] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.400] ReadFile (in: hFile=0x1c88, lpBuffer=0x314bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314bf85c, lpOverlapped=0x0 | out: lpBuffer=0x314bfb34*, lpNumberOfBytesRead=0x314bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.402] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.402] ReadFile (in: hFile=0x1c88, lpBuffer=0x314bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314bf85c, lpOverlapped=0x0 | out: lpBuffer=0x314bfb34*, lpNumberOfBytesRead=0x314bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.402] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.404] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.404] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x314bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0176.404] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x314bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x314bf828, pbKeyObject=0x0) returned 0x0 [0176.405] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x314bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x314bf500) returned 0x0 [0176.405] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.405] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x314bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x314bf500) returned 0x0 [0176.408] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.411] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.411] WriteFile (in: hFile=0x1c88, lpBuffer=0x314bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x314bf830, lpOverlapped=0x0 | out: lpBuffer=0x314bfb34*, lpNumberOfBytesWritten=0x314bf830*=0x428, lpOverlapped=0x0) returned 1 [0176.411] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.411] ReadFile (in: hFile=0x1c88, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x314bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x314bf61c*=0x1338, lpOverlapped=0x0) returned 1 [0176.411] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0xffffecc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.411] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5f50000, cbInput=0x1338, pPaddingInfo=0x0, pbIV=0x314bf848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x314bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x314bf848, pbOutput=0x5f50000, pcbResult=0x314bf618) returned 0x0 [0176.411] WriteFile (in: hFile=0x1c88, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x314bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x314bf61c*=0x1340, lpOverlapped=0x0) returned 1 [0176.411] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314bf60c | out: lpNewFilePointer=0x0) returned 1 [0176.411] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.411] WriteFile (in: hFile=0x1c88, lpBuffer=0x314bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x314bf61c, lpOverlapped=0x0 | out: lpBuffer=0x314bf83c*, lpNumberOfBytesWritten=0x314bf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.412] SetFilePointerEx (in: hFile=0x1c88, liDistanceToMove=0x1340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.412] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.412] CloseHandle (hObject=0x1c88) returned 1 [0176.412] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.play")) returned 1 [0176.415] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2543 os_tid = 0x2630 [0176.418] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.418] ReadFile (in: hFile=0x1c90, lpBuffer=0x315ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x315ff85c, lpOverlapped=0x0 | out: lpBuffer=0x315ffb34*, lpNumberOfBytesRead=0x315ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.420] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.420] ReadFile (in: hFile=0x1c90, lpBuffer=0x315ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x315ff85c, lpOverlapped=0x0 | out: lpBuffer=0x315ffb34*, lpNumberOfBytesRead=0x315ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.420] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.422] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.422] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x315ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0176.422] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x315ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x315ff828, pbKeyObject=0x0) returned 0x0 [0176.422] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x315ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x315ff500) returned 0x0 [0176.422] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.422] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x315ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x315ff500) returned 0x0 [0176.425] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.428] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.428] WriteFile (in: hFile=0x1c90, lpBuffer=0x315ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x315ff830, lpOverlapped=0x0 | out: lpBuffer=0x315ffb34*, lpNumberOfBytesWritten=0x315ff830*=0x428, lpOverlapped=0x0) returned 1 [0176.428] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.428] ReadFile (in: hFile=0x1c90, lpBuffer=0x6050000, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x315ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x315ff61c*=0x52e0, lpOverlapped=0x0) returned 1 [0176.429] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xffffad20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.429] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x6050000, cbInput=0x52e0, pPaddingInfo=0x0, pbIV=0x315ff848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x315ff618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x315ff848, pbOutput=0x6050000, pcbResult=0x315ff618) returned 0x0 [0176.429] WriteFile (in: hFile=0x1c90, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x315ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x315ff61c*=0x52f0, lpOverlapped=0x0) returned 1 [0176.429] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315ff60c | out: lpNewFilePointer=0x0) returned 1 [0176.429] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.429] WriteFile (in: hFile=0x1c90, lpBuffer=0x315ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x315ff61c, lpOverlapped=0x0 | out: lpBuffer=0x315ff83c*, lpNumberOfBytesWritten=0x315ff61c*=0x8, lpOverlapped=0x0) returned 1 [0176.429] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x52f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.429] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.429] CloseHandle (hObject=0x1c90) returned 1 [0176.429] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.431] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.play")) returned 1 [0176.432] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2544 os_tid = 0x2634 [0176.435] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.436] ReadFile (in: hFile=0x1c98, lpBuffer=0x3173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3173f85c, lpOverlapped=0x0 | out: lpBuffer=0x3173fb34*, lpNumberOfBytesRead=0x3173f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.437] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.437] ReadFile (in: hFile=0x1c98, lpBuffer=0x3173fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3173f85c, lpOverlapped=0x0 | out: lpBuffer=0x3173fb34*, lpNumberOfBytesRead=0x3173f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.437] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.439] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.439] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x3173f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0176.439] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x3173f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x3173f828, pbKeyObject=0x0) returned 0x0 [0176.439] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3173f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3173f500) returned 0x0 [0176.439] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.439] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3173f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3173f500) returned 0x0 [0176.442] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.444] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.444] WriteFile (in: hFile=0x1c98, lpBuffer=0x3173fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3173f830, lpOverlapped=0x0 | out: lpBuffer=0x3173fb34*, lpNumberOfBytesWritten=0x3173f830*=0x428, lpOverlapped=0x0) returned 1 [0176.445] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.445] ReadFile (in: hFile=0x1c98, lpBuffer=0x6150000, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x3173f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x3173f61c*=0xe8c, lpOverlapped=0x0) returned 1 [0176.445] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0xfffff174, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.445] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x6150000, cbInput=0xe8c, pPaddingInfo=0x0, pbIV=0x3173f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x3173f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x3173f848, pbOutput=0x6150000, pcbResult=0x3173f618) returned 0x0 [0176.445] WriteFile (in: hFile=0x1c98, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x3173f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x3173f61c*=0xe90, lpOverlapped=0x0) returned 1 [0176.445] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3173f60c | out: lpNewFilePointer=0x0) returned 1 [0176.445] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.445] WriteFile (in: hFile=0x1c98, lpBuffer=0x3173f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3173f61c, lpOverlapped=0x0 | out: lpBuffer=0x3173f83c*, lpNumberOfBytesWritten=0x3173f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.445] SetFilePointerEx (in: hFile=0x1c98, liDistanceToMove=0xe90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.445] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.445] CloseHandle (hObject=0x1c98) returned 1 [0176.446] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.447] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.play")) returned 1 [0176.449] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2545 os_tid = 0x2638 [0176.521] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.521] ReadFile (in: hFile=0x1ca0, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.523] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.523] ReadFile (in: hFile=0x1ca0, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.523] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.525] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.525] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0176.525] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0176.525] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x141cf500) returned 0x0 [0176.525] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.526] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x141cf500) returned 0x0 [0176.529] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.532] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.532] WriteFile (in: hFile=0x1ca0, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0176.532] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.532] ReadFile (in: hFile=0x1ca0, lpBuffer=0x6250000, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x141cf61c*=0xdf0, lpOverlapped=0x0) returned 1 [0176.532] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0xfffff210, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.532] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x6250000, cbInput=0xdf0, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x141cf848, pbOutput=0x6250000, pcbResult=0x141cf618) returned 0x0 [0176.532] WriteFile (in: hFile=0x1ca0, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x141cf61c*=0xe00, lpOverlapped=0x0) returned 1 [0176.532] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0176.532] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.533] WriteFile (in: hFile=0x1ca0, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.533] SetFilePointerEx (in: hFile=0x1ca0, liDistanceToMove=0xe00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.533] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0176.533] CloseHandle (hObject=0x1ca0) returned 1 [0176.533] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0176.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.play")) returned 1 [0176.536] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2546 os_tid = 0x263c [0176.539] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.539] ReadFile (in: hFile=0x1c90, lpBuffer=0x1430fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1430f85c, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesRead=0x1430f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.582] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.582] ReadFile (in: hFile=0x1c90, lpBuffer=0x1430fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1430f85c, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesRead=0x1430f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.583] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.586] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.586] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1430f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0176.586] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1430f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1430f828, pbKeyObject=0x0) returned 0x0 [0176.586] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1430f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1430f500) returned 0x0 [0176.586] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.588] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1430f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1430f500) returned 0x0 [0176.592] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.595] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.595] WriteFile (in: hFile=0x1c90, lpBuffer=0x1430fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1430f830, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesWritten=0x1430f830*=0x428, lpOverlapped=0x0) returned 1 [0176.808] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.808] ReadFile (in: hFile=0x1c90, lpBuffer=0x2750000, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1430f61c*=0x258c, lpOverlapped=0x0) returned 1 [0177.081] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xffffda74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.081] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2750000, cbInput=0x258c, pPaddingInfo=0x0, pbIV=0x1430f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1430f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x1430f848, pbOutput=0x2750000, pcbResult=0x1430f618) returned 0x0 [0177.081] WriteFile (in: hFile=0x1c90, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1430f61c*=0x2590, lpOverlapped=0x0) returned 1 [0177.081] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1430f60c | out: lpNewFilePointer=0x0) returned 1 [0177.081] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.081] WriteFile (in: hFile=0x1c90, lpBuffer=0x1430f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x1430f83c*, lpNumberOfBytesWritten=0x1430f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.082] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x2590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.082] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0177.082] CloseHandle (hObject=0x1c90) returned 1 [0177.120] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4c0000 [0177.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.play")) returned 1 [0178.185] VirtualFree (lpAddress=0xb4c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2547 os_tid = 0x2640 [0176.595] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.595] ReadFile (in: hFile=0x1c80, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.597] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.597] ReadFile (in: hFile=0x1c80, lpBuffer=0x297bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x297bf85c, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesRead=0x297bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.597] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.599] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x297bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0176.599] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x297bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x297bf828, pbKeyObject=0x0) returned 0x0 [0176.599] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x297bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x297bf500) returned 0x0 [0176.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.599] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x297bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x297bf500) returned 0x0 [0176.603] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.605] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.605] WriteFile (in: hFile=0x1c80, lpBuffer=0x297bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x297bf830, lpOverlapped=0x0 | out: lpBuffer=0x297bfb34*, lpNumberOfBytesWritten=0x297bf830*=0x428, lpOverlapped=0x0) returned 1 [0176.824] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.824] ReadFile (in: hFile=0x1c80, lpBuffer=0x2850000, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x297bf61c*=0x1788, lpOverlapped=0x0) returned 1 [0176.824] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xffffe878, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.824] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2850000, cbInput=0x1788, pPaddingInfo=0x0, pbIV=0x297bf848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x297bf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x297bf848, pbOutput=0x2850000, pcbResult=0x297bf618) returned 0x0 [0176.824] WriteFile (in: hFile=0x1c80, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x297bf61c*=0x1790, lpOverlapped=0x0) returned 1 [0176.824] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x297bf60c | out: lpNewFilePointer=0x0) returned 1 [0176.824] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.824] WriteFile (in: hFile=0x1c80, lpBuffer=0x297bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x297bf61c, lpOverlapped=0x0 | out: lpBuffer=0x297bf83c*, lpNumberOfBytesWritten=0x297bf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.824] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x1790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.824] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0176.824] CloseHandle (hObject=0x1c80) returned 1 [0176.824] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0176.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.play")) returned 1 [0176.827] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2548 os_tid = 0x2644 [0176.605] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.605] ReadFile (in: hFile=0x1c70, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.607] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.607] ReadFile (in: hFile=0x1c70, lpBuffer=0x298ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x298ff85c, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesRead=0x298ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.607] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.609] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.609] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x298ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0176.609] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x298ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x298ff828, pbKeyObject=0x0) returned 0x0 [0176.609] BCryptExportKey (in: hKey=0x7f1c80, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x298ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x298ff500) returned 0x0 [0176.609] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.609] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x298ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x298ff500) returned 0x0 [0176.612] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.614] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.615] WriteFile (in: hFile=0x1c70, lpBuffer=0x298ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x298ff830, lpOverlapped=0x0 | out: lpBuffer=0x298ffb34*, lpNumberOfBytesWritten=0x298ff830*=0x428, lpOverlapped=0x0) returned 1 [0176.817] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.817] ReadFile (in: hFile=0x1c70, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x298ff61c*=0x1374, lpOverlapped=0x0) returned 1 [0176.817] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xffffec8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.817] BCryptEncrypt (in: hKey=0x7f1c80, pbInput=0x2950000, cbInput=0x1374, pPaddingInfo=0x0, pbIV=0x298ff848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x298ff618, dwFlags=0x1 | out: hKey=0x7f1c80, pbIV=0x298ff848, pbOutput=0x2950000, pcbResult=0x298ff618) returned 0x0 [0176.817] WriteFile (in: hFile=0x1c70, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x298ff61c*=0x1380, lpOverlapped=0x0) returned 1 [0176.817] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298ff60c | out: lpNewFilePointer=0x0) returned 1 [0176.817] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.817] WriteFile (in: hFile=0x1c70, lpBuffer=0x298ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x298ff61c, lpOverlapped=0x0 | out: lpBuffer=0x298ff83c*, lpNumberOfBytesWritten=0x298ff61c*=0x8, lpOverlapped=0x0) returned 1 [0176.817] SetFilePointerEx (in: hFile=0x1c70, liDistanceToMove=0x1380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.817] BCryptDestroyKey (in: hKey=0x7f1c80 | out: hKey=0x7f1c80) returned 0x0 [0176.817] CloseHandle (hObject=0x1c70) returned 1 [0176.817] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0176.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.play")) returned 1 [0176.820] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2549 os_tid = 0x2648 [0176.618] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.618] ReadFile (in: hFile=0x1c68, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.619] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.619] ReadFile (in: hFile=0x1c68, lpBuffer=0x29a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesRead=0x29a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.619] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.621] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.621] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x29a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0176.621] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x29a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x29a3f828, pbKeyObject=0x0) returned 0x0 [0176.621] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x29a3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x29a3f500) returned 0x0 [0176.621] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.621] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x29a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x29a3f500) returned 0x0 [0176.625] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.628] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.628] WriteFile (in: hFile=0x1c68, lpBuffer=0x29a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29a3f830, lpOverlapped=0x0 | out: lpBuffer=0x29a3fb34*, lpNumberOfBytesWritten=0x29a3f830*=0x428, lpOverlapped=0x0) returned 1 [0176.809] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.809] ReadFile (in: hFile=0x1c68, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x29a3f61c*=0xbe0, lpOverlapped=0x0) returned 1 [0176.809] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffff420, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.809] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0xbe0, pPaddingInfo=0x0, pbIV=0x29a3f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x29a3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x29a3f848, pbOutput=0x2a50000, pcbResult=0x29a3f618) returned 0x0 [0176.809] WriteFile (in: hFile=0x1c68, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x29a3f61c*=0xbf0, lpOverlapped=0x0) returned 1 [0176.809] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29a3f60c | out: lpNewFilePointer=0x0) returned 1 [0176.809] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.810] WriteFile (in: hFile=0x1c68, lpBuffer=0x29a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29a3f83c*, lpNumberOfBytesWritten=0x29a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.810] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xbf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.810] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0176.810] CloseHandle (hObject=0x1c68) returned 1 [0176.810] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0176.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.play")) returned 1 [0176.813] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2550 os_tid = 0x264c [0176.628] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.628] ReadFile (in: hFile=0x1c50, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.630] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.630] ReadFile (in: hFile=0x1c50, lpBuffer=0x29b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesRead=0x29b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.630] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.631] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.631] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x29b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0176.631] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x29b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x29b7f828, pbKeyObject=0x0) returned 0x0 [0176.631] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x29b7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x29b7f500) returned 0x0 [0176.632] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.632] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x29b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x29b7f500) returned 0x0 [0176.635] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.637] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.637] WriteFile (in: hFile=0x1c50, lpBuffer=0x29b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29b7f830, lpOverlapped=0x0 | out: lpBuffer=0x29b7fb34*, lpNumberOfBytesWritten=0x29b7f830*=0x428, lpOverlapped=0x0) returned 1 [0176.809] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.809] ReadFile (in: hFile=0x1c50, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x29b7f61c*=0x1f40, lpOverlapped=0x0) returned 1 [0177.079] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xffffe0c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.079] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x2b50000, cbInput=0x1f40, pPaddingInfo=0x0, pbIV=0x29b7f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x29b7f618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x29b7f848, pbOutput=0x2b50000, pcbResult=0x29b7f618) returned 0x0 [0177.079] WriteFile (in: hFile=0x1c50, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x29b7f61c*=0x1f50, lpOverlapped=0x0) returned 1 [0177.079] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29b7f60c | out: lpNewFilePointer=0x0) returned 1 [0177.079] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.079] WriteFile (in: hFile=0x1c50, lpBuffer=0x29b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x29b7f83c*, lpNumberOfBytesWritten=0x29b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.079] SetFilePointerEx (in: hFile=0x1c50, liDistanceToMove=0x1f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.079] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0177.079] CloseHandle (hObject=0x1c50) returned 1 [0177.113] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb110000 [0177.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.play")) returned 1 [0178.192] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2551 os_tid = 0x2650 [0176.638] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.638] ReadFile (in: hFile=0x1c40, lpBuffer=0x2d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesRead=0x2d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.640] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.640] ReadFile (in: hFile=0x1c40, lpBuffer=0x2d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesRead=0x2d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.640] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.641] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.641] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x2d3bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0176.641] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x2d3bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x2d3bf828, pbKeyObject=0x0) returned 0x0 [0176.641] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d3bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d3bf500) returned 0x0 [0176.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.642] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d3bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d3bf500) returned 0x0 [0176.645] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.647] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.647] WriteFile (in: hFile=0x1c40, lpBuffer=0x2d3bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d3bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb34*, lpNumberOfBytesWritten=0x2d3bf830*=0x428, lpOverlapped=0x0) returned 1 [0176.808] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.808] ReadFile (in: hFile=0x1c40, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x2d3bf61c*=0x4054, lpOverlapped=0x0) returned 1 [0177.080] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xffffbfac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.080] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2c50000, cbInput=0x4054, pPaddingInfo=0x0, pbIV=0x2d3bf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x2d3bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d3bf848, pbOutput=0x2c50000, pcbResult=0x2d3bf618) returned 0x0 [0177.080] WriteFile (in: hFile=0x1c40, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x2d3bf61c*=0x4060, lpOverlapped=0x0) returned 1 [0177.080] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.080] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.080] WriteFile (in: hFile=0x1c40, lpBuffer=0x2d3bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d3bf83c*, lpNumberOfBytesWritten=0x2d3bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.080] SetFilePointerEx (in: hFile=0x1c40, liDistanceToMove=0x4060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.080] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0177.080] CloseHandle (hObject=0x1c40) returned 1 [0177.116] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4a0000 [0177.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.play")) returned 1 [0178.193] VirtualFree (lpAddress=0xb4a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2552 os_tid = 0x2654 [0176.647] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.648] ReadFile (in: hFile=0x1c30, lpBuffer=0x2d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesRead=0x2d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.649] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.649] ReadFile (in: hFile=0x1c30, lpBuffer=0x2d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesRead=0x2d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.650] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.651] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.651] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2d4ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0176.651] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2d4ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2d4ff828, pbKeyObject=0x0) returned 0x0 [0176.651] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d4ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d4ff500) returned 0x0 [0176.651] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.652] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d4ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d4ff500) returned 0x0 [0176.655] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.657] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.658] WriteFile (in: hFile=0x1c30, lpBuffer=0x2d4ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d4ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d4ffb34*, lpNumberOfBytesWritten=0x2d4ff830*=0x428, lpOverlapped=0x0) returned 1 [0176.808] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.808] ReadFile (in: hFile=0x1c30, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2d4ff61c*=0x1acc, lpOverlapped=0x0) returned 1 [0177.080] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xffffe534, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.080] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2d50000, cbInput=0x1acc, pPaddingInfo=0x0, pbIV=0x2d4ff848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2d4ff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2d4ff848, pbOutput=0x2d50000, pcbResult=0x2d4ff618) returned 0x0 [0177.080] WriteFile (in: hFile=0x1c30, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2d4ff61c*=0x1ad0, lpOverlapped=0x0) returned 1 [0177.081] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4ff60c | out: lpNewFilePointer=0x0) returned 1 [0177.081] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.081] WriteFile (in: hFile=0x1c30, lpBuffer=0x2d4ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d4ff83c*, lpNumberOfBytesWritten=0x2d4ff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.081] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x1ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.081] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0177.081] CloseHandle (hObject=0x1c30) returned 1 [0177.118] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4b0000 [0177.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.play")) returned 1 [0178.186] VirtualFree (lpAddress=0xb4b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2553 os_tid = 0x2658 [0176.658] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.658] ReadFile (in: hFile=0x1c20, lpBuffer=0x2d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesRead=0x2d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.659] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.659] ReadFile (in: hFile=0x1c20, lpBuffer=0x2d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesRead=0x2d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.659] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0176.661] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0176.661] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2d63f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0176.661] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2d63f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2d63f828, pbKeyObject=0x0) returned 0x0 [0176.661] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d63f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d63f500) returned 0x0 [0176.661] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0176.662] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d63f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d63f500) returned 0x0 [0176.665] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.667] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.667] WriteFile (in: hFile=0x1c20, lpBuffer=0x2d63fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d63f830, lpOverlapped=0x0 | out: lpBuffer=0x2d63fb34*, lpNumberOfBytesWritten=0x2d63f830*=0x428, lpOverlapped=0x0) returned 1 [0176.807] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.807] ReadFile (in: hFile=0x1c20, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2d63f61c*=0x1918, lpOverlapped=0x0) returned 1 [0177.082] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xffffe6e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.082] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x2e50000, cbInput=0x1918, pPaddingInfo=0x0, pbIV=0x2d63f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2d63f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2d63f848, pbOutput=0x2e50000, pcbResult=0x2d63f618) returned 0x0 [0177.082] WriteFile (in: hFile=0x1c20, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2d63f61c*=0x1920, lpOverlapped=0x0) returned 1 [0177.082] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d63f60c | out: lpNewFilePointer=0x0) returned 1 [0177.082] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.082] WriteFile (in: hFile=0x1c20, lpBuffer=0x2d63f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d63f83c*, lpNumberOfBytesWritten=0x2d63f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.082] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x1920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.082] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0177.082] CloseHandle (hObject=0x1c20) returned 1 [0177.122] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf910000 [0177.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.play")) returned 1 [0178.185] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2554 os_tid = 0x265c [0176.667] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.667] ReadFile (in: hFile=0x1c10, lpBuffer=0x2d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesRead=0x2d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.922] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.922] ReadFile (in: hFile=0x1c10, lpBuffer=0x2d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesRead=0x2d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.922] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0176.924] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0176.924] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d77f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0176.924] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d77f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d77f828, pbKeyObject=0x0) returned 0x0 [0176.924] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d77f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d77f500) returned 0x0 [0176.924] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0176.924] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d77f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d77f500) returned 0x0 [0176.928] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.930] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.930] WriteFile (in: hFile=0x1c10, lpBuffer=0x2d77fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d77f830, lpOverlapped=0x0 | out: lpBuffer=0x2d77fb34*, lpNumberOfBytesWritten=0x2d77f830*=0x428, lpOverlapped=0x0) returned 1 [0176.930] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.930] ReadFile (in: hFile=0x1c10, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d77f61c*=0x22a0, lpOverlapped=0x0) returned 1 [0177.082] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xffffdd60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.083] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2f50000, cbInput=0x22a0, pPaddingInfo=0x0, pbIV=0x2d77f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d77f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2d77f848, pbOutput=0x2f50000, pcbResult=0x2d77f618) returned 0x0 [0177.083] WriteFile (in: hFile=0x1c10, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d77f61c*=0x22b0, lpOverlapped=0x0) returned 1 [0177.083] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d77f60c | out: lpNewFilePointer=0x0) returned 1 [0177.083] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.083] WriteFile (in: hFile=0x1c10, lpBuffer=0x2d77f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d77f83c*, lpNumberOfBytesWritten=0x2d77f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.083] SetFilePointerEx (in: hFile=0x1c10, liDistanceToMove=0x22b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.083] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0177.083] CloseHandle (hObject=0x1c10) returned 1 [0177.124] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0177.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.play")) returned 1 [0178.182] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2555 os_tid = 0x2660 [0176.830] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.830] ReadFile (in: hFile=0x1878, lpBuffer=0x2d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesRead=0x2d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.069] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.069] ReadFile (in: hFile=0x1878, lpBuffer=0x2d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesRead=0x2d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.069] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.072] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d8bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0177.072] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d8bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d8bf828, pbKeyObject=0x0) returned 0x0 [0177.072] BCryptExportKey (in: hKey=0x7f3d70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d8bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d8bf500) returned 0x0 [0177.072] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.072] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d8bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d8bf500) returned 0x0 [0177.075] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.078] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.078] WriteFile (in: hFile=0x1878, lpBuffer=0x2d8bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d8bfb34*, lpNumberOfBytesWritten=0x2d8bf830*=0x428, lpOverlapped=0x0) returned 1 [0177.078] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.078] ReadFile (in: hFile=0x1878, lpBuffer=0x3050000, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d8bf61c*=0x1068, lpOverlapped=0x0) returned 1 [0177.078] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xffffef98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.078] BCryptEncrypt (in: hKey=0x7f3d70, pbInput=0x3050000, cbInput=0x1068, pPaddingInfo=0x0, pbIV=0x2d8bf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d8bf618, dwFlags=0x1 | out: hKey=0x7f3d70, pbIV=0x2d8bf848, pbOutput=0x3050000, pcbResult=0x2d8bf618) returned 0x0 [0177.078] WriteFile (in: hFile=0x1878, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d8bf61c*=0x1070, lpOverlapped=0x0) returned 1 [0177.078] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.078] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.078] WriteFile (in: hFile=0x1878, lpBuffer=0x2d8bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8bf83c*, lpNumberOfBytesWritten=0x2d8bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.079] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x1070, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.079] BCryptDestroyKey (in: hKey=0x7f3d70 | out: hKey=0x7f3d70) returned 0x0 [0177.079] CloseHandle (hObject=0x1878) returned 1 [0177.083] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0177.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.play")) returned 1 [0178.191] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2556 os_tid = 0x2664 [0176.831] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.832] ReadFile (in: hFile=0x1bf0, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.060] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.060] ReadFile (in: hFile=0x1bf0, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.060] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.062] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0177.062] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d9ff828, pbKeyObject=0x0) returned 0x0 [0177.062] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d9ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d9ff500) returned 0x0 [0177.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.062] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d9ff500) returned 0x0 [0177.066] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.068] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.068] WriteFile (in: hFile=0x1bf0, lpBuffer=0x2d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesWritten=0x2d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0177.068] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.068] ReadFile (in: hFile=0x1bf0, lpBuffer=0x3150000, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d9ff61c*=0x2a54, lpOverlapped=0x0) returned 1 [0177.112] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xffffd5ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.112] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x3150000, cbInput=0x2a54, pPaddingInfo=0x0, pbIV=0x2d9ff848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d9ff618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x2d9ff848, pbOutput=0x3150000, pcbResult=0x2d9ff618) returned 0x0 [0177.112] WriteFile (in: hFile=0x1bf0, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d9ff61c*=0x2a60, lpOverlapped=0x0) returned 1 [0177.113] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0177.113] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.113] WriteFile (in: hFile=0x1bf0, lpBuffer=0x2d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ff83c*, lpNumberOfBytesWritten=0x2d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.113] SetFilePointerEx (in: hFile=0x1bf0, liDistanceToMove=0x2a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.113] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0177.113] CloseHandle (hObject=0x1bf0) returned 1 [0177.152] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x30c60000 [0177.154] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.play")) returned 1 [0177.160] VirtualFree (lpAddress=0x30c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2557 os_tid = 0x2668 [0176.833] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.833] ReadFile (in: hFile=0x1be0, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.051] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.051] ReadFile (in: hFile=0x1be0, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.051] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.053] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.053] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2db3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0177.053] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2db3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2db3f828, pbKeyObject=0x0) returned 0x0 [0177.053] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2db3f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2db3f500) returned 0x0 [0177.053] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.053] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2db3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2db3f500) returned 0x0 [0177.057] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.059] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.059] WriteFile (in: hFile=0x1be0, lpBuffer=0x2db3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db3f830, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesWritten=0x2db3f830*=0x428, lpOverlapped=0x0) returned 1 [0177.059] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.059] ReadFile (in: hFile=0x1be0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2db3f61c*=0x2c8c, lpOverlapped=0x0) returned 1 [0177.112] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xffffd374, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.112] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x3250000, cbInput=0x2c8c, pPaddingInfo=0x0, pbIV=0x2db3f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2db3f618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x2db3f848, pbOutput=0x3250000, pcbResult=0x2db3f618) returned 0x0 [0177.112] WriteFile (in: hFile=0x1be0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2db3f61c*=0x2c90, lpOverlapped=0x0) returned 1 [0177.112] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db3f60c | out: lpNewFilePointer=0x0) returned 1 [0177.112] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.112] WriteFile (in: hFile=0x1be0, lpBuffer=0x2db3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db3f83c*, lpNumberOfBytesWritten=0x2db3f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.112] SetFilePointerEx (in: hFile=0x1be0, liDistanceToMove=0x2c90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.112] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0177.112] CloseHandle (hObject=0x1be0) returned 1 [0177.149] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x30c50000 [0177.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.play")) returned 1 [0177.157] VirtualFree (lpAddress=0x30c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2558 os_tid = 0x266c [0176.834] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.834] ReadFile (in: hFile=0x1bd0, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.042] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.042] ReadFile (in: hFile=0x1bd0, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.042] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.044] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2dc7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0177.044] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2dc7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2dc7f828, pbKeyObject=0x0) returned 0x0 [0177.044] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2dc7f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2dc7f500) returned 0x0 [0177.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.044] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2dc7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2dc7f500) returned 0x0 [0177.047] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.050] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.050] WriteFile (in: hFile=0x1bd0, lpBuffer=0x2dc7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dc7f830, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesWritten=0x2dc7f830*=0x428, lpOverlapped=0x0) returned 1 [0177.050] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.050] ReadFile (in: hFile=0x1bd0, lpBuffer=0x3350000, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2dc7f61c*=0x2fac, lpOverlapped=0x0) returned 1 [0177.111] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xffffd054, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.111] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3350000, cbInput=0x2fac, pPaddingInfo=0x0, pbIV=0x2dc7f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2dc7f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2dc7f848, pbOutput=0x3350000, pcbResult=0x2dc7f618) returned 0x0 [0177.111] WriteFile (in: hFile=0x1bd0, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2dc7f61c*=0x2fb0, lpOverlapped=0x0) returned 1 [0177.111] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dc7f60c | out: lpNewFilePointer=0x0) returned 1 [0177.111] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.111] WriteFile (in: hFile=0x1bd0, lpBuffer=0x2dc7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7f83c*, lpNumberOfBytesWritten=0x2dc7f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.111] SetFilePointerEx (in: hFile=0x1bd0, liDistanceToMove=0x2fb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.111] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0177.111] CloseHandle (hObject=0x1bd0) returned 1 [0177.147] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x30c40000 [0177.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.play")) returned 1 [0177.163] VirtualFree (lpAddress=0x30c40000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2559 os_tid = 0x2670 [0176.835] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.835] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.041] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.041] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.100] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb110000 [0177.104] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb110000) returned 0x0 [0177.104] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0177.104] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb110000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0177.104] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb110000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0xb110000, pcbResult=0x2ddbf500) returned 0x0 [0177.104] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb110230) returned 0x0 [0177.104] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb110000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb110000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb110000, pcbResult=0x2ddbf500) returned 0x0 [0177.107] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.110] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.110] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0177.110] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.110] ReadFile (in: hFile=0x1bc0, lpBuffer=0x3450000, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2ddbf61c*=0x36b8, lpOverlapped=0x0) returned 1 [0177.132] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xffffc948, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.133] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3450000, cbInput=0x36b8, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2ddbf848, pbOutput=0x3450000, pcbResult=0x2ddbf618) returned 0x0 [0177.133] WriteFile (in: hFile=0x1bc0, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x36c0, lpOverlapped=0x0) returned 1 [0177.133] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0177.133] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.133] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.133] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x36c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.133] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0177.133] CloseHandle (hObject=0x1bc0) returned 1 [0177.205] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x327c0000 [0177.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.play")) returned 1 [0178.191] VirtualFree (lpAddress=0x327c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2560 os_tid = 0x2674 [0176.837] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.837] ReadFile (in: hFile=0x1bb0, lpBuffer=0x2deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2deff85c, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesRead=0x2deff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.031] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.031] ReadFile (in: hFile=0x1bb0, lpBuffer=0x2deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2deff85c, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesRead=0x2deff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.031] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.033] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.033] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2deff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0177.033] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2deff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2deff828, pbKeyObject=0x0) returned 0x0 [0177.033] BCryptExportKey (in: hKey=0x7f3350, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2deff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2deff500) returned 0x0 [0177.034] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.034] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2deff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2deff500) returned 0x0 [0177.037] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.040] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.040] WriteFile (in: hFile=0x1bb0, lpBuffer=0x2deffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2deff830, lpOverlapped=0x0 | out: lpBuffer=0x2deffb34*, lpNumberOfBytesWritten=0x2deff830*=0x428, lpOverlapped=0x0) returned 1 [0177.041] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.041] ReadFile (in: hFile=0x1bb0, lpBuffer=0x3550000, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2deff61c*=0x1f0c, lpOverlapped=0x0) returned 1 [0177.099] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xffffe0f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.099] BCryptEncrypt (in: hKey=0x7f3350, pbInput=0x3550000, cbInput=0x1f0c, pPaddingInfo=0x0, pbIV=0x2deff848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2deff618, dwFlags=0x1 | out: hKey=0x7f3350, pbIV=0x2deff848, pbOutput=0x3550000, pcbResult=0x2deff618) returned 0x0 [0177.099] WriteFile (in: hFile=0x1bb0, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2deff61c*=0x1f10, lpOverlapped=0x0) returned 1 [0177.100] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2deff60c | out: lpNewFilePointer=0x0) returned 1 [0177.100] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.100] WriteFile (in: hFile=0x1bb0, lpBuffer=0x2deff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2deff61c, lpOverlapped=0x0 | out: lpBuffer=0x2deff83c*, lpNumberOfBytesWritten=0x2deff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.100] SetFilePointerEx (in: hFile=0x1bb0, liDistanceToMove=0x1f10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.100] BCryptDestroyKey (in: hKey=0x7f3350 | out: hKey=0x7f3350) returned 0x0 [0177.100] CloseHandle (hObject=0x1bb0) returned 1 [0177.145] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x30c30000 [0177.147] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.play")) returned 1 [0178.169] VirtualFree (lpAddress=0x30c30000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2561 os_tid = 0x2678 [0176.838] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.838] ReadFile (in: hFile=0x1ba0, lpBuffer=0x2e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesRead=0x2e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.022] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.022] ReadFile (in: hFile=0x1ba0, lpBuffer=0x2e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesRead=0x2e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.022] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.024] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.025] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2e03f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0177.025] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2e03f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2e03f828, pbKeyObject=0x0) returned 0x0 [0177.025] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e03f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e03f500) returned 0x0 [0177.025] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.025] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e03f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e03f500) returned 0x0 [0177.028] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.030] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.030] WriteFile (in: hFile=0x1ba0, lpBuffer=0x2e03fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e03f830, lpOverlapped=0x0 | out: lpBuffer=0x2e03fb34*, lpNumberOfBytesWritten=0x2e03f830*=0x428, lpOverlapped=0x0) returned 1 [0177.031] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.031] ReadFile (in: hFile=0x1ba0, lpBuffer=0x3650000, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2e03f61c*=0x1a88, lpOverlapped=0x0) returned 1 [0177.099] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xffffe578, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.099] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x3650000, cbInput=0x1a88, pPaddingInfo=0x0, pbIV=0x2e03f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2e03f618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x2e03f848, pbOutput=0x3650000, pcbResult=0x2e03f618) returned 0x0 [0177.099] WriteFile (in: hFile=0x1ba0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2e03f61c*=0x1a90, lpOverlapped=0x0) returned 1 [0177.099] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e03f60c | out: lpNewFilePointer=0x0) returned 1 [0177.099] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.099] WriteFile (in: hFile=0x1ba0, lpBuffer=0x2e03f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e03f83c*, lpNumberOfBytesWritten=0x2e03f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.099] SetFilePointerEx (in: hFile=0x1ba0, liDistanceToMove=0x1a90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.099] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0177.099] CloseHandle (hObject=0x1ba0) returned 1 [0177.143] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x30c20000 [0177.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.play")) returned 1 [0178.122] VirtualFree (lpAddress=0x30c20000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2562 os_tid = 0x267c [0176.839] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.839] ReadFile (in: hFile=0x1b90, lpBuffer=0x2e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesRead=0x2e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.013] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.013] ReadFile (in: hFile=0x1b90, lpBuffer=0x2e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesRead=0x2e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.013] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.015] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.015] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2e17f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0177.015] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2e17f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2e17f828, pbKeyObject=0x0) returned 0x0 [0177.015] BCryptExportKey (in: hKey=0x7f2e40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e17f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e17f500) returned 0x0 [0177.016] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.016] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e17f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e17f500) returned 0x0 [0177.019] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.021] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.021] WriteFile (in: hFile=0x1b90, lpBuffer=0x2e17fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e17f830, lpOverlapped=0x0 | out: lpBuffer=0x2e17fb34*, lpNumberOfBytesWritten=0x2e17f830*=0x428, lpOverlapped=0x0) returned 1 [0177.021] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.022] ReadFile (in: hFile=0x1b90, lpBuffer=0x3750000, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2e17f61c*=0x6890, lpOverlapped=0x0) returned 1 [0177.098] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xffff9770, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.098] BCryptEncrypt (in: hKey=0x7f2e40, pbInput=0x3750000, cbInput=0x6890, pPaddingInfo=0x0, pbIV=0x2e17f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2e17f618, dwFlags=0x1 | out: hKey=0x7f2e40, pbIV=0x2e17f848, pbOutput=0x3750000, pcbResult=0x2e17f618) returned 0x0 [0177.098] WriteFile (in: hFile=0x1b90, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2e17f61c*=0x68a0, lpOverlapped=0x0) returned 1 [0177.098] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e17f60c | out: lpNewFilePointer=0x0) returned 1 [0177.098] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.098] WriteFile (in: hFile=0x1b90, lpBuffer=0x2e17f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e17f83c*, lpNumberOfBytesWritten=0x2e17f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.098] SetFilePointerEx (in: hFile=0x1b90, liDistanceToMove=0x68a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.098] BCryptDestroyKey (in: hKey=0x7f2e40 | out: hKey=0x7f2e40) returned 0x0 [0177.099] CloseHandle (hObject=0x1b90) returned 1 [0177.140] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x30c10000 [0177.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.play")) returned 1 [0178.170] VirtualFree (lpAddress=0x30c10000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2563 os_tid = 0x2680 [0176.840] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.841] ReadFile (in: hFile=0x1b80, lpBuffer=0x2e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesRead=0x2e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.003] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.003] ReadFile (in: hFile=0x1b80, lpBuffer=0x2e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesRead=0x2e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.003] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0177.005] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0177.005] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2e2bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0177.006] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2e2bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2e2bf828, pbKeyObject=0x0) returned 0x0 [0177.006] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e2bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e2bf500) returned 0x0 [0177.006] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0177.006] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e2bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e2bf500) returned 0x0 [0177.010] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.012] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.012] WriteFile (in: hFile=0x1b80, lpBuffer=0x2e2bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e2bfb34*, lpNumberOfBytesWritten=0x2e2bf830*=0x428, lpOverlapped=0x0) returned 1 [0177.012] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.012] ReadFile (in: hFile=0x1b80, lpBuffer=0x3850000, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2e2bf61c*=0x1ba0, lpOverlapped=0x0) returned 1 [0177.097] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xffffe460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.097] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x3850000, cbInput=0x1ba0, pPaddingInfo=0x0, pbIV=0x2e2bf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2e2bf618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x2e2bf848, pbOutput=0x3850000, pcbResult=0x2e2bf618) returned 0x0 [0177.097] WriteFile (in: hFile=0x1b80, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2e2bf61c*=0x1bb0, lpOverlapped=0x0) returned 1 [0177.097] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.097] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.098] WriteFile (in: hFile=0x1b80, lpBuffer=0x2e2bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2bf83c*, lpNumberOfBytesWritten=0x2e2bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.098] SetFilePointerEx (in: hFile=0x1b80, liDistanceToMove=0x1bb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.098] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0177.098] CloseHandle (hObject=0x1b80) returned 1 [0177.138] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x30c00000 [0177.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.play")) returned 1 [0178.176] VirtualFree (lpAddress=0x30c00000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2564 os_tid = 0x2684 [0176.842] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.842] ReadFile (in: hFile=0x1b70, lpBuffer=0x2e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesRead=0x2e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.993] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.993] ReadFile (in: hFile=0x1b70, lpBuffer=0x2e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesRead=0x2e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.993] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0176.995] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0176.995] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e3ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0176.995] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e3ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e3ff828, pbKeyObject=0x0) returned 0x0 [0176.995] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e3ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e3ff500) returned 0x0 [0176.996] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0176.996] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e3ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e3ff500) returned 0x0 [0176.999] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.001] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.002] WriteFile (in: hFile=0x1b70, lpBuffer=0x2e3ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e3ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e3ffb34*, lpNumberOfBytesWritten=0x2e3ff830*=0x428, lpOverlapped=0x0) returned 1 [0177.002] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.002] ReadFile (in: hFile=0x1b70, lpBuffer=0x3950000, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e3ff61c*=0x12c8, lpOverlapped=0x0) returned 1 [0177.002] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xffffed38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.002] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x3950000, cbInput=0x12c8, pPaddingInfo=0x0, pbIV=0x2e3ff848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e3ff618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x2e3ff848, pbOutput=0x3950000, pcbResult=0x2e3ff618) returned 0x0 [0177.002] WriteFile (in: hFile=0x1b70, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e3ff61c*=0x12d0, lpOverlapped=0x0) returned 1 [0177.002] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3ff60c | out: lpNewFilePointer=0x0) returned 1 [0177.002] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.002] WriteFile (in: hFile=0x1b70, lpBuffer=0x2e3ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e3ff83c*, lpNumberOfBytesWritten=0x2e3ff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.002] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x12d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.002] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0177.002] CloseHandle (hObject=0x1b70) returned 1 [0177.209] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x327d0000 [0177.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.play")) returned 1 [0178.190] VirtualFree (lpAddress=0x327d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2565 os_tid = 0x2688 [0176.843] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.843] ReadFile (in: hFile=0x7dc, lpBuffer=0x2e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesRead=0x2e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.984] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.984] ReadFile (in: hFile=0x7dc, lpBuffer=0x2e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesRead=0x2e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.984] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0176.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0176.986] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e53f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0176.986] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e53f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e53f828, pbKeyObject=0x0) returned 0x0 [0176.986] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e53f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e53f500) returned 0x0 [0176.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0176.986] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e53f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e53f500) returned 0x0 [0176.990] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.992] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.992] WriteFile (in: hFile=0x7dc, lpBuffer=0x2e53fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e53f830, lpOverlapped=0x0 | out: lpBuffer=0x2e53fb34*, lpNumberOfBytesWritten=0x2e53f830*=0x428, lpOverlapped=0x0) returned 1 [0176.992] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.992] ReadFile (in: hFile=0x7dc, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e53f61c*=0x121c, lpOverlapped=0x0) returned 1 [0176.992] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xffffede4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.992] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x3a50000, cbInput=0x121c, pPaddingInfo=0x0, pbIV=0x2e53f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e53f618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x2e53f848, pbOutput=0x3a50000, pcbResult=0x2e53f618) returned 0x0 [0176.992] WriteFile (in: hFile=0x7dc, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e53f61c*=0x1220, lpOverlapped=0x0) returned 1 [0176.992] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e53f60c | out: lpNewFilePointer=0x0) returned 1 [0176.993] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.993] WriteFile (in: hFile=0x7dc, lpBuffer=0x2e53f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e53f83c*, lpNumberOfBytesWritten=0x2e53f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.993] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x1220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.993] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0176.993] CloseHandle (hObject=0x7dc) returned 1 [0177.128] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf980000 [0177.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.play")) returned 1 [0178.179] VirtualFree (lpAddress=0xf980000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2566 os_tid = 0x268c [0176.844] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.844] ReadFile (in: hFile=0x13d4, lpBuffer=0x2e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesRead=0x2e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.974] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.974] ReadFile (in: hFile=0x13d4, lpBuffer=0x2e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesRead=0x2e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.974] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0176.976] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0176.976] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0176.976] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e67f828, pbKeyObject=0x0) returned 0x0 [0176.976] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e67f500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e67f500) returned 0x0 [0176.976] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0176.976] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e67f500) returned 0x0 [0176.980] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.983] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.983] WriteFile (in: hFile=0x13d4, lpBuffer=0x2e67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e67f830, lpOverlapped=0x0 | out: lpBuffer=0x2e67fb34*, lpNumberOfBytesWritten=0x2e67f830*=0x428, lpOverlapped=0x0) returned 1 [0176.983] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.983] ReadFile (in: hFile=0x13d4, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e67f61c*=0xed8, lpOverlapped=0x0) returned 1 [0176.983] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff128, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.983] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x3b50000, cbInput=0xed8, pPaddingInfo=0x0, pbIV=0x2e67f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e67f618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x2e67f848, pbOutput=0x3b50000, pcbResult=0x2e67f618) returned 0x0 [0176.983] WriteFile (in: hFile=0x13d4, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e67f61c*=0xee0, lpOverlapped=0x0) returned 1 [0176.983] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e67f60c | out: lpNewFilePointer=0x0) returned 1 [0176.983] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.983] WriteFile (in: hFile=0x13d4, lpBuffer=0x2e67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e67f83c*, lpNumberOfBytesWritten=0x2e67f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.984] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.984] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0176.984] CloseHandle (hObject=0x13d4) returned 1 [0177.126] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf970000 [0177.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.play")) returned 1 [0178.180] VirtualFree (lpAddress=0xf970000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2567 os_tid = 0x2690 [0176.845] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.845] ReadFile (in: hFile=0x179c, lpBuffer=0x2e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesRead=0x2e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.965] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.965] ReadFile (in: hFile=0x179c, lpBuffer=0x2e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesRead=0x2e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.965] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0176.967] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0176.967] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2e7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0176.967] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2e7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2e7bf828, pbKeyObject=0x0) returned 0x0 [0176.967] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e7bf500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e7bf500) returned 0x0 [0176.967] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0176.968] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e7bf500) returned 0x0 [0176.971] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.973] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.973] WriteFile (in: hFile=0x179c, lpBuffer=0x2e7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesWritten=0x2e7bf830*=0x428, lpOverlapped=0x0) returned 1 [0176.973] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.974] ReadFile (in: hFile=0x179c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2e7bf61c*=0x2044, lpOverlapped=0x0) returned 1 [0177.096] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xffffdfbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.097] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3c50000, cbInput=0x2044, pPaddingInfo=0x0, pbIV=0x2e7bf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2e7bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e7bf848, pbOutput=0x3c50000, pcbResult=0x2e7bf618) returned 0x0 [0177.097] WriteFile (in: hFile=0x179c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2e7bf61c*=0x2050, lpOverlapped=0x0) returned 1 [0177.097] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.097] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.097] WriteFile (in: hFile=0x179c, lpBuffer=0x2e7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bf83c*, lpNumberOfBytesWritten=0x2e7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.097] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x2050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.097] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0177.097] CloseHandle (hObject=0x179c) returned 1 [0177.136] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bf0000 [0177.138] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.play")) returned 1 [0178.176] VirtualFree (lpAddress=0x17bf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2568 os_tid = 0x2694 [0176.846] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.847] ReadFile (in: hFile=0x170c, lpBuffer=0x2e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesRead=0x2e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.956] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.956] ReadFile (in: hFile=0x170c, lpBuffer=0x2e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesRead=0x2e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0176.956] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0176.958] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0176.958] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0176.958] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e8ff828, pbKeyObject=0x0) returned 0x0 [0176.958] BCryptExportKey (in: hKey=0x7f1c80, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2e8ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2e8ff500) returned 0x0 [0176.958] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0176.959] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2e8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2e8ff500) returned 0x0 [0176.962] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.964] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.964] WriteFile (in: hFile=0x170c, lpBuffer=0x2e8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e8ffb34*, lpNumberOfBytesWritten=0x2e8ff830*=0x428, lpOverlapped=0x0) returned 1 [0176.965] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.965] ReadFile (in: hFile=0x170c, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e8ff61c*=0x1b68, lpOverlapped=0x0) returned 1 [0177.096] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xffffe498, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.096] BCryptEncrypt (in: hKey=0x7f1c80, pbInput=0x3d50000, cbInput=0x1b68, pPaddingInfo=0x0, pbIV=0x2e8ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e8ff618, dwFlags=0x1 | out: hKey=0x7f1c80, pbIV=0x2e8ff848, pbOutput=0x3d50000, pcbResult=0x2e8ff618) returned 0x0 [0177.096] WriteFile (in: hFile=0x170c, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e8ff61c*=0x1b70, lpOverlapped=0x0) returned 1 [0177.096] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8ff60c | out: lpNewFilePointer=0x0) returned 1 [0177.096] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.096] WriteFile (in: hFile=0x170c, lpBuffer=0x2e8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e8ff83c*, lpNumberOfBytesWritten=0x2e8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.096] SetFilePointerEx (in: hFile=0x170c, liDistanceToMove=0x1b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.096] BCryptDestroyKey (in: hKey=0x7f1c80 | out: hKey=0x7f1c80) returned 0x0 [0177.096] CloseHandle (hObject=0x170c) returned 1 [0177.134] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17be0000 [0177.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.play")) returned 1 [0178.177] VirtualFree (lpAddress=0x17be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2569 os_tid = 0x2698 [0176.848] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.848] ReadFile (in: hFile=0x134c, lpBuffer=0x2ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesRead=0x2ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.955] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.956] ReadFile (in: hFile=0x134c, lpBuffer=0x2ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesRead=0x2ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.086] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb110000 [0177.088] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb110000) returned 0x0 [0177.088] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2ea3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0177.088] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2ea3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb110000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2ea3f828, pbKeyObject=0x0) returned 0x0 [0177.088] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb110000, cbOutput=0x230, pcbResult=0x2ea3f500, dwFlags=0x0 | out: pbOutput=0xb110000, pcbResult=0x2ea3f500) returned 0x0 [0177.089] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb110230) returned 0x0 [0177.089] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb110000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb110000, cbOutput=0x400, pcbResult=0x2ea3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb110000, pcbResult=0x2ea3f500) returned 0x0 [0177.092] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.095] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.095] WriteFile (in: hFile=0x134c, lpBuffer=0x2ea3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ea3f830, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fb34*, lpNumberOfBytesWritten=0x2ea3f830*=0x428, lpOverlapped=0x0) returned 1 [0177.095] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.095] ReadFile (in: hFile=0x134c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2ea3f61c*=0x1574, lpOverlapped=0x0) returned 1 [0177.095] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xffffea8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.095] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3e50000, cbInput=0x1574, pPaddingInfo=0x0, pbIV=0x2ea3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2ea3f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x2ea3f848, pbOutput=0x3e50000, pcbResult=0x2ea3f618) returned 0x0 [0177.095] WriteFile (in: hFile=0x134c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2ea3f61c*=0x1580, lpOverlapped=0x0) returned 1 [0177.095] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea3f60c | out: lpNewFilePointer=0x0) returned 1 [0177.095] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.095] WriteFile (in: hFile=0x134c, lpBuffer=0x2ea3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ea3f83c*, lpNumberOfBytesWritten=0x2ea3f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.095] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x1580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.095] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0177.096] CloseHandle (hObject=0x134c) returned 1 [0177.130] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x17bd0000 [0177.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.play")) returned 1 [0178.178] VirtualFree (lpAddress=0x17bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2570 os_tid = 0x269c [0176.849] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.849] ReadFile (in: hFile=0x17cc, lpBuffer=0x2eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesRead=0x2eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.940] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.941] ReadFile (in: hFile=0x17cc, lpBuffer=0x2eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesRead=0x2eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.941] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0176.943] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0176.943] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2eb7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0176.943] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2eb7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2eb7f828, pbKeyObject=0x0) returned 0x0 [0176.943] BCryptExportKey (in: hKey=0x7f1c80, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2eb7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2eb7f500) returned 0x0 [0176.943] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0176.943] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2eb7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2eb7f500) returned 0x0 [0176.947] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.949] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.950] WriteFile (in: hFile=0x17cc, lpBuffer=0x2eb7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2eb7f830, lpOverlapped=0x0 | out: lpBuffer=0x2eb7fb34*, lpNumberOfBytesWritten=0x2eb7f830*=0x428, lpOverlapped=0x0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.950] ReadFile (in: hFile=0x17cc, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2eb7f61c*=0xbf4, lpOverlapped=0x0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffff40c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.950] BCryptEncrypt (in: hKey=0x7f1c80, pbInput=0x3f50000, cbInput=0xbf4, pPaddingInfo=0x0, pbIV=0x2eb7f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2eb7f618, dwFlags=0x1 | out: hKey=0x7f1c80, pbIV=0x2eb7f848, pbOutput=0x3f50000, pcbResult=0x2eb7f618) returned 0x0 [0176.950] WriteFile (in: hFile=0x17cc, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2eb7f61c*=0xc00, lpOverlapped=0x0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eb7f60c | out: lpNewFilePointer=0x0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.950] WriteFile (in: hFile=0x17cc, lpBuffer=0x2eb7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2eb7f83c*, lpNumberOfBytesWritten=0x2eb7f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0x17cc, liDistanceToMove=0xc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.950] BCryptDestroyKey (in: hKey=0x7f1c80 | out: hKey=0x7f1c80) returned 0x0 [0176.950] CloseHandle (hObject=0x17cc) returned 1 [0176.953] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0176.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.play")) returned 1 [0178.189] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2571 os_tid = 0x26a0 [0176.868] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.868] ReadFile (in: hFile=0x1c80, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.912] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.912] ReadFile (in: hFile=0x1c80, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0176.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0176.914] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0176.914] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0176.914] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0176.914] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x141cf500) returned 0x0 [0176.914] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0176.915] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x141cf500) returned 0x0 [0176.918] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.920] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.920] WriteFile (in: hFile=0x1c80, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0176.921] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.921] ReadFile (in: hFile=0x1c80, lpBuffer=0x4050000, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x141cf61c*=0xc44, lpOverlapped=0x0) returned 1 [0176.921] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffff3bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.921] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x4050000, cbInput=0xc44, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x141cf848, pbOutput=0x4050000, pcbResult=0x141cf618) returned 0x0 [0176.921] WriteFile (in: hFile=0x1c80, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x141cf61c*=0xc50, lpOverlapped=0x0) returned 1 [0176.921] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0176.921] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.921] WriteFile (in: hFile=0x1c80, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0176.922] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xc50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.922] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0176.922] CloseHandle (hObject=0x1c80) returned 1 [0176.931] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0176.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.play")) returned 1 [0176.934] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2572 os_tid = 0x26a4 [0176.869] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.869] ReadFile (in: hFile=0x1c68, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.896] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.896] ReadFile (in: hFile=0x1c68, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0176.896] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0176.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0176.902] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0176.902] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0176.902] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0176.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0176.902] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0176.906] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.909] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.909] WriteFile (in: hFile=0x1c68, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0176.909] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.909] ReadFile (in: hFile=0x1c68, lpBuffer=0x2850000, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1444f61c*=0xe3c, lpOverlapped=0x0) returned 1 [0176.909] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffff1c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.909] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2850000, cbInput=0xe3c, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x1444f848, pbOutput=0x2850000, pcbResult=0x1444f618) returned 0x0 [0176.909] WriteFile (in: hFile=0x1c68, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1444f61c*=0xe40, lpOverlapped=0x0) returned 1 [0176.909] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0176.909] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.909] WriteFile (in: hFile=0x1c68, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0176.910] SetFilePointerEx (in: hFile=0x1c68, liDistanceToMove=0xe40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.910] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0176.910] CloseHandle (hObject=0x1c68) returned 1 [0176.910] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0176.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.play")) returned 1 [0178.188] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2573 os_tid = 0x26a8 [0176.874] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0176.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0176.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f060c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca0 [0176.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0176.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0624, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0176.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0176.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f063c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0176.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0176.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0654, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0176.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0176.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f066c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0176.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0176.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0684, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0176.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0176.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f069c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0176.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0176.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0176.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0176.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910 [0176.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0176.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920 [0176.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928 [0176.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930 [0176.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0176.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0714, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0176.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0176.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f072c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0176.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0176.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0176.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb0 [0177.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f075c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb4 [0177.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb8 [0177.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0774, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cbc [0177.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc0 [0177.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f078c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc4 [0177.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc8 [0177.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ccc [0177.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd0 [0177.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd4 [0177.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd8 [0177.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cdc [0177.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce0 [0177.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce4 [0177.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce8 [0177.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0804, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cec [0177.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf0 [0177.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f081c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf4 [0177.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf8 [0177.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cfc [0177.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d00 [0177.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f084c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d04 [0177.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d08 [0177.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0864, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0c [0177.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d10 [0177.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f087c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d14 [0177.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d18 [0177.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0894, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b90 [0178.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0178.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0178.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0178.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80 [0178.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0178.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170c [0178.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc0 [0178.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134c [0178.447] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x6bc, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0180.625] CloseHandle (hObject=0x6bc) returned 1 [0180.625] CloseHandle (hObject=0x1ca0) returned 1 [0180.625] CloseHandle (hObject=0x1898) returned 1 [0180.625] CloseHandle (hObject=0x18a0) returned 1 [0180.625] CloseHandle (hObject=0x18a8) returned 1 [0180.625] CloseHandle (hObject=0x18b8) returned 1 [0180.625] CloseHandle (hObject=0x18b0) returned 1 [0180.625] CloseHandle (hObject=0x18c0) returned 1 [0180.625] CloseHandle (hObject=0x18c8) returned 1 [0180.625] CloseHandle (hObject=0x18d0) returned 1 [0180.625] CloseHandle (hObject=0x18d8) returned 1 [0180.625] CloseHandle (hObject=0x18e0) returned 1 [0180.625] CloseHandle (hObject=0x18e8) returned 1 [0180.625] CloseHandle (hObject=0x18f0) returned 1 [0180.626] CloseHandle (hObject=0x18f8) returned 1 [0180.626] CloseHandle (hObject=0x1900) returned 1 [0180.626] CloseHandle (hObject=0x1908) returned 1 [0180.626] CloseHandle (hObject=0x1910) returned 1 [0180.626] CloseHandle (hObject=0x1918) returned 1 [0180.626] CloseHandle (hObject=0x1920) returned 1 [0180.626] CloseHandle (hObject=0x1928) returned 1 [0180.626] CloseHandle (hObject=0x1930) returned 1 [0180.626] CloseHandle (hObject=0x538) returned 1 [0180.626] CloseHandle (hObject=0x1538) returned 1 [0180.626] CloseHandle (hObject=0x1284) returned 1 [0180.626] CloseHandle (hObject=0x1204) returned 1 [0180.626] CloseHandle (hObject=0x121c) returned 1 [0180.626] CloseHandle (hObject=0x11f4) returned 1 [0180.626] CloseHandle (hObject=0x1cb0) returned 1 [0180.626] CloseHandle (hObject=0x1cb4) returned 1 [0180.626] CloseHandle (hObject=0x1cb8) returned 1 [0180.626] CloseHandle (hObject=0x1cbc) returned 1 [0180.627] CloseHandle (hObject=0x1cc0) returned 1 [0180.627] CloseHandle (hObject=0x1cc4) returned 1 [0180.627] CloseHandle (hObject=0x1cc8) returned 1 [0180.627] CloseHandle (hObject=0x1ccc) returned 1 [0180.627] CloseHandle (hObject=0x1cd0) returned 1 [0180.627] CloseHandle (hObject=0x1cd4) returned 1 [0180.627] CloseHandle (hObject=0x1cd8) returned 1 [0180.627] CloseHandle (hObject=0x1cdc) returned 1 [0180.627] CloseHandle (hObject=0x1ce0) returned 1 [0180.627] CloseHandle (hObject=0x1ce4) returned 1 [0180.627] CloseHandle (hObject=0x1ce8) returned 1 [0180.627] CloseHandle (hObject=0x1cec) returned 1 [0180.627] CloseHandle (hObject=0x1cf0) returned 1 [0180.627] CloseHandle (hObject=0x1cf4) returned 1 [0180.627] CloseHandle (hObject=0x1cf8) returned 1 [0180.627] CloseHandle (hObject=0x1cfc) returned 1 [0180.627] CloseHandle (hObject=0x1d00) returned 1 [0180.627] CloseHandle (hObject=0x1d04) returned 1 [0180.628] CloseHandle (hObject=0x1d08) returned 1 [0180.628] CloseHandle (hObject=0x1d0c) returned 1 [0180.628] CloseHandle (hObject=0x1d10) returned 1 [0180.628] CloseHandle (hObject=0x1d14) returned 1 [0180.628] CloseHandle (hObject=0x1d18) returned 1 [0180.628] CloseHandle (hObject=0x1b90) returned 1 [0180.628] CloseHandle (hObject=0x6ac) returned 1 [0180.628] CloseHandle (hObject=0x6b0) returned 1 [0180.628] CloseHandle (hObject=0x6b4) returned 1 [0180.628] CloseHandle (hObject=0x1b80) returned 1 [0180.628] CloseHandle (hObject=0x179c) returned 1 [0180.628] CloseHandle (hObject=0x170c) returned 1 [0180.628] CloseHandle (hObject=0x1bc0) returned 1 [0180.628] CloseHandle (hObject=0x134c) returned 1 [0180.628] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2574 os_tid = 0x26ac [0177.231] GetLastError () returned 0x57 [0177.231] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef8e8 [0177.231] SetLastError (dwErrCode=0x57) [0177.231] IcmpCreateFile () returned 0x7f56e8 [0177.231] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f68a0 [0177.231] IcmpSendEcho2 (IcmpHandle=0x7f56e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8100a8c0, RequestData=0x1458ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f68a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2575 os_tid = 0x26b0 [0177.232] GetLastError () returned 0x57 [0177.232] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7efc70 [0177.232] SetLastError (dwErrCode=0x57) [0177.233] IcmpCreateFile () returned 0x7f5720 [0177.233] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f68f0 [0177.233] IcmpSendEcho2 (IcmpHandle=0x7f5720, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8200a8c0, RequestData=0x297bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f68f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2576 os_tid = 0x26b4 [0177.233] GetLastError () returned 0x57 [0177.234] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7efff8 [0177.234] SetLastError (dwErrCode=0x57) [0177.234] IcmpCreateFile () returned 0x7f5758 [0177.234] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6940 [0177.234] IcmpSendEcho2 (IcmpHandle=0x7f5758, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8300a8c0, RequestData=0x298fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6940, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2577 os_tid = 0x26b8 [0177.235] GetLastError () returned 0x57 [0177.235] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f0380 [0177.235] SetLastError (dwErrCode=0x57) [0177.235] IcmpCreateFile () returned 0x7f5790 [0177.235] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6990 [0177.235] IcmpSendEcho2 (IcmpHandle=0x7f5790, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8400a8c0, RequestData=0x29a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6990, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2578 os_tid = 0x26bc [0177.236] GetLastError () returned 0x57 [0177.236] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f0708 [0177.236] SetLastError (dwErrCode=0x57) [0177.236] IcmpCreateFile () returned 0x7f57c8 [0177.236] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f69e0 [0177.236] IcmpSendEcho2 (IcmpHandle=0x7f57c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8500a8c0, RequestData=0x2ecbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f69e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2579 os_tid = 0x26c0 [0177.237] GetLastError () returned 0x57 [0177.237] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7f0a90 [0177.238] SetLastError (dwErrCode=0x57) [0177.238] IcmpCreateFile () returned 0x7f5800 [0177.238] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6a30 [0177.238] IcmpSendEcho2 (IcmpHandle=0x7f5800, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8600a8c0, RequestData=0x2edfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6a30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2580 os_tid = 0x26c4 [0177.239] GetLastError () returned 0x57 [0177.239] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ef1d8 [0177.239] SetLastError (dwErrCode=0x57) [0177.239] IcmpCreateFile () returned 0x7f5838 [0177.239] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6a80 [0177.239] IcmpSendEcho2 (IcmpHandle=0x7f5838, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8700a8c0, RequestData=0x2ef3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6a80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2581 os_tid = 0x26c8 [0177.240] GetLastError () returned 0x57 [0177.240] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f17c8 [0177.240] SetLastError (dwErrCode=0x57) [0177.240] IcmpCreateFile () returned 0x7f5870 [0177.240] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6ad0 [0177.240] IcmpSendEcho2 (IcmpHandle=0x7f5870, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8800a8c0, RequestData=0x2f07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6ad0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2582 os_tid = 0x26cc [0177.241] GetLastError () returned 0x57 [0177.241] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ec690 [0177.241] SetLastError (dwErrCode=0x57) [0177.241] IcmpCreateFile () returned 0x7f58a8 [0177.241] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6b20 [0177.241] IcmpSendEcho2 (IcmpHandle=0x7f58a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8900a8c0, RequestData=0x2f1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6b20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2583 os_tid = 0x26d0 [0177.242] GetLastError () returned 0x57 [0177.242] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6eca18 [0177.243] SetLastError (dwErrCode=0x57) [0177.243] IcmpCreateFile () returned 0x7f5f00 [0177.243] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6b70 [0177.243] IcmpSendEcho2 (IcmpHandle=0x7f5f00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8a00a8c0, RequestData=0x2f2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6b70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2584 os_tid = 0x26d4 [0177.244] GetLastError () returned 0x57 [0177.244] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ecda0 [0177.244] SetLastError (dwErrCode=0x57) [0177.244] IcmpCreateFile () returned 0x7f5f38 [0177.244] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6c10 [0177.244] IcmpSendEcho2 (IcmpHandle=0x7f5f38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8b00a8c0, RequestData=0x2f43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6c10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2585 os_tid = 0x26d8 [0177.245] GetLastError () returned 0x57 [0177.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed128 [0177.245] SetLastError (dwErrCode=0x57) [0177.245] IcmpCreateFile () returned 0x7f5f70 [0177.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6c60 [0177.245] IcmpSendEcho2 (IcmpHandle=0x7f5f70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8c00a8c0, RequestData=0x2f57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6c60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2586 os_tid = 0x26dc [0177.246] GetLastError () returned 0x57 [0177.246] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ed4b0 [0177.246] SetLastError (dwErrCode=0x57) [0177.247] IcmpCreateFile () returned 0x7f5de8 [0177.247] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6cb0 [0177.247] IcmpSendEcho2 (IcmpHandle=0x7f5de8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8d00a8c0, RequestData=0x2f6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6cb0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2587 os_tid = 0x26e0 [0177.247] GetLastError () returned 0x57 [0177.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a97e8 [0177.248] SetLastError (dwErrCode=0x57) [0177.248] IcmpCreateFile () returned 0x7f5e20 [0177.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6d00 [0177.248] IcmpSendEcho2 (IcmpHandle=0x7f5e20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8e00a8c0, RequestData=0x2f7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6d00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2588 os_tid = 0x26e4 [0177.249] GetLastError () returned 0x57 [0177.249] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a9b70 [0177.249] SetLastError (dwErrCode=0x57) [0177.249] IcmpCreateFile () returned 0x7f5e58 [0177.249] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6d50 [0177.249] IcmpSendEcho2 (IcmpHandle=0x7f5e58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8f00a8c0, RequestData=0x2f93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6d50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2589 os_tid = 0x26e8 [0177.250] GetLastError () returned 0x57 [0177.250] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ab428 [0177.250] SetLastError (dwErrCode=0x57) [0177.250] IcmpCreateFile () returned 0x7f5e90 [0177.250] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6da0 [0177.250] IcmpSendEcho2 (IcmpHandle=0x7f5e90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9000a8c0, RequestData=0x2fa7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6da0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2590 os_tid = 0x26ec [0177.251] GetLastError () returned 0x57 [0177.252] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ab7b0 [0177.252] SetLastError (dwErrCode=0x57) [0177.252] IcmpCreateFile () returned 0x7f5ec8 [0177.252] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6df0 [0177.252] IcmpSendEcho2 (IcmpHandle=0x7f5ec8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9100a8c0, RequestData=0x2fbbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6df0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2591 os_tid = 0x26f0 [0177.253] GetLastError () returned 0x57 [0177.253] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a703c68 [0177.259] SetLastError (dwErrCode=0x57) [0177.259] IcmpCreateFile () returned 0x7f5480 [0177.259] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6e40 [0177.259] IcmpSendEcho2 (IcmpHandle=0x7f5480, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9200a8c0, RequestData=0x2fcfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6e40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2592 os_tid = 0x26f4 [0177.260] GetLastError () returned 0x57 [0177.260] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a703ff0 [0177.260] SetLastError (dwErrCode=0x57) [0177.260] IcmpCreateFile () returned 0x7f5288 [0177.260] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6ee0 [0177.260] IcmpSendEcho2 (IcmpHandle=0x7f5288, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9300a8c0, RequestData=0x2fe3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6ee0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2593 os_tid = 0x26f8 [0177.261] GetLastError () returned 0x57 [0177.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a704378 [0177.261] SetLastError (dwErrCode=0x57) [0177.261] IcmpCreateFile () returned 0x7f52c0 [0177.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6f30 [0177.261] IcmpSendEcho2 (IcmpHandle=0x7f52c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9400a8c0, RequestData=0x2ff7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6f30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2594 os_tid = 0x26fc [0177.262] GetLastError () returned 0x57 [0177.262] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a702ac0 [0177.262] SetLastError (dwErrCode=0x57) [0177.262] IcmpCreateFile () returned 0x7f52f8 [0177.263] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6f80 [0177.263] IcmpSendEcho2 (IcmpHandle=0x7f52f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9500a8c0, RequestData=0x300bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6f80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2595 os_tid = 0x2700 [0177.263] GetLastError () returned 0x57 [0177.264] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a702e48 [0177.264] SetLastError (dwErrCode=0x57) [0177.264] IcmpCreateFile () returned 0x7f5330 [0177.264] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6fd0 [0177.264] IcmpSendEcho2 (IcmpHandle=0x7f5330, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9600a8c0, RequestData=0x301fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6fd0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2596 os_tid = 0x2704 [0177.265] GetLastError () returned 0x57 [0177.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7031d0 [0177.265] SetLastError (dwErrCode=0x57) [0177.265] IcmpCreateFile () returned 0x7f5368 [0177.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f6e90 [0177.265] IcmpSendEcho2 (IcmpHandle=0x7f5368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9700a8c0, RequestData=0x3033ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f6e90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2597 os_tid = 0x2708 [0177.266] GetLastError () returned 0x57 [0177.266] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a703558 [0177.266] SetLastError (dwErrCode=0x57) [0177.266] IcmpCreateFile () returned 0x7f53a0 [0177.266] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f78e0 [0177.266] IcmpSendEcho2 (IcmpHandle=0x7f53a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9800a8c0, RequestData=0x3047ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f78e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2598 os_tid = 0x270c [0177.267] GetLastError () returned 0x57 [0177.267] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7038e0 [0177.267] SetLastError (dwErrCode=0x57) [0177.267] IcmpCreateFile () returned 0x7f53d8 [0177.267] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7930 [0177.267] IcmpSendEcho2 (IcmpHandle=0x7f53d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9900a8c0, RequestData=0x305bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7930, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2599 os_tid = 0x2710 [0177.268] GetLastError () returned 0x57 [0177.268] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fa108 [0177.269] SetLastError (dwErrCode=0x57) [0177.269] IcmpCreateFile () returned 0x7f5410 [0177.269] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7980 [0177.269] IcmpSendEcho2 (IcmpHandle=0x7f5410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9a00a8c0, RequestData=0x306fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7980, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2600 os_tid = 0x2714 [0177.270] GetLastError () returned 0x57 [0177.270] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fa490 [0177.270] SetLastError (dwErrCode=0x57) [0177.270] IcmpCreateFile () returned 0x7f5448 [0177.270] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f79d0 [0177.270] IcmpSendEcho2 (IcmpHandle=0x7f5448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9b00a8c0, RequestData=0x3083ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f79d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2601 os_tid = 0x2718 [0177.271] GetLastError () returned 0x57 [0177.271] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fa818 [0177.271] SetLastError (dwErrCode=0x57) [0177.271] IcmpCreateFile () returned 0x7f54b8 [0177.271] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7a20 [0177.271] IcmpSendEcho2 (IcmpHandle=0x7f54b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9c00a8c0, RequestData=0x3097ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7a20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2602 os_tid = 0x2720 [0177.274] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.274] ReadFile (in: hFile=0x1c80, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.275] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.275] ReadFile (in: hFile=0x1c80, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.276] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x14590000 [0177.278] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x14590000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x14590000) returned 0x0 [0177.278] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0177.278] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x14590000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0177.278] BCryptExportKey (in: hKey=0x7f4280, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x14590000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x14590000, pcbResult=0x141cf500) returned 0x0 [0177.279] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x14590230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x14590230) returned 0x0 [0177.279] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x14590000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x14590000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x14590000, pcbResult=0x141cf500) returned 0x0 [0177.282] VirtualFree (lpAddress=0x14590000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.284] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.285] WriteFile (in: hFile=0x1c80, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0177.285] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.285] ReadFile (in: hFile=0x1c80, lpBuffer=0x2950000, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x141cf61c*=0x138c, lpOverlapped=0x0) returned 1 [0177.285] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xffffec74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.285] BCryptEncrypt (in: hKey=0x7f4280, pbInput=0x2950000, cbInput=0x138c, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f4280, pbIV=0x141cf848, pbOutput=0x2950000, pcbResult=0x141cf618) returned 0x0 [0177.285] WriteFile (in: hFile=0x1c80, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x141cf61c*=0x1390, lpOverlapped=0x0) returned 1 [0177.285] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0177.285] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.285] WriteFile (in: hFile=0x1c80, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.285] SetFilePointerEx (in: hFile=0x1c80, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.285] BCryptDestroyKey (in: hKey=0x7f4280 | out: hKey=0x7f4280) returned 0x0 [0177.285] CloseHandle (hObject=0x1c80) returned 1 [0177.288] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x14590000 [0177.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.play")) returned 1 [0178.187] VirtualFree (lpAddress=0x14590000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2603 os_tid = 0x2724 [0177.292] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.292] ReadFile (in: hFile=0xa8c, lpBuffer=0x30bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bff85c, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesRead=0x30bff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.293] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.293] ReadFile (in: hFile=0xa8c, lpBuffer=0x30bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bff85c, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesRead=0x30bff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.293] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145a0000 [0177.295] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145a0000) returned 0x0 [0177.296] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x30bff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0177.296] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x30bff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x30bff828, pbKeyObject=0x0) returned 0x0 [0177.296] BCryptExportKey (in: hKey=0x7f4280, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145a0000, cbOutput=0x230, pcbResult=0x30bff500, dwFlags=0x0 | out: pbOutput=0x145a0000, pcbResult=0x30bff500) returned 0x0 [0177.296] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145a0230) returned 0x0 [0177.296] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145a0000, cbOutput=0x400, pcbResult=0x30bff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145a0000, pcbResult=0x30bff500) returned 0x0 [0177.299] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.301] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.301] WriteFile (in: hFile=0xa8c, lpBuffer=0x30bffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bff830, lpOverlapped=0x0 | out: lpBuffer=0x30bffb34*, lpNumberOfBytesWritten=0x30bff830*=0x428, lpOverlapped=0x0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.302] ReadFile (in: hFile=0xa8c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x30bff61c*=0x12b4, lpOverlapped=0x0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xffffed4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.302] BCryptEncrypt (in: hKey=0x7f4280, pbInput=0x2a50000, cbInput=0x12b4, pPaddingInfo=0x0, pbIV=0x30bff848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x30bff618, dwFlags=0x1 | out: hKey=0x7f4280, pbIV=0x30bff848, pbOutput=0x2a50000, pcbResult=0x30bff618) returned 0x0 [0177.302] WriteFile (in: hFile=0xa8c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x30bff61c*=0x12c0, lpOverlapped=0x0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bff60c | out: lpNewFilePointer=0x0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.302] WriteFile (in: hFile=0xa8c, lpBuffer=0x30bff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bff61c, lpOverlapped=0x0 | out: lpBuffer=0x30bff83c*, lpNumberOfBytesWritten=0x30bff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xa8c, liDistanceToMove=0x12c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.302] BCryptDestroyKey (in: hKey=0x7f4280 | out: hKey=0x7f4280) returned 0x0 [0177.302] CloseHandle (hObject=0xa8c) returned 1 [0177.459] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145a0000 [0177.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.play")) returned 1 [0178.175] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2604 os_tid = 0x2728 [0177.303] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.303] ReadFile (in: hFile=0x1b70, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.307] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.307] ReadFile (in: hFile=0x1b70, lpBuffer=0x2d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesRead=0x2d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145a0000 [0177.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145a0000) returned 0x0 [0177.309] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0177.309] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2d9ff828, pbKeyObject=0x0) returned 0x0 [0177.309] BCryptExportKey (in: hKey=0x7f4280, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145a0000, cbOutput=0x230, pcbResult=0x2d9ff500, dwFlags=0x0 | out: pbOutput=0x145a0000, pcbResult=0x2d9ff500) returned 0x0 [0177.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145a0230) returned 0x0 [0177.310] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145a0000, cbOutput=0x400, pcbResult=0x2d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145a0000, pcbResult=0x2d9ff500) returned 0x0 [0177.313] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.315] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.316] WriteFile (in: hFile=0x1b70, lpBuffer=0x2d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d9ffb34*, lpNumberOfBytesWritten=0x2d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0177.316] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.316] ReadFile (in: hFile=0x1b70, lpBuffer=0x4050000, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2d9ff61c*=0x2020, lpOverlapped=0x0) returned 1 [0177.316] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xffffdfe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.317] BCryptEncrypt (in: hKey=0x7f4280, pbInput=0x4050000, cbInput=0x2020, pPaddingInfo=0x0, pbIV=0x2d9ff848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2d9ff618, dwFlags=0x1 | out: hKey=0x7f4280, pbIV=0x2d9ff848, pbOutput=0x4050000, pcbResult=0x2d9ff618) returned 0x0 [0177.317] WriteFile (in: hFile=0x1b70, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2d9ff61c*=0x2030, lpOverlapped=0x0) returned 1 [0177.317] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0177.317] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.317] WriteFile (in: hFile=0x1b70, lpBuffer=0x2d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d9ff83c*, lpNumberOfBytesWritten=0x2d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.317] SetFilePointerEx (in: hFile=0x1b70, liDistanceToMove=0x2030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.317] BCryptDestroyKey (in: hKey=0x7f4280 | out: hKey=0x7f4280) returned 0x0 [0177.317] CloseHandle (hObject=0x1b70) returned 1 [0177.463] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145b0000 [0177.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.play")) returned 1 [0178.173] VirtualFree (lpAddress=0x145b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2605 os_tid = 0x272c [0177.317] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.318] ReadFile (in: hFile=0x1878, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.319] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.319] ReadFile (in: hFile=0x1878, lpBuffer=0x2db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesRead=0x2db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.319] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145a0000 [0177.322] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145a0000) returned 0x0 [0177.322] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2db3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0177.322] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2db3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2db3f828, pbKeyObject=0x0) returned 0x0 [0177.322] BCryptExportKey (in: hKey=0x7f4280, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145a0000, cbOutput=0x230, pcbResult=0x2db3f500, dwFlags=0x0 | out: pbOutput=0x145a0000, pcbResult=0x2db3f500) returned 0x0 [0177.322] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145a0230) returned 0x0 [0177.322] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145a0000, cbOutput=0x400, pcbResult=0x2db3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145a0000, pcbResult=0x2db3f500) returned 0x0 [0177.326] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.329] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.329] WriteFile (in: hFile=0x1878, lpBuffer=0x2db3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db3f830, lpOverlapped=0x0 | out: lpBuffer=0x2db3fb34*, lpNumberOfBytesWritten=0x2db3f830*=0x428, lpOverlapped=0x0) returned 1 [0177.330] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.330] ReadFile (in: hFile=0x1878, lpBuffer=0x3150000, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2db3f61c*=0x126c, lpOverlapped=0x0) returned 1 [0177.330] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xffffed94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.330] BCryptEncrypt (in: hKey=0x7f4280, pbInput=0x3150000, cbInput=0x126c, pPaddingInfo=0x0, pbIV=0x2db3f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2db3f618, dwFlags=0x1 | out: hKey=0x7f4280, pbIV=0x2db3f848, pbOutput=0x3150000, pcbResult=0x2db3f618) returned 0x0 [0177.330] WriteFile (in: hFile=0x1878, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2db3f61c*=0x1270, lpOverlapped=0x0) returned 1 [0177.330] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db3f60c | out: lpNewFilePointer=0x0) returned 1 [0177.330] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.330] WriteFile (in: hFile=0x1878, lpBuffer=0x2db3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db3f83c*, lpNumberOfBytesWritten=0x2db3f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.330] SetFilePointerEx (in: hFile=0x1878, liDistanceToMove=0x1270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.330] BCryptDestroyKey (in: hKey=0x7f4280 | out: hKey=0x7f4280) returned 0x0 [0177.330] CloseHandle (hObject=0x1878) returned 1 [0177.469] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145c0000 [0177.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.play")) returned 1 [0178.173] VirtualFree (lpAddress=0x145c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2606 os_tid = 0x2730 [0177.334] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.334] ReadFile (in: hFile=0x13d4, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.336] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.336] ReadFile (in: hFile=0x13d4, lpBuffer=0x2dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesRead=0x2dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.336] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145a0000 [0177.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145a0000) returned 0x0 [0177.339] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2dc7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0177.339] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2dc7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2dc7f828, pbKeyObject=0x0) returned 0x0 [0177.339] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145a0000, cbOutput=0x230, pcbResult=0x2dc7f500, dwFlags=0x0 | out: pbOutput=0x145a0000, pcbResult=0x2dc7f500) returned 0x0 [0177.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145a0230) returned 0x0 [0177.339] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145a0000, cbOutput=0x400, pcbResult=0x2dc7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145a0000, pcbResult=0x2dc7f500) returned 0x0 [0177.343] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.345] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.346] WriteFile (in: hFile=0x13d4, lpBuffer=0x2dc7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dc7f830, lpOverlapped=0x0 | out: lpBuffer=0x2dc7fb34*, lpNumberOfBytesWritten=0x2dc7f830*=0x428, lpOverlapped=0x0) returned 1 [0177.346] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.346] ReadFile (in: hFile=0x13d4, lpBuffer=0x3250000, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2dc7f61c*=0x4146, lpOverlapped=0x0) returned 1 [0177.346] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xffffbeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.347] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x3250000, cbInput=0x4146, pPaddingInfo=0x0, pbIV=0x2dc7f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2dc7f618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x2dc7f848, pbOutput=0x3250000, pcbResult=0x2dc7f618) returned 0x0 [0177.347] WriteFile (in: hFile=0x13d4, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2dc7f61c*=0x4150, lpOverlapped=0x0) returned 1 [0177.347] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dc7f60c | out: lpNewFilePointer=0x0) returned 1 [0177.347] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.347] WriteFile (in: hFile=0x13d4, lpBuffer=0x2dc7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2dc7f83c*, lpNumberOfBytesWritten=0x2dc7f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.347] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x4150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.347] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0177.347] CloseHandle (hObject=0x13d4) returned 1 [0177.473] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145d0000 [0177.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.play")) returned 1 [0178.172] VirtualFree (lpAddress=0x145d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2607 os_tid = 0x2734 [0177.347] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.348] ReadFile (in: hFile=0x108c, lpBuffer=0x30d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30d7fb34*, lpNumberOfBytesRead=0x30d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.349] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.349] ReadFile (in: hFile=0x108c, lpBuffer=0x30d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30d7fb34*, lpNumberOfBytesRead=0x30d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.349] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145a0000 [0177.352] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145a0000) returned 0x0 [0177.352] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x30d7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0177.352] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x30d7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x30d7f828, pbKeyObject=0x0) returned 0x0 [0177.352] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145a0000, cbOutput=0x230, pcbResult=0x30d7f500, dwFlags=0x0 | out: pbOutput=0x145a0000, pcbResult=0x30d7f500) returned 0x0 [0177.352] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145a0230) returned 0x0 [0177.353] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145a0000, cbOutput=0x400, pcbResult=0x30d7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145a0000, pcbResult=0x30d7f500) returned 0x0 [0177.357] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.361] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.361] WriteFile (in: hFile=0x108c, lpBuffer=0x30d7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30d7f830, lpOverlapped=0x0 | out: lpBuffer=0x30d7fb34*, lpNumberOfBytesWritten=0x30d7f830*=0x428, lpOverlapped=0x0) returned 1 [0177.361] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.361] ReadFile (in: hFile=0x108c, lpBuffer=0x3350000, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x30d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x30d7f61c*=0x9d27, lpOverlapped=0x0) returned 1 [0177.362] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xffff62d9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.362] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x3350000, cbInput=0x9d27, pPaddingInfo=0x0, pbIV=0x30d7f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x30d7f618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x30d7f848, pbOutput=0x3350000, pcbResult=0x30d7f618) returned 0x0 [0177.362] WriteFile (in: hFile=0x108c, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x30d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x30d7f61c*=0x9d30, lpOverlapped=0x0) returned 1 [0177.363] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30d7f60c | out: lpNewFilePointer=0x0) returned 1 [0177.363] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.363] WriteFile (in: hFile=0x108c, lpBuffer=0x30d7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x30d7f83c*, lpNumberOfBytesWritten=0x30d7f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.363] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x9d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.363] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0177.363] CloseHandle (hObject=0x108c) returned 1 [0177.476] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145e0000 [0177.480] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.play")) returned 1 [0178.171] VirtualFree (lpAddress=0x145e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2608 os_tid = 0x2738 [0177.363] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.364] ReadFile (in: hFile=0x100c, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.365] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.365] ReadFile (in: hFile=0x100c, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.365] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145a0000 [0177.369] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145a0000) returned 0x0 [0177.369] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x30ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0177.369] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x30ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x30ebf828, pbKeyObject=0x0) returned 0x0 [0177.369] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145a0000, cbOutput=0x230, pcbResult=0x30ebf500, dwFlags=0x0 | out: pbOutput=0x145a0000, pcbResult=0x30ebf500) returned 0x0 [0177.369] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145a0230) returned 0x0 [0177.369] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145a0000, cbOutput=0x400, pcbResult=0x30ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145a0000, pcbResult=0x30ebf500) returned 0x0 [0177.374] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.382] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.382] WriteFile (in: hFile=0x100c, lpBuffer=0x30ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30ebf830, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesWritten=0x30ebf830*=0x428, lpOverlapped=0x0) returned 1 [0177.382] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.382] ReadFile (in: hFile=0x100c, lpBuffer=0x4150000, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x30ebf61c*=0x8379, lpOverlapped=0x0) returned 1 [0177.383] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xffff7c87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.383] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x4150000, cbInput=0x8379, pPaddingInfo=0x0, pbIV=0x30ebf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x30ebf618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x30ebf848, pbOutput=0x4150000, pcbResult=0x30ebf618) returned 0x0 [0177.383] WriteFile (in: hFile=0x100c, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x30ebf61c*=0x8380, lpOverlapped=0x0) returned 1 [0177.383] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ebf60c | out: lpNewFilePointer=0x0) returned 1 [0177.384] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.384] WriteFile (in: hFile=0x100c, lpBuffer=0x30ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x30ebf83c*, lpNumberOfBytesWritten=0x30ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.384] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x8380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.384] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0177.384] CloseHandle (hObject=0x100c) returned 1 [0177.480] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.play")) returned 1 [0177.492] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2609 os_tid = 0x273c [0177.384] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.385] ReadFile (in: hFile=0x16a4, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.386] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.386] ReadFile (in: hFile=0x16a4, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.386] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145a0000 [0177.389] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145a0000) returned 0x0 [0177.389] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x30fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0177.389] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x30fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x30fff828, pbKeyObject=0x0) returned 0x0 [0177.389] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145a0000, cbOutput=0x230, pcbResult=0x30fff500, dwFlags=0x0 | out: pbOutput=0x145a0000, pcbResult=0x30fff500) returned 0x0 [0177.389] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145a0230) returned 0x0 [0177.389] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145a0000, cbOutput=0x400, pcbResult=0x30fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145a0000, pcbResult=0x30fff500) returned 0x0 [0177.392] VirtualFree (lpAddress=0x145a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.395] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.395] WriteFile (in: hFile=0x16a4, lpBuffer=0x30fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30fff830, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesWritten=0x30fff830*=0x428, lpOverlapped=0x0) returned 1 [0177.396] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.396] ReadFile (in: hFile=0x16a4, lpBuffer=0x4250000, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x30fff61c*=0xf0c1, lpOverlapped=0x0) returned 1 [0177.397] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0xffff0f3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.397] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x4250000, cbInput=0xf0c1, pPaddingInfo=0x0, pbIV=0x30fff848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x30fff618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x30fff848, pbOutput=0x4250000, pcbResult=0x30fff618) returned 0x0 [0177.397] WriteFile (in: hFile=0x16a4, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x30fff61c*=0xf0d0, lpOverlapped=0x0) returned 1 [0177.399] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30fff60c | out: lpNewFilePointer=0x0) returned 1 [0177.399] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.399] WriteFile (in: hFile=0x16a4, lpBuffer=0x30fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x30fff83c*, lpNumberOfBytesWritten=0x30fff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.400] SetFilePointerEx (in: hFile=0x16a4, liDistanceToMove=0xf0d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.400] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0177.400] CloseHandle (hObject=0x16a4) returned 1 [0178.192] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0178.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.play")) returned 1 [0178.717] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2610 os_tid = 0x2740 [0177.400] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.400] ReadFile (in: hFile=0x16ac, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.594] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.594] ReadFile (in: hFile=0x16ac, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.594] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.596] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.596] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x3113f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0177.596] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x3113f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x3113f828, pbKeyObject=0x0) returned 0x0 [0177.596] BCryptExportKey (in: hKey=0x7f4ca0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3113f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3113f500) returned 0x0 [0177.596] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.596] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3113f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3113f500) returned 0x0 [0177.600] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.602] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.602] WriteFile (in: hFile=0x16ac, lpBuffer=0x3113fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3113f830, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesWritten=0x3113f830*=0x428, lpOverlapped=0x0) returned 1 [0177.602] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.602] ReadFile (in: hFile=0x16ac, lpBuffer=0x4350000, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x3113f61c*=0xc056, lpOverlapped=0x0) returned 1 [0177.768] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0xffff3faa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.768] BCryptEncrypt (in: hKey=0x7f4ca0, pbInput=0x4350000, cbInput=0xc056, pPaddingInfo=0x0, pbIV=0x3113f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x3113f618, dwFlags=0x1 | out: hKey=0x7f4ca0, pbIV=0x3113f848, pbOutput=0x4350000, pcbResult=0x3113f618) returned 0x0 [0177.768] WriteFile (in: hFile=0x16ac, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x3113f61c*=0xc060, lpOverlapped=0x0) returned 1 [0177.770] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3113f60c | out: lpNewFilePointer=0x0) returned 1 [0177.770] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.770] WriteFile (in: hFile=0x16ac, lpBuffer=0x3113f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x3113f83c*, lpNumberOfBytesWritten=0x3113f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.770] SetFilePointerEx (in: hFile=0x16ac, liDistanceToMove=0xc060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.770] BCryptDestroyKey (in: hKey=0x7f4ca0 | out: hKey=0x7f4ca0) returned 0x0 [0177.770] CloseHandle (hObject=0x16ac) returned 1 [0177.770] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.play")) returned 1 [0177.774] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2611 os_tid = 0x2744 [0177.401] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.402] ReadFile (in: hFile=0x16b4, lpBuffer=0x3127fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3127f85c, lpOverlapped=0x0 | out: lpBuffer=0x3127fb34*, lpNumberOfBytesRead=0x3127f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.603] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.603] ReadFile (in: hFile=0x16b4, lpBuffer=0x3127fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3127f85c, lpOverlapped=0x0 | out: lpBuffer=0x3127fb34*, lpNumberOfBytesRead=0x3127f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.603] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.605] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.605] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x3127f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0177.605] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x3127f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x3127f828, pbKeyObject=0x0) returned 0x0 [0177.606] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3127f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3127f500) returned 0x0 [0177.606] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.606] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3127f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3127f500) returned 0x0 [0177.609] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.611] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.611] WriteFile (in: hFile=0x16b4, lpBuffer=0x3127fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3127f830, lpOverlapped=0x0 | out: lpBuffer=0x3127fb34*, lpNumberOfBytesWritten=0x3127f830*=0x428, lpOverlapped=0x0) returned 1 [0177.612] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.612] ReadFile (in: hFile=0x16b4, lpBuffer=0x4450000, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x3127f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x3127f61c*=0x5285, lpOverlapped=0x0) returned 1 [0177.778] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xffffad7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.778] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x4450000, cbInput=0x5285, pPaddingInfo=0x0, pbIV=0x3127f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x3127f618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x3127f848, pbOutput=0x4450000, pcbResult=0x3127f618) returned 0x0 [0177.778] WriteFile (in: hFile=0x16b4, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x3127f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x3127f61c*=0x5290, lpOverlapped=0x0) returned 1 [0177.778] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3127f60c | out: lpNewFilePointer=0x0) returned 1 [0177.778] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.778] WriteFile (in: hFile=0x16b4, lpBuffer=0x3127f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3127f61c, lpOverlapped=0x0 | out: lpBuffer=0x3127f83c*, lpNumberOfBytesWritten=0x3127f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.778] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x5290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.778] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0177.778] CloseHandle (hObject=0x16b4) returned 1 [0177.778] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.play")) returned 1 [0177.782] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2612 os_tid = 0x2748 [0177.404] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.404] ReadFile (in: hFile=0x16bc, lpBuffer=0x313bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x313bf85c, lpOverlapped=0x0 | out: lpBuffer=0x313bfb34*, lpNumberOfBytesRead=0x313bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.593] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.593] ReadFile (in: hFile=0x16bc, lpBuffer=0x313bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x313bf85c, lpOverlapped=0x0 | out: lpBuffer=0x313bfb34*, lpNumberOfBytesRead=0x313bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.755] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.760] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x313bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0177.760] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x313bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x313bf828, pbKeyObject=0x0) returned 0x0 [0177.760] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x313bf500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x313bf500) returned 0x0 [0177.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.760] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x313bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x313bf500) returned 0x0 [0177.764] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.766] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.766] WriteFile (in: hFile=0x16bc, lpBuffer=0x313bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x313bf830, lpOverlapped=0x0 | out: lpBuffer=0x313bfb34*, lpNumberOfBytesWritten=0x313bf830*=0x428, lpOverlapped=0x0) returned 1 [0177.767] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.767] ReadFile (in: hFile=0x16bc, lpBuffer=0x4550000, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x313bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x313bf61c*=0x45cb, lpOverlapped=0x0) returned 1 [0177.955] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0xffffba35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.955] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x4550000, cbInput=0x45cb, pPaddingInfo=0x0, pbIV=0x313bf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x313bf618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x313bf848, pbOutput=0x4550000, pcbResult=0x313bf618) returned 0x0 [0177.955] WriteFile (in: hFile=0x16bc, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x313bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x313bf61c*=0x45d0, lpOverlapped=0x0) returned 1 [0177.955] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.955] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.955] WriteFile (in: hFile=0x16bc, lpBuffer=0x313bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x313bf61c, lpOverlapped=0x0 | out: lpBuffer=0x313bf83c*, lpNumberOfBytesWritten=0x313bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.956] SetFilePointerEx (in: hFile=0x16bc, liDistanceToMove=0x45d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.956] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0177.956] CloseHandle (hObject=0x16bc) returned 1 [0177.956] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.play")) returned 1 [0177.959] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2613 os_tid = 0x274c [0177.405] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.405] ReadFile (in: hFile=0x1b0c, lpBuffer=0x314ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314ff85c, lpOverlapped=0x0 | out: lpBuffer=0x314ffb34*, lpNumberOfBytesRead=0x314ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.638] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.638] ReadFile (in: hFile=0x1b0c, lpBuffer=0x314ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314ff85c, lpOverlapped=0x0 | out: lpBuffer=0x314ffb34*, lpNumberOfBytesRead=0x314ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.638] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.640] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.641] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x314ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0177.641] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x314ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x314ff828, pbKeyObject=0x0) returned 0x0 [0177.641] BCryptExportKey (in: hKey=0x7f1260, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x314ff500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x314ff500) returned 0x0 [0177.641] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.641] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x314ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x314ff500) returned 0x0 [0177.644] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.647] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.647] WriteFile (in: hFile=0x1b0c, lpBuffer=0x314ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x314ff830, lpOverlapped=0x0 | out: lpBuffer=0x314ffb34*, lpNumberOfBytesWritten=0x314ff830*=0x428, lpOverlapped=0x0) returned 1 [0177.647] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.647] ReadFile (in: hFile=0x1b0c, lpBuffer=0x4650000, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x314ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x314ff61c*=0x7c6a, lpOverlapped=0x0) returned 1 [0177.847] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xffff8396, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.847] BCryptEncrypt (in: hKey=0x7f1260, pbInput=0x4650000, cbInput=0x7c6a, pPaddingInfo=0x0, pbIV=0x314ff848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x314ff618, dwFlags=0x1 | out: hKey=0x7f1260, pbIV=0x314ff848, pbOutput=0x4650000, pcbResult=0x314ff618) returned 0x0 [0177.847] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x314ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x314ff61c*=0x7c70, lpOverlapped=0x0) returned 1 [0177.847] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314ff60c | out: lpNewFilePointer=0x0) returned 1 [0177.847] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.847] WriteFile (in: hFile=0x1b0c, lpBuffer=0x314ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x314ff61c, lpOverlapped=0x0 | out: lpBuffer=0x314ff83c*, lpNumberOfBytesWritten=0x314ff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.847] SetFilePointerEx (in: hFile=0x1b0c, liDistanceToMove=0x7c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.847] BCryptDestroyKey (in: hKey=0x7f1260 | out: hKey=0x7f1260) returned 0x0 [0177.847] CloseHandle (hObject=0x1b0c) returned 1 [0177.848] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.play")) returned 1 [0177.851] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2614 os_tid = 0x2750 [0177.406] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.406] ReadFile (in: hFile=0x1af0, lpBuffer=0x3163fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3163f85c, lpOverlapped=0x0 | out: lpBuffer=0x3163fb34*, lpNumberOfBytesRead=0x3163f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.579] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.579] ReadFile (in: hFile=0x1af0, lpBuffer=0x3163fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3163f85c, lpOverlapped=0x0 | out: lpBuffer=0x3163fb34*, lpNumberOfBytesRead=0x3163f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.579] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.583] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.583] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x3163f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0177.583] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x3163f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x3163f828, pbKeyObject=0x0) returned 0x0 [0177.583] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3163f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3163f500) returned 0x0 [0177.583] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.583] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3163f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3163f500) returned 0x0 [0177.587] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.590] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.590] WriteFile (in: hFile=0x1af0, lpBuffer=0x3163fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3163f830, lpOverlapped=0x0 | out: lpBuffer=0x3163fb34*, lpNumberOfBytesWritten=0x3163f830*=0x428, lpOverlapped=0x0) returned 1 [0177.591] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.591] ReadFile (in: hFile=0x1af0, lpBuffer=0x4750000, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x3163f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x3163f61c*=0x8fd4, lpOverlapped=0x0) returned 1 [0177.741] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xffff702c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.741] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x4750000, cbInput=0x8fd4, pPaddingInfo=0x0, pbIV=0x3163f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x3163f618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x3163f848, pbOutput=0x4750000, pcbResult=0x3163f618) returned 0x0 [0177.741] WriteFile (in: hFile=0x1af0, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x3163f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x3163f61c*=0x8fe0, lpOverlapped=0x0) returned 1 [0177.742] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3163f60c | out: lpNewFilePointer=0x0) returned 1 [0177.742] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.742] WriteFile (in: hFile=0x1af0, lpBuffer=0x3163f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3163f61c, lpOverlapped=0x0 | out: lpBuffer=0x3163f83c*, lpNumberOfBytesWritten=0x3163f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.742] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x8fe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.742] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0177.742] CloseHandle (hObject=0x1af0) returned 1 [0177.742] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.play")) returned 1 [0177.747] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2615 os_tid = 0x2754 [0177.408] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.408] ReadFile (in: hFile=0x1ad0, lpBuffer=0x3177fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3177f85c, lpOverlapped=0x0 | out: lpBuffer=0x3177fb34*, lpNumberOfBytesRead=0x3177f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.613] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.613] ReadFile (in: hFile=0x1ad0, lpBuffer=0x3177fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3177f85c, lpOverlapped=0x0 | out: lpBuffer=0x3177fb34*, lpNumberOfBytesRead=0x3177f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.613] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.615] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.615] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x3177f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0177.615] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x3177f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x3177f828, pbKeyObject=0x0) returned 0x0 [0177.615] BCryptExportKey (in: hKey=0x7f0fe0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3177f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3177f500) returned 0x0 [0177.615] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.615] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3177f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3177f500) returned 0x0 [0177.634] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.637] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.637] WriteFile (in: hFile=0x1ad0, lpBuffer=0x3177fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3177f830, lpOverlapped=0x0 | out: lpBuffer=0x3177fb34*, lpNumberOfBytesWritten=0x3177f830*=0x428, lpOverlapped=0x0) returned 1 [0177.637] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.637] ReadFile (in: hFile=0x1ad0, lpBuffer=0x4850000, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x3177f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x3177f61c*=0x8fb8, lpOverlapped=0x0) returned 1 [0177.801] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xffff7048, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.801] BCryptEncrypt (in: hKey=0x7f0fe0, pbInput=0x4850000, cbInput=0x8fb8, pPaddingInfo=0x0, pbIV=0x3177f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x3177f618, dwFlags=0x1 | out: hKey=0x7f0fe0, pbIV=0x3177f848, pbOutput=0x4850000, pcbResult=0x3177f618) returned 0x0 [0177.801] WriteFile (in: hFile=0x1ad0, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x3177f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x3177f61c*=0x8fc0, lpOverlapped=0x0) returned 1 [0177.802] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3177f60c | out: lpNewFilePointer=0x0) returned 1 [0177.802] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.802] WriteFile (in: hFile=0x1ad0, lpBuffer=0x3177f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3177f61c, lpOverlapped=0x0 | out: lpBuffer=0x3177f83c*, lpNumberOfBytesWritten=0x3177f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.802] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x8fc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.803] BCryptDestroyKey (in: hKey=0x7f0fe0 | out: hKey=0x7f0fe0) returned 0x0 [0177.803] CloseHandle (hObject=0x1ad0) returned 1 [0177.803] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.play")) returned 1 [0177.811] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2616 os_tid = 0x2758 [0177.409] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.409] ReadFile (in: hFile=0x1ab0, lpBuffer=0x318bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x318bf85c, lpOverlapped=0x0 | out: lpBuffer=0x318bfb34*, lpNumberOfBytesRead=0x318bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.568] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.568] ReadFile (in: hFile=0x1ab0, lpBuffer=0x318bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x318bf85c, lpOverlapped=0x0 | out: lpBuffer=0x318bfb34*, lpNumberOfBytesRead=0x318bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.568] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.571] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.571] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x318bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0177.572] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x318bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x318bf828, pbKeyObject=0x0) returned 0x0 [0177.572] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x318bf500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x318bf500) returned 0x0 [0177.572] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.572] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x318bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x318bf500) returned 0x0 [0177.575] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.578] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.578] WriteFile (in: hFile=0x1ab0, lpBuffer=0x318bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x318bf830, lpOverlapped=0x0 | out: lpBuffer=0x318bfb34*, lpNumberOfBytesWritten=0x318bf830*=0x428, lpOverlapped=0x0) returned 1 [0177.578] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.578] ReadFile (in: hFile=0x1ab0, lpBuffer=0x4950000, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x318bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x318bf61c*=0x8a5b, lpOverlapped=0x0) returned 1 [0177.725] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xffff75a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.725] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4950000, cbInput=0x8a5b, pPaddingInfo=0x0, pbIV=0x318bf848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x318bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x318bf848, pbOutput=0x4950000, pcbResult=0x318bf618) returned 0x0 [0177.726] WriteFile (in: hFile=0x1ab0, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x318bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x318bf61c*=0x8a60, lpOverlapped=0x0) returned 1 [0177.728] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.728] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.729] WriteFile (in: hFile=0x1ab0, lpBuffer=0x318bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x318bf61c, lpOverlapped=0x0 | out: lpBuffer=0x318bf83c*, lpNumberOfBytesWritten=0x318bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.729] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x8a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.729] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0177.729] CloseHandle (hObject=0x1ab0) returned 1 [0177.729] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.play")) returned 1 [0177.733] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2617 os_tid = 0x275c [0177.410] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.410] ReadFile (in: hFile=0x1a90, lpBuffer=0x319ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x319ff85c, lpOverlapped=0x0 | out: lpBuffer=0x319ffb34*, lpNumberOfBytesRead=0x319ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.612] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.612] ReadFile (in: hFile=0x1a90, lpBuffer=0x319ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x319ff85c, lpOverlapped=0x0 | out: lpBuffer=0x319ffb34*, lpNumberOfBytesRead=0x319ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.787] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.789] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.789] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x319ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0177.789] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x319ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x319ff828, pbKeyObject=0x0) returned 0x0 [0177.789] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x319ff500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x319ff500) returned 0x0 [0177.789] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.789] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x319ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x319ff500) returned 0x0 [0177.793] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.795] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.796] WriteFile (in: hFile=0x1a90, lpBuffer=0x319ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x319ff830, lpOverlapped=0x0 | out: lpBuffer=0x319ffb34*, lpNumberOfBytesWritten=0x319ff830*=0x428, lpOverlapped=0x0) returned 1 [0177.796] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.796] ReadFile (in: hFile=0x1a90, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x319ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x319ff61c*=0x84a6, lpOverlapped=0x0) returned 1 [0177.962] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xffff7b5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.962] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4a50000, cbInput=0x84a6, pPaddingInfo=0x0, pbIV=0x319ff848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x319ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x319ff848, pbOutput=0x4a50000, pcbResult=0x319ff618) returned 0x0 [0177.962] WriteFile (in: hFile=0x1a90, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x319ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x319ff61c*=0x84b0, lpOverlapped=0x0) returned 1 [0177.962] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319ff60c | out: lpNewFilePointer=0x0) returned 1 [0177.962] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.962] WriteFile (in: hFile=0x1a90, lpBuffer=0x319ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x319ff61c, lpOverlapped=0x0 | out: lpBuffer=0x319ff83c*, lpNumberOfBytesWritten=0x319ff61c*=0x8, lpOverlapped=0x0) returned 1 [0177.962] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x84b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.962] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0177.962] CloseHandle (hObject=0x1a90) returned 1 [0177.962] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.play")) returned 1 [0177.965] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2618 os_tid = 0x2760 [0177.411] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.412] ReadFile (in: hFile=0x1a70, lpBuffer=0x31b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31b3fb34*, lpNumberOfBytesRead=0x31b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.695] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.695] ReadFile (in: hFile=0x1a70, lpBuffer=0x31b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31b3fb34*, lpNumberOfBytesRead=0x31b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.695] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.698] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.698] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x31b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0177.699] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x31b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x31b3f828, pbKeyObject=0x0) returned 0x0 [0177.699] BCryptExportKey (in: hKey=0x7f1c80, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x31b3f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x31b3f500) returned 0x0 [0177.699] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.699] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x31b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x31b3f500) returned 0x0 [0177.704] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.707] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.707] WriteFile (in: hFile=0x1a70, lpBuffer=0x31b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31b3f830, lpOverlapped=0x0 | out: lpBuffer=0x31b3fb34*, lpNumberOfBytesWritten=0x31b3f830*=0x428, lpOverlapped=0x0) returned 1 [0177.708] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.708] ReadFile (in: hFile=0x1a70, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x31b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x31b3f61c*=0x9a76, lpOverlapped=0x0) returned 1 [0177.924] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xffff658a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.924] BCryptEncrypt (in: hKey=0x7f1c80, pbInput=0x4b50000, cbInput=0x9a76, pPaddingInfo=0x0, pbIV=0x31b3f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x31b3f618, dwFlags=0x1 | out: hKey=0x7f1c80, pbIV=0x31b3f848, pbOutput=0x4b50000, pcbResult=0x31b3f618) returned 0x0 [0177.924] WriteFile (in: hFile=0x1a70, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x31b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x31b3f61c*=0x9a80, lpOverlapped=0x0) returned 1 [0177.924] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31b3f60c | out: lpNewFilePointer=0x0) returned 1 [0177.924] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.924] WriteFile (in: hFile=0x1a70, lpBuffer=0x31b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x31b3f83c*, lpNumberOfBytesWritten=0x31b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.926] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x9a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.926] BCryptDestroyKey (in: hKey=0x7f1c80 | out: hKey=0x7f1c80) returned 0x0 [0177.926] CloseHandle (hObject=0x1a70) returned 1 [0177.927] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.play")) returned 1 [0177.930] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2619 os_tid = 0x2764 [0177.413] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.413] ReadFile (in: hFile=0x1a54, lpBuffer=0x31c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31c7fb34*, lpNumberOfBytesRead=0x31c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.694] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.694] ReadFile (in: hFile=0x1a54, lpBuffer=0x31c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31c7fb34*, lpNumberOfBytesRead=0x31c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.901] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.905] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.905] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x31c7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0177.905] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x31c7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x31c7f828, pbKeyObject=0x0) returned 0x0 [0177.905] BCryptExportKey (in: hKey=0x7f4ca0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x31c7f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x31c7f500) returned 0x0 [0177.906] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.906] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x31c7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x31c7f500) returned 0x0 [0177.909] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.911] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.912] WriteFile (in: hFile=0x1a54, lpBuffer=0x31c7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31c7f830, lpOverlapped=0x0 | out: lpBuffer=0x31c7fb34*, lpNumberOfBytesWritten=0x31c7f830*=0x428, lpOverlapped=0x0) returned 1 [0177.912] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.912] ReadFile (in: hFile=0x1a54, lpBuffer=0x4c50000, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x31c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x31c7f61c*=0xb5ac, lpOverlapped=0x0) returned 1 [0178.008] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xffff4a54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.008] BCryptEncrypt (in: hKey=0x7f4ca0, pbInput=0x4c50000, cbInput=0xb5ac, pPaddingInfo=0x0, pbIV=0x31c7f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x31c7f618, dwFlags=0x1 | out: hKey=0x7f4ca0, pbIV=0x31c7f848, pbOutput=0x4c50000, pcbResult=0x31c7f618) returned 0x0 [0178.008] WriteFile (in: hFile=0x1a54, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x31c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x31c7f61c*=0xb5b0, lpOverlapped=0x0) returned 1 [0178.008] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31c7f60c | out: lpNewFilePointer=0x0) returned 1 [0178.008] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.008] WriteFile (in: hFile=0x1a54, lpBuffer=0x31c7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x31c7f83c*, lpNumberOfBytesWritten=0x31c7f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.008] SetFilePointerEx (in: hFile=0x1a54, liDistanceToMove=0xb5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.008] BCryptDestroyKey (in: hKey=0x7f4ca0 | out: hKey=0x7f4ca0) returned 0x0 [0178.008] CloseHandle (hObject=0x1a54) returned 1 [0178.008] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0178.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.play")) returned 1 [0178.013] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2620 os_tid = 0x2768 [0177.414] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.414] ReadFile (in: hFile=0x1a34, lpBuffer=0x31dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x31dbfb34*, lpNumberOfBytesRead=0x31dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.712] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.712] ReadFile (in: hFile=0x1a34, lpBuffer=0x31dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x31dbfb34*, lpNumberOfBytesRead=0x31dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.712] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.715] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x31dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0177.716] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x31dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x31dbf828, pbKeyObject=0x0) returned 0x0 [0177.716] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x31dbf500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x31dbf500) returned 0x0 [0177.716] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.716] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x31dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x31dbf500) returned 0x0 [0177.721] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.724] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.724] WriteFile (in: hFile=0x1a34, lpBuffer=0x31dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31dbf830, lpOverlapped=0x0 | out: lpBuffer=0x31dbfb34*, lpNumberOfBytesWritten=0x31dbf830*=0x428, lpOverlapped=0x0) returned 1 [0177.724] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.724] ReadFile (in: hFile=0x1a34, lpBuffer=0x4d50000, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x31dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x31dbf61c*=0xaa9a, lpOverlapped=0x0) returned 1 [0177.946] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xffff5566, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.946] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4d50000, cbInput=0xaa9a, pPaddingInfo=0x0, pbIV=0x31dbf848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x31dbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x31dbf848, pbOutput=0x4d50000, pcbResult=0x31dbf618) returned 0x0 [0177.946] WriteFile (in: hFile=0x1a34, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x31dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x31dbf61c*=0xaaa0, lpOverlapped=0x0) returned 1 [0177.946] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dbf60c | out: lpNewFilePointer=0x0) returned 1 [0177.946] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.946] WriteFile (in: hFile=0x1a34, lpBuffer=0x31dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x31dbf83c*, lpNumberOfBytesWritten=0x31dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.946] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xaaa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.946] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0177.946] CloseHandle (hObject=0x1a34) returned 1 [0177.947] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.play")) returned 1 [0177.950] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2621 os_tid = 0x276c [0177.416] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.416] ReadFile (in: hFile=0x1a14, lpBuffer=0x31effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31eff85c, lpOverlapped=0x0 | out: lpBuffer=0x31effb34*, lpNumberOfBytesRead=0x31eff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.711] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.711] ReadFile (in: hFile=0x1a14, lpBuffer=0x31effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31eff85c, lpOverlapped=0x0 | out: lpBuffer=0x31effb34*, lpNumberOfBytesRead=0x31eff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.933] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.935] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.935] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x31eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0177.935] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x31eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x31eff828, pbKeyObject=0x0) returned 0x0 [0177.935] BCryptExportKey (in: hKey=0x7f1260, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x31eff500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x31eff500) returned 0x0 [0177.936] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.936] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x31eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x31eff500) returned 0x0 [0177.939] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.941] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.941] WriteFile (in: hFile=0x1a14, lpBuffer=0x31effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31eff830, lpOverlapped=0x0 | out: lpBuffer=0x31effb34*, lpNumberOfBytesWritten=0x31eff830*=0x428, lpOverlapped=0x0) returned 1 [0177.941] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.941] ReadFile (in: hFile=0x1a14, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x31eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x31eff61c*=0x107d4, lpOverlapped=0x0) returned 1 [0178.023] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffef82c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.023] BCryptEncrypt (in: hKey=0x7f1260, pbInput=0x4e50000, cbInput=0x107d4, pPaddingInfo=0x0, pbIV=0x31eff848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x31eff618, dwFlags=0x1 | out: hKey=0x7f1260, pbIV=0x31eff848, pbOutput=0x4e50000, pcbResult=0x31eff618) returned 0x0 [0178.023] WriteFile (in: hFile=0x1a14, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x31eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x31eff61c*=0x107e0, lpOverlapped=0x0) returned 1 [0178.023] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31eff60c | out: lpNewFilePointer=0x0) returned 1 [0178.024] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.024] WriteFile (in: hFile=0x1a14, lpBuffer=0x31eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31eff61c, lpOverlapped=0x0 | out: lpBuffer=0x31eff83c*, lpNumberOfBytesWritten=0x31eff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.024] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x107e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.024] BCryptDestroyKey (in: hKey=0x7f1260 | out: hKey=0x7f1260) returned 0x0 [0178.024] CloseHandle (hObject=0x1a14) returned 1 [0178.024] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0178.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.play")) returned 1 [0178.027] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2622 os_tid = 0x2770 [0177.417] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.417] ReadFile (in: hFile=0x19f4, lpBuffer=0x3203fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3203f85c, lpOverlapped=0x0 | out: lpBuffer=0x3203fb34*, lpNumberOfBytesRead=0x3203f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.710] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.711] ReadFile (in: hFile=0x19f4, lpBuffer=0x3203fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3203f85c, lpOverlapped=0x0 | out: lpBuffer=0x3203fb34*, lpNumberOfBytesRead=0x3203f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.917] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.917] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x3203f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0177.917] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x3203f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x3203f828, pbKeyObject=0x0) returned 0x0 [0177.917] BCryptExportKey (in: hKey=0x7f0fe0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3203f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3203f500) returned 0x0 [0177.917] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.917] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3203f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3203f500) returned 0x0 [0177.920] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.923] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.923] WriteFile (in: hFile=0x19f4, lpBuffer=0x3203fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3203f830, lpOverlapped=0x0 | out: lpBuffer=0x3203fb34*, lpNumberOfBytesWritten=0x3203f830*=0x428, lpOverlapped=0x0) returned 1 [0177.923] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.923] ReadFile (in: hFile=0x19f4, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x3203f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x3203f61c*=0x955d, lpOverlapped=0x0) returned 1 [0178.015] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xffff6aa3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.016] BCryptEncrypt (in: hKey=0x7f0fe0, pbInput=0x4f50000, cbInput=0x955d, pPaddingInfo=0x0, pbIV=0x3203f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x3203f618, dwFlags=0x1 | out: hKey=0x7f0fe0, pbIV=0x3203f848, pbOutput=0x4f50000, pcbResult=0x3203f618) returned 0x0 [0178.016] WriteFile (in: hFile=0x19f4, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x3203f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x3203f61c*=0x9560, lpOverlapped=0x0) returned 1 [0178.016] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3203f60c | out: lpNewFilePointer=0x0) returned 1 [0178.016] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.016] WriteFile (in: hFile=0x19f4, lpBuffer=0x3203f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3203f61c, lpOverlapped=0x0 | out: lpBuffer=0x3203f83c*, lpNumberOfBytesWritten=0x3203f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.016] SetFilePointerEx (in: hFile=0x19f4, liDistanceToMove=0x9560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.016] BCryptDestroyKey (in: hKey=0x7f0fe0 | out: hKey=0x7f0fe0) returned 0x0 [0178.016] CloseHandle (hObject=0x19f4) returned 1 [0178.016] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0178.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.play")) returned 1 [0178.019] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2623 os_tid = 0x2774 [0177.418] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.419] ReadFile (in: hFile=0x19d4, lpBuffer=0x3217fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3217f85c, lpOverlapped=0x0 | out: lpBuffer=0x3217fb34*, lpNumberOfBytesRead=0x3217f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.678] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.678] ReadFile (in: hFile=0x19d4, lpBuffer=0x3217fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3217f85c, lpOverlapped=0x0 | out: lpBuffer=0x3217fb34*, lpNumberOfBytesRead=0x3217f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.678] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.682] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.682] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x3217f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0177.682] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x3217f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x3217f828, pbKeyObject=0x0) returned 0x0 [0177.682] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3217f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3217f500) returned 0x0 [0177.683] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.683] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3217f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3217f500) returned 0x0 [0177.688] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.691] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.691] WriteFile (in: hFile=0x19d4, lpBuffer=0x3217fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3217f830, lpOverlapped=0x0 | out: lpBuffer=0x3217fb34*, lpNumberOfBytesWritten=0x3217f830*=0x428, lpOverlapped=0x0) returned 1 [0177.691] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.691] ReadFile (in: hFile=0x19d4, lpBuffer=0x5050000, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x3217f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x3217f61c*=0x6b01, lpOverlapped=0x0) returned 1 [0177.894] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xffff94ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.894] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x5050000, cbInput=0x6b01, pPaddingInfo=0x0, pbIV=0x3217f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x3217f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x3217f848, pbOutput=0x5050000, pcbResult=0x3217f618) returned 0x0 [0177.894] WriteFile (in: hFile=0x19d4, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x3217f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x3217f61c*=0x6b10, lpOverlapped=0x0) returned 1 [0177.894] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3217f60c | out: lpNewFilePointer=0x0) returned 1 [0177.894] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.894] WriteFile (in: hFile=0x19d4, lpBuffer=0x3217f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3217f61c, lpOverlapped=0x0 | out: lpBuffer=0x3217f83c*, lpNumberOfBytesWritten=0x3217f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.895] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x6b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.895] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0177.895] CloseHandle (hObject=0x19d4) returned 1 [0177.895] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.play")) returned 1 [0177.898] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2624 os_tid = 0x2778 [0177.422] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.422] ReadFile (in: hFile=0x17ec, lpBuffer=0x322bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x322bf85c, lpOverlapped=0x0 | out: lpBuffer=0x322bfb34*, lpNumberOfBytesRead=0x322bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.662] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.663] ReadFile (in: hFile=0x17ec, lpBuffer=0x322bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x322bf85c, lpOverlapped=0x0 | out: lpBuffer=0x322bfb34*, lpNumberOfBytesRead=0x322bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.663] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.665] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.666] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x322bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0177.666] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x322bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x322bf828, pbKeyObject=0x0) returned 0x0 [0177.666] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x322bf500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x322bf500) returned 0x0 [0177.666] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.666] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x322bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x322bf500) returned 0x0 [0177.671] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.674] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.675] WriteFile (in: hFile=0x17ec, lpBuffer=0x322bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x322bf830, lpOverlapped=0x0 | out: lpBuffer=0x322bfb34*, lpNumberOfBytesWritten=0x322bf830*=0x428, lpOverlapped=0x0) returned 1 [0177.675] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.675] ReadFile (in: hFile=0x17ec, lpBuffer=0x5150000, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x322bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x322bf61c*=0xfd22, lpOverlapped=0x0) returned 1 [0177.884] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xffff02de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.884] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x5150000, cbInput=0xfd22, pPaddingInfo=0x0, pbIV=0x322bf848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x322bf618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x322bf848, pbOutput=0x5150000, pcbResult=0x322bf618) returned 0x0 [0177.884] WriteFile (in: hFile=0x17ec, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x322bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x322bf61c*=0xfd30, lpOverlapped=0x0) returned 1 [0177.886] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.886] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.887] WriteFile (in: hFile=0x17ec, lpBuffer=0x322bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x322bf61c, lpOverlapped=0x0 | out: lpBuffer=0x322bf83c*, lpNumberOfBytesWritten=0x322bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.887] SetFilePointerEx (in: hFile=0x17ec, liDistanceToMove=0xfd30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.887] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0177.887] CloseHandle (hObject=0x17ec) returned 1 [0177.887] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.play")) returned 1 [0177.891] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2625 os_tid = 0x277c [0177.423] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.423] ReadFile (in: hFile=0x1810, lpBuffer=0x323ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x323ff85c, lpOverlapped=0x0 | out: lpBuffer=0x323ffb34*, lpNumberOfBytesRead=0x323ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.662] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.662] ReadFile (in: hFile=0x1810, lpBuffer=0x323ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x323ff85c, lpOverlapped=0x0 | out: lpBuffer=0x323ffb34*, lpNumberOfBytesRead=0x323ff85c*=0x428, lpOverlapped=0x0) returned 1 [0177.870] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.876] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.876] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x323ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0177.876] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x323ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x323ff828, pbKeyObject=0x0) returned 0x0 [0177.876] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x323ff500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x323ff500) returned 0x0 [0177.876] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.876] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x323ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x323ff500) returned 0x0 [0177.880] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.882] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.882] WriteFile (in: hFile=0x1810, lpBuffer=0x323ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x323ff830, lpOverlapped=0x0 | out: lpBuffer=0x323ffb34*, lpNumberOfBytesWritten=0x323ff830*=0x428, lpOverlapped=0x0) returned 1 [0177.883] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.883] ReadFile (in: hFile=0x1810, lpBuffer=0x5250000, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x323ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x323ff61c*=0xb544, lpOverlapped=0x0) returned 1 [0178.000] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xffff4abc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.000] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x5250000, cbInput=0xb544, pPaddingInfo=0x0, pbIV=0x323ff848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x323ff618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x323ff848, pbOutput=0x5250000, pcbResult=0x323ff618) returned 0x0 [0178.000] WriteFile (in: hFile=0x1810, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x323ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x323ff61c*=0xb550, lpOverlapped=0x0) returned 1 [0178.001] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323ff60c | out: lpNewFilePointer=0x0) returned 1 [0178.001] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.001] WriteFile (in: hFile=0x1810, lpBuffer=0x323ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x323ff61c, lpOverlapped=0x0 | out: lpBuffer=0x323ff83c*, lpNumberOfBytesWritten=0x323ff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.001] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xb550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.001] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.001] CloseHandle (hObject=0x1810) returned 1 [0178.001] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0178.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.play")) returned 1 [0178.005] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2626 os_tid = 0x2780 [0177.424] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.425] ReadFile (in: hFile=0x1830, lpBuffer=0x3253fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3253f85c, lpOverlapped=0x0 | out: lpBuffer=0x3253fb34*, lpNumberOfBytesRead=0x3253f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.648] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.648] ReadFile (in: hFile=0x1830, lpBuffer=0x3253fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3253f85c, lpOverlapped=0x0 | out: lpBuffer=0x3253fb34*, lpNumberOfBytesRead=0x3253f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.648] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.653] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x3253f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0177.653] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x3253f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x3253f828, pbKeyObject=0x0) returned 0x0 [0177.653] BCryptExportKey (in: hKey=0x7f14f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3253f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3253f500) returned 0x0 [0177.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.653] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3253f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3253f500) returned 0x0 [0177.656] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.659] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.659] WriteFile (in: hFile=0x1830, lpBuffer=0x3253fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3253f830, lpOverlapped=0x0 | out: lpBuffer=0x3253fb34*, lpNumberOfBytesWritten=0x3253f830*=0x428, lpOverlapped=0x0) returned 1 [0177.659] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.659] ReadFile (in: hFile=0x1830, lpBuffer=0x5350000, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x3253f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x3253f61c*=0x212e, lpOverlapped=0x0) returned 1 [0177.854] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xffffded2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.854] BCryptEncrypt (in: hKey=0x7f14f0, pbInput=0x5350000, cbInput=0x212e, pPaddingInfo=0x0, pbIV=0x3253f848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x3253f618, dwFlags=0x1 | out: hKey=0x7f14f0, pbIV=0x3253f848, pbOutput=0x5350000, pcbResult=0x3253f618) returned 0x0 [0177.856] WriteFile (in: hFile=0x1830, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x3253f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x3253f61c*=0x2130, lpOverlapped=0x0) returned 1 [0177.856] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3253f60c | out: lpNewFilePointer=0x0) returned 1 [0177.857] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.857] WriteFile (in: hFile=0x1830, lpBuffer=0x3253f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3253f61c, lpOverlapped=0x0 | out: lpBuffer=0x3253f83c*, lpNumberOfBytesWritten=0x3253f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.857] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x2130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.857] BCryptDestroyKey (in: hKey=0x7f14f0 | out: hKey=0x7f14f0) returned 0x0 [0177.857] CloseHandle (hObject=0x1830) returned 1 [0177.857] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.play")) returned 1 [0177.860] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2627 os_tid = 0x2784 [0177.426] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.426] ReadFile (in: hFile=0x1850, lpBuffer=0x3267fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3267f85c, lpOverlapped=0x0 | out: lpBuffer=0x3267fb34*, lpNumberOfBytesRead=0x3267f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.827] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.827] ReadFile (in: hFile=0x1850, lpBuffer=0x3267fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3267f85c, lpOverlapped=0x0 | out: lpBuffer=0x3267fb34*, lpNumberOfBytesRead=0x3267f85c*=0x428, lpOverlapped=0x0) returned 1 [0177.827] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.830] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.830] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x3267f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0177.830] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x3267f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x3267f828, pbKeyObject=0x0) returned 0x0 [0177.830] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x3267f500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x3267f500) returned 0x0 [0177.830] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.830] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x3267f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x3267f500) returned 0x0 [0177.833] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.836] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.836] WriteFile (in: hFile=0x1850, lpBuffer=0x3267fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3267f830, lpOverlapped=0x0 | out: lpBuffer=0x3267fb34*, lpNumberOfBytesWritten=0x3267f830*=0x428, lpOverlapped=0x0) returned 1 [0177.836] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.836] ReadFile (in: hFile=0x1850, lpBuffer=0x5450000, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x3267f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x3267f61c*=0x1104, lpOverlapped=0x0) returned 1 [0177.836] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xffffeefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.836] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x5450000, cbInput=0x1104, pPaddingInfo=0x0, pbIV=0x3267f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x3267f618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x3267f848, pbOutput=0x5450000, pcbResult=0x3267f618) returned 0x0 [0177.836] WriteFile (in: hFile=0x1850, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x3267f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x3267f61c*=0x1110, lpOverlapped=0x0) returned 1 [0177.837] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3267f60c | out: lpNewFilePointer=0x0) returned 1 [0177.837] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.837] WriteFile (in: hFile=0x1850, lpBuffer=0x3267f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3267f61c, lpOverlapped=0x0 | out: lpBuffer=0x3267f83c*, lpNumberOfBytesWritten=0x3267f61c*=0x8, lpOverlapped=0x0) returned 1 [0177.837] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x1110, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.840] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0177.840] CloseHandle (hObject=0x1850) returned 1 [0177.840] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.842] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.play")) returned 1 [0177.843] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2628 os_tid = 0x2788 [0177.427] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.427] ReadFile (in: hFile=0x1870, lpBuffer=0x327bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x327bf85c, lpOverlapped=0x0 | out: lpBuffer=0x327bfb34*, lpNumberOfBytesRead=0x327bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.815] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.815] ReadFile (in: hFile=0x1870, lpBuffer=0x327bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x327bf85c, lpOverlapped=0x0 | out: lpBuffer=0x327bfb34*, lpNumberOfBytesRead=0x327bf85c*=0x428, lpOverlapped=0x0) returned 1 [0177.815] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x145f0000 [0177.817] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x145f0000) returned 0x0 [0177.817] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x327bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0177.817] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x327bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x145f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x327bf828, pbKeyObject=0x0) returned 0x0 [0177.817] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x145f0000, cbOutput=0x230, pcbResult=0x327bf500, dwFlags=0x0 | out: pbOutput=0x145f0000, pcbResult=0x327bf500) returned 0x0 [0177.817] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x145f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x145f0230) returned 0x0 [0177.818] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x145f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x145f0000, cbOutput=0x400, pcbResult=0x327bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x145f0000, pcbResult=0x327bf500) returned 0x0 [0177.821] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.826] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.826] WriteFile (in: hFile=0x1870, lpBuffer=0x327bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x327bf830, lpOverlapped=0x0 | out: lpBuffer=0x327bfb34*, lpNumberOfBytesWritten=0x327bf830*=0x428, lpOverlapped=0x0) returned 1 [0177.826] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.827] ReadFile (in: hFile=0x1870, lpBuffer=0x5550000, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x327bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x327bf61c*=0x3c68, lpOverlapped=0x0) returned 1 [0177.968] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xffffc398, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.968] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5550000, cbInput=0x3c68, pPaddingInfo=0x0, pbIV=0x327bf848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x327bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x327bf848, pbOutput=0x5550000, pcbResult=0x327bf618) returned 0x0 [0177.968] WriteFile (in: hFile=0x1870, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x327bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x327bf61c*=0x3c70, lpOverlapped=0x0) returned 1 [0177.968] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327bf60c | out: lpNewFilePointer=0x0) returned 1 [0177.968] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.968] WriteFile (in: hFile=0x1870, lpBuffer=0x327bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x327bf61c, lpOverlapped=0x0 | out: lpBuffer=0x327bf83c*, lpNumberOfBytesWritten=0x327bf61c*=0x8, lpOverlapped=0x0) returned 1 [0177.969] SetFilePointerEx (in: hFile=0x1870, liDistanceToMove=0x3c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0177.969] CloseHandle (hObject=0x1870) returned 1 [0177.969] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x145f0000 [0177.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.play")) returned 1 [0177.996] VirtualFree (lpAddress=0x145f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2629 os_tid = 0x271c [0177.428] GetLastError () returned 0x57 [0177.428] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6faba0 [0177.429] SetLastError (dwErrCode=0x57) [0177.429] IcmpCreateFile () returned 0x7f54f0 [0177.429] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7a70 [0177.429] IcmpSendEcho2 (IcmpHandle=0x7f54f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9d00a8c0, RequestData=0x30abff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7a70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2630 os_tid = 0x278c [0177.430] GetLastError () returned 0x57 [0177.430] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6faf28 [0177.433] SetLastError (dwErrCode=0x57) [0177.433] IcmpCreateFile () returned 0x7f5528 [0177.433] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7ac0 [0177.433] IcmpSendEcho2 (IcmpHandle=0x7f5528, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9e00a8c0, RequestData=0x3291ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7ac0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2631 os_tid = 0x2790 [0177.434] GetLastError () returned 0x57 [0177.434] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fb2b0 [0177.435] SetLastError (dwErrCode=0x57) [0177.435] IcmpCreateFile () returned 0x7f5560 [0177.435] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7b10 [0177.435] IcmpSendEcho2 (IcmpHandle=0x7f5560, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9f00a8c0, RequestData=0x32cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7b10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2632 os_tid = 0x2794 [0177.436] GetLastError () returned 0x57 [0177.436] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fb638 [0177.436] SetLastError (dwErrCode=0x57) [0177.436] IcmpCreateFile () returned 0x7f5598 [0177.436] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7b60 [0177.436] IcmpSendEcho2 (IcmpHandle=0x7f5598, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa000a8c0, RequestData=0x32dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7b60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2633 os_tid = 0x2798 [0177.437] GetLastError () returned 0x57 [0177.438] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f48c0 [0177.438] SetLastError (dwErrCode=0x57) [0177.438] IcmpCreateFile () returned 0x7f55d0 [0177.438] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7bb0 [0177.438] IcmpSendEcho2 (IcmpHandle=0x7f55d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa100a8c0, RequestData=0x32efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7bb0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2634 os_tid = 0x279c [0177.439] GetLastError () returned 0x57 [0177.439] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f4c48 [0177.439] SetLastError (dwErrCode=0x57) [0177.439] IcmpCreateFile () returned 0x7f5608 [0177.439] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7200 [0177.439] IcmpSendEcho2 (IcmpHandle=0x7f5608, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa200a8c0, RequestData=0x3303ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7200, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2635 os_tid = 0x27a0 [0177.440] GetLastError () returned 0x57 [0177.441] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f4fd0 [0177.441] SetLastError (dwErrCode=0x57) [0177.441] IcmpCreateFile () returned 0x7f5640 [0177.441] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7250 [0177.441] IcmpSendEcho2 (IcmpHandle=0x7f5640, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa300a8c0, RequestData=0x3317ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7250, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2636 os_tid = 0x27a4 [0177.444] GetLastError () returned 0x57 [0177.444] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f5358 [0177.444] SetLastError (dwErrCode=0x57) [0177.444] IcmpCreateFile () returned 0x7f5678 [0177.444] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f72a0 [0177.444] IcmpSendEcho2 (IcmpHandle=0x7f5678, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa400a8c0, RequestData=0x332bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f72a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2637 os_tid = 0x27a8 [0177.446] GetLastError () returned 0x57 [0177.446] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f56e0 [0177.446] SetLastError (dwErrCode=0x57) [0177.446] IcmpCreateFile () returned 0x7f56b0 [0177.446] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f72f0 [0177.446] IcmpSendEcho2 (IcmpHandle=0x7f56b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa500a8c0, RequestData=0x333fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f72f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2638 os_tid = 0x27ac [0177.447] GetLastError () returned 0x57 [0177.447] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f5a68 [0177.448] SetLastError (dwErrCode=0x57) [0177.448] IcmpCreateFile () returned 0x7f4fe8 [0177.448] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7340 [0177.448] IcmpSendEcho2 (IcmpHandle=0x7f4fe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa600a8c0, RequestData=0x3353ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7340, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2639 os_tid = 0x27b0 [0177.449] GetLastError () returned 0x57 [0177.449] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f5df0 [0177.449] SetLastError (dwErrCode=0x57) [0177.449] IcmpCreateFile () returned 0x7f5020 [0177.449] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7390 [0177.449] IcmpSendEcho2 (IcmpHandle=0x7f5020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa700a8c0, RequestData=0x3367ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7390, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2640 os_tid = 0x27b4 [0177.450] GetLastError () returned 0x57 [0177.451] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f6178 [0177.451] SetLastError (dwErrCode=0x57) [0177.451] IcmpCreateFile () returned 0x7f5058 [0177.451] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f73e0 [0177.451] IcmpSendEcho2 (IcmpHandle=0x7f5058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa800a8c0, RequestData=0x337bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f73e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2641 os_tid = 0x27b8 [0177.452] GetLastError () returned 0x57 [0177.452] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f6500 [0177.452] SetLastError (dwErrCode=0x57) [0177.452] IcmpCreateFile () returned 0x7f5090 [0177.452] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7430 [0177.452] IcmpSendEcho2 (IcmpHandle=0x7f5090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa900a8c0, RequestData=0x338fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7430, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2642 os_tid = 0x27bc [0177.453] GetLastError () returned 0x57 [0177.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f6888 [0177.454] SetLastError (dwErrCode=0x57) [0177.454] IcmpCreateFile () returned 0x7f50c8 [0177.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7480 [0177.454] IcmpSendEcho2 (IcmpHandle=0x7f50c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaa00a8c0, RequestData=0x33a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7480, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2643 os_tid = 0x27c0 [0177.455] GetLastError () returned 0x57 [0177.455] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f6c10 [0177.455] SetLastError (dwErrCode=0x57) [0177.455] IcmpCreateFile () returned 0x7f5100 [0177.455] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f74d0 [0177.455] IcmpSendEcho2 (IcmpHandle=0x7f5100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xab00a8c0, RequestData=0x33b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f74d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2644 os_tid = 0x27c4 [0177.456] GetLastError () returned 0x57 [0177.456] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f6f98 [0177.457] SetLastError (dwErrCode=0x57) [0177.457] IcmpCreateFile () returned 0x7f5138 [0177.457] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7520 [0177.457] IcmpSendEcho2 (IcmpHandle=0x7f5138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xac00a8c0, RequestData=0x33cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7520, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2645 os_tid = 0x27c8 [0177.458] GetLastError () returned 0x57 [0177.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f7320 [0177.458] SetLastError (dwErrCode=0x57) [0177.458] IcmpCreateFile () returned 0x7f5170 [0177.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7570 [0177.458] IcmpSendEcho2 (IcmpHandle=0x7f5170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xad00a8c0, RequestData=0x33dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7570, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2646 os_tid = 0x27cc [0178.194] GetLastError () returned 0x57 [0178.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f76a8 [0178.196] SetLastError (dwErrCode=0x57) [0178.196] IcmpCreateFile () returned 0x7f51a8 [0178.196] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f75c0 [0178.196] IcmpSendEcho2 (IcmpHandle=0x7f51a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xae00a8c0, RequestData=0x33f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f75c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2647 os_tid = 0x27d0 [0178.197] GetLastError () returned 0x57 [0178.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f7a30 [0178.198] SetLastError (dwErrCode=0x57) [0178.198] IcmpCreateFile () returned 0x7f51e0 [0178.198] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7610 [0178.198] IcmpSendEcho2 (IcmpHandle=0x7f51e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaf00a8c0, RequestData=0x3407ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7610, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2648 os_tid = 0x27d4 [0178.199] GetLastError () returned 0x57 [0178.199] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f7db8 [0178.199] SetLastError (dwErrCode=0x57) [0178.199] IcmpCreateFile () returned 0x7f5218 [0178.199] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7660 [0178.199] IcmpSendEcho2 (IcmpHandle=0x7f5218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb000a8c0, RequestData=0x341bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7660, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2649 os_tid = 0x27d8 [0178.201] GetLastError () returned 0x57 [0178.201] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f8140 [0178.201] SetLastError (dwErrCode=0x57) [0178.201] IcmpCreateFile () returned 0x7f5250 [0178.201] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f76b0 [0178.201] IcmpSendEcho2 (IcmpHandle=0x7f5250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb100a8c0, RequestData=0x342fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f76b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2650 os_tid = 0x27dc [0178.202] GetLastError () returned 0x57 [0178.202] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f84c8 [0178.202] SetLastError (dwErrCode=0x57) [0178.203] IcmpCreateFile () returned 0x75d118 [0178.203] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7700 [0178.203] IcmpSendEcho2 (IcmpHandle=0x75d118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb200a8c0, RequestData=0x3443ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7700, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2651 os_tid = 0x27e0 [0178.204] GetLastError () returned 0x57 [0178.204] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f8850 [0178.204] SetLastError (dwErrCode=0x57) [0178.204] IcmpCreateFile () returned 0x75d188 [0178.204] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7750 [0178.204] IcmpSendEcho2 (IcmpHandle=0x75d188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb300a8c0, RequestData=0x3457ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7750, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2652 os_tid = 0x27e4 [0178.207] GetLastError () returned 0x57 [0178.207] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f8bd8 [0178.207] SetLastError (dwErrCode=0x57) [0178.208] IcmpCreateFile () returned 0x75d1c0 [0178.208] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f77a0 [0178.208] IcmpSendEcho2 (IcmpHandle=0x75d1c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb500a8c0, RequestData=0x346bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f77a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2653 os_tid = 0x27e8 [0178.210] GetLastError () returned 0x57 [0178.210] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f8f60 [0178.210] SetLastError (dwErrCode=0x57) [0178.210] IcmpCreateFile () returned 0x75d1f8 [0178.210] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f77f0 [0178.210] IcmpSendEcho2 (IcmpHandle=0x75d1f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb600a8c0, RequestData=0x347fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f77f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2654 os_tid = 0x27ec [0178.213] GetLastError () returned 0x57 [0178.213] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f92e8 [0178.213] SetLastError (dwErrCode=0x57) [0178.213] IcmpCreateFile () returned 0x75d230 [0178.214] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7840 [0178.214] IcmpSendEcho2 (IcmpHandle=0x75d230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb700a8c0, RequestData=0x3493ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7840, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2655 os_tid = 0x27f0 [0178.215] GetLastError () returned 0x57 [0178.216] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f9670 [0178.216] SetLastError (dwErrCode=0x57) [0178.216] IcmpCreateFile () returned 0x804b30 [0178.216] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7890 [0178.216] IcmpSendEcho2 (IcmpHandle=0x804b30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb800a8c0, RequestData=0x34a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7890, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2656 os_tid = 0x27f8 [0178.321] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.321] ReadFile (in: hFile=0x1a14, lpBuffer=0x30e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesRead=0x30e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.323] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.323] ReadFile (in: hFile=0x1a14, lpBuffer=0x30e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesRead=0x30e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.323] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0178.604] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0178.604] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x30e7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0178.604] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x30e7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x30e7f828, pbKeyObject=0x0) returned 0x0 [0178.604] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x30e7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x30e7f500) returned 0x0 [0178.604] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0178.604] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x30e7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x30e7f500) returned 0x0 [0178.607] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.609] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.610] WriteFile (in: hFile=0x1a14, lpBuffer=0x30e7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30e7f830, lpOverlapped=0x0 | out: lpBuffer=0x30e7fb34*, lpNumberOfBytesWritten=0x30e7f830*=0x428, lpOverlapped=0x0) returned 1 [0178.610] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.610] ReadFile (in: hFile=0x1a14, lpBuffer=0x5650000, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x30e7f61c*=0x4844, lpOverlapped=0x0) returned 1 [0178.618] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xffffb7bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.618] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5650000, cbInput=0x4844, pPaddingInfo=0x0, pbIV=0x30e7f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x30e7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x30e7f848, pbOutput=0x5650000, pcbResult=0x30e7f618) returned 0x0 [0178.618] WriteFile (in: hFile=0x1a14, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x30e7f61c*=0x4850, lpOverlapped=0x0) returned 1 [0178.618] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30e7f60c | out: lpNewFilePointer=0x0) returned 1 [0178.618] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.618] WriteFile (in: hFile=0x1a14, lpBuffer=0x30e7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x30e7f83c*, lpNumberOfBytesWritten=0x30e7f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.628] SetFilePointerEx (in: hFile=0x1a14, liDistanceToMove=0x4850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.628] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.628] CloseHandle (hObject=0x1a14) returned 1 [0178.628] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0178.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.play")) returned 1 [0178.632] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2657 os_tid = 0x27fc [0178.323] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.323] ReadFile (in: hFile=0x1c30, lpBuffer=0x2dfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfff85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfffb34*, lpNumberOfBytesRead=0x2dfff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.325] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.325] ReadFile (in: hFile=0x1c30, lpBuffer=0x2dfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfff85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfffb34*, lpNumberOfBytesRead=0x2dfff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.325] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0178.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0178.611] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2dfff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0178.611] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2dfff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2dfff828, pbKeyObject=0x0) returned 0x0 [0178.611] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2dfff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2dfff500) returned 0x0 [0178.611] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0178.611] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2dfff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2dfff500) returned 0x0 [0178.614] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.617] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.617] WriteFile (in: hFile=0x1c30, lpBuffer=0x2dfffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dfff830, lpOverlapped=0x0 | out: lpBuffer=0x2dfffb34*, lpNumberOfBytesWritten=0x2dfff830*=0x428, lpOverlapped=0x0) returned 1 [0178.617] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.617] ReadFile (in: hFile=0x1c30, lpBuffer=0x3650000, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x2dfff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2dfff61c*=0x3928, lpOverlapped=0x0) returned 1 [0178.642] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xffffc6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.642] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x3650000, cbInput=0x3928, pPaddingInfo=0x0, pbIV=0x2dfff848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2dfff618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x2dfff848, pbOutput=0x3650000, pcbResult=0x2dfff618) returned 0x0 [0178.642] WriteFile (in: hFile=0x1c30, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x2dfff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2dfff61c*=0x3930, lpOverlapped=0x0) returned 1 [0178.643] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dfff60c | out: lpNewFilePointer=0x0) returned 1 [0178.643] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.643] WriteFile (in: hFile=0x1c30, lpBuffer=0x2dfff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dfff61c, lpOverlapped=0x0 | out: lpBuffer=0x2dfff83c*, lpNumberOfBytesWritten=0x2dfff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.643] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x3930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.643] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.643] CloseHandle (hObject=0x1c30) returned 1 [0178.643] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0178.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.play")) returned 1 [0178.646] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2658 os_tid = 0xdd0 [0178.325] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.327] ReadFile (in: hFile=0x1810, lpBuffer=0x310ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x310ff85c, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesRead=0x310ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.328] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.329] ReadFile (in: hFile=0x1810, lpBuffer=0x310ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x310ff85c, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesRead=0x310ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.329] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb110000 [0178.635] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb110000) returned 0x0 [0178.635] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x310ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0178.635] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x310ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb110000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x310ff828, pbKeyObject=0x0) returned 0x0 [0178.635] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb110000, cbOutput=0x230, pcbResult=0x310ff500, dwFlags=0x0 | out: pbOutput=0xb110000, pcbResult=0x310ff500) returned 0x0 [0178.635] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb110230) returned 0x0 [0178.635] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb110000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb110000, cbOutput=0x400, pcbResult=0x310ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb110000, pcbResult=0x310ff500) returned 0x0 [0178.639] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.641] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.642] WriteFile (in: hFile=0x1810, lpBuffer=0x310ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x310ff830, lpOverlapped=0x0 | out: lpBuffer=0x310ffb34*, lpNumberOfBytesWritten=0x310ff830*=0x428, lpOverlapped=0x0) returned 1 [0178.642] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.642] ReadFile (in: hFile=0x1810, lpBuffer=0x4150000, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x310ff61c*=0x1a60, lpOverlapped=0x0) returned 1 [0178.657] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xffffe5a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.657] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4150000, cbInput=0x1a60, pPaddingInfo=0x0, pbIV=0x310ff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x310ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x310ff848, pbOutput=0x4150000, pcbResult=0x310ff618) returned 0x0 [0178.657] WriteFile (in: hFile=0x1810, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x310ff61c*=0x1a70, lpOverlapped=0x0) returned 1 [0178.657] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310ff60c | out: lpNewFilePointer=0x0) returned 1 [0178.657] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.657] WriteFile (in: hFile=0x1810, lpBuffer=0x310ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x310ff61c, lpOverlapped=0x0 | out: lpBuffer=0x310ff83c*, lpNumberOfBytesWritten=0x310ff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.657] SetFilePointerEx (in: hFile=0x1810, liDistanceToMove=0x1a70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.657] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.657] CloseHandle (hObject=0x1810) returned 1 [0178.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0178.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.play")) returned 1 [0178.660] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2659 os_tid = 0x1114 [0178.329] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.329] ReadFile (in: hFile=0x1a90, lpBuffer=0x311ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x311ff85c, lpOverlapped=0x0 | out: lpBuffer=0x311ffb34*, lpNumberOfBytesRead=0x311ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.330] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.330] ReadFile (in: hFile=0x1a90, lpBuffer=0x311ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x311ff85c, lpOverlapped=0x0 | out: lpBuffer=0x311ffb34*, lpNumberOfBytesRead=0x311ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.330] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4a0000 [0178.649] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4a0000) returned 0x0 [0178.649] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x311ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0178.649] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x311ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x311ff828, pbKeyObject=0x0) returned 0x0 [0178.650] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4a0000, cbOutput=0x230, pcbResult=0x311ff500, dwFlags=0x0 | out: pbOutput=0xb4a0000, pcbResult=0x311ff500) returned 0x0 [0178.650] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4a0230) returned 0x0 [0178.650] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4a0000, cbOutput=0x400, pcbResult=0x311ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4a0000, pcbResult=0x311ff500) returned 0x0 [0178.653] VirtualFree (lpAddress=0xb4a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.656] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.656] WriteFile (in: hFile=0x1a90, lpBuffer=0x311ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x311ff830, lpOverlapped=0x0 | out: lpBuffer=0x311ffb34*, lpNumberOfBytesWritten=0x311ff830*=0x428, lpOverlapped=0x0) returned 1 [0178.656] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.656] ReadFile (in: hFile=0x1a90, lpBuffer=0x4350000, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x311ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x311ff61c*=0x2988, lpOverlapped=0x0) returned 1 [0178.671] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xffffd678, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.671] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x4350000, cbInput=0x2988, pPaddingInfo=0x0, pbIV=0x311ff848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x311ff618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x311ff848, pbOutput=0x4350000, pcbResult=0x311ff618) returned 0x0 [0178.671] WriteFile (in: hFile=0x1a90, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x311ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x311ff61c*=0x2990, lpOverlapped=0x0) returned 1 [0178.671] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311ff60c | out: lpNewFilePointer=0x0) returned 1 [0178.671] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.671] WriteFile (in: hFile=0x1a90, lpBuffer=0x311ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x311ff61c, lpOverlapped=0x0 | out: lpBuffer=0x311ff83c*, lpNumberOfBytesWritten=0x311ff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.672] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x2990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.672] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.672] CloseHandle (hObject=0x1a90) returned 1 [0178.672] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0178.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.play")) returned 1 [0178.676] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2660 os_tid = 0xdd4 [0178.331] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.331] ReadFile (in: hFile=0x1a34, lpBuffer=0x312ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x312ff85c, lpOverlapped=0x0 | out: lpBuffer=0x312ffb34*, lpNumberOfBytesRead=0x312ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.332] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.332] ReadFile (in: hFile=0x1a34, lpBuffer=0x312ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x312ff85c, lpOverlapped=0x0 | out: lpBuffer=0x312ffb34*, lpNumberOfBytesRead=0x312ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.332] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4b0000 [0178.664] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4b0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4b0000) returned 0x0 [0178.664] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x312ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0178.664] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x312ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4b0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x312ff828, pbKeyObject=0x0) returned 0x0 [0178.664] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4b0000, cbOutput=0x230, pcbResult=0x312ff500, dwFlags=0x0 | out: pbOutput=0xb4b0000, pcbResult=0x312ff500) returned 0x0 [0178.664] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4b0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4b0230) returned 0x0 [0178.664] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4b0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4b0000, cbOutput=0x400, pcbResult=0x312ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4b0000, pcbResult=0x312ff500) returned 0x0 [0178.668] VirtualFree (lpAddress=0xb4b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.670] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.670] WriteFile (in: hFile=0x1a34, lpBuffer=0x312ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x312ff830, lpOverlapped=0x0 | out: lpBuffer=0x312ffb34*, lpNumberOfBytesWritten=0x312ff830*=0x428, lpOverlapped=0x0) returned 1 [0178.670] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.671] ReadFile (in: hFile=0x1a34, lpBuffer=0x4450000, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x312ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x312ff61c*=0x3394, lpOverlapped=0x0) returned 1 [0178.686] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xffffcc6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.686] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4450000, cbInput=0x3394, pPaddingInfo=0x0, pbIV=0x312ff848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x312ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x312ff848, pbOutput=0x4450000, pcbResult=0x312ff618) returned 0x0 [0178.686] WriteFile (in: hFile=0x1a34, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x312ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x312ff61c*=0x33a0, lpOverlapped=0x0) returned 1 [0178.686] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312ff60c | out: lpNewFilePointer=0x0) returned 1 [0178.686] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.686] WriteFile (in: hFile=0x1a34, lpBuffer=0x312ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x312ff61c, lpOverlapped=0x0 | out: lpBuffer=0x312ff83c*, lpNumberOfBytesWritten=0x312ff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.687] SetFilePointerEx (in: hFile=0x1a34, liDistanceToMove=0x33a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.687] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.687] CloseHandle (hObject=0x1a34) returned 1 [0178.687] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0178.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.play")) returned 1 [0178.690] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2661 os_tid = 0xe40 [0178.332] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.333] ReadFile (in: hFile=0x19d4, lpBuffer=0x3143fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3143f85c, lpOverlapped=0x0 | out: lpBuffer=0x3143fb34*, lpNumberOfBytesRead=0x3143f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.334] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.334] ReadFile (in: hFile=0x19d4, lpBuffer=0x3143fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3143f85c, lpOverlapped=0x0 | out: lpBuffer=0x3143fb34*, lpNumberOfBytesRead=0x3143f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.334] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4c0000 [0178.678] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4c0000) returned 0x0 [0178.679] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x3143f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0178.679] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x3143f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x3143f828, pbKeyObject=0x0) returned 0x0 [0178.679] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4c0000, cbOutput=0x230, pcbResult=0x3143f500, dwFlags=0x0 | out: pbOutput=0xb4c0000, pcbResult=0x3143f500) returned 0x0 [0178.679] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4c0230) returned 0x0 [0178.679] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4c0000, cbOutput=0x400, pcbResult=0x3143f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4c0000, pcbResult=0x3143f500) returned 0x0 [0178.683] VirtualFree (lpAddress=0xb4c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.685] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.685] WriteFile (in: hFile=0x19d4, lpBuffer=0x3143fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3143f830, lpOverlapped=0x0 | out: lpBuffer=0x3143fb34*, lpNumberOfBytesWritten=0x3143f830*=0x428, lpOverlapped=0x0) returned 1 [0178.685] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.685] ReadFile (in: hFile=0x19d4, lpBuffer=0x4550000, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x3143f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x3143f61c*=0x3418, lpOverlapped=0x0) returned 1 [0178.700] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xffffcbe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.701] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x4550000, cbInput=0x3418, pPaddingInfo=0x0, pbIV=0x3143f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x3143f618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x3143f848, pbOutput=0x4550000, pcbResult=0x3143f618) returned 0x0 [0178.701] WriteFile (in: hFile=0x19d4, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x3143f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x3143f61c*=0x3420, lpOverlapped=0x0) returned 1 [0178.701] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3143f60c | out: lpNewFilePointer=0x0) returned 1 [0178.701] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.701] WriteFile (in: hFile=0x19d4, lpBuffer=0x3143f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3143f61c, lpOverlapped=0x0 | out: lpBuffer=0x3143f83c*, lpNumberOfBytesWritten=0x3143f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.701] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x3420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.701] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.701] CloseHandle (hObject=0x19d4) returned 1 [0178.701] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0178.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.play")) returned 1 [0178.705] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2662 os_tid = 0xda8 [0178.334] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.335] ReadFile (in: hFile=0x1830, lpBuffer=0x3157fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3157f85c, lpOverlapped=0x0 | out: lpBuffer=0x3157fb34*, lpNumberOfBytesRead=0x3157f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.336] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.336] ReadFile (in: hFile=0x1830, lpBuffer=0x3157fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3157f85c, lpOverlapped=0x0 | out: lpBuffer=0x3157fb34*, lpNumberOfBytesRead=0x3157f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.336] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf910000 [0178.693] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf910000) returned 0x0 [0178.693] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x3157f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0178.693] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x3157f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x3157f828, pbKeyObject=0x0) returned 0x0 [0178.693] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf910000, cbOutput=0x230, pcbResult=0x3157f500, dwFlags=0x0 | out: pbOutput=0xf910000, pcbResult=0x3157f500) returned 0x0 [0178.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf910230) returned 0x0 [0178.694] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf910000, cbOutput=0x400, pcbResult=0x3157f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf910000, pcbResult=0x3157f500) returned 0x0 [0178.697] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.700] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.700] WriteFile (in: hFile=0x1830, lpBuffer=0x3157fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3157f830, lpOverlapped=0x0 | out: lpBuffer=0x3157fb34*, lpNumberOfBytesWritten=0x3157f830*=0x428, lpOverlapped=0x0) returned 1 [0178.700] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.700] ReadFile (in: hFile=0x1830, lpBuffer=0x4650000, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x3157f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x3157f61c*=0x2a00, lpOverlapped=0x0) returned 1 [0178.707] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xffffd600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.707] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4650000, cbInput=0x2a00, pPaddingInfo=0x0, pbIV=0x3157f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x3157f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3157f848, pbOutput=0x4650000, pcbResult=0x3157f618) returned 0x0 [0178.707] WriteFile (in: hFile=0x1830, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x3157f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x3157f61c*=0x2a10, lpOverlapped=0x0) returned 1 [0178.708] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3157f60c | out: lpNewFilePointer=0x0) returned 1 [0178.708] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.708] WriteFile (in: hFile=0x1830, lpBuffer=0x3157f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3157f61c, lpOverlapped=0x0 | out: lpBuffer=0x3157f83c*, lpNumberOfBytesWritten=0x3157f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.708] SetFilePointerEx (in: hFile=0x1830, liDistanceToMove=0x2a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.708] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.708] CloseHandle (hObject=0x1830) returned 1 [0178.708] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0178.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.play")) returned 1 [0178.711] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2663 os_tid = 0xd80 [0178.336] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.336] ReadFile (in: hFile=0x1850, lpBuffer=0x316bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x316bf85c, lpOverlapped=0x0 | out: lpBuffer=0x316bfb34*, lpNumberOfBytesRead=0x316bf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.338] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.338] ReadFile (in: hFile=0x1850, lpBuffer=0x316bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x316bf85c, lpOverlapped=0x0 | out: lpBuffer=0x316bfb34*, lpNumberOfBytesRead=0x316bf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x146b0000 [0178.364] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x146b0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x146b0000) returned 0x0 [0178.364] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x316bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0178.364] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x316bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x146b0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x316bf828, pbKeyObject=0x0) returned 0x0 [0178.364] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x146b0000, cbOutput=0x230, pcbResult=0x316bf500, dwFlags=0x0 | out: pbOutput=0x146b0000, pcbResult=0x316bf500) returned 0x0 [0178.364] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x146b0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x146b0230) returned 0x0 [0178.365] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x146b0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x146b0000, cbOutput=0x400, pcbResult=0x316bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x146b0000, pcbResult=0x316bf500) returned 0x0 [0178.469] VirtualFree (lpAddress=0x146b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.473] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.473] WriteFile (in: hFile=0x1850, lpBuffer=0x316bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x316bf830, lpOverlapped=0x0 | out: lpBuffer=0x316bfb34*, lpNumberOfBytesWritten=0x316bf830*=0x428, lpOverlapped=0x0) returned 1 [0178.473] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.473] ReadFile (in: hFile=0x1850, lpBuffer=0x4750000, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x316bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x316bf61c*=0x610c, lpOverlapped=0x0) returned 1 [0178.496] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xffff9ef4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.497] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4750000, cbInput=0x610c, pPaddingInfo=0x0, pbIV=0x316bf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x316bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x316bf848, pbOutput=0x4750000, pcbResult=0x316bf618) returned 0x0 [0178.497] WriteFile (in: hFile=0x1850, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x316bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x316bf61c*=0x6110, lpOverlapped=0x0) returned 1 [0178.497] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316bf60c | out: lpNewFilePointer=0x0) returned 1 [0178.497] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.497] WriteFile (in: hFile=0x1850, lpBuffer=0x316bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x316bf61c, lpOverlapped=0x0 | out: lpBuffer=0x316bf83c*, lpNumberOfBytesWritten=0x316bf61c*=0x8, lpOverlapped=0x0) returned 1 [0178.497] SetFilePointerEx (in: hFile=0x1850, liDistanceToMove=0x6110, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.497] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.497] CloseHandle (hObject=0x1850) returned 1 [0178.497] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.play")) returned 1 [0178.501] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2664 os_tid = 0xd78 [0178.338] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.338] ReadFile (in: hFile=0x16b4, lpBuffer=0x317ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x317ff85c, lpOverlapped=0x0 | out: lpBuffer=0x317ffb34*, lpNumberOfBytesRead=0x317ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.340] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.340] ReadFile (in: hFile=0x16b4, lpBuffer=0x317ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x317ff85c, lpOverlapped=0x0 | out: lpBuffer=0x317ffb34*, lpNumberOfBytesRead=0x317ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.340] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x146c0000 [0178.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x146c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x146c0000) returned 0x0 [0178.474] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x317ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0178.474] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x317ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x146c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x317ff828, pbKeyObject=0x0) returned 0x0 [0178.474] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x146c0000, cbOutput=0x230, pcbResult=0x317ff500, dwFlags=0x0 | out: pbOutput=0x146c0000, pcbResult=0x317ff500) returned 0x0 [0178.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x146c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x146c0230) returned 0x0 [0178.474] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x146c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x146c0000, cbOutput=0x400, pcbResult=0x317ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x146c0000, pcbResult=0x317ff500) returned 0x0 [0178.482] VirtualFree (lpAddress=0x146c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.486] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.486] WriteFile (in: hFile=0x16b4, lpBuffer=0x317ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x317ff830, lpOverlapped=0x0 | out: lpBuffer=0x317ffb34*, lpNumberOfBytesWritten=0x317ff830*=0x428, lpOverlapped=0x0) returned 1 [0178.486] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.486] ReadFile (in: hFile=0x16b4, lpBuffer=0x4850000, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x317ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x317ff61c*=0x3734, lpOverlapped=0x0) returned 1 [0178.504] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xffffc8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.504] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x4850000, cbInput=0x3734, pPaddingInfo=0x0, pbIV=0x317ff848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x317ff618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x317ff848, pbOutput=0x4850000, pcbResult=0x317ff618) returned 0x0 [0178.505] WriteFile (in: hFile=0x16b4, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x317ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x317ff61c*=0x3740, lpOverlapped=0x0) returned 1 [0178.505] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317ff60c | out: lpNewFilePointer=0x0) returned 1 [0178.505] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.505] WriteFile (in: hFile=0x16b4, lpBuffer=0x317ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x317ff61c, lpOverlapped=0x0 | out: lpBuffer=0x317ff83c*, lpNumberOfBytesWritten=0x317ff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.505] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x3740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.505] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.505] CloseHandle (hObject=0x16b4) returned 1 [0178.505] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.play")) returned 1 [0178.508] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2665 os_tid = 0x2804 [0178.341] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.341] ReadFile (in: hFile=0x1af0, lpBuffer=0x3193fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3193f85c, lpOverlapped=0x0 | out: lpBuffer=0x3193fb34*, lpNumberOfBytesRead=0x3193f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.342] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.342] ReadFile (in: hFile=0x1af0, lpBuffer=0x3193fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3193f85c, lpOverlapped=0x0 | out: lpBuffer=0x3193fb34*, lpNumberOfBytesRead=0x3193f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.342] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x30c20000 [0178.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x30c20000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x30c20000) returned 0x0 [0178.487] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x3193f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0178.487] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x3193f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x30c20000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x3193f828, pbKeyObject=0x0) returned 0x0 [0178.487] BCryptExportKey (in: hKey=0x7f4ca0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x30c20000, cbOutput=0x230, pcbResult=0x3193f500, dwFlags=0x0 | out: pbOutput=0x30c20000, pcbResult=0x3193f500) returned 0x0 [0178.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x30c20230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x30c20230) returned 0x0 [0178.487] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x30c20000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x30c20000, cbOutput=0x400, pcbResult=0x3193f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x30c20000, pcbResult=0x3193f500) returned 0x0 [0178.490] VirtualFree (lpAddress=0x30c20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.495] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.496] WriteFile (in: hFile=0x1af0, lpBuffer=0x3193fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3193f830, lpOverlapped=0x0 | out: lpBuffer=0x3193fb34*, lpNumberOfBytesWritten=0x3193f830*=0x428, lpOverlapped=0x0) returned 1 [0178.496] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.496] ReadFile (in: hFile=0x1af0, lpBuffer=0x4950000, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x3193f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x3193f61c*=0x406c, lpOverlapped=0x0) returned 1 [0178.520] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xffffbf94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.520] BCryptEncrypt (in: hKey=0x7f4ca0, pbInput=0x4950000, cbInput=0x406c, pPaddingInfo=0x0, pbIV=0x3193f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x3193f618, dwFlags=0x1 | out: hKey=0x7f4ca0, pbIV=0x3193f848, pbOutput=0x4950000, pcbResult=0x3193f618) returned 0x0 [0178.520] WriteFile (in: hFile=0x1af0, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x3193f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x3193f61c*=0x4070, lpOverlapped=0x0) returned 1 [0178.520] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3193f60c | out: lpNewFilePointer=0x0) returned 1 [0178.520] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.520] WriteFile (in: hFile=0x1af0, lpBuffer=0x3193f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3193f61c, lpOverlapped=0x0 | out: lpBuffer=0x3193f83c*, lpNumberOfBytesWritten=0x3193f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.520] SetFilePointerEx (in: hFile=0x1af0, liDistanceToMove=0x4070, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.520] BCryptDestroyKey (in: hKey=0x7f4ca0 | out: hKey=0x7f4ca0) returned 0x0 [0178.520] CloseHandle (hObject=0x1af0) returned 1 [0178.521] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.play")) returned 1 [0178.524] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2666 os_tid = 0x2808 [0178.342] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.342] ReadFile (in: hFile=0x1dc0, lpBuffer=0x31a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31a7fb34*, lpNumberOfBytesRead=0x31a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.345] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.345] ReadFile (in: hFile=0x1dc0, lpBuffer=0x31a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31a7fb34*, lpNumberOfBytesRead=0x31a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.345] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x30c30000 [0178.513] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x30c30000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x30c30000) returned 0x0 [0178.513] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x31a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0178.513] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x31a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x30c30000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x31a7f828, pbKeyObject=0x0) returned 0x0 [0178.513] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x30c30000, cbOutput=0x230, pcbResult=0x31a7f500, dwFlags=0x0 | out: pbOutput=0x30c30000, pcbResult=0x31a7f500) returned 0x0 [0178.514] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x30c30230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x30c30230) returned 0x0 [0178.514] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x30c30000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x30c30000, cbOutput=0x400, pcbResult=0x31a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x30c30000, pcbResult=0x31a7f500) returned 0x0 [0178.517] VirtualFree (lpAddress=0x30c30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.519] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.519] WriteFile (in: hFile=0x1dc0, lpBuffer=0x31a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31a7f830, lpOverlapped=0x0 | out: lpBuffer=0x31a7fb34*, lpNumberOfBytesWritten=0x31a7f830*=0x428, lpOverlapped=0x0) returned 1 [0178.519] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.519] ReadFile (in: hFile=0x1dc0, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x31a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x31a7f61c*=0x2c4c, lpOverlapped=0x0) returned 1 [0178.538] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xffffd3b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.538] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4a50000, cbInput=0x2c4c, pPaddingInfo=0x0, pbIV=0x31a7f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x31a7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x31a7f848, pbOutput=0x4a50000, pcbResult=0x31a7f618) returned 0x0 [0178.538] WriteFile (in: hFile=0x1dc0, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x31a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x31a7f61c*=0x2c50, lpOverlapped=0x0) returned 1 [0178.538] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31a7f60c | out: lpNewFilePointer=0x0) returned 1 [0178.539] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.539] WriteFile (in: hFile=0x1dc0, lpBuffer=0x31a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x31a7f83c*, lpNumberOfBytesWritten=0x31a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.539] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x2c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.539] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.539] CloseHandle (hObject=0x1dc0) returned 1 [0178.539] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.play")) returned 1 [0178.545] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2667 os_tid = 0x280c [0178.344] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.344] ReadFile (in: hFile=0x1dc8, lpBuffer=0x31bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x31bbfb34*, lpNumberOfBytesRead=0x31bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.345] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.346] ReadFile (in: hFile=0x1dc8, lpBuffer=0x31bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x31bbfb34*, lpNumberOfBytesRead=0x31bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.346] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x32480000 [0178.529] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x32480000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x32480000) returned 0x0 [0178.529] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x31bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0178.529] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x31bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x32480000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x31bbf828, pbKeyObject=0x0) returned 0x0 [0178.529] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x32480000, cbOutput=0x230, pcbResult=0x31bbf500, dwFlags=0x0 | out: pbOutput=0x32480000, pcbResult=0x31bbf500) returned 0x0 [0178.529] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x32480230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x32480230) returned 0x0 [0178.529] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x32480000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x32480000, cbOutput=0x400, pcbResult=0x31bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x32480000, pcbResult=0x31bbf500) returned 0x0 [0178.532] VirtualFree (lpAddress=0x32480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.536] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.536] WriteFile (in: hFile=0x1dc8, lpBuffer=0x31bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31bbf830, lpOverlapped=0x0 | out: lpBuffer=0x31bbfb34*, lpNumberOfBytesWritten=0x31bbf830*=0x428, lpOverlapped=0x0) returned 1 [0178.537] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.537] ReadFile (in: hFile=0x1dc8, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x31bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x31bbf61c*=0x4030, lpOverlapped=0x0) returned 1 [0178.555] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0xffffbfd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.555] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x4b50000, cbInput=0x4030, pPaddingInfo=0x0, pbIV=0x31bbf848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x31bbf618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x31bbf848, pbOutput=0x4b50000, pcbResult=0x31bbf618) returned 0x0 [0178.555] WriteFile (in: hFile=0x1dc8, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x31bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x31bbf61c*=0x4040, lpOverlapped=0x0) returned 1 [0178.555] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bbf60c | out: lpNewFilePointer=0x0) returned 1 [0178.555] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.555] WriteFile (in: hFile=0x1dc8, lpBuffer=0x31bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x31bbf83c*, lpNumberOfBytesWritten=0x31bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0178.555] SetFilePointerEx (in: hFile=0x1dc8, liDistanceToMove=0x4040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.555] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.555] CloseHandle (hObject=0x1dc8) returned 1 [0178.556] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.play")) returned 1 [0178.559] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2668 os_tid = 0x2810 [0178.346] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.346] ReadFile (in: hFile=0x1dd0, lpBuffer=0x31cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31cff85c, lpOverlapped=0x0 | out: lpBuffer=0x31cffb34*, lpNumberOfBytesRead=0x31cff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.349] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.349] ReadFile (in: hFile=0x1dd0, lpBuffer=0x31cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31cff85c, lpOverlapped=0x0 | out: lpBuffer=0x31cffb34*, lpNumberOfBytesRead=0x31cff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.349] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x32490000 [0178.548] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x32490000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x32490000) returned 0x0 [0178.548] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x31cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0178.548] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x31cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x32490000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x31cff828, pbKeyObject=0x0) returned 0x0 [0178.548] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x32490000, cbOutput=0x230, pcbResult=0x31cff500, dwFlags=0x0 | out: pbOutput=0x32490000, pcbResult=0x31cff500) returned 0x0 [0178.548] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x32490230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x32490230) returned 0x0 [0178.548] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x32490000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x32490000, cbOutput=0x400, pcbResult=0x31cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x32490000, pcbResult=0x31cff500) returned 0x0 [0178.551] VirtualFree (lpAddress=0x32490000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.554] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.554] WriteFile (in: hFile=0x1dd0, lpBuffer=0x31cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31cff830, lpOverlapped=0x0 | out: lpBuffer=0x31cffb34*, lpNumberOfBytesWritten=0x31cff830*=0x428, lpOverlapped=0x0) returned 1 [0178.554] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.554] ReadFile (in: hFile=0x1dd0, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x31cff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x31cff61c*=0x3eb4, lpOverlapped=0x0) returned 1 [0178.576] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xffffc14c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.576] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4c50000, cbInput=0x3eb4, pPaddingInfo=0x0, pbIV=0x31cff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x31cff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x31cff848, pbOutput=0x4c50000, pcbResult=0x31cff618) returned 0x0 [0178.576] WriteFile (in: hFile=0x1dd0, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x31cff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x31cff61c*=0x3ec0, lpOverlapped=0x0) returned 1 [0178.577] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31cff60c | out: lpNewFilePointer=0x0) returned 1 [0178.577] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.577] WriteFile (in: hFile=0x1dd0, lpBuffer=0x31cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31cff61c, lpOverlapped=0x0 | out: lpBuffer=0x31cff83c*, lpNumberOfBytesWritten=0x31cff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.577] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x3ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.577] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.577] CloseHandle (hObject=0x1dd0) returned 1 [0178.577] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.579] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.play")) returned 1 [0178.581] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2669 os_tid = 0x2814 [0178.349] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.350] ReadFile (in: hFile=0x1dd8, lpBuffer=0x31e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31e3fb34*, lpNumberOfBytesRead=0x31e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.351] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.351] ReadFile (in: hFile=0x1dd8, lpBuffer=0x31e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31e3fb34*, lpNumberOfBytesRead=0x31e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.351] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x324a0000 [0178.565] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x324a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x324a0000) returned 0x0 [0178.565] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x31e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0178.565] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x31e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x324a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x31e3f828, pbKeyObject=0x0) returned 0x0 [0178.565] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x324a0000, cbOutput=0x230, pcbResult=0x31e3f500, dwFlags=0x0 | out: pbOutput=0x324a0000, pcbResult=0x31e3f500) returned 0x0 [0178.565] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x324a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x324a0230) returned 0x0 [0178.566] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x324a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x324a0000, cbOutput=0x400, pcbResult=0x31e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x324a0000, pcbResult=0x31e3f500) returned 0x0 [0178.571] VirtualFree (lpAddress=0x324a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.575] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.575] WriteFile (in: hFile=0x1dd8, lpBuffer=0x31e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31e3f830, lpOverlapped=0x0 | out: lpBuffer=0x31e3fb34*, lpNumberOfBytesWritten=0x31e3f830*=0x428, lpOverlapped=0x0) returned 1 [0178.575] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.575] ReadFile (in: hFile=0x1dd8, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x31e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x31e3f61c*=0x2a80, lpOverlapped=0x0) returned 1 [0178.597] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xffffd580, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.597] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x4d50000, cbInput=0x2a80, pPaddingInfo=0x0, pbIV=0x31e3f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x31e3f618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x31e3f848, pbOutput=0x4d50000, pcbResult=0x31e3f618) returned 0x0 [0178.597] WriteFile (in: hFile=0x1dd8, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x31e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x31e3f61c*=0x2a90, lpOverlapped=0x0) returned 1 [0178.597] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31e3f60c | out: lpNewFilePointer=0x0) returned 1 [0178.597] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.597] WriteFile (in: hFile=0x1dd8, lpBuffer=0x31e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x31e3f83c*, lpNumberOfBytesWritten=0x31e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.598] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x2a90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.598] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.598] CloseHandle (hObject=0x1dd8) returned 1 [0178.598] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.play")) returned 1 [0178.601] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2670 os_tid = 0x2818 [0178.351] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.351] ReadFile (in: hFile=0x1de0, lpBuffer=0x31f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31f7fb34*, lpNumberOfBytesRead=0x31f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.353] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.353] ReadFile (in: hFile=0x1de0, lpBuffer=0x31f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31f7fb34*, lpNumberOfBytesRead=0x31f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.353] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x324b0000 [0178.584] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x324b0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x324b0000) returned 0x0 [0178.584] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x31f7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0178.584] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x31f7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x324b0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x31f7f828, pbKeyObject=0x0) returned 0x0 [0178.584] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x324b0000, cbOutput=0x230, pcbResult=0x31f7f500, dwFlags=0x0 | out: pbOutput=0x324b0000, pcbResult=0x31f7f500) returned 0x0 [0178.584] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x324b0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x324b0230) returned 0x0 [0178.584] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x324b0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x324b0000, cbOutput=0x400, pcbResult=0x31f7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x324b0000, pcbResult=0x31f7f500) returned 0x0 [0178.588] VirtualFree (lpAddress=0x324b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.590] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.590] WriteFile (in: hFile=0x1de0, lpBuffer=0x31f7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31f7f830, lpOverlapped=0x0 | out: lpBuffer=0x31f7fb34*, lpNumberOfBytesWritten=0x31f7f830*=0x428, lpOverlapped=0x0) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.591] ReadFile (in: hFile=0x1de0, lpBuffer=0x4e50000, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x31f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x31f7f61c*=0xe70, lpOverlapped=0x0) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0xfffff190, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.591] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4e50000, cbInput=0xe70, pPaddingInfo=0x0, pbIV=0x31f7f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x31f7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x31f7f848, pbOutput=0x4e50000, pcbResult=0x31f7f618) returned 0x0 [0178.591] WriteFile (in: hFile=0x1de0, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x31f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x31f7f61c*=0xe80, lpOverlapped=0x0) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31f7f60c | out: lpNewFilePointer=0x0) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.591] WriteFile (in: hFile=0x1de0, lpBuffer=0x31f7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x31f7f83c*, lpNumberOfBytesWritten=0x31f7f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x1de0, liDistanceToMove=0xe80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.591] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.591] CloseHandle (hObject=0x1de0) returned 1 [0178.591] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0178.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.play")) returned 1 [0178.595] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2671 os_tid = 0x281c [0178.801] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.801] ReadFile (in: hFile=0x1de8, lpBuffer=0x320bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x320bf85c, lpOverlapped=0x0 | out: lpBuffer=0x320bfb34*, lpNumberOfBytesRead=0x320bf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.803] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.803] ReadFile (in: hFile=0x1de8, lpBuffer=0x320bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x320bf85c, lpOverlapped=0x0 | out: lpBuffer=0x320bfb34*, lpNumberOfBytesRead=0x320bf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.803] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0178.806] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0178.806] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x320bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0178.806] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x320bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x320bf828, pbKeyObject=0x0) returned 0x0 [0178.807] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x320bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x320bf500) returned 0x0 [0178.807] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0178.807] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x320bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x320bf500) returned 0x0 [0178.811] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.814] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.814] WriteFile (in: hFile=0x1de8, lpBuffer=0x320bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x320bf830, lpOverlapped=0x0 | out: lpBuffer=0x320bfb34*, lpNumberOfBytesWritten=0x320bf830*=0x428, lpOverlapped=0x0) returned 1 [0178.814] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.814] ReadFile (in: hFile=0x1de8, lpBuffer=0x4f50000, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x320bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x320bf61c*=0xd28, lpOverlapped=0x0) returned 1 [0178.814] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0xfffff2d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.814] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x4f50000, cbInput=0xd28, pPaddingInfo=0x0, pbIV=0x320bf848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x320bf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x320bf848, pbOutput=0x4f50000, pcbResult=0x320bf618) returned 0x0 [0178.814] WriteFile (in: hFile=0x1de8, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x320bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x320bf61c*=0xd30, lpOverlapped=0x0) returned 1 [0178.815] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320bf60c | out: lpNewFilePointer=0x0) returned 1 [0178.815] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.815] WriteFile (in: hFile=0x1de8, lpBuffer=0x320bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x320bf61c, lpOverlapped=0x0 | out: lpBuffer=0x320bf83c*, lpNumberOfBytesWritten=0x320bf61c*=0x8, lpOverlapped=0x0) returned 1 [0178.815] SetFilePointerEx (in: hFile=0x1de8, liDistanceToMove=0xd30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.815] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0178.815] CloseHandle (hObject=0x1de8) returned 1 [0178.815] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0178.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.play")) returned 1 [0178.818] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2672 os_tid = 0x2820 [0178.720] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.720] ReadFile (in: hFile=0x1df0, lpBuffer=0x321ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x321ff85c, lpOverlapped=0x0 | out: lpBuffer=0x321ffb34*, lpNumberOfBytesRead=0x321ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.723] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.723] ReadFile (in: hFile=0x1df0, lpBuffer=0x321ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x321ff85c, lpOverlapped=0x0 | out: lpBuffer=0x321ffb34*, lpNumberOfBytesRead=0x321ff85c*=0x428, lpOverlapped=0x0) returned 1 [0178.723] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0178.725] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0178.725] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x321ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0178.725] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x321ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x321ff828, pbKeyObject=0x0) returned 0x0 [0178.725] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x321ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x321ff500) returned 0x0 [0178.725] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0178.725] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x321ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x321ff500) returned 0x0 [0178.729] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.731] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.731] WriteFile (in: hFile=0x1df0, lpBuffer=0x321ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x321ff830, lpOverlapped=0x0 | out: lpBuffer=0x321ffb34*, lpNumberOfBytesWritten=0x321ff830*=0x428, lpOverlapped=0x0) returned 1 [0178.732] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.732] ReadFile (in: hFile=0x1df0, lpBuffer=0x5050000, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x321ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x321ff61c*=0x2ab4, lpOverlapped=0x0) returned 1 [0178.749] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0xffffd54c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.749] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5050000, cbInput=0x2ab4, pPaddingInfo=0x0, pbIV=0x321ff848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x321ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x321ff848, pbOutput=0x5050000, pcbResult=0x321ff618) returned 0x0 [0178.749] WriteFile (in: hFile=0x1df0, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x321ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x321ff61c*=0x2ac0, lpOverlapped=0x0) returned 1 [0178.749] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321ff60c | out: lpNewFilePointer=0x0) returned 1 [0178.750] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.750] WriteFile (in: hFile=0x1df0, lpBuffer=0x321ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x321ff61c, lpOverlapped=0x0 | out: lpBuffer=0x321ff83c*, lpNumberOfBytesWritten=0x321ff61c*=0x8, lpOverlapped=0x0) returned 1 [0178.750] SetFilePointerEx (in: hFile=0x1df0, liDistanceToMove=0x2ac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.750] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.750] CloseHandle (hObject=0x1df0) returned 1 [0178.751] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0178.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.play")) returned 1 [0178.756] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2673 os_tid = 0x2824 [0178.721] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.722] ReadFile (in: hFile=0x1df8, lpBuffer=0x3233fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3233f85c, lpOverlapped=0x0 | out: lpBuffer=0x3233fb34*, lpNumberOfBytesRead=0x3233f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.734] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.734] ReadFile (in: hFile=0x1df8, lpBuffer=0x3233fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3233f85c, lpOverlapped=0x0 | out: lpBuffer=0x3233fb34*, lpNumberOfBytesRead=0x3233f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.734] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0178.736] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0178.736] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x3233f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0178.736] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x3233f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x3233f828, pbKeyObject=0x0) returned 0x0 [0178.736] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3233f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3233f500) returned 0x0 [0178.736] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0178.736] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3233f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3233f500) returned 0x0 [0178.740] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.746] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.747] WriteFile (in: hFile=0x1df8, lpBuffer=0x3233fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3233f830, lpOverlapped=0x0 | out: lpBuffer=0x3233fb34*, lpNumberOfBytesWritten=0x3233f830*=0x428, lpOverlapped=0x0) returned 1 [0178.747] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.747] ReadFile (in: hFile=0x1df8, lpBuffer=0x5150000, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x3233f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x3233f61c*=0x18c4, lpOverlapped=0x0) returned 1 [0178.762] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xffffe73c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.762] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x5150000, cbInput=0x18c4, pPaddingInfo=0x0, pbIV=0x3233f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x3233f618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x3233f848, pbOutput=0x5150000, pcbResult=0x3233f618) returned 0x0 [0178.762] WriteFile (in: hFile=0x1df8, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x3233f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x3233f61c*=0x18d0, lpOverlapped=0x0) returned 1 [0178.762] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3233f60c | out: lpNewFilePointer=0x0) returned 1 [0178.762] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.762] WriteFile (in: hFile=0x1df8, lpBuffer=0x3233f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3233f61c, lpOverlapped=0x0 | out: lpBuffer=0x3233f83c*, lpNumberOfBytesWritten=0x3233f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.762] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x18d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.762] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0178.762] CloseHandle (hObject=0x1df8) returned 1 [0178.763] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0178.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.play")) returned 1 [0178.767] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2674 os_tid = 0x27f4 [0178.732] GetLastError () returned 0x57 [0178.732] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f99f8 [0178.732] SetLastError (dwErrCode=0x57) [0178.733] IcmpCreateFile () returned 0x8049a8 [0178.733] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8240 [0178.733] IcmpSendEcho2 (IcmpHandle=0x8049a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb900a8c0, RequestData=0x34bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8240, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2675 os_tid = 0x282c [0178.871] GetLastError () returned 0x57 [0178.871] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6f9d80 [0178.872] SetLastError (dwErrCode=0x57) [0178.872] IcmpCreateFile () returned 0x8049e0 [0178.872] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8290 [0178.872] IcmpSendEcho2 (IcmpHandle=0x8049e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xba00a8c0, RequestData=0x325bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8290, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2676 os_tid = 0x2830 [0178.873] GetLastError () returned 0x57 [0178.873] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a701ca0 [0178.873] SetLastError (dwErrCode=0x57) [0178.873] IcmpCreateFile () returned 0x804a18 [0178.873] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f82e0 [0178.873] IcmpSendEcho2 (IcmpHandle=0x804a18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbb00a8c0, RequestData=0x326fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f82e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2677 os_tid = 0x2834 [0178.874] GetLastError () returned 0x57 [0178.874] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a702028 [0178.875] SetLastError (dwErrCode=0x57) [0178.875] IcmpCreateFile () returned 0x804a50 [0178.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8330 [0178.875] IcmpSendEcho2 (IcmpHandle=0x804a50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbc00a8c0, RequestData=0x34cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8330, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2678 os_tid = 0x2838 [0178.876] GetLastError () returned 0x57 [0178.876] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7023b0 [0178.876] SetLastError (dwErrCode=0x57) [0178.876] IcmpCreateFile () returned 0x804a88 [0178.876] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8380 [0178.876] IcmpSendEcho2 (IcmpHandle=0x804a88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbd00a8c0, RequestData=0x34dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8380, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2679 os_tid = 0x283c [0178.877] GetLastError () returned 0x57 [0178.877] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a702738 [0178.877] SetLastError (dwErrCode=0x57) [0178.877] IcmpCreateFile () returned 0x804ac0 [0178.877] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f83d0 [0178.877] IcmpSendEcho2 (IcmpHandle=0x804ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbe00a8c0, RequestData=0x34ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f83d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2680 os_tid = 0x2840 [0178.878] GetLastError () returned 0x57 [0178.878] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fb9c0 [0178.878] SetLastError (dwErrCode=0x57) [0178.879] IcmpCreateFile () returned 0x804af8 [0178.879] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8420 [0178.879] IcmpSendEcho2 (IcmpHandle=0x804af8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbf00a8c0, RequestData=0x34ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8420, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2681 os_tid = 0x2844 [0178.880] GetLastError () returned 0x57 [0178.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fbd48 [0178.880] SetLastError (dwErrCode=0x57) [0178.880] IcmpCreateFile () returned 0x804b68 [0178.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8470 [0178.880] IcmpSendEcho2 (IcmpHandle=0x804b68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc000a8c0, RequestData=0x3513ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8470, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2682 os_tid = 0x2848 [0178.881] GetLastError () returned 0x57 [0178.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fc0d0 [0178.881] SetLastError (dwErrCode=0x57) [0178.881] IcmpCreateFile () returned 0x804ba0 [0178.881] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f84c0 [0178.881] IcmpSendEcho2 (IcmpHandle=0x804ba0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc100a8c0, RequestData=0x3527ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f84c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2683 os_tid = 0x2828 [0178.883] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.883] ReadFile (in: hFile=0x1e00, lpBuffer=0x3247fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3247f85c, lpOverlapped=0x0 | out: lpBuffer=0x3247fb34*, lpNumberOfBytesRead=0x3247f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.884] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.884] ReadFile (in: hFile=0x1e00, lpBuffer=0x3247fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3247f85c, lpOverlapped=0x0 | out: lpBuffer=0x3247fb34*, lpNumberOfBytesRead=0x3247f85c*=0x428, lpOverlapped=0x0) returned 1 [0178.885] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0178.889] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0178.889] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x3247f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0178.889] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x3247f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x3247f828, pbKeyObject=0x0) returned 0x0 [0178.889] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3247f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3247f500) returned 0x0 [0178.890] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0178.890] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3247f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3247f500) returned 0x0 [0178.893] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.896] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.896] WriteFile (in: hFile=0x1e00, lpBuffer=0x3247fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3247f830, lpOverlapped=0x0 | out: lpBuffer=0x3247fb34*, lpNumberOfBytesWritten=0x3247f830*=0x428, lpOverlapped=0x0) returned 1 [0178.896] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.896] ReadFile (in: hFile=0x1e00, lpBuffer=0x5250000, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x3247f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x3247f61c*=0x2628, lpOverlapped=0x0) returned 1 [0178.897] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0xffffd9d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.897] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5250000, cbInput=0x2628, pPaddingInfo=0x0, pbIV=0x3247f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x3247f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3247f848, pbOutput=0x5250000, pcbResult=0x3247f618) returned 0x0 [0178.897] WriteFile (in: hFile=0x1e00, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x3247f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x3247f61c*=0x2630, lpOverlapped=0x0) returned 1 [0178.897] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3247f60c | out: lpNewFilePointer=0x0) returned 1 [0178.897] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.897] WriteFile (in: hFile=0x1e00, lpBuffer=0x3247f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3247f61c, lpOverlapped=0x0 | out: lpBuffer=0x3247f83c*, lpNumberOfBytesWritten=0x3247f61c*=0x8, lpOverlapped=0x0) returned 1 [0178.897] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x2630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.897] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.897] CloseHandle (hObject=0x1e00) returned 1 [0178.897] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0178.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.play")) returned 1 [0178.901] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2684 os_tid = 0x284c [0178.939] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.939] ReadFile (in: hFile=0x1df8, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.943] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.943] ReadFile (in: hFile=0x1df8, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0178.943] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0178.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0178.948] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0178.948] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0178.948] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0178.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0178.948] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0178.951] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.954] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.954] WriteFile (in: hFile=0x1df8, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0178.955] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.955] ReadFile (in: hFile=0x1df8, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x141cf61c*=0x1884, lpOverlapped=0x0) returned 1 [0178.956] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xffffe77c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.956] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2750000, cbInput=0x1884, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x141cf848, pbOutput=0x2750000, pcbResult=0x141cf618) returned 0x0 [0178.956] WriteFile (in: hFile=0x1df8, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x141cf61c*=0x1890, lpOverlapped=0x0) returned 1 [0178.956] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0178.956] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.956] WriteFile (in: hFile=0x1df8, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0178.956] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x1890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.956] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0178.956] CloseHandle (hObject=0x1df8) returned 1 [0178.956] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0178.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.play")) returned 1 [0178.960] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2685 os_tid = 0x2850 [0179.010] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.010] ReadFile (in: hFile=0x19d4, lpBuffer=0x1430fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1430f85c, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesRead=0x1430f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.012] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.012] ReadFile (in: hFile=0x19d4, lpBuffer=0x1430fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1430f85c, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesRead=0x1430f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.012] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.017] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.017] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1430f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0179.017] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1430f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1430f828, pbKeyObject=0x0) returned 0x0 [0179.017] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1430f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1430f500) returned 0x0 [0179.018] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.018] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1430f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1430f500) returned 0x0 [0179.024] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.027] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.028] WriteFile (in: hFile=0x19d4, lpBuffer=0x1430fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1430f830, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesWritten=0x1430f830*=0x428, lpOverlapped=0x0) returned 1 [0179.028] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.028] ReadFile (in: hFile=0x19d4, lpBuffer=0x2850000, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1430f61c*=0x40f8, lpOverlapped=0x0) returned 1 [0179.029] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xffffbf08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.029] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2850000, cbInput=0x40f8, pPaddingInfo=0x0, pbIV=0x1430f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1430f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x1430f848, pbOutput=0x2850000, pcbResult=0x1430f618) returned 0x0 [0179.029] WriteFile (in: hFile=0x19d4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1430f61c*=0x4100, lpOverlapped=0x0) returned 1 [0179.029] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1430f60c | out: lpNewFilePointer=0x0) returned 1 [0179.029] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.029] WriteFile (in: hFile=0x19d4, lpBuffer=0x1430f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x1430f83c*, lpNumberOfBytesWritten=0x1430f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.030] SetFilePointerEx (in: hFile=0x19d4, liDistanceToMove=0x4100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.030] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.030] CloseHandle (hObject=0x19d4) returned 1 [0179.030] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.play")) returned 1 [0179.034] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2686 os_tid = 0x2854 [0179.038] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.038] ReadFile (in: hFile=0x1a90, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.040] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.040] ReadFile (in: hFile=0x1a90, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.040] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.042] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.043] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0179.043] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0179.043] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0179.043] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.043] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0179.046] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.049] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.049] WriteFile (in: hFile=0x1a90, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0179.049] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.049] ReadFile (in: hFile=0x1a90, lpBuffer=0x2950000, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1444f61c*=0x3094, lpOverlapped=0x0) returned 1 [0179.050] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xffffcf6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.050] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2950000, cbInput=0x3094, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x1444f848, pbOutput=0x2950000, pcbResult=0x1444f618) returned 0x0 [0179.050] WriteFile (in: hFile=0x1a90, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1444f61c*=0x30a0, lpOverlapped=0x0) returned 1 [0179.050] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0179.050] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.050] WriteFile (in: hFile=0x1a90, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.050] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x30a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.050] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.050] CloseHandle (hObject=0x1a90) returned 1 [0179.050] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.play")) returned 1 [0179.054] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2687 os_tid = 0x2858 [0179.058] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.058] ReadFile (in: hFile=0x1c30, lpBuffer=0x1470fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1470f85c, lpOverlapped=0x0 | out: lpBuffer=0x1470fb34*, lpNumberOfBytesRead=0x1470f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.059] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.059] ReadFile (in: hFile=0x1c30, lpBuffer=0x1470fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1470f85c, lpOverlapped=0x0 | out: lpBuffer=0x1470fb34*, lpNumberOfBytesRead=0x1470f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.060] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.062] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1470f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0179.062] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1470f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1470f828, pbKeyObject=0x0) returned 0x0 [0179.062] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1470f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1470f500) returned 0x0 [0179.063] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.063] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1470f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1470f500) returned 0x0 [0179.066] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.069] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.069] WriteFile (in: hFile=0x1c30, lpBuffer=0x1470fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1470f830, lpOverlapped=0x0 | out: lpBuffer=0x1470fb34*, lpNumberOfBytesWritten=0x1470f830*=0x428, lpOverlapped=0x0) returned 1 [0179.069] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.069] ReadFile (in: hFile=0x1c30, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x1470f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1470f61c*=0x1748, lpOverlapped=0x0) returned 1 [0179.069] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xffffe8b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.069] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2a50000, cbInput=0x1748, pPaddingInfo=0x0, pbIV=0x1470f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1470f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x1470f848, pbOutput=0x2a50000, pcbResult=0x1470f618) returned 0x0 [0179.069] WriteFile (in: hFile=0x1c30, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x1470f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1470f61c*=0x1750, lpOverlapped=0x0) returned 1 [0179.070] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1470f60c | out: lpNewFilePointer=0x0) returned 1 [0179.070] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.070] WriteFile (in: hFile=0x1c30, lpBuffer=0x1470f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1470f61c, lpOverlapped=0x0 | out: lpBuffer=0x1470f83c*, lpNumberOfBytesWritten=0x1470f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.070] SetFilePointerEx (in: hFile=0x1c30, liDistanceToMove=0x1750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.070] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.070] CloseHandle (hObject=0x1c30) returned 1 [0179.070] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.play")) returned 1 [0179.074] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2688 os_tid = 0x285c [0179.078] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.078] ReadFile (in: hFile=0x1dd8, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.080] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.080] ReadFile (in: hFile=0x1dd8, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.081] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.083] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.083] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1484f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0179.083] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1484f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1484f828, pbKeyObject=0x0) returned 0x0 [0179.083] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1484f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1484f500) returned 0x0 [0179.083] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.083] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1484f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1484f500) returned 0x0 [0179.086] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.089] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.089] WriteFile (in: hFile=0x1dd8, lpBuffer=0x1484fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1484f830, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesWritten=0x1484f830*=0x428, lpOverlapped=0x0) returned 1 [0179.090] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.090] ReadFile (in: hFile=0x1dd8, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1484f61c*=0x2584, lpOverlapped=0x0) returned 1 [0179.090] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xffffda7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.090] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2b50000, cbInput=0x2584, pPaddingInfo=0x0, pbIV=0x1484f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1484f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x1484f848, pbOutput=0x2b50000, pcbResult=0x1484f618) returned 0x0 [0179.090] WriteFile (in: hFile=0x1dd8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1484f61c*=0x2590, lpOverlapped=0x0) returned 1 [0179.091] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1484f60c | out: lpNewFilePointer=0x0) returned 1 [0179.091] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.091] WriteFile (in: hFile=0x1dd8, lpBuffer=0x1484f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x1484f83c*, lpNumberOfBytesWritten=0x1484f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.091] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x2590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.091] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.091] CloseHandle (hObject=0x1dd8) returned 1 [0179.091] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.play")) returned 1 [0179.094] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2689 os_tid = 0x2860 [0179.102] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.102] ReadFile (in: hFile=0x1dd0, lpBuffer=0x1498fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1498f85c, lpOverlapped=0x0 | out: lpBuffer=0x1498fb34*, lpNumberOfBytesRead=0x1498f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.107] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.108] ReadFile (in: hFile=0x1dd0, lpBuffer=0x1498fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1498f85c, lpOverlapped=0x0 | out: lpBuffer=0x1498fb34*, lpNumberOfBytesRead=0x1498f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.108] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.111] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.111] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1498f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0179.111] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1498f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1498f828, pbKeyObject=0x0) returned 0x0 [0179.111] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1498f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1498f500) returned 0x0 [0179.111] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.111] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1498f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1498f500) returned 0x0 [0179.114] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.117] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.117] WriteFile (in: hFile=0x1dd0, lpBuffer=0x1498fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1498f830, lpOverlapped=0x0 | out: lpBuffer=0x1498fb34*, lpNumberOfBytesWritten=0x1498f830*=0x428, lpOverlapped=0x0) returned 1 [0179.117] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.118] ReadFile (in: hFile=0x1dd0, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x1498f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1498f61c*=0x6688, lpOverlapped=0x0) returned 1 [0179.119] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xffff9978, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.119] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2c50000, cbInput=0x6688, pPaddingInfo=0x0, pbIV=0x1498f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1498f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x1498f848, pbOutput=0x2c50000, pcbResult=0x1498f618) returned 0x0 [0179.119] WriteFile (in: hFile=0x1dd0, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x1498f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1498f61c*=0x6690, lpOverlapped=0x0) returned 1 [0179.119] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1498f60c | out: lpNewFilePointer=0x0) returned 1 [0179.119] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.119] WriteFile (in: hFile=0x1dd0, lpBuffer=0x1498f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1498f61c, lpOverlapped=0x0 | out: lpBuffer=0x1498f83c*, lpNumberOfBytesWritten=0x1498f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.119] SetFilePointerEx (in: hFile=0x1dd0, liDistanceToMove=0x6690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.119] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.119] CloseHandle (hObject=0x1dd0) returned 1 [0179.120] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.play")) returned 1 [0179.123] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2690 os_tid = 0x2864 [0179.127] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.127] ReadFile (in: hFile=0x1dc0, lpBuffer=0x29b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesRead=0x29b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.128] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.128] ReadFile (in: hFile=0x1dc0, lpBuffer=0x29b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesRead=0x29b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.128] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.130] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.131] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x29b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0179.131] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x29b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x29b3f828, pbKeyObject=0x0) returned 0x0 [0179.131] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x29b3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x29b3f500) returned 0x0 [0179.131] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.131] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x29b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x29b3f500) returned 0x0 [0179.134] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.137] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.137] WriteFile (in: hFile=0x1dc0, lpBuffer=0x29b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29b3f830, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesWritten=0x29b3f830*=0x428, lpOverlapped=0x0) returned 1 [0179.137] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.137] ReadFile (in: hFile=0x1dc0, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x29b3f61c*=0x785c, lpOverlapped=0x0) returned 1 [0179.138] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xffff87a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.138] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2d50000, cbInput=0x785c, pPaddingInfo=0x0, pbIV=0x29b3f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x29b3f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x29b3f848, pbOutput=0x2d50000, pcbResult=0x29b3f618) returned 0x0 [0179.138] WriteFile (in: hFile=0x1dc0, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x29b3f61c*=0x7860, lpOverlapped=0x0) returned 1 [0179.139] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29b3f60c | out: lpNewFilePointer=0x0) returned 1 [0179.139] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.139] WriteFile (in: hFile=0x1dc0, lpBuffer=0x29b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29b3f83c*, lpNumberOfBytesWritten=0x29b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.139] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x7860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.139] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.139] CloseHandle (hObject=0x1dc0) returned 1 [0179.139] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.play")) returned 1 [0179.142] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2691 os_tid = 0x2868 [0179.146] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.146] ReadFile (in: hFile=0x16b4, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.147] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.147] ReadFile (in: hFile=0x16b4, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.148] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.157] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.158] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0179.158] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0179.158] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0179.158] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.158] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0179.161] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.165] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.166] WriteFile (in: hFile=0x16b4, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0179.167] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.167] ReadFile (in: hFile=0x16b4, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2d37f61c*=0x8774, lpOverlapped=0x0) returned 1 [0179.169] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xffff788c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.169] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2e50000, cbInput=0x8774, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2d37f848, pbOutput=0x2e50000, pcbResult=0x2d37f618) returned 0x0 [0179.169] WriteFile (in: hFile=0x16b4, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x8780, lpOverlapped=0x0) returned 1 [0179.169] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0179.169] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.170] WriteFile (in: hFile=0x16b4, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.170] SetFilePointerEx (in: hFile=0x16b4, liDistanceToMove=0x8780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.170] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.170] CloseHandle (hObject=0x16b4) returned 1 [0179.170] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.play")) returned 1 [0179.176] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2692 os_tid = 0x286c [0179.182] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.182] ReadFile (in: hFile=0x1c20, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.186] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.188] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.188] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0179.188] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0179.188] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0179.189] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.189] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0179.192] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.195] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.195] WriteFile (in: hFile=0x1c20, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0179.195] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.195] ReadFile (in: hFile=0x1c20, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d47f61c*=0x4f4, lpOverlapped=0x0) returned 1 [0179.195] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffb0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.196] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2f50000, cbInput=0x4f4, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2d47f848, pbOutput=0x2f50000, pcbResult=0x2d47f618) returned 0x0 [0179.196] WriteFile (in: hFile=0x1c20, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d47f61c*=0x500, lpOverlapped=0x0) returned 1 [0179.196] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0179.196] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.196] WriteFile (in: hFile=0x1c20, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.196] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.196] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.196] CloseHandle (hObject=0x1c20) returned 1 [0179.196] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.play")) returned 1 [0179.200] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2693 os_tid = 0x2870 [0179.203] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.203] ReadFile (in: hFile=0x1db0, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.205] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.207] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.207] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0179.207] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0179.207] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0179.208] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.208] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0179.211] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.214] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.214] WriteFile (in: hFile=0x1db0, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0179.214] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.214] ReadFile (in: hFile=0x1db0, lpBuffer=0x3050000, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d57f61c*=0x544, lpOverlapped=0x0) returned 1 [0179.214] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0xfffffabc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.214] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3050000, cbInput=0x544, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2d57f848, pbOutput=0x3050000, pcbResult=0x2d57f618) returned 0x0 [0179.214] WriteFile (in: hFile=0x1db0, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d57f61c*=0x550, lpOverlapped=0x0) returned 1 [0179.214] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0179.214] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.214] WriteFile (in: hFile=0x1db0, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.214] SetFilePointerEx (in: hFile=0x1db0, liDistanceToMove=0x550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.214] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.215] CloseHandle (hObject=0x1db0) returned 1 [0179.215] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.217] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.play")) returned 1 [0179.221] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2694 os_tid = 0x2874 [0179.225] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.225] ReadFile (in: hFile=0x1db8, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.226] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.226] ReadFile (in: hFile=0x1db8, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.227] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.229] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.229] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0179.229] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0179.229] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0179.230] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.230] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0179.233] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.236] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.236] WriteFile (in: hFile=0x1db8, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0179.236] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.236] ReadFile (in: hFile=0x1db8, lpBuffer=0x3150000, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d67f61c*=0x1c98, lpOverlapped=0x0) returned 1 [0179.237] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xffffe368, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.237] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3150000, cbInput=0x1c98, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2d67f848, pbOutput=0x3150000, pcbResult=0x2d67f618) returned 0x0 [0179.237] WriteFile (in: hFile=0x1db8, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d67f61c*=0x1ca0, lpOverlapped=0x0) returned 1 [0179.237] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0179.237] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.237] WriteFile (in: hFile=0x1db8, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.238] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x1ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.238] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.238] CloseHandle (hObject=0x1db8) returned 1 [0179.238] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.play")) returned 1 [0179.241] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2695 os_tid = 0x2878 [0179.245] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.245] ReadFile (in: hFile=0x1c90, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.247] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.249] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.249] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0179.249] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d7bf828, pbKeyObject=0x0) returned 0x0 [0179.249] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d7bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d7bf500) returned 0x0 [0179.249] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.249] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d7bf500) returned 0x0 [0179.253] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.255] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.255] WriteFile (in: hFile=0x1c90, lpBuffer=0x2d7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesWritten=0x2d7bf830*=0x428, lpOverlapped=0x0) returned 1 [0179.255] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.255] ReadFile (in: hFile=0x1c90, lpBuffer=0x3250000, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d7bf61c*=0x4b8, lpOverlapped=0x0) returned 1 [0179.255] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffffb48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.255] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3250000, cbInput=0x4b8, pPaddingInfo=0x0, pbIV=0x2d7bf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d7bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2d7bf848, pbOutput=0x3250000, pcbResult=0x2d7bf618) returned 0x0 [0179.255] WriteFile (in: hFile=0x1c90, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d7bf61c*=0x4c0, lpOverlapped=0x0) returned 1 [0179.256] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf60c | out: lpNewFilePointer=0x0) returned 1 [0179.256] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.256] WriteFile (in: hFile=0x1c90, lpBuffer=0x2d7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf83c*, lpNumberOfBytesWritten=0x2d7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.256] SetFilePointerEx (in: hFile=0x1c90, liDistanceToMove=0x4c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.256] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.256] CloseHandle (hObject=0x1c90) returned 1 [0179.256] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.play")) returned 1 [0179.260] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2696 os_tid = 0x287c [0179.263] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.263] ReadFile (in: hFile=0x1e04, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.265] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.267] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.267] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0179.267] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d8ff828, pbKeyObject=0x0) returned 0x0 [0179.267] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d8ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0179.267] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.267] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0179.270] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.273] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.273] WriteFile (in: hFile=0x1e04, lpBuffer=0x2d8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesWritten=0x2d8ff830*=0x428, lpOverlapped=0x0) returned 1 [0179.273] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.273] ReadFile (in: hFile=0x1e04, lpBuffer=0x3350000, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d8ff61c*=0x4b8, lpOverlapped=0x0) returned 1 [0179.273] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xfffffb48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.273] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3350000, cbInput=0x4b8, pPaddingInfo=0x0, pbIV=0x2d8ff848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d8ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2d8ff848, pbOutput=0x3350000, pcbResult=0x2d8ff618) returned 0x0 [0179.273] WriteFile (in: hFile=0x1e04, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d8ff61c*=0x4c0, lpOverlapped=0x0) returned 1 [0179.274] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8ff60c | out: lpNewFilePointer=0x0) returned 1 [0179.274] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.274] WriteFile (in: hFile=0x1e04, lpBuffer=0x2d8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ff83c*, lpNumberOfBytesWritten=0x2d8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.274] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x4c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.274] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.274] CloseHandle (hObject=0x1e04) returned 1 [0179.274] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.play")) returned 1 [0179.278] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2697 os_tid = 0x2880 [0179.282] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.282] ReadFile (in: hFile=0x1e0c, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.283] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.286] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.286] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2da3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0179.286] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2da3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2da3f828, pbKeyObject=0x0) returned 0x0 [0179.286] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2da3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2da3f500) returned 0x0 [0179.286] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.286] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2da3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2da3f500) returned 0x0 [0179.289] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.294] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.294] WriteFile (in: hFile=0x1e0c, lpBuffer=0x2da3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da3f830, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesWritten=0x2da3f830*=0x428, lpOverlapped=0x0) returned 1 [0179.295] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.295] ReadFile (in: hFile=0x1e0c, lpBuffer=0x3450000, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2da3f61c*=0x674, lpOverlapped=0x0) returned 1 [0179.295] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0xfffff98c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.295] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3450000, cbInput=0x674, pPaddingInfo=0x0, pbIV=0x2da3f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2da3f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2da3f848, pbOutput=0x3450000, pcbResult=0x2da3f618) returned 0x0 [0179.295] WriteFile (in: hFile=0x1e0c, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2da3f61c*=0x680, lpOverlapped=0x0) returned 1 [0179.295] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da3f60c | out: lpNewFilePointer=0x0) returned 1 [0179.295] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.295] WriteFile (in: hFile=0x1e0c, lpBuffer=0x2da3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da3f83c*, lpNumberOfBytesWritten=0x2da3f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.295] SetFilePointerEx (in: hFile=0x1e0c, liDistanceToMove=0x680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.295] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.295] CloseHandle (hObject=0x1e0c) returned 1 [0179.295] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.play")) returned 1 [0179.299] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2698 os_tid = 0x2884 [0179.302] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.303] ReadFile (in: hFile=0x1e14, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.304] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.304] ReadFile (in: hFile=0x1e14, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.304] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.306] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.306] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2db7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0179.306] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2db7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2db7f828, pbKeyObject=0x0) returned 0x0 [0179.306] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2db7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2db7f500) returned 0x0 [0179.306] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.307] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2db7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2db7f500) returned 0x0 [0179.310] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.312] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.312] WriteFile (in: hFile=0x1e14, lpBuffer=0x2db7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db7f830, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesWritten=0x2db7f830*=0x428, lpOverlapped=0x0) returned 1 [0179.312] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.312] ReadFile (in: hFile=0x1e14, lpBuffer=0x3550000, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2db7f61c*=0x132c, lpOverlapped=0x0) returned 1 [0179.312] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xffffecd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.313] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3550000, cbInput=0x132c, pPaddingInfo=0x0, pbIV=0x2db7f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2db7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2db7f848, pbOutput=0x3550000, pcbResult=0x2db7f618) returned 0x0 [0179.313] WriteFile (in: hFile=0x1e14, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2db7f61c*=0x1330, lpOverlapped=0x0) returned 1 [0179.313] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db7f60c | out: lpNewFilePointer=0x0) returned 1 [0179.313] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.313] WriteFile (in: hFile=0x1e14, lpBuffer=0x2db7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db7f83c*, lpNumberOfBytesWritten=0x2db7f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.313] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x1330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.313] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.313] CloseHandle (hObject=0x1e14) returned 1 [0179.313] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.play")) returned 1 [0179.316] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2699 os_tid = 0x2888 [0179.320] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.320] ReadFile (in: hFile=0x1e1c, lpBuffer=0x2dcbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dcbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb34*, lpNumberOfBytesRead=0x2dcbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.322] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.322] ReadFile (in: hFile=0x1e1c, lpBuffer=0x2dcbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dcbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb34*, lpNumberOfBytesRead=0x2dcbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.322] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.324] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.324] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2dcbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0179.324] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2dcbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2dcbf828, pbKeyObject=0x0) returned 0x0 [0179.324] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2dcbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2dcbf500) returned 0x0 [0179.324] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.324] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2dcbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2dcbf500) returned 0x0 [0179.328] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.332] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.332] WriteFile (in: hFile=0x1e1c, lpBuffer=0x2dcbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dcbf830, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb34*, lpNumberOfBytesWritten=0x2dcbf830*=0x428, lpOverlapped=0x0) returned 1 [0179.332] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.332] ReadFile (in: hFile=0x1e1c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x2dcbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2dcbf61c*=0x11e4, lpOverlapped=0x0) returned 1 [0179.332] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0xffffee1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.332] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3650000, cbInput=0x11e4, pPaddingInfo=0x0, pbIV=0x2dcbf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2dcbf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2dcbf848, pbOutput=0x3650000, pcbResult=0x2dcbf618) returned 0x0 [0179.332] WriteFile (in: hFile=0x1e1c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x2dcbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2dcbf61c*=0x11f0, lpOverlapped=0x0) returned 1 [0179.333] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcbf60c | out: lpNewFilePointer=0x0) returned 1 [0179.333] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.333] WriteFile (in: hFile=0x1e1c, lpBuffer=0x2dcbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dcbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dcbf83c*, lpNumberOfBytesWritten=0x2dcbf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.333] SetFilePointerEx (in: hFile=0x1e1c, liDistanceToMove=0x11f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.333] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.333] CloseHandle (hObject=0x1e1c) returned 1 [0179.333] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.play")) returned 1 [0179.336] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2700 os_tid = 0x288c [0179.342] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.342] ReadFile (in: hFile=0x1e24, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.344] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.344] ReadFile (in: hFile=0x1e24, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.344] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.346] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.346] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2ddff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0179.346] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2ddff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2ddff828, pbKeyObject=0x0) returned 0x0 [0179.346] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ddff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ddff500) returned 0x0 [0179.346] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.346] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ddff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ddff500) returned 0x0 [0179.350] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.352] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.352] WriteFile (in: hFile=0x1e24, lpBuffer=0x2ddffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddff830, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesWritten=0x2ddff830*=0x428, lpOverlapped=0x0) returned 1 [0179.352] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.352] ReadFile (in: hFile=0x1e24, lpBuffer=0x3750000, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2ddff61c*=0x1b6c, lpOverlapped=0x0) returned 1 [0179.353] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xffffe494, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.353] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3750000, cbInput=0x1b6c, pPaddingInfo=0x0, pbIV=0x2ddff848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2ddff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2ddff848, pbOutput=0x3750000, pcbResult=0x2ddff618) returned 0x0 [0179.353] WriteFile (in: hFile=0x1e24, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2ddff61c*=0x1b70, lpOverlapped=0x0) returned 1 [0179.354] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddff60c | out: lpNewFilePointer=0x0) returned 1 [0179.354] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.354] WriteFile (in: hFile=0x1e24, lpBuffer=0x2ddff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddff83c*, lpNumberOfBytesWritten=0x2ddff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.354] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x1b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.354] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.354] CloseHandle (hObject=0x1e24) returned 1 [0179.354] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.play")) returned 1 [0179.357] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2701 os_tid = 0x2890 [0179.361] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.361] ReadFile (in: hFile=0x1e2c, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.362] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.362] ReadFile (in: hFile=0x1e2c, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.362] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.364] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.364] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2df3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0179.364] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2df3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2df3f828, pbKeyObject=0x0) returned 0x0 [0179.364] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2df3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2df3f500) returned 0x0 [0179.365] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.365] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2df3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2df3f500) returned 0x0 [0179.368] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.371] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.371] WriteFile (in: hFile=0x1e2c, lpBuffer=0x2df3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2df3f830, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesWritten=0x2df3f830*=0x428, lpOverlapped=0x0) returned 1 [0179.371] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.371] ReadFile (in: hFile=0x1e2c, lpBuffer=0x3850000, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2df3f61c*=0x1ec4, lpOverlapped=0x0) returned 1 [0179.373] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0xffffe13c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.373] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3850000, cbInput=0x1ec4, pPaddingInfo=0x0, pbIV=0x2df3f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2df3f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2df3f848, pbOutput=0x3850000, pcbResult=0x2df3f618) returned 0x0 [0179.373] WriteFile (in: hFile=0x1e2c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2df3f61c*=0x1ed0, lpOverlapped=0x0) returned 1 [0179.373] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2df3f60c | out: lpNewFilePointer=0x0) returned 1 [0179.373] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.374] WriteFile (in: hFile=0x1e2c, lpBuffer=0x2df3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2df3f83c*, lpNumberOfBytesWritten=0x2df3f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.374] SetFilePointerEx (in: hFile=0x1e2c, liDistanceToMove=0x1ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.374] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.374] CloseHandle (hObject=0x1e2c) returned 1 [0179.374] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.play")) returned 1 [0179.377] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2702 os_tid = 0x2894 [0179.381] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.381] ReadFile (in: hFile=0x1e34, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.383] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.383] ReadFile (in: hFile=0x1e34, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.383] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.385] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.385] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0179.385] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e07f828, pbKeyObject=0x0) returned 0x0 [0179.385] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e07f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e07f500) returned 0x0 [0179.385] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.386] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e07f500) returned 0x0 [0179.389] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.391] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.391] WriteFile (in: hFile=0x1e34, lpBuffer=0x2e07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e07f830, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesWritten=0x2e07f830*=0x428, lpOverlapped=0x0) returned 1 [0179.391] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.391] ReadFile (in: hFile=0x1e34, lpBuffer=0x3950000, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e07f61c*=0x3a28, lpOverlapped=0x0) returned 1 [0179.392] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xffffc5d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.392] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3950000, cbInput=0x3a28, pPaddingInfo=0x0, pbIV=0x2e07f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e07f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e07f848, pbOutput=0x3950000, pcbResult=0x2e07f618) returned 0x0 [0179.392] WriteFile (in: hFile=0x1e34, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e07f61c*=0x3a30, lpOverlapped=0x0) returned 1 [0179.392] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e07f60c | out: lpNewFilePointer=0x0) returned 1 [0179.392] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.392] WriteFile (in: hFile=0x1e34, lpBuffer=0x2e07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e07f83c*, lpNumberOfBytesWritten=0x2e07f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.392] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x3a30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.393] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.393] CloseHandle (hObject=0x1e34) returned 1 [0179.393] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.play")) returned 1 [0179.396] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2703 os_tid = 0x2898 [0179.399] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.399] ReadFile (in: hFile=0x1e3c, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.401] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.401] ReadFile (in: hFile=0x1e3c, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.401] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.403] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.403] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0179.403] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e1bf828, pbKeyObject=0x0) returned 0x0 [0179.403] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e1bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e1bf500) returned 0x0 [0179.403] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.403] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e1bf500) returned 0x0 [0179.407] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.410] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.410] WriteFile (in: hFile=0x1e3c, lpBuffer=0x2e1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesWritten=0x2e1bf830*=0x428, lpOverlapped=0x0) returned 1 [0179.410] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.410] ReadFile (in: hFile=0x1e3c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e1bf61c*=0x2370, lpOverlapped=0x0) returned 1 [0179.411] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xffffdc90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.411] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3a50000, cbInput=0x2370, pPaddingInfo=0x0, pbIV=0x2e1bf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e1bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e1bf848, pbOutput=0x3a50000, pcbResult=0x2e1bf618) returned 0x0 [0179.411] WriteFile (in: hFile=0x1e3c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e1bf61c*=0x2380, lpOverlapped=0x0) returned 1 [0179.411] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1bf60c | out: lpNewFilePointer=0x0) returned 1 [0179.411] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.411] WriteFile (in: hFile=0x1e3c, lpBuffer=0x2e1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bf83c*, lpNumberOfBytesWritten=0x2e1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.411] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x2380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.411] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.411] CloseHandle (hObject=0x1e3c) returned 1 [0179.412] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.play")) returned 1 [0179.416] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2704 os_tid = 0x289c [0179.419] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.419] ReadFile (in: hFile=0x1e44, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.420] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.421] ReadFile (in: hFile=0x1e44, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.421] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.423] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.423] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0179.423] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e2ff828, pbKeyObject=0x0) returned 0x0 [0179.423] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e2ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e2ff500) returned 0x0 [0179.423] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.423] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e2ff500) returned 0x0 [0179.426] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.429] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.429] WriteFile (in: hFile=0x1e44, lpBuffer=0x2e2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesWritten=0x2e2ff830*=0x428, lpOverlapped=0x0) returned 1 [0179.429] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.429] ReadFile (in: hFile=0x1e44, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e2ff61c*=0x1b2c, lpOverlapped=0x0) returned 1 [0179.430] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0xffffe4d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.430] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3b50000, cbInput=0x1b2c, pPaddingInfo=0x0, pbIV=0x2e2ff848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e2ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e2ff848, pbOutput=0x3b50000, pcbResult=0x2e2ff618) returned 0x0 [0179.430] WriteFile (in: hFile=0x1e44, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e2ff61c*=0x1b30, lpOverlapped=0x0) returned 1 [0179.430] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2ff60c | out: lpNewFilePointer=0x0) returned 1 [0179.430] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.430] WriteFile (in: hFile=0x1e44, lpBuffer=0x2e2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ff83c*, lpNumberOfBytesWritten=0x2e2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.430] SetFilePointerEx (in: hFile=0x1e44, liDistanceToMove=0x1b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.430] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.430] CloseHandle (hObject=0x1e44) returned 1 [0179.431] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.play")) returned 1 [0179.434] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2705 os_tid = 0x28a0 [0179.437] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.437] ReadFile (in: hFile=0x1e4c, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.439] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.441] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.441] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2e43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0179.441] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2e43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2e43f828, pbKeyObject=0x0) returned 0x0 [0179.441] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e43f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e43f500) returned 0x0 [0179.441] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.441] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e43f500) returned 0x0 [0179.445] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.447] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.447] WriteFile (in: hFile=0x1e4c, lpBuffer=0x2e43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e43f830, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesWritten=0x2e43f830*=0x428, lpOverlapped=0x0) returned 1 [0179.447] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.447] ReadFile (in: hFile=0x1e4c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2e43f61c*=0x794, lpOverlapped=0x0) returned 1 [0179.447] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xfffff86c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.448] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3c50000, cbInput=0x794, pPaddingInfo=0x0, pbIV=0x2e43f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2e43f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e43f848, pbOutput=0x3c50000, pcbResult=0x2e43f618) returned 0x0 [0179.448] WriteFile (in: hFile=0x1e4c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2e43f61c*=0x7a0, lpOverlapped=0x0) returned 1 [0179.448] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e43f60c | out: lpNewFilePointer=0x0) returned 1 [0179.448] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.448] WriteFile (in: hFile=0x1e4c, lpBuffer=0x2e43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f83c*, lpNumberOfBytesWritten=0x2e43f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.448] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0x7a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.448] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.448] CloseHandle (hObject=0x1e4c) returned 1 [0179.448] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.450] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.play")) returned 1 [0179.451] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2706 os_tid = 0x28a4 [0179.456] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.456] ReadFile (in: hFile=0x1e54, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.457] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.458] ReadFile (in: hFile=0x1e54, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.458] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.459] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.460] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0179.460] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e57f828, pbKeyObject=0x0) returned 0x0 [0179.460] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e57f500) returned 0x0 [0179.460] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.460] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e57f500) returned 0x0 [0179.463] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.465] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.465] WriteFile (in: hFile=0x1e54, lpBuffer=0x2e57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e57f830, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesWritten=0x2e57f830*=0x428, lpOverlapped=0x0) returned 1 [0179.466] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.466] ReadFile (in: hFile=0x1e54, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e57f61c*=0x29ac, lpOverlapped=0x0) returned 1 [0179.466] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0xffffd654, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.466] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3d50000, cbInput=0x29ac, pPaddingInfo=0x0, pbIV=0x2e57f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e57f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e57f848, pbOutput=0x3d50000, pcbResult=0x2e57f618) returned 0x0 [0179.466] WriteFile (in: hFile=0x1e54, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e57f61c*=0x29b0, lpOverlapped=0x0) returned 1 [0179.467] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e57f60c | out: lpNewFilePointer=0x0) returned 1 [0179.467] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.467] WriteFile (in: hFile=0x1e54, lpBuffer=0x2e57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e57f83c*, lpNumberOfBytesWritten=0x2e57f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.467] SetFilePointerEx (in: hFile=0x1e54, liDistanceToMove=0x29b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.467] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.467] CloseHandle (hObject=0x1e54) returned 1 [0179.467] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.play")) returned 1 [0179.470] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2707 os_tid = 0x28a8 [0179.474] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.474] ReadFile (in: hFile=0x1e5c, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.475] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.475] ReadFile (in: hFile=0x1e5c, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.475] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.477] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.478] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0179.478] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0179.478] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0179.478] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.478] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0179.481] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.484] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.484] WriteFile (in: hFile=0x1e5c, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0179.485] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.485] ReadFile (in: hFile=0x1e5c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2e6bf61c*=0x2c54, lpOverlapped=0x0) returned 1 [0179.486] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xffffd3ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.486] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3e50000, cbInput=0x2c54, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e6bf848, pbOutput=0x3e50000, pcbResult=0x2e6bf618) returned 0x0 [0179.486] WriteFile (in: hFile=0x1e5c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x2c60, lpOverlapped=0x0) returned 1 [0179.486] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0179.486] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.487] WriteFile (in: hFile=0x1e5c, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.487] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x2c60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.487] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.487] CloseHandle (hObject=0x1e5c) returned 1 [0179.487] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.play")) returned 1 [0179.490] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2708 os_tid = 0x28ac [0179.495] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.495] ReadFile (in: hFile=0x1e64, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.496] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.496] ReadFile (in: hFile=0x1e64, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.496] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.498] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.499] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2e7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0179.499] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2e7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2e7ff828, pbKeyObject=0x0) returned 0x0 [0179.499] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0179.499] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.499] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0179.502] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.505] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.505] WriteFile (in: hFile=0x1e64, lpBuffer=0x2e7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesWritten=0x2e7ff830*=0x428, lpOverlapped=0x0) returned 1 [0179.505] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.505] ReadFile (in: hFile=0x1e64, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2e7ff61c*=0x1190, lpOverlapped=0x0) returned 1 [0179.505] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0xffffee70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.505] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x3f50000, cbInput=0x1190, pPaddingInfo=0x0, pbIV=0x2e7ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2e7ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e7ff848, pbOutput=0x3f50000, pcbResult=0x2e7ff618) returned 0x0 [0179.505] WriteFile (in: hFile=0x1e64, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2e7ff61c*=0x11a0, lpOverlapped=0x0) returned 1 [0179.505] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7ff60c | out: lpNewFilePointer=0x0) returned 1 [0179.505] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.506] WriteFile (in: hFile=0x1e64, lpBuffer=0x2e7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ff83c*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.506] SetFilePointerEx (in: hFile=0x1e64, liDistanceToMove=0x11a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.506] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.506] CloseHandle (hObject=0x1e64) returned 1 [0179.506] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.508] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.play")) returned 1 [0179.509] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2709 os_tid = 0x28b0 [0179.512] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.513] ReadFile (in: hFile=0x1e6c, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.514] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.514] ReadFile (in: hFile=0x1e6c, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.514] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.516] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.516] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2e93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0179.516] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2e93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2e93f828, pbKeyObject=0x0) returned 0x0 [0179.516] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0179.516] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.516] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0179.520] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.522] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.522] WriteFile (in: hFile=0x1e6c, lpBuffer=0x2e93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e93f830, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesWritten=0x2e93f830*=0x428, lpOverlapped=0x0) returned 1 [0179.522] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.522] ReadFile (in: hFile=0x1e6c, lpBuffer=0x4050000, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2e93f61c*=0x812c, lpOverlapped=0x0) returned 1 [0179.523] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xffff7ed4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.523] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4050000, cbInput=0x812c, pPaddingInfo=0x0, pbIV=0x2e93f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2e93f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2e93f848, pbOutput=0x4050000, pcbResult=0x2e93f618) returned 0x0 [0179.523] WriteFile (in: hFile=0x1e6c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2e93f61c*=0x8130, lpOverlapped=0x0) returned 1 [0179.523] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93f60c | out: lpNewFilePointer=0x0) returned 1 [0179.523] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.524] WriteFile (in: hFile=0x1e6c, lpBuffer=0x2e93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e93f83c*, lpNumberOfBytesWritten=0x2e93f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.524] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x8130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.524] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.524] CloseHandle (hObject=0x1e6c) returned 1 [0179.524] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.play")) returned 1 [0179.528] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2710 os_tid = 0x28b4 [0179.537] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.537] ReadFile (in: hFile=0x1e00, lpBuffer=0x14bcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14bcf85c, lpOverlapped=0x0 | out: lpBuffer=0x14bcfb34*, lpNumberOfBytesRead=0x14bcf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.538] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.541] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.541] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x14bcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0179.541] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x14bcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x14bcf828, pbKeyObject=0x0) returned 0x0 [0179.541] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x14bcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x14bcf500) returned 0x0 [0179.541] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.541] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x14bcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x14bcf500) returned 0x0 [0179.545] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.547] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.547] WriteFile (in: hFile=0x1e00, lpBuffer=0x14bcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14bcf830, lpOverlapped=0x0 | out: lpBuffer=0x14bcfb34*, lpNumberOfBytesWritten=0x14bcf830*=0x428, lpOverlapped=0x0) returned 1 [0179.548] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.548] ReadFile (in: hFile=0x1e00, lpBuffer=0x4150000, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x14bcf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x14bcf61c*=0x778, lpOverlapped=0x0) returned 1 [0179.548] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0xfffff888, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.548] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4150000, cbInput=0x778, pPaddingInfo=0x0, pbIV=0x14bcf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x14bcf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x14bcf848, pbOutput=0x4150000, pcbResult=0x14bcf618) returned 0x0 [0179.548] WriteFile (in: hFile=0x1e00, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x14bcf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x14bcf61c*=0x780, lpOverlapped=0x0) returned 1 [0179.548] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14bcf60c | out: lpNewFilePointer=0x0) returned 1 [0179.548] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.548] WriteFile (in: hFile=0x1e00, lpBuffer=0x14bcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14bcf61c, lpOverlapped=0x0 | out: lpBuffer=0x14bcf83c*, lpNumberOfBytesWritten=0x14bcf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.548] SetFilePointerEx (in: hFile=0x1e00, liDistanceToMove=0x780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.548] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.548] CloseHandle (hObject=0x1e00) returned 1 [0179.548] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.play")) returned 1 [0179.552] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2711 os_tid = 0x28b8 [0179.555] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.555] ReadFile (in: hFile=0x1e94, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.557] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.557] ReadFile (in: hFile=0x1e94, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.557] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.559] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.559] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x2ea7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0179.559] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x2ea7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x2ea7f828, pbKeyObject=0x0) returned 0x0 [0179.559] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ea7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0179.559] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.560] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ea7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0179.563] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.566] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.566] WriteFile (in: hFile=0x1e94, lpBuffer=0x2ea7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ea7f830, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesWritten=0x2ea7f830*=0x428, lpOverlapped=0x0) returned 1 [0179.566] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.566] ReadFile (in: hFile=0x1e94, lpBuffer=0x4250000, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x2ea7f61c*=0x1ea8, lpOverlapped=0x0) returned 1 [0179.567] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xffffe158, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.567] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4250000, cbInput=0x1ea8, pPaddingInfo=0x0, pbIV=0x2ea7f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x2ea7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x2ea7f848, pbOutput=0x4250000, pcbResult=0x2ea7f618) returned 0x0 [0179.567] WriteFile (in: hFile=0x1e94, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x2ea7f61c*=0x1eb0, lpOverlapped=0x0) returned 1 [0179.567] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea7f60c | out: lpNewFilePointer=0x0) returned 1 [0179.567] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.567] WriteFile (in: hFile=0x1e94, lpBuffer=0x2ea7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7f83c*, lpNumberOfBytesWritten=0x2ea7f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.567] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x1eb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.567] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.567] CloseHandle (hObject=0x1e94) returned 1 [0179.567] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.play")) returned 1 [0179.571] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2712 os_tid = 0x28bc [0179.575] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.576] ReadFile (in: hFile=0x1e9c, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.577] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.577] ReadFile (in: hFile=0x1e9c, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.577] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.579] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.579] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x30bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0179.579] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x30bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x30bbf828, pbKeyObject=0x0) returned 0x0 [0179.579] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30bbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0179.579] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.580] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0179.583] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.585] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.585] WriteFile (in: hFile=0x1e9c, lpBuffer=0x30bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bbf830, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesWritten=0x30bbf830*=0x428, lpOverlapped=0x0) returned 1 [0179.586] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.586] ReadFile (in: hFile=0x1e9c, lpBuffer=0x4350000, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x30bbf61c*=0x1fc8, lpOverlapped=0x0) returned 1 [0179.591] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0xffffe038, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.591] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4350000, cbInput=0x1fc8, pPaddingInfo=0x0, pbIV=0x30bbf848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x30bbf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x30bbf848, pbOutput=0x4350000, pcbResult=0x30bbf618) returned 0x0 [0179.591] WriteFile (in: hFile=0x1e9c, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x30bbf61c*=0x1fd0, lpOverlapped=0x0) returned 1 [0179.591] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bbf60c | out: lpNewFilePointer=0x0) returned 1 [0179.591] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.591] WriteFile (in: hFile=0x1e9c, lpBuffer=0x30bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30bbf83c*, lpNumberOfBytesWritten=0x30bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.591] SetFilePointerEx (in: hFile=0x1e9c, liDistanceToMove=0x1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.591] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.591] CloseHandle (hObject=0x1e9c) returned 1 [0179.591] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.play")) returned 1 [0179.595] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2713 os_tid = 0x28c0 [0179.599] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.599] ReadFile (in: hFile=0x1ea4, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.651] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.652] ReadFile (in: hFile=0x1ea4, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.652] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.654] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.654] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x30cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0179.655] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x30cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x30cbf828, pbKeyObject=0x0) returned 0x0 [0179.655] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30cbf500) returned 0x0 [0179.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.655] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30cbf500) returned 0x0 [0179.658] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.661] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.661] WriteFile (in: hFile=0x1ea4, lpBuffer=0x30cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30cbf830, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesWritten=0x30cbf830*=0x428, lpOverlapped=0x0) returned 1 [0179.662] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.662] ReadFile (in: hFile=0x1ea4, lpBuffer=0x4450000, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x30cbf61c*=0x22b0, lpOverlapped=0x0) returned 1 [0179.705] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0xffffdd50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.705] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x4450000, cbInput=0x22b0, pPaddingInfo=0x0, pbIV=0x30cbf848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x30cbf618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x30cbf848, pbOutput=0x4450000, pcbResult=0x30cbf618) returned 0x0 [0179.705] WriteFile (in: hFile=0x1ea4, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x30cbf61c*=0x22c0, lpOverlapped=0x0) returned 1 [0179.705] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cbf60c | out: lpNewFilePointer=0x0) returned 1 [0179.705] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.705] WriteFile (in: hFile=0x1ea4, lpBuffer=0x30cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30cbf83c*, lpNumberOfBytesWritten=0x30cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.706] SetFilePointerEx (in: hFile=0x1ea4, liDistanceToMove=0x22c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.706] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0179.706] CloseHandle (hObject=0x1ea4) returned 1 [0179.706] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.play")) returned 1 [0179.709] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2714 os_tid = 0x28c4 [0179.600] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.600] ReadFile (in: hFile=0x1eac, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.662] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.662] ReadFile (in: hFile=0x1eac, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.662] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.664] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.664] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x30dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0179.664] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x30dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x30dbf828, pbKeyObject=0x0) returned 0x0 [0179.664] BCryptExportKey (in: hKey=0x7f4ca0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30dbf500) returned 0x0 [0179.664] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.664] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30dbf500) returned 0x0 [0179.668] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.670] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.670] WriteFile (in: hFile=0x1eac, lpBuffer=0x30dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30dbf830, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesWritten=0x30dbf830*=0x428, lpOverlapped=0x0) returned 1 [0179.671] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.671] ReadFile (in: hFile=0x1eac, lpBuffer=0x4550000, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x30dbf61c*=0xe78, lpOverlapped=0x0) returned 1 [0179.671] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0xfffff188, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.671] BCryptEncrypt (in: hKey=0x7f4ca0, pbInput=0x4550000, cbInput=0xe78, pPaddingInfo=0x0, pbIV=0x30dbf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x30dbf618, dwFlags=0x1 | out: hKey=0x7f4ca0, pbIV=0x30dbf848, pbOutput=0x4550000, pcbResult=0x30dbf618) returned 0x0 [0179.671] WriteFile (in: hFile=0x1eac, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x30dbf61c*=0xe80, lpOverlapped=0x0) returned 1 [0179.671] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dbf60c | out: lpNewFilePointer=0x0) returned 1 [0179.671] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.671] WriteFile (in: hFile=0x1eac, lpBuffer=0x30dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30dbf83c*, lpNumberOfBytesWritten=0x30dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.671] SetFilePointerEx (in: hFile=0x1eac, liDistanceToMove=0xe80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.671] BCryptDestroyKey (in: hKey=0x7f4ca0 | out: hKey=0x7f4ca0) returned 0x0 [0179.671] CloseHandle (hObject=0x1eac) returned 1 [0179.671] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.play")) returned 1 [0179.675] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2715 os_tid = 0x28c8 [0179.602] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.602] ReadFile (in: hFile=0x1eb4, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.603] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.604] ReadFile (in: hFile=0x1eb4, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.604] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.606] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.606] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x30ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0179.606] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x30ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x30ebf828, pbKeyObject=0x0) returned 0x0 [0179.606] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30ebf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30ebf500) returned 0x0 [0179.606] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.606] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30ebf500) returned 0x0 [0179.610] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.612] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.613] WriteFile (in: hFile=0x1eb4, lpBuffer=0x30ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30ebf830, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesWritten=0x30ebf830*=0x428, lpOverlapped=0x0) returned 1 [0179.613] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.613] ReadFile (in: hFile=0x1eb4, lpBuffer=0x4650000, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x30ebf61c*=0xbc0, lpOverlapped=0x0) returned 1 [0179.613] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xfffff440, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.613] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4650000, cbInput=0xbc0, pPaddingInfo=0x0, pbIV=0x30ebf848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x30ebf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x30ebf848, pbOutput=0x4650000, pcbResult=0x30ebf618) returned 0x0 [0179.613] WriteFile (in: hFile=0x1eb4, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x30ebf61c*=0xbd0, lpOverlapped=0x0) returned 1 [0179.613] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ebf60c | out: lpNewFilePointer=0x0) returned 1 [0179.613] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.613] WriteFile (in: hFile=0x1eb4, lpBuffer=0x30ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x30ebf83c*, lpNumberOfBytesWritten=0x30ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.613] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xbd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.613] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.613] CloseHandle (hObject=0x1eb4) returned 1 [0179.614] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.play")) returned 1 [0179.617] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2716 os_tid = 0x28cc [0179.621] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.621] ReadFile (in: hFile=0x1ebc, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.696] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.696] ReadFile (in: hFile=0x1ebc, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.696] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.698] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.698] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x30fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0179.698] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x30fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x30fff828, pbKeyObject=0x0) returned 0x0 [0179.698] BCryptExportKey (in: hKey=0x7f4ca0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30fff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30fff500) returned 0x0 [0179.698] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.698] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30fff500) returned 0x0 [0179.702] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.704] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.704] WriteFile (in: hFile=0x1ebc, lpBuffer=0x30fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30fff830, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesWritten=0x30fff830*=0x428, lpOverlapped=0x0) returned 1 [0179.704] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.704] ReadFile (in: hFile=0x1ebc, lpBuffer=0x4750000, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x30fff61c*=0x4e80, lpOverlapped=0x0) returned 1 [0179.720] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0xffffb180, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.720] BCryptEncrypt (in: hKey=0x7f4ca0, pbInput=0x4750000, cbInput=0x4e80, pPaddingInfo=0x0, pbIV=0x30fff848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x30fff618, dwFlags=0x1 | out: hKey=0x7f4ca0, pbIV=0x30fff848, pbOutput=0x4750000, pcbResult=0x30fff618) returned 0x0 [0179.720] WriteFile (in: hFile=0x1ebc, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x30fff61c*=0x4e90, lpOverlapped=0x0) returned 1 [0179.720] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30fff60c | out: lpNewFilePointer=0x0) returned 1 [0179.720] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.720] WriteFile (in: hFile=0x1ebc, lpBuffer=0x30fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x30fff83c*, lpNumberOfBytesWritten=0x30fff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.720] SetFilePointerEx (in: hFile=0x1ebc, liDistanceToMove=0x4e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.720] BCryptDestroyKey (in: hKey=0x7f4ca0 | out: hKey=0x7f4ca0) returned 0x0 [0179.720] CloseHandle (hObject=0x1ebc) returned 1 [0179.720] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.play")) returned 1 [0179.723] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2717 os_tid = 0x28d0 [0179.622] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.622] ReadFile (in: hFile=0x1ec4, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.686] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.686] ReadFile (in: hFile=0x1ec4, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.688] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.688] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x3113f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0179.688] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x3113f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x3113f828, pbKeyObject=0x0) returned 0x0 [0179.688] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3113f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3113f500) returned 0x0 [0179.688] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.688] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3113f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3113f500) returned 0x0 [0179.692] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.694] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.694] WriteFile (in: hFile=0x1ec4, lpBuffer=0x3113fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3113f830, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesWritten=0x3113f830*=0x428, lpOverlapped=0x0) returned 1 [0179.694] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.694] ReadFile (in: hFile=0x1ec4, lpBuffer=0x4850000, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x3113f61c*=0x8f0c, lpOverlapped=0x0) returned 1 [0179.712] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xffff70f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.712] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4850000, cbInput=0x8f0c, pPaddingInfo=0x0, pbIV=0x3113f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x3113f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3113f848, pbOutput=0x4850000, pcbResult=0x3113f618) returned 0x0 [0179.713] WriteFile (in: hFile=0x1ec4, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x3113f61c*=0x8f10, lpOverlapped=0x0) returned 1 [0179.713] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3113f60c | out: lpNewFilePointer=0x0) returned 1 [0179.713] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.713] WriteFile (in: hFile=0x1ec4, lpBuffer=0x3113f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x3113f83c*, lpNumberOfBytesWritten=0x3113f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.713] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x8f10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.713] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.713] CloseHandle (hObject=0x1ec4) returned 1 [0179.713] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.715] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.play")) returned 1 [0179.716] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2718 os_tid = 0x28d4 [0179.623] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.623] ReadFile (in: hFile=0x1ecc, lpBuffer=0x3127fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3127f85c, lpOverlapped=0x0 | out: lpBuffer=0x3127fb34*, lpNumberOfBytesRead=0x3127f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.625] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.625] ReadFile (in: hFile=0x1ecc, lpBuffer=0x3127fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3127f85c, lpOverlapped=0x0 | out: lpBuffer=0x3127fb34*, lpNumberOfBytesRead=0x3127f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.625] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.627] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x3127f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0179.627] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x3127f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x3127f828, pbKeyObject=0x0) returned 0x0 [0179.627] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3127f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3127f500) returned 0x0 [0179.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.628] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3127f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3127f500) returned 0x0 [0179.631] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.636] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.636] WriteFile (in: hFile=0x1ecc, lpBuffer=0x3127fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3127f830, lpOverlapped=0x0 | out: lpBuffer=0x3127fb34*, lpNumberOfBytesWritten=0x3127f830*=0x428, lpOverlapped=0x0) returned 1 [0179.637] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.637] ReadFile (in: hFile=0x1ecc, lpBuffer=0x4950000, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x3127f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x3127f61c*=0x7850, lpOverlapped=0x0) returned 1 [0179.678] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xffff87b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.678] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4950000, cbInput=0x7850, pPaddingInfo=0x0, pbIV=0x3127f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x3127f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3127f848, pbOutput=0x4950000, pcbResult=0x3127f618) returned 0x0 [0179.678] WriteFile (in: hFile=0x1ecc, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x3127f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x3127f61c*=0x7860, lpOverlapped=0x0) returned 1 [0179.679] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3127f60c | out: lpNewFilePointer=0x0) returned 1 [0179.679] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.679] WriteFile (in: hFile=0x1ecc, lpBuffer=0x3127f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3127f61c, lpOverlapped=0x0 | out: lpBuffer=0x3127f83c*, lpNumberOfBytesWritten=0x3127f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.679] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x7860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.679] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.679] CloseHandle (hObject=0x1ecc) returned 1 [0179.679] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.play")) returned 1 [0179.683] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2719 os_tid = 0x28d8 [0179.727] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.727] ReadFile (in: hFile=0x1ed4, lpBuffer=0x313bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x313bf85c, lpOverlapped=0x0 | out: lpBuffer=0x313bfb34*, lpNumberOfBytesRead=0x313bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.730] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.730] ReadFile (in: hFile=0x1ed4, lpBuffer=0x313bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x313bf85c, lpOverlapped=0x0 | out: lpBuffer=0x313bfb34*, lpNumberOfBytesRead=0x313bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.731] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.733] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.733] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x313bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0179.733] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x313bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x313bf828, pbKeyObject=0x0) returned 0x0 [0179.733] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x313bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x313bf500) returned 0x0 [0179.733] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.733] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x313bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x313bf500) returned 0x0 [0179.737] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.739] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.739] WriteFile (in: hFile=0x1ed4, lpBuffer=0x313bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x313bf830, lpOverlapped=0x0 | out: lpBuffer=0x313bfb34*, lpNumberOfBytesWritten=0x313bf830*=0x428, lpOverlapped=0x0) returned 1 [0179.740] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.740] ReadFile (in: hFile=0x1ed4, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x313bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x313bf61c*=0x9658, lpOverlapped=0x0) returned 1 [0179.740] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xffff69a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.741] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4a50000, cbInput=0x9658, pPaddingInfo=0x0, pbIV=0x313bf848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x313bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x313bf848, pbOutput=0x4a50000, pcbResult=0x313bf618) returned 0x0 [0179.741] WriteFile (in: hFile=0x1ed4, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x313bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x313bf61c*=0x9660, lpOverlapped=0x0) returned 1 [0179.741] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313bf60c | out: lpNewFilePointer=0x0) returned 1 [0179.741] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.741] WriteFile (in: hFile=0x1ed4, lpBuffer=0x313bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x313bf61c, lpOverlapped=0x0 | out: lpBuffer=0x313bf83c*, lpNumberOfBytesWritten=0x313bf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.741] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x9660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.741] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.741] CloseHandle (hObject=0x1ed4) returned 1 [0179.742] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.744] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.play")) returned 1 [0179.745] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2720 os_tid = 0x28dc [0179.748] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.749] ReadFile (in: hFile=0x1edc, lpBuffer=0x314ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314ff85c, lpOverlapped=0x0 | out: lpBuffer=0x314ffb34*, lpNumberOfBytesRead=0x314ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.750] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.750] ReadFile (in: hFile=0x1edc, lpBuffer=0x314ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x314ff85c, lpOverlapped=0x0 | out: lpBuffer=0x314ffb34*, lpNumberOfBytesRead=0x314ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.750] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.752] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.752] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x314ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0179.752] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x314ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x314ff828, pbKeyObject=0x0) returned 0x0 [0179.752] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x314ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x314ff500) returned 0x0 [0179.753] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.753] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x314ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x314ff500) returned 0x0 [0179.756] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.759] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.759] WriteFile (in: hFile=0x1edc, lpBuffer=0x314ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x314ff830, lpOverlapped=0x0 | out: lpBuffer=0x314ffb34*, lpNumberOfBytesWritten=0x314ff830*=0x428, lpOverlapped=0x0) returned 1 [0179.759] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.759] ReadFile (in: hFile=0x1edc, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x314ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x314ff61c*=0x3c58, lpOverlapped=0x0) returned 1 [0179.760] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0xffffc3a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.760] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4b50000, cbInput=0x3c58, pPaddingInfo=0x0, pbIV=0x314ff848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x314ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x314ff848, pbOutput=0x4b50000, pcbResult=0x314ff618) returned 0x0 [0179.760] WriteFile (in: hFile=0x1edc, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x314ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x314ff61c*=0x3c60, lpOverlapped=0x0) returned 1 [0179.760] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314ff60c | out: lpNewFilePointer=0x0) returned 1 [0179.760] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.760] WriteFile (in: hFile=0x1edc, lpBuffer=0x314ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x314ff61c, lpOverlapped=0x0 | out: lpBuffer=0x314ff83c*, lpNumberOfBytesWritten=0x314ff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.761] SetFilePointerEx (in: hFile=0x1edc, liDistanceToMove=0x3c60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.761] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.761] CloseHandle (hObject=0x1edc) returned 1 [0179.761] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.763] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.play")) returned 1 [0179.764] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2721 os_tid = 0x28e0 [0179.767] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.767] ReadFile (in: hFile=0x1ee4, lpBuffer=0x3163fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3163f85c, lpOverlapped=0x0 | out: lpBuffer=0x3163fb34*, lpNumberOfBytesRead=0x3163f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.769] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.769] ReadFile (in: hFile=0x1ee4, lpBuffer=0x3163fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3163f85c, lpOverlapped=0x0 | out: lpBuffer=0x3163fb34*, lpNumberOfBytesRead=0x3163f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.769] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.771] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.771] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x3163f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0179.771] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x3163f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x3163f828, pbKeyObject=0x0) returned 0x0 [0179.771] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3163f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3163f500) returned 0x0 [0179.771] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.772] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3163f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3163f500) returned 0x0 [0179.775] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.778] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.778] WriteFile (in: hFile=0x1ee4, lpBuffer=0x3163fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3163f830, lpOverlapped=0x0 | out: lpBuffer=0x3163fb34*, lpNumberOfBytesWritten=0x3163f830*=0x428, lpOverlapped=0x0) returned 1 [0179.778] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.778] ReadFile (in: hFile=0x1ee4, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x3163f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x3163f61c*=0x4238, lpOverlapped=0x0) returned 1 [0179.779] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xffffbdc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.779] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4c50000, cbInput=0x4238, pPaddingInfo=0x0, pbIV=0x3163f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x3163f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3163f848, pbOutput=0x4c50000, pcbResult=0x3163f618) returned 0x0 [0179.779] WriteFile (in: hFile=0x1ee4, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x3163f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x3163f61c*=0x4240, lpOverlapped=0x0) returned 1 [0179.780] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3163f60c | out: lpNewFilePointer=0x0) returned 1 [0179.780] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.780] WriteFile (in: hFile=0x1ee4, lpBuffer=0x3163f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3163f61c, lpOverlapped=0x0 | out: lpBuffer=0x3163f83c*, lpNumberOfBytesWritten=0x3163f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.780] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x4240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.781] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.781] CloseHandle (hObject=0x1ee4) returned 1 [0179.781] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.play")) returned 1 [0179.784] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2722 os_tid = 0x28e4 [0179.788] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.789] ReadFile (in: hFile=0x1eec, lpBuffer=0x3177fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3177f85c, lpOverlapped=0x0 | out: lpBuffer=0x3177fb34*, lpNumberOfBytesRead=0x3177f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.790] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.790] ReadFile (in: hFile=0x1eec, lpBuffer=0x3177fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3177f85c, lpOverlapped=0x0 | out: lpBuffer=0x3177fb34*, lpNumberOfBytesRead=0x3177f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.791] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.793] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.793] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x3177f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0179.793] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x3177f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x3177f828, pbKeyObject=0x0) returned 0x0 [0179.793] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3177f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3177f500) returned 0x0 [0179.793] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.794] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3177f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3177f500) returned 0x0 [0179.797] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.800] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.800] WriteFile (in: hFile=0x1eec, lpBuffer=0x3177fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3177f830, lpOverlapped=0x0 | out: lpBuffer=0x3177fb34*, lpNumberOfBytesWritten=0x3177f830*=0x428, lpOverlapped=0x0) returned 1 [0179.800] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.800] ReadFile (in: hFile=0x1eec, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x3177f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x3177f61c*=0x4464, lpOverlapped=0x0) returned 1 [0179.802] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0xffffbb9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.802] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4d50000, cbInput=0x4464, pPaddingInfo=0x0, pbIV=0x3177f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x3177f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3177f848, pbOutput=0x4d50000, pcbResult=0x3177f618) returned 0x0 [0179.802] WriteFile (in: hFile=0x1eec, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x3177f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x3177f61c*=0x4470, lpOverlapped=0x0) returned 1 [0179.802] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3177f60c | out: lpNewFilePointer=0x0) returned 1 [0179.802] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.802] WriteFile (in: hFile=0x1eec, lpBuffer=0x3177f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3177f61c, lpOverlapped=0x0 | out: lpBuffer=0x3177f83c*, lpNumberOfBytesWritten=0x3177f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.802] SetFilePointerEx (in: hFile=0x1eec, liDistanceToMove=0x4470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.802] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.802] CloseHandle (hObject=0x1eec) returned 1 [0179.802] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.805] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.play")) returned 1 [0179.806] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2723 os_tid = 0x28e8 [0179.810] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.810] ReadFile (in: hFile=0x1ef4, lpBuffer=0x318bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x318bf85c, lpOverlapped=0x0 | out: lpBuffer=0x318bfb34*, lpNumberOfBytesRead=0x318bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.811] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.811] ReadFile (in: hFile=0x1ef4, lpBuffer=0x318bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x318bf85c, lpOverlapped=0x0 | out: lpBuffer=0x318bfb34*, lpNumberOfBytesRead=0x318bf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.812] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.814] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x318bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0179.814] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x318bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x318bf828, pbKeyObject=0x0) returned 0x0 [0179.814] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x318bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x318bf500) returned 0x0 [0179.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.814] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x318bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x318bf500) returned 0x0 [0179.818] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.821] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.821] WriteFile (in: hFile=0x1ef4, lpBuffer=0x318bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x318bf830, lpOverlapped=0x0 | out: lpBuffer=0x318bfb34*, lpNumberOfBytesWritten=0x318bf830*=0x428, lpOverlapped=0x0) returned 1 [0179.822] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.822] ReadFile (in: hFile=0x1ef4, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x318bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x318bf61c*=0x85d0, lpOverlapped=0x0) returned 1 [0179.823] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0xffff7a30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.823] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4e50000, cbInput=0x85d0, pPaddingInfo=0x0, pbIV=0x318bf848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x318bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x318bf848, pbOutput=0x4e50000, pcbResult=0x318bf618) returned 0x0 [0179.823] WriteFile (in: hFile=0x1ef4, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x318bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x318bf61c*=0x85e0, lpOverlapped=0x0) returned 1 [0179.823] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318bf60c | out: lpNewFilePointer=0x0) returned 1 [0179.823] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.823] WriteFile (in: hFile=0x1ef4, lpBuffer=0x318bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x318bf61c, lpOverlapped=0x0 | out: lpBuffer=0x318bf83c*, lpNumberOfBytesWritten=0x318bf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.823] SetFilePointerEx (in: hFile=0x1ef4, liDistanceToMove=0x85e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.823] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.823] CloseHandle (hObject=0x1ef4) returned 1 [0179.823] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.play")) returned 1 [0179.827] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2724 os_tid = 0x28ec [0179.830] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.830] ReadFile (in: hFile=0x1efc, lpBuffer=0x319ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x319ff85c, lpOverlapped=0x0 | out: lpBuffer=0x319ffb34*, lpNumberOfBytesRead=0x319ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.832] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.832] ReadFile (in: hFile=0x1efc, lpBuffer=0x319ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x319ff85c, lpOverlapped=0x0 | out: lpBuffer=0x319ffb34*, lpNumberOfBytesRead=0x319ff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.832] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.834] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.834] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x319ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0179.834] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x319ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x319ff828, pbKeyObject=0x0) returned 0x0 [0179.834] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x319ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x319ff500) returned 0x0 [0179.834] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.834] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x319ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x319ff500) returned 0x0 [0179.838] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.841] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.841] WriteFile (in: hFile=0x1efc, lpBuffer=0x319ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x319ff830, lpOverlapped=0x0 | out: lpBuffer=0x319ffb34*, lpNumberOfBytesWritten=0x319ff830*=0x428, lpOverlapped=0x0) returned 1 [0179.841] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.841] ReadFile (in: hFile=0x1efc, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x319ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x319ff61c*=0x31d0, lpOverlapped=0x0) returned 1 [0179.842] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0xffffce30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.842] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4f50000, cbInput=0x31d0, pPaddingInfo=0x0, pbIV=0x319ff848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x319ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x319ff848, pbOutput=0x4f50000, pcbResult=0x319ff618) returned 0x0 [0179.842] WriteFile (in: hFile=0x1efc, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x319ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x319ff61c*=0x31e0, lpOverlapped=0x0) returned 1 [0179.842] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319ff60c | out: lpNewFilePointer=0x0) returned 1 [0179.842] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.842] WriteFile (in: hFile=0x1efc, lpBuffer=0x319ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x319ff61c, lpOverlapped=0x0 | out: lpBuffer=0x319ff83c*, lpNumberOfBytesWritten=0x319ff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.842] SetFilePointerEx (in: hFile=0x1efc, liDistanceToMove=0x31e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.842] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.843] CloseHandle (hObject=0x1efc) returned 1 [0179.843] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.play")) returned 1 [0179.846] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2725 os_tid = 0x28f0 [0179.849] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.849] ReadFile (in: hFile=0x1f04, lpBuffer=0x31b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31b3fb34*, lpNumberOfBytesRead=0x31b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.851] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.851] ReadFile (in: hFile=0x1f04, lpBuffer=0x31b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x31b3fb34*, lpNumberOfBytesRead=0x31b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.851] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.854] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.854] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x31b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0179.854] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x31b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x31b3f828, pbKeyObject=0x0) returned 0x0 [0179.854] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x31b3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x31b3f500) returned 0x0 [0179.854] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.854] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x31b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x31b3f500) returned 0x0 [0179.857] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.860] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.860] WriteFile (in: hFile=0x1f04, lpBuffer=0x31b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31b3f830, lpOverlapped=0x0 | out: lpBuffer=0x31b3fb34*, lpNumberOfBytesWritten=0x31b3f830*=0x428, lpOverlapped=0x0) returned 1 [0179.860] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.861] ReadFile (in: hFile=0x1f04, lpBuffer=0x5050000, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x31b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x31b3f61c*=0x1d08, lpOverlapped=0x0) returned 1 [0179.861] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xffffe2f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.861] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5050000, cbInput=0x1d08, pPaddingInfo=0x0, pbIV=0x31b3f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x31b3f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x31b3f848, pbOutput=0x5050000, pcbResult=0x31b3f618) returned 0x0 [0179.861] WriteFile (in: hFile=0x1f04, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x31b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x31b3f61c*=0x1d10, lpOverlapped=0x0) returned 1 [0179.861] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31b3f60c | out: lpNewFilePointer=0x0) returned 1 [0179.862] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.862] WriteFile (in: hFile=0x1f04, lpBuffer=0x31b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x31b3f83c*, lpNumberOfBytesWritten=0x31b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.862] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x1d10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.862] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.862] CloseHandle (hObject=0x1f04) returned 1 [0179.862] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.play")) returned 1 [0179.865] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2726 os_tid = 0x28f4 [0179.878] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.879] ReadFile (in: hFile=0x1f0c, lpBuffer=0x31c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31c7fb34*, lpNumberOfBytesRead=0x31c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.883] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.883] ReadFile (in: hFile=0x1f0c, lpBuffer=0x31c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x31c7fb34*, lpNumberOfBytesRead=0x31c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.883] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.886] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.886] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x31c7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0179.886] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x31c7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x31c7f828, pbKeyObject=0x0) returned 0x0 [0179.886] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x31c7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x31c7f500) returned 0x0 [0179.886] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.886] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x31c7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x31c7f500) returned 0x0 [0179.889] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.892] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.892] WriteFile (in: hFile=0x1f0c, lpBuffer=0x31c7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31c7f830, lpOverlapped=0x0 | out: lpBuffer=0x31c7fb34*, lpNumberOfBytesWritten=0x31c7f830*=0x428, lpOverlapped=0x0) returned 1 [0179.893] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.893] ReadFile (in: hFile=0x1f0c, lpBuffer=0x5150000, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x31c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x31c7f61c*=0x30f0, lpOverlapped=0x0) returned 1 [0179.893] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0xffffcf10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.893] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5150000, cbInput=0x30f0, pPaddingInfo=0x0, pbIV=0x31c7f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x31c7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x31c7f848, pbOutput=0x5150000, pcbResult=0x31c7f618) returned 0x0 [0179.893] WriteFile (in: hFile=0x1f0c, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x31c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x31c7f61c*=0x3100, lpOverlapped=0x0) returned 1 [0179.894] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31c7f60c | out: lpNewFilePointer=0x0) returned 1 [0179.894] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.894] WriteFile (in: hFile=0x1f0c, lpBuffer=0x31c7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x31c7f83c*, lpNumberOfBytesWritten=0x31c7f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.894] SetFilePointerEx (in: hFile=0x1f0c, liDistanceToMove=0x3100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.894] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.894] CloseHandle (hObject=0x1f0c) returned 1 [0179.894] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.play")) returned 1 [0179.898] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2727 os_tid = 0x28f8 [0179.902] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.902] ReadFile (in: hFile=0x1f14, lpBuffer=0x31dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x31dbfb34*, lpNumberOfBytesRead=0x31dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0179.904] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.907] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.907] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x31dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0179.907] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x31dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x31dbf828, pbKeyObject=0x0) returned 0x0 [0179.907] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x31dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x31dbf500) returned 0x0 [0179.907] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.908] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x31dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x31dbf500) returned 0x0 [0179.911] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.914] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.914] WriteFile (in: hFile=0x1f14, lpBuffer=0x31dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31dbf830, lpOverlapped=0x0 | out: lpBuffer=0x31dbfb34*, lpNumberOfBytesWritten=0x31dbf830*=0x428, lpOverlapped=0x0) returned 1 [0179.914] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.914] ReadFile (in: hFile=0x1f14, lpBuffer=0x5250000, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x31dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x31dbf61c*=0x560, lpOverlapped=0x0) returned 1 [0179.914] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.914] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5250000, cbInput=0x560, pPaddingInfo=0x0, pbIV=0x31dbf848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x31dbf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x31dbf848, pbOutput=0x5250000, pcbResult=0x31dbf618) returned 0x0 [0179.914] WriteFile (in: hFile=0x1f14, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x31dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x31dbf61c*=0x570, lpOverlapped=0x0) returned 1 [0179.914] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31dbf60c | out: lpNewFilePointer=0x0) returned 1 [0179.914] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.914] WriteFile (in: hFile=0x1f14, lpBuffer=0x31dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x31dbf83c*, lpNumberOfBytesWritten=0x31dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0179.914] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.914] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.915] CloseHandle (hObject=0x1f14) returned 1 [0179.915] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.play")) returned 1 [0179.919] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2728 os_tid = 0x28fc [0179.923] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.923] ReadFile (in: hFile=0x1f1c, lpBuffer=0x31effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31eff85c, lpOverlapped=0x0 | out: lpBuffer=0x31effb34*, lpNumberOfBytesRead=0x31eff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.925] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.926] ReadFile (in: hFile=0x1f1c, lpBuffer=0x31effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x31eff85c, lpOverlapped=0x0 | out: lpBuffer=0x31effb34*, lpNumberOfBytesRead=0x31eff85c*=0x428, lpOverlapped=0x0) returned 1 [0179.926] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.930] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.930] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x31eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0179.930] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x31eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x31eff828, pbKeyObject=0x0) returned 0x0 [0179.930] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x31eff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x31eff500) returned 0x0 [0179.930] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.930] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x31eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x31eff500) returned 0x0 [0179.936] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.939] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.939] WriteFile (in: hFile=0x1f1c, lpBuffer=0x31effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x31eff830, lpOverlapped=0x0 | out: lpBuffer=0x31effb34*, lpNumberOfBytesWritten=0x31eff830*=0x428, lpOverlapped=0x0) returned 1 [0179.940] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.940] ReadFile (in: hFile=0x1f1c, lpBuffer=0x5350000, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x31eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x31eff61c*=0xb66e, lpOverlapped=0x0) returned 1 [0179.941] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0xffff4992, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.941] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5350000, cbInput=0xb66e, pPaddingInfo=0x0, pbIV=0x31eff848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x31eff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x31eff848, pbOutput=0x5350000, pcbResult=0x31eff618) returned 0x0 [0179.941] WriteFile (in: hFile=0x1f1c, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x31eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x31eff61c*=0xb670, lpOverlapped=0x0) returned 1 [0179.942] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31eff60c | out: lpNewFilePointer=0x0) returned 1 [0179.942] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.942] WriteFile (in: hFile=0x1f1c, lpBuffer=0x31eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x31eff61c, lpOverlapped=0x0 | out: lpBuffer=0x31eff83c*, lpNumberOfBytesWritten=0x31eff61c*=0x8, lpOverlapped=0x0) returned 1 [0179.942] SetFilePointerEx (in: hFile=0x1f1c, liDistanceToMove=0xb670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.942] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.942] CloseHandle (hObject=0x1f1c) returned 1 [0179.942] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.play")) returned 1 [0179.947] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2729 os_tid = 0x2900 [0179.951] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.951] ReadFile (in: hFile=0x1f24, lpBuffer=0x3203fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3203f85c, lpOverlapped=0x0 | out: lpBuffer=0x3203fb34*, lpNumberOfBytesRead=0x3203f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.953] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.953] ReadFile (in: hFile=0x1f24, lpBuffer=0x3203fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3203f85c, lpOverlapped=0x0 | out: lpBuffer=0x3203fb34*, lpNumberOfBytesRead=0x3203f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.954] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.957] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.957] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x3203f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0179.957] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x3203f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x3203f828, pbKeyObject=0x0) returned 0x0 [0179.957] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3203f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3203f500) returned 0x0 [0179.957] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.957] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3203f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3203f500) returned 0x0 [0179.964] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.967] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.967] WriteFile (in: hFile=0x1f24, lpBuffer=0x3203fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3203f830, lpOverlapped=0x0 | out: lpBuffer=0x3203fb34*, lpNumberOfBytesWritten=0x3203f830*=0x428, lpOverlapped=0x0) returned 1 [0179.967] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.967] ReadFile (in: hFile=0x1f24, lpBuffer=0x5450000, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x3203f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x3203f61c*=0x54d4, lpOverlapped=0x0) returned 1 [0179.968] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xffffab2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.969] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5450000, cbInput=0x54d4, pPaddingInfo=0x0, pbIV=0x3203f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x3203f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3203f848, pbOutput=0x5450000, pcbResult=0x3203f618) returned 0x0 [0179.969] WriteFile (in: hFile=0x1f24, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x3203f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x3203f61c*=0x54e0, lpOverlapped=0x0) returned 1 [0179.969] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3203f60c | out: lpNewFilePointer=0x0) returned 1 [0179.969] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.969] WriteFile (in: hFile=0x1f24, lpBuffer=0x3203f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3203f61c, lpOverlapped=0x0 | out: lpBuffer=0x3203f83c*, lpNumberOfBytesWritten=0x3203f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.969] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x54e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.969] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.969] CloseHandle (hObject=0x1f24) returned 1 [0179.969] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0179.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.play")) returned 1 [0179.974] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2730 os_tid = 0x2904 [0179.980] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.980] ReadFile (in: hFile=0x1f2c, lpBuffer=0x3217fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3217f85c, lpOverlapped=0x0 | out: lpBuffer=0x3217fb34*, lpNumberOfBytesRead=0x3217f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.981] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.982] ReadFile (in: hFile=0x1f2c, lpBuffer=0x3217fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3217f85c, lpOverlapped=0x0 | out: lpBuffer=0x3217fb34*, lpNumberOfBytesRead=0x3217f85c*=0x428, lpOverlapped=0x0) returned 1 [0179.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0179.985] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0179.985] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x3217f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0179.985] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x3217f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x3217f828, pbKeyObject=0x0) returned 0x0 [0179.985] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3217f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3217f500) returned 0x0 [0179.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0179.986] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3217f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3217f500) returned 0x0 [0179.992] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.997] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.997] WriteFile (in: hFile=0x1f2c, lpBuffer=0x3217fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3217f830, lpOverlapped=0x0 | out: lpBuffer=0x3217fb34*, lpNumberOfBytesWritten=0x3217f830*=0x428, lpOverlapped=0x0) returned 1 [0179.997] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.997] ReadFile (in: hFile=0x1f2c, lpBuffer=0x5550000, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x3217f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x3217f61c*=0x45f8, lpOverlapped=0x0) returned 1 [0179.998] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0xffffba08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.998] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5550000, cbInput=0x45f8, pPaddingInfo=0x0, pbIV=0x3217f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x3217f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3217f848, pbOutput=0x5550000, pcbResult=0x3217f618) returned 0x0 [0179.998] WriteFile (in: hFile=0x1f2c, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x3217f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x3217f61c*=0x4600, lpOverlapped=0x0) returned 1 [0179.999] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3217f60c | out: lpNewFilePointer=0x0) returned 1 [0179.999] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.999] WriteFile (in: hFile=0x1f2c, lpBuffer=0x3217f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3217f61c, lpOverlapped=0x0 | out: lpBuffer=0x3217f83c*, lpNumberOfBytesWritten=0x3217f61c*=0x8, lpOverlapped=0x0) returned 1 [0179.999] SetFilePointerEx (in: hFile=0x1f2c, liDistanceToMove=0x4600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.999] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0179.999] CloseHandle (hObject=0x1f2c) returned 1 [0179.999] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.play")) returned 1 [0180.003] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2731 os_tid = 0x2908 [0180.009] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.009] ReadFile (in: hFile=0x1f34, lpBuffer=0x322bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x322bf85c, lpOverlapped=0x0 | out: lpBuffer=0x322bfb34*, lpNumberOfBytesRead=0x322bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.011] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.011] ReadFile (in: hFile=0x1f34, lpBuffer=0x322bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x322bf85c, lpOverlapped=0x0 | out: lpBuffer=0x322bfb34*, lpNumberOfBytesRead=0x322bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.011] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.014] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.015] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x322bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0180.015] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x322bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x322bf828, pbKeyObject=0x0) returned 0x0 [0180.015] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x322bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x322bf500) returned 0x0 [0180.015] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.015] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x322bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x322bf500) returned 0x0 [0180.020] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.023] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.024] WriteFile (in: hFile=0x1f34, lpBuffer=0x322bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x322bf830, lpOverlapped=0x0 | out: lpBuffer=0x322bfb34*, lpNumberOfBytesWritten=0x322bf830*=0x428, lpOverlapped=0x0) returned 1 [0180.024] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.024] ReadFile (in: hFile=0x1f34, lpBuffer=0x5650000, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x322bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x322bf61c*=0x2c84, lpOverlapped=0x0) returned 1 [0180.025] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xffffd37c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.025] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5650000, cbInput=0x2c84, pPaddingInfo=0x0, pbIV=0x322bf848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x322bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x322bf848, pbOutput=0x5650000, pcbResult=0x322bf618) returned 0x0 [0180.025] WriteFile (in: hFile=0x1f34, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x322bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x322bf61c*=0x2c90, lpOverlapped=0x0) returned 1 [0180.026] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322bf60c | out: lpNewFilePointer=0x0) returned 1 [0180.026] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.026] WriteFile (in: hFile=0x1f34, lpBuffer=0x322bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x322bf61c, lpOverlapped=0x0 | out: lpBuffer=0x322bf83c*, lpNumberOfBytesWritten=0x322bf61c*=0x8, lpOverlapped=0x0) returned 1 [0180.026] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x2c90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.026] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.026] CloseHandle (hObject=0x1f34) returned 1 [0180.026] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.play")) returned 1 [0180.030] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2732 os_tid = 0x290c [0180.035] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.035] ReadFile (in: hFile=0x1f3c, lpBuffer=0x323ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x323ff85c, lpOverlapped=0x0 | out: lpBuffer=0x323ffb34*, lpNumberOfBytesRead=0x323ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.037] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.037] ReadFile (in: hFile=0x1f3c, lpBuffer=0x323ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x323ff85c, lpOverlapped=0x0 | out: lpBuffer=0x323ffb34*, lpNumberOfBytesRead=0x323ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.037] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.040] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.040] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x323ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0180.040] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x323ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x323ff828, pbKeyObject=0x0) returned 0x0 [0180.040] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x323ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x323ff500) returned 0x0 [0180.040] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.041] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x323ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x323ff500) returned 0x0 [0180.046] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.050] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.050] WriteFile (in: hFile=0x1f3c, lpBuffer=0x323ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x323ff830, lpOverlapped=0x0 | out: lpBuffer=0x323ffb34*, lpNumberOfBytesWritten=0x323ff830*=0x428, lpOverlapped=0x0) returned 1 [0180.050] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.050] ReadFile (in: hFile=0x1f3c, lpBuffer=0x5750000, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x323ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x323ff61c*=0x48dc, lpOverlapped=0x0) returned 1 [0180.051] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xffffb724, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.052] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5750000, cbInput=0x48dc, pPaddingInfo=0x0, pbIV=0x323ff848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x323ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x323ff848, pbOutput=0x5750000, pcbResult=0x323ff618) returned 0x0 [0180.052] WriteFile (in: hFile=0x1f3c, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x323ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x323ff61c*=0x48e0, lpOverlapped=0x0) returned 1 [0180.052] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323ff60c | out: lpNewFilePointer=0x0) returned 1 [0180.052] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.052] WriteFile (in: hFile=0x1f3c, lpBuffer=0x323ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x323ff61c, lpOverlapped=0x0 | out: lpBuffer=0x323ff83c*, lpNumberOfBytesWritten=0x323ff61c*=0x8, lpOverlapped=0x0) returned 1 [0180.052] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x48e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.052] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.052] CloseHandle (hObject=0x1f3c) returned 1 [0180.053] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.play")) returned 1 [0180.121] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2733 os_tid = 0x2910 [0180.073] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.074] ReadFile (in: hFile=0x1f44, lpBuffer=0x3537fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3537f85c, lpOverlapped=0x0 | out: lpBuffer=0x3537fb34*, lpNumberOfBytesRead=0x3537f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.075] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.076] ReadFile (in: hFile=0x1f44, lpBuffer=0x3537fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3537f85c, lpOverlapped=0x0 | out: lpBuffer=0x3537fb34*, lpNumberOfBytesRead=0x3537f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.076] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0180.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0180.080] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x3537f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0180.080] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x3537f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x3537f828, pbKeyObject=0x0) returned 0x0 [0180.080] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x3537f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x3537f500) returned 0x0 [0180.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0180.080] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x3537f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x3537f500) returned 0x0 [0180.085] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.089] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.089] WriteFile (in: hFile=0x1f44, lpBuffer=0x3537fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3537f830, lpOverlapped=0x0 | out: lpBuffer=0x3537fb34*, lpNumberOfBytesWritten=0x3537f830*=0x428, lpOverlapped=0x0) returned 1 [0180.111] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.111] ReadFile (in: hFile=0x1f44, lpBuffer=0x5850000, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x3537f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x3537f61c*=0x462e, lpOverlapped=0x0) returned 1 [0180.112] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0xffffb9d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.112] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5850000, cbInput=0x462e, pPaddingInfo=0x0, pbIV=0x3537f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x3537f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3537f848, pbOutput=0x5850000, pcbResult=0x3537f618) returned 0x0 [0180.112] WriteFile (in: hFile=0x1f44, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x3537f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x3537f61c*=0x4630, lpOverlapped=0x0) returned 1 [0180.112] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3537f60c | out: lpNewFilePointer=0x0) returned 1 [0180.112] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.112] WriteFile (in: hFile=0x1f44, lpBuffer=0x3537f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3537f61c, lpOverlapped=0x0 | out: lpBuffer=0x3537f83c*, lpNumberOfBytesWritten=0x3537f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.112] SetFilePointerEx (in: hFile=0x1f44, liDistanceToMove=0x4630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.112] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.112] CloseHandle (hObject=0x1f44) returned 1 [0180.113] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0180.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.play")) returned 1 [0180.117] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2734 os_tid = 0x2914 [0180.124] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.124] ReadFile (in: hFile=0x1df8, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.126] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.126] ReadFile (in: hFile=0x1df8, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.126] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.128] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.128] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0180.128] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0180.128] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0180.128] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.128] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0180.132] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.135] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.135] WriteFile (in: hFile=0x1df8, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0180.136] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.136] ReadFile (in: hFile=0x1df8, lpBuffer=0x2750000, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x141cf61c*=0x72de, lpOverlapped=0x0) returned 1 [0180.137] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xffff8d22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.137] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x2750000, cbInput=0x72de, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x141cf848, pbOutput=0x2750000, pcbResult=0x141cf618) returned 0x0 [0180.137] WriteFile (in: hFile=0x1df8, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x141cf61c*=0x72e0, lpOverlapped=0x0) returned 1 [0180.137] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0180.137] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.137] WriteFile (in: hFile=0x1df8, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0180.137] SetFilePointerEx (in: hFile=0x1df8, liDistanceToMove=0x72e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.138] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.138] CloseHandle (hObject=0x1df8) returned 1 [0180.138] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.play")) returned 1 [0180.142] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2735 os_tid = 0x2918 [0180.145] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.146] ReadFile (in: hFile=0x1f50, lpBuffer=0x3547fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3547f85c, lpOverlapped=0x0 | out: lpBuffer=0x3547fb34*, lpNumberOfBytesRead=0x3547f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.147] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.147] ReadFile (in: hFile=0x1f50, lpBuffer=0x3547fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3547f85c, lpOverlapped=0x0 | out: lpBuffer=0x3547fb34*, lpNumberOfBytesRead=0x3547f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.148] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.150] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.150] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x3547f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0180.150] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x3547f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x3547f828, pbKeyObject=0x0) returned 0x0 [0180.150] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3547f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3547f500) returned 0x0 [0180.150] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.150] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3547f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3547f500) returned 0x0 [0180.154] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.156] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.156] WriteFile (in: hFile=0x1f50, lpBuffer=0x3547fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3547f830, lpOverlapped=0x0 | out: lpBuffer=0x3547fb34*, lpNumberOfBytesWritten=0x3547f830*=0x428, lpOverlapped=0x0) returned 1 [0180.156] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.157] ReadFile (in: hFile=0x1f50, lpBuffer=0x5950000, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x3547f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x3547f61c*=0xb594, lpOverlapped=0x0) returned 1 [0180.158] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xffff4a6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.158] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5950000, cbInput=0xb594, pPaddingInfo=0x0, pbIV=0x3547f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x3547f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3547f848, pbOutput=0x5950000, pcbResult=0x3547f618) returned 0x0 [0180.158] WriteFile (in: hFile=0x1f50, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x3547f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x3547f61c*=0xb5a0, lpOverlapped=0x0) returned 1 [0180.158] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3547f60c | out: lpNewFilePointer=0x0) returned 1 [0180.158] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.158] WriteFile (in: hFile=0x1f50, lpBuffer=0x3547f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3547f61c, lpOverlapped=0x0 | out: lpBuffer=0x3547f83c*, lpNumberOfBytesWritten=0x3547f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.158] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xb5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.158] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.158] CloseHandle (hObject=0x1f50) returned 1 [0180.158] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.play")) returned 1 [0180.162] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2736 os_tid = 0x291c [0180.166] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.166] ReadFile (in: hFile=0x1f58, lpBuffer=0x3557fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3557f85c, lpOverlapped=0x0 | out: lpBuffer=0x3557fb34*, lpNumberOfBytesRead=0x3557f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.167] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.167] ReadFile (in: hFile=0x1f58, lpBuffer=0x3557fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3557f85c, lpOverlapped=0x0 | out: lpBuffer=0x3557fb34*, lpNumberOfBytesRead=0x3557f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.167] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.169] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.169] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x3557f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0180.169] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x3557f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x3557f828, pbKeyObject=0x0) returned 0x0 [0180.170] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3557f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3557f500) returned 0x0 [0180.170] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.170] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3557f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3557f500) returned 0x0 [0180.173] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.175] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.176] WriteFile (in: hFile=0x1f58, lpBuffer=0x3557fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3557f830, lpOverlapped=0x0 | out: lpBuffer=0x3557fb34*, lpNumberOfBytesWritten=0x3557f830*=0x428, lpOverlapped=0x0) returned 1 [0180.176] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.176] ReadFile (in: hFile=0x1f58, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x3557f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x3557f61c*=0x51aa, lpOverlapped=0x0) returned 1 [0180.177] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0xffffae56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.177] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5a50000, cbInput=0x51aa, pPaddingInfo=0x0, pbIV=0x3557f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x3557f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3557f848, pbOutput=0x5a50000, pcbResult=0x3557f618) returned 0x0 [0180.177] WriteFile (in: hFile=0x1f58, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x3557f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x3557f61c*=0x51b0, lpOverlapped=0x0) returned 1 [0180.177] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3557f60c | out: lpNewFilePointer=0x0) returned 1 [0180.177] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.177] WriteFile (in: hFile=0x1f58, lpBuffer=0x3557f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3557f61c, lpOverlapped=0x0 | out: lpBuffer=0x3557f83c*, lpNumberOfBytesWritten=0x3557f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.177] SetFilePointerEx (in: hFile=0x1f58, liDistanceToMove=0x51b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.177] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.177] CloseHandle (hObject=0x1f58) returned 1 [0180.177] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.play")) returned 1 [0180.181] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2737 os_tid = 0x2920 [0180.185] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.185] ReadFile (in: hFile=0x1f60, lpBuffer=0x356bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x356bf85c, lpOverlapped=0x0 | out: lpBuffer=0x356bfb34*, lpNumberOfBytesRead=0x356bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.187] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.187] ReadFile (in: hFile=0x1f60, lpBuffer=0x356bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x356bf85c, lpOverlapped=0x0 | out: lpBuffer=0x356bfb34*, lpNumberOfBytesRead=0x356bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.187] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.189] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.189] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x356bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0180.189] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x356bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x356bf828, pbKeyObject=0x0) returned 0x0 [0180.189] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x356bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x356bf500) returned 0x0 [0180.189] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.190] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x356bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x356bf500) returned 0x0 [0180.193] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.195] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.195] WriteFile (in: hFile=0x1f60, lpBuffer=0x356bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x356bf830, lpOverlapped=0x0 | out: lpBuffer=0x356bfb34*, lpNumberOfBytesWritten=0x356bf830*=0x428, lpOverlapped=0x0) returned 1 [0180.196] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.196] ReadFile (in: hFile=0x1f60, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x356bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x356bf61c*=0x3888, lpOverlapped=0x0) returned 1 [0180.202] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xffffc778, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.202] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5b50000, cbInput=0x3888, pPaddingInfo=0x0, pbIV=0x356bf848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x356bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x356bf848, pbOutput=0x5b50000, pcbResult=0x356bf618) returned 0x0 [0180.202] WriteFile (in: hFile=0x1f60, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x356bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x356bf61c*=0x3890, lpOverlapped=0x0) returned 1 [0180.202] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356bf60c | out: lpNewFilePointer=0x0) returned 1 [0180.202] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.202] WriteFile (in: hFile=0x1f60, lpBuffer=0x356bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x356bf61c, lpOverlapped=0x0 | out: lpBuffer=0x356bf83c*, lpNumberOfBytesWritten=0x356bf61c*=0x8, lpOverlapped=0x0) returned 1 [0180.202] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x3890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.202] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.202] CloseHandle (hObject=0x1f60) returned 1 [0180.202] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.play")) returned 1 [0180.206] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2738 os_tid = 0x2924 [0180.211] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.212] ReadFile (in: hFile=0x1f68, lpBuffer=0x357ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x357ff85c, lpOverlapped=0x0 | out: lpBuffer=0x357ffb34*, lpNumberOfBytesRead=0x357ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.213] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.213] ReadFile (in: hFile=0x1f68, lpBuffer=0x357ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x357ff85c, lpOverlapped=0x0 | out: lpBuffer=0x357ffb34*, lpNumberOfBytesRead=0x357ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.213] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.216] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.216] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x357ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0180.216] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x357ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x357ff828, pbKeyObject=0x0) returned 0x0 [0180.216] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x357ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x357ff500) returned 0x0 [0180.216] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.216] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x357ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x357ff500) returned 0x0 [0180.219] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.222] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.222] WriteFile (in: hFile=0x1f68, lpBuffer=0x357ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x357ff830, lpOverlapped=0x0 | out: lpBuffer=0x357ffb34*, lpNumberOfBytesWritten=0x357ff830*=0x428, lpOverlapped=0x0) returned 1 [0180.222] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.222] ReadFile (in: hFile=0x1f68, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x357ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x357ff61c*=0x1ae8, lpOverlapped=0x0) returned 1 [0180.223] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0xffffe518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.223] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5c50000, cbInput=0x1ae8, pPaddingInfo=0x0, pbIV=0x357ff848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x357ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x357ff848, pbOutput=0x5c50000, pcbResult=0x357ff618) returned 0x0 [0180.223] WriteFile (in: hFile=0x1f68, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x357ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x357ff61c*=0x1af0, lpOverlapped=0x0) returned 1 [0180.223] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x357ff60c | out: lpNewFilePointer=0x0) returned 1 [0180.223] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.223] WriteFile (in: hFile=0x1f68, lpBuffer=0x357ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x357ff61c, lpOverlapped=0x0 | out: lpBuffer=0x357ff83c*, lpNumberOfBytesWritten=0x357ff61c*=0x8, lpOverlapped=0x0) returned 1 [0180.223] SetFilePointerEx (in: hFile=0x1f68, liDistanceToMove=0x1af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.223] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.223] CloseHandle (hObject=0x1f68) returned 1 [0180.224] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.play")) returned 1 [0180.227] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2739 os_tid = 0x2928 [0180.232] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.232] ReadFile (in: hFile=0x1f70, lpBuffer=0x3593fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3593f85c, lpOverlapped=0x0 | out: lpBuffer=0x3593fb34*, lpNumberOfBytesRead=0x3593f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.235] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.235] ReadFile (in: hFile=0x1f70, lpBuffer=0x3593fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3593f85c, lpOverlapped=0x0 | out: lpBuffer=0x3593fb34*, lpNumberOfBytesRead=0x3593f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.235] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.239] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.239] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x3593f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0180.239] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x3593f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x3593f828, pbKeyObject=0x0) returned 0x0 [0180.239] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3593f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3593f500) returned 0x0 [0180.239] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.240] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3593f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3593f500) returned 0x0 [0180.245] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.248] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.248] WriteFile (in: hFile=0x1f70, lpBuffer=0x3593fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3593f830, lpOverlapped=0x0 | out: lpBuffer=0x3593fb34*, lpNumberOfBytesWritten=0x3593f830*=0x428, lpOverlapped=0x0) returned 1 [0180.248] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.249] ReadFile (in: hFile=0x1f70, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x3593f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x3593f61c*=0x1d18, lpOverlapped=0x0) returned 1 [0180.249] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xffffe2e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.249] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5d50000, cbInput=0x1d18, pPaddingInfo=0x0, pbIV=0x3593f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x3593f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3593f848, pbOutput=0x5d50000, pcbResult=0x3593f618) returned 0x0 [0180.249] WriteFile (in: hFile=0x1f70, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x3593f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x3593f61c*=0x1d20, lpOverlapped=0x0) returned 1 [0180.249] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3593f60c | out: lpNewFilePointer=0x0) returned 1 [0180.250] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.250] WriteFile (in: hFile=0x1f70, lpBuffer=0x3593f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3593f61c, lpOverlapped=0x0 | out: lpBuffer=0x3593f83c*, lpNumberOfBytesWritten=0x3593f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.250] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x1d20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.250] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.250] CloseHandle (hObject=0x1f70) returned 1 [0180.250] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.play")) returned 1 [0180.253] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2740 os_tid = 0x292c [0180.256] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.257] ReadFile (in: hFile=0x1f78, lpBuffer=0x35a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x35a7fb34*, lpNumberOfBytesRead=0x35a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.258] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.258] ReadFile (in: hFile=0x1f78, lpBuffer=0x35a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x35a7fb34*, lpNumberOfBytesRead=0x35a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.258] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.260] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x35a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0180.260] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x35a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x35a7f828, pbKeyObject=0x0) returned 0x0 [0180.260] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x35a7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x35a7f500) returned 0x0 [0180.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.261] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x35a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x35a7f500) returned 0x0 [0180.264] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.266] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.266] WriteFile (in: hFile=0x1f78, lpBuffer=0x35a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x35a7f830, lpOverlapped=0x0 | out: lpBuffer=0x35a7fb34*, lpNumberOfBytesWritten=0x35a7f830*=0x428, lpOverlapped=0x0) returned 1 [0180.266] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.266] ReadFile (in: hFile=0x1f78, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x35a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x35a7f61c*=0x1b74, lpOverlapped=0x0) returned 1 [0180.269] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0xffffe48c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.269] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5e50000, cbInput=0x1b74, pPaddingInfo=0x0, pbIV=0x35a7f848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x35a7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x35a7f848, pbOutput=0x5e50000, pcbResult=0x35a7f618) returned 0x0 [0180.269] WriteFile (in: hFile=0x1f78, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x35a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x35a7f61c*=0x1b80, lpOverlapped=0x0) returned 1 [0180.270] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35a7f60c | out: lpNewFilePointer=0x0) returned 1 [0180.270] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.270] WriteFile (in: hFile=0x1f78, lpBuffer=0x35a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x35a7f83c*, lpNumberOfBytesWritten=0x35a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.270] SetFilePointerEx (in: hFile=0x1f78, liDistanceToMove=0x1b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.270] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.270] CloseHandle (hObject=0x1f78) returned 1 [0180.270] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.272] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.play")) returned 1 [0180.273] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2741 os_tid = 0x2930 [0180.277] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.277] ReadFile (in: hFile=0x1f80, lpBuffer=0x35bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x35bbfb34*, lpNumberOfBytesRead=0x35bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.279] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.279] ReadFile (in: hFile=0x1f80, lpBuffer=0x35bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x35bbfb34*, lpNumberOfBytesRead=0x35bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.279] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.281] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.281] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x35bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0180.281] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x35bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x35bbf828, pbKeyObject=0x0) returned 0x0 [0180.281] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x35bbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x35bbf500) returned 0x0 [0180.282] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.282] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x35bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x35bbf500) returned 0x0 [0180.285] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.288] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.288] WriteFile (in: hFile=0x1f80, lpBuffer=0x35bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x35bbf830, lpOverlapped=0x0 | out: lpBuffer=0x35bbfb34*, lpNumberOfBytesWritten=0x35bbf830*=0x428, lpOverlapped=0x0) returned 1 [0180.288] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.288] ReadFile (in: hFile=0x1f80, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x35bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x35bbf61c*=0x3198, lpOverlapped=0x0) returned 1 [0180.289] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xffffce68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.289] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x5f50000, cbInput=0x3198, pPaddingInfo=0x0, pbIV=0x35bbf848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x35bbf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x35bbf848, pbOutput=0x5f50000, pcbResult=0x35bbf618) returned 0x0 [0180.289] WriteFile (in: hFile=0x1f80, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x35bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x35bbf61c*=0x31a0, lpOverlapped=0x0) returned 1 [0180.290] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bbf60c | out: lpNewFilePointer=0x0) returned 1 [0180.290] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.290] WriteFile (in: hFile=0x1f80, lpBuffer=0x35bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x35bbf83c*, lpNumberOfBytesWritten=0x35bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0180.290] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x31a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.290] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.290] CloseHandle (hObject=0x1f80) returned 1 [0180.290] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.play")) returned 1 [0180.294] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2742 os_tid = 0x2934 [0180.299] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.299] ReadFile (in: hFile=0x1f88, lpBuffer=0x35cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35cff85c, lpOverlapped=0x0 | out: lpBuffer=0x35cffb34*, lpNumberOfBytesRead=0x35cff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.300] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.301] ReadFile (in: hFile=0x1f88, lpBuffer=0x35cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35cff85c, lpOverlapped=0x0 | out: lpBuffer=0x35cffb34*, lpNumberOfBytesRead=0x35cff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.301] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.304] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x35cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0180.304] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x35cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x35cff828, pbKeyObject=0x0) returned 0x0 [0180.304] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x35cff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x35cff500) returned 0x0 [0180.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.305] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x35cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x35cff500) returned 0x0 [0180.311] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.314] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.314] WriteFile (in: hFile=0x1f88, lpBuffer=0x35cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x35cff830, lpOverlapped=0x0 | out: lpBuffer=0x35cffb34*, lpNumberOfBytesWritten=0x35cff830*=0x428, lpOverlapped=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.315] ReadFile (in: hFile=0x1f88, lpBuffer=0x6050000, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x35cff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x35cff61c*=0x16e8, lpOverlapped=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0xffffe918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.315] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6050000, cbInput=0x16e8, pPaddingInfo=0x0, pbIV=0x35cff848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x35cff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x35cff848, pbOutput=0x6050000, pcbResult=0x35cff618) returned 0x0 [0180.315] WriteFile (in: hFile=0x1f88, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x35cff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x35cff61c*=0x16f0, lpOverlapped=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cff60c | out: lpNewFilePointer=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.315] WriteFile (in: hFile=0x1f88, lpBuffer=0x35cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35cff61c, lpOverlapped=0x0 | out: lpBuffer=0x35cff83c*, lpNumberOfBytesWritten=0x35cff61c*=0x8, lpOverlapped=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x1f88, liDistanceToMove=0x16f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.315] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.315] CloseHandle (hObject=0x1f88) returned 1 [0180.316] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.play")) returned 1 [0180.320] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2743 os_tid = 0x2938 [0180.332] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.332] ReadFile (in: hFile=0x1f90, lpBuffer=0x35e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x35e3fb34*, lpNumberOfBytesRead=0x35e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.334] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.334] ReadFile (in: hFile=0x1f90, lpBuffer=0x35e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x35e3fb34*, lpNumberOfBytesRead=0x35e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.335] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.339] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x35e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0180.339] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x35e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x35e3f828, pbKeyObject=0x0) returned 0x0 [0180.339] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x35e3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x35e3f500) returned 0x0 [0180.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.339] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x35e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x35e3f500) returned 0x0 [0180.345] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.349] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.349] WriteFile (in: hFile=0x1f90, lpBuffer=0x35e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x35e3f830, lpOverlapped=0x0 | out: lpBuffer=0x35e3fb34*, lpNumberOfBytesWritten=0x35e3f830*=0x428, lpOverlapped=0x0) returned 1 [0180.349] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.349] ReadFile (in: hFile=0x1f90, lpBuffer=0x6150000, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x35e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x35e3f61c*=0x2608, lpOverlapped=0x0) returned 1 [0180.350] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xffffd9f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.351] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6150000, cbInput=0x2608, pPaddingInfo=0x0, pbIV=0x35e3f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x35e3f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x35e3f848, pbOutput=0x6150000, pcbResult=0x35e3f618) returned 0x0 [0180.351] WriteFile (in: hFile=0x1f90, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x35e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x35e3f61c*=0x2610, lpOverlapped=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35e3f60c | out: lpNewFilePointer=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.351] WriteFile (in: hFile=0x1f90, lpBuffer=0x35e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x35e3f83c*, lpNumberOfBytesWritten=0x35e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x2610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.351] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.351] CloseHandle (hObject=0x1f90) returned 1 [0180.351] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.play")) returned 1 [0180.357] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2744 os_tid = 0x293c [0180.362] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.362] ReadFile (in: hFile=0x1f98, lpBuffer=0x35f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x35f7fb34*, lpNumberOfBytesRead=0x35f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.364] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.364] ReadFile (in: hFile=0x1f98, lpBuffer=0x35f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x35f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x35f7fb34*, lpNumberOfBytesRead=0x35f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.364] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.368] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x35f7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0180.368] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x35f7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x35f7f828, pbKeyObject=0x0) returned 0x0 [0180.368] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x35f7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x35f7f500) returned 0x0 [0180.369] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.369] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x35f7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x35f7f500) returned 0x0 [0180.374] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.378] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.378] WriteFile (in: hFile=0x1f98, lpBuffer=0x35f7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x35f7f830, lpOverlapped=0x0 | out: lpBuffer=0x35f7fb34*, lpNumberOfBytesWritten=0x35f7f830*=0x428, lpOverlapped=0x0) returned 1 [0180.379] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.379] ReadFile (in: hFile=0x1f98, lpBuffer=0x6250000, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x35f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x35f7f61c*=0x13ec, lpOverlapped=0x0) returned 1 [0180.379] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0xffffec14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.379] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6250000, cbInput=0x13ec, pPaddingInfo=0x0, pbIV=0x35f7f848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x35f7f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x35f7f848, pbOutput=0x6250000, pcbResult=0x35f7f618) returned 0x0 [0180.379] WriteFile (in: hFile=0x1f98, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x35f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x35f7f61c*=0x13f0, lpOverlapped=0x0) returned 1 [0180.379] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35f7f60c | out: lpNewFilePointer=0x0) returned 1 [0180.379] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.379] WriteFile (in: hFile=0x1f98, lpBuffer=0x35f7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x35f7f83c*, lpNumberOfBytesWritten=0x35f7f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.379] SetFilePointerEx (in: hFile=0x1f98, liDistanceToMove=0x13f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.379] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.379] CloseHandle (hObject=0x1f98) returned 1 [0180.380] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.play")) returned 1 [0180.384] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2745 os_tid = 0x2940 [0180.394] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.394] ReadFile (in: hFile=0x1fa0, lpBuffer=0x360bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x360bf85c, lpOverlapped=0x0 | out: lpBuffer=0x360bfb34*, lpNumberOfBytesRead=0x360bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.396] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.396] ReadFile (in: hFile=0x1fa0, lpBuffer=0x360bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x360bf85c, lpOverlapped=0x0 | out: lpBuffer=0x360bfb34*, lpNumberOfBytesRead=0x360bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.396] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.399] BCryptSetProperty (in: hObject=0x732d30, pszProperty="ChainingMode", pbInput=0x360bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732d30) returned 0x0 [0180.399] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732d30, phKey=0x360bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732d30, phKey=0x360bf828, pbKeyObject=0x0) returned 0x0 [0180.399] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x360bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x360bf500) returned 0x0 [0180.400] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.400] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x360bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x360bf500) returned 0x0 [0180.405] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.408] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.408] WriteFile (in: hFile=0x1fa0, lpBuffer=0x360bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x360bf830, lpOverlapped=0x0 | out: lpBuffer=0x360bfb34*, lpNumberOfBytesWritten=0x360bf830*=0x428, lpOverlapped=0x0) returned 1 [0180.409] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.409] ReadFile (in: hFile=0x1fa0, lpBuffer=0x6350000, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x360bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x360bf61c*=0x6196, lpOverlapped=0x0) returned 1 [0180.409] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xffff9e6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.410] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6350000, cbInput=0x6196, pPaddingInfo=0x0, pbIV=0x360bf848, cbIV=0x10, pbOutput=0x6350000, cbOutput=0x100000, pcbResult=0x360bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x360bf848, pbOutput=0x6350000, pcbResult=0x360bf618) returned 0x0 [0180.410] WriteFile (in: hFile=0x1fa0, lpBuffer=0x6350000*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x360bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesWritten=0x360bf61c*=0x61a0, lpOverlapped=0x0) returned 1 [0180.410] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360bf60c | out: lpNewFilePointer=0x0) returned 1 [0180.410] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.410] WriteFile (in: hFile=0x1fa0, lpBuffer=0x360bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x360bf61c, lpOverlapped=0x0 | out: lpBuffer=0x360bf83c*, lpNumberOfBytesWritten=0x360bf61c*=0x8, lpOverlapped=0x0) returned 1 [0180.410] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x61a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.410] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.410] CloseHandle (hObject=0x1fa0) returned 1 [0180.410] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.play")) returned 1 [0180.415] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2746 os_tid = 0x2944 [0180.419] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.419] ReadFile (in: hFile=0x1fa8, lpBuffer=0x361ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x361ff85c, lpOverlapped=0x0 | out: lpBuffer=0x361ffb34*, lpNumberOfBytesRead=0x361ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.421] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.421] ReadFile (in: hFile=0x1fa8, lpBuffer=0x361ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x361ff85c, lpOverlapped=0x0 | out: lpBuffer=0x361ffb34*, lpNumberOfBytesRead=0x361ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.422] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.424] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.424] BCryptSetProperty (in: hObject=0x731d60, pszProperty="ChainingMode", pbInput=0x361ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731d60) returned 0x0 [0180.425] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731d60, phKey=0x361ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731d60, phKey=0x361ff828, pbKeyObject=0x0) returned 0x0 [0180.425] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x361ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x361ff500) returned 0x0 [0180.425] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.425] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x361ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x361ff500) returned 0x0 [0180.429] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.434] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.434] WriteFile (in: hFile=0x1fa8, lpBuffer=0x361ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x361ff830, lpOverlapped=0x0 | out: lpBuffer=0x361ffb34*, lpNumberOfBytesWritten=0x361ff830*=0x428, lpOverlapped=0x0) returned 1 [0180.435] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.435] ReadFile (in: hFile=0x1fa8, lpBuffer=0x6450000, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x361ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesRead=0x361ff61c*=0xb57d, lpOverlapped=0x0) returned 1 [0180.436] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0xffff4a83, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.436] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6450000, cbInput=0xb57d, pPaddingInfo=0x0, pbIV=0x361ff848, cbIV=0x10, pbOutput=0x6450000, cbOutput=0x100000, pcbResult=0x361ff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x361ff848, pbOutput=0x6450000, pcbResult=0x361ff618) returned 0x0 [0180.436] WriteFile (in: hFile=0x1fa8, lpBuffer=0x6450000*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x361ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesWritten=0x361ff61c*=0xb580, lpOverlapped=0x0) returned 1 [0180.436] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361ff60c | out: lpNewFilePointer=0x0) returned 1 [0180.437] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.437] WriteFile (in: hFile=0x1fa8, lpBuffer=0x361ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x361ff61c, lpOverlapped=0x0 | out: lpBuffer=0x361ff83c*, lpNumberOfBytesWritten=0x361ff61c*=0x8, lpOverlapped=0x0) returned 1 [0180.437] SetFilePointerEx (in: hFile=0x1fa8, liDistanceToMove=0xb580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.437] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.437] CloseHandle (hObject=0x1fa8) returned 1 [0180.437] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.play")) returned 1 [0180.442] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2747 os_tid = 0x2948 [0180.447] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.447] ReadFile (in: hFile=0x1fb0, lpBuffer=0x3633fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3633f85c, lpOverlapped=0x0 | out: lpBuffer=0x3633fb34*, lpNumberOfBytesRead=0x3633f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.449] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.449] ReadFile (in: hFile=0x1fb0, lpBuffer=0x3633fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3633f85c, lpOverlapped=0x0 | out: lpBuffer=0x3633fb34*, lpNumberOfBytesRead=0x3633f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.449] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.452] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.452] BCryptSetProperty (in: hObject=0x7329c0, pszProperty="ChainingMode", pbInput=0x3633f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7329c0) returned 0x0 [0180.452] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7329c0, phKey=0x3633f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7329c0, phKey=0x3633f828, pbKeyObject=0x0) returned 0x0 [0180.452] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3633f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3633f500) returned 0x0 [0180.452] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.452] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3633f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3633f500) returned 0x0 [0180.459] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.462] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.462] WriteFile (in: hFile=0x1fb0, lpBuffer=0x3633fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3633f830, lpOverlapped=0x0 | out: lpBuffer=0x3633fb34*, lpNumberOfBytesWritten=0x3633f830*=0x428, lpOverlapped=0x0) returned 1 [0180.462] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.463] ReadFile (in: hFile=0x1fb0, lpBuffer=0x6550000, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x3633f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesRead=0x3633f61c*=0x38d8, lpOverlapped=0x0) returned 1 [0180.464] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xffffc728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.464] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6550000, cbInput=0x38d8, pPaddingInfo=0x0, pbIV=0x3633f848, cbIV=0x10, pbOutput=0x6550000, cbOutput=0x100000, pcbResult=0x3633f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3633f848, pbOutput=0x6550000, pcbResult=0x3633f618) returned 0x0 [0180.464] WriteFile (in: hFile=0x1fb0, lpBuffer=0x6550000*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x3633f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesWritten=0x3633f61c*=0x38e0, lpOverlapped=0x0) returned 1 [0180.464] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3633f60c | out: lpNewFilePointer=0x0) returned 1 [0180.464] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.464] WriteFile (in: hFile=0x1fb0, lpBuffer=0x3633f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3633f61c, lpOverlapped=0x0 | out: lpBuffer=0x3633f83c*, lpNumberOfBytesWritten=0x3633f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.464] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x38e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.464] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.464] CloseHandle (hObject=0x1fb0) returned 1 [0180.465] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.468] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.play")) returned 1 [0180.469] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2748 os_tid = 0x294c [0180.474] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.474] ReadFile (in: hFile=0x1fb8, lpBuffer=0x3647fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3647f85c, lpOverlapped=0x0 | out: lpBuffer=0x3647fb34*, lpNumberOfBytesRead=0x3647f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.476] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.476] ReadFile (in: hFile=0x1fb8, lpBuffer=0x3647fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3647f85c, lpOverlapped=0x0 | out: lpBuffer=0x3647fb34*, lpNumberOfBytesRead=0x3647f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.476] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.480] BCryptSetProperty (in: hObject=0x732020, pszProperty="ChainingMode", pbInput=0x3647f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732020) returned 0x0 [0180.480] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732020, phKey=0x3647f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732020, phKey=0x3647f828, pbKeyObject=0x0) returned 0x0 [0180.480] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3647f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3647f500) returned 0x0 [0180.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.481] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3647f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3647f500) returned 0x0 [0180.487] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.490] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.491] WriteFile (in: hFile=0x1fb8, lpBuffer=0x3647fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3647f830, lpOverlapped=0x0 | out: lpBuffer=0x3647fb34*, lpNumberOfBytesWritten=0x3647f830*=0x428, lpOverlapped=0x0) returned 1 [0180.491] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.491] ReadFile (in: hFile=0x1fb8, lpBuffer=0x6650000, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x3647f61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesRead=0x3647f61c*=0xb12e, lpOverlapped=0x0) returned 1 [0180.492] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0xffff4ed2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.492] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6650000, cbInput=0xb12e, pPaddingInfo=0x0, pbIV=0x3647f848, cbIV=0x10, pbOutput=0x6650000, cbOutput=0x100000, pcbResult=0x3647f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3647f848, pbOutput=0x6650000, pcbResult=0x3647f618) returned 0x0 [0180.492] WriteFile (in: hFile=0x1fb8, lpBuffer=0x6650000*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x3647f61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesWritten=0x3647f61c*=0xb130, lpOverlapped=0x0) returned 1 [0180.493] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3647f60c | out: lpNewFilePointer=0x0) returned 1 [0180.493] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.493] WriteFile (in: hFile=0x1fb8, lpBuffer=0x3647f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3647f61c, lpOverlapped=0x0 | out: lpBuffer=0x3647f83c*, lpNumberOfBytesWritten=0x3647f61c*=0x8, lpOverlapped=0x0) returned 1 [0180.493] SetFilePointerEx (in: hFile=0x1fb8, liDistanceToMove=0xb130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.494] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0180.494] CloseHandle (hObject=0x1fb8) returned 1 [0180.494] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0180.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.play")) returned 1 [0180.499] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2749 os_tid = 0x2950 [0180.504] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.504] ReadFile (in: hFile=0x1fc0, lpBuffer=0x365bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x365bf85c, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesRead=0x365bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.605] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.605] ReadFile (in: hFile=0x1fc0, lpBuffer=0x365bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x365bf85c, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesRead=0x365bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.605] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.610] BCryptSetProperty (in: hObject=0x732a70, pszProperty="ChainingMode", pbInput=0x365bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732a70) returned 0x0 [0180.610] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732a70, phKey=0x365bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732a70, phKey=0x365bf828, pbKeyObject=0x0) returned 0x0 [0180.610] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x365bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x365bf500) returned 0x0 [0180.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.610] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x365bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x365bf500) returned 0x0 [0180.615] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.624] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.624] WriteFile (in: hFile=0x1fc0, lpBuffer=0x365bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x365bf830, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesWritten=0x365bf830*=0x428, lpOverlapped=0x0) returned 1 [0181.065] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.065] ReadFile (in: hFile=0x1fc0, lpBuffer=0x6750000, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesRead=0x365bf61c*=0xd902, lpOverlapped=0x0) returned 1 [0181.351] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0xffff26fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.351] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x6750000, cbInput=0xd902, pPaddingInfo=0x0, pbIV=0x365bf848, cbIV=0x10, pbOutput=0x6750000, cbOutput=0x100000, pcbResult=0x365bf618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x365bf848, pbOutput=0x6750000, pcbResult=0x365bf618) returned 0x0 [0181.351] WriteFile (in: hFile=0x1fc0, lpBuffer=0x6750000*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesWritten=0x365bf61c*=0xd910, lpOverlapped=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365bf60c | out: lpNewFilePointer=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.352] WriteFile (in: hFile=0x1fc0, lpBuffer=0x365bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x365bf83c*, lpNumberOfBytesWritten=0x365bf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x1fc0, liDistanceToMove=0xd910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.352] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0181.352] CloseHandle (hObject=0x1fc0) returned 1 [0181.373] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0181.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.play")) returned 1 [0181.704] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2750 os_tid = 0x2954 [0180.666] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.666] ReadFile (in: hFile=0x1fc8, lpBuffer=0x366ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x366ff85c, lpOverlapped=0x0 | out: lpBuffer=0x366ffb34*, lpNumberOfBytesRead=0x366ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.668] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.668] ReadFile (in: hFile=0x1fc8, lpBuffer=0x366ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x366ff85c, lpOverlapped=0x0 | out: lpBuffer=0x366ffb34*, lpNumberOfBytesRead=0x366ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.668] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0180.671] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0180.671] BCryptSetProperty (in: hObject=0x732bd0, pszProperty="ChainingMode", pbInput=0x366ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732bd0) returned 0x0 [0180.671] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732bd0, phKey=0x366ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732bd0, phKey=0x366ff828, pbKeyObject=0x0) returned 0x0 [0180.671] BCryptExportKey (in: hKey=0x7f4a10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x366ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x366ff500) returned 0x0 [0180.671] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0180.672] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x366ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x366ff500) returned 0x0 [0180.676] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.680] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.680] WriteFile (in: hFile=0x1fc8, lpBuffer=0x366ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x366ff830, lpOverlapped=0x0 | out: lpBuffer=0x366ffb34*, lpNumberOfBytesWritten=0x366ff830*=0x428, lpOverlapped=0x0) returned 1 [0181.844] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.844] ReadFile (in: hFile=0x1fc8, lpBuffer=0x6850000, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x366ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesRead=0x366ff61c*=0x907d, lpOverlapped=0x0) returned 1 [0181.845] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0xffff6f83, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.845] BCryptEncrypt (in: hKey=0x7f4a10, pbInput=0x6850000, cbInput=0x907d, pPaddingInfo=0x0, pbIV=0x366ff848, cbIV=0x10, pbOutput=0x6850000, cbOutput=0x100000, pcbResult=0x366ff618, dwFlags=0x1 | out: hKey=0x7f4a10, pbIV=0x366ff848, pbOutput=0x6850000, pcbResult=0x366ff618) returned 0x0 [0181.845] WriteFile (in: hFile=0x1fc8, lpBuffer=0x6850000*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x366ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesWritten=0x366ff61c*=0x9080, lpOverlapped=0x0) returned 1 [0181.845] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366ff60c | out: lpNewFilePointer=0x0) returned 1 [0181.845] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.845] WriteFile (in: hFile=0x1fc8, lpBuffer=0x366ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x366ff61c, lpOverlapped=0x0 | out: lpBuffer=0x366ff83c*, lpNumberOfBytesWritten=0x366ff61c*=0x8, lpOverlapped=0x0) returned 1 [0181.846] SetFilePointerEx (in: hFile=0x1fc8, liDistanceToMove=0x9080, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.846] BCryptDestroyKey (in: hKey=0x7f4a10 | out: hKey=0x7f4a10) returned 0x0 [0181.846] CloseHandle (hObject=0x1fc8) returned 1 [0181.846] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.play")) returned 1 [0181.850] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2751 os_tid = 0x2958 [0180.681] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.681] ReadFile (in: hFile=0x1fb0, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.876] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.876] ReadFile (in: hFile=0x1fb0, lpBuffer=0x141cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x141cf85c, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesRead=0x141cf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.881] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.881] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x141cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0180.881] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x141cf828, pbKeyObject=0x0) returned 0x0 [0180.881] BCryptExportKey (in: hKey=0x7f1c80, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x141cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0180.881] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.881] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x141cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x141cf500) returned 0x0 [0180.885] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.889] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.889] WriteFile (in: hFile=0x1fb0, lpBuffer=0x141cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x141cf830, lpOverlapped=0x0 | out: lpBuffer=0x141cfb34*, lpNumberOfBytesWritten=0x141cf830*=0x428, lpOverlapped=0x0) returned 1 [0181.769] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.769] ReadFile (in: hFile=0x1fb0, lpBuffer=0x2750000, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x141cf61c*=0x7214, lpOverlapped=0x0) returned 1 [0181.770] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xffff8dec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.770] BCryptEncrypt (in: hKey=0x7f1c80, pbInput=0x2750000, cbInput=0x7214, pPaddingInfo=0x0, pbIV=0x141cf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x141cf618, dwFlags=0x1 | out: hKey=0x7f1c80, pbIV=0x141cf848, pbOutput=0x2750000, pcbResult=0x141cf618) returned 0x0 [0181.770] WriteFile (in: hFile=0x1fb0, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x141cf61c*=0x7220, lpOverlapped=0x0) returned 1 [0181.770] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x141cf60c | out: lpNewFilePointer=0x0) returned 1 [0181.770] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.770] WriteFile (in: hFile=0x1fb0, lpBuffer=0x141cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141cf61c, lpOverlapped=0x0 | out: lpBuffer=0x141cf83c*, lpNumberOfBytesWritten=0x141cf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.771] SetFilePointerEx (in: hFile=0x1fb0, liDistanceToMove=0x7220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.771] BCryptDestroyKey (in: hKey=0x7f1c80 | out: hKey=0x7f1c80) returned 0x0 [0181.771] CloseHandle (hObject=0x1fb0) returned 1 [0181.771] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.play")) returned 1 [0181.776] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2752 os_tid = 0x295c [0180.682] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.683] ReadFile (in: hFile=0x1fa0, lpBuffer=0x1430fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1430f85c, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesRead=0x1430f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.688] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.688] ReadFile (in: hFile=0x1fa0, lpBuffer=0x1430fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1430f85c, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesRead=0x1430f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.690] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0180.693] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0180.693] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1430f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0180.693] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1430f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1430f828, pbKeyObject=0x0) returned 0x0 [0180.694] BCryptExportKey (in: hKey=0x7f4ca0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1430f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1430f500) returned 0x0 [0180.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0180.694] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1430f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1430f500) returned 0x0 [0180.698] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.701] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.701] WriteFile (in: hFile=0x1fa0, lpBuffer=0x1430fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1430f830, lpOverlapped=0x0 | out: lpBuffer=0x1430fb34*, lpNumberOfBytesWritten=0x1430f830*=0x428, lpOverlapped=0x0) returned 1 [0181.833] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.833] ReadFile (in: hFile=0x1fa0, lpBuffer=0x2850000, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1430f61c*=0x67a3, lpOverlapped=0x0) returned 1 [0181.834] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xffff985d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.834] BCryptEncrypt (in: hKey=0x7f4ca0, pbInput=0x2850000, cbInput=0x67a3, pPaddingInfo=0x0, pbIV=0x1430f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1430f618, dwFlags=0x1 | out: hKey=0x7f4ca0, pbIV=0x1430f848, pbOutput=0x2850000, pcbResult=0x1430f618) returned 0x0 [0181.834] WriteFile (in: hFile=0x1fa0, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1430f61c*=0x67b0, lpOverlapped=0x0) returned 1 [0181.834] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1430f60c | out: lpNewFilePointer=0x0) returned 1 [0181.834] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.834] WriteFile (in: hFile=0x1fa0, lpBuffer=0x1430f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1430f61c, lpOverlapped=0x0 | out: lpBuffer=0x1430f83c*, lpNumberOfBytesWritten=0x1430f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.834] SetFilePointerEx (in: hFile=0x1fa0, liDistanceToMove=0x67b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.835] BCryptDestroyKey (in: hKey=0x7f4ca0 | out: hKey=0x7f4ca0) returned 0x0 [0181.835] CloseHandle (hObject=0x1fa0) returned 1 [0181.835] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.play")) returned 1 [0181.839] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2753 os_tid = 0x2960 [0180.701] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.701] ReadFile (in: hFile=0x1f90, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.065] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.065] ReadFile (in: hFile=0x1f90, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.066] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.083] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.083] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0181.083] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0181.083] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1444f500) returned 0x0 [0181.084] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.084] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1444f500) returned 0x0 [0181.110] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.114] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.114] WriteFile (in: hFile=0x1f90, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0181.115] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.115] ReadFile (in: hFile=0x1f90, lpBuffer=0x2950000, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1444f61c*=0x5de2, lpOverlapped=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xffffa21e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.352] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2950000, cbInput=0x5de2, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x1444f848, pbOutput=0x2950000, pcbResult=0x1444f618) returned 0x0 [0181.352] WriteFile (in: hFile=0x1f90, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1444f61c*=0x5df0, lpOverlapped=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.353] WriteFile (in: hFile=0x1f90, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.353] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x5df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.353] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0181.353] CloseHandle (hObject=0x1f90) returned 1 [0181.376] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0181.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.play")) returned 1 [0181.443] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2754 os_tid = 0x2964 [0180.703] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.703] ReadFile (in: hFile=0x1f80, lpBuffer=0x1470fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1470f85c, lpOverlapped=0x0 | out: lpBuffer=0x1470fb34*, lpNumberOfBytesRead=0x1470f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.704] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.704] ReadFile (in: hFile=0x1f80, lpBuffer=0x1470fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1470f85c, lpOverlapped=0x0 | out: lpBuffer=0x1470fb34*, lpNumberOfBytesRead=0x1470f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.704] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0180.707] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0180.707] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1470f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0180.707] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1470f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1470f828, pbKeyObject=0x0) returned 0x0 [0180.707] BCryptExportKey (in: hKey=0x7f0fe0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1470f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1470f500) returned 0x0 [0180.707] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0180.707] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1470f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1470f500) returned 0x0 [0180.710] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.713] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.713] WriteFile (in: hFile=0x1f80, lpBuffer=0x1470fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1470f830, lpOverlapped=0x0 | out: lpBuffer=0x1470fb34*, lpNumberOfBytesWritten=0x1470f830*=0x428, lpOverlapped=0x0) returned 1 [0181.822] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.822] ReadFile (in: hFile=0x1f80, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x1470f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1470f61c*=0x5b2a, lpOverlapped=0x0) returned 1 [0181.823] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xffffa4d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.823] BCryptEncrypt (in: hKey=0x7f0fe0, pbInput=0x2a50000, cbInput=0x5b2a, pPaddingInfo=0x0, pbIV=0x1470f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1470f618, dwFlags=0x1 | out: hKey=0x7f0fe0, pbIV=0x1470f848, pbOutput=0x2a50000, pcbResult=0x1470f618) returned 0x0 [0181.823] WriteFile (in: hFile=0x1f80, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x1470f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1470f61c*=0x5b30, lpOverlapped=0x0) returned 1 [0181.823] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1470f60c | out: lpNewFilePointer=0x0) returned 1 [0181.824] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.824] WriteFile (in: hFile=0x1f80, lpBuffer=0x1470f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1470f61c, lpOverlapped=0x0 | out: lpBuffer=0x1470f83c*, lpNumberOfBytesWritten=0x1470f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.824] SetFilePointerEx (in: hFile=0x1f80, liDistanceToMove=0x5b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.824] BCryptDestroyKey (in: hKey=0x7f0fe0 | out: hKey=0x7f0fe0) returned 0x0 [0181.824] CloseHandle (hObject=0x1f80) returned 1 [0181.824] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.play")) returned 1 [0181.828] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2755 os_tid = 0x2968 [0180.713] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.713] ReadFile (in: hFile=0x1f70, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.173] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.173] ReadFile (in: hFile=0x1f70, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.176] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.176] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1484f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0181.176] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1484f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1484f828, pbKeyObject=0x0) returned 0x0 [0181.176] BCryptExportKey (in: hKey=0x7f3350, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1484f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1484f500) returned 0x0 [0181.176] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.176] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1484f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1484f500) returned 0x0 [0181.181] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.186] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.186] WriteFile (in: hFile=0x1f70, lpBuffer=0x1484fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1484f830, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesWritten=0x1484f830*=0x428, lpOverlapped=0x0) returned 1 [0181.187] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.187] ReadFile (in: hFile=0x1f70, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1484f61c*=0x7d26, lpOverlapped=0x0) returned 1 [0181.367] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xffff82da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.367] BCryptEncrypt (in: hKey=0x7f3350, pbInput=0x2b50000, cbInput=0x7d26, pPaddingInfo=0x0, pbIV=0x1484f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1484f618, dwFlags=0x1 | out: hKey=0x7f3350, pbIV=0x1484f848, pbOutput=0x2b50000, pcbResult=0x1484f618) returned 0x0 [0181.367] WriteFile (in: hFile=0x1f70, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1484f61c*=0x7d30, lpOverlapped=0x0) returned 1 [0181.367] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1484f60c | out: lpNewFilePointer=0x0) returned 1 [0181.367] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.368] WriteFile (in: hFile=0x1f70, lpBuffer=0x1484f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x1484f83c*, lpNumberOfBytesWritten=0x1484f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.368] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x7d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.368] BCryptDestroyKey (in: hKey=0x7f3350 | out: hKey=0x7f3350) returned 0x0 [0181.368] CloseHandle (hObject=0x1f70) returned 1 [0181.387] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4c0000 [0181.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.play")) returned 1 [0181.427] VirtualFree (lpAddress=0xb4c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2756 os_tid = 0x296c [0180.714] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.715] ReadFile (in: hFile=0x1f60, lpBuffer=0x1498fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1498f85c, lpOverlapped=0x0 | out: lpBuffer=0x1498fb34*, lpNumberOfBytesRead=0x1498f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.716] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.716] ReadFile (in: hFile=0x1f60, lpBuffer=0x1498fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1498f85c, lpOverlapped=0x0 | out: lpBuffer=0x1498fb34*, lpNumberOfBytesRead=0x1498f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.716] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0180.718] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0180.718] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1498f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0180.718] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1498f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1498f828, pbKeyObject=0x0) returned 0x0 [0180.718] BCryptExportKey (in: hKey=0x7f1260, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1498f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1498f500) returned 0x0 [0180.719] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0180.719] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1498f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1498f500) returned 0x0 [0180.722] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.724] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.724] WriteFile (in: hFile=0x1f60, lpBuffer=0x1498fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1498f830, lpOverlapped=0x0 | out: lpBuffer=0x1498fb34*, lpNumberOfBytesWritten=0x1498f830*=0x428, lpOverlapped=0x0) returned 1 [0181.812] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.812] ReadFile (in: hFile=0x1f60, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x1498f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1498f61c*=0x8a0c, lpOverlapped=0x0) returned 1 [0181.813] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xffff75f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.813] BCryptEncrypt (in: hKey=0x7f1260, pbInput=0x2c50000, cbInput=0x8a0c, pPaddingInfo=0x0, pbIV=0x1498f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1498f618, dwFlags=0x1 | out: hKey=0x7f1260, pbIV=0x1498f848, pbOutput=0x2c50000, pcbResult=0x1498f618) returned 0x0 [0181.813] WriteFile (in: hFile=0x1f60, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x1498f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1498f61c*=0x8a10, lpOverlapped=0x0) returned 1 [0181.813] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1498f60c | out: lpNewFilePointer=0x0) returned 1 [0181.813] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.813] WriteFile (in: hFile=0x1f60, lpBuffer=0x1498f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1498f61c, lpOverlapped=0x0 | out: lpBuffer=0x1498f83c*, lpNumberOfBytesWritten=0x1498f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.813] SetFilePointerEx (in: hFile=0x1f60, liDistanceToMove=0x8a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.814] BCryptDestroyKey (in: hKey=0x7f1260 | out: hKey=0x7f1260) returned 0x0 [0181.814] CloseHandle (hObject=0x1f60) returned 1 [0181.814] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.816] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.play")) returned 1 [0181.818] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2757 os_tid = 0x2970 [0180.725] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.725] ReadFile (in: hFile=0x1f50, lpBuffer=0x14acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14acf85c, lpOverlapped=0x0 | out: lpBuffer=0x14acfb34*, lpNumberOfBytesRead=0x14acf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.726] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.726] ReadFile (in: hFile=0x1f50, lpBuffer=0x14acfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14acf85c, lpOverlapped=0x0 | out: lpBuffer=0x14acfb34*, lpNumberOfBytesRead=0x14acf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.726] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0180.729] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0180.729] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x14acf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0180.729] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x14acf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x14acf828, pbKeyObject=0x0) returned 0x0 [0180.729] BCryptExportKey (in: hKey=0x7f14f0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x14acf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x14acf500) returned 0x0 [0180.729] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0180.729] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x14acf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x14acf500) returned 0x0 [0180.732] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.735] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.735] WriteFile (in: hFile=0x1f50, lpBuffer=0x14acfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14acf830, lpOverlapped=0x0 | out: lpBuffer=0x14acfb34*, lpNumberOfBytesWritten=0x14acf830*=0x428, lpOverlapped=0x0) returned 1 [0181.801] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.801] ReadFile (in: hFile=0x1f50, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x14acf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x14acf61c*=0x7d6e, lpOverlapped=0x0) returned 1 [0181.802] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xffff8292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.802] BCryptEncrypt (in: hKey=0x7f14f0, pbInput=0x2d50000, cbInput=0x7d6e, pPaddingInfo=0x0, pbIV=0x14acf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x14acf618, dwFlags=0x1 | out: hKey=0x7f14f0, pbIV=0x14acf848, pbOutput=0x2d50000, pcbResult=0x14acf618) returned 0x0 [0181.802] WriteFile (in: hFile=0x1f50, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x14acf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x14acf61c*=0x7d70, lpOverlapped=0x0) returned 1 [0181.802] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14acf60c | out: lpNewFilePointer=0x0) returned 1 [0181.802] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.802] WriteFile (in: hFile=0x1f50, lpBuffer=0x14acf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14acf61c, lpOverlapped=0x0 | out: lpBuffer=0x14acf83c*, lpNumberOfBytesWritten=0x14acf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.803] SetFilePointerEx (in: hFile=0x1f50, liDistanceToMove=0x7d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.803] BCryptDestroyKey (in: hKey=0x7f14f0 | out: hKey=0x7f14f0) returned 0x0 [0181.803] CloseHandle (hObject=0x1f50) returned 1 [0181.803] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.806] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.play")) returned 1 [0181.808] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2758 os_tid = 0x2974 [0180.736] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.736] ReadFile (in: hFile=0x1f3c, lpBuffer=0x14c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x14c0fb34*, lpNumberOfBytesRead=0x14c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.737] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.737] ReadFile (in: hFile=0x1f3c, lpBuffer=0x14c0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14c0f85c, lpOverlapped=0x0 | out: lpBuffer=0x14c0fb34*, lpNumberOfBytesRead=0x14c0f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.737] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0180.739] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0180.739] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x14c0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0180.739] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x14c0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x14c0f828, pbKeyObject=0x0) returned 0x0 [0180.739] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x14c0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x14c0f500) returned 0x0 [0180.740] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0180.740] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x14c0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x14c0f500) returned 0x0 [0180.743] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.746] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.746] WriteFile (in: hFile=0x1f3c, lpBuffer=0x14c0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14c0f830, lpOverlapped=0x0 | out: lpBuffer=0x14c0fb34*, lpNumberOfBytesWritten=0x14c0f830*=0x428, lpOverlapped=0x0) returned 1 [0181.790] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.790] ReadFile (in: hFile=0x1f3c, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x14c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x14c0f61c*=0x40e7, lpOverlapped=0x0) returned 1 [0181.791] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xffffbf19, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.791] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2e50000, cbInput=0x40e7, pPaddingInfo=0x0, pbIV=0x14c0f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x14c0f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x14c0f848, pbOutput=0x2e50000, pcbResult=0x14c0f618) returned 0x0 [0181.791] WriteFile (in: hFile=0x1f3c, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x14c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x14c0f61c*=0x40f0, lpOverlapped=0x0) returned 1 [0181.791] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14c0f60c | out: lpNewFilePointer=0x0) returned 1 [0181.792] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.792] WriteFile (in: hFile=0x1f3c, lpBuffer=0x14c0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14c0f61c, lpOverlapped=0x0 | out: lpBuffer=0x14c0f83c*, lpNumberOfBytesWritten=0x14c0f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.792] SetFilePointerEx (in: hFile=0x1f3c, liDistanceToMove=0x40f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.792] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0181.792] CloseHandle (hObject=0x1f3c) returned 1 [0181.792] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.play")) returned 1 [0181.796] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2759 os_tid = 0x2978 [0180.746] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.746] ReadFile (in: hFile=0x1f34, lpBuffer=0x29b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesRead=0x29b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.748] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.748] ReadFile (in: hFile=0x1f34, lpBuffer=0x29b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x29b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesRead=0x29b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.748] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0180.750] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0180.750] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x29b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0180.750] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x29b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x29b3f828, pbKeyObject=0x0) returned 0x0 [0180.750] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x29b3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x29b3f500) returned 0x0 [0180.750] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0180.750] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x29b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x29b3f500) returned 0x0 [0180.754] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.756] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.756] WriteFile (in: hFile=0x1f34, lpBuffer=0x29b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x29b3f830, lpOverlapped=0x0 | out: lpBuffer=0x29b3fb34*, lpNumberOfBytesWritten=0x29b3f830*=0x428, lpOverlapped=0x0) returned 1 [0181.780] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.780] ReadFile (in: hFile=0x1f34, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x29b3f61c*=0x5f48, lpOverlapped=0x0) returned 1 [0181.781] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xffffa0b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.781] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2f50000, cbInput=0x5f48, pPaddingInfo=0x0, pbIV=0x29b3f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x29b3f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x29b3f848, pbOutput=0x2f50000, pcbResult=0x29b3f618) returned 0x0 [0181.781] WriteFile (in: hFile=0x1f34, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x29b3f61c*=0x5f50, lpOverlapped=0x0) returned 1 [0181.781] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29b3f60c | out: lpNewFilePointer=0x0) returned 1 [0181.781] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.781] WriteFile (in: hFile=0x1f34, lpBuffer=0x29b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x29b3f83c*, lpNumberOfBytesWritten=0x29b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.781] SetFilePointerEx (in: hFile=0x1f34, liDistanceToMove=0x5f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.781] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0181.781] CloseHandle (hObject=0x1f34) returned 1 [0181.782] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.play")) returned 1 [0181.786] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2760 os_tid = 0x297c [0180.757] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.757] ReadFile (in: hFile=0x1f24, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.317] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.317] ReadFile (in: hFile=0x1f24, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.317] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.319] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.320] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0181.320] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0181.320] BCryptExportKey (in: hKey=0x805ab0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d37f500) returned 0x0 [0181.320] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.320] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d37f500) returned 0x0 [0181.324] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.327] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.327] WriteFile (in: hFile=0x1f24, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0181.327] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.327] ReadFile (in: hFile=0x1f24, lpBuffer=0x3050000, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d37f61c*=0x3b2e, lpOverlapped=0x0) returned 1 [0181.562] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xffffc4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.562] BCryptEncrypt (in: hKey=0x805ab0, pbInput=0x3050000, cbInput=0x3b2e, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x805ab0, pbIV=0x2d37f848, pbOutput=0x3050000, pcbResult=0x2d37f618) returned 0x0 [0181.562] WriteFile (in: hFile=0x1f24, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d37f61c*=0x3b30, lpOverlapped=0x0) returned 1 [0181.562] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0181.562] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.562] WriteFile (in: hFile=0x1f24, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.562] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x3b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.562] BCryptDestroyKey (in: hKey=0x805ab0 | out: hKey=0x805ab0) returned 0x0 [0181.562] CloseHandle (hObject=0x1f24) returned 1 [0181.563] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.play")) returned 1 [0181.567] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2761 os_tid = 0x2980 [0180.758] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.758] ReadFile (in: hFile=0x1f14, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.306] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.307] ReadFile (in: hFile=0x1f14, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.309] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0181.309] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0181.309] BCryptExportKey (in: hKey=0x805820, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d47f500) returned 0x0 [0181.310] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.310] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d47f500) returned 0x0 [0181.313] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.316] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.316] WriteFile (in: hFile=0x1f14, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0181.316] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.316] ReadFile (in: hFile=0x1f14, lpBuffer=0x3150000, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d47f61c*=0x1e8e, lpOverlapped=0x0) returned 1 [0181.459] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xffffe172, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.459] BCryptEncrypt (in: hKey=0x805820, pbInput=0x3150000, cbInput=0x1e8e, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x805820, pbIV=0x2d47f848, pbOutput=0x3150000, pcbResult=0x2d47f618) returned 0x0 [0181.459] WriteFile (in: hFile=0x1f14, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d47f61c*=0x1e90, lpOverlapped=0x0) returned 1 [0181.460] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0181.460] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.460] WriteFile (in: hFile=0x1f14, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.460] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x1e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.460] BCryptDestroyKey (in: hKey=0x805820 | out: hKey=0x805820) returned 0x0 [0181.460] CloseHandle (hObject=0x1f14) returned 1 [0181.460] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.play")) returned 1 [0181.465] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2762 os_tid = 0x2984 [0180.799] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.799] ReadFile (in: hFile=0x1f04, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0181.285] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.285] ReadFile (in: hFile=0x1f04, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0181.285] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.287] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.287] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0181.287] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0181.287] BCryptExportKey (in: hKey=0x809260, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x219ff500) returned 0x0 [0181.287] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.288] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x219ff500) returned 0x0 [0181.291] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.293] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.294] WriteFile (in: hFile=0x1f04, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0181.294] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.294] ReadFile (in: hFile=0x1f04, lpBuffer=0x3250000, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x219ff61c*=0x3ed2, lpOverlapped=0x0) returned 1 [0181.536] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xffffc12e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.536] BCryptEncrypt (in: hKey=0x809260, pbInput=0x3250000, cbInput=0x3ed2, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x809260, pbIV=0x219ff848, pbOutput=0x3250000, pcbResult=0x219ff618) returned 0x0 [0181.536] WriteFile (in: hFile=0x1f04, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x219ff61c*=0x3ee0, lpOverlapped=0x0) returned 1 [0181.536] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0181.537] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.537] WriteFile (in: hFile=0x1f04, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0181.537] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x3ee0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.537] BCryptDestroyKey (in: hKey=0x809260 | out: hKey=0x809260) returned 0x0 [0181.537] CloseHandle (hObject=0x1f04) returned 1 [0181.537] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.play")) returned 1 [0181.542] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2763 os_tid = 0x2988 [0180.800] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.800] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.919] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.919] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.189] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.195] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.196] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0181.196] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0181.196] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d57f500) returned 0x0 [0181.196] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.197] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d57f500) returned 0x0 [0181.200] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.203] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.203] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0181.203] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.203] ReadFile (in: hFile=0x1bc0, lpBuffer=0x3350000, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d57f61c*=0x745c, lpOverlapped=0x0) returned 1 [0181.369] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xffff8ba4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.369] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x3350000, cbInput=0x745c, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x2d57f848, pbOutput=0x3350000, pcbResult=0x2d57f618) returned 0x0 [0181.369] WriteFile (in: hFile=0x1bc0, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d57f61c*=0x7460, lpOverlapped=0x0) returned 1 [0181.369] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0181.369] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.369] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.370] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x7460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.370] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0181.370] CloseHandle (hObject=0x1bc0) returned 1 [0181.392] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0181.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.play")) returned 1 [0181.415] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2764 os_tid = 0x298c [0180.802] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.802] ReadFile (in: hFile=0x179c, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.274] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.274] ReadFile (in: hFile=0x179c, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.274] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.277] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.277] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0181.278] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0181.278] BCryptExportKey (in: hKey=0x808fd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d67f500) returned 0x0 [0181.278] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.278] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d67f500) returned 0x0 [0181.281] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.284] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.284] WriteFile (in: hFile=0x179c, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0181.284] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.284] ReadFile (in: hFile=0x179c, lpBuffer=0x3450000, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2d67f61c*=0x6fd2, lpOverlapped=0x0) returned 1 [0181.513] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xffff902e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.513] BCryptEncrypt (in: hKey=0x808fd0, pbInput=0x3450000, cbInput=0x6fd2, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x808fd0, pbIV=0x2d67f848, pbOutput=0x3450000, pcbResult=0x2d67f618) returned 0x0 [0181.513] WriteFile (in: hFile=0x179c, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2d67f61c*=0x6fe0, lpOverlapped=0x0) returned 1 [0181.513] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0181.513] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.513] WriteFile (in: hFile=0x179c, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.513] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x6fe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.513] BCryptDestroyKey (in: hKey=0x808fd0 | out: hKey=0x808fd0) returned 0x0 [0181.513] CloseHandle (hObject=0x179c) returned 1 [0181.514] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.play")) returned 1 [0181.518] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2765 os_tid = 0x2990 [0180.803] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.803] ReadFile (in: hFile=0x6b4, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.264] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.264] ReadFile (in: hFile=0x6b4, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.264] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.266] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.266] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2d7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0181.266] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2d7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2d7bf828, pbKeyObject=0x0) returned 0x0 [0181.267] BCryptExportKey (in: hKey=0x808d50, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d7bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d7bf500) returned 0x0 [0181.267] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.267] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d7bf500) returned 0x0 [0181.270] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.273] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.273] WriteFile (in: hFile=0x6b4, lpBuffer=0x2d7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesWritten=0x2d7bf830*=0x428, lpOverlapped=0x0) returned 1 [0181.273] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.273] ReadFile (in: hFile=0x6b4, lpBuffer=0x3550000, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2d7bf61c*=0x5f6e, lpOverlapped=0x0) returned 1 [0181.503] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xffffa092, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.503] BCryptEncrypt (in: hKey=0x808d50, pbInput=0x3550000, cbInput=0x5f6e, pPaddingInfo=0x0, pbIV=0x2d7bf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2d7bf618, dwFlags=0x1 | out: hKey=0x808d50, pbIV=0x2d7bf848, pbOutput=0x3550000, pcbResult=0x2d7bf618) returned 0x0 [0181.503] WriteFile (in: hFile=0x6b4, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2d7bf61c*=0x5f70, lpOverlapped=0x0) returned 1 [0181.503] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf60c | out: lpNewFilePointer=0x0) returned 1 [0181.503] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.503] WriteFile (in: hFile=0x6b4, lpBuffer=0x2d7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf83c*, lpNumberOfBytesWritten=0x2d7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.503] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x5f70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.503] BCryptDestroyKey (in: hKey=0x808d50 | out: hKey=0x808d50) returned 0x0 [0181.504] CloseHandle (hObject=0x6b4) returned 1 [0181.504] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.play")) returned 1 [0181.508] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2766 os_tid = 0x2994 [0180.804] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.805] ReadFile (in: hFile=0x6ac, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.909] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.909] ReadFile (in: hFile=0x6ac, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.909] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.911] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.911] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2d8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0180.911] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2d8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2d8ff828, pbKeyObject=0x0) returned 0x0 [0180.911] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d8ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0180.911] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.911] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0180.915] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.918] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.918] WriteFile (in: hFile=0x6ac, lpBuffer=0x2d8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesWritten=0x2d8ff830*=0x428, lpOverlapped=0x0) returned 1 [0181.691] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.691] ReadFile (in: hFile=0x6ac, lpBuffer=0x3650000, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2d8ff61c*=0x4b4a, lpOverlapped=0x0) returned 1 [0181.692] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xffffb4b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.692] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3650000, cbInput=0x4b4a, pPaddingInfo=0x0, pbIV=0x2d8ff848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2d8ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d8ff848, pbOutput=0x3650000, pcbResult=0x2d8ff618) returned 0x0 [0181.692] WriteFile (in: hFile=0x6ac, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2d8ff61c*=0x4b50, lpOverlapped=0x0) returned 1 [0181.692] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8ff60c | out: lpNewFilePointer=0x0) returned 1 [0181.692] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.692] WriteFile (in: hFile=0x6ac, lpBuffer=0x2d8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ff83c*, lpNumberOfBytesWritten=0x2d8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0181.692] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x4b50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.692] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0181.692] CloseHandle (hObject=0x6ac) returned 1 [0181.693] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.play")) returned 1 [0181.699] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2767 os_tid = 0x2998 [0180.806] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.806] ReadFile (in: hFile=0x1d18, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.255] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.255] ReadFile (in: hFile=0x1d18, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.255] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.257] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.257] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2da3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0181.257] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2da3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2da3f828, pbKeyObject=0x0) returned 0x0 [0181.257] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2da3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2da3f500) returned 0x0 [0181.257] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.257] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2da3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2da3f500) returned 0x0 [0181.261] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.263] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.263] WriteFile (in: hFile=0x1d18, lpBuffer=0x2da3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da3f830, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesWritten=0x2da3f830*=0x428, lpOverlapped=0x0) returned 1 [0181.264] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.264] ReadFile (in: hFile=0x1d18, lpBuffer=0x3750000, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2da3f61c*=0x1c88, lpOverlapped=0x0) returned 1 [0181.480] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xffffe378, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.480] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x3750000, cbInput=0x1c88, pPaddingInfo=0x0, pbIV=0x2da3f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2da3f618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x2da3f848, pbOutput=0x3750000, pcbResult=0x2da3f618) returned 0x0 [0181.480] WriteFile (in: hFile=0x1d18, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2da3f61c*=0x1c90, lpOverlapped=0x0) returned 1 [0181.481] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da3f60c | out: lpNewFilePointer=0x0) returned 1 [0181.481] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.481] WriteFile (in: hFile=0x1d18, lpBuffer=0x2da3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da3f83c*, lpNumberOfBytesWritten=0x2da3f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.481] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0x1c90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.481] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0181.481] CloseHandle (hObject=0x1d18) returned 1 [0181.481] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.play")) returned 1 [0181.486] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2768 os_tid = 0x299c [0180.807] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.807] ReadFile (in: hFile=0x1d10, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.116] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.116] ReadFile (in: hFile=0x1d10, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.120] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2db7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0181.120] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2db7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2db7f828, pbKeyObject=0x0) returned 0x0 [0181.120] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2db7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2db7f500) returned 0x0 [0181.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.120] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2db7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2db7f500) returned 0x0 [0181.125] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.129] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.129] WriteFile (in: hFile=0x1d10, lpBuffer=0x2db7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db7f830, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesWritten=0x2db7f830*=0x428, lpOverlapped=0x0) returned 1 [0181.129] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.129] ReadFile (in: hFile=0x1d10, lpBuffer=0x3850000, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2db7f61c*=0x4e46, lpOverlapped=0x0) returned 1 [0181.365] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0xffffb1ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.365] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3850000, cbInput=0x4e46, pPaddingInfo=0x0, pbIV=0x2db7f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2db7f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2db7f848, pbOutput=0x3850000, pcbResult=0x2db7f618) returned 0x0 [0181.365] WriteFile (in: hFile=0x1d10, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2db7f61c*=0x4e50, lpOverlapped=0x0) returned 1 [0181.365] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db7f60c | out: lpNewFilePointer=0x0) returned 1 [0181.365] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.365] WriteFile (in: hFile=0x1d10, lpBuffer=0x2db7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db7f83c*, lpNumberOfBytesWritten=0x2db7f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.365] SetFilePointerEx (in: hFile=0x1d10, liDistanceToMove=0x4e50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.365] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0181.365] CloseHandle (hObject=0x1d10) returned 1 [0181.379] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb110000 [0181.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.play")) returned 1 [0181.439] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2769 os_tid = 0x29a0 [0180.808] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.808] ReadFile (in: hFile=0x1d08, lpBuffer=0x2dcbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dcbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb34*, lpNumberOfBytesRead=0x2dcbf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.900] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.900] ReadFile (in: hFile=0x1d08, lpBuffer=0x2dcbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dcbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb34*, lpNumberOfBytesRead=0x2dcbf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.900] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.902] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2dcbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0180.902] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2dcbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2dcbf828, pbKeyObject=0x0) returned 0x0 [0180.902] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2dcbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2dcbf500) returned 0x0 [0180.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.903] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2dcbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2dcbf500) returned 0x0 [0180.906] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.908] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.908] WriteFile (in: hFile=0x1d08, lpBuffer=0x2dcbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dcbf830, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb34*, lpNumberOfBytesWritten=0x2dcbf830*=0x428, lpOverlapped=0x0) returned 1 [0181.744] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.744] ReadFile (in: hFile=0x1d08, lpBuffer=0x3950000, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x2dcbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2dcbf61c*=0x69d8, lpOverlapped=0x0) returned 1 [0181.745] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0xffff9628, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.745] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x3950000, cbInput=0x69d8, pPaddingInfo=0x0, pbIV=0x2dcbf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2dcbf618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x2dcbf848, pbOutput=0x3950000, pcbResult=0x2dcbf618) returned 0x0 [0181.745] WriteFile (in: hFile=0x1d08, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x2dcbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2dcbf61c*=0x69e0, lpOverlapped=0x0) returned 1 [0181.745] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcbf60c | out: lpNewFilePointer=0x0) returned 1 [0181.745] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.745] WriteFile (in: hFile=0x1d08, lpBuffer=0x2dcbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dcbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dcbf83c*, lpNumberOfBytesWritten=0x2dcbf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.745] SetFilePointerEx (in: hFile=0x1d08, liDistanceToMove=0x69e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.745] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0181.745] CloseHandle (hObject=0x1d08) returned 1 [0181.746] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.play")) returned 1 [0181.752] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2770 os_tid = 0x29a4 [0180.810] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.810] ReadFile (in: hFile=0x1d00, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.889] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.890] ReadFile (in: hFile=0x1d00, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.890] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.892] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.892] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2ddff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0180.892] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2ddff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2ddff828, pbKeyObject=0x0) returned 0x0 [0180.892] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ddff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ddff500) returned 0x0 [0180.893] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.893] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ddff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ddff500) returned 0x0 [0180.897] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.899] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.900] WriteFile (in: hFile=0x1d00, lpBuffer=0x2ddffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddff830, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesWritten=0x2ddff830*=0x428, lpOverlapped=0x0) returned 1 [0181.757] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.757] ReadFile (in: hFile=0x1d00, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2ddff61c*=0x62e0, lpOverlapped=0x0) returned 1 [0181.758] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0xffff9d20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.758] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3a50000, cbInput=0x62e0, pPaddingInfo=0x0, pbIV=0x2ddff848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2ddff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2ddff848, pbOutput=0x3a50000, pcbResult=0x2ddff618) returned 0x0 [0181.758] WriteFile (in: hFile=0x1d00, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2ddff61c*=0x62f0, lpOverlapped=0x0) returned 1 [0181.758] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddff60c | out: lpNewFilePointer=0x0) returned 1 [0181.758] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.758] WriteFile (in: hFile=0x1d00, lpBuffer=0x2ddff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddff83c*, lpNumberOfBytesWritten=0x2ddff61c*=0x8, lpOverlapped=0x0) returned 1 [0181.758] SetFilePointerEx (in: hFile=0x1d00, liDistanceToMove=0x62f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.758] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0181.758] CloseHandle (hObject=0x1d00) returned 1 [0181.759] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.play")) returned 1 [0181.763] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2771 os_tid = 0x29a8 [0180.811] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.811] ReadFile (in: hFile=0x1cf8, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.245] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.246] ReadFile (in: hFile=0x1cf8, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.246] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.248] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.248] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2df3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0181.248] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2df3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2df3f828, pbKeyObject=0x0) returned 0x0 [0181.248] BCryptExportKey (in: hKey=0x7f4280, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2df3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2df3f500) returned 0x0 [0181.248] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.248] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2df3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2df3f500) returned 0x0 [0181.251] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.254] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.254] WriteFile (in: hFile=0x1cf8, lpBuffer=0x2df3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2df3f830, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesWritten=0x2df3f830*=0x428, lpOverlapped=0x0) returned 1 [0181.254] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.254] ReadFile (in: hFile=0x1cf8, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2df3f61c*=0xe956, lpOverlapped=0x0) returned 1 [0181.491] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0xffff16aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.491] BCryptEncrypt (in: hKey=0x7f4280, pbInput=0x3b50000, cbInput=0xe956, pPaddingInfo=0x0, pbIV=0x2df3f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2df3f618, dwFlags=0x1 | out: hKey=0x7f4280, pbIV=0x2df3f848, pbOutput=0x3b50000, pcbResult=0x2df3f618) returned 0x0 [0181.491] WriteFile (in: hFile=0x1cf8, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2df3f61c*=0xe960, lpOverlapped=0x0) returned 1 [0181.492] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2df3f60c | out: lpNewFilePointer=0x0) returned 1 [0181.492] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.492] WriteFile (in: hFile=0x1cf8, lpBuffer=0x2df3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2df3f83c*, lpNumberOfBytesWritten=0x2df3f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.492] SetFilePointerEx (in: hFile=0x1cf8, liDistanceToMove=0xe960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.492] BCryptDestroyKey (in: hKey=0x7f4280 | out: hKey=0x7f4280) returned 0x0 [0181.492] CloseHandle (hObject=0x1cf8) returned 1 [0181.492] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.play")) returned 1 [0181.498] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2772 os_tid = 0x29ac [0180.812] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.812] ReadFile (in: hFile=0x1cf0, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.235] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.235] ReadFile (in: hFile=0x1cf0, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.235] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.237] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.237] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2e07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0181.237] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2e07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2e07f828, pbKeyObject=0x0) returned 0x0 [0181.238] BCryptExportKey (in: hKey=0x7f3ff0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e07f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e07f500) returned 0x0 [0181.238] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.238] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e07f500) returned 0x0 [0181.241] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.245] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.245] WriteFile (in: hFile=0x1cf0, lpBuffer=0x2e07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e07f830, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesWritten=0x2e07f830*=0x428, lpOverlapped=0x0) returned 1 [0181.245] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.245] ReadFile (in: hFile=0x1cf0, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2e07f61c*=0x99a2, lpOverlapped=0x0) returned 1 [0181.470] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0xffff665e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.470] BCryptEncrypt (in: hKey=0x7f3ff0, pbInput=0x3c50000, cbInput=0x99a2, pPaddingInfo=0x0, pbIV=0x2e07f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2e07f618, dwFlags=0x1 | out: hKey=0x7f3ff0, pbIV=0x2e07f848, pbOutput=0x3c50000, pcbResult=0x2e07f618) returned 0x0 [0181.470] WriteFile (in: hFile=0x1cf0, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2e07f61c*=0x99b0, lpOverlapped=0x0) returned 1 [0181.471] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e07f60c | out: lpNewFilePointer=0x0) returned 1 [0181.471] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.471] WriteFile (in: hFile=0x1cf0, lpBuffer=0x2e07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e07f83c*, lpNumberOfBytesWritten=0x2e07f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.471] SetFilePointerEx (in: hFile=0x1cf0, liDistanceToMove=0x99b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.471] BCryptDestroyKey (in: hKey=0x7f3ff0 | out: hKey=0x7f3ff0) returned 0x0 [0181.471] CloseHandle (hObject=0x1cf0) returned 1 [0181.471] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.play")) returned 1 [0181.476] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2773 os_tid = 0x29b0 [0180.814] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.814] ReadFile (in: hFile=0x1ce8, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.159] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.159] ReadFile (in: hFile=0x1ce8, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.159] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.162] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.162] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0181.162] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e1bf828, pbKeyObject=0x0) returned 0x0 [0181.162] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e1bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e1bf500) returned 0x0 [0181.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.163] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e1bf500) returned 0x0 [0181.168] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.171] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.171] WriteFile (in: hFile=0x1ce8, lpBuffer=0x2e1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesWritten=0x2e1bf830*=0x428, lpOverlapped=0x0) returned 1 [0181.172] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.172] ReadFile (in: hFile=0x1ce8, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e1bf61c*=0x50b6, lpOverlapped=0x0) returned 1 [0181.368] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0xffffaf4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.368] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x3d50000, cbInput=0x50b6, pPaddingInfo=0x0, pbIV=0x2e1bf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e1bf618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x2e1bf848, pbOutput=0x3d50000, pcbResult=0x2e1bf618) returned 0x0 [0181.368] WriteFile (in: hFile=0x1ce8, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e1bf61c*=0x50c0, lpOverlapped=0x0) returned 1 [0181.368] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1bf60c | out: lpNewFilePointer=0x0) returned 1 [0181.368] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.369] WriteFile (in: hFile=0x1ce8, lpBuffer=0x2e1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bf83c*, lpNumberOfBytesWritten=0x2e1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.369] SetFilePointerEx (in: hFile=0x1ce8, liDistanceToMove=0x50c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.369] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0181.369] CloseHandle (hObject=0x1ce8) returned 1 [0181.390] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf910000 [0181.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.play")) returned 1 [0181.420] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2774 os_tid = 0x29b4 [0180.815] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.815] ReadFile (in: hFile=0x1ce0, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0180.929] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.929] ReadFile (in: hFile=0x1ce0, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0181.214] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.216] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.216] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2e2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0181.216] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2e2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2e2ff828, pbKeyObject=0x0) returned 0x0 [0181.216] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e2ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e2ff500) returned 0x0 [0181.216] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.216] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e2ff500) returned 0x0 [0181.220] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.222] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.223] WriteFile (in: hFile=0x1ce0, lpBuffer=0x2e2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesWritten=0x2e2ff830*=0x428, lpOverlapped=0x0) returned 1 [0181.223] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.223] ReadFile (in: hFile=0x1ce0, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2e2ff61c*=0x650c, lpOverlapped=0x0) returned 1 [0181.371] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xffff9af4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.371] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x3e50000, cbInput=0x650c, pPaddingInfo=0x0, pbIV=0x2e2ff848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2e2ff618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x2e2ff848, pbOutput=0x3e50000, pcbResult=0x2e2ff618) returned 0x0 [0181.371] WriteFile (in: hFile=0x1ce0, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2e2ff61c*=0x6510, lpOverlapped=0x0) returned 1 [0181.371] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2ff60c | out: lpNewFilePointer=0x0) returned 1 [0181.371] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.372] WriteFile (in: hFile=0x1ce0, lpBuffer=0x2e2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ff83c*, lpNumberOfBytesWritten=0x2e2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0181.372] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x6510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.372] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0181.372] CloseHandle (hObject=0x1ce0) returned 1 [0181.397] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf980000 [0181.399] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.play")) returned 1 [0181.401] VirtualFree (lpAddress=0xf980000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2775 os_tid = 0x29b8 [0180.816] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.817] ReadFile (in: hFile=0x1cd8, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.337] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.337] ReadFile (in: hFile=0x1cd8, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.337] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.339] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.340] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2e43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0181.340] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2e43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2e43f828, pbKeyObject=0x0) returned 0x0 [0181.340] BCryptExportKey (in: hKey=0x805fc0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e43f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e43f500) returned 0x0 [0181.340] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.340] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e43f500) returned 0x0 [0181.344] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.347] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.347] WriteFile (in: hFile=0x1cd8, lpBuffer=0x2e43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e43f830, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesWritten=0x2e43f830*=0x428, lpOverlapped=0x0) returned 1 [0181.347] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.347] ReadFile (in: hFile=0x1cd8, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2e43f61c*=0x8420, lpOverlapped=0x0) returned 1 [0181.571] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0xffff7be0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.571] BCryptEncrypt (in: hKey=0x805fc0, pbInput=0x3f50000, cbInput=0x8420, pPaddingInfo=0x0, pbIV=0x2e43f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2e43f618, dwFlags=0x1 | out: hKey=0x805fc0, pbIV=0x2e43f848, pbOutput=0x3f50000, pcbResult=0x2e43f618) returned 0x0 [0181.571] WriteFile (in: hFile=0x1cd8, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2e43f61c*=0x8430, lpOverlapped=0x0) returned 1 [0181.572] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e43f60c | out: lpNewFilePointer=0x0) returned 1 [0181.572] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.572] WriteFile (in: hFile=0x1cd8, lpBuffer=0x2e43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f83c*, lpNumberOfBytesWritten=0x2e43f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.572] SetFilePointerEx (in: hFile=0x1cd8, liDistanceToMove=0x8430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.572] BCryptDestroyKey (in: hKey=0x805fc0 | out: hKey=0x805fc0) returned 0x0 [0181.572] CloseHandle (hObject=0x1cd8) returned 1 [0181.572] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.575] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.play")) returned 1 [0181.576] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2776 os_tid = 0x29bc [0180.818] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.818] ReadFile (in: hFile=0x1cd0, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.327] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.327] ReadFile (in: hFile=0x1cd0, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.327] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.330] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.330] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2e57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0181.330] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2e57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2e57f828, pbKeyObject=0x0) returned 0x0 [0181.330] BCryptExportKey (in: hKey=0x805d30, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e57f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e57f500) returned 0x0 [0181.330] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.330] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e57f500) returned 0x0 [0181.333] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.336] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.336] WriteFile (in: hFile=0x1cd0, lpBuffer=0x2e57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e57f830, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesWritten=0x2e57f830*=0x428, lpOverlapped=0x0) returned 1 [0181.336] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.337] ReadFile (in: hFile=0x1cd0, lpBuffer=0x4050000, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2e57f61c*=0x5eae, lpOverlapped=0x0) returned 1 [0181.580] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xffffa152, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.581] BCryptEncrypt (in: hKey=0x805d30, pbInput=0x4050000, cbInput=0x5eae, pPaddingInfo=0x0, pbIV=0x2e57f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2e57f618, dwFlags=0x1 | out: hKey=0x805d30, pbIV=0x2e57f848, pbOutput=0x4050000, pcbResult=0x2e57f618) returned 0x0 [0181.581] WriteFile (in: hFile=0x1cd0, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2e57f61c*=0x5eb0, lpOverlapped=0x0) returned 1 [0181.581] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e57f60c | out: lpNewFilePointer=0x0) returned 1 [0181.581] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.581] WriteFile (in: hFile=0x1cd0, lpBuffer=0x2e57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e57f83c*, lpNumberOfBytesWritten=0x2e57f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.581] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x5eb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.581] BCryptDestroyKey (in: hKey=0x805d30 | out: hKey=0x805d30) returned 0x0 [0181.581] CloseHandle (hObject=0x1cd0) returned 1 [0181.581] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.play")) returned 1 [0181.586] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2777 os_tid = 0x29c0 [0180.819] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.819] ReadFile (in: hFile=0x1cc8, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.928] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.928] ReadFile (in: hFile=0x1cc8, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.223] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.226] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.226] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0181.226] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0181.226] BCryptExportKey (in: hKey=0x7f3d70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e6bf500) returned 0x0 [0181.226] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.226] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e6bf500) returned 0x0 [0181.229] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.232] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.232] WriteFile (in: hFile=0x1cc8, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0181.233] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.233] ReadFile (in: hFile=0x1cc8, lpBuffer=0x4150000, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2e6bf61c*=0x773a, lpOverlapped=0x0) returned 1 [0181.372] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xffff88c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.372] BCryptEncrypt (in: hKey=0x7f3d70, pbInput=0x4150000, cbInput=0x773a, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f3d70, pbIV=0x2e6bf848, pbOutput=0x4150000, pcbResult=0x2e6bf618) returned 0x0 [0181.372] WriteFile (in: hFile=0x1cc8, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x7740, lpOverlapped=0x0) returned 1 [0181.372] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0181.372] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.373] WriteFile (in: hFile=0x1cc8, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.373] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x7740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.373] BCryptDestroyKey (in: hKey=0x7f3d70 | out: hKey=0x7f3d70) returned 0x0 [0181.373] CloseHandle (hObject=0x1cc8) returned 1 [0181.446] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0181.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.play")) returned 1 [0181.450] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2778 os_tid = 0x29c4 [0180.820] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.820] ReadFile (in: hFile=0x1cc0, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0181.296] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.296] ReadFile (in: hFile=0x1cc0, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0181.296] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.299] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.299] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x2e7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0181.299] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x2e7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x2e7ff828, pbKeyObject=0x0) returned 0x0 [0181.299] BCryptExportKey (in: hKey=0x8094e0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e7ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e7ff500) returned 0x0 [0181.299] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.299] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e7ff500) returned 0x0 [0181.302] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.305] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.305] WriteFile (in: hFile=0x1cc0, lpBuffer=0x2e7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesWritten=0x2e7ff830*=0x428, lpOverlapped=0x0) returned 1 [0181.305] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.305] ReadFile (in: hFile=0x1cc0, lpBuffer=0x4250000, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x2e7ff61c*=0x8b8e, lpOverlapped=0x0) returned 1 [0181.546] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0xffff7472, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.547] BCryptEncrypt (in: hKey=0x8094e0, pbInput=0x4250000, cbInput=0x8b8e, pPaddingInfo=0x0, pbIV=0x2e7ff848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x2e7ff618, dwFlags=0x1 | out: hKey=0x8094e0, pbIV=0x2e7ff848, pbOutput=0x4250000, pcbResult=0x2e7ff618) returned 0x0 [0181.547] WriteFile (in: hFile=0x1cc0, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8b90, lpOverlapped=0x0) returned 1 [0181.547] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7ff60c | out: lpNewFilePointer=0x0) returned 1 [0181.547] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.547] WriteFile (in: hFile=0x1cc0, lpBuffer=0x2e7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ff83c*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0181.547] SetFilePointerEx (in: hFile=0x1cc0, liDistanceToMove=0x8b90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.547] BCryptDestroyKey (in: hKey=0x8094e0 | out: hKey=0x8094e0) returned 0x0 [0181.547] CloseHandle (hObject=0x1cc0) returned 1 [0181.547] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.play")) returned 1 [0181.555] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2779 os_tid = 0x29c8 [0180.822] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.822] ReadFile (in: hFile=0x1cb8, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.145] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.145] ReadFile (in: hFile=0x1cb8, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.145] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.148] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.148] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x2e93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0181.148] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x2e93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x2e93f828, pbKeyObject=0x0) returned 0x0 [0181.148] BCryptExportKey (in: hKey=0x7f2e40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2e93f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2e93f500) returned 0x0 [0181.149] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.149] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2e93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2e93f500) returned 0x0 [0181.154] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.158] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.158] WriteFile (in: hFile=0x1cb8, lpBuffer=0x2e93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e93f830, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesWritten=0x2e93f830*=0x428, lpOverlapped=0x0) returned 1 [0181.158] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.158] ReadFile (in: hFile=0x1cb8, lpBuffer=0x4350000, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x2e93f61c*=0x1e74, lpOverlapped=0x0) returned 1 [0181.366] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0xffffe18c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.366] BCryptEncrypt (in: hKey=0x7f2e40, pbInput=0x4350000, cbInput=0x1e74, pPaddingInfo=0x0, pbIV=0x2e93f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x2e93f618, dwFlags=0x1 | out: hKey=0x7f2e40, pbIV=0x2e93f848, pbOutput=0x4350000, pcbResult=0x2e93f618) returned 0x0 [0181.366] WriteFile (in: hFile=0x1cb8, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x2e93f61c*=0x1e80, lpOverlapped=0x0) returned 1 [0181.366] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93f60c | out: lpNewFilePointer=0x0) returned 1 [0181.367] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.367] WriteFile (in: hFile=0x1cb8, lpBuffer=0x2e93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e93f83c*, lpNumberOfBytesWritten=0x2e93f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.367] SetFilePointerEx (in: hFile=0x1cb8, liDistanceToMove=0x1e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.367] BCryptDestroyKey (in: hKey=0x7f2e40 | out: hKey=0x7f2e40) returned 0x0 [0181.367] CloseHandle (hObject=0x1cb8) returned 1 [0181.385] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4b0000 [0181.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.play")) returned 1 [0181.430] VirtualFree (lpAddress=0xb4b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2780 os_tid = 0x29cc [0180.823] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.823] ReadFile (in: hFile=0x1cb0, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.920] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.920] ReadFile (in: hFile=0x1cb0, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0180.920] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0180.922] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0180.922] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x2ea7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0180.922] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x2ea7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x2ea7f828, pbKeyObject=0x0) returned 0x0 [0180.922] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ea7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0180.922] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0180.922] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ea7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0180.925] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.928] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.928] WriteFile (in: hFile=0x1cb0, lpBuffer=0x2ea7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ea7f830, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesWritten=0x2ea7f830*=0x428, lpOverlapped=0x0) returned 1 [0181.037] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.038] ReadFile (in: hFile=0x1cb0, lpBuffer=0x4450000, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x2ea7f61c*=0x2182, lpOverlapped=0x0) returned 1 [0181.057] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0xffffde7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.057] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x4450000, cbInput=0x2182, pPaddingInfo=0x0, pbIV=0x2ea7f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x2ea7f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2ea7f848, pbOutput=0x4450000, pcbResult=0x2ea7f618) returned 0x0 [0181.057] WriteFile (in: hFile=0x1cb0, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x2ea7f61c*=0x2190, lpOverlapped=0x0) returned 1 [0181.057] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea7f60c | out: lpNewFilePointer=0x0) returned 1 [0181.057] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.057] WriteFile (in: hFile=0x1cb0, lpBuffer=0x2ea7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7f83c*, lpNumberOfBytesWritten=0x2ea7f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.058] SetFilePointerEx (in: hFile=0x1cb0, liDistanceToMove=0x2190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.058] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0181.058] CloseHandle (hObject=0x1cb0) returned 1 [0181.058] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.play")) returned 1 [0181.455] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2781 os_tid = 0x29d0 [0180.825] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.825] ReadFile (in: hFile=0x121c, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.296] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.296] ReadFile (in: hFile=0x121c, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.523] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0181.526] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0181.526] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x30bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0181.526] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x30bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x30bbf828, pbKeyObject=0x0) returned 0x0 [0181.526] BCryptExportKey (in: hKey=0x808fd0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30bbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0181.526] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0181.526] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0181.531] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.535] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.535] WriteFile (in: hFile=0x121c, lpBuffer=0x30bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bbf830, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesWritten=0x30bbf830*=0x428, lpOverlapped=0x0) returned 1 [0181.535] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.535] ReadFile (in: hFile=0x121c, lpBuffer=0x4550000, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x30bbf61c*=0x37e4, lpOverlapped=0x0) returned 1 [0181.634] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xffffc81c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.635] BCryptEncrypt (in: hKey=0x808fd0, pbInput=0x4550000, cbInput=0x37e4, pPaddingInfo=0x0, pbIV=0x30bbf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x30bbf618, dwFlags=0x1 | out: hKey=0x808fd0, pbIV=0x30bbf848, pbOutput=0x4550000, pcbResult=0x30bbf618) returned 0x0 [0181.635] WriteFile (in: hFile=0x121c, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x30bbf61c*=0x37f0, lpOverlapped=0x0) returned 1 [0181.635] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bbf60c | out: lpNewFilePointer=0x0) returned 1 [0181.635] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.635] WriteFile (in: hFile=0x121c, lpBuffer=0x30bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30bbf83c*, lpNumberOfBytesWritten=0x30bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.635] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x37f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.635] BCryptDestroyKey (in: hKey=0x808fd0 | out: hKey=0x808fd0) returned 0x0 [0181.635] CloseHandle (hObject=0x121c) returned 1 [0181.635] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.play")) returned 1 [0181.640] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2782 os_tid = 0x29d4 [0180.826] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.826] ReadFile (in: hFile=0x1284, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.130] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.130] ReadFile (in: hFile=0x1284, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.130] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.133] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.134] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x30cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0181.134] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x30cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x30cbf828, pbKeyObject=0x0) returned 0x0 [0181.134] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x30cbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x30cbf500) returned 0x0 [0181.134] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.134] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x30cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x30cbf500) returned 0x0 [0181.140] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.143] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.143] WriteFile (in: hFile=0x1284, lpBuffer=0x30cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30cbf830, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesWritten=0x30cbf830*=0x428, lpOverlapped=0x0) returned 1 [0181.144] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.144] ReadFile (in: hFile=0x1284, lpBuffer=0x4650000, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x30cbf61c*=0x21da, lpOverlapped=0x0) returned 1 [0181.365] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xffffde26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.366] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x4650000, cbInput=0x21da, pPaddingInfo=0x0, pbIV=0x30cbf848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x30cbf618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x30cbf848, pbOutput=0x4650000, pcbResult=0x30cbf618) returned 0x0 [0181.366] WriteFile (in: hFile=0x1284, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x30cbf61c*=0x21e0, lpOverlapped=0x0) returned 1 [0181.366] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cbf60c | out: lpNewFilePointer=0x0) returned 1 [0181.366] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.366] WriteFile (in: hFile=0x1284, lpBuffer=0x30cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30cbf83c*, lpNumberOfBytesWritten=0x30cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.366] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x21e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.366] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0181.366] CloseHandle (hObject=0x1284) returned 1 [0181.382] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4a0000 [0181.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.play")) returned 1 [0181.435] VirtualFree (lpAddress=0xb4a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2783 os_tid = 0x29d8 [0180.827] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.827] ReadFile (in: hFile=0x538, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0180.919] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.919] ReadFile (in: hFile=0x538, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.204] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.206] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.206] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x30dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0181.206] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x30dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x30dbf828, pbKeyObject=0x0) returned 0x0 [0181.206] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x30dbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x30dbf500) returned 0x0 [0181.206] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.206] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x30dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x30dbf500) returned 0x0 [0181.209] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.213] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.213] WriteFile (in: hFile=0x538, lpBuffer=0x30dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30dbf830, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesWritten=0x30dbf830*=0x428, lpOverlapped=0x0) returned 1 [0181.213] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.213] ReadFile (in: hFile=0x538, lpBuffer=0x4750000, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x30dbf61c*=0x843a, lpOverlapped=0x0) returned 1 [0181.370] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xffff7bc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.370] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x4750000, cbInput=0x843a, pPaddingInfo=0x0, pbIV=0x30dbf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x30dbf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x30dbf848, pbOutput=0x4750000, pcbResult=0x30dbf618) returned 0x0 [0181.370] WriteFile (in: hFile=0x538, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x30dbf61c*=0x8440, lpOverlapped=0x0) returned 1 [0181.370] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dbf60c | out: lpNewFilePointer=0x0) returned 1 [0181.370] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.371] WriteFile (in: hFile=0x538, lpBuffer=0x30dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30dbf83c*, lpNumberOfBytesWritten=0x30dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.371] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x8440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.371] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0181.371] CloseHandle (hObject=0x538) returned 1 [0181.394] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf970000 [0181.396] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.play")) returned 1 [0181.409] VirtualFree (lpAddress=0xf970000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2784 os_tid = 0x29dc [0180.828] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.828] ReadFile (in: hFile=0x1928, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.115] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.115] ReadFile (in: hFile=0x1928, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0181.353] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0181.356] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0181.356] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x30ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0181.356] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x30ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x30ebf828, pbKeyObject=0x0) returned 0x0 [0181.356] BCryptExportKey (in: hKey=0x806240, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x30ebf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x30ebf500) returned 0x0 [0181.356] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0181.356] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x30ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x30ebf500) returned 0x0 [0181.361] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.364] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.364] WriteFile (in: hFile=0x1928, lpBuffer=0x30ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30ebf830, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesWritten=0x30ebf830*=0x428, lpOverlapped=0x0) returned 1 [0181.364] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.364] ReadFile (in: hFile=0x1928, lpBuffer=0x4850000, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x30ebf61c*=0x44fe, lpOverlapped=0x0) returned 1 [0181.624] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xffffbb02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.624] BCryptEncrypt (in: hKey=0x806240, pbInput=0x4850000, cbInput=0x44fe, pPaddingInfo=0x0, pbIV=0x30ebf848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x30ebf618, dwFlags=0x1 | out: hKey=0x806240, pbIV=0x30ebf848, pbOutput=0x4850000, pcbResult=0x30ebf618) returned 0x0 [0181.624] WriteFile (in: hFile=0x1928, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x30ebf61c*=0x4500, lpOverlapped=0x0) returned 1 [0181.624] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ebf60c | out: lpNewFilePointer=0x0) returned 1 [0181.624] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.624] WriteFile (in: hFile=0x1928, lpBuffer=0x30ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x30ebf83c*, lpNumberOfBytesWritten=0x30ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0181.624] SetFilePointerEx (in: hFile=0x1928, liDistanceToMove=0x4500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.624] BCryptDestroyKey (in: hKey=0x806240 | out: hKey=0x806240) returned 0x0 [0181.624] CloseHandle (hObject=0x1928) returned 1 [0181.625] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.play")) returned 1 [0181.630] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2785 os_tid = 0x29e0 [0180.835] VirtualAlloc (lpAddress=0x0, dwSize=0xf4, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0180.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0180.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f090c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0180.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0180.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0924, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0180.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0180.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f093c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0180.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0180.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0954, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0180.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0180.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f096c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0180.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0180.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0984, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0180.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0180.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f099c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0180.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca0 [0180.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0180.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eec [0180.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee4 [0180.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc [0180.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4 [0180.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ebc [0180.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f09fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec4 [0180.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea4 [0180.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc [0180.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eac [0180.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb4 [0180.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c [0180.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e94 [0180.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e00 [0180.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0180.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e6c [0180.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a74, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e64 [0180.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e5c [0180.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a8c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e54 [0180.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4c [0180.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e44 [0180.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e3c [0180.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0abc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e34 [0180.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e2c [0180.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ad4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e24 [0180.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e1c [0180.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0aec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e14 [0180.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0c [0180.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b04, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e04 [0180.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c90 [0180.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b1c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db8 [0180.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db0 [0180.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c20 [0180.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0180.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc0 [0180.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd0 [0180.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b64, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2134 [0182.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2138 [0182.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x213c [0182.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2140 [0182.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0b94, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2144 [0182.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2148 [0182.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214c [0182.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2150 [0182.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bc4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2154 [0182.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2158 [0182.026] WaitForMultipleObjects (nCount=0x3d, lpHandles=0x6f0000*=0x1900, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0184.415] CloseHandle (hObject=0x1900) returned 1 [0184.416] CloseHandle (hObject=0x18f8) returned 1 [0184.416] CloseHandle (hObject=0x18f0) returned 1 [0184.443] CloseHandle (hObject=0x18e8) returned 1 [0184.443] CloseHandle (hObject=0x18e0) returned 1 [0184.443] CloseHandle (hObject=0x18d8) returned 1 [0184.443] CloseHandle (hObject=0x18d0) returned 1 [0184.443] CloseHandle (hObject=0x18c8) returned 1 [0184.443] CloseHandle (hObject=0x18c0) returned 1 [0184.443] CloseHandle (hObject=0x18b0) returned 1 [0184.443] CloseHandle (hObject=0x18b8) returned 1 [0184.443] CloseHandle (hObject=0x18a8) returned 1 [0184.444] CloseHandle (hObject=0x18a0) returned 1 [0184.444] CloseHandle (hObject=0x1898) returned 1 [0184.444] CloseHandle (hObject=0x1ca0) returned 1 [0184.444] CloseHandle (hObject=0x6bc) returned 1 [0184.444] CloseHandle (hObject=0x1eec) returned 1 [0184.444] CloseHandle (hObject=0x1ee4) returned 1 [0184.444] CloseHandle (hObject=0x1edc) returned 1 [0184.444] CloseHandle (hObject=0x1ed4) returned 1 [0184.444] CloseHandle (hObject=0x1ebc) returned 1 [0184.444] CloseHandle (hObject=0x1ec4) returned 1 [0184.444] CloseHandle (hObject=0x1ea4) returned 1 [0184.444] CloseHandle (hObject=0x1ecc) returned 1 [0184.444] CloseHandle (hObject=0x1eac) returned 1 [0184.444] CloseHandle (hObject=0x1eb4) returned 1 [0184.444] CloseHandle (hObject=0x1e9c) returned 1 [0184.444] CloseHandle (hObject=0x1e94) returned 1 [0184.445] CloseHandle (hObject=0x1e00) returned 1 [0184.445] CloseHandle (hObject=0x74c) returned 1 [0184.445] CloseHandle (hObject=0x1e6c) returned 1 [0184.445] CloseHandle (hObject=0x1e64) returned 1 [0184.445] CloseHandle (hObject=0x1e5c) returned 1 [0184.445] CloseHandle (hObject=0x1e54) returned 1 [0184.445] CloseHandle (hObject=0x1e4c) returned 1 [0184.445] CloseHandle (hObject=0x1e44) returned 1 [0184.445] CloseHandle (hObject=0x1e3c) returned 1 [0184.445] CloseHandle (hObject=0x1e34) returned 1 [0184.445] CloseHandle (hObject=0x1e2c) returned 1 [0184.445] CloseHandle (hObject=0x1e24) returned 1 [0184.445] CloseHandle (hObject=0x1e1c) returned 1 [0184.445] CloseHandle (hObject=0x1e14) returned 1 [0184.445] CloseHandle (hObject=0x1e0c) returned 1 [0184.445] CloseHandle (hObject=0x1e04) returned 1 [0184.445] CloseHandle (hObject=0x1c90) returned 1 [0184.445] CloseHandle (hObject=0x1db8) returned 1 [0184.446] CloseHandle (hObject=0x1db0) returned 1 [0184.446] CloseHandle (hObject=0x1c20) returned 1 [0184.446] CloseHandle (hObject=0x16b4) returned 1 [0184.446] CloseHandle (hObject=0x1dc0) returned 1 [0184.446] CloseHandle (hObject=0x1dd0) returned 1 [0184.446] CloseHandle (hObject=0x2134) returned 1 [0184.446] CloseHandle (hObject=0x2138) returned 1 [0184.446] CloseHandle (hObject=0x213c) returned 1 [0184.446] CloseHandle (hObject=0x2140) returned 1 [0184.446] CloseHandle (hObject=0x2144) returned 1 [0184.446] CloseHandle (hObject=0x2148) returned 1 [0184.446] CloseHandle (hObject=0x214c) returned 1 [0184.446] CloseHandle (hObject=0x2150) returned 1 [0184.446] CloseHandle (hObject=0x2154) returned 1 [0184.446] CloseHandle (hObject=0x2158) returned 1 [0184.446] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2786 os_tid = 0x29e4 [0181.855] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.855] ReadFile (in: hFile=0x750, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0181.857] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.857] ReadFile (in: hFile=0x750, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0181.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0181.861] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0181.861] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x30fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0181.861] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x30fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x30fff828, pbKeyObject=0x0) returned 0x0 [0181.861] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30fff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30fff500) returned 0x0 [0181.861] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0181.861] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30fff500) returned 0x0 [0181.866] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.885] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.885] WriteFile (in: hFile=0x750, lpBuffer=0x30fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30fff830, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesWritten=0x30fff830*=0x428, lpOverlapped=0x0) returned 1 [0181.885] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.885] ReadFile (in: hFile=0x750, lpBuffer=0x4950000, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x30fff61c*=0x4724, lpOverlapped=0x0) returned 1 [0181.886] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0xffffb8dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.886] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4950000, cbInput=0x4724, pPaddingInfo=0x0, pbIV=0x30fff848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x30fff618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x30fff848, pbOutput=0x4950000, pcbResult=0x30fff618) returned 0x0 [0181.886] WriteFile (in: hFile=0x750, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x30fff61c*=0x4730, lpOverlapped=0x0) returned 1 [0181.886] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30fff60c | out: lpNewFilePointer=0x0) returned 1 [0181.887] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.887] WriteFile (in: hFile=0x750, lpBuffer=0x30fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x30fff83c*, lpNumberOfBytesWritten=0x30fff61c*=0x8, lpOverlapped=0x0) returned 1 [0181.887] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x4730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.887] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0181.887] CloseHandle (hObject=0x750) returned 1 [0181.887] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.play")) returned 1 [0181.892] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2787 os_tid = 0x29e8 [0181.897] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.897] ReadFile (in: hFile=0x1910, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.899] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.899] ReadFile (in: hFile=0x1910, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0181.899] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0181.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0181.902] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x3113f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0181.902] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x3113f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x3113f828, pbKeyObject=0x0) returned 0x0 [0181.902] BCryptExportKey (in: hKey=0x7f4790, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3113f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3113f500) returned 0x0 [0181.902] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0181.902] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3113f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3113f500) returned 0x0 [0181.907] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.910] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.910] WriteFile (in: hFile=0x1910, lpBuffer=0x3113fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3113f830, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesWritten=0x3113f830*=0x428, lpOverlapped=0x0) returned 1 [0181.910] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.911] ReadFile (in: hFile=0x1910, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x3113f61c*=0x19c4, lpOverlapped=0x0) returned 1 [0181.911] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xffffe63c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.911] BCryptEncrypt (in: hKey=0x7f4790, pbInput=0x4a50000, cbInput=0x19c4, pPaddingInfo=0x0, pbIV=0x3113f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x3113f618, dwFlags=0x1 | out: hKey=0x7f4790, pbIV=0x3113f848, pbOutput=0x4a50000, pcbResult=0x3113f618) returned 0x0 [0181.911] WriteFile (in: hFile=0x1910, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x3113f61c*=0x19d0, lpOverlapped=0x0) returned 1 [0181.912] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3113f60c | out: lpNewFilePointer=0x0) returned 1 [0181.912] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.912] WriteFile (in: hFile=0x1910, lpBuffer=0x3113f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x3113f83c*, lpNumberOfBytesWritten=0x3113f61c*=0x8, lpOverlapped=0x0) returned 1 [0181.912] SetFilePointerEx (in: hFile=0x1910, liDistanceToMove=0x19d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.912] BCryptDestroyKey (in: hKey=0x7f4790 | out: hKey=0x7f4790) returned 0x0 [0181.912] CloseHandle (hObject=0x1910) returned 1 [0181.912] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0181.915] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.play")) returned 1 [0181.917] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2788 os_tid = 0x29ec [0181.924] GetLastError () returned 0x57 [0181.924] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fc458 [0181.924] SetLastError (dwErrCode=0x57) [0181.924] IcmpCreateFile () returned 0x804820 [0181.924] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8510 [0181.924] IcmpSendEcho2 (IcmpHandle=0x804820, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc200a8c0, RequestData=0x3127ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8510, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2789 os_tid = 0x29f0 [0181.926] GetLastError () returned 0x57 [0181.926] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fc7e0 [0181.926] SetLastError (dwErrCode=0x57) [0181.926] IcmpCreateFile () returned 0x804858 [0181.926] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8560 [0181.926] IcmpSendEcho2 (IcmpHandle=0x804858, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc300a8c0, RequestData=0x313bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8560, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2790 os_tid = 0x29f4 [0181.927] GetLastError () returned 0x57 [0181.927] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fcb68 [0181.928] SetLastError (dwErrCode=0x57) [0181.928] IcmpCreateFile () returned 0x804890 [0181.928] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f85b0 [0181.928] IcmpSendEcho2 (IcmpHandle=0x804890, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc400a8c0, RequestData=0x314fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f85b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2791 os_tid = 0x29f8 [0181.929] GetLastError () returned 0x57 [0181.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fcef0 [0181.929] SetLastError (dwErrCode=0x57) [0181.929] IcmpCreateFile () returned 0x8048c8 [0181.929] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7c00 [0181.929] IcmpSendEcho2 (IcmpHandle=0x8048c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc500a8c0, RequestData=0x3163ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7c00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2792 os_tid = 0x29fc [0181.930] GetLastError () returned 0x57 [0181.931] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fd278 [0181.931] SetLastError (dwErrCode=0x57) [0181.931] IcmpCreateFile () returned 0x804900 [0181.931] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7c50 [0181.931] IcmpSendEcho2 (IcmpHandle=0x804900, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc600a8c0, RequestData=0x3177ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7c50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2793 os_tid = 0x2a00 [0181.932] GetLastError () returned 0x57 [0181.932] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fd600 [0181.933] SetLastError (dwErrCode=0x57) [0181.933] IcmpCreateFile () returned 0x804938 [0181.933] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7ca0 [0181.933] IcmpSendEcho2 (IcmpHandle=0x804938, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc700a8c0, RequestData=0x318bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7ca0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2794 os_tid = 0x2a04 [0181.934] GetLastError () returned 0x57 [0181.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fd988 [0181.934] SetLastError (dwErrCode=0x57) [0181.934] IcmpCreateFile () returned 0x804970 [0181.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7cf0 [0181.934] IcmpSendEcho2 (IcmpHandle=0x804970, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc800a8c0, RequestData=0x319fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7cf0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2795 os_tid = 0x2a08 [0181.935] GetLastError () returned 0x57 [0181.935] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fdd10 [0181.935] SetLastError (dwErrCode=0x57) [0181.936] IcmpCreateFile () returned 0x804bd8 [0181.936] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7d40 [0181.936] IcmpSendEcho2 (IcmpHandle=0x804bd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc900a8c0, RequestData=0x31b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7d40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2796 os_tid = 0x2a0c [0181.937] GetLastError () returned 0x57 [0181.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fe098 [0181.937] SetLastError (dwErrCode=0x57) [0181.937] IcmpCreateFile () returned 0x804c10 [0181.937] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7d90 [0181.937] IcmpSendEcho2 (IcmpHandle=0x804c10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xca00a8c0, RequestData=0x31c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7d90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2797 os_tid = 0x2a10 [0181.938] GetLastError () returned 0x57 [0181.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fe420 [0181.939] SetLastError (dwErrCode=0x57) [0181.939] IcmpCreateFile () returned 0x804c48 [0181.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7de0 [0181.939] IcmpSendEcho2 (IcmpHandle=0x804c48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcb00a8c0, RequestData=0x31dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7de0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2798 os_tid = 0x2a14 [0181.940] GetLastError () returned 0x57 [0181.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6fe7a8 [0181.940] SetLastError (dwErrCode=0x57) [0181.940] IcmpCreateFile () returned 0x804c80 [0181.940] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7e30 [0181.940] IcmpSendEcho2 (IcmpHandle=0x804c80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcc00a8c0, RequestData=0x31efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7e30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2799 os_tid = 0x2a18 [0181.942] GetLastError () returned 0x57 [0181.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6feb30 [0181.942] SetLastError (dwErrCode=0x57) [0181.942] IcmpCreateFile () returned 0x804cb8 [0181.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7e80 [0181.942] IcmpSendEcho2 (IcmpHandle=0x804cb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcd00a8c0, RequestData=0x3203ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7e80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2800 os_tid = 0x2a1c [0181.943] GetLastError () returned 0x57 [0181.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6feeb8 [0181.943] SetLastError (dwErrCode=0x57) [0181.943] IcmpCreateFile () returned 0x804cf0 [0181.943] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7ed0 [0181.943] IcmpSendEcho2 (IcmpHandle=0x804cf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xce00a8c0, RequestData=0x3217ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7ed0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2801 os_tid = 0x2a20 [0181.953] GetLastError () returned 0x57 [0181.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ff240 [0181.953] SetLastError (dwErrCode=0x57) [0181.953] IcmpCreateFile () returned 0x804d28 [0181.953] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7f20 [0181.953] IcmpSendEcho2 (IcmpHandle=0x804d28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xcf00a8c0, RequestData=0x322bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7f20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2802 os_tid = 0x2a24 [0181.955] GetLastError () returned 0x57 [0181.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ff5c8 [0181.955] SetLastError (dwErrCode=0x57) [0181.955] IcmpCreateFile () returned 0x804d60 [0181.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7f70 [0181.955] IcmpSendEcho2 (IcmpHandle=0x804d60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd000a8c0, RequestData=0x323fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7f70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2803 os_tid = 0x2a28 [0181.956] GetLastError () returned 0x57 [0181.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ff950 [0181.956] SetLastError (dwErrCode=0x57) [0181.956] IcmpCreateFile () returned 0x804d98 [0181.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f7fc0 [0181.956] IcmpSendEcho2 (IcmpHandle=0x804d98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd100a8c0, RequestData=0x3537ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f7fc0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2804 os_tid = 0x2a2c [0181.958] GetLastError () returned 0x57 [0181.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a6ffcd8 [0181.958] SetLastError (dwErrCode=0x57) [0181.958] IcmpCreateFile () returned 0x804dd0 [0181.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8010 [0181.958] IcmpSendEcho2 (IcmpHandle=0x804dd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd200a8c0, RequestData=0x3547ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8010, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2805 os_tid = 0x2a30 [0181.959] GetLastError () returned 0x57 [0181.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a700060 [0181.960] SetLastError (dwErrCode=0x57) [0181.960] IcmpCreateFile () returned 0x804e08 [0181.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8060 [0181.960] IcmpSendEcho2 (IcmpHandle=0x804e08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd300a8c0, RequestData=0x3557ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8060, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2806 os_tid = 0x2a34 [0181.961] GetLastError () returned 0x57 [0181.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7003e8 [0181.961] SetLastError (dwErrCode=0x57) [0181.961] IcmpCreateFile () returned 0x804e40 [0181.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f80b0 [0181.961] IcmpSendEcho2 (IcmpHandle=0x804e40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd400a8c0, RequestData=0x356bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f80b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2807 os_tid = 0x2a38 [0181.963] GetLastError () returned 0x57 [0181.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a700770 [0181.963] SetLastError (dwErrCode=0x57) [0181.963] IcmpCreateFile () returned 0x804e78 [0181.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8100 [0181.963] IcmpSendEcho2 (IcmpHandle=0x804e78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd500a8c0, RequestData=0x357fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8100, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2808 os_tid = 0x2a3c [0181.964] GetLastError () returned 0x57 [0181.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a700af8 [0181.964] SetLastError (dwErrCode=0x57) [0181.964] IcmpCreateFile () returned 0x804eb0 [0181.965] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8150 [0181.965] IcmpSendEcho2 (IcmpHandle=0x804eb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd600a8c0, RequestData=0x3593ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8150, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2809 os_tid = 0x2a40 [0181.966] GetLastError () returned 0x57 [0181.966] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a700e80 [0181.966] SetLastError (dwErrCode=0x57) [0181.966] IcmpCreateFile () returned 0x804ee8 [0181.966] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f81a0 [0181.966] IcmpSendEcho2 (IcmpHandle=0x804ee8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd700a8c0, RequestData=0x35a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f81a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2810 os_tid = 0x2a44 [0181.967] GetLastError () returned 0x57 [0181.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a701208 [0181.968] SetLastError (dwErrCode=0x57) [0181.968] IcmpCreateFile () returned 0x804f20 [0181.968] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f81f0 [0181.968] IcmpSendEcho2 (IcmpHandle=0x804f20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd800a8c0, RequestData=0x35bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f81f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2811 os_tid = 0x2a48 [0181.969] GetLastError () returned 0x57 [0181.969] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a701590 [0181.969] SetLastError (dwErrCode=0x57) [0181.969] IcmpCreateFile () returned 0x804f58 [0181.969] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8740 [0181.969] IcmpSendEcho2 (IcmpHandle=0x804f58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd900a8c0, RequestData=0x35cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8740, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2812 os_tid = 0x2a4c [0181.970] GetLastError () returned 0x57 [0181.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a701918 [0181.971] SetLastError (dwErrCode=0x57) [0181.971] IcmpCreateFile () returned 0x804f90 [0181.971] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8600 [0181.971] IcmpSendEcho2 (IcmpHandle=0x804f90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xda00a8c0, RequestData=0x35e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8600, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2813 os_tid = 0x2a50 [0181.972] GetLastError () returned 0x57 [0181.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a7ba8 [0181.972] SetLastError (dwErrCode=0x57) [0181.972] IcmpCreateFile () returned 0x804fc8 [0181.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f8650 [0181.972] IcmpSendEcho2 (IcmpHandle=0x804fc8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdb00a8c0, RequestData=0x35f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f8650, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2814 os_tid = 0x2a54 [0181.973] GetLastError () returned 0x57 [0181.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a7f30 [0181.974] SetLastError (dwErrCode=0x57) [0181.974] IcmpCreateFile () returned 0x805000 [0181.974] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f86a0 [0181.974] IcmpSendEcho2 (IcmpHandle=0x805000, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdc00a8c0, RequestData=0x360bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f86a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2815 os_tid = 0x2a58 [0181.975] GetLastError () returned 0x57 [0181.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a82b8 [0181.975] SetLastError (dwErrCode=0x57) [0181.975] IcmpCreateFile () returned 0x805038 [0181.975] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7f86f0 [0181.975] IcmpSendEcho2 (IcmpHandle=0x805038, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdd00a8c0, RequestData=0x361fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7f86f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2816 os_tid = 0x2a5c [0181.976] GetLastError () returned 0x57 [0181.976] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a8640 [0181.977] SetLastError (dwErrCode=0x57) [0181.977] IcmpCreateFile () returned 0x805070 [0181.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf618 [0181.977] IcmpSendEcho2 (IcmpHandle=0x805070, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xde00a8c0, RequestData=0x3633ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf618, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2817 os_tid = 0x2a60 [0181.978] GetLastError () returned 0x57 [0181.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a89c8 [0181.978] SetLastError (dwErrCode=0x57) [0181.978] IcmpCreateFile () returned 0x8050a8 [0181.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf668 [0181.978] IcmpSendEcho2 (IcmpHandle=0x8050a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xdf00a8c0, RequestData=0x3647ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf668, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2818 os_tid = 0x2a64 [0181.980] GetLastError () returned 0x57 [0181.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a8d50 [0181.980] SetLastError (dwErrCode=0x57) [0181.980] IcmpCreateFile () returned 0x8050e0 [0181.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf7f8 [0181.980] IcmpSendEcho2 (IcmpHandle=0x8050e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe000a8c0, RequestData=0x3683ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf7f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2819 os_tid = 0x2a68 [0181.981] GetLastError () returned 0x57 [0181.981] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a90d8 [0181.981] SetLastError (dwErrCode=0x57) [0181.981] IcmpCreateFile () returned 0x805118 [0181.981] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf848 [0181.982] IcmpSendEcho2 (IcmpHandle=0x805118, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe100a8c0, RequestData=0x3697ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf848, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2820 os_tid = 0x2a6c [0181.984] GetLastError () returned 0x57 [0181.984] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72dbd0 [0181.988] SetLastError (dwErrCode=0x57) [0181.988] IcmpCreateFile () returned 0x805380 [0181.988] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfa78 [0181.988] IcmpSendEcho2 (IcmpHandle=0x805380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe200a8c0, RequestData=0x36abff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfa78, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2821 os_tid = 0x2a70 [0181.989] GetLastError () returned 0x57 [0181.989] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72df58 [0181.990] SetLastError (dwErrCode=0x57) [0181.990] IcmpCreateFile () returned 0x805150 [0181.990] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfac8 [0181.990] IcmpSendEcho2 (IcmpHandle=0x805150, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe300a8c0, RequestData=0x36bfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfac8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2822 os_tid = 0x2a74 [0181.991] GetLastError () returned 0x57 [0181.991] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72e2e0 [0181.991] SetLastError (dwErrCode=0x57) [0181.991] IcmpCreateFile () returned 0x805188 [0181.991] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfb18 [0181.991] IcmpSendEcho2 (IcmpHandle=0x805188, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe400a8c0, RequestData=0x36d3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfb18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2823 os_tid = 0x2a78 [0181.992] GetLastError () returned 0x57 [0181.993] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72e668 [0181.993] SetLastError (dwErrCode=0x57) [0181.993] IcmpCreateFile () returned 0x8051c0 [0181.993] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfb68 [0181.993] IcmpSendEcho2 (IcmpHandle=0x8051c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe500a8c0, RequestData=0x36e7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfb68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2824 os_tid = 0x2a7c [0181.995] GetLastError () returned 0x57 [0181.995] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7278f0 [0181.995] SetLastError (dwErrCode=0x57) [0181.995] IcmpCreateFile () returned 0x8051f8 [0181.995] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfbb8 [0181.995] IcmpSendEcho2 (IcmpHandle=0x8051f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe600a8c0, RequestData=0x36fbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfbb8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2825 os_tid = 0x2a80 [0181.996] GetLastError () returned 0x57 [0181.996] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a727c78 [0181.996] SetLastError (dwErrCode=0x57) [0181.996] IcmpCreateFile () returned 0x805230 [0181.997] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfc08 [0181.997] IcmpSendEcho2 (IcmpHandle=0x805230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe700a8c0, RequestData=0x370fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfc08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2826 os_tid = 0x2a84 [0181.998] GetLastError () returned 0x57 [0181.998] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a728000 [0181.998] SetLastError (dwErrCode=0x57) [0181.998] IcmpCreateFile () returned 0x805268 [0181.998] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfc58 [0181.998] IcmpSendEcho2 (IcmpHandle=0x805268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe800a8c0, RequestData=0x3723ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfc58, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2827 os_tid = 0x2a88 [0181.999] GetLastError () returned 0x57 [0181.999] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a728388 [0182.000] SetLastError (dwErrCode=0x57) [0182.000] IcmpCreateFile () returned 0x8052a0 [0182.000] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790408 [0182.000] IcmpSendEcho2 (IcmpHandle=0x8052a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe900a8c0, RequestData=0x3737ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790408, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2828 os_tid = 0x2a8c [0182.001] GetLastError () returned 0x57 [0182.001] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a728710 [0182.001] SetLastError (dwErrCode=0x57) [0182.001] IcmpCreateFile () returned 0x805540 [0182.001] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7906d8 [0182.001] IcmpSendEcho2 (IcmpHandle=0x805540, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xea00a8c0, RequestData=0x374bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7906d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2829 os_tid = 0x2a90 [0182.002] GetLastError () returned 0x57 [0182.003] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a728a98 [0182.003] SetLastError (dwErrCode=0x57) [0182.003] IcmpCreateFile () returned 0x805578 [0182.003] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790728 [0182.003] IcmpSendEcho2 (IcmpHandle=0x805578, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xeb00a8c0, RequestData=0x375fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790728, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2830 os_tid = 0x2a94 [0182.004] GetLastError () returned 0x57 [0182.004] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a728e20 [0182.004] SetLastError (dwErrCode=0x57) [0182.004] IcmpCreateFile () returned 0x8055b0 [0182.004] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790778 [0182.004] IcmpSendEcho2 (IcmpHandle=0x8055b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xec00a8c0, RequestData=0x3773ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790778, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2831 os_tid = 0x2a98 [0182.006] GetLastError () returned 0x57 [0182.006] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7291a8 [0182.006] SetLastError (dwErrCode=0x57) [0182.006] IcmpCreateFile () returned 0x8055e8 [0182.006] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7907c8 [0182.006] IcmpSendEcho2 (IcmpHandle=0x8055e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xed00a8c0, RequestData=0x3787ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7907c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2832 os_tid = 0x2a9c [0182.007] GetLastError () returned 0x57 [0182.007] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a729530 [0182.007] SetLastError (dwErrCode=0x57) [0182.007] IcmpCreateFile () returned 0x8052d8 [0182.008] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790818 [0182.008] IcmpSendEcho2 (IcmpHandle=0x8052d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xee00a8c0, RequestData=0x379bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790818, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2833 os_tid = 0x2aa0 [0182.011] GetLastError () returned 0x57 [0182.011] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a729fc8 [0182.012] SetLastError (dwErrCode=0x57) [0182.012] IcmpCreateFile () returned 0x805310 [0182.012] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790458 [0182.012] IcmpSendEcho2 (IcmpHandle=0x805310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xef00a8c0, RequestData=0x37afff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790458, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2834 os_tid = 0x2aa4 [0182.013] GetLastError () returned 0x57 [0182.013] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72a350 [0182.013] SetLastError (dwErrCode=0x57) [0182.013] IcmpCreateFile () returned 0x805348 [0182.013] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790868 [0182.013] IcmpSendEcho2 (IcmpHandle=0x805348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf000a8c0, RequestData=0x37c3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790868, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2835 os_tid = 0x2aa8 [0182.014] GetLastError () returned 0x57 [0182.015] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72a6d8 [0182.015] SetLastError (dwErrCode=0x57) [0182.015] IcmpCreateFile () returned 0x8053b8 [0182.015] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7908b8 [0182.015] IcmpSendEcho2 (IcmpHandle=0x8053b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf100a8c0, RequestData=0x37d7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7908b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2836 os_tid = 0x2aac [0182.016] GetLastError () returned 0x57 [0182.016] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72aa60 [0182.016] SetLastError (dwErrCode=0x57) [0182.016] IcmpCreateFile () returned 0x8053f0 [0182.016] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790908 [0182.016] IcmpSendEcho2 (IcmpHandle=0x8053f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf200a8c0, RequestData=0x37ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790908, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2837 os_tid = 0x2ab0 [0182.018] GetLastError () returned 0x57 [0182.018] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72ade8 [0182.018] SetLastError (dwErrCode=0x57) [0182.018] IcmpCreateFile () returned 0x805428 [0182.018] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790958 [0182.018] IcmpSendEcho2 (IcmpHandle=0x805428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf300a8c0, RequestData=0x37ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790958, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2838 os_tid = 0x2ab4 [0182.019] GetLastError () returned 0x57 [0182.019] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72b170 [0182.020] SetLastError (dwErrCode=0x57) [0182.020] IcmpCreateFile () returned 0x805460 [0182.020] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7909a8 [0182.020] IcmpSendEcho2 (IcmpHandle=0x805460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf400a8c0, RequestData=0x3813ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7909a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2839 os_tid = 0x2abc [0182.026] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.027] ReadFile (in: hFile=0x1dd8, lpBuffer=0x383bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x383bf85c, lpOverlapped=0x0 | out: lpBuffer=0x383bfb34*, lpNumberOfBytesRead=0x383bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.028] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.028] ReadFile (in: hFile=0x1dd8, lpBuffer=0x383bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x383bf85c, lpOverlapped=0x0 | out: lpBuffer=0x383bfb34*, lpNumberOfBytesRead=0x383bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.029] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.033] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.034] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x383bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0182.034] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x383bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x383bf828, pbKeyObject=0x0) returned 0x0 [0182.034] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x383bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x383bf500) returned 0x0 [0182.034] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.034] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x383bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x383bf500) returned 0x0 [0182.039] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.043] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.043] WriteFile (in: hFile=0x1dd8, lpBuffer=0x383bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x383bf830, lpOverlapped=0x0 | out: lpBuffer=0x383bfb34*, lpNumberOfBytesWritten=0x383bf830*=0x428, lpOverlapped=0x0) returned 1 [0182.043] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.043] ReadFile (in: hFile=0x1dd8, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x383bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x383bf61c*=0x1500, lpOverlapped=0x0) returned 1 [0182.043] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xffffeb00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.043] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x4b50000, cbInput=0x1500, pPaddingInfo=0x0, pbIV=0x383bf848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x383bf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x383bf848, pbOutput=0x4b50000, pcbResult=0x383bf618) returned 0x0 [0182.043] WriteFile (in: hFile=0x1dd8, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x383bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x383bf61c*=0x1510, lpOverlapped=0x0) returned 1 [0182.044] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383bf60c | out: lpNewFilePointer=0x0) returned 1 [0182.044] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.044] WriteFile (in: hFile=0x1dd8, lpBuffer=0x383bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x383bf61c, lpOverlapped=0x0 | out: lpBuffer=0x383bf83c*, lpNumberOfBytesWritten=0x383bf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.044] SetFilePointerEx (in: hFile=0x1dd8, liDistanceToMove=0x1510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.044] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0182.044] CloseHandle (hObject=0x1dd8) returned 1 [0182.044] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.play")) returned 1 [0182.048] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2840 os_tid = 0x2ac0 [0182.053] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.053] ReadFile (in: hFile=0x1a90, lpBuffer=0x384ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x384ff85c, lpOverlapped=0x0 | out: lpBuffer=0x384ffb34*, lpNumberOfBytesRead=0x384ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.055] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.055] ReadFile (in: hFile=0x1a90, lpBuffer=0x384ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x384ff85c, lpOverlapped=0x0 | out: lpBuffer=0x384ffb34*, lpNumberOfBytesRead=0x384ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.055] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.059] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.059] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x384ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0182.059] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x384ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x384ff828, pbKeyObject=0x0) returned 0x0 [0182.059] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x384ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x384ff500) returned 0x0 [0182.059] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.059] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x384ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x384ff500) returned 0x0 [0182.064] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.067] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.067] WriteFile (in: hFile=0x1a90, lpBuffer=0x384ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x384ff830, lpOverlapped=0x0 | out: lpBuffer=0x384ffb34*, lpNumberOfBytesWritten=0x384ff830*=0x428, lpOverlapped=0x0) returned 1 [0182.068] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.068] ReadFile (in: hFile=0x1a90, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x384ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x384ff61c*=0x2d7c, lpOverlapped=0x0) returned 1 [0182.069] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xffffd284, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.069] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x4c50000, cbInput=0x2d7c, pPaddingInfo=0x0, pbIV=0x384ff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x384ff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x384ff848, pbOutput=0x4c50000, pcbResult=0x384ff618) returned 0x0 [0182.069] WriteFile (in: hFile=0x1a90, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x384ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x384ff61c*=0x2d80, lpOverlapped=0x0) returned 1 [0182.069] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x384ff60c | out: lpNewFilePointer=0x0) returned 1 [0182.069] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.070] WriteFile (in: hFile=0x1a90, lpBuffer=0x384ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x384ff61c, lpOverlapped=0x0 | out: lpBuffer=0x384ff83c*, lpNumberOfBytesWritten=0x384ff61c*=0x8, lpOverlapped=0x0) returned 1 [0182.070] SetFilePointerEx (in: hFile=0x1a90, liDistanceToMove=0x2d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.070] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0182.070] CloseHandle (hObject=0x1a90) returned 1 [0182.070] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.play")) returned 1 [0182.075] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2841 os_tid = 0x2ac4 [0182.079] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.080] ReadFile (in: hFile=0x1fcc, lpBuffer=0x3863fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3863f85c, lpOverlapped=0x0 | out: lpBuffer=0x3863fb34*, lpNumberOfBytesRead=0x3863f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.116] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.116] ReadFile (in: hFile=0x1fcc, lpBuffer=0x3863fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3863f85c, lpOverlapped=0x0 | out: lpBuffer=0x3863fb34*, lpNumberOfBytesRead=0x3863f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.117] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.119] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x3863f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0182.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x3863f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x3863f828, pbKeyObject=0x0) returned 0x0 [0182.119] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3863f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3863f500) returned 0x0 [0182.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.120] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3863f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3863f500) returned 0x0 [0182.123] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.126] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.126] WriteFile (in: hFile=0x1fcc, lpBuffer=0x3863fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3863f830, lpOverlapped=0x0 | out: lpBuffer=0x3863fb34*, lpNumberOfBytesWritten=0x3863f830*=0x428, lpOverlapped=0x0) returned 1 [0182.126] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.126] ReadFile (in: hFile=0x1fcc, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x3863f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x3863f61c*=0x2870, lpOverlapped=0x0) returned 1 [0182.142] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0xffffd790, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.142] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4d50000, cbInput=0x2870, pPaddingInfo=0x0, pbIV=0x3863f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x3863f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3863f848, pbOutput=0x4d50000, pcbResult=0x3863f618) returned 0x0 [0182.142] WriteFile (in: hFile=0x1fcc, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x3863f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x3863f61c*=0x2880, lpOverlapped=0x0) returned 1 [0182.142] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3863f60c | out: lpNewFilePointer=0x0) returned 1 [0182.142] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.142] WriteFile (in: hFile=0x1fcc, lpBuffer=0x3863f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3863f61c, lpOverlapped=0x0 | out: lpBuffer=0x3863f83c*, lpNumberOfBytesWritten=0x3863f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.142] SetFilePointerEx (in: hFile=0x1fcc, liDistanceToMove=0x2880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.142] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0182.142] CloseHandle (hObject=0x1fcc) returned 1 [0182.142] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.play")) returned 1 [0182.146] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2842 os_tid = 0x2ac8 [0182.081] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.081] ReadFile (in: hFile=0x1fd4, lpBuffer=0x3877fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3877f85c, lpOverlapped=0x0 | out: lpBuffer=0x3877fb34*, lpNumberOfBytesRead=0x3877f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.084] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.084] ReadFile (in: hFile=0x1fd4, lpBuffer=0x3877fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3877f85c, lpOverlapped=0x0 | out: lpBuffer=0x3877fb34*, lpNumberOfBytesRead=0x3877f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.084] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.088] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.088] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x3877f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0182.088] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x3877f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x3877f828, pbKeyObject=0x0) returned 0x0 [0182.088] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3877f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3877f500) returned 0x0 [0182.088] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.088] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3877f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3877f500) returned 0x0 [0182.093] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.099] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.100] WriteFile (in: hFile=0x1fd4, lpBuffer=0x3877fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3877f830, lpOverlapped=0x0 | out: lpBuffer=0x3877fb34*, lpNumberOfBytesWritten=0x3877f830*=0x428, lpOverlapped=0x0) returned 1 [0182.101] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.101] ReadFile (in: hFile=0x1fd4, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x3877f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x3877f61c*=0x1d4c, lpOverlapped=0x0) returned 1 [0182.104] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0xffffe2b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.105] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x4e50000, cbInput=0x1d4c, pPaddingInfo=0x0, pbIV=0x3877f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x3877f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x3877f848, pbOutput=0x4e50000, pcbResult=0x3877f618) returned 0x0 [0182.105] WriteFile (in: hFile=0x1fd4, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x3877f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x3877f61c*=0x1d50, lpOverlapped=0x0) returned 1 [0182.105] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3877f60c | out: lpNewFilePointer=0x0) returned 1 [0182.106] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.106] WriteFile (in: hFile=0x1fd4, lpBuffer=0x3877f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3877f61c, lpOverlapped=0x0 | out: lpBuffer=0x3877f83c*, lpNumberOfBytesWritten=0x3877f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.106] SetFilePointerEx (in: hFile=0x1fd4, liDistanceToMove=0x1d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.106] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0182.106] CloseHandle (hObject=0x1fd4) returned 1 [0182.107] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.play")) returned 1 [0182.111] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2843 os_tid = 0x2acc [0182.127] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.127] ReadFile (in: hFile=0x1fdc, lpBuffer=0x388bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x388bf85c, lpOverlapped=0x0 | out: lpBuffer=0x388bfb34*, lpNumberOfBytesRead=0x388bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.129] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.129] ReadFile (in: hFile=0x1fdc, lpBuffer=0x388bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x388bf85c, lpOverlapped=0x0 | out: lpBuffer=0x388bfb34*, lpNumberOfBytesRead=0x388bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.129] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.132] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.132] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x388bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0182.132] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x388bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x388bf828, pbKeyObject=0x0) returned 0x0 [0182.132] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x388bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x388bf500) returned 0x0 [0182.132] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.132] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x388bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x388bf500) returned 0x0 [0182.136] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.139] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.139] WriteFile (in: hFile=0x1fdc, lpBuffer=0x388bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x388bf830, lpOverlapped=0x0 | out: lpBuffer=0x388bfb34*, lpNumberOfBytesWritten=0x388bf830*=0x428, lpOverlapped=0x0) returned 1 [0182.139] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.139] ReadFile (in: hFile=0x1fdc, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x388bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x388bf61c*=0x3040, lpOverlapped=0x0) returned 1 [0182.149] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0xffffcfc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.149] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x4f50000, cbInput=0x3040, pPaddingInfo=0x0, pbIV=0x388bf848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x388bf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x388bf848, pbOutput=0x4f50000, pcbResult=0x388bf618) returned 0x0 [0182.149] WriteFile (in: hFile=0x1fdc, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x388bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x388bf61c*=0x3050, lpOverlapped=0x0) returned 1 [0182.150] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x388bf60c | out: lpNewFilePointer=0x0) returned 1 [0182.150] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.150] WriteFile (in: hFile=0x1fdc, lpBuffer=0x388bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x388bf61c, lpOverlapped=0x0 | out: lpBuffer=0x388bf83c*, lpNumberOfBytesWritten=0x388bf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.150] SetFilePointerEx (in: hFile=0x1fdc, liDistanceToMove=0x3050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.150] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0182.150] CloseHandle (hObject=0x1fdc) returned 1 [0182.150] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.play")) returned 1 [0182.154] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2844 os_tid = 0x2ad0 [0182.157] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.157] ReadFile (in: hFile=0x1fe4, lpBuffer=0x389ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x389ff85c, lpOverlapped=0x0 | out: lpBuffer=0x389ffb34*, lpNumberOfBytesRead=0x389ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.159] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.159] ReadFile (in: hFile=0x1fe4, lpBuffer=0x389ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x389ff85c, lpOverlapped=0x0 | out: lpBuffer=0x389ffb34*, lpNumberOfBytesRead=0x389ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.159] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.162] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.162] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x389ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0182.162] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x389ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x389ff828, pbKeyObject=0x0) returned 0x0 [0182.162] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x389ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x389ff500) returned 0x0 [0182.162] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.162] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x389ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x389ff500) returned 0x0 [0182.166] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.168] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.168] WriteFile (in: hFile=0x1fe4, lpBuffer=0x389ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x389ff830, lpOverlapped=0x0 | out: lpBuffer=0x389ffb34*, lpNumberOfBytesWritten=0x389ff830*=0x428, lpOverlapped=0x0) returned 1 [0182.169] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.169] ReadFile (in: hFile=0x1fe4, lpBuffer=0x5050000, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x389ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x389ff61c*=0x2480, lpOverlapped=0x0) returned 1 [0182.169] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0xffffdb80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.169] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x5050000, cbInput=0x2480, pPaddingInfo=0x0, pbIV=0x389ff848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x389ff618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x389ff848, pbOutput=0x5050000, pcbResult=0x389ff618) returned 0x0 [0182.169] WriteFile (in: hFile=0x1fe4, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x389ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x389ff61c*=0x2490, lpOverlapped=0x0) returned 1 [0182.170] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389ff60c | out: lpNewFilePointer=0x0) returned 1 [0182.170] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.170] WriteFile (in: hFile=0x1fe4, lpBuffer=0x389ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x389ff61c, lpOverlapped=0x0 | out: lpBuffer=0x389ff83c*, lpNumberOfBytesWritten=0x389ff61c*=0x8, lpOverlapped=0x0) returned 1 [0182.170] SetFilePointerEx (in: hFile=0x1fe4, liDistanceToMove=0x2490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.170] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.170] CloseHandle (hObject=0x1fe4) returned 1 [0182.170] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.play")) returned 1 [0182.173] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2845 os_tid = 0x2ad4 [0182.178] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.178] ReadFile (in: hFile=0x121c, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.179] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.180] ReadFile (in: hFile=0x121c, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.180] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.182] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.183] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0182.183] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0182.183] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0182.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.183] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0182.186] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.189] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.189] WriteFile (in: hFile=0x121c, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0182.189] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.189] ReadFile (in: hFile=0x121c, lpBuffer=0x5150000, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x1444f61c*=0x3fe2, lpOverlapped=0x0) returned 1 [0182.191] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xffffc01e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.191] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x5150000, cbInput=0x3fe2, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x1444f848, pbOutput=0x5150000, pcbResult=0x1444f618) returned 0x0 [0182.191] WriteFile (in: hFile=0x121c, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x1444f61c*=0x3ff0, lpOverlapped=0x0) returned 1 [0182.191] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0182.191] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.191] WriteFile (in: hFile=0x121c, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.191] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x3ff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.191] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.191] CloseHandle (hObject=0x121c) returned 1 [0182.192] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.play")) returned 1 [0182.195] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2846 os_tid = 0x2ad8 [0182.199] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.199] ReadFile (in: hFile=0x1cd0, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.200] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.201] ReadFile (in: hFile=0x1cd0, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.201] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.203] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.203] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1484f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0182.203] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1484f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1484f828, pbKeyObject=0x0) returned 0x0 [0182.204] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1484f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1484f500) returned 0x0 [0182.204] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.204] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1484f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1484f500) returned 0x0 [0182.207] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.210] WriteFile (in: hFile=0x1cd0, lpBuffer=0x1484fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1484f830, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesWritten=0x1484f830*=0x428, lpOverlapped=0x0) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.210] ReadFile (in: hFile=0x1cd0, lpBuffer=0x2950000, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1484f61c*=0x14fc, lpOverlapped=0x0) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xffffeb04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.210] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x2950000, cbInput=0x14fc, pPaddingInfo=0x0, pbIV=0x1484f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1484f618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x1484f848, pbOutput=0x2950000, pcbResult=0x1484f618) returned 0x0 [0182.210] WriteFile (in: hFile=0x1cd0, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1484f61c*=0x1500, lpOverlapped=0x0) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1484f60c | out: lpNewFilePointer=0x0) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.211] WriteFile (in: hFile=0x1cd0, lpBuffer=0x1484f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x1484f83c*, lpNumberOfBytesWritten=0x1484f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.211] SetFilePointerEx (in: hFile=0x1cd0, liDistanceToMove=0x1500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.211] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.211] CloseHandle (hObject=0x1cd0) returned 1 [0182.211] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.213] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.play")) returned 1 [0182.215] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2847 os_tid = 0x2adc [0182.219] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.219] ReadFile (in: hFile=0x1f24, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.221] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.221] ReadFile (in: hFile=0x1f24, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.221] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.223] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0182.223] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0182.223] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0182.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.224] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0182.227] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.230] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.230] WriteFile (in: hFile=0x1f24, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0182.230] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.230] ReadFile (in: hFile=0x1f24, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x219ff61c*=0x1bcc, lpOverlapped=0x0) returned 1 [0182.231] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xffffe434, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.231] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x2b50000, cbInput=0x1bcc, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x219ff848, pbOutput=0x2b50000, pcbResult=0x219ff618) returned 0x0 [0182.231] WriteFile (in: hFile=0x1f24, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x219ff61c*=0x1bd0, lpOverlapped=0x0) returned 1 [0182.231] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0182.231] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.231] WriteFile (in: hFile=0x1f24, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0182.231] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x1bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.232] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.232] CloseHandle (hObject=0x1f24) returned 1 [0182.232] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.play")) returned 1 [0182.235] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2848 os_tid = 0x2ae0 [0182.239] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.239] ReadFile (in: hFile=0x1f04, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.240] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.240] ReadFile (in: hFile=0x1f04, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.240] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.242] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.242] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0182.242] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0182.243] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0182.243] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.243] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0182.397] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.405] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.405] WriteFile (in: hFile=0x1f04, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0182.405] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.405] ReadFile (in: hFile=0x1f04, lpBuffer=0x3050000, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d37f61c*=0x1d94, lpOverlapped=0x0) returned 1 [0182.408] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xffffe26c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.408] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x3050000, cbInput=0x1d94, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x2d37f848, pbOutput=0x3050000, pcbResult=0x2d37f618) returned 0x0 [0182.408] WriteFile (in: hFile=0x1f04, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d37f61c*=0x1da0, lpOverlapped=0x0) returned 1 [0182.408] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0182.408] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.409] WriteFile (in: hFile=0x1f04, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.409] SetFilePointerEx (in: hFile=0x1f04, liDistanceToMove=0x1da0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.409] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.409] CloseHandle (hObject=0x1f04) returned 1 [0182.409] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.play")) returned 1 [0182.415] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2849 os_tid = 0x2ae4 [0182.420] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.420] ReadFile (in: hFile=0x6b4, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.422] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.422] ReadFile (in: hFile=0x6b4, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.422] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.425] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.425] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0182.425] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0182.425] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0182.425] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.425] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0182.429] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.432] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.432] WriteFile (in: hFile=0x6b4, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0182.432] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.432] ReadFile (in: hFile=0x6b4, lpBuffer=0x3150000, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d47f61c*=0x221c, lpOverlapped=0x0) returned 1 [0182.433] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xffffdde4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.433] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x3150000, cbInput=0x221c, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x2d47f848, pbOutput=0x3150000, pcbResult=0x2d47f618) returned 0x0 [0182.433] WriteFile (in: hFile=0x6b4, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d47f61c*=0x2220, lpOverlapped=0x0) returned 1 [0182.433] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0182.434] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.434] WriteFile (in: hFile=0x6b4, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.434] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x2220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.434] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.434] CloseHandle (hObject=0x6b4) returned 1 [0182.434] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.play")) returned 1 [0182.438] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2850 os_tid = 0x2ae8 [0182.442] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.442] ReadFile (in: hFile=0x1d18, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.443] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.443] ReadFile (in: hFile=0x1d18, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.443] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.445] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.445] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0182.445] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0182.445] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0182.445] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.446] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0182.449] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.451] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.451] WriteFile (in: hFile=0x1d18, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0182.451] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.451] ReadFile (in: hFile=0x1d18, lpBuffer=0x3250000, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d57f61c*=0xaac, lpOverlapped=0x0) returned 1 [0182.451] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xfffff554, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.452] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x3250000, cbInput=0xaac, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x2d57f848, pbOutput=0x3250000, pcbResult=0x2d57f618) returned 0x0 [0182.452] WriteFile (in: hFile=0x1d18, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d57f61c*=0xab0, lpOverlapped=0x0) returned 1 [0182.452] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0182.452] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.452] WriteFile (in: hFile=0x1d18, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.452] SetFilePointerEx (in: hFile=0x1d18, liDistanceToMove=0xab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.452] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.452] CloseHandle (hObject=0x1d18) returned 1 [0182.452] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.play")) returned 1 [0182.455] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2851 os_tid = 0x2aec [0182.459] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.459] ReadFile (in: hFile=0x1f14, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.461] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.461] ReadFile (in: hFile=0x1f14, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.461] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.463] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.463] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0182.463] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0182.463] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0182.463] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.463] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0182.466] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.469] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.469] WriteFile (in: hFile=0x1f14, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0182.469] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.469] ReadFile (in: hFile=0x1f14, lpBuffer=0x3350000, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d67f61c*=0x2394, lpOverlapped=0x0) returned 1 [0182.470] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xffffdc6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.470] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x3350000, cbInput=0x2394, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x2d67f848, pbOutput=0x3350000, pcbResult=0x2d67f618) returned 0x0 [0182.470] WriteFile (in: hFile=0x1f14, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d67f61c*=0x23a0, lpOverlapped=0x0) returned 1 [0182.470] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0182.470] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.470] WriteFile (in: hFile=0x1f14, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.470] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x23a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.471] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.471] CloseHandle (hObject=0x1f14) returned 1 [0182.471] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.play")) returned 1 [0182.474] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2852 os_tid = 0x2af0 [0182.478] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.478] ReadFile (in: hFile=0x1ce0, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.480] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.480] ReadFile (in: hFile=0x1ce0, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.480] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.482] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.482] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2d7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0182.482] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2d7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2d7bf828, pbKeyObject=0x0) returned 0x0 [0182.482] BCryptExportKey (in: hKey=0x7f4500, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d7bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d7bf500) returned 0x0 [0182.485] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.485] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d7bf500) returned 0x0 [0182.490] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.493] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.493] WriteFile (in: hFile=0x1ce0, lpBuffer=0x2d7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesWritten=0x2d7bf830*=0x428, lpOverlapped=0x0) returned 1 [0182.493] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.493] ReadFile (in: hFile=0x1ce0, lpBuffer=0x3450000, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2d7bf61c*=0x2a44, lpOverlapped=0x0) returned 1 [0182.494] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xffffd5bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.494] BCryptEncrypt (in: hKey=0x7f4500, pbInput=0x3450000, cbInput=0x2a44, pPaddingInfo=0x0, pbIV=0x2d7bf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2d7bf618, dwFlags=0x1 | out: hKey=0x7f4500, pbIV=0x2d7bf848, pbOutput=0x3450000, pcbResult=0x2d7bf618) returned 0x0 [0182.494] WriteFile (in: hFile=0x1ce0, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2d7bf61c*=0x2a50, lpOverlapped=0x0) returned 1 [0182.494] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf60c | out: lpNewFilePointer=0x0) returned 1 [0182.494] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.495] WriteFile (in: hFile=0x1ce0, lpBuffer=0x2d7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf83c*, lpNumberOfBytesWritten=0x2d7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.495] SetFilePointerEx (in: hFile=0x1ce0, liDistanceToMove=0x2a50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.495] BCryptDestroyKey (in: hKey=0x7f4500 | out: hKey=0x7f4500) returned 0x0 [0182.495] CloseHandle (hObject=0x1ce0) returned 1 [0182.495] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.play")) returned 1 [0182.498] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2853 os_tid = 0x2af4 [0182.502] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.502] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.523] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.523] ReadFile (in: hFile=0x1bc0, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.524] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.526] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.526] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2da3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0182.526] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2da3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2da3f828, pbKeyObject=0x0) returned 0x0 [0182.526] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2da3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2da3f500) returned 0x0 [0182.526] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.526] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2da3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2da3f500) returned 0x0 [0182.529] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.532] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.532] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2da3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da3f830, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesWritten=0x2da3f830*=0x428, lpOverlapped=0x0) returned 1 [0182.532] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.532] ReadFile (in: hFile=0x1bc0, lpBuffer=0x3550000, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2da3f61c*=0x1258, lpOverlapped=0x0) returned 1 [0182.532] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xffffeda8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.532] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3550000, cbInput=0x1258, pPaddingInfo=0x0, pbIV=0x2da3f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2da3f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2da3f848, pbOutput=0x3550000, pcbResult=0x2da3f618) returned 0x0 [0182.532] WriteFile (in: hFile=0x1bc0, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2da3f61c*=0x1260, lpOverlapped=0x0) returned 1 [0182.532] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da3f60c | out: lpNewFilePointer=0x0) returned 1 [0182.533] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.533] WriteFile (in: hFile=0x1bc0, lpBuffer=0x2da3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da3f83c*, lpNumberOfBytesWritten=0x2da3f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.533] SetFilePointerEx (in: hFile=0x1bc0, liDistanceToMove=0x1260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.533] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.533] CloseHandle (hObject=0x1bc0) returned 1 [0182.533] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.play")) returned 1 [0182.536] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2854 os_tid = 0x2af8 [0182.504] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.504] ReadFile (in: hFile=0x1f70, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.506] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.508] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.508] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2db7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0182.508] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2db7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2db7f828, pbKeyObject=0x0) returned 0x0 [0182.508] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2db7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2db7f500) returned 0x0 [0182.508] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.509] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2db7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2db7f500) returned 0x0 [0182.512] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.515] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.515] WriteFile (in: hFile=0x1f70, lpBuffer=0x2db7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db7f830, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesWritten=0x2db7f830*=0x428, lpOverlapped=0x0) returned 1 [0182.515] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.515] ReadFile (in: hFile=0x1f70, lpBuffer=0x3750000, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2db7f61c*=0x834, lpOverlapped=0x0) returned 1 [0182.515] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffff7cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.515] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3750000, cbInput=0x834, pPaddingInfo=0x0, pbIV=0x2db7f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2db7f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2db7f848, pbOutput=0x3750000, pcbResult=0x2db7f618) returned 0x0 [0182.515] WriteFile (in: hFile=0x1f70, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2db7f61c*=0x840, lpOverlapped=0x0) returned 1 [0182.515] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db7f60c | out: lpNewFilePointer=0x0) returned 1 [0182.515] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.515] WriteFile (in: hFile=0x1f70, lpBuffer=0x2db7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db7f83c*, lpNumberOfBytesWritten=0x2db7f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.515] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x840, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.515] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0182.515] CloseHandle (hObject=0x1f70) returned 1 [0182.516] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.play")) returned 1 [0182.520] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2855 os_tid = 0x2afc [0182.540] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.540] ReadFile (in: hFile=0x1284, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.541] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.541] ReadFile (in: hFile=0x1284, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.542] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.544] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.544] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2df3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0182.544] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2df3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2df3f828, pbKeyObject=0x0) returned 0x0 [0182.544] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2df3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2df3f500) returned 0x0 [0182.544] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.544] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2df3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2df3f500) returned 0x0 [0182.548] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.551] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.551] WriteFile (in: hFile=0x1284, lpBuffer=0x2df3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2df3f830, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesWritten=0x2df3f830*=0x428, lpOverlapped=0x0) returned 1 [0182.551] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.551] ReadFile (in: hFile=0x1284, lpBuffer=0x3850000, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2df3f61c*=0x15f4, lpOverlapped=0x0) returned 1 [0182.551] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xffffea0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.552] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3850000, cbInput=0x15f4, pPaddingInfo=0x0, pbIV=0x2df3f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2df3f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2df3f848, pbOutput=0x3850000, pcbResult=0x2df3f618) returned 0x0 [0182.552] WriteFile (in: hFile=0x1284, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2df3f61c*=0x1600, lpOverlapped=0x0) returned 1 [0182.552] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2df3f60c | out: lpNewFilePointer=0x0) returned 1 [0182.552] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.552] WriteFile (in: hFile=0x1284, lpBuffer=0x2df3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2df3f83c*, lpNumberOfBytesWritten=0x2df3f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.552] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x1600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.552] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.552] CloseHandle (hObject=0x1284) returned 1 [0182.552] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.play")) returned 1 [0182.556] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2856 os_tid = 0x2b00 [0182.559] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.559] ReadFile (in: hFile=0x1f90, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.561] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.561] ReadFile (in: hFile=0x1f90, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.563] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0182.563] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e07f828, pbKeyObject=0x0) returned 0x0 [0182.563] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e07f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e07f500) returned 0x0 [0182.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.563] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e07f500) returned 0x0 [0182.567] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.569] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.569] WriteFile (in: hFile=0x1f90, lpBuffer=0x2e07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e07f830, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesWritten=0x2e07f830*=0x428, lpOverlapped=0x0) returned 1 [0182.570] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.570] ReadFile (in: hFile=0x1f90, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e07f61c*=0xd90, lpOverlapped=0x0) returned 1 [0182.570] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffff270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.570] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3b50000, cbInput=0xd90, pPaddingInfo=0x0, pbIV=0x2e07f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e07f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e07f848, pbOutput=0x3b50000, pcbResult=0x2e07f618) returned 0x0 [0182.570] WriteFile (in: hFile=0x1f90, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e07f61c*=0xda0, lpOverlapped=0x0) returned 1 [0182.570] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e07f60c | out: lpNewFilePointer=0x0) returned 1 [0182.570] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.570] WriteFile (in: hFile=0x1f90, lpBuffer=0x2e07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e07f83c*, lpNumberOfBytesWritten=0x2e07f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.570] SetFilePointerEx (in: hFile=0x1f90, liDistanceToMove=0xda0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.570] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.570] CloseHandle (hObject=0x1f90) returned 1 [0182.570] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.play")) returned 1 [0182.574] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2857 os_tid = 0x2b04 [0182.577] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.577] ReadFile (in: hFile=0x1fec, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.579] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.579] ReadFile (in: hFile=0x1fec, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.579] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.581] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.581] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2e1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0182.581] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2e1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2e1bf828, pbKeyObject=0x0) returned 0x0 [0182.581] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e1bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e1bf500) returned 0x0 [0182.581] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.581] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e1bf500) returned 0x0 [0182.585] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.587] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.587] WriteFile (in: hFile=0x1fec, lpBuffer=0x2e1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesWritten=0x2e1bf830*=0x428, lpOverlapped=0x0) returned 1 [0182.588] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.588] ReadFile (in: hFile=0x1fec, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2e1bf61c*=0x1388, lpOverlapped=0x0) returned 1 [0182.588] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xffffec78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.588] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3c50000, cbInput=0x1388, pPaddingInfo=0x0, pbIV=0x2e1bf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2e1bf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e1bf848, pbOutput=0x3c50000, pcbResult=0x2e1bf618) returned 0x0 [0182.588] WriteFile (in: hFile=0x1fec, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2e1bf61c*=0x1390, lpOverlapped=0x0) returned 1 [0182.588] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1bf60c | out: lpNewFilePointer=0x0) returned 1 [0182.588] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.588] WriteFile (in: hFile=0x1fec, lpBuffer=0x2e1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bf83c*, lpNumberOfBytesWritten=0x2e1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.588] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.588] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.588] CloseHandle (hObject=0x1fec) returned 1 [0182.588] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.play")) returned 1 [0182.591] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2858 os_tid = 0x2b08 [0182.595] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.595] ReadFile (in: hFile=0x1ff4, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.597] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.597] ReadFile (in: hFile=0x1ff4, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.597] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.599] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0182.599] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e2ff828, pbKeyObject=0x0) returned 0x0 [0182.599] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e2ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e2ff500) returned 0x0 [0182.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.599] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e2ff500) returned 0x0 [0182.603] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.605] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.605] WriteFile (in: hFile=0x1ff4, lpBuffer=0x2e2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesWritten=0x2e2ff830*=0x428, lpOverlapped=0x0) returned 1 [0182.605] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.606] ReadFile (in: hFile=0x1ff4, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e2ff61c*=0x29dc, lpOverlapped=0x0) returned 1 [0182.606] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0xffffd624, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.606] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3d50000, cbInput=0x29dc, pPaddingInfo=0x0, pbIV=0x2e2ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e2ff618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e2ff848, pbOutput=0x3d50000, pcbResult=0x2e2ff618) returned 0x0 [0182.606] WriteFile (in: hFile=0x1ff4, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e2ff61c*=0x29e0, lpOverlapped=0x0) returned 1 [0182.606] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2ff60c | out: lpNewFilePointer=0x0) returned 1 [0182.606] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.607] WriteFile (in: hFile=0x1ff4, lpBuffer=0x2e2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ff83c*, lpNumberOfBytesWritten=0x2e2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0182.607] SetFilePointerEx (in: hFile=0x1ff4, liDistanceToMove=0x29e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.607] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.607] CloseHandle (hObject=0x1ff4) returned 1 [0182.607] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.play")) returned 1 [0182.610] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2859 os_tid = 0x2b0c [0182.614] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.614] ReadFile (in: hFile=0x1ffc, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.615] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.615] ReadFile (in: hFile=0x1ffc, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.615] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.617] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.617] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2e43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0182.617] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2e43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2e43f828, pbKeyObject=0x0) returned 0x0 [0182.617] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e43f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e43f500) returned 0x0 [0182.618] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.618] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e43f500) returned 0x0 [0182.621] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.623] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.623] WriteFile (in: hFile=0x1ffc, lpBuffer=0x2e43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e43f830, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesWritten=0x2e43f830*=0x428, lpOverlapped=0x0) returned 1 [0182.623] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.623] ReadFile (in: hFile=0x1ffc, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2e43f61c*=0x3004, lpOverlapped=0x0) returned 1 [0182.625] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xffffcffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.625] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3e50000, cbInput=0x3004, pPaddingInfo=0x0, pbIV=0x2e43f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2e43f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e43f848, pbOutput=0x3e50000, pcbResult=0x2e43f618) returned 0x0 [0182.625] WriteFile (in: hFile=0x1ffc, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2e43f61c*=0x3010, lpOverlapped=0x0) returned 1 [0182.625] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e43f60c | out: lpNewFilePointer=0x0) returned 1 [0182.625] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.625] WriteFile (in: hFile=0x1ffc, lpBuffer=0x2e43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f83c*, lpNumberOfBytesWritten=0x2e43f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.625] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x3010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.625] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.625] CloseHandle (hObject=0x1ffc) returned 1 [0182.625] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.play")) returned 1 [0182.632] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2860 os_tid = 0x2b10 [0182.635] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.635] ReadFile (in: hFile=0x1cc8, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.637] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.637] ReadFile (in: hFile=0x1cc8, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.637] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.639] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.639] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2d8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0182.639] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2d8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2d8ff828, pbKeyObject=0x0) returned 0x0 [0182.639] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d8ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0182.640] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.640] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0182.643] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.646] WriteFile (in: hFile=0x1cc8, lpBuffer=0x2d8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesWritten=0x2d8ff830*=0x428, lpOverlapped=0x0) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.646] ReadFile (in: hFile=0x1cc8, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2d8ff61c*=0x16c0, lpOverlapped=0x0) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xffffe940, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.646] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3f50000, cbInput=0x16c0, pPaddingInfo=0x0, pbIV=0x2d8ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2d8ff618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2d8ff848, pbOutput=0x3f50000, pcbResult=0x2d8ff618) returned 0x0 [0182.646] WriteFile (in: hFile=0x1cc8, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2d8ff61c*=0x16d0, lpOverlapped=0x0) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8ff60c | out: lpNewFilePointer=0x0) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.646] WriteFile (in: hFile=0x1cc8, lpBuffer=0x2d8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ff83c*, lpNumberOfBytesWritten=0x2d8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0182.647] SetFilePointerEx (in: hFile=0x1cc8, liDistanceToMove=0x16d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.647] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.647] CloseHandle (hObject=0x1cc8) returned 1 [0182.647] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.play")) returned 1 [0182.650] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2861 os_tid = 0x2b14 [0182.653] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.654] ReadFile (in: hFile=0x2008, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.655] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.655] ReadFile (in: hFile=0x2008, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.655] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.657] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.657] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2e57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0182.657] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2e57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2e57f828, pbKeyObject=0x0) returned 0x0 [0182.657] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e57f500) returned 0x0 [0182.657] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.657] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e57f500) returned 0x0 [0182.661] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.663] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.663] WriteFile (in: hFile=0x2008, lpBuffer=0x2e57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e57f830, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesWritten=0x2e57f830*=0x428, lpOverlapped=0x0) returned 1 [0182.664] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.664] ReadFile (in: hFile=0x2008, lpBuffer=0x3650000, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2e57f61c*=0x3b5c, lpOverlapped=0x0) returned 1 [0182.664] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xffffc4a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.664] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3650000, cbInput=0x3b5c, pPaddingInfo=0x0, pbIV=0x2e57f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2e57f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e57f848, pbOutput=0x3650000, pcbResult=0x2e57f618) returned 0x0 [0182.664] WriteFile (in: hFile=0x2008, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2e57f61c*=0x3b60, lpOverlapped=0x0) returned 1 [0182.664] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e57f60c | out: lpNewFilePointer=0x0) returned 1 [0182.665] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.665] WriteFile (in: hFile=0x2008, lpBuffer=0x2e57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e57f83c*, lpNumberOfBytesWritten=0x2e57f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.665] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x3b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.665] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.665] CloseHandle (hObject=0x2008) returned 1 [0182.665] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.play")) returned 1 [0182.668] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2862 os_tid = 0x2b18 [0182.672] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.672] ReadFile (in: hFile=0x2010, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.673] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.673] ReadFile (in: hFile=0x2010, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.688] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.688] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0182.688] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0182.688] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0182.688] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.688] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0182.692] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.695] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.696] WriteFile (in: hFile=0x2010, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0182.696] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.696] ReadFile (in: hFile=0x2010, lpBuffer=0x4050000, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2e6bf61c*=0x3e9e, lpOverlapped=0x0) returned 1 [0182.697] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0xffffc162, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.697] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x4050000, cbInput=0x3e9e, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e6bf848, pbOutput=0x4050000, pcbResult=0x2e6bf618) returned 0x0 [0182.697] WriteFile (in: hFile=0x2010, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x3ea0, lpOverlapped=0x0) returned 1 [0182.697] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0182.697] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.697] WriteFile (in: hFile=0x2010, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.697] SetFilePointerEx (in: hFile=0x2010, liDistanceToMove=0x3ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.697] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.697] CloseHandle (hObject=0x2010) returned 1 [0182.697] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.700] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.play")) returned 1 [0182.701] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2863 os_tid = 0x2b1c [0182.705] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.705] ReadFile (in: hFile=0x2018, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.706] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.706] ReadFile (in: hFile=0x2018, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.706] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.709] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.709] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x2e7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0182.709] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x2e7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x2e7ff828, pbKeyObject=0x0) returned 0x0 [0182.709] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0182.709] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.709] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0182.713] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.716] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.716] WriteFile (in: hFile=0x2018, lpBuffer=0x2e7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesWritten=0x2e7ff830*=0x428, lpOverlapped=0x0) returned 1 [0182.716] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.716] ReadFile (in: hFile=0x2018, lpBuffer=0x4150000, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2e7ff61c*=0x73a2, lpOverlapped=0x0) returned 1 [0182.717] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xffff8c5e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.717] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x4150000, cbInput=0x73a2, pPaddingInfo=0x0, pbIV=0x2e7ff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2e7ff618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e7ff848, pbOutput=0x4150000, pcbResult=0x2e7ff618) returned 0x0 [0182.717] WriteFile (in: hFile=0x2018, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2e7ff61c*=0x73b0, lpOverlapped=0x0) returned 1 [0182.717] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7ff60c | out: lpNewFilePointer=0x0) returned 1 [0182.717] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.718] WriteFile (in: hFile=0x2018, lpBuffer=0x2e7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ff83c*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0182.718] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x73b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.718] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.718] CloseHandle (hObject=0x2018) returned 1 [0182.718] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.720] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.play")) returned 1 [0182.722] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2864 os_tid = 0x2b20 [0182.726] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.727] ReadFile (in: hFile=0x2020, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.728] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.728] ReadFile (in: hFile=0x2020, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.728] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.730] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.730] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x2e93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0182.730] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x2e93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x2e93f828, pbKeyObject=0x0) returned 0x0 [0182.730] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0182.731] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.731] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0182.734] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.737] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.737] WriteFile (in: hFile=0x2020, lpBuffer=0x2e93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e93f830, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesWritten=0x2e93f830*=0x428, lpOverlapped=0x0) returned 1 [0182.737] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.737] ReadFile (in: hFile=0x2020, lpBuffer=0x4250000, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x2e93f61c*=0x336a, lpOverlapped=0x0) returned 1 [0182.739] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0xffffcc96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.739] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x4250000, cbInput=0x336a, pPaddingInfo=0x0, pbIV=0x2e93f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x2e93f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e93f848, pbOutput=0x4250000, pcbResult=0x2e93f618) returned 0x0 [0182.739] WriteFile (in: hFile=0x2020, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x2e93f61c*=0x3370, lpOverlapped=0x0) returned 1 [0182.739] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93f60c | out: lpNewFilePointer=0x0) returned 1 [0182.739] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.739] WriteFile (in: hFile=0x2020, lpBuffer=0x2e93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e93f83c*, lpNumberOfBytesWritten=0x2e93f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.739] SetFilePointerEx (in: hFile=0x2020, liDistanceToMove=0x3370, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.739] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.739] CloseHandle (hObject=0x2020) returned 1 [0182.739] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.741] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.play")) returned 1 [0182.743] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2865 os_tid = 0x2b24 [0182.746] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.746] ReadFile (in: hFile=0x2028, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.748] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.748] ReadFile (in: hFile=0x2028, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.748] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.750] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.750] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x2ea7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0182.750] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x2ea7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x2ea7f828, pbKeyObject=0x0) returned 0x0 [0182.750] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ea7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0182.750] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.750] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ea7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0182.754] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.757] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.757] WriteFile (in: hFile=0x2028, lpBuffer=0x2ea7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ea7f830, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesWritten=0x2ea7f830*=0x428, lpOverlapped=0x0) returned 1 [0182.758] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.758] ReadFile (in: hFile=0x2028, lpBuffer=0x4350000, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x2ea7f61c*=0x1ca4, lpOverlapped=0x0) returned 1 [0182.758] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xffffe35c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.759] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x4350000, cbInput=0x1ca4, pPaddingInfo=0x0, pbIV=0x2ea7f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x2ea7f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2ea7f848, pbOutput=0x4350000, pcbResult=0x2ea7f618) returned 0x0 [0182.759] WriteFile (in: hFile=0x2028, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x2ea7f61c*=0x1cb0, lpOverlapped=0x0) returned 1 [0182.759] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea7f60c | out: lpNewFilePointer=0x0) returned 1 [0182.759] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.759] WriteFile (in: hFile=0x2028, lpBuffer=0x2ea7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7f83c*, lpNumberOfBytesWritten=0x2ea7f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.759] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x1cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.759] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.759] CloseHandle (hObject=0x2028) returned 1 [0182.759] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.play")) returned 1 [0182.763] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2866 os_tid = 0x2b28 [0182.767] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.767] ReadFile (in: hFile=0x2030, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.769] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.769] ReadFile (in: hFile=0x2030, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.769] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.771] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.771] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x30bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0182.771] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x30bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x30bbf828, pbKeyObject=0x0) returned 0x0 [0182.771] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30bbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0182.771] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.771] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0182.774] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.777] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.777] WriteFile (in: hFile=0x2030, lpBuffer=0x30bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bbf830, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesWritten=0x30bbf830*=0x428, lpOverlapped=0x0) returned 1 [0182.777] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.777] ReadFile (in: hFile=0x2030, lpBuffer=0x4450000, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x30bbf61c*=0x11b6, lpOverlapped=0x0) returned 1 [0182.777] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0xffffee4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.778] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x4450000, cbInput=0x11b6, pPaddingInfo=0x0, pbIV=0x30bbf848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x30bbf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x30bbf848, pbOutput=0x4450000, pcbResult=0x30bbf618) returned 0x0 [0182.778] WriteFile (in: hFile=0x2030, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x30bbf61c*=0x11c0, lpOverlapped=0x0) returned 1 [0182.778] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bbf60c | out: lpNewFilePointer=0x0) returned 1 [0182.778] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.778] WriteFile (in: hFile=0x2030, lpBuffer=0x30bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30bbf83c*, lpNumberOfBytesWritten=0x30bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.778] SetFilePointerEx (in: hFile=0x2030, liDistanceToMove=0x11c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.778] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.778] CloseHandle (hObject=0x2030) returned 1 [0182.778] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.play")) returned 1 [0182.783] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2867 os_tid = 0x2b2c [0182.788] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.788] ReadFile (in: hFile=0x2038, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.790] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.790] ReadFile (in: hFile=0x2038, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.790] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.792] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.792] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x30cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0182.792] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x30cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x30cbf828, pbKeyObject=0x0) returned 0x0 [0182.792] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30cbf500) returned 0x0 [0182.793] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.793] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30cbf500) returned 0x0 [0182.796] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.799] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.799] WriteFile (in: hFile=0x2038, lpBuffer=0x30cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30cbf830, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesWritten=0x30cbf830*=0x428, lpOverlapped=0x0) returned 1 [0182.799] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.799] ReadFile (in: hFile=0x2038, lpBuffer=0x4550000, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x30cbf61c*=0x207a, lpOverlapped=0x0) returned 1 [0182.800] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xffffdf86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.800] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x4550000, cbInput=0x207a, pPaddingInfo=0x0, pbIV=0x30cbf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x30cbf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x30cbf848, pbOutput=0x4550000, pcbResult=0x30cbf618) returned 0x0 [0182.800] WriteFile (in: hFile=0x2038, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x30cbf61c*=0x2080, lpOverlapped=0x0) returned 1 [0182.800] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cbf60c | out: lpNewFilePointer=0x0) returned 1 [0182.800] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.800] WriteFile (in: hFile=0x2038, lpBuffer=0x30cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30cbf83c*, lpNumberOfBytesWritten=0x30cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.800] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x2080, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.800] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.800] CloseHandle (hObject=0x2038) returned 1 [0182.801] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.play")) returned 1 [0182.804] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2868 os_tid = 0x2b30 [0182.808] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.808] ReadFile (in: hFile=0x2040, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.810] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.810] ReadFile (in: hFile=0x2040, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.810] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.813] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.813] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x30dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0182.813] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x30dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x30dbf828, pbKeyObject=0x0) returned 0x0 [0182.813] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30dbf500) returned 0x0 [0182.813] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.813] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30dbf500) returned 0x0 [0182.816] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.819] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.819] WriteFile (in: hFile=0x2040, lpBuffer=0x30dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30dbf830, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesWritten=0x30dbf830*=0x428, lpOverlapped=0x0) returned 1 [0182.819] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.820] ReadFile (in: hFile=0x2040, lpBuffer=0x4650000, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x30dbf61c*=0x72f8, lpOverlapped=0x0) returned 1 [0182.832] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0xffff8d08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.832] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x4650000, cbInput=0x72f8, pPaddingInfo=0x0, pbIV=0x30dbf848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x30dbf618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x30dbf848, pbOutput=0x4650000, pcbResult=0x30dbf618) returned 0x0 [0182.832] WriteFile (in: hFile=0x2040, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x30dbf61c*=0x7300, lpOverlapped=0x0) returned 1 [0182.832] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dbf60c | out: lpNewFilePointer=0x0) returned 1 [0182.832] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.832] WriteFile (in: hFile=0x2040, lpBuffer=0x30dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30dbf83c*, lpNumberOfBytesWritten=0x30dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.832] SetFilePointerEx (in: hFile=0x2040, liDistanceToMove=0x7300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.832] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0182.832] CloseHandle (hObject=0x2040) returned 1 [0182.833] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.play")) returned 1 [0182.836] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2869 os_tid = 0x2b34 [0182.809] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.809] ReadFile (in: hFile=0x2048, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.821] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.821] ReadFile (in: hFile=0x2048, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.821] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.823] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.823] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x30ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0182.823] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x30ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x30ebf828, pbKeyObject=0x0) returned 0x0 [0182.823] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30ebf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30ebf500) returned 0x0 [0182.823] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.824] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30ebf500) returned 0x0 [0182.827] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.830] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.830] WriteFile (in: hFile=0x2048, lpBuffer=0x30ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30ebf830, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesWritten=0x30ebf830*=0x428, lpOverlapped=0x0) returned 1 [0182.830] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.830] ReadFile (in: hFile=0x2048, lpBuffer=0x4750000, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x30ebf61c*=0x5350, lpOverlapped=0x0) returned 1 [0182.840] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xffffacb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.840] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x4750000, cbInput=0x5350, pPaddingInfo=0x0, pbIV=0x30ebf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x30ebf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x30ebf848, pbOutput=0x4750000, pcbResult=0x30ebf618) returned 0x0 [0182.840] WriteFile (in: hFile=0x2048, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x30ebf61c*=0x5360, lpOverlapped=0x0) returned 1 [0182.840] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ebf60c | out: lpNewFilePointer=0x0) returned 1 [0182.841] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.841] WriteFile (in: hFile=0x2048, lpBuffer=0x30ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x30ebf83c*, lpNumberOfBytesWritten=0x30ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.841] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x5360, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.841] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0182.841] CloseHandle (hObject=0x2048) returned 1 [0182.841] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.play")) returned 1 [0182.845] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2870 os_tid = 0x2b38 [0182.820] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.850] ReadFile (in: hFile=0x2050, lpBuffer=0x365bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x365bf85c, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesRead=0x365bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.851] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.851] ReadFile (in: hFile=0x2050, lpBuffer=0x365bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x365bf85c, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesRead=0x365bf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.851] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.854] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.854] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x365bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0182.854] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x365bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x365bf828, pbKeyObject=0x0) returned 0x0 [0182.854] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x365bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x365bf500) returned 0x0 [0182.855] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.855] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x365bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x365bf500) returned 0x0 [0182.860] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.864] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.864] WriteFile (in: hFile=0x2050, lpBuffer=0x365bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x365bf830, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesWritten=0x365bf830*=0x428, lpOverlapped=0x0) returned 1 [0182.864] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.865] ReadFile (in: hFile=0x2050, lpBuffer=0x4850000, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x365bf61c*=0x48be, lpOverlapped=0x0) returned 1 [0182.865] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0xffffb742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.866] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x4850000, cbInput=0x48be, pPaddingInfo=0x0, pbIV=0x365bf848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x365bf618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x365bf848, pbOutput=0x4850000, pcbResult=0x365bf618) returned 0x0 [0182.866] WriteFile (in: hFile=0x2050, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x365bf61c*=0x48c0, lpOverlapped=0x0) returned 1 [0182.866] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365bf60c | out: lpNewFilePointer=0x0) returned 1 [0182.866] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.866] WriteFile (in: hFile=0x2050, lpBuffer=0x365bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x365bf83c*, lpNumberOfBytesWritten=0x365bf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.866] SetFilePointerEx (in: hFile=0x2050, liDistanceToMove=0x48c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.866] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0182.866] CloseHandle (hObject=0x2050) returned 1 [0182.866] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.play")) returned 1 [0182.872] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2871 os_tid = 0x2b3c [0182.887] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.887] ReadFile (in: hFile=0x2058, lpBuffer=0x38b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38b3fb34*, lpNumberOfBytesRead=0x38b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.889] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.889] ReadFile (in: hFile=0x2058, lpBuffer=0x38b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38b3fb34*, lpNumberOfBytesRead=0x38b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.896] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.896] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x38b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0182.897] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x38b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x38b3f828, pbKeyObject=0x0) returned 0x0 [0182.897] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x38b3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x38b3f500) returned 0x0 [0182.897] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.897] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x38b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x38b3f500) returned 0x0 [0182.902] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.905] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.905] WriteFile (in: hFile=0x2058, lpBuffer=0x38b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38b3f830, lpOverlapped=0x0 | out: lpBuffer=0x38b3fb34*, lpNumberOfBytesWritten=0x38b3f830*=0x428, lpOverlapped=0x0) returned 1 [0182.906] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.906] ReadFile (in: hFile=0x2058, lpBuffer=0x5250000, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x38b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x38b3f61c*=0xe60, lpOverlapped=0x0) returned 1 [0182.906] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffff1a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.906] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x5250000, cbInput=0xe60, pPaddingInfo=0x0, pbIV=0x38b3f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x38b3f618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x38b3f848, pbOutput=0x5250000, pcbResult=0x38b3f618) returned 0x0 [0182.906] WriteFile (in: hFile=0x2058, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x38b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x38b3f61c*=0xe70, lpOverlapped=0x0) returned 1 [0182.906] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38b3f60c | out: lpNewFilePointer=0x0) returned 1 [0182.906] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.906] WriteFile (in: hFile=0x2058, lpBuffer=0x38b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x38b3f83c*, lpNumberOfBytesWritten=0x38b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.906] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xe70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.907] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0182.907] CloseHandle (hObject=0x2058) returned 1 [0182.907] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.play")) returned 1 [0182.911] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2872 os_tid = 0x2b40 [0182.915] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.915] ReadFile (in: hFile=0x2060, lpBuffer=0x38c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x38c7fb34*, lpNumberOfBytesRead=0x38c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.917] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.917] ReadFile (in: hFile=0x2060, lpBuffer=0x38c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x38c7fb34*, lpNumberOfBytesRead=0x38c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.920] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x38c7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0182.920] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x38c7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x38c7f828, pbKeyObject=0x0) returned 0x0 [0182.920] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x38c7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x38c7f500) returned 0x0 [0182.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.920] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x38c7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x38c7f500) returned 0x0 [0182.925] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.928] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.928] WriteFile (in: hFile=0x2060, lpBuffer=0x38c7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38c7f830, lpOverlapped=0x0 | out: lpBuffer=0x38c7fb34*, lpNumberOfBytesWritten=0x38c7f830*=0x428, lpOverlapped=0x0) returned 1 [0182.928] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.929] ReadFile (in: hFile=0x2060, lpBuffer=0x5350000, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x38c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x38c7f61c*=0xbbc, lpOverlapped=0x0) returned 1 [0182.929] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0xfffff444, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.929] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x5350000, cbInput=0xbbc, pPaddingInfo=0x0, pbIV=0x38c7f848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x38c7f618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x38c7f848, pbOutput=0x5350000, pcbResult=0x38c7f618) returned 0x0 [0182.929] WriteFile (in: hFile=0x2060, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x38c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x38c7f61c*=0xbc0, lpOverlapped=0x0) returned 1 [0182.929] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38c7f60c | out: lpNewFilePointer=0x0) returned 1 [0182.929] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.929] WriteFile (in: hFile=0x2060, lpBuffer=0x38c7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x38c7f83c*, lpNumberOfBytesWritten=0x38c7f61c*=0x8, lpOverlapped=0x0) returned 1 [0182.929] SetFilePointerEx (in: hFile=0x2060, liDistanceToMove=0xbc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.929] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0182.929] CloseHandle (hObject=0x2060) returned 1 [0182.929] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.932] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.play")) returned 1 [0182.933] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2873 os_tid = 0x2b44 [0182.939] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.939] ReadFile (in: hFile=0x2068, lpBuffer=0x38dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x38dbfb34*, lpNumberOfBytesRead=0x38dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.944] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.944] ReadFile (in: hFile=0x2068, lpBuffer=0x38dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x38dbfb34*, lpNumberOfBytesRead=0x38dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0182.944] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.948] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x38dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0182.948] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x38dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x38dbf828, pbKeyObject=0x0) returned 0x0 [0182.948] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x38dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x38dbf500) returned 0x0 [0182.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.948] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x38dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x38dbf500) returned 0x0 [0182.953] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.956] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.957] WriteFile (in: hFile=0x2068, lpBuffer=0x38dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38dbf830, lpOverlapped=0x0 | out: lpBuffer=0x38dbfb34*, lpNumberOfBytesWritten=0x38dbf830*=0x428, lpOverlapped=0x0) returned 1 [0182.957] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.957] ReadFile (in: hFile=0x2068, lpBuffer=0x5450000, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x38dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x38dbf61c*=0x128e, lpOverlapped=0x0) returned 1 [0182.957] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xffffed72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.957] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x5450000, cbInput=0x128e, pPaddingInfo=0x0, pbIV=0x38dbf848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x38dbf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x38dbf848, pbOutput=0x5450000, pcbResult=0x38dbf618) returned 0x0 [0182.957] WriteFile (in: hFile=0x2068, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x38dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x38dbf61c*=0x1290, lpOverlapped=0x0) returned 1 [0182.957] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dbf60c | out: lpNewFilePointer=0x0) returned 1 [0182.957] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.957] WriteFile (in: hFile=0x2068, lpBuffer=0x38dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x38dbf83c*, lpNumberOfBytesWritten=0x38dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0182.958] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x1290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.958] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0182.958] CloseHandle (hObject=0x2068) returned 1 [0182.958] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.960] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.play")) returned 1 [0182.962] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2874 os_tid = 0x2b48 [0182.940] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.941] ReadFile (in: hFile=0x2070, lpBuffer=0x38effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38eff85c, lpOverlapped=0x0 | out: lpBuffer=0x38effb34*, lpNumberOfBytesRead=0x38eff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.966] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.966] ReadFile (in: hFile=0x2070, lpBuffer=0x38effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38eff85c, lpOverlapped=0x0 | out: lpBuffer=0x38effb34*, lpNumberOfBytesRead=0x38eff85c*=0x428, lpOverlapped=0x0) returned 1 [0182.967] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.969] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.970] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x38eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0182.970] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x38eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x38eff828, pbKeyObject=0x0) returned 0x0 [0182.970] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x38eff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x38eff500) returned 0x0 [0182.970] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.970] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x38eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x38eff500) returned 0x0 [0182.975] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.978] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.978] WriteFile (in: hFile=0x2070, lpBuffer=0x38effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38eff830, lpOverlapped=0x0 | out: lpBuffer=0x38effb34*, lpNumberOfBytesWritten=0x38eff830*=0x428, lpOverlapped=0x0) returned 1 [0182.978] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.978] ReadFile (in: hFile=0x2070, lpBuffer=0x5550000, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x38eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x38eff61c*=0x14ce, lpOverlapped=0x0) returned 1 [0182.978] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0xffffeb32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.978] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x5550000, cbInput=0x14ce, pPaddingInfo=0x0, pbIV=0x38eff848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x38eff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x38eff848, pbOutput=0x5550000, pcbResult=0x38eff618) returned 0x0 [0182.978] WriteFile (in: hFile=0x2070, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x38eff61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x38eff61c*=0x14d0, lpOverlapped=0x0) returned 1 [0182.978] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38eff60c | out: lpNewFilePointer=0x0) returned 1 [0182.978] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.979] WriteFile (in: hFile=0x2070, lpBuffer=0x38eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38eff61c, lpOverlapped=0x0 | out: lpBuffer=0x38eff83c*, lpNumberOfBytesWritten=0x38eff61c*=0x8, lpOverlapped=0x0) returned 1 [0182.979] SetFilePointerEx (in: hFile=0x2070, liDistanceToMove=0x14d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.979] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0182.979] CloseHandle (hObject=0x2070) returned 1 [0182.979] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0182.982] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.play")) returned 1 [0182.983] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2875 os_tid = 0x2b4c [0182.989] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.989] ReadFile (in: hFile=0x2078, lpBuffer=0x3903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3903f85c, lpOverlapped=0x0 | out: lpBuffer=0x3903fb34*, lpNumberOfBytesRead=0x3903f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.990] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.991] ReadFile (in: hFile=0x2078, lpBuffer=0x3903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3903f85c, lpOverlapped=0x0 | out: lpBuffer=0x3903fb34*, lpNumberOfBytesRead=0x3903f85c*=0x428, lpOverlapped=0x0) returned 1 [0182.991] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0182.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0182.993] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x3903f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0182.993] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x3903f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x3903f828, pbKeyObject=0x0) returned 0x0 [0182.993] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3903f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3903f500) returned 0x0 [0182.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0182.994] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3903f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3903f500) returned 0x0 [0182.998] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.002] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.002] WriteFile (in: hFile=0x2078, lpBuffer=0x3903fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3903f830, lpOverlapped=0x0 | out: lpBuffer=0x3903fb34*, lpNumberOfBytesWritten=0x3903f830*=0x428, lpOverlapped=0x0) returned 1 [0183.002] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.002] ReadFile (in: hFile=0x2078, lpBuffer=0x5650000, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x3903f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x3903f61c*=0xef2, lpOverlapped=0x0) returned 1 [0183.002] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffff10e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.003] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x5650000, cbInput=0xef2, pPaddingInfo=0x0, pbIV=0x3903f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x3903f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x3903f848, pbOutput=0x5650000, pcbResult=0x3903f618) returned 0x0 [0183.003] WriteFile (in: hFile=0x2078, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x3903f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x3903f61c*=0xf00, lpOverlapped=0x0) returned 1 [0183.003] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3903f60c | out: lpNewFilePointer=0x0) returned 1 [0183.003] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.003] WriteFile (in: hFile=0x2078, lpBuffer=0x3903f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3903f61c, lpOverlapped=0x0 | out: lpBuffer=0x3903f83c*, lpNumberOfBytesWritten=0x3903f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.003] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.003] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0183.003] CloseHandle (hObject=0x2078) returned 1 [0183.004] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.play")) returned 1 [0183.008] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2876 os_tid = 0x2b50 [0183.012] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.012] ReadFile (in: hFile=0x2080, lpBuffer=0x3917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3917f85c, lpOverlapped=0x0 | out: lpBuffer=0x3917fb34*, lpNumberOfBytesRead=0x3917f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.014] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.014] ReadFile (in: hFile=0x2080, lpBuffer=0x3917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3917f85c, lpOverlapped=0x0 | out: lpBuffer=0x3917fb34*, lpNumberOfBytesRead=0x3917f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.015] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.017] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.017] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x3917f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0183.017] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x3917f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x3917f828, pbKeyObject=0x0) returned 0x0 [0183.017] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3917f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3917f500) returned 0x0 [0183.017] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.018] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3917f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3917f500) returned 0x0 [0183.023] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.026] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.026] WriteFile (in: hFile=0x2080, lpBuffer=0x3917fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3917f830, lpOverlapped=0x0 | out: lpBuffer=0x3917fb34*, lpNumberOfBytesWritten=0x3917f830*=0x428, lpOverlapped=0x0) returned 1 [0183.026] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.026] ReadFile (in: hFile=0x2080, lpBuffer=0x5750000, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x3917f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x3917f61c*=0x3586, lpOverlapped=0x0) returned 1 [0183.027] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0xffffca7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.027] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x5750000, cbInput=0x3586, pPaddingInfo=0x0, pbIV=0x3917f848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x3917f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x3917f848, pbOutput=0x5750000, pcbResult=0x3917f618) returned 0x0 [0183.027] WriteFile (in: hFile=0x2080, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x3917f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x3917f61c*=0x3590, lpOverlapped=0x0) returned 1 [0183.027] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3917f60c | out: lpNewFilePointer=0x0) returned 1 [0183.027] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.028] WriteFile (in: hFile=0x2080, lpBuffer=0x3917f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3917f61c, lpOverlapped=0x0 | out: lpBuffer=0x3917f83c*, lpNumberOfBytesWritten=0x3917f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.028] SetFilePointerEx (in: hFile=0x2080, liDistanceToMove=0x3590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.028] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0183.028] CloseHandle (hObject=0x2080) returned 1 [0183.028] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.play")) returned 1 [0183.032] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2877 os_tid = 0x2b54 [0183.036] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.036] ReadFile (in: hFile=0x2088, lpBuffer=0x392bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x392bf85c, lpOverlapped=0x0 | out: lpBuffer=0x392bfb34*, lpNumberOfBytesRead=0x392bf85c*=0x428, lpOverlapped=0x0) returned 1 [0183.039] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.039] ReadFile (in: hFile=0x2088, lpBuffer=0x392bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x392bf85c, lpOverlapped=0x0 | out: lpBuffer=0x392bfb34*, lpNumberOfBytesRead=0x392bf85c*=0x428, lpOverlapped=0x0) returned 1 [0183.039] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.042] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.042] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x392bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0183.042] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x392bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x392bf828, pbKeyObject=0x0) returned 0x0 [0183.042] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x392bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x392bf500) returned 0x0 [0183.042] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.042] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x392bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x392bf500) returned 0x0 [0183.052] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.055] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.055] WriteFile (in: hFile=0x2088, lpBuffer=0x392bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x392bf830, lpOverlapped=0x0 | out: lpBuffer=0x392bfb34*, lpNumberOfBytesWritten=0x392bf830*=0x428, lpOverlapped=0x0) returned 1 [0183.055] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.055] ReadFile (in: hFile=0x2088, lpBuffer=0x5850000, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x392bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x392bf61c*=0x1b00, lpOverlapped=0x0) returned 1 [0183.056] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xffffe500, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.056] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x5850000, cbInput=0x1b00, pPaddingInfo=0x0, pbIV=0x392bf848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x392bf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x392bf848, pbOutput=0x5850000, pcbResult=0x392bf618) returned 0x0 [0183.056] WriteFile (in: hFile=0x2088, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x392bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x392bf61c*=0x1b10, lpOverlapped=0x0) returned 1 [0183.056] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x392bf60c | out: lpNewFilePointer=0x0) returned 1 [0183.056] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.056] WriteFile (in: hFile=0x2088, lpBuffer=0x392bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x392bf61c, lpOverlapped=0x0 | out: lpBuffer=0x392bf83c*, lpNumberOfBytesWritten=0x392bf61c*=0x8, lpOverlapped=0x0) returned 1 [0183.056] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x1b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.056] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0183.056] CloseHandle (hObject=0x2088) returned 1 [0183.057] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.play")) returned 1 [0183.060] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2878 os_tid = 0x2b58 [0183.064] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.064] ReadFile (in: hFile=0x2090, lpBuffer=0x393ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x393ff85c, lpOverlapped=0x0 | out: lpBuffer=0x393ffb34*, lpNumberOfBytesRead=0x393ff85c*=0x428, lpOverlapped=0x0) returned 1 [0183.065] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.065] ReadFile (in: hFile=0x2090, lpBuffer=0x393ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x393ff85c, lpOverlapped=0x0 | out: lpBuffer=0x393ffb34*, lpNumberOfBytesRead=0x393ff85c*=0x428, lpOverlapped=0x0) returned 1 [0183.066] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.068] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.068] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x393ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0183.068] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x393ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x393ff828, pbKeyObject=0x0) returned 0x0 [0183.068] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x393ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x393ff500) returned 0x0 [0183.068] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.069] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x393ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x393ff500) returned 0x0 [0183.072] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.075] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.075] WriteFile (in: hFile=0x2090, lpBuffer=0x393ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x393ff830, lpOverlapped=0x0 | out: lpBuffer=0x393ffb34*, lpNumberOfBytesWritten=0x393ff830*=0x428, lpOverlapped=0x0) returned 1 [0183.075] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.075] ReadFile (in: hFile=0x2090, lpBuffer=0x5950000, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x393ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x393ff61c*=0x164c, lpOverlapped=0x0) returned 1 [0183.075] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0xffffe9b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.075] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x5950000, cbInput=0x164c, pPaddingInfo=0x0, pbIV=0x393ff848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x393ff618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x393ff848, pbOutput=0x5950000, pcbResult=0x393ff618) returned 0x0 [0183.075] WriteFile (in: hFile=0x2090, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x393ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x393ff61c*=0x1650, lpOverlapped=0x0) returned 1 [0183.076] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393ff60c | out: lpNewFilePointer=0x0) returned 1 [0183.076] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.076] WriteFile (in: hFile=0x2090, lpBuffer=0x393ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393ff61c, lpOverlapped=0x0 | out: lpBuffer=0x393ff83c*, lpNumberOfBytesWritten=0x393ff61c*=0x8, lpOverlapped=0x0) returned 1 [0183.076] SetFilePointerEx (in: hFile=0x2090, liDistanceToMove=0x1650, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.076] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0183.076] CloseHandle (hObject=0x2090) returned 1 [0183.076] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.play")) returned 1 [0183.079] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2879 os_tid = 0x2ab8 [0183.346] GetLastError () returned 0x57 [0183.346] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72b4f8 [0183.347] SetLastError (dwErrCode=0x57) [0183.347] IcmpCreateFile () returned 0x805498 [0183.347] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7909f8 [0183.347] IcmpSendEcho2 (IcmpHandle=0x805498, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf500a8c0, RequestData=0x3827ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7909f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2880 os_tid = 0x2b60 [0183.349] GetLastError () returned 0x57 [0183.349] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72b880 [0183.349] SetLastError (dwErrCode=0x57) [0183.349] IcmpCreateFile () returned 0x8054d0 [0183.349] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7904a8 [0183.349] IcmpSendEcho2 (IcmpHandle=0x8054d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf600a8c0, RequestData=0x141cff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7904a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2881 os_tid = 0x2b64 [0183.351] GetLastError () returned 0x57 [0183.351] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72bc08 [0183.351] SetLastError (dwErrCode=0x57) [0183.351] IcmpCreateFile () returned 0x805508 [0183.351] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790a48 [0183.351] IcmpSendEcho2 (IcmpHandle=0x805508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf700a8c0, RequestData=0x1430ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790a48, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2882 os_tid = 0x2b68 [0183.353] GetLastError () returned 0x57 [0183.353] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72bf90 [0183.353] SetLastError (dwErrCode=0x57) [0183.353] IcmpCreateFile () returned 0x8057a8 [0183.353] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790a98 [0183.353] IcmpSendEcho2 (IcmpHandle=0x8057a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf800a8c0, RequestData=0x1470ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790a98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2883 os_tid = 0x2b6c [0183.354] GetLastError () returned 0x57 [0183.354] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72c318 [0183.354] SetLastError (dwErrCode=0x57) [0183.355] IcmpCreateFile () returned 0x805620 [0183.355] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790ae8 [0183.355] IcmpSendEcho2 (IcmpHandle=0x805620, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf900a8c0, RequestData=0x1498ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790ae8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2884 os_tid = 0x2b70 [0183.356] GetLastError () returned 0x57 [0183.356] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72c6a0 [0183.356] SetLastError (dwErrCode=0x57) [0183.356] IcmpCreateFile () returned 0x805658 [0183.356] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790b38 [0183.356] IcmpSendEcho2 (IcmpHandle=0x805658, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfa00a8c0, RequestData=0x14acff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790b38, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2885 os_tid = 0x2b74 [0183.357] GetLastError () returned 0x57 [0183.358] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72ca28 [0183.358] SetLastError (dwErrCode=0x57) [0183.358] IcmpCreateFile () returned 0x805690 [0183.358] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790b88 [0183.358] IcmpSendEcho2 (IcmpHandle=0x805690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfb00a8c0, RequestData=0x14c0ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790b88, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2886 os_tid = 0x2b78 [0183.359] GetLastError () returned 0x57 [0183.359] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72cdb0 [0183.360] SetLastError (dwErrCode=0x57) [0183.360] IcmpCreateFile () returned 0x8056c8 [0183.360] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790bd8 [0183.360] IcmpSendEcho2 (IcmpHandle=0x8056c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfc00a8c0, RequestData=0x14f4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790bd8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2887 os_tid = 0x2b7c [0183.361] GetLastError () returned 0x57 [0183.361] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72d138 [0183.362] SetLastError (dwErrCode=0x57) [0183.362] IcmpCreateFile () returned 0x805700 [0183.362] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790c28 [0183.362] IcmpSendEcho2 (IcmpHandle=0x805700, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfd00a8c0, RequestData=0x29b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790c28, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2888 os_tid = 0x2b80 [0183.364] GetLastError () returned 0x57 [0183.364] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72d4c0 [0183.365] SetLastError (dwErrCode=0x57) [0183.365] IcmpCreateFile () returned 0x805738 [0183.365] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790c78 [0183.365] IcmpSendEcho2 (IcmpHandle=0x805738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xfe00a8c0, RequestData=0x2dcbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790c78, ReplySize=0x44, Timeout=0x2bc) Thread: id = 2889 os_tid = 0x2b5c [0183.375] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.376] ReadFile (in: hFile=0x2098, lpBuffer=0x3953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3953f85c, lpOverlapped=0x0 | out: lpBuffer=0x3953fb34*, lpNumberOfBytesRead=0x3953f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.377] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.377] ReadFile (in: hFile=0x2098, lpBuffer=0x3953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3953f85c, lpOverlapped=0x0 | out: lpBuffer=0x3953fb34*, lpNumberOfBytesRead=0x3953f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.378] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.383] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.384] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x3953f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0183.384] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x3953f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x3953f828, pbKeyObject=0x0) returned 0x0 [0183.384] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3953f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3953f500) returned 0x0 [0183.384] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.384] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3953f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3953f500) returned 0x0 [0183.389] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.393] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.393] WriteFile (in: hFile=0x2098, lpBuffer=0x3953fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3953f830, lpOverlapped=0x0 | out: lpBuffer=0x3953fb34*, lpNumberOfBytesWritten=0x3953f830*=0x428, lpOverlapped=0x0) returned 1 [0183.394] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.394] ReadFile (in: hFile=0x2098, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x3953f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x3953f61c*=0x9d26, lpOverlapped=0x0) returned 1 [0183.395] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xffff62da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.396] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5a50000, cbInput=0x9d26, pPaddingInfo=0x0, pbIV=0x3953f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x3953f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3953f848, pbOutput=0x5a50000, pcbResult=0x3953f618) returned 0x0 [0183.396] WriteFile (in: hFile=0x2098, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x3953f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x3953f61c*=0x9d30, lpOverlapped=0x0) returned 1 [0183.396] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3953f60c | out: lpNewFilePointer=0x0) returned 1 [0183.396] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.396] WriteFile (in: hFile=0x2098, lpBuffer=0x3953f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3953f61c, lpOverlapped=0x0 | out: lpBuffer=0x3953f83c*, lpNumberOfBytesWritten=0x3953f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.396] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0x9d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.396] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.396] CloseHandle (hObject=0x2098) returned 1 [0183.397] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.play")) returned 1 [0183.402] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2890 os_tid = 0x2b84 [0183.466] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.466] ReadFile (in: hFile=0x2088, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.468] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.468] ReadFile (in: hFile=0x2088, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.469] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.474] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0183.474] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0183.474] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0183.475] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.475] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1444f500) returned 0x0 [0183.480] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.484] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.484] WriteFile (in: hFile=0x2088, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0183.485] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.485] ReadFile (in: hFile=0x2088, lpBuffer=0x2750000, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1444f61c*=0x668c, lpOverlapped=0x0) returned 1 [0183.486] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xffff9974, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.486] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2750000, cbInput=0x668c, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1444f848, pbOutput=0x2750000, pcbResult=0x1444f618) returned 0x0 [0183.486] WriteFile (in: hFile=0x2088, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1444f61c*=0x6690, lpOverlapped=0x0) returned 1 [0183.486] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0183.486] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.486] WriteFile (in: hFile=0x2088, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.486] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x6690, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.486] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.486] CloseHandle (hObject=0x2088) returned 1 [0183.487] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.play")) returned 1 [0183.495] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2891 os_tid = 0x2b88 [0183.541] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.541] ReadFile (in: hFile=0x2078, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.543] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.543] ReadFile (in: hFile=0x2078, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.549] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.549] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1484f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0183.549] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1484f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1484f828, pbKeyObject=0x0) returned 0x0 [0183.549] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1484f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1484f500) returned 0x0 [0183.549] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.550] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1484f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1484f500) returned 0x0 [0183.555] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.559] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.559] WriteFile (in: hFile=0x2078, lpBuffer=0x1484fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1484f830, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesWritten=0x1484f830*=0x428, lpOverlapped=0x0) returned 1 [0183.560] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.560] ReadFile (in: hFile=0x2078, lpBuffer=0x2850000, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1484f61c*=0x849c, lpOverlapped=0x0) returned 1 [0183.561] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xffff7b64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.561] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2850000, cbInput=0x849c, pPaddingInfo=0x0, pbIV=0x1484f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1484f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1484f848, pbOutput=0x2850000, pcbResult=0x1484f618) returned 0x0 [0183.561] WriteFile (in: hFile=0x2078, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1484f61c*=0x84a0, lpOverlapped=0x0) returned 1 [0183.562] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1484f60c | out: lpNewFilePointer=0x0) returned 1 [0183.562] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.562] WriteFile (in: hFile=0x2078, lpBuffer=0x1484f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x1484f83c*, lpNumberOfBytesWritten=0x1484f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.562] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x84a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.562] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.562] CloseHandle (hObject=0x2078) returned 1 [0183.562] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.play")) returned 1 [0183.569] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2892 os_tid = 0x2b8c [0183.610] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.610] ReadFile (in: hFile=0x2068, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0183.611] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.611] ReadFile (in: hFile=0x2068, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0183.612] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.617] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.617] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0183.617] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0183.617] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0183.617] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.617] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0183.622] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.626] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.626] WriteFile (in: hFile=0x2068, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0183.626] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.626] ReadFile (in: hFile=0x2068, lpBuffer=0x2950000, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x219ff61c*=0x5cae, lpOverlapped=0x0) returned 1 [0183.627] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xffffa352, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.628] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2950000, cbInput=0x5cae, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x219ff848, pbOutput=0x2950000, pcbResult=0x219ff618) returned 0x0 [0183.628] WriteFile (in: hFile=0x2068, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x219ff61c*=0x5cb0, lpOverlapped=0x0) returned 1 [0183.628] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0183.628] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.628] WriteFile (in: hFile=0x2068, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0183.628] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x5cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.628] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.628] CloseHandle (hObject=0x2068) returned 1 [0183.628] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.play")) returned 1 [0183.633] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2893 os_tid = 0x2b90 [0183.673] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.673] ReadFile (in: hFile=0x2058, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.689] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.689] ReadFile (in: hFile=0x2058, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.689] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.695] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.695] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0183.695] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0183.695] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0183.695] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.695] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0183.700] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.705] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.705] WriteFile (in: hFile=0x2058, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0183.705] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.705] ReadFile (in: hFile=0x2058, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x2d37f61c*=0x8860, lpOverlapped=0x0) returned 1 [0183.707] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xffff77a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.707] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2a50000, cbInput=0x8860, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d37f848, pbOutput=0x2a50000, pcbResult=0x2d37f618) returned 0x0 [0183.707] WriteFile (in: hFile=0x2058, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x8870, lpOverlapped=0x0) returned 1 [0183.707] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0183.707] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.707] WriteFile (in: hFile=0x2058, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.707] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x8870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.707] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.708] CloseHandle (hObject=0x2058) returned 1 [0183.708] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.play")) returned 1 [0183.713] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2894 os_tid = 0x2b94 [0183.752] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.752] ReadFile (in: hFile=0x2048, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.754] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.754] ReadFile (in: hFile=0x2048, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.755] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.760] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0183.760] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0183.761] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0183.761] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.761] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0183.766] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.771] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.771] WriteFile (in: hFile=0x2048, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0183.771] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.771] ReadFile (in: hFile=0x2048, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x2d47f61c*=0x6624, lpOverlapped=0x0) returned 1 [0183.772] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xffff99dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.772] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2b50000, cbInput=0x6624, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d47f848, pbOutput=0x2b50000, pcbResult=0x2d47f618) returned 0x0 [0183.772] WriteFile (in: hFile=0x2048, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x2d47f61c*=0x6630, lpOverlapped=0x0) returned 1 [0183.773] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0183.773] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.773] WriteFile (in: hFile=0x2048, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.773] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x6630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.773] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.773] CloseHandle (hObject=0x2048) returned 1 [0183.773] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.play")) returned 1 [0183.779] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2895 os_tid = 0x2b98 [0183.817] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.817] ReadFile (in: hFile=0x2038, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.819] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.819] ReadFile (in: hFile=0x2038, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.819] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.825] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.825] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0183.825] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0183.825] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0183.825] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.825] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0183.830] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.835] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.835] WriteFile (in: hFile=0x2038, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0183.835] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.835] ReadFile (in: hFile=0x2038, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x2d57f61c*=0x3cce, lpOverlapped=0x0) returned 1 [0183.839] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xffffc332, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.839] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2c50000, cbInput=0x3cce, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d57f848, pbOutput=0x2c50000, pcbResult=0x2d57f618) returned 0x0 [0183.840] WriteFile (in: hFile=0x2038, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x2d57f61c*=0x3cd0, lpOverlapped=0x0) returned 1 [0183.840] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0183.840] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.840] WriteFile (in: hFile=0x2038, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.840] SetFilePointerEx (in: hFile=0x2038, liDistanceToMove=0x3cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.840] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.840] CloseHandle (hObject=0x2038) returned 1 [0183.840] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.play")) returned 1 [0183.862] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2896 os_tid = 0x2b9c [0183.819] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.836] ReadFile (in: hFile=0x2028, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.839] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.839] ReadFile (in: hFile=0x2028, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0183.845] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0183.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0183.849] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0183.849] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0183.849] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d67f500) returned 0x0 [0183.849] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0183.850] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d67f500) returned 0x0 [0183.855] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.859] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.859] WriteFile (in: hFile=0x2028, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0183.859] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.859] ReadFile (in: hFile=0x2028, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2d67f61c*=0xd6b4, lpOverlapped=0x0) returned 1 [0183.868] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xffff294c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.868] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2d50000, cbInput=0xd6b4, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d67f848, pbOutput=0x2d50000, pcbResult=0x2d67f618) returned 0x0 [0183.868] WriteFile (in: hFile=0x2028, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2d67f61c*=0xd6c0, lpOverlapped=0x0) returned 1 [0183.869] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0183.869] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.869] WriteFile (in: hFile=0x2028, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0183.869] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xd6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.869] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.869] CloseHandle (hObject=0x2028) returned 1 [0183.869] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.play")) returned 1 [0183.874] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2897 os_tid = 0x2ba0 [0183.925] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.926] ReadFile (in: hFile=0x2018, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0183.927] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.927] ReadFile (in: hFile=0x2018, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0183.928] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.933] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.933] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2d7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0183.933] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2d7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2d7bf828, pbKeyObject=0x0) returned 0x0 [0183.934] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d7bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d7bf500) returned 0x0 [0183.934] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.934] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d7bf500) returned 0x0 [0183.939] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.944] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.944] WriteFile (in: hFile=0x2018, lpBuffer=0x2d7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesWritten=0x2d7bf830*=0x428, lpOverlapped=0x0) returned 1 [0183.944] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.944] ReadFile (in: hFile=0x2018, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2d7bf61c*=0xa520, lpOverlapped=0x0) returned 1 [0183.946] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xffff5ae0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.946] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2e50000, cbInput=0xa520, pPaddingInfo=0x0, pbIV=0x2d7bf848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2d7bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d7bf848, pbOutput=0x2e50000, pcbResult=0x2d7bf618) returned 0x0 [0183.946] WriteFile (in: hFile=0x2018, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2d7bf61c*=0xa530, lpOverlapped=0x0) returned 1 [0183.947] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf60c | out: lpNewFilePointer=0x0) returned 1 [0183.947] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.947] WriteFile (in: hFile=0x2018, lpBuffer=0x2d7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf83c*, lpNumberOfBytesWritten=0x2d7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0183.947] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xa530, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.947] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.947] CloseHandle (hObject=0x2018) returned 1 [0183.947] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.play")) returned 1 [0183.953] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2898 os_tid = 0x2ba4 [0183.959] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.960] ReadFile (in: hFile=0x2008, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0183.968] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.969] ReadFile (in: hFile=0x2008, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0183.969] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0183.974] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0183.974] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0183.974] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d8ff828, pbKeyObject=0x0) returned 0x0 [0183.974] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d8ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0183.975] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0183.975] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d8ff500) returned 0x0 [0183.981] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.989] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.989] WriteFile (in: hFile=0x2008, lpBuffer=0x2d8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesWritten=0x2d8ff830*=0x428, lpOverlapped=0x0) returned 1 [0183.990] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.990] ReadFile (in: hFile=0x2008, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d8ff61c*=0xa3b2, lpOverlapped=0x0) returned 1 [0183.993] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xffff5c4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.993] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2f50000, cbInput=0xa3b2, pPaddingInfo=0x0, pbIV=0x2d8ff848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d8ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d8ff848, pbOutput=0x2f50000, pcbResult=0x2d8ff618) returned 0x0 [0183.993] WriteFile (in: hFile=0x2008, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d8ff61c*=0xa3c0, lpOverlapped=0x0) returned 1 [0183.993] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8ff60c | out: lpNewFilePointer=0x0) returned 1 [0183.993] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.993] WriteFile (in: hFile=0x2008, lpBuffer=0x2d8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ff83c*, lpNumberOfBytesWritten=0x2d8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0183.994] SetFilePointerEx (in: hFile=0x2008, liDistanceToMove=0xa3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.994] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0183.994] CloseHandle (hObject=0x2008) returned 1 [0183.994] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0183.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.play")) returned 1 [0184.000] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2899 os_tid = 0x2ba8 [0183.990] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.990] ReadFile (in: hFile=0x1ffc, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.007] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.007] ReadFile (in: hFile=0x1ffc, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.008] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.012] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.013] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2da3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0184.013] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2da3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2da3f828, pbKeyObject=0x0) returned 0x0 [0184.013] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2da3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2da3f500) returned 0x0 [0184.013] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.013] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2da3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2da3f500) returned 0x0 [0184.018] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.023] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.023] WriteFile (in: hFile=0x1ffc, lpBuffer=0x2da3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da3f830, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesWritten=0x2da3f830*=0x428, lpOverlapped=0x0) returned 1 [0184.023] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.023] ReadFile (in: hFile=0x1ffc, lpBuffer=0x3050000, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2da3f61c*=0xa69e, lpOverlapped=0x0) returned 1 [0184.025] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xffff5962, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.025] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3050000, cbInput=0xa69e, pPaddingInfo=0x0, pbIV=0x2da3f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2da3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2da3f848, pbOutput=0x3050000, pcbResult=0x2da3f618) returned 0x0 [0184.025] WriteFile (in: hFile=0x1ffc, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2da3f61c*=0xa6a0, lpOverlapped=0x0) returned 1 [0184.026] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da3f60c | out: lpNewFilePointer=0x0) returned 1 [0184.026] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.026] WriteFile (in: hFile=0x1ffc, lpBuffer=0x2da3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da3f83c*, lpNumberOfBytesWritten=0x2da3f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.026] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xa6a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.026] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.026] CloseHandle (hObject=0x1ffc) returned 1 [0184.026] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.play")) returned 1 [0184.032] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2900 os_tid = 0x2bac [0184.024] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.024] ReadFile (in: hFile=0x1fec, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.057] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.057] ReadFile (in: hFile=0x1fec, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.057] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.060] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.060] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2db7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0184.060] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2db7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2db7f828, pbKeyObject=0x0) returned 0x0 [0184.060] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2db7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2db7f500) returned 0x0 [0184.061] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.061] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2db7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2db7f500) returned 0x0 [0184.065] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.070] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.071] WriteFile (in: hFile=0x1fec, lpBuffer=0x2db7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db7f830, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesWritten=0x2db7f830*=0x428, lpOverlapped=0x0) returned 1 [0184.071] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.071] ReadFile (in: hFile=0x1fec, lpBuffer=0x3150000, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2db7f61c*=0x6f9c, lpOverlapped=0x0) returned 1 [0184.085] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xffff9064, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.085] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3150000, cbInput=0x6f9c, pPaddingInfo=0x0, pbIV=0x2db7f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2db7f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2db7f848, pbOutput=0x3150000, pcbResult=0x2db7f618) returned 0x0 [0184.085] WriteFile (in: hFile=0x1fec, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2db7f61c*=0x6fa0, lpOverlapped=0x0) returned 1 [0184.085] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db7f60c | out: lpNewFilePointer=0x0) returned 1 [0184.086] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.086] WriteFile (in: hFile=0x1fec, lpBuffer=0x2db7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db7f83c*, lpNumberOfBytesWritten=0x2db7f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.086] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x6fa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.086] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0184.086] CloseHandle (hObject=0x1fec) returned 1 [0184.086] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.play")) returned 1 [0184.090] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2901 os_tid = 0x2bb0 [0184.037] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.038] ReadFile (in: hFile=0x1284, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.039] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.040] ReadFile (in: hFile=0x1284, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.040] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.044] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2ddff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0184.044] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2ddff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2ddff828, pbKeyObject=0x0) returned 0x0 [0184.044] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ddff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ddff500) returned 0x0 [0184.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.044] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ddff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ddff500) returned 0x0 [0184.049] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.055] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.055] WriteFile (in: hFile=0x1284, lpBuffer=0x2ddffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddff830, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesWritten=0x2ddff830*=0x428, lpOverlapped=0x0) returned 1 [0184.056] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.056] ReadFile (in: hFile=0x1284, lpBuffer=0x3250000, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2ddff61c*=0x9d6c, lpOverlapped=0x0) returned 1 [0184.073] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xffff6294, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.073] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3250000, cbInput=0x9d6c, pPaddingInfo=0x0, pbIV=0x2ddff848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2ddff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2ddff848, pbOutput=0x3250000, pcbResult=0x2ddff618) returned 0x0 [0184.073] WriteFile (in: hFile=0x1284, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2ddff61c*=0x9d70, lpOverlapped=0x0) returned 1 [0184.074] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddff60c | out: lpNewFilePointer=0x0) returned 1 [0184.074] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.074] WriteFile (in: hFile=0x1284, lpBuffer=0x2ddff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddff83c*, lpNumberOfBytesWritten=0x2ddff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.074] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x9d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.074] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.074] CloseHandle (hObject=0x1284) returned 1 [0184.074] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.play")) returned 1 [0184.081] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2902 os_tid = 0x2bb4 [0184.094] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.094] ReadFile (in: hFile=0x1f70, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.095] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.095] ReadFile (in: hFile=0x1f70, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.095] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.098] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.098] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2df3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0184.098] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2df3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2df3f828, pbKeyObject=0x0) returned 0x0 [0184.099] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2df3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2df3f500) returned 0x0 [0184.099] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.099] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2df3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2df3f500) returned 0x0 [0184.102] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.105] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.105] WriteFile (in: hFile=0x1f70, lpBuffer=0x2df3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2df3f830, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesWritten=0x2df3f830*=0x428, lpOverlapped=0x0) returned 1 [0184.105] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.105] ReadFile (in: hFile=0x1f70, lpBuffer=0x3350000, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2df3f61c*=0xc20c, lpOverlapped=0x0) returned 1 [0184.106] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xffff3df4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.106] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3350000, cbInput=0xc20c, pPaddingInfo=0x0, pbIV=0x2df3f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2df3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2df3f848, pbOutput=0x3350000, pcbResult=0x2df3f618) returned 0x0 [0184.107] WriteFile (in: hFile=0x1f70, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2df3f61c*=0xc210, lpOverlapped=0x0) returned 1 [0184.107] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2df3f60c | out: lpNewFilePointer=0x0) returned 1 [0184.107] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.107] WriteFile (in: hFile=0x1f70, lpBuffer=0x2df3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2df3f83c*, lpNumberOfBytesWritten=0x2df3f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.107] SetFilePointerEx (in: hFile=0x1f70, liDistanceToMove=0xc210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.107] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.107] CloseHandle (hObject=0x1f70) returned 1 [0184.107] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.play")) returned 1 [0184.111] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2903 os_tid = 0x2bb8 [0184.115] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.115] ReadFile (in: hFile=0x1f14, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.117] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.117] ReadFile (in: hFile=0x1f14, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.117] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.120] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2e07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0184.120] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2e07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2e07f828, pbKeyObject=0x0) returned 0x0 [0184.120] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e07f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e07f500) returned 0x0 [0184.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.120] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e07f500) returned 0x0 [0184.123] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.126] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.126] WriteFile (in: hFile=0x1f14, lpBuffer=0x2e07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e07f830, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesWritten=0x2e07f830*=0x428, lpOverlapped=0x0) returned 1 [0184.127] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.127] ReadFile (in: hFile=0x1f14, lpBuffer=0x3450000, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2e07f61c*=0xae08, lpOverlapped=0x0) returned 1 [0184.128] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xffff51f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.128] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3450000, cbInput=0xae08, pPaddingInfo=0x0, pbIV=0x2e07f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2e07f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e07f848, pbOutput=0x3450000, pcbResult=0x2e07f618) returned 0x0 [0184.128] WriteFile (in: hFile=0x1f14, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2e07f61c*=0xae10, lpOverlapped=0x0) returned 1 [0184.128] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e07f60c | out: lpNewFilePointer=0x0) returned 1 [0184.128] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.129] WriteFile (in: hFile=0x1f14, lpBuffer=0x2e07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e07f83c*, lpNumberOfBytesWritten=0x2e07f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.129] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xae10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.129] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.129] CloseHandle (hObject=0x1f14) returned 1 [0184.129] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.play")) returned 1 [0184.133] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2904 os_tid = 0x2bbc [0184.116] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.116] ReadFile (in: hFile=0x6b4, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.139] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.139] ReadFile (in: hFile=0x6b4, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.139] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.141] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.141] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2e1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0184.142] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2e1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2e1bf828, pbKeyObject=0x0) returned 0x0 [0184.142] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e1bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e1bf500) returned 0x0 [0184.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.142] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e1bf500) returned 0x0 [0184.145] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.148] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.148] WriteFile (in: hFile=0x6b4, lpBuffer=0x2e1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesWritten=0x2e1bf830*=0x428, lpOverlapped=0x0) returned 1 [0184.149] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.149] ReadFile (in: hFile=0x6b4, lpBuffer=0x3550000, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2e1bf61c*=0xe17a, lpOverlapped=0x0) returned 1 [0184.150] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xffff1e86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.150] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3550000, cbInput=0xe17a, pPaddingInfo=0x0, pbIV=0x2e1bf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2e1bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e1bf848, pbOutput=0x3550000, pcbResult=0x2e1bf618) returned 0x0 [0184.150] WriteFile (in: hFile=0x6b4, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2e1bf61c*=0xe180, lpOverlapped=0x0) returned 1 [0184.150] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1bf60c | out: lpNewFilePointer=0x0) returned 1 [0184.150] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.151] WriteFile (in: hFile=0x6b4, lpBuffer=0x2e1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bf83c*, lpNumberOfBytesWritten=0x2e1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.151] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xe180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.151] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.151] CloseHandle (hObject=0x6b4) returned 1 [0184.151] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.153] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.play")) returned 1 [0184.155] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2905 os_tid = 0x2bc0 [0184.138] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.149] ReadFile (in: hFile=0x1f24, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.162] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.162] ReadFile (in: hFile=0x1f24, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.163] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.166] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.166] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2e2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0184.166] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2e2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2e2ff828, pbKeyObject=0x0) returned 0x0 [0184.167] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e2ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e2ff500) returned 0x0 [0184.167] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.167] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e2ff500) returned 0x0 [0184.171] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.175] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.175] WriteFile (in: hFile=0x1f24, lpBuffer=0x2e2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesWritten=0x2e2ff830*=0x428, lpOverlapped=0x0) returned 1 [0184.175] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.175] ReadFile (in: hFile=0x1f24, lpBuffer=0x3650000, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2e2ff61c*=0x714e, lpOverlapped=0x0) returned 1 [0184.176] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xffff8eb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.176] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3650000, cbInput=0x714e, pPaddingInfo=0x0, pbIV=0x2e2ff848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2e2ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e2ff848, pbOutput=0x3650000, pcbResult=0x2e2ff618) returned 0x0 [0184.176] WriteFile (in: hFile=0x1f24, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2e2ff61c*=0x7150, lpOverlapped=0x0) returned 1 [0184.176] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2ff60c | out: lpNewFilePointer=0x0) returned 1 [0184.176] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.177] WriteFile (in: hFile=0x1f24, lpBuffer=0x2e2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ff83c*, lpNumberOfBytesWritten=0x2e2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.177] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x7150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.177] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.177] CloseHandle (hObject=0x1f24) returned 1 [0184.177] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.play")) returned 1 [0184.181] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2906 os_tid = 0x2bc4 [0184.186] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.186] ReadFile (in: hFile=0x121c, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.187] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.187] ReadFile (in: hFile=0x121c, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.187] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.190] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.190] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2e43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0184.190] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2e43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2e43f828, pbKeyObject=0x0) returned 0x0 [0184.190] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e43f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e43f500) returned 0x0 [0184.190] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.190] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e43f500) returned 0x0 [0184.194] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.196] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.196] WriteFile (in: hFile=0x121c, lpBuffer=0x2e43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e43f830, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesWritten=0x2e43f830*=0x428, lpOverlapped=0x0) returned 1 [0184.197] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.197] ReadFile (in: hFile=0x121c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2e43f61c*=0x7c4e, lpOverlapped=0x0) returned 1 [0184.198] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xffff83b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.198] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3750000, cbInput=0x7c4e, pPaddingInfo=0x0, pbIV=0x2e43f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2e43f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e43f848, pbOutput=0x3750000, pcbResult=0x2e43f618) returned 0x0 [0184.198] WriteFile (in: hFile=0x121c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2e43f61c*=0x7c50, lpOverlapped=0x0) returned 1 [0184.198] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e43f60c | out: lpNewFilePointer=0x0) returned 1 [0184.198] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.198] WriteFile (in: hFile=0x121c, lpBuffer=0x2e43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f83c*, lpNumberOfBytesWritten=0x2e43f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.198] SetFilePointerEx (in: hFile=0x121c, liDistanceToMove=0x7c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.198] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.198] CloseHandle (hObject=0x121c) returned 1 [0184.198] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.play")) returned 1 [0184.205] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2907 os_tid = 0x2bcc [0184.228] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.228] ReadFile (in: hFile=0x2098, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.230] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.230] ReadFile (in: hFile=0x2098, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.230] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.234] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2e57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0184.234] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2e57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2e57f828, pbKeyObject=0x0) returned 0x0 [0184.234] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e57f500) returned 0x0 [0184.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.234] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e57f500) returned 0x0 [0184.237] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.241] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.241] WriteFile (in: hFile=0x2098, lpBuffer=0x2e57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e57f830, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesWritten=0x2e57f830*=0x428, lpOverlapped=0x0) returned 1 [0184.241] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.241] ReadFile (in: hFile=0x2098, lpBuffer=0x3850000, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2e57f61c*=0xc37e, lpOverlapped=0x0) returned 1 [0184.242] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xffff3c82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.242] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3850000, cbInput=0xc37e, pPaddingInfo=0x0, pbIV=0x2e57f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2e57f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e57f848, pbOutput=0x3850000, pcbResult=0x2e57f618) returned 0x0 [0184.242] WriteFile (in: hFile=0x2098, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2e57f61c*=0xc380, lpOverlapped=0x0) returned 1 [0184.242] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e57f60c | out: lpNewFilePointer=0x0) returned 1 [0184.243] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.243] WriteFile (in: hFile=0x2098, lpBuffer=0x2e57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e57f83c*, lpNumberOfBytesWritten=0x2e57f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.243] SetFilePointerEx (in: hFile=0x2098, liDistanceToMove=0xc380, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.243] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.243] CloseHandle (hObject=0x2098) returned 1 [0184.243] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.246] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.play")) returned 1 [0184.247] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2908 os_tid = 0x2bd0 [0184.251] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.251] ReadFile (in: hFile=0x2174, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.253] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.253] ReadFile (in: hFile=0x2174, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.253] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.256] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.256] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0184.256] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0184.256] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0184.256] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.256] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0184.261] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.266] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.267] WriteFile (in: hFile=0x2174, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0184.267] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.267] ReadFile (in: hFile=0x2174, lpBuffer=0x3950000, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e6bf61c*=0x662a, lpOverlapped=0x0) returned 1 [0184.268] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xffff99d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.268] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3950000, cbInput=0x662a, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e6bf848, pbOutput=0x3950000, pcbResult=0x2e6bf618) returned 0x0 [0184.268] WriteFile (in: hFile=0x2174, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x6630, lpOverlapped=0x0) returned 1 [0184.268] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0184.268] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.269] WriteFile (in: hFile=0x2174, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.269] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x6630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.269] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.269] CloseHandle (hObject=0x2174) returned 1 [0184.269] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.play")) returned 1 [0184.274] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2909 os_tid = 0x2bd4 [0184.280] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.280] ReadFile (in: hFile=0x217c, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.281] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.282] ReadFile (in: hFile=0x217c, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.282] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.284] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.285] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0184.285] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e7ff828, pbKeyObject=0x0) returned 0x0 [0184.285] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0184.285] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.285] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0184.288] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.291] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.291] WriteFile (in: hFile=0x217c, lpBuffer=0x2e7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesWritten=0x2e7ff830*=0x428, lpOverlapped=0x0) returned 1 [0184.292] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.292] ReadFile (in: hFile=0x217c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e7ff61c*=0x4124, lpOverlapped=0x0) returned 1 [0184.292] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0xffffbedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.292] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3a50000, cbInput=0x4124, pPaddingInfo=0x0, pbIV=0x2e7ff848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e7ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e7ff848, pbOutput=0x3a50000, pcbResult=0x2e7ff618) returned 0x0 [0184.292] WriteFile (in: hFile=0x217c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e7ff61c*=0x4130, lpOverlapped=0x0) returned 1 [0184.293] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7ff60c | out: lpNewFilePointer=0x0) returned 1 [0184.293] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.293] WriteFile (in: hFile=0x217c, lpBuffer=0x2e7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ff83c*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.293] SetFilePointerEx (in: hFile=0x217c, liDistanceToMove=0x4130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.293] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.293] CloseHandle (hObject=0x217c) returned 1 [0184.293] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.play")) returned 1 [0184.297] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2910 os_tid = 0x2bd8 [0184.301] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.302] ReadFile (in: hFile=0x2184, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.303] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.303] ReadFile (in: hFile=0x2184, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.303] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.307] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.307] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0184.307] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e93f828, pbKeyObject=0x0) returned 0x0 [0184.307] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0184.308] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.308] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0184.313] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.317] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.317] WriteFile (in: hFile=0x2184, lpBuffer=0x2e93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e93f830, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesWritten=0x2e93f830*=0x428, lpOverlapped=0x0) returned 1 [0184.317] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.317] ReadFile (in: hFile=0x2184, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e93f61c*=0x13c4, lpOverlapped=0x0) returned 1 [0184.317] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xffffec3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.317] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3b50000, cbInput=0x13c4, pPaddingInfo=0x0, pbIV=0x2e93f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e93f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e93f848, pbOutput=0x3b50000, pcbResult=0x2e93f618) returned 0x0 [0184.318] WriteFile (in: hFile=0x2184, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e93f61c*=0x13d0, lpOverlapped=0x0) returned 1 [0184.318] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93f60c | out: lpNewFilePointer=0x0) returned 1 [0184.318] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.318] WriteFile (in: hFile=0x2184, lpBuffer=0x2e93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e93f83c*, lpNumberOfBytesWritten=0x2e93f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.318] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x13d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.318] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.318] CloseHandle (hObject=0x2184) returned 1 [0184.318] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.play")) returned 1 [0184.323] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2911 os_tid = 0x2bdc [0184.328] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.328] ReadFile (in: hFile=0x218c, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.330] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.330] ReadFile (in: hFile=0x218c, lpBuffer=0x2ea7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ea7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesRead=0x2ea7f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.331] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.334] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.334] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2ea7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0184.334] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2ea7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2ea7f828, pbKeyObject=0x0) returned 0x0 [0184.334] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ea7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0184.335] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.335] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ea7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ea7f500) returned 0x0 [0184.340] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.344] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.344] WriteFile (in: hFile=0x218c, lpBuffer=0x2ea7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ea7f830, lpOverlapped=0x0 | out: lpBuffer=0x2ea7fb34*, lpNumberOfBytesWritten=0x2ea7f830*=0x428, lpOverlapped=0x0) returned 1 [0184.344] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.344] ReadFile (in: hFile=0x218c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2ea7f61c*=0x35bc, lpOverlapped=0x0) returned 1 [0184.345] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0xffffca44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.345] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3c50000, cbInput=0x35bc, pPaddingInfo=0x0, pbIV=0x2ea7f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2ea7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2ea7f848, pbOutput=0x3c50000, pcbResult=0x2ea7f618) returned 0x0 [0184.345] WriteFile (in: hFile=0x218c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2ea7f61c*=0x35c0, lpOverlapped=0x0) returned 1 [0184.346] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea7f60c | out: lpNewFilePointer=0x0) returned 1 [0184.346] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.346] WriteFile (in: hFile=0x218c, lpBuffer=0x2ea7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2ea7f83c*, lpNumberOfBytesWritten=0x2ea7f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.346] SetFilePointerEx (in: hFile=0x218c, liDistanceToMove=0x35c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.346] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.346] CloseHandle (hObject=0x218c) returned 1 [0184.346] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.play")) returned 1 [0184.351] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2912 os_tid = 0x2be0 [0184.356] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.356] ReadFile (in: hFile=0x2194, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.358] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.358] ReadFile (in: hFile=0x2194, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.358] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.362] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x30bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0184.362] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x30bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x30bbf828, pbKeyObject=0x0) returned 0x0 [0184.362] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30bbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0184.362] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.362] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30bbf500) returned 0x0 [0184.367] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.371] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.371] WriteFile (in: hFile=0x2194, lpBuffer=0x30bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bbf830, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesWritten=0x30bbf830*=0x428, lpOverlapped=0x0) returned 1 [0184.371] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.371] ReadFile (in: hFile=0x2194, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x30bbf61c*=0x2a18, lpOverlapped=0x0) returned 1 [0184.373] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xffffd5e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.373] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3d50000, cbInput=0x2a18, pPaddingInfo=0x0, pbIV=0x30bbf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x30bbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30bbf848, pbOutput=0x3d50000, pcbResult=0x30bbf618) returned 0x0 [0184.373] WriteFile (in: hFile=0x2194, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x30bbf61c*=0x2a20, lpOverlapped=0x0) returned 1 [0184.374] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bbf60c | out: lpNewFilePointer=0x0) returned 1 [0184.374] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.374] WriteFile (in: hFile=0x2194, lpBuffer=0x30bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30bbf83c*, lpNumberOfBytesWritten=0x30bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.374] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x2a20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.374] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.374] CloseHandle (hObject=0x2194) returned 1 [0184.374] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.play")) returned 1 [0184.379] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2913 os_tid = 0x2be4 [0184.385] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.385] ReadFile (in: hFile=0x219c, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.387] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.387] ReadFile (in: hFile=0x219c, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.388] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.392] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.392] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x30cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0184.392] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x30cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x30cbf828, pbKeyObject=0x0) returned 0x0 [0184.392] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30cbf500) returned 0x0 [0184.393] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.393] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30cbf500) returned 0x0 [0184.398] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.402] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.402] WriteFile (in: hFile=0x219c, lpBuffer=0x30cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30cbf830, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesWritten=0x30cbf830*=0x428, lpOverlapped=0x0) returned 1 [0184.402] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.402] ReadFile (in: hFile=0x219c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x30cbf61c*=0x1484, lpOverlapped=0x0) returned 1 [0184.402] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0xffffeb7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.402] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3e50000, cbInput=0x1484, pPaddingInfo=0x0, pbIV=0x30cbf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x30cbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30cbf848, pbOutput=0x3e50000, pcbResult=0x30cbf618) returned 0x0 [0184.403] WriteFile (in: hFile=0x219c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x30cbf61c*=0x1490, lpOverlapped=0x0) returned 1 [0184.403] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cbf60c | out: lpNewFilePointer=0x0) returned 1 [0184.403] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.403] WriteFile (in: hFile=0x219c, lpBuffer=0x30cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30cbf83c*, lpNumberOfBytesWritten=0x30cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.403] SetFilePointerEx (in: hFile=0x219c, liDistanceToMove=0x1490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.403] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.403] CloseHandle (hObject=0x219c) returned 1 [0184.403] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.play")) returned 1 [0184.409] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2914 os_tid = 0x2be8 [0184.414] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.414] ReadFile (in: hFile=0x21a4, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.416] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.416] ReadFile (in: hFile=0x21a4, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.417] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0184.421] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0184.421] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x30dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0184.421] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x30dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x30dbf828, pbKeyObject=0x0) returned 0x0 [0184.421] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x30dbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x30dbf500) returned 0x0 [0184.421] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0184.421] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x30dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x30dbf500) returned 0x0 [0184.426] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.430] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.431] WriteFile (in: hFile=0x21a4, lpBuffer=0x30dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30dbf830, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesWritten=0x30dbf830*=0x428, lpOverlapped=0x0) returned 1 [0184.431] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.431] ReadFile (in: hFile=0x21a4, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x30dbf61c*=0x27b4, lpOverlapped=0x0) returned 1 [0184.432] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0xffffd84c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.432] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3f50000, cbInput=0x27b4, pPaddingInfo=0x0, pbIV=0x30dbf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x30dbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30dbf848, pbOutput=0x3f50000, pcbResult=0x30dbf618) returned 0x0 [0184.432] WriteFile (in: hFile=0x21a4, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x30dbf61c*=0x27c0, lpOverlapped=0x0) returned 1 [0184.432] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dbf60c | out: lpNewFilePointer=0x0) returned 1 [0184.432] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.432] WriteFile (in: hFile=0x21a4, lpBuffer=0x30dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30dbf83c*, lpNumberOfBytesWritten=0x30dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.432] SetFilePointerEx (in: hFile=0x21a4, liDistanceToMove=0x27c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.432] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.432] CloseHandle (hObject=0x21a4) returned 1 [0184.433] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0184.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.play")) returned 1 [0184.438] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2915 os_tid = 0x2bec [0184.451] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.452] ReadFile (in: hFile=0x21ac, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.453] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.453] ReadFile (in: hFile=0x21ac, lpBuffer=0x30ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesRead=0x30ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.454] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.457] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.457] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x30ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0184.457] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x30ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x30ebf828, pbKeyObject=0x0) returned 0x0 [0184.457] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30ebf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30ebf500) returned 0x0 [0184.457] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.458] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30ebf500) returned 0x0 [0184.463] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.467] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.468] WriteFile (in: hFile=0x21ac, lpBuffer=0x30ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30ebf830, lpOverlapped=0x0 | out: lpBuffer=0x30ebfb34*, lpNumberOfBytesWritten=0x30ebf830*=0x428, lpOverlapped=0x0) returned 1 [0184.468] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.468] ReadFile (in: hFile=0x21ac, lpBuffer=0x4050000, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x30ebf61c*=0x302c, lpOverlapped=0x0) returned 1 [0184.469] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xffffcfd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.469] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4050000, cbInput=0x302c, pPaddingInfo=0x0, pbIV=0x30ebf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x30ebf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30ebf848, pbOutput=0x4050000, pcbResult=0x30ebf618) returned 0x0 [0184.469] WriteFile (in: hFile=0x21ac, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x30ebf61c*=0x3030, lpOverlapped=0x0) returned 1 [0184.469] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30ebf60c | out: lpNewFilePointer=0x0) returned 1 [0184.469] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.469] WriteFile (in: hFile=0x21ac, lpBuffer=0x30ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x30ebf83c*, lpNumberOfBytesWritten=0x30ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.469] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x3030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.470] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.470] CloseHandle (hObject=0x21ac) returned 1 [0184.470] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.play")) returned 1 [0184.475] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2916 os_tid = 0x2bf0 [0184.481] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.482] ReadFile (in: hFile=0x21b4, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.484] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.484] ReadFile (in: hFile=0x21b4, lpBuffer=0x30fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30fff85c, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesRead=0x30fff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.484] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.487] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x30fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0184.487] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x30fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x30fff828, pbKeyObject=0x0) returned 0x0 [0184.487] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30fff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30fff500) returned 0x0 [0184.488] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.488] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30fff500) returned 0x0 [0184.492] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.497] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.497] WriteFile (in: hFile=0x21b4, lpBuffer=0x30fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30fff830, lpOverlapped=0x0 | out: lpBuffer=0x30fffb34*, lpNumberOfBytesWritten=0x30fff830*=0x428, lpOverlapped=0x0) returned 1 [0184.497] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.497] ReadFile (in: hFile=0x21b4, lpBuffer=0x4150000, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x30fff61c*=0x2004, lpOverlapped=0x0) returned 1 [0184.499] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0xffffdffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.499] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4150000, cbInput=0x2004, pPaddingInfo=0x0, pbIV=0x30fff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x30fff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30fff848, pbOutput=0x4150000, pcbResult=0x30fff618) returned 0x0 [0184.499] WriteFile (in: hFile=0x21b4, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x30fff61c*=0x2010, lpOverlapped=0x0) returned 1 [0184.499] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30fff60c | out: lpNewFilePointer=0x0) returned 1 [0184.499] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.500] WriteFile (in: hFile=0x21b4, lpBuffer=0x30fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30fff61c, lpOverlapped=0x0 | out: lpBuffer=0x30fff83c*, lpNumberOfBytesWritten=0x30fff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.500] SetFilePointerEx (in: hFile=0x21b4, liDistanceToMove=0x2010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.500] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.500] CloseHandle (hObject=0x21b4) returned 1 [0184.500] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.play")) returned 1 [0184.505] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2917 os_tid = 0x2bf4 [0184.510] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.510] ReadFile (in: hFile=0x21bc, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.512] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.512] ReadFile (in: hFile=0x21bc, lpBuffer=0x3113fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3113f85c, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesRead=0x3113f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.512] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.515] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.515] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x3113f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0184.515] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x3113f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x3113f828, pbKeyObject=0x0) returned 0x0 [0184.515] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3113f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3113f500) returned 0x0 [0184.515] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.515] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3113f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3113f500) returned 0x0 [0184.520] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.525] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.525] WriteFile (in: hFile=0x21bc, lpBuffer=0x3113fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3113f830, lpOverlapped=0x0 | out: lpBuffer=0x3113fb34*, lpNumberOfBytesWritten=0x3113f830*=0x428, lpOverlapped=0x0) returned 1 [0184.525] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.525] ReadFile (in: hFile=0x21bc, lpBuffer=0x4250000, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x3113f61c*=0x1c0c, lpOverlapped=0x0) returned 1 [0184.526] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xffffe3f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.526] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4250000, cbInput=0x1c0c, pPaddingInfo=0x0, pbIV=0x3113f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x3113f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3113f848, pbOutput=0x4250000, pcbResult=0x3113f618) returned 0x0 [0184.526] WriteFile (in: hFile=0x21bc, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x3113f61c*=0x1c10, lpOverlapped=0x0) returned 1 [0184.526] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3113f60c | out: lpNewFilePointer=0x0) returned 1 [0184.526] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.527] WriteFile (in: hFile=0x21bc, lpBuffer=0x3113f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3113f61c, lpOverlapped=0x0 | out: lpBuffer=0x3113f83c*, lpNumberOfBytesWritten=0x3113f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.527] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x1c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.527] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.527] CloseHandle (hObject=0x21bc) returned 1 [0184.527] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.play")) returned 1 [0184.532] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2918 os_tid = 0x2bf8 [0184.537] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.538] ReadFile (in: hFile=0x21c4, lpBuffer=0x365bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x365bf85c, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesRead=0x365bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.539] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.539] ReadFile (in: hFile=0x21c4, lpBuffer=0x365bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x365bf85c, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesRead=0x365bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.540] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.543] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.543] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x365bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0184.543] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x365bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x365bf828, pbKeyObject=0x0) returned 0x0 [0184.543] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x365bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x365bf500) returned 0x0 [0184.543] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.543] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x365bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x365bf500) returned 0x0 [0184.548] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.552] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.552] WriteFile (in: hFile=0x21c4, lpBuffer=0x365bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x365bf830, lpOverlapped=0x0 | out: lpBuffer=0x365bfb34*, lpNumberOfBytesWritten=0x365bf830*=0x428, lpOverlapped=0x0) returned 1 [0184.553] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.553] ReadFile (in: hFile=0x21c4, lpBuffer=0x4350000, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x365bf61c*=0x14c0, lpOverlapped=0x0) returned 1 [0184.553] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0xffffeb40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.553] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4350000, cbInput=0x14c0, pPaddingInfo=0x0, pbIV=0x365bf848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x365bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x365bf848, pbOutput=0x4350000, pcbResult=0x365bf618) returned 0x0 [0184.553] WriteFile (in: hFile=0x21c4, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x365bf61c*=0x14d0, lpOverlapped=0x0) returned 1 [0184.554] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365bf60c | out: lpNewFilePointer=0x0) returned 1 [0184.554] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.554] WriteFile (in: hFile=0x21c4, lpBuffer=0x365bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x365bf61c, lpOverlapped=0x0 | out: lpBuffer=0x365bf83c*, lpNumberOfBytesWritten=0x365bf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.554] SetFilePointerEx (in: hFile=0x21c4, liDistanceToMove=0x14d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.554] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.554] CloseHandle (hObject=0x21c4) returned 1 [0184.555] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.play")) returned 1 [0184.562] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2919 os_tid = 0x2bfc [0184.566] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.566] ReadFile (in: hFile=0x21cc, lpBuffer=0x366ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x366ff85c, lpOverlapped=0x0 | out: lpBuffer=0x366ffb34*, lpNumberOfBytesRead=0x366ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.568] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.568] ReadFile (in: hFile=0x21cc, lpBuffer=0x366ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x366ff85c, lpOverlapped=0x0 | out: lpBuffer=0x366ffb34*, lpNumberOfBytesRead=0x366ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.568] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.570] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.570] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x366ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0184.570] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x366ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x366ff828, pbKeyObject=0x0) returned 0x0 [0184.570] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x366ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x366ff500) returned 0x0 [0184.571] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.571] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x366ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x366ff500) returned 0x0 [0184.574] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.577] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.577] WriteFile (in: hFile=0x21cc, lpBuffer=0x366ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x366ff830, lpOverlapped=0x0 | out: lpBuffer=0x366ffb34*, lpNumberOfBytesWritten=0x366ff830*=0x428, lpOverlapped=0x0) returned 1 [0184.577] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.577] ReadFile (in: hFile=0x21cc, lpBuffer=0x4450000, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x366ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x366ff61c*=0x1f7c, lpOverlapped=0x0) returned 1 [0184.578] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xffffe084, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.578] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4450000, cbInput=0x1f7c, pPaddingInfo=0x0, pbIV=0x366ff848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x366ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x366ff848, pbOutput=0x4450000, pcbResult=0x366ff618) returned 0x0 [0184.578] WriteFile (in: hFile=0x21cc, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x366ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x366ff61c*=0x1f80, lpOverlapped=0x0) returned 1 [0184.578] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366ff60c | out: lpNewFilePointer=0x0) returned 1 [0184.578] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.578] WriteFile (in: hFile=0x21cc, lpBuffer=0x366ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x366ff61c, lpOverlapped=0x0 | out: lpBuffer=0x366ff83c*, lpNumberOfBytesWritten=0x366ff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.578] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x1f80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.578] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.579] CloseHandle (hObject=0x21cc) returned 1 [0184.579] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.play")) returned 1 [0184.582] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2920 os_tid = 0xe54 [0184.587] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.587] ReadFile (in: hFile=0x21d4, lpBuffer=0x383bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x383bf85c, lpOverlapped=0x0 | out: lpBuffer=0x383bfb34*, lpNumberOfBytesRead=0x383bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.588] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.588] ReadFile (in: hFile=0x21d4, lpBuffer=0x383bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x383bf85c, lpOverlapped=0x0 | out: lpBuffer=0x383bfb34*, lpNumberOfBytesRead=0x383bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.588] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.590] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.590] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x383bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0184.591] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x383bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x383bf828, pbKeyObject=0x0) returned 0x0 [0184.591] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x383bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x383bf500) returned 0x0 [0184.591] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.591] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x383bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x383bf500) returned 0x0 [0184.595] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.598] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.598] WriteFile (in: hFile=0x21d4, lpBuffer=0x383bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x383bf830, lpOverlapped=0x0 | out: lpBuffer=0x383bfb34*, lpNumberOfBytesWritten=0x383bf830*=0x428, lpOverlapped=0x0) returned 1 [0184.598] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.598] ReadFile (in: hFile=0x21d4, lpBuffer=0x4550000, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x383bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x383bf61c*=0x7a46, lpOverlapped=0x0) returned 1 [0184.599] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0xffff85ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.599] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4550000, cbInput=0x7a46, pPaddingInfo=0x0, pbIV=0x383bf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x383bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x383bf848, pbOutput=0x4550000, pcbResult=0x383bf618) returned 0x0 [0184.599] WriteFile (in: hFile=0x21d4, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x383bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x383bf61c*=0x7a50, lpOverlapped=0x0) returned 1 [0184.599] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383bf60c | out: lpNewFilePointer=0x0) returned 1 [0184.599] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.599] WriteFile (in: hFile=0x21d4, lpBuffer=0x383bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x383bf61c, lpOverlapped=0x0 | out: lpBuffer=0x383bf83c*, lpNumberOfBytesWritten=0x383bf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.599] SetFilePointerEx (in: hFile=0x21d4, liDistanceToMove=0x7a50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.599] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.599] CloseHandle (hObject=0x21d4) returned 1 [0184.600] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.play")) returned 1 [0184.603] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2921 os_tid = 0x11fc [0184.607] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.607] ReadFile (in: hFile=0x21dc, lpBuffer=0x384ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x384ff85c, lpOverlapped=0x0 | out: lpBuffer=0x384ffb34*, lpNumberOfBytesRead=0x384ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.609] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.609] ReadFile (in: hFile=0x21dc, lpBuffer=0x384ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x384ff85c, lpOverlapped=0x0 | out: lpBuffer=0x384ffb34*, lpNumberOfBytesRead=0x384ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.609] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.611] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.611] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x384ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0184.611] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x384ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x384ff828, pbKeyObject=0x0) returned 0x0 [0184.611] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x384ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x384ff500) returned 0x0 [0184.611] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.611] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x384ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x384ff500) returned 0x0 [0184.615] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.618] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.618] WriteFile (in: hFile=0x21dc, lpBuffer=0x384ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x384ff830, lpOverlapped=0x0 | out: lpBuffer=0x384ffb34*, lpNumberOfBytesWritten=0x384ff830*=0x428, lpOverlapped=0x0) returned 1 [0184.618] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.618] ReadFile (in: hFile=0x21dc, lpBuffer=0x4650000, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x384ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x384ff61c*=0x4c0a, lpOverlapped=0x0) returned 1 [0184.619] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xffffb3f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.619] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4650000, cbInput=0x4c0a, pPaddingInfo=0x0, pbIV=0x384ff848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x384ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x384ff848, pbOutput=0x4650000, pcbResult=0x384ff618) returned 0x0 [0184.619] WriteFile (in: hFile=0x21dc, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x384ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x384ff61c*=0x4c10, lpOverlapped=0x0) returned 1 [0184.619] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x384ff60c | out: lpNewFilePointer=0x0) returned 1 [0184.619] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.619] WriteFile (in: hFile=0x21dc, lpBuffer=0x384ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x384ff61c, lpOverlapped=0x0 | out: lpBuffer=0x384ff83c*, lpNumberOfBytesWritten=0x384ff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.619] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x4c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.619] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.619] CloseHandle (hObject=0x21dc) returned 1 [0184.620] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.play")) returned 1 [0184.623] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2922 os_tid = 0x1204 [0184.627] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.627] ReadFile (in: hFile=0x21e4, lpBuffer=0x3863fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3863f85c, lpOverlapped=0x0 | out: lpBuffer=0x3863fb34*, lpNumberOfBytesRead=0x3863f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.629] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.629] ReadFile (in: hFile=0x21e4, lpBuffer=0x3863fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3863f85c, lpOverlapped=0x0 | out: lpBuffer=0x3863fb34*, lpNumberOfBytesRead=0x3863f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.629] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.631] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.631] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x3863f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0184.631] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x3863f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x3863f828, pbKeyObject=0x0) returned 0x0 [0184.631] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3863f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3863f500) returned 0x0 [0184.631] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.632] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3863f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3863f500) returned 0x0 [0184.635] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.638] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.638] WriteFile (in: hFile=0x21e4, lpBuffer=0x3863fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3863f830, lpOverlapped=0x0 | out: lpBuffer=0x3863fb34*, lpNumberOfBytesWritten=0x3863f830*=0x428, lpOverlapped=0x0) returned 1 [0184.638] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.638] ReadFile (in: hFile=0x21e4, lpBuffer=0x4750000, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x3863f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x3863f61c*=0xa0b0, lpOverlapped=0x0) returned 1 [0184.639] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0xffff5f50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.639] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4750000, cbInput=0xa0b0, pPaddingInfo=0x0, pbIV=0x3863f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x3863f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3863f848, pbOutput=0x4750000, pcbResult=0x3863f618) returned 0x0 [0184.639] WriteFile (in: hFile=0x21e4, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0xa0c0, lpNumberOfBytesWritten=0x3863f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x3863f61c*=0xa0c0, lpOverlapped=0x0) returned 1 [0184.639] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3863f60c | out: lpNewFilePointer=0x0) returned 1 [0184.639] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.640] WriteFile (in: hFile=0x21e4, lpBuffer=0x3863f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3863f61c, lpOverlapped=0x0 | out: lpBuffer=0x3863f83c*, lpNumberOfBytesWritten=0x3863f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.640] SetFilePointerEx (in: hFile=0x21e4, liDistanceToMove=0xa0c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.640] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.640] CloseHandle (hObject=0x21e4) returned 1 [0184.640] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.play")) returned 1 [0184.643] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2923 os_tid = 0x1200 [0184.647] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.647] ReadFile (in: hFile=0x21ec, lpBuffer=0x3877fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3877f85c, lpOverlapped=0x0 | out: lpBuffer=0x3877fb34*, lpNumberOfBytesRead=0x3877f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.649] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.649] ReadFile (in: hFile=0x21ec, lpBuffer=0x3877fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3877f85c, lpOverlapped=0x0 | out: lpBuffer=0x3877fb34*, lpNumberOfBytesRead=0x3877f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.649] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.652] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.652] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x3877f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0184.652] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x3877f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x3877f828, pbKeyObject=0x0) returned 0x0 [0184.652] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3877f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3877f500) returned 0x0 [0184.652] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.652] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3877f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3877f500) returned 0x0 [0184.656] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.660] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.660] WriteFile (in: hFile=0x21ec, lpBuffer=0x3877fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3877f830, lpOverlapped=0x0 | out: lpBuffer=0x3877fb34*, lpNumberOfBytesWritten=0x3877f830*=0x428, lpOverlapped=0x0) returned 1 [0184.660] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.660] ReadFile (in: hFile=0x21ec, lpBuffer=0x4850000, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x3877f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x3877f61c*=0x4f08, lpOverlapped=0x0) returned 1 [0184.661] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xffffb0f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.661] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4850000, cbInput=0x4f08, pPaddingInfo=0x0, pbIV=0x3877f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x3877f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3877f848, pbOutput=0x4850000, pcbResult=0x3877f618) returned 0x0 [0184.661] WriteFile (in: hFile=0x21ec, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x3877f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x3877f61c*=0x4f10, lpOverlapped=0x0) returned 1 [0184.661] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3877f60c | out: lpNewFilePointer=0x0) returned 1 [0184.661] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.661] WriteFile (in: hFile=0x21ec, lpBuffer=0x3877f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3877f61c, lpOverlapped=0x0 | out: lpBuffer=0x3877f83c*, lpNumberOfBytesWritten=0x3877f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.662] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x4f10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.662] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.662] CloseHandle (hObject=0x21ec) returned 1 [0184.662] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.play")) returned 1 [0184.666] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2924 os_tid = 0x11f8 [0184.671] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.671] ReadFile (in: hFile=0x21f4, lpBuffer=0x388bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x388bf85c, lpOverlapped=0x0 | out: lpBuffer=0x388bfb34*, lpNumberOfBytesRead=0x388bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.672] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.672] ReadFile (in: hFile=0x21f4, lpBuffer=0x388bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x388bf85c, lpOverlapped=0x0 | out: lpBuffer=0x388bfb34*, lpNumberOfBytesRead=0x388bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.672] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.676] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.676] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x388bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0184.676] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x388bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x388bf828, pbKeyObject=0x0) returned 0x0 [0184.676] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x388bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x388bf500) returned 0x0 [0184.676] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.676] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x388bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x388bf500) returned 0x0 [0184.680] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.684] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.684] WriteFile (in: hFile=0x21f4, lpBuffer=0x388bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x388bf830, lpOverlapped=0x0 | out: lpBuffer=0x388bfb34*, lpNumberOfBytesWritten=0x388bf830*=0x428, lpOverlapped=0x0) returned 1 [0184.684] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.684] ReadFile (in: hFile=0x21f4, lpBuffer=0x4950000, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x388bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x388bf61c*=0x5398, lpOverlapped=0x0) returned 1 [0184.686] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0xffffac68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.686] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4950000, cbInput=0x5398, pPaddingInfo=0x0, pbIV=0x388bf848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x388bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x388bf848, pbOutput=0x4950000, pcbResult=0x388bf618) returned 0x0 [0184.686] WriteFile (in: hFile=0x21f4, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x388bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x388bf61c*=0x53a0, lpOverlapped=0x0) returned 1 [0184.687] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x388bf60c | out: lpNewFilePointer=0x0) returned 1 [0184.687] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.687] WriteFile (in: hFile=0x21f4, lpBuffer=0x388bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x388bf61c, lpOverlapped=0x0 | out: lpBuffer=0x388bf83c*, lpNumberOfBytesWritten=0x388bf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.687] SetFilePointerEx (in: hFile=0x21f4, liDistanceToMove=0x53a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.687] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.687] CloseHandle (hObject=0x21f4) returned 1 [0184.687] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.play")) returned 1 [0184.691] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2925 os_tid = 0x1244 [0184.695] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.695] ReadFile (in: hFile=0x21fc, lpBuffer=0x389ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x389ff85c, lpOverlapped=0x0 | out: lpBuffer=0x389ffb34*, lpNumberOfBytesRead=0x389ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.697] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.697] ReadFile (in: hFile=0x21fc, lpBuffer=0x389ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x389ff85c, lpOverlapped=0x0 | out: lpBuffer=0x389ffb34*, lpNumberOfBytesRead=0x389ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.697] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.700] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.700] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x389ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0184.700] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x389ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x389ff828, pbKeyObject=0x0) returned 0x0 [0184.700] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x389ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x389ff500) returned 0x0 [0184.700] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.700] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x389ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x389ff500) returned 0x0 [0184.705] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.708] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.708] WriteFile (in: hFile=0x21fc, lpBuffer=0x389ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x389ff830, lpOverlapped=0x0 | out: lpBuffer=0x389ffb34*, lpNumberOfBytesWritten=0x389ff830*=0x428, lpOverlapped=0x0) returned 1 [0184.708] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.708] ReadFile (in: hFile=0x21fc, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x389ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x389ff61c*=0x366e, lpOverlapped=0x0) returned 1 [0184.709] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xffffc992, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.709] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4a50000, cbInput=0x366e, pPaddingInfo=0x0, pbIV=0x389ff848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x389ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x389ff848, pbOutput=0x4a50000, pcbResult=0x389ff618) returned 0x0 [0184.709] WriteFile (in: hFile=0x21fc, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x389ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x389ff61c*=0x3670, lpOverlapped=0x0) returned 1 [0184.709] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x389ff60c | out: lpNewFilePointer=0x0) returned 1 [0184.709] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.709] WriteFile (in: hFile=0x21fc, lpBuffer=0x389ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x389ff61c, lpOverlapped=0x0 | out: lpBuffer=0x389ff83c*, lpNumberOfBytesWritten=0x389ff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.709] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x3670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.709] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.709] CloseHandle (hObject=0x21fc) returned 1 [0184.709] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.play")) returned 1 [0184.713] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2926 os_tid = 0x26a8 [0184.718] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.718] ReadFile (in: hFile=0x2088, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.720] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.720] ReadFile (in: hFile=0x2088, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.720] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.723] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.723] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0184.723] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0184.723] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1444f500) returned 0x0 [0184.723] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.723] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1444f500) returned 0x0 [0184.727] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.730] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.730] WriteFile (in: hFile=0x2088, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0184.730] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.730] ReadFile (in: hFile=0x2088, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x1444f61c*=0x273e, lpOverlapped=0x0) returned 1 [0184.731] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xffffd8c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.731] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4b50000, cbInput=0x273e, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1444f848, pbOutput=0x4b50000, pcbResult=0x1444f618) returned 0x0 [0184.731] WriteFile (in: hFile=0x2088, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x1444f61c*=0x2740, lpOverlapped=0x0) returned 1 [0184.731] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0184.731] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.731] WriteFile (in: hFile=0x2088, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.731] SetFilePointerEx (in: hFile=0x2088, liDistanceToMove=0x2740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.731] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.732] CloseHandle (hObject=0x2088) returned 1 [0184.732] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.play")) returned 1 [0184.735] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2927 os_tid = 0x1240 [0184.739] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.740] ReadFile (in: hFile=0x2208, lpBuffer=0x38b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38b3fb34*, lpNumberOfBytesRead=0x38b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.741] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.741] ReadFile (in: hFile=0x2208, lpBuffer=0x38b3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38b3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38b3fb34*, lpNumberOfBytesRead=0x38b3f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.741] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.745] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.745] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x38b3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0184.745] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x38b3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x38b3f828, pbKeyObject=0x0) returned 0x0 [0184.745] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38b3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38b3f500) returned 0x0 [0184.745] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.745] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38b3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38b3f500) returned 0x0 [0184.751] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.754] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.755] WriteFile (in: hFile=0x2208, lpBuffer=0x38b3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38b3f830, lpOverlapped=0x0 | out: lpBuffer=0x38b3fb34*, lpNumberOfBytesWritten=0x38b3f830*=0x428, lpOverlapped=0x0) returned 1 [0184.755] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.755] ReadFile (in: hFile=0x2208, lpBuffer=0x2750000, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x38b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x38b3f61c*=0xf36, lpOverlapped=0x0) returned 1 [0184.755] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffff0ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.755] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2750000, cbInput=0xf36, pPaddingInfo=0x0, pbIV=0x38b3f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x38b3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38b3f848, pbOutput=0x2750000, pcbResult=0x38b3f618) returned 0x0 [0184.755] WriteFile (in: hFile=0x2208, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x38b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x38b3f61c*=0xf40, lpOverlapped=0x0) returned 1 [0184.755] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38b3f60c | out: lpNewFilePointer=0x0) returned 1 [0184.756] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.756] WriteFile (in: hFile=0x2208, lpBuffer=0x38b3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38b3f61c, lpOverlapped=0x0 | out: lpBuffer=0x38b3f83c*, lpNumberOfBytesWritten=0x38b3f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.756] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xf40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.756] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.756] CloseHandle (hObject=0x2208) returned 1 [0184.756] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.759] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.play")) returned 1 [0184.761] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2928 os_tid = 0x1178 [0184.766] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.766] ReadFile (in: hFile=0x2210, lpBuffer=0x38c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x38c7fb34*, lpNumberOfBytesRead=0x38c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.769] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.769] ReadFile (in: hFile=0x2210, lpBuffer=0x38c7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38c7f85c, lpOverlapped=0x0 | out: lpBuffer=0x38c7fb34*, lpNumberOfBytesRead=0x38c7f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.770] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.773] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.774] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x38c7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0184.774] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x38c7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x38c7f828, pbKeyObject=0x0) returned 0x0 [0184.774] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38c7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38c7f500) returned 0x0 [0184.774] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.774] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38c7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38c7f500) returned 0x0 [0184.777] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.781] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.781] WriteFile (in: hFile=0x2210, lpBuffer=0x38c7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38c7f830, lpOverlapped=0x0 | out: lpBuffer=0x38c7fb34*, lpNumberOfBytesWritten=0x38c7f830*=0x428, lpOverlapped=0x0) returned 1 [0184.782] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.782] ReadFile (in: hFile=0x2210, lpBuffer=0x4c50000, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x38c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x38c7f61c*=0xa50e, lpOverlapped=0x0) returned 1 [0184.783] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0xffff5af2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.783] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4c50000, cbInput=0xa50e, pPaddingInfo=0x0, pbIV=0x38c7f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x38c7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38c7f848, pbOutput=0x4c50000, pcbResult=0x38c7f618) returned 0x0 [0184.783] WriteFile (in: hFile=0x2210, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x38c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x38c7f61c*=0xa510, lpOverlapped=0x0) returned 1 [0184.783] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38c7f60c | out: lpNewFilePointer=0x0) returned 1 [0184.783] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.783] WriteFile (in: hFile=0x2210, lpBuffer=0x38c7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38c7f61c, lpOverlapped=0x0 | out: lpBuffer=0x38c7f83c*, lpNumberOfBytesWritten=0x38c7f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.783] SetFilePointerEx (in: hFile=0x2210, liDistanceToMove=0xa510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.783] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.783] CloseHandle (hObject=0x2210) returned 1 [0184.783] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.play")) returned 1 [0184.788] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2929 os_tid = 0x2c04 [0184.768] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.768] ReadFile (in: hFile=0x2218, lpBuffer=0x38dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x38dbfb34*, lpNumberOfBytesRead=0x38dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.793] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.793] ReadFile (in: hFile=0x2218, lpBuffer=0x38dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x38dbfb34*, lpNumberOfBytesRead=0x38dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.793] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.806] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.806] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x38dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0184.806] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x38dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x38dbf828, pbKeyObject=0x0) returned 0x0 [0184.806] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38dbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38dbf500) returned 0x0 [0184.806] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.806] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38dbf500) returned 0x0 [0184.810] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.814] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.814] WriteFile (in: hFile=0x2218, lpBuffer=0x38dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38dbf830, lpOverlapped=0x0 | out: lpBuffer=0x38dbfb34*, lpNumberOfBytesWritten=0x38dbf830*=0x428, lpOverlapped=0x0) returned 1 [0184.814] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.814] ReadFile (in: hFile=0x2218, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x38dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x38dbf61c*=0x6e74, lpOverlapped=0x0) returned 1 [0184.815] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xffff918c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.815] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4d50000, cbInput=0x6e74, pPaddingInfo=0x0, pbIV=0x38dbf848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x38dbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38dbf848, pbOutput=0x4d50000, pcbResult=0x38dbf618) returned 0x0 [0184.815] WriteFile (in: hFile=0x2218, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x38dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x38dbf61c*=0x6e80, lpOverlapped=0x0) returned 1 [0184.816] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dbf60c | out: lpNewFilePointer=0x0) returned 1 [0184.816] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.816] WriteFile (in: hFile=0x2218, lpBuffer=0x38dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x38dbf83c*, lpNumberOfBytesWritten=0x38dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.816] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x6e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.816] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.816] CloseHandle (hObject=0x2218) returned 1 [0184.816] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.play")) returned 1 [0184.820] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2930 os_tid = 0x2c08 [0184.825] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.825] ReadFile (in: hFile=0x2220, lpBuffer=0x38effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38eff85c, lpOverlapped=0x0 | out: lpBuffer=0x38effb34*, lpNumberOfBytesRead=0x38eff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.827] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.827] ReadFile (in: hFile=0x2220, lpBuffer=0x38effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38eff85c, lpOverlapped=0x0 | out: lpBuffer=0x38effb34*, lpNumberOfBytesRead=0x38eff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.828] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.831] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.831] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x38eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0184.831] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x38eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x38eff828, pbKeyObject=0x0) returned 0x0 [0184.831] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38eff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38eff500) returned 0x0 [0184.832] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.832] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38eff500) returned 0x0 [0184.838] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.842] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.842] WriteFile (in: hFile=0x2220, lpBuffer=0x38effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38eff830, lpOverlapped=0x0 | out: lpBuffer=0x38effb34*, lpNumberOfBytesWritten=0x38eff830*=0x428, lpOverlapped=0x0) returned 1 [0184.843] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.843] ReadFile (in: hFile=0x2220, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x38eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x38eff61c*=0x180e, lpOverlapped=0x0) returned 1 [0184.843] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0xffffe7f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.843] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4e50000, cbInput=0x180e, pPaddingInfo=0x0, pbIV=0x38eff848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x38eff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38eff848, pbOutput=0x4e50000, pcbResult=0x38eff618) returned 0x0 [0184.843] WriteFile (in: hFile=0x2220, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x38eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x38eff61c*=0x1810, lpOverlapped=0x0) returned 1 [0184.843] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38eff60c | out: lpNewFilePointer=0x0) returned 1 [0184.843] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.843] WriteFile (in: hFile=0x2220, lpBuffer=0x38eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38eff61c, lpOverlapped=0x0 | out: lpBuffer=0x38eff83c*, lpNumberOfBytesWritten=0x38eff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.843] SetFilePointerEx (in: hFile=0x2220, liDistanceToMove=0x1810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.843] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.843] CloseHandle (hObject=0x2220) returned 1 [0184.843] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.play")) returned 1 [0184.848] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2931 os_tid = 0x2c0c [0184.852] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.852] ReadFile (in: hFile=0x2228, lpBuffer=0x3903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3903f85c, lpOverlapped=0x0 | out: lpBuffer=0x3903fb34*, lpNumberOfBytesRead=0x3903f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.854] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.854] ReadFile (in: hFile=0x2228, lpBuffer=0x3903fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3903f85c, lpOverlapped=0x0 | out: lpBuffer=0x3903fb34*, lpNumberOfBytesRead=0x3903f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.854] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.858] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.858] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x3903f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0184.858] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x3903f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x3903f828, pbKeyObject=0x0) returned 0x0 [0184.858] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3903f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3903f500) returned 0x0 [0184.858] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.858] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3903f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3903f500) returned 0x0 [0184.861] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.864] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.865] WriteFile (in: hFile=0x2228, lpBuffer=0x3903fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3903f830, lpOverlapped=0x0 | out: lpBuffer=0x3903fb34*, lpNumberOfBytesWritten=0x3903f830*=0x428, lpOverlapped=0x0) returned 1 [0184.865] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.865] ReadFile (in: hFile=0x2228, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x3903f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x3903f61c*=0x25cc, lpOverlapped=0x0) returned 1 [0184.865] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xffffda34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.866] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4f50000, cbInput=0x25cc, pPaddingInfo=0x0, pbIV=0x3903f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x3903f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3903f848, pbOutput=0x4f50000, pcbResult=0x3903f618) returned 0x0 [0184.866] WriteFile (in: hFile=0x2228, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x3903f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x3903f61c*=0x25d0, lpOverlapped=0x0) returned 1 [0184.866] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3903f60c | out: lpNewFilePointer=0x0) returned 1 [0184.866] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.866] WriteFile (in: hFile=0x2228, lpBuffer=0x3903f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3903f61c, lpOverlapped=0x0 | out: lpBuffer=0x3903f83c*, lpNumberOfBytesWritten=0x3903f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.866] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x25d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.866] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.866] CloseHandle (hObject=0x2228) returned 1 [0184.866] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.play")) returned 1 [0184.870] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2932 os_tid = 0x2c10 [0184.874] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.874] ReadFile (in: hFile=0x2230, lpBuffer=0x3917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3917f85c, lpOverlapped=0x0 | out: lpBuffer=0x3917fb34*, lpNumberOfBytesRead=0x3917f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.876] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.876] ReadFile (in: hFile=0x2230, lpBuffer=0x3917fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3917f85c, lpOverlapped=0x0 | out: lpBuffer=0x3917fb34*, lpNumberOfBytesRead=0x3917f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.878] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.878] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x3917f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0184.878] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x3917f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x3917f828, pbKeyObject=0x0) returned 0x0 [0184.878] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3917f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3917f500) returned 0x0 [0184.879] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.879] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3917f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3917f500) returned 0x0 [0184.882] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.885] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.885] WriteFile (in: hFile=0x2230, lpBuffer=0x3917fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3917f830, lpOverlapped=0x0 | out: lpBuffer=0x3917fb34*, lpNumberOfBytesWritten=0x3917f830*=0x428, lpOverlapped=0x0) returned 1 [0184.885] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.886] ReadFile (in: hFile=0x2230, lpBuffer=0x5050000, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x3917f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x3917f61c*=0x199a, lpOverlapped=0x0) returned 1 [0184.894] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0xffffe666, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.894] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5050000, cbInput=0x199a, pPaddingInfo=0x0, pbIV=0x3917f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x3917f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3917f848, pbOutput=0x5050000, pcbResult=0x3917f618) returned 0x0 [0184.894] WriteFile (in: hFile=0x2230, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x3917f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x3917f61c*=0x19a0, lpOverlapped=0x0) returned 1 [0184.895] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3917f60c | out: lpNewFilePointer=0x0) returned 1 [0184.895] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.895] WriteFile (in: hFile=0x2230, lpBuffer=0x3917f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3917f61c, lpOverlapped=0x0 | out: lpBuffer=0x3917f83c*, lpNumberOfBytesWritten=0x3917f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.895] SetFilePointerEx (in: hFile=0x2230, liDistanceToMove=0x19a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.895] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.895] CloseHandle (hObject=0x2230) returned 1 [0184.895] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.play")) returned 1 [0184.900] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2933 os_tid = 0x2c14 [0184.906] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.906] ReadFile (in: hFile=0x2238, lpBuffer=0x392bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x392bf85c, lpOverlapped=0x0 | out: lpBuffer=0x392bfb34*, lpNumberOfBytesRead=0x392bf85c*=0x428, lpOverlapped=0x0) returned 1 [0184.908] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.912] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.912] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x392bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0184.912] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x392bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x392bf828, pbKeyObject=0x0) returned 0x0 [0184.912] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x392bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x392bf500) returned 0x0 [0184.913] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.913] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x392bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x392bf500) returned 0x0 [0184.919] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.923] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.924] WriteFile (in: hFile=0x2238, lpBuffer=0x392bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x392bf830, lpOverlapped=0x0 | out: lpBuffer=0x392bfb34*, lpNumberOfBytesWritten=0x392bf830*=0x428, lpOverlapped=0x0) returned 1 [0184.924] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.924] ReadFile (in: hFile=0x2238, lpBuffer=0x5150000, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x392bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x392bf61c*=0x80c, lpOverlapped=0x0) returned 1 [0184.924] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0xfffff7f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.924] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5150000, cbInput=0x80c, pPaddingInfo=0x0, pbIV=0x392bf848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x392bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x392bf848, pbOutput=0x5150000, pcbResult=0x392bf618) returned 0x0 [0184.924] WriteFile (in: hFile=0x2238, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x392bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x392bf61c*=0x810, lpOverlapped=0x0) returned 1 [0184.925] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x392bf60c | out: lpNewFilePointer=0x0) returned 1 [0184.925] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.925] WriteFile (in: hFile=0x2238, lpBuffer=0x392bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x392bf61c, lpOverlapped=0x0 | out: lpBuffer=0x392bf83c*, lpNumberOfBytesWritten=0x392bf61c*=0x8, lpOverlapped=0x0) returned 1 [0184.925] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.925] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.925] CloseHandle (hObject=0x2238) returned 1 [0184.925] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.play")) returned 1 [0184.931] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2934 os_tid = 0x2c18 [0184.936] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.936] ReadFile (in: hFile=0x2240, lpBuffer=0x393ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x393ff85c, lpOverlapped=0x0 | out: lpBuffer=0x393ffb34*, lpNumberOfBytesRead=0x393ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.938] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.938] ReadFile (in: hFile=0x2240, lpBuffer=0x393ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x393ff85c, lpOverlapped=0x0 | out: lpBuffer=0x393ffb34*, lpNumberOfBytesRead=0x393ff85c*=0x428, lpOverlapped=0x0) returned 1 [0184.938] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.942] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.942] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x393ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0184.942] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x393ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x393ff828, pbKeyObject=0x0) returned 0x0 [0184.942] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x393ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x393ff500) returned 0x0 [0184.942] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.942] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x393ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x393ff500) returned 0x0 [0184.948] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.953] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.953] WriteFile (in: hFile=0x2240, lpBuffer=0x393ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x393ff830, lpOverlapped=0x0 | out: lpBuffer=0x393ffb34*, lpNumberOfBytesWritten=0x393ff830*=0x428, lpOverlapped=0x0) returned 1 [0184.953] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.953] ReadFile (in: hFile=0x2240, lpBuffer=0x5250000, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x393ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x393ff61c*=0x1d4a, lpOverlapped=0x0) returned 1 [0184.954] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0xffffe2b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.954] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5250000, cbInput=0x1d4a, pPaddingInfo=0x0, pbIV=0x393ff848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x393ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x393ff848, pbOutput=0x5250000, pcbResult=0x393ff618) returned 0x0 [0184.954] WriteFile (in: hFile=0x2240, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x393ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x393ff61c*=0x1d50, lpOverlapped=0x0) returned 1 [0184.955] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393ff60c | out: lpNewFilePointer=0x0) returned 1 [0184.955] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.955] WriteFile (in: hFile=0x2240, lpBuffer=0x393ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393ff61c, lpOverlapped=0x0 | out: lpBuffer=0x393ff83c*, lpNumberOfBytesWritten=0x393ff61c*=0x8, lpOverlapped=0x0) returned 1 [0184.955] SetFilePointerEx (in: hFile=0x2240, liDistanceToMove=0x1d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.955] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.955] CloseHandle (hObject=0x2240) returned 1 [0184.955] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.play")) returned 1 [0184.960] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2935 os_tid = 0x2c1c [0184.966] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.966] ReadFile (in: hFile=0x2248, lpBuffer=0x3953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3953f85c, lpOverlapped=0x0 | out: lpBuffer=0x3953fb34*, lpNumberOfBytesRead=0x3953f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.968] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.968] ReadFile (in: hFile=0x2248, lpBuffer=0x3953fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3953f85c, lpOverlapped=0x0 | out: lpBuffer=0x3953fb34*, lpNumberOfBytesRead=0x3953f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.968] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0184.972] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0184.972] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x3953f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0184.972] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x3953f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x3953f828, pbKeyObject=0x0) returned 0x0 [0184.972] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3953f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3953f500) returned 0x0 [0184.972] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0184.973] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3953f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3953f500) returned 0x0 [0184.976] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.981] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.981] WriteFile (in: hFile=0x2248, lpBuffer=0x3953fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3953f830, lpOverlapped=0x0 | out: lpBuffer=0x3953fb34*, lpNumberOfBytesWritten=0x3953f830*=0x428, lpOverlapped=0x0) returned 1 [0184.981] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.981] ReadFile (in: hFile=0x2248, lpBuffer=0x5350000, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x3953f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x3953f61c*=0xa5c, lpOverlapped=0x0) returned 1 [0184.981] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0xfffff5a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.981] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5350000, cbInput=0xa5c, pPaddingInfo=0x0, pbIV=0x3953f848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x3953f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3953f848, pbOutput=0x5350000, pcbResult=0x3953f618) returned 0x0 [0184.981] WriteFile (in: hFile=0x2248, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x3953f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x3953f61c*=0xa60, lpOverlapped=0x0) returned 1 [0184.982] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3953f60c | out: lpNewFilePointer=0x0) returned 1 [0184.982] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.982] WriteFile (in: hFile=0x2248, lpBuffer=0x3953f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3953f61c, lpOverlapped=0x0 | out: lpBuffer=0x3953f83c*, lpNumberOfBytesWritten=0x3953f61c*=0x8, lpOverlapped=0x0) returned 1 [0184.982] SetFilePointerEx (in: hFile=0x2248, liDistanceToMove=0xa60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.982] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0184.982] CloseHandle (hObject=0x2248) returned 1 [0184.982] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0184.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.play")) returned 1 [0184.989] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2936 os_tid = 0x2c20 [0184.996] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.996] ReadFile (in: hFile=0x2250, lpBuffer=0x3967fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3967f85c, lpOverlapped=0x0 | out: lpBuffer=0x3967fb34*, lpNumberOfBytesRead=0x3967f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.998] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.998] ReadFile (in: hFile=0x2250, lpBuffer=0x3967fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3967f85c, lpOverlapped=0x0 | out: lpBuffer=0x3967fb34*, lpNumberOfBytesRead=0x3967f85c*=0x428, lpOverlapped=0x0) returned 1 [0184.998] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.002] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.002] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x3967f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0185.002] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x3967f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x3967f828, pbKeyObject=0x0) returned 0x0 [0185.002] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3967f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3967f500) returned 0x0 [0185.002] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.003] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3967f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3967f500) returned 0x0 [0185.008] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.013] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.013] WriteFile (in: hFile=0x2250, lpBuffer=0x3967fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3967f830, lpOverlapped=0x0 | out: lpBuffer=0x3967fb34*, lpNumberOfBytesWritten=0x3967f830*=0x428, lpOverlapped=0x0) returned 1 [0185.013] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.013] ReadFile (in: hFile=0x2250, lpBuffer=0x5450000, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x3967f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x3967f61c*=0xf00, lpOverlapped=0x0) returned 1 [0185.014] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xfffff100, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.014] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5450000, cbInput=0xf00, pPaddingInfo=0x0, pbIV=0x3967f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x3967f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3967f848, pbOutput=0x5450000, pcbResult=0x3967f618) returned 0x0 [0185.014] WriteFile (in: hFile=0x2250, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x3967f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x3967f61c*=0xf10, lpOverlapped=0x0) returned 1 [0185.014] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3967f60c | out: lpNewFilePointer=0x0) returned 1 [0185.014] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.014] WriteFile (in: hFile=0x2250, lpBuffer=0x3967f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3967f61c, lpOverlapped=0x0 | out: lpBuffer=0x3967f83c*, lpNumberOfBytesWritten=0x3967f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.014] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xf10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.014] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.014] CloseHandle (hObject=0x2250) returned 1 [0185.015] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.play")) returned 1 [0185.019] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2937 os_tid = 0x2c24 [0185.025] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.025] ReadFile (in: hFile=0x2258, lpBuffer=0x397bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x397bf85c, lpOverlapped=0x0 | out: lpBuffer=0x397bfb34*, lpNumberOfBytesRead=0x397bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.027] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.027] ReadFile (in: hFile=0x2258, lpBuffer=0x397bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x397bf85c, lpOverlapped=0x0 | out: lpBuffer=0x397bfb34*, lpNumberOfBytesRead=0x397bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.027] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.031] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.031] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x397bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0185.031] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x397bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x397bf828, pbKeyObject=0x0) returned 0x0 [0185.031] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x397bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x397bf500) returned 0x0 [0185.031] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.031] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x397bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x397bf500) returned 0x0 [0185.037] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.041] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.041] WriteFile (in: hFile=0x2258, lpBuffer=0x397bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x397bf830, lpOverlapped=0x0 | out: lpBuffer=0x397bfb34*, lpNumberOfBytesWritten=0x397bf830*=0x428, lpOverlapped=0x0) returned 1 [0185.042] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.042] ReadFile (in: hFile=0x2258, lpBuffer=0x5550000, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x397bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x397bf61c*=0x7cb6, lpOverlapped=0x0) returned 1 [0185.043] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0xffff834a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.043] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5550000, cbInput=0x7cb6, pPaddingInfo=0x0, pbIV=0x397bf848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x397bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x397bf848, pbOutput=0x5550000, pcbResult=0x397bf618) returned 0x0 [0185.043] WriteFile (in: hFile=0x2258, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x397bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x397bf61c*=0x7cc0, lpOverlapped=0x0) returned 1 [0185.044] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397bf60c | out: lpNewFilePointer=0x0) returned 1 [0185.044] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.044] WriteFile (in: hFile=0x2258, lpBuffer=0x397bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x397bf61c, lpOverlapped=0x0 | out: lpBuffer=0x397bf83c*, lpNumberOfBytesWritten=0x397bf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.044] SetFilePointerEx (in: hFile=0x2258, liDistanceToMove=0x7cc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.044] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.044] CloseHandle (hObject=0x2258) returned 1 [0185.045] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.play")) returned 1 [0185.050] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2938 os_tid = 0x2c28 [0185.056] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.056] ReadFile (in: hFile=0x2260, lpBuffer=0x398ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x398ff85c, lpOverlapped=0x0 | out: lpBuffer=0x398ffb34*, lpNumberOfBytesRead=0x398ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.058] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.058] ReadFile (in: hFile=0x2260, lpBuffer=0x398ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x398ff85c, lpOverlapped=0x0 | out: lpBuffer=0x398ffb34*, lpNumberOfBytesRead=0x398ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.058] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.062] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x398ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0185.062] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x398ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x398ff828, pbKeyObject=0x0) returned 0x0 [0185.062] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x398ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x398ff500) returned 0x0 [0185.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.062] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x398ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x398ff500) returned 0x0 [0185.068] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.073] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.073] WriteFile (in: hFile=0x2260, lpBuffer=0x398ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x398ff830, lpOverlapped=0x0 | out: lpBuffer=0x398ffb34*, lpNumberOfBytesWritten=0x398ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.074] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.074] ReadFile (in: hFile=0x2260, lpBuffer=0x5650000, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x398ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x398ff61c*=0xaefa, lpOverlapped=0x0) returned 1 [0185.075] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xffff5106, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.075] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5650000, cbInput=0xaefa, pPaddingInfo=0x0, pbIV=0x398ff848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x398ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x398ff848, pbOutput=0x5650000, pcbResult=0x398ff618) returned 0x0 [0185.075] WriteFile (in: hFile=0x2260, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x398ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x398ff61c*=0xaf00, lpOverlapped=0x0) returned 1 [0185.076] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x398ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.076] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.076] WriteFile (in: hFile=0x2260, lpBuffer=0x398ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x398ff61c, lpOverlapped=0x0 | out: lpBuffer=0x398ff83c*, lpNumberOfBytesWritten=0x398ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.076] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xaf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.076] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.076] CloseHandle (hObject=0x2260) returned 1 [0185.076] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.play")) returned 1 [0185.082] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2939 os_tid = 0x2c2c [0185.087] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.087] ReadFile (in: hFile=0x2268, lpBuffer=0x39a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x39a3fb34*, lpNumberOfBytesRead=0x39a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.089] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.089] ReadFile (in: hFile=0x2268, lpBuffer=0x39a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x39a3fb34*, lpNumberOfBytesRead=0x39a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.089] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.094] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.094] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x39a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0185.094] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x39a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x39a3f828, pbKeyObject=0x0) returned 0x0 [0185.094] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39a3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39a3f500) returned 0x0 [0185.095] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.095] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39a3f500) returned 0x0 [0185.101] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.105] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.106] WriteFile (in: hFile=0x2268, lpBuffer=0x39a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39a3f830, lpOverlapped=0x0 | out: lpBuffer=0x39a3fb34*, lpNumberOfBytesWritten=0x39a3f830*=0x428, lpOverlapped=0x0) returned 1 [0185.106] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.106] ReadFile (in: hFile=0x2268, lpBuffer=0x5750000, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x39a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x39a3f61c*=0x2d6c, lpOverlapped=0x0) returned 1 [0185.107] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0xffffd294, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.108] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5750000, cbInput=0x2d6c, pPaddingInfo=0x0, pbIV=0x39a3f848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x39a3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39a3f848, pbOutput=0x5750000, pcbResult=0x39a3f618) returned 0x0 [0185.108] WriteFile (in: hFile=0x2268, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x39a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x39a3f61c*=0x2d70, lpOverlapped=0x0) returned 1 [0185.108] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39a3f60c | out: lpNewFilePointer=0x0) returned 1 [0185.108] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.108] WriteFile (in: hFile=0x2268, lpBuffer=0x39a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x39a3f83c*, lpNumberOfBytesWritten=0x39a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.108] SetFilePointerEx (in: hFile=0x2268, liDistanceToMove=0x2d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.109] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.109] CloseHandle (hObject=0x2268) returned 1 [0185.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.play")) returned 1 [0185.114] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2940 os_tid = 0x2c30 [0185.119] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.119] ReadFile (in: hFile=0x2270, lpBuffer=0x39b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x39b7fb34*, lpNumberOfBytesRead=0x39b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.121] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.121] ReadFile (in: hFile=0x2270, lpBuffer=0x39b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x39b7fb34*, lpNumberOfBytesRead=0x39b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.121] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.124] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.125] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x39b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0185.125] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x39b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x39b7f828, pbKeyObject=0x0) returned 0x0 [0185.125] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39b7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39b7f500) returned 0x0 [0185.125] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.125] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39b7f500) returned 0x0 [0185.131] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.135] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.135] WriteFile (in: hFile=0x2270, lpBuffer=0x39b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39b7f830, lpOverlapped=0x0 | out: lpBuffer=0x39b7fb34*, lpNumberOfBytesWritten=0x39b7f830*=0x428, lpOverlapped=0x0) returned 1 [0185.136] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.136] ReadFile (in: hFile=0x2270, lpBuffer=0x5850000, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x39b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x39b7f61c*=0x1f50, lpOverlapped=0x0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xffffe0b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.137] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5850000, cbInput=0x1f50, pPaddingInfo=0x0, pbIV=0x39b7f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x39b7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39b7f848, pbOutput=0x5850000, pcbResult=0x39b7f618) returned 0x0 [0185.137] WriteFile (in: hFile=0x2270, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x39b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x39b7f61c*=0x1f60, lpOverlapped=0x0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39b7f60c | out: lpNewFilePointer=0x0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.137] WriteFile (in: hFile=0x2270, lpBuffer=0x39b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x39b7f83c*, lpNumberOfBytesWritten=0x39b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x1f60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.137] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.137] CloseHandle (hObject=0x2270) returned 1 [0185.138] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.play")) returned 1 [0185.143] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2941 os_tid = 0x2c34 [0185.149] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.149] ReadFile (in: hFile=0x2278, lpBuffer=0x39cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x39cbfb34*, lpNumberOfBytesRead=0x39cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.151] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.151] ReadFile (in: hFile=0x2278, lpBuffer=0x39cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x39cbfb34*, lpNumberOfBytesRead=0x39cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.151] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.155] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x39cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0185.155] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x39cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x39cbf828, pbKeyObject=0x0) returned 0x0 [0185.155] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39cbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39cbf500) returned 0x0 [0185.155] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.155] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39cbf500) returned 0x0 [0185.161] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.165] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.165] WriteFile (in: hFile=0x2278, lpBuffer=0x39cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39cbf830, lpOverlapped=0x0 | out: lpBuffer=0x39cbfb34*, lpNumberOfBytesWritten=0x39cbf830*=0x428, lpOverlapped=0x0) returned 1 [0185.165] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.166] ReadFile (in: hFile=0x2278, lpBuffer=0x5950000, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x39cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x39cbf61c*=0x81ce, lpOverlapped=0x0) returned 1 [0185.167] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0xffff7e32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.167] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5950000, cbInput=0x81ce, pPaddingInfo=0x0, pbIV=0x39cbf848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x39cbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39cbf848, pbOutput=0x5950000, pcbResult=0x39cbf618) returned 0x0 [0185.167] WriteFile (in: hFile=0x2278, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x39cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x39cbf61c*=0x81d0, lpOverlapped=0x0) returned 1 [0185.167] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39cbf60c | out: lpNewFilePointer=0x0) returned 1 [0185.167] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.167] WriteFile (in: hFile=0x2278, lpBuffer=0x39cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x39cbf83c*, lpNumberOfBytesWritten=0x39cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.167] SetFilePointerEx (in: hFile=0x2278, liDistanceToMove=0x81d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.168] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.168] CloseHandle (hObject=0x2278) returned 1 [0185.168] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.171] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.play")) returned 1 [0185.173] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2942 os_tid = 0x2c38 [0185.177] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.177] ReadFile (in: hFile=0x2280, lpBuffer=0x39dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39dff85c, lpOverlapped=0x0 | out: lpBuffer=0x39dffb34*, lpNumberOfBytesRead=0x39dff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.179] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.179] ReadFile (in: hFile=0x2280, lpBuffer=0x39dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39dff85c, lpOverlapped=0x0 | out: lpBuffer=0x39dffb34*, lpNumberOfBytesRead=0x39dff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.180] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.183] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x39dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0185.183] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x39dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x39dff828, pbKeyObject=0x0) returned 0x0 [0185.183] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39dff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39dff500) returned 0x0 [0185.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.183] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39dff500) returned 0x0 [0185.189] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.192] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.192] WriteFile (in: hFile=0x2280, lpBuffer=0x39dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39dff830, lpOverlapped=0x0 | out: lpBuffer=0x39dffb34*, lpNumberOfBytesWritten=0x39dff830*=0x428, lpOverlapped=0x0) returned 1 [0185.192] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.192] ReadFile (in: hFile=0x2280, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x39dff61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x39dff61c*=0x244a, lpOverlapped=0x0) returned 1 [0185.194] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xffffdbb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.194] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5a50000, cbInput=0x244a, pPaddingInfo=0x0, pbIV=0x39dff848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x39dff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39dff848, pbOutput=0x5a50000, pcbResult=0x39dff618) returned 0x0 [0185.194] WriteFile (in: hFile=0x2280, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x39dff61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x39dff61c*=0x2450, lpOverlapped=0x0) returned 1 [0185.194] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39dff60c | out: lpNewFilePointer=0x0) returned 1 [0185.194] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.194] WriteFile (in: hFile=0x2280, lpBuffer=0x39dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39dff61c, lpOverlapped=0x0 | out: lpBuffer=0x39dff83c*, lpNumberOfBytesWritten=0x39dff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.194] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x2450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.194] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.194] CloseHandle (hObject=0x2280) returned 1 [0185.195] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.play")) returned 1 [0185.199] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2943 os_tid = 0x2c3c [0185.205] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.205] ReadFile (in: hFile=0x2288, lpBuffer=0x39f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x39f3fb34*, lpNumberOfBytesRead=0x39f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.206] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.206] ReadFile (in: hFile=0x2288, lpBuffer=0x39f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x39f3fb34*, lpNumberOfBytesRead=0x39f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.207] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.209] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.210] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x39f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0185.210] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x39f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x39f3f828, pbKeyObject=0x0) returned 0x0 [0185.210] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39f3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39f3f500) returned 0x0 [0185.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.210] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39f3f500) returned 0x0 [0185.213] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.216] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.216] WriteFile (in: hFile=0x2288, lpBuffer=0x39f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39f3f830, lpOverlapped=0x0 | out: lpBuffer=0x39f3fb34*, lpNumberOfBytesWritten=0x39f3f830*=0x428, lpOverlapped=0x0) returned 1 [0185.216] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.216] ReadFile (in: hFile=0x2288, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x39f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x39f3f61c*=0x45a2, lpOverlapped=0x0) returned 1 [0185.217] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0xffffba5e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.217] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5b50000, cbInput=0x45a2, pPaddingInfo=0x0, pbIV=0x39f3f848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x39f3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39f3f848, pbOutput=0x5b50000, pcbResult=0x39f3f618) returned 0x0 [0185.217] WriteFile (in: hFile=0x2288, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x39f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x39f3f61c*=0x45b0, lpOverlapped=0x0) returned 1 [0185.217] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39f3f60c | out: lpNewFilePointer=0x0) returned 1 [0185.217] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.217] WriteFile (in: hFile=0x2288, lpBuffer=0x39f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x39f3f83c*, lpNumberOfBytesWritten=0x39f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.218] SetFilePointerEx (in: hFile=0x2288, liDistanceToMove=0x45b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.218] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.218] CloseHandle (hObject=0x2288) returned 1 [0185.218] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.play")) returned 1 [0185.233] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2944 os_tid = 0x2c40 [0185.237] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.237] ReadFile (in: hFile=0x2078, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.239] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.239] ReadFile (in: hFile=0x2078, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.239] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.242] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.242] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x1484f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0185.242] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x1484f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x1484f828, pbKeyObject=0x0) returned 0x0 [0185.242] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1484f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1484f500) returned 0x0 [0185.242] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.243] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1484f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1484f500) returned 0x0 [0185.246] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.249] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.249] WriteFile (in: hFile=0x2078, lpBuffer=0x1484fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1484f830, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesWritten=0x1484f830*=0x428, lpOverlapped=0x0) returned 1 [0185.250] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.250] ReadFile (in: hFile=0x2078, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x1484f61c*=0x15f2, lpOverlapped=0x0) returned 1 [0185.250] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xffffea0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.250] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5c50000, cbInput=0x15f2, pPaddingInfo=0x0, pbIV=0x1484f848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x1484f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1484f848, pbOutput=0x5c50000, pcbResult=0x1484f618) returned 0x0 [0185.250] WriteFile (in: hFile=0x2078, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x1484f61c*=0x1600, lpOverlapped=0x0) returned 1 [0185.250] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1484f60c | out: lpNewFilePointer=0x0) returned 1 [0185.250] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.250] WriteFile (in: hFile=0x2078, lpBuffer=0x1484f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x1484f83c*, lpNumberOfBytesWritten=0x1484f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.250] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x1600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.250] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.250] CloseHandle (hObject=0x2078) returned 1 [0185.250] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.play")) returned 1 [0185.254] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2945 os_tid = 0x2c44 [0185.258] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.258] ReadFile (in: hFile=0x2294, lpBuffer=0x3a07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a07f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a07fb34*, lpNumberOfBytesRead=0x3a07f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.259] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.259] ReadFile (in: hFile=0x2294, lpBuffer=0x3a07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a07f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a07fb34*, lpNumberOfBytesRead=0x3a07f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.260] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.262] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.262] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x3a07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0185.262] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x3a07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x3a07f828, pbKeyObject=0x0) returned 0x0 [0185.262] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a07f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a07f500) returned 0x0 [0185.262] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.262] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a07f500) returned 0x0 [0185.266] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.269] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.269] WriteFile (in: hFile=0x2294, lpBuffer=0x3a07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a07f830, lpOverlapped=0x0 | out: lpBuffer=0x3a07fb34*, lpNumberOfBytesWritten=0x3a07f830*=0x428, lpOverlapped=0x0) returned 1 [0185.269] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.269] ReadFile (in: hFile=0x2294, lpBuffer=0x2850000, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x3a07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x3a07f61c*=0xa783, lpOverlapped=0x0) returned 1 [0185.270] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0xffff587d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.270] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2850000, cbInput=0xa783, pPaddingInfo=0x0, pbIV=0x3a07f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x3a07f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a07f848, pbOutput=0x2850000, pcbResult=0x3a07f618) returned 0x0 [0185.270] WriteFile (in: hFile=0x2294, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x3a07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x3a07f61c*=0xa790, lpOverlapped=0x0) returned 1 [0185.270] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a07f60c | out: lpNewFilePointer=0x0) returned 1 [0185.270] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.270] WriteFile (in: hFile=0x2294, lpBuffer=0x3a07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a07f83c*, lpNumberOfBytesWritten=0x3a07f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.271] SetFilePointerEx (in: hFile=0x2294, liDistanceToMove=0xa790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.271] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.271] CloseHandle (hObject=0x2294) returned 1 [0185.271] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.play")) returned 1 [0185.274] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2946 os_tid = 0x2c48 [0185.278] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.278] ReadFile (in: hFile=0x229c, lpBuffer=0x3a1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3a1bfb34*, lpNumberOfBytesRead=0x3a1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.280] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.280] ReadFile (in: hFile=0x229c, lpBuffer=0x3a1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3a1bfb34*, lpNumberOfBytesRead=0x3a1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.280] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.283] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.283] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x3a1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0185.283] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x3a1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x3a1bf828, pbKeyObject=0x0) returned 0x0 [0185.283] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a1bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a1bf500) returned 0x0 [0185.283] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.283] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a1bf500) returned 0x0 [0185.286] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.289] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.289] WriteFile (in: hFile=0x229c, lpBuffer=0x3a1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a1bf830, lpOverlapped=0x0 | out: lpBuffer=0x3a1bfb34*, lpNumberOfBytesWritten=0x3a1bf830*=0x428, lpOverlapped=0x0) returned 1 [0185.289] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.289] ReadFile (in: hFile=0x229c, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x3a1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x3a1bf61c*=0x5474, lpOverlapped=0x0) returned 1 [0185.290] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xffffab8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.290] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5d50000, cbInput=0x5474, pPaddingInfo=0x0, pbIV=0x3a1bf848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x3a1bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a1bf848, pbOutput=0x5d50000, pcbResult=0x3a1bf618) returned 0x0 [0185.290] WriteFile (in: hFile=0x229c, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x3a1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x3a1bf61c*=0x5480, lpOverlapped=0x0) returned 1 [0185.290] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1bf60c | out: lpNewFilePointer=0x0) returned 1 [0185.290] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.290] WriteFile (in: hFile=0x229c, lpBuffer=0x3a1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a1bf83c*, lpNumberOfBytesWritten=0x3a1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.290] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x5480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.291] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.291] CloseHandle (hObject=0x229c) returned 1 [0185.291] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.play")) returned 1 [0185.294] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2947 os_tid = 0x2c4c [0185.299] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.299] ReadFile (in: hFile=0x22a4, lpBuffer=0x3a2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3a2ffb34*, lpNumberOfBytesRead=0x3a2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.300] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.300] ReadFile (in: hFile=0x22a4, lpBuffer=0x3a2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3a2ffb34*, lpNumberOfBytesRead=0x3a2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.301] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.303] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.303] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x3a2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0185.303] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x3a2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x3a2ff828, pbKeyObject=0x0) returned 0x0 [0185.303] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a2ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a2ff500) returned 0x0 [0185.303] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.304] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a2ff500) returned 0x0 [0185.307] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.309] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.309] WriteFile (in: hFile=0x22a4, lpBuffer=0x3a2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a2ff830, lpOverlapped=0x0 | out: lpBuffer=0x3a2ffb34*, lpNumberOfBytesWritten=0x3a2ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.310] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.310] ReadFile (in: hFile=0x22a4, lpBuffer=0x5e50000, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x3a2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x3a2ff61c*=0xa488, lpOverlapped=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0xffff5b78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.311] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5e50000, cbInput=0xa488, pPaddingInfo=0x0, pbIV=0x3a2ff848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x3a2ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a2ff848, pbOutput=0x5e50000, pcbResult=0x3a2ff618) returned 0x0 [0185.311] WriteFile (in: hFile=0x22a4, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x3a2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x3a2ff61c*=0xa490, lpOverlapped=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.311] WriteFile (in: hFile=0x22a4, lpBuffer=0x3a2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a2ff83c*, lpNumberOfBytesWritten=0x3a2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x22a4, liDistanceToMove=0xa490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.311] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.312] CloseHandle (hObject=0x22a4) returned 1 [0185.312] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.play")) returned 1 [0185.315] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2948 os_tid = 0x2c50 [0185.319] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.319] ReadFile (in: hFile=0x22ac, lpBuffer=0x3a43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a43f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a43fb34*, lpNumberOfBytesRead=0x3a43f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.321] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.321] ReadFile (in: hFile=0x22ac, lpBuffer=0x3a43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a43f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a43fb34*, lpNumberOfBytesRead=0x3a43f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.321] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.323] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.323] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x3a43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0185.323] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x3a43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x3a43f828, pbKeyObject=0x0) returned 0x0 [0185.323] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a43f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a43f500) returned 0x0 [0185.323] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.323] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a43f500) returned 0x0 [0185.327] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.329] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.329] WriteFile (in: hFile=0x22ac, lpBuffer=0x3a43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a43f830, lpOverlapped=0x0 | out: lpBuffer=0x3a43fb34*, lpNumberOfBytesWritten=0x3a43f830*=0x428, lpOverlapped=0x0) returned 1 [0185.330] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.330] ReadFile (in: hFile=0x22ac, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x3a43f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x3a43f61c*=0x60dc, lpOverlapped=0x0) returned 1 [0185.331] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xffff9f24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.331] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5f50000, cbInput=0x60dc, pPaddingInfo=0x0, pbIV=0x3a43f848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x3a43f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a43f848, pbOutput=0x5f50000, pcbResult=0x3a43f618) returned 0x0 [0185.331] WriteFile (in: hFile=0x22ac, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x3a43f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x3a43f61c*=0x60e0, lpOverlapped=0x0) returned 1 [0185.331] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a43f60c | out: lpNewFilePointer=0x0) returned 1 [0185.331] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.331] WriteFile (in: hFile=0x22ac, lpBuffer=0x3a43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a43f83c*, lpNumberOfBytesWritten=0x3a43f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.331] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x60e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.331] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.331] CloseHandle (hObject=0x22ac) returned 1 [0185.331] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.play")) returned 1 [0185.335] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2949 os_tid = 0x2c54 [0185.338] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.338] ReadFile (in: hFile=0x22b4, lpBuffer=0x3a57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a57f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a57fb34*, lpNumberOfBytesRead=0x3a57f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.340] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.340] ReadFile (in: hFile=0x22b4, lpBuffer=0x3a57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a57f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a57fb34*, lpNumberOfBytesRead=0x3a57f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.340] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.343] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x3a57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0185.343] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x3a57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x3a57f828, pbKeyObject=0x0) returned 0x0 [0185.343] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a57f500) returned 0x0 [0185.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.343] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a57f500) returned 0x0 [0185.346] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.349] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.349] WriteFile (in: hFile=0x22b4, lpBuffer=0x3a57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a57f830, lpOverlapped=0x0 | out: lpBuffer=0x3a57fb34*, lpNumberOfBytesWritten=0x3a57f830*=0x428, lpOverlapped=0x0) returned 1 [0185.349] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.349] ReadFile (in: hFile=0x22b4, lpBuffer=0x6050000, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x3a57f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x3a57f61c*=0x1f46, lpOverlapped=0x0) returned 1 [0185.350] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0xffffe0ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.350] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6050000, cbInput=0x1f46, pPaddingInfo=0x0, pbIV=0x3a57f848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x3a57f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a57f848, pbOutput=0x6050000, pcbResult=0x3a57f618) returned 0x0 [0185.350] WriteFile (in: hFile=0x22b4, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x3a57f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x3a57f61c*=0x1f50, lpOverlapped=0x0) returned 1 [0185.350] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a57f60c | out: lpNewFilePointer=0x0) returned 1 [0185.350] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.350] WriteFile (in: hFile=0x22b4, lpBuffer=0x3a57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a57f83c*, lpNumberOfBytesWritten=0x3a57f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.350] SetFilePointerEx (in: hFile=0x22b4, liDistanceToMove=0x1f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.351] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.351] CloseHandle (hObject=0x22b4) returned 1 [0185.351] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.play")) returned 1 [0185.354] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2950 os_tid = 0x2c58 [0185.358] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.358] ReadFile (in: hFile=0x22bc, lpBuffer=0x3a6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3a6bfb34*, lpNumberOfBytesRead=0x3a6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.359] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.359] ReadFile (in: hFile=0x22bc, lpBuffer=0x3a6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3a6bfb34*, lpNumberOfBytesRead=0x3a6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.360] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.362] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.362] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x3a6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0185.362] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x3a6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x3a6bf828, pbKeyObject=0x0) returned 0x0 [0185.362] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a6bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a6bf500) returned 0x0 [0185.362] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.363] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a6bf500) returned 0x0 [0185.366] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.369] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.369] WriteFile (in: hFile=0x22bc, lpBuffer=0x3a6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a6bf830, lpOverlapped=0x0 | out: lpBuffer=0x3a6bfb34*, lpNumberOfBytesWritten=0x3a6bf830*=0x428, lpOverlapped=0x0) returned 1 [0185.369] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.369] ReadFile (in: hFile=0x22bc, lpBuffer=0x6150000, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x3a6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x3a6bf61c*=0x24e2, lpOverlapped=0x0) returned 1 [0185.370] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0xffffdb1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.370] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6150000, cbInput=0x24e2, pPaddingInfo=0x0, pbIV=0x3a6bf848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x3a6bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a6bf848, pbOutput=0x6150000, pcbResult=0x3a6bf618) returned 0x0 [0185.370] WriteFile (in: hFile=0x22bc, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x3a6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x3a6bf61c*=0x24f0, lpOverlapped=0x0) returned 1 [0185.370] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a6bf60c | out: lpNewFilePointer=0x0) returned 1 [0185.370] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.370] WriteFile (in: hFile=0x22bc, lpBuffer=0x3a6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a6bf83c*, lpNumberOfBytesWritten=0x3a6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.370] SetFilePointerEx (in: hFile=0x22bc, liDistanceToMove=0x24f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.370] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.370] CloseHandle (hObject=0x22bc) returned 1 [0185.370] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.play")) returned 1 [0185.374] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2951 os_tid = 0x2c5c [0185.383] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.384] ReadFile (in: hFile=0x22c4, lpBuffer=0x3a7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3a7ffb34*, lpNumberOfBytesRead=0x3a7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.385] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.386] ReadFile (in: hFile=0x22c4, lpBuffer=0x3a7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3a7ffb34*, lpNumberOfBytesRead=0x3a7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.386] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.389] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.389] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x3a7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0185.389] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x3a7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x3a7ff828, pbKeyObject=0x0) returned 0x0 [0185.389] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a7ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a7ff500) returned 0x0 [0185.390] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.390] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a7ff500) returned 0x0 [0185.395] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.399] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.399] WriteFile (in: hFile=0x22c4, lpBuffer=0x3a7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a7ff830, lpOverlapped=0x0 | out: lpBuffer=0x3a7ffb34*, lpNumberOfBytesWritten=0x3a7ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.399] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.399] ReadFile (in: hFile=0x22c4, lpBuffer=0x6250000, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x3a7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x3a7ff61c*=0x9b3a, lpOverlapped=0x0) returned 1 [0185.401] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xffff64c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.401] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6250000, cbInput=0x9b3a, pPaddingInfo=0x0, pbIV=0x3a7ff848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x3a7ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a7ff848, pbOutput=0x6250000, pcbResult=0x3a7ff618) returned 0x0 [0185.401] WriteFile (in: hFile=0x22c4, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x3a7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x3a7ff61c*=0x9b40, lpOverlapped=0x0) returned 1 [0185.401] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.401] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.402] WriteFile (in: hFile=0x22c4, lpBuffer=0x3a7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a7ff83c*, lpNumberOfBytesWritten=0x3a7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.402] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0x9b40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.402] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.402] CloseHandle (hObject=0x22c4) returned 1 [0185.402] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.play")) returned 1 [0185.407] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2952 os_tid = 0x2c60 [0185.410] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.411] ReadFile (in: hFile=0x22cc, lpBuffer=0x3a93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a93f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a93fb34*, lpNumberOfBytesRead=0x3a93f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.412] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.412] ReadFile (in: hFile=0x22cc, lpBuffer=0x3a93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a93f85c, lpOverlapped=0x0 | out: lpBuffer=0x3a93fb34*, lpNumberOfBytesRead=0x3a93f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.413] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.415] BCryptSetProperty (in: hObject=0x732d30, pszProperty="ChainingMode", pbInput=0x3a93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732d30) returned 0x0 [0185.415] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732d30, phKey=0x3a93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732d30, phKey=0x3a93f828, pbKeyObject=0x0) returned 0x0 [0185.415] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a93f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a93f500) returned 0x0 [0185.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.415] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a93f500) returned 0x0 [0185.419] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.422] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.422] WriteFile (in: hFile=0x22cc, lpBuffer=0x3a93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a93f830, lpOverlapped=0x0 | out: lpBuffer=0x3a93fb34*, lpNumberOfBytesWritten=0x3a93f830*=0x428, lpOverlapped=0x0) returned 1 [0185.422] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.422] ReadFile (in: hFile=0x22cc, lpBuffer=0x6350000, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x3a93f61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x3a93f61c*=0x1484, lpOverlapped=0x0) returned 1 [0185.422] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0xffffeb7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.422] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6350000, cbInput=0x1484, pPaddingInfo=0x0, pbIV=0x3a93f848, cbIV=0x10, pbOutput=0x6350000, cbOutput=0x100000, pcbResult=0x3a93f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a93f848, pbOutput=0x6350000, pcbResult=0x3a93f618) returned 0x0 [0185.422] WriteFile (in: hFile=0x22cc, lpBuffer=0x6350000*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x3a93f61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesWritten=0x3a93f61c*=0x1490, lpOverlapped=0x0) returned 1 [0185.423] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a93f60c | out: lpNewFilePointer=0x0) returned 1 [0185.423] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.423] WriteFile (in: hFile=0x22cc, lpBuffer=0x3a93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a93f83c*, lpNumberOfBytesWritten=0x3a93f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.423] SetFilePointerEx (in: hFile=0x22cc, liDistanceToMove=0x1490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.423] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.423] CloseHandle (hObject=0x22cc) returned 1 [0185.423] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.play")) returned 1 [0185.427] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2953 os_tid = 0x2c64 [0185.431] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.431] ReadFile (in: hFile=0x22d4, lpBuffer=0x3aa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3aa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3aa7fb34*, lpNumberOfBytesRead=0x3aa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.432] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.432] ReadFile (in: hFile=0x22d4, lpBuffer=0x3aa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3aa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3aa7fb34*, lpNumberOfBytesRead=0x3aa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.432] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.435] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.435] BCryptSetProperty (in: hObject=0x731d60, pszProperty="ChainingMode", pbInput=0x3aa7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731d60) returned 0x0 [0185.435] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731d60, phKey=0x3aa7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731d60, phKey=0x3aa7f828, pbKeyObject=0x0) returned 0x0 [0185.435] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3aa7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3aa7f500) returned 0x0 [0185.435] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.435] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3aa7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3aa7f500) returned 0x0 [0185.439] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.442] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.442] WriteFile (in: hFile=0x22d4, lpBuffer=0x3aa7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3aa7f830, lpOverlapped=0x0 | out: lpBuffer=0x3aa7fb34*, lpNumberOfBytesWritten=0x3aa7f830*=0x428, lpOverlapped=0x0) returned 1 [0185.442] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.442] ReadFile (in: hFile=0x22d4, lpBuffer=0x6450000, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x3aa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesRead=0x3aa7f61c*=0xd9a, lpOverlapped=0x0) returned 1 [0185.442] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffff266, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.442] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6450000, cbInput=0xd9a, pPaddingInfo=0x0, pbIV=0x3aa7f848, cbIV=0x10, pbOutput=0x6450000, cbOutput=0x100000, pcbResult=0x3aa7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3aa7f848, pbOutput=0x6450000, pcbResult=0x3aa7f618) returned 0x0 [0185.442] WriteFile (in: hFile=0x22d4, lpBuffer=0x6450000*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x3aa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesWritten=0x3aa7f61c*=0xda0, lpOverlapped=0x0) returned 1 [0185.443] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3aa7f60c | out: lpNewFilePointer=0x0) returned 1 [0185.443] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.443] WriteFile (in: hFile=0x22d4, lpBuffer=0x3aa7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3aa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3aa7f83c*, lpNumberOfBytesWritten=0x3aa7f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.443] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xda0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.443] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.443] CloseHandle (hObject=0x22d4) returned 1 [0185.443] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.445] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.play")) returned 1 [0185.447] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2954 os_tid = 0x2c68 [0185.451] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.451] ReadFile (in: hFile=0x22dc, lpBuffer=0x3abbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3abbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3abbfb34*, lpNumberOfBytesRead=0x3abbf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.452] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.452] ReadFile (in: hFile=0x22dc, lpBuffer=0x3abbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3abbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3abbfb34*, lpNumberOfBytesRead=0x3abbf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.452] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.455] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.455] BCryptSetProperty (in: hObject=0x7329c0, pszProperty="ChainingMode", pbInput=0x3abbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7329c0) returned 0x0 [0185.455] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7329c0, phKey=0x3abbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7329c0, phKey=0x3abbf828, pbKeyObject=0x0) returned 0x0 [0185.455] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3abbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3abbf500) returned 0x0 [0185.455] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.455] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3abbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3abbf500) returned 0x0 [0185.458] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.461] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.461] WriteFile (in: hFile=0x22dc, lpBuffer=0x3abbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3abbf830, lpOverlapped=0x0 | out: lpBuffer=0x3abbfb34*, lpNumberOfBytesWritten=0x3abbf830*=0x428, lpOverlapped=0x0) returned 1 [0185.461] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.461] ReadFile (in: hFile=0x22dc, lpBuffer=0x6550000, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x3abbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesRead=0x3abbf61c*=0x1ca8, lpOverlapped=0x0) returned 1 [0185.462] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0xffffe358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.462] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6550000, cbInput=0x1ca8, pPaddingInfo=0x0, pbIV=0x3abbf848, cbIV=0x10, pbOutput=0x6550000, cbOutput=0x100000, pcbResult=0x3abbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3abbf848, pbOutput=0x6550000, pcbResult=0x3abbf618) returned 0x0 [0185.462] WriteFile (in: hFile=0x22dc, lpBuffer=0x6550000*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x3abbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesWritten=0x3abbf61c*=0x1cb0, lpOverlapped=0x0) returned 1 [0185.462] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3abbf60c | out: lpNewFilePointer=0x0) returned 1 [0185.462] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.462] WriteFile (in: hFile=0x22dc, lpBuffer=0x3abbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3abbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3abbf83c*, lpNumberOfBytesWritten=0x3abbf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.462] SetFilePointerEx (in: hFile=0x22dc, liDistanceToMove=0x1cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.462] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.462] CloseHandle (hObject=0x22dc) returned 1 [0185.463] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.play")) returned 1 [0185.466] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2955 os_tid = 0x2c6c [0185.470] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.470] ReadFile (in: hFile=0x22e4, lpBuffer=0x3acffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3acff85c, lpOverlapped=0x0 | out: lpBuffer=0x3acffb34*, lpNumberOfBytesRead=0x3acff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.471] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.471] ReadFile (in: hFile=0x22e4, lpBuffer=0x3acffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3acff85c, lpOverlapped=0x0 | out: lpBuffer=0x3acffb34*, lpNumberOfBytesRead=0x3acff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.471] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.473] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.474] BCryptSetProperty (in: hObject=0x732020, pszProperty="ChainingMode", pbInput=0x3acff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732020) returned 0x0 [0185.474] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732020, phKey=0x3acff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732020, phKey=0x3acff828, pbKeyObject=0x0) returned 0x0 [0185.474] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3acff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3acff500) returned 0x0 [0185.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.474] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3acff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3acff500) returned 0x0 [0185.477] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.480] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.480] WriteFile (in: hFile=0x22e4, lpBuffer=0x3acffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3acff830, lpOverlapped=0x0 | out: lpBuffer=0x3acffb34*, lpNumberOfBytesWritten=0x3acff830*=0x428, lpOverlapped=0x0) returned 1 [0185.480] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.480] ReadFile (in: hFile=0x22e4, lpBuffer=0x6650000, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x3acff61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesRead=0x3acff61c*=0x8ad6, lpOverlapped=0x0) returned 1 [0185.515] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0xffff752a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.515] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6650000, cbInput=0x8ad6, pPaddingInfo=0x0, pbIV=0x3acff848, cbIV=0x10, pbOutput=0x6650000, cbOutput=0x100000, pcbResult=0x3acff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3acff848, pbOutput=0x6650000, pcbResult=0x3acff618) returned 0x0 [0185.515] WriteFile (in: hFile=0x22e4, lpBuffer=0x6650000*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x3acff61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesWritten=0x3acff61c*=0x8ae0, lpOverlapped=0x0) returned 1 [0185.516] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3acff60c | out: lpNewFilePointer=0x0) returned 1 [0185.516] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.516] WriteFile (in: hFile=0x22e4, lpBuffer=0x3acff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3acff61c, lpOverlapped=0x0 | out: lpBuffer=0x3acff83c*, lpNumberOfBytesWritten=0x3acff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.516] SetFilePointerEx (in: hFile=0x22e4, liDistanceToMove=0x8ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.516] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.516] CloseHandle (hObject=0x22e4) returned 1 [0185.516] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.play")) returned 1 [0185.520] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2956 os_tid = 0x2c70 [0185.481] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.481] ReadFile (in: hFile=0x22ec, lpBuffer=0x3ae3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ae3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ae3fb34*, lpNumberOfBytesRead=0x3ae3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.482] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.482] ReadFile (in: hFile=0x22ec, lpBuffer=0x3ae3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ae3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ae3fb34*, lpNumberOfBytesRead=0x3ae3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.485] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.485] BCryptSetProperty (in: hObject=0x732a70, pszProperty="ChainingMode", pbInput=0x3ae3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732a70) returned 0x0 [0185.485] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732a70, phKey=0x3ae3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732a70, phKey=0x3ae3f828, pbKeyObject=0x0) returned 0x0 [0185.485] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ae3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ae3f500) returned 0x0 [0185.485] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.485] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ae3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ae3f500) returned 0x0 [0185.488] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.491] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.491] WriteFile (in: hFile=0x22ec, lpBuffer=0x3ae3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ae3f830, lpOverlapped=0x0 | out: lpBuffer=0x3ae3fb34*, lpNumberOfBytesWritten=0x3ae3f830*=0x428, lpOverlapped=0x0) returned 1 [0185.491] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.491] ReadFile (in: hFile=0x22ec, lpBuffer=0x6750000, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x3ae3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesRead=0x3ae3f61c*=0xe2e9, lpOverlapped=0x0) returned 1 [0185.492] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xffff1d17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.492] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x6750000, cbInput=0xe2e9, pPaddingInfo=0x0, pbIV=0x3ae3f848, cbIV=0x10, pbOutput=0x6750000, cbOutput=0x100000, pcbResult=0x3ae3f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x3ae3f848, pbOutput=0x6750000, pcbResult=0x3ae3f618) returned 0x0 [0185.492] WriteFile (in: hFile=0x22ec, lpBuffer=0x6750000*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x3ae3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesWritten=0x3ae3f61c*=0xe2f0, lpOverlapped=0x0) returned 1 [0185.493] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ae3f60c | out: lpNewFilePointer=0x0) returned 1 [0185.493] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.493] WriteFile (in: hFile=0x22ec, lpBuffer=0x3ae3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ae3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ae3f83c*, lpNumberOfBytesWritten=0x3ae3f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.493] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xe2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.493] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0185.493] CloseHandle (hObject=0x22ec) returned 1 [0185.493] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.495] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.play")) returned 1 [0185.497] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2957 os_tid = 0x2c74 [0185.501] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.502] ReadFile (in: hFile=0x22f4, lpBuffer=0x3af7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3af7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3af7fb34*, lpNumberOfBytesRead=0x3af7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.503] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.503] ReadFile (in: hFile=0x22f4, lpBuffer=0x3af7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3af7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3af7fb34*, lpNumberOfBytesRead=0x3af7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.504] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.506] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.507] BCryptSetProperty (in: hObject=0x732bd0, pszProperty="ChainingMode", pbInput=0x3af7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732bd0) returned 0x0 [0185.507] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732bd0, phKey=0x3af7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732bd0, phKey=0x3af7f828, pbKeyObject=0x0) returned 0x0 [0185.507] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3af7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3af7f500) returned 0x0 [0185.507] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.507] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3af7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3af7f500) returned 0x0 [0185.510] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.514] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.514] WriteFile (in: hFile=0x22f4, lpBuffer=0x3af7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3af7f830, lpOverlapped=0x0 | out: lpBuffer=0x3af7fb34*, lpNumberOfBytesWritten=0x3af7f830*=0x428, lpOverlapped=0x0) returned 1 [0185.514] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.514] ReadFile (in: hFile=0x22f4, lpBuffer=0x6850000, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x3af7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesRead=0x3af7f61c*=0x65a6, lpOverlapped=0x0) returned 1 [0185.524] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xffff9a5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.524] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x6850000, cbInput=0x65a6, pPaddingInfo=0x0, pbIV=0x3af7f848, cbIV=0x10, pbOutput=0x6850000, cbOutput=0x100000, pcbResult=0x3af7f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x3af7f848, pbOutput=0x6850000, pcbResult=0x3af7f618) returned 0x0 [0185.524] WriteFile (in: hFile=0x22f4, lpBuffer=0x6850000*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x3af7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesWritten=0x3af7f61c*=0x65b0, lpOverlapped=0x0) returned 1 [0185.524] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3af7f60c | out: lpNewFilePointer=0x0) returned 1 [0185.524] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.524] WriteFile (in: hFile=0x22f4, lpBuffer=0x3af7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3af7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3af7f83c*, lpNumberOfBytesWritten=0x3af7f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.524] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x65b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.524] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0185.524] CloseHandle (hObject=0x22f4) returned 1 [0185.525] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.play")) returned 1 [0185.528] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2958 os_tid = 0x2c78 [0185.532] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.532] ReadFile (in: hFile=0x2068, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.534] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.534] ReadFile (in: hFile=0x2068, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.534] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.536] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.536] BCryptSetProperty (in: hObject=0x733200, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733200) returned 0x0 [0185.536] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733200, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733200, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0185.536] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0185.537] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.537] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0185.540] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.543] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.543] WriteFile (in: hFile=0x2068, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.543] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.543] ReadFile (in: hFile=0x2068, lpBuffer=0x6950000, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesRead=0x219ff61c*=0x918c, lpOverlapped=0x0) returned 1 [0185.544] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xffff6e74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.544] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6950000, cbInput=0x918c, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x6950000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x219ff848, pbOutput=0x6950000, pcbResult=0x219ff618) returned 0x0 [0185.544] WriteFile (in: hFile=0x2068, lpBuffer=0x6950000*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesWritten=0x219ff61c*=0x9190, lpOverlapped=0x0) returned 1 [0185.544] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.544] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.544] WriteFile (in: hFile=0x2068, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.544] SetFilePointerEx (in: hFile=0x2068, liDistanceToMove=0x9190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.544] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.545] CloseHandle (hObject=0x2068) returned 1 [0185.545] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.play")) returned 1 [0185.548] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2959 os_tid = 0x2c7c [0185.552] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.552] ReadFile (in: hFile=0x2300, lpBuffer=0x3b0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3b0bfb34*, lpNumberOfBytesRead=0x3b0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.553] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.554] ReadFile (in: hFile=0x2300, lpBuffer=0x3b0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3b0bfb34*, lpNumberOfBytesRead=0x3b0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.556] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.556] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x3b0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0185.556] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x3b0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x3b0bf828, pbKeyObject=0x0) returned 0x0 [0185.556] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b0bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b0bf500) returned 0x0 [0185.556] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.556] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b0bf500) returned 0x0 [0185.559] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.563] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.563] WriteFile (in: hFile=0x2300, lpBuffer=0x3b0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b0bf830, lpOverlapped=0x0 | out: lpBuffer=0x3b0bfb34*, lpNumberOfBytesWritten=0x3b0bf830*=0x428, lpOverlapped=0x0) returned 1 [0185.563] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.563] ReadFile (in: hFile=0x2300, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x3b0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x3b0bf61c*=0x1daa, lpOverlapped=0x0) returned 1 [0185.564] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xffffe256, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.564] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2950000, cbInput=0x1daa, pPaddingInfo=0x0, pbIV=0x3b0bf848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x3b0bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b0bf848, pbOutput=0x2950000, pcbResult=0x3b0bf618) returned 0x0 [0185.564] WriteFile (in: hFile=0x2300, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x3b0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x3b0bf61c*=0x1db0, lpOverlapped=0x0) returned 1 [0185.564] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b0bf60c | out: lpNewFilePointer=0x0) returned 1 [0185.564] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.564] WriteFile (in: hFile=0x2300, lpBuffer=0x3b0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b0bf83c*, lpNumberOfBytesWritten=0x3b0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.564] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0x1db0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.564] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.564] CloseHandle (hObject=0x2300) returned 1 [0185.564] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.play")) returned 1 [0185.568] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2960 os_tid = 0x2c80 [0185.572] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.572] ReadFile (in: hFile=0x2308, lpBuffer=0x3b1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3b1ffb34*, lpNumberOfBytesRead=0x3b1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.581] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.581] ReadFile (in: hFile=0x2308, lpBuffer=0x3b1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3b1ffb34*, lpNumberOfBytesRead=0x3b1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.581] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.584] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.584] BCryptSetProperty (in: hObject=0x731cb0, pszProperty="ChainingMode", pbInput=0x3b1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731cb0) returned 0x0 [0185.584] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731cb0, phKey=0x3b1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731cb0, phKey=0x3b1ff828, pbKeyObject=0x0) returned 0x0 [0185.584] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b1ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b1ff500) returned 0x0 [0185.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.585] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b1ff500) returned 0x0 [0185.588] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.591] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.591] WriteFile (in: hFile=0x2308, lpBuffer=0x3b1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b1ff830, lpOverlapped=0x0 | out: lpBuffer=0x3b1ffb34*, lpNumberOfBytesWritten=0x3b1ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.592] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.592] ReadFile (in: hFile=0x2308, lpBuffer=0x6a50000, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x3b1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesRead=0x3b1ff61c*=0x1066, lpOverlapped=0x0) returned 1 [0185.592] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0xffffef9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.592] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6a50000, cbInput=0x1066, pPaddingInfo=0x0, pbIV=0x3b1ff848, cbIV=0x10, pbOutput=0x6a50000, cbOutput=0x100000, pcbResult=0x3b1ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b1ff848, pbOutput=0x6a50000, pcbResult=0x3b1ff618) returned 0x0 [0185.592] WriteFile (in: hFile=0x2308, lpBuffer=0x6a50000*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x3b1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesWritten=0x3b1ff61c*=0x1070, lpOverlapped=0x0) returned 1 [0185.592] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b1ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.592] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.592] WriteFile (in: hFile=0x2308, lpBuffer=0x3b1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b1ff83c*, lpNumberOfBytesWritten=0x3b1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.592] SetFilePointerEx (in: hFile=0x2308, liDistanceToMove=0x1070, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.593] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.593] CloseHandle (hObject=0x2308) returned 1 [0185.593] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.play")) returned 1 [0185.597] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2961 os_tid = 0x2c84 [0185.602] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.602] ReadFile (in: hFile=0x2310, lpBuffer=0x3b33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b33f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b33fb34*, lpNumberOfBytesRead=0x3b33f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.603] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.603] ReadFile (in: hFile=0x2310, lpBuffer=0x3b33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b33f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b33fb34*, lpNumberOfBytesRead=0x3b33f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.603] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.606] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.606] BCryptSetProperty (in: hObject=0x732230, pszProperty="ChainingMode", pbInput=0x3b33f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732230) returned 0x0 [0185.606] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732230, phKey=0x3b33f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732230, phKey=0x3b33f828, pbKeyObject=0x0) returned 0x0 [0185.606] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b33f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b33f500) returned 0x0 [0185.606] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.606] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b33f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b33f500) returned 0x0 [0185.610] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.613] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.613] WriteFile (in: hFile=0x2310, lpBuffer=0x3b33fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b33f830, lpOverlapped=0x0 | out: lpBuffer=0x3b33fb34*, lpNumberOfBytesWritten=0x3b33f830*=0x428, lpOverlapped=0x0) returned 1 [0185.613] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.614] ReadFile (in: hFile=0x2310, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x3b33f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x3b33f61c*=0x332a, lpOverlapped=0x0) returned 1 [0185.614] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xffffccd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.614] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6b50000, cbInput=0x332a, pPaddingInfo=0x0, pbIV=0x3b33f848, cbIV=0x10, pbOutput=0x6b50000, cbOutput=0x100000, pcbResult=0x3b33f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b33f848, pbOutput=0x6b50000, pcbResult=0x3b33f618) returned 0x0 [0185.614] WriteFile (in: hFile=0x2310, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x3b33f61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x3b33f61c*=0x3330, lpOverlapped=0x0) returned 1 [0185.614] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b33f60c | out: lpNewFilePointer=0x0) returned 1 [0185.615] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.615] WriteFile (in: hFile=0x2310, lpBuffer=0x3b33f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b33f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b33f83c*, lpNumberOfBytesWritten=0x3b33f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.615] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x3330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.615] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.615] CloseHandle (hObject=0x2310) returned 1 [0185.615] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.play")) returned 1 [0185.619] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2962 os_tid = 0x2c88 [0185.623] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.623] ReadFile (in: hFile=0x2318, lpBuffer=0x3b47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b47f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b47fb34*, lpNumberOfBytesRead=0x3b47f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.624] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.625] ReadFile (in: hFile=0x2318, lpBuffer=0x3b47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b47f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b47fb34*, lpNumberOfBytesRead=0x3b47f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.625] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.627] BCryptSetProperty (in: hObject=0x732440, pszProperty="ChainingMode", pbInput=0x3b47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732440) returned 0x0 [0185.627] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732440, phKey=0x3b47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732440, phKey=0x3b47f828, pbKeyObject=0x0) returned 0x0 [0185.627] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b47f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b47f500) returned 0x0 [0185.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.627] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b47f500) returned 0x0 [0185.631] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.634] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.634] WriteFile (in: hFile=0x2318, lpBuffer=0x3b47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b47f830, lpOverlapped=0x0 | out: lpBuffer=0x3b47fb34*, lpNumberOfBytesWritten=0x3b47f830*=0x428, lpOverlapped=0x0) returned 1 [0185.634] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.634] ReadFile (in: hFile=0x2318, lpBuffer=0x6c50000, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x3b47f61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesRead=0x3b47f61c*=0x6bc2, lpOverlapped=0x0) returned 1 [0185.635] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0xffff943e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.635] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6c50000, cbInput=0x6bc2, pPaddingInfo=0x0, pbIV=0x3b47f848, cbIV=0x10, pbOutput=0x6c50000, cbOutput=0x100000, pcbResult=0x3b47f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b47f848, pbOutput=0x6c50000, pcbResult=0x3b47f618) returned 0x0 [0185.635] WriteFile (in: hFile=0x2318, lpBuffer=0x6c50000*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x3b47f61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesWritten=0x3b47f61c*=0x6bd0, lpOverlapped=0x0) returned 1 [0185.636] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b47f60c | out: lpNewFilePointer=0x0) returned 1 [0185.636] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.636] WriteFile (in: hFile=0x2318, lpBuffer=0x3b47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b47f83c*, lpNumberOfBytesWritten=0x3b47f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.636] SetFilePointerEx (in: hFile=0x2318, liDistanceToMove=0x6bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.636] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.636] CloseHandle (hObject=0x2318) returned 1 [0185.636] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.play")) returned 1 [0185.640] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2963 os_tid = 0x2c8c [0185.644] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.644] ReadFile (in: hFile=0x2320, lpBuffer=0x3b5bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b5bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bfb34*, lpNumberOfBytesRead=0x3b5bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.646] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.646] ReadFile (in: hFile=0x2320, lpBuffer=0x3b5bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b5bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bfb34*, lpNumberOfBytesRead=0x3b5bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.646] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.648] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.648] BCryptSetProperty (in: hObject=0x7324f0, pszProperty="ChainingMode", pbInput=0x3b5bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7324f0) returned 0x0 [0185.648] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7324f0, phKey=0x3b5bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7324f0, phKey=0x3b5bf828, pbKeyObject=0x0) returned 0x0 [0185.648] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b5bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b5bf500) returned 0x0 [0185.649] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.649] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b5bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b5bf500) returned 0x0 [0185.652] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.655] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.655] WriteFile (in: hFile=0x2320, lpBuffer=0x3b5bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b5bf830, lpOverlapped=0x0 | out: lpBuffer=0x3b5bfb34*, lpNumberOfBytesWritten=0x3b5bf830*=0x428, lpOverlapped=0x0) returned 1 [0185.655] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.656] ReadFile (in: hFile=0x2320, lpBuffer=0x6d50000, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x3b5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesRead=0x3b5bf61c*=0xa086, lpOverlapped=0x0) returned 1 [0185.656] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xffff5f7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.657] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6d50000, cbInput=0xa086, pPaddingInfo=0x0, pbIV=0x3b5bf848, cbIV=0x10, pbOutput=0x6d50000, cbOutput=0x100000, pcbResult=0x3b5bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b5bf848, pbOutput=0x6d50000, pcbResult=0x3b5bf618) returned 0x0 [0185.657] WriteFile (in: hFile=0x2320, lpBuffer=0x6d50000*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x3b5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesWritten=0x3b5bf61c*=0xa090, lpOverlapped=0x0) returned 1 [0185.657] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5bf60c | out: lpNewFilePointer=0x0) returned 1 [0185.657] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.657] WriteFile (in: hFile=0x2320, lpBuffer=0x3b5bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b5bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bf83c*, lpNumberOfBytesWritten=0x3b5bf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.657] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xa090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.657] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.657] CloseHandle (hObject=0x2320) returned 1 [0185.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.play")) returned 1 [0185.661] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2964 os_tid = 0x2c90 [0185.665] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.665] ReadFile (in: hFile=0x2328, lpBuffer=0x3b6ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b6ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3b6ffb34*, lpNumberOfBytesRead=0x3b6ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.667] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.667] ReadFile (in: hFile=0x2328, lpBuffer=0x3b6ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b6ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3b6ffb34*, lpNumberOfBytesRead=0x3b6ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.667] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.670] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.670] BCryptSetProperty (in: hObject=0x7325a0, pszProperty="ChainingMode", pbInput=0x3b6ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7325a0) returned 0x0 [0185.670] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7325a0, phKey=0x3b6ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7325a0, phKey=0x3b6ff828, pbKeyObject=0x0) returned 0x0 [0185.670] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b6ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b6ff500) returned 0x0 [0185.670] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.670] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b6ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b6ff500) returned 0x0 [0185.674] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.677] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.677] WriteFile (in: hFile=0x2328, lpBuffer=0x3b6ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b6ff830, lpOverlapped=0x0 | out: lpBuffer=0x3b6ffb34*, lpNumberOfBytesWritten=0x3b6ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.677] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.677] ReadFile (in: hFile=0x2328, lpBuffer=0x6e50000, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x3b6ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesRead=0x3b6ff61c*=0x380a, lpOverlapped=0x0) returned 1 [0185.678] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0xffffc7f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.678] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6e50000, cbInput=0x380a, pPaddingInfo=0x0, pbIV=0x3b6ff848, cbIV=0x10, pbOutput=0x6e50000, cbOutput=0x100000, pcbResult=0x3b6ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b6ff848, pbOutput=0x6e50000, pcbResult=0x3b6ff618) returned 0x0 [0185.678] WriteFile (in: hFile=0x2328, lpBuffer=0x6e50000*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x3b6ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesWritten=0x3b6ff61c*=0x3810, lpOverlapped=0x0) returned 1 [0185.678] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.678] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.679] WriteFile (in: hFile=0x2328, lpBuffer=0x3b6ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b6ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b6ff83c*, lpNumberOfBytesWritten=0x3b6ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.679] SetFilePointerEx (in: hFile=0x2328, liDistanceToMove=0x3810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.679] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.679] CloseHandle (hObject=0x2328) returned 1 [0185.679] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.play")) returned 1 [0185.683] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2965 os_tid = 0x2c94 [0185.687] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.687] ReadFile (in: hFile=0x2330, lpBuffer=0x3b83fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b83f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b83fb34*, lpNumberOfBytesRead=0x3b83f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.689] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.689] ReadFile (in: hFile=0x2330, lpBuffer=0x3b83fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b83f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b83fb34*, lpNumberOfBytesRead=0x3b83f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.689] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.692] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.692] BCryptSetProperty (in: hObject=0x736300, pszProperty="ChainingMode", pbInput=0x3b83f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736300) returned 0x0 [0185.692] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736300, phKey=0x3b83f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736300, phKey=0x3b83f828, pbKeyObject=0x0) returned 0x0 [0185.692] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b83f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b83f500) returned 0x0 [0185.692] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.692] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b83f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b83f500) returned 0x0 [0185.696] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.699] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.699] WriteFile (in: hFile=0x2330, lpBuffer=0x3b83fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b83f830, lpOverlapped=0x0 | out: lpBuffer=0x3b83fb34*, lpNumberOfBytesWritten=0x3b83f830*=0x428, lpOverlapped=0x0) returned 1 [0185.699] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.699] ReadFile (in: hFile=0x2330, lpBuffer=0x6f50000, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x3b83f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesRead=0x3b83f61c*=0x899c, lpOverlapped=0x0) returned 1 [0185.716] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xffff7664, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.716] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6f50000, cbInput=0x899c, pPaddingInfo=0x0, pbIV=0x3b83f848, cbIV=0x10, pbOutput=0x6f50000, cbOutput=0x100000, pcbResult=0x3b83f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b83f848, pbOutput=0x6f50000, pcbResult=0x3b83f618) returned 0x0 [0185.716] WriteFile (in: hFile=0x2330, lpBuffer=0x6f50000*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x3b83f61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesWritten=0x3b83f61c*=0x89a0, lpOverlapped=0x0) returned 1 [0185.717] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b83f60c | out: lpNewFilePointer=0x0) returned 1 [0185.717] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.717] WriteFile (in: hFile=0x2330, lpBuffer=0x3b83f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b83f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b83f83c*, lpNumberOfBytesWritten=0x3b83f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.717] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x89a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.717] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.717] CloseHandle (hObject=0x2330) returned 1 [0185.717] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.play")) returned 1 [0185.721] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2966 os_tid = 0x2c98 [0185.701] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.701] ReadFile (in: hFile=0x2338, lpBuffer=0x3b97fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b97f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b97fb34*, lpNumberOfBytesRead=0x3b97f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.725] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.725] ReadFile (in: hFile=0x2338, lpBuffer=0x3b97fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3b97f85c, lpOverlapped=0x0 | out: lpBuffer=0x3b97fb34*, lpNumberOfBytesRead=0x3b97f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.725] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.727] BCryptSetProperty (in: hObject=0x736250, pszProperty="ChainingMode", pbInput=0x3b97f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736250) returned 0x0 [0185.727] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736250, phKey=0x3b97f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736250, phKey=0x3b97f828, pbKeyObject=0x0) returned 0x0 [0185.728] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3b97f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3b97f500) returned 0x0 [0185.728] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.728] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3b97f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3b97f500) returned 0x0 [0185.731] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.735] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.735] WriteFile (in: hFile=0x2338, lpBuffer=0x3b97fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3b97f830, lpOverlapped=0x0 | out: lpBuffer=0x3b97fb34*, lpNumberOfBytesWritten=0x3b97f830*=0x428, lpOverlapped=0x0) returned 1 [0185.736] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.736] ReadFile (in: hFile=0x2338, lpBuffer=0x7050000, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x3b97f61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesRead=0x3b97f61c*=0x4de6, lpOverlapped=0x0) returned 1 [0185.744] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0xffffb21a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.745] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7050000, cbInput=0x4de6, pPaddingInfo=0x0, pbIV=0x3b97f848, cbIV=0x10, pbOutput=0x7050000, cbOutput=0x100000, pcbResult=0x3b97f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3b97f848, pbOutput=0x7050000, pcbResult=0x3b97f618) returned 0x0 [0185.745] WriteFile (in: hFile=0x2338, lpBuffer=0x7050000*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x3b97f61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesWritten=0x3b97f61c*=0x4df0, lpOverlapped=0x0) returned 1 [0185.745] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b97f60c | out: lpNewFilePointer=0x0) returned 1 [0185.745] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.745] WriteFile (in: hFile=0x2338, lpBuffer=0x3b97f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b97f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b97f83c*, lpNumberOfBytesWritten=0x3b97f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.745] SetFilePointerEx (in: hFile=0x2338, liDistanceToMove=0x4df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.745] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.745] CloseHandle (hObject=0x2338) returned 1 [0185.745] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.play")) returned 1 [0185.749] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2967 os_tid = 0x2c9c [0185.703] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.703] ReadFile (in: hFile=0x2340, lpBuffer=0x3babfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3babf85c, lpOverlapped=0x0 | out: lpBuffer=0x3babfb34*, lpNumberOfBytesRead=0x3babf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.704] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.704] ReadFile (in: hFile=0x2340, lpBuffer=0x3babfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3babf85c, lpOverlapped=0x0 | out: lpBuffer=0x3babfb34*, lpNumberOfBytesRead=0x3babf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.705] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.707] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.707] BCryptSetProperty (in: hObject=0x7361a0, pszProperty="ChainingMode", pbInput=0x3babf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7361a0) returned 0x0 [0185.708] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7361a0, phKey=0x3babf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7361a0, phKey=0x3babf828, pbKeyObject=0x0) returned 0x0 [0185.708] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3babf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3babf500) returned 0x0 [0185.708] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.708] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3babf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3babf500) returned 0x0 [0185.712] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.715] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.715] WriteFile (in: hFile=0x2340, lpBuffer=0x3babfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3babf830, lpOverlapped=0x0 | out: lpBuffer=0x3babfb34*, lpNumberOfBytesWritten=0x3babf830*=0x428, lpOverlapped=0x0) returned 1 [0185.715] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.715] ReadFile (in: hFile=0x2340, lpBuffer=0x7150000, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x3babf61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesRead=0x3babf61c*=0x26e8, lpOverlapped=0x0) returned 1 [0185.736] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0xffffd918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.736] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x7150000, cbInput=0x26e8, pPaddingInfo=0x0, pbIV=0x3babf848, cbIV=0x10, pbOutput=0x7150000, cbOutput=0x100000, pcbResult=0x3babf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x3babf848, pbOutput=0x7150000, pcbResult=0x3babf618) returned 0x0 [0185.736] WriteFile (in: hFile=0x2340, lpBuffer=0x7150000*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x3babf61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesWritten=0x3babf61c*=0x26f0, lpOverlapped=0x0) returned 1 [0185.736] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3babf60c | out: lpNewFilePointer=0x0) returned 1 [0185.737] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.737] WriteFile (in: hFile=0x2340, lpBuffer=0x3babf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3babf61c, lpOverlapped=0x0 | out: lpBuffer=0x3babf83c*, lpNumberOfBytesWritten=0x3babf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.737] SetFilePointerEx (in: hFile=0x2340, liDistanceToMove=0x26f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.737] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0185.737] CloseHandle (hObject=0x2340) returned 1 [0185.737] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.play")) returned 1 [0185.741] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2968 os_tid = 0x2ca0 [0185.753] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.753] ReadFile (in: hFile=0x2348, lpBuffer=0x3bbffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bbff85c, lpOverlapped=0x0 | out: lpBuffer=0x3bbffb34*, lpNumberOfBytesRead=0x3bbff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.754] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.754] ReadFile (in: hFile=0x2348, lpBuffer=0x3bbffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bbff85c, lpOverlapped=0x0 | out: lpBuffer=0x3bbffb34*, lpNumberOfBytesRead=0x3bbff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.754] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.756] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.757] BCryptSetProperty (in: hObject=0x7363b0, pszProperty="ChainingMode", pbInput=0x3bbff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7363b0) returned 0x0 [0185.757] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7363b0, phKey=0x3bbff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7363b0, phKey=0x3bbff828, pbKeyObject=0x0) returned 0x0 [0185.757] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3bbff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3bbff500) returned 0x0 [0185.757] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.757] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3bbff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3bbff500) returned 0x0 [0185.760] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.763] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.763] WriteFile (in: hFile=0x2348, lpBuffer=0x3bbffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3bbff830, lpOverlapped=0x0 | out: lpBuffer=0x3bbffb34*, lpNumberOfBytesWritten=0x3bbff830*=0x428, lpOverlapped=0x0) returned 1 [0185.763] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.763] ReadFile (in: hFile=0x2348, lpBuffer=0x7250000, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x3bbff61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesRead=0x3bbff61c*=0x312c, lpOverlapped=0x0) returned 1 [0185.764] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0xffffced4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.764] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7250000, cbInput=0x312c, pPaddingInfo=0x0, pbIV=0x3bbff848, cbIV=0x10, pbOutput=0x7250000, cbOutput=0x100000, pcbResult=0x3bbff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3bbff848, pbOutput=0x7250000, pcbResult=0x3bbff618) returned 0x0 [0185.764] WriteFile (in: hFile=0x2348, lpBuffer=0x7250000*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x3bbff61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesWritten=0x3bbff61c*=0x3130, lpOverlapped=0x0) returned 1 [0185.765] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbff60c | out: lpNewFilePointer=0x0) returned 1 [0185.765] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.765] WriteFile (in: hFile=0x2348, lpBuffer=0x3bbff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbff61c, lpOverlapped=0x0 | out: lpBuffer=0x3bbff83c*, lpNumberOfBytesWritten=0x3bbff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.765] SetFilePointerEx (in: hFile=0x2348, liDistanceToMove=0x3130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.765] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.765] CloseHandle (hObject=0x2348) returned 1 [0185.765] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.play")) returned 1 [0185.769] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2969 os_tid = 0x2ca4 [0185.773] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.773] ReadFile (in: hFile=0x2350, lpBuffer=0x3bd3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bd3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3bd3fb34*, lpNumberOfBytesRead=0x3bd3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.774] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.774] ReadFile (in: hFile=0x2350, lpBuffer=0x3bd3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bd3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3bd3fb34*, lpNumberOfBytesRead=0x3bd3f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.775] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.777] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.777] BCryptSetProperty (in: hObject=0x735f90, pszProperty="ChainingMode", pbInput=0x3bd3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735f90) returned 0x0 [0185.777] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735f90, phKey=0x3bd3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735f90, phKey=0x3bd3f828, pbKeyObject=0x0) returned 0x0 [0185.777] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3bd3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3bd3f500) returned 0x0 [0185.777] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.777] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3bd3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3bd3f500) returned 0x0 [0185.781] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.784] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.784] WriteFile (in: hFile=0x2350, lpBuffer=0x3bd3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3bd3f830, lpOverlapped=0x0 | out: lpBuffer=0x3bd3fb34*, lpNumberOfBytesWritten=0x3bd3f830*=0x428, lpOverlapped=0x0) returned 1 [0185.784] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.784] ReadFile (in: hFile=0x2350, lpBuffer=0x7350000, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x3bd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesRead=0x3bd3f61c*=0x975e, lpOverlapped=0x0) returned 1 [0185.785] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0xffff68a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.785] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7350000, cbInput=0x975e, pPaddingInfo=0x0, pbIV=0x3bd3f848, cbIV=0x10, pbOutput=0x7350000, cbOutput=0x100000, pcbResult=0x3bd3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3bd3f848, pbOutput=0x7350000, pcbResult=0x3bd3f618) returned 0x0 [0185.785] WriteFile (in: hFile=0x2350, lpBuffer=0x7350000*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x3bd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesWritten=0x3bd3f61c*=0x9760, lpOverlapped=0x0) returned 1 [0185.786] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bd3f60c | out: lpNewFilePointer=0x0) returned 1 [0185.786] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.786] WriteFile (in: hFile=0x2350, lpBuffer=0x3bd3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bd3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3bd3f83c*, lpNumberOfBytesWritten=0x3bd3f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.786] SetFilePointerEx (in: hFile=0x2350, liDistanceToMove=0x9760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.786] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.786] CloseHandle (hObject=0x2350) returned 1 [0185.786] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.play")) returned 1 [0185.790] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2970 os_tid = 0x2ca8 [0185.794] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.794] ReadFile (in: hFile=0x2358, lpBuffer=0x3be7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3be7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3be7fb34*, lpNumberOfBytesRead=0x3be7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.795] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.795] ReadFile (in: hFile=0x2358, lpBuffer=0x3be7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3be7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3be7fb34*, lpNumberOfBytesRead=0x3be7f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.795] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.798] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.798] BCryptSetProperty (in: hObject=0x735ac0, pszProperty="ChainingMode", pbInput=0x3be7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ac0) returned 0x0 [0185.798] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ac0, phKey=0x3be7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ac0, phKey=0x3be7f828, pbKeyObject=0x0) returned 0x0 [0185.798] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3be7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3be7f500) returned 0x0 [0185.798] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.798] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3be7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3be7f500) returned 0x0 [0185.801] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.804] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.804] WriteFile (in: hFile=0x2358, lpBuffer=0x3be7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3be7f830, lpOverlapped=0x0 | out: lpBuffer=0x3be7fb34*, lpNumberOfBytesWritten=0x3be7f830*=0x428, lpOverlapped=0x0) returned 1 [0185.804] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.805] ReadFile (in: hFile=0x2358, lpBuffer=0x7450000, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x3be7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesRead=0x3be7f61c*=0xcec6, lpOverlapped=0x0) returned 1 [0185.807] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xffff313a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.807] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7450000, cbInput=0xcec6, pPaddingInfo=0x0, pbIV=0x3be7f848, cbIV=0x10, pbOutput=0x7450000, cbOutput=0x100000, pcbResult=0x3be7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3be7f848, pbOutput=0x7450000, pcbResult=0x3be7f618) returned 0x0 [0185.807] WriteFile (in: hFile=0x2358, lpBuffer=0x7450000*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x3be7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesWritten=0x3be7f61c*=0xced0, lpOverlapped=0x0) returned 1 [0185.807] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3be7f60c | out: lpNewFilePointer=0x0) returned 1 [0185.807] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.807] WriteFile (in: hFile=0x2358, lpBuffer=0x3be7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3be7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3be7f83c*, lpNumberOfBytesWritten=0x3be7f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.807] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xced0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.807] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.807] CloseHandle (hObject=0x2358) returned 1 [0185.808] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.play")) returned 1 [0185.812] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2971 os_tid = 0x2cac [0185.816] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.816] ReadFile (in: hFile=0x2360, lpBuffer=0x3bfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesRead=0x3bfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.817] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.817] ReadFile (in: hFile=0x2360, lpBuffer=0x3bfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesRead=0x3bfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.817] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.820] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.820] BCryptSetProperty (in: hObject=0x735d80, pszProperty="ChainingMode", pbInput=0x3bfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735d80) returned 0x0 [0185.820] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735d80, phKey=0x3bfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735d80, phKey=0x3bfbf828, pbKeyObject=0x0) returned 0x0 [0185.820] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3bfbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3bfbf500) returned 0x0 [0185.820] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.820] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3bfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3bfbf500) returned 0x0 [0185.823] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.827] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.827] WriteFile (in: hFile=0x2360, lpBuffer=0x3bfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3bfbf830, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesWritten=0x3bfbf830*=0x428, lpOverlapped=0x0) returned 1 [0185.828] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.828] ReadFile (in: hFile=0x2360, lpBuffer=0x7550000, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesRead=0x3bfbf61c*=0x4b40, lpOverlapped=0x0) returned 1 [0185.829] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0xffffb4c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.830] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7550000, cbInput=0x4b40, pPaddingInfo=0x0, pbIV=0x3bfbf848, cbIV=0x10, pbOutput=0x7550000, cbOutput=0x100000, pcbResult=0x3bfbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3bfbf848, pbOutput=0x7550000, pcbResult=0x3bfbf618) returned 0x0 [0185.830] WriteFile (in: hFile=0x2360, lpBuffer=0x7550000*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesWritten=0x3bfbf61c*=0x4b50, lpOverlapped=0x0) returned 1 [0185.830] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bfbf60c | out: lpNewFilePointer=0x0) returned 1 [0185.830] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.830] WriteFile (in: hFile=0x2360, lpBuffer=0x3bfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbf83c*, lpNumberOfBytesWritten=0x3bfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.831] SetFilePointerEx (in: hFile=0x2360, liDistanceToMove=0x4b50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.831] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.831] CloseHandle (hObject=0x2360) returned 1 [0185.831] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.834] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.play")) returned 1 [0185.835] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2972 os_tid = 0x2cb0 [0185.839] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.839] ReadFile (in: hFile=0x2058, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.841] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.841] ReadFile (in: hFile=0x2058, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.841] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.844] BCryptSetProperty (in: hObject=0x735cd0, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735cd0) returned 0x0 [0185.844] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735cd0, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735cd0, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0185.844] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0185.844] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.845] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0185.848] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.850] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.850] WriteFile (in: hFile=0x2058, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0185.851] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.851] ReadFile (in: hFile=0x2058, lpBuffer=0x7650000, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesRead=0x2d37f61c*=0x80d4, lpOverlapped=0x0) returned 1 [0185.852] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xffff7f2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.852] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7650000, cbInput=0x80d4, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x7650000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d37f848, pbOutput=0x7650000, pcbResult=0x2d37f618) returned 0x0 [0185.852] WriteFile (in: hFile=0x2058, lpBuffer=0x7650000*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesWritten=0x2d37f61c*=0x80e0, lpOverlapped=0x0) returned 1 [0185.852] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0185.852] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.852] WriteFile (in: hFile=0x2058, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.852] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x80e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.852] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.852] CloseHandle (hObject=0x2058) returned 1 [0185.853] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.play")) returned 1 [0185.856] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2973 os_tid = 0x2cb4 [0185.860] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.860] ReadFile (in: hFile=0x236c, lpBuffer=0x3c0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesRead=0x3c0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.862] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.862] ReadFile (in: hFile=0x236c, lpBuffer=0x3c0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesRead=0x3c0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.862] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.864] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.864] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x3c0ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0185.864] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x3c0ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x3c0ff828, pbKeyObject=0x0) returned 0x0 [0185.864] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c0ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c0ff500) returned 0x0 [0185.865] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.865] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c0ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c0ff500) returned 0x0 [0185.868] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.871] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.871] WriteFile (in: hFile=0x236c, lpBuffer=0x3c0ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c0ff830, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesWritten=0x3c0ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.871] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.871] ReadFile (in: hFile=0x236c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x3c0ff61c*=0xcba0, lpOverlapped=0x0) returned 1 [0185.874] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0xffff3460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.874] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2a50000, cbInput=0xcba0, pPaddingInfo=0x0, pbIV=0x3c0ff848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x3c0ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c0ff848, pbOutput=0x2a50000, pcbResult=0x3c0ff618) returned 0x0 [0185.874] WriteFile (in: hFile=0x236c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xcbb0, lpNumberOfBytesWritten=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x3c0ff61c*=0xcbb0, lpOverlapped=0x0) returned 1 [0185.875] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c0ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.875] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.875] WriteFile (in: hFile=0x236c, lpBuffer=0x3c0ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ff83c*, lpNumberOfBytesWritten=0x3c0ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.875] SetFilePointerEx (in: hFile=0x236c, liDistanceToMove=0xcbb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.875] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.875] CloseHandle (hObject=0x236c) returned 1 [0185.875] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.play")) returned 1 [0185.879] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2974 os_tid = 0x2cb8 [0185.872] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.872] ReadFile (in: hFile=0x2374, lpBuffer=0x3c23fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c23f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesRead=0x3c23f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.873] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.873] ReadFile (in: hFile=0x2374, lpBuffer=0x3c23fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c23f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesRead=0x3c23f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.882] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.884] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.884] BCryptSetProperty (in: hObject=0x735b70, pszProperty="ChainingMode", pbInput=0x3c23f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735b70) returned 0x0 [0185.884] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735b70, phKey=0x3c23f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735b70, phKey=0x3c23f828, pbKeyObject=0x0) returned 0x0 [0185.884] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c23f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c23f500) returned 0x0 [0185.885] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.885] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c23f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c23f500) returned 0x0 [0185.888] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.899] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.899] WriteFile (in: hFile=0x2374, lpBuffer=0x3c23fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c23f830, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesWritten=0x3c23f830*=0x428, lpOverlapped=0x0) returned 1 [0185.899] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.899] ReadFile (in: hFile=0x2374, lpBuffer=0x7750000, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x7750000*, lpNumberOfBytesRead=0x3c23f61c*=0x5700, lpOverlapped=0x0) returned 1 [0185.900] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xffffa900, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.900] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7750000, cbInput=0x5700, pPaddingInfo=0x0, pbIV=0x3c23f848, cbIV=0x10, pbOutput=0x7750000, cbOutput=0x100000, pcbResult=0x3c23f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c23f848, pbOutput=0x7750000, pcbResult=0x3c23f618) returned 0x0 [0185.900] WriteFile (in: hFile=0x2374, lpBuffer=0x7750000*, nNumberOfBytesToWrite=0x5710, lpNumberOfBytesWritten=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x7750000*, lpNumberOfBytesWritten=0x3c23f61c*=0x5710, lpOverlapped=0x0) returned 1 [0185.900] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c23f60c | out: lpNewFilePointer=0x0) returned 1 [0185.900] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.900] WriteFile (in: hFile=0x2374, lpBuffer=0x3c23f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c23f83c*, lpNumberOfBytesWritten=0x3c23f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.901] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x5710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.901] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.901] CloseHandle (hObject=0x2374) returned 1 [0185.901] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.play")) returned 1 [0185.905] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2975 os_tid = 0x2cbc [0185.909] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.909] ReadFile (in: hFile=0x237c, lpBuffer=0x3c37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c37f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesRead=0x3c37f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.911] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.911] ReadFile (in: hFile=0x237c, lpBuffer=0x3c37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c37f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesRead=0x3c37f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.911] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.913] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.913] BCryptSetProperty (in: hObject=0x736040, pszProperty="ChainingMode", pbInput=0x3c37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736040) returned 0x0 [0185.913] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736040, phKey=0x3c37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736040, phKey=0x3c37f828, pbKeyObject=0x0) returned 0x0 [0185.913] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c37f500) returned 0x0 [0185.913] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.914] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c37f500) returned 0x0 [0185.917] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.919] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.919] WriteFile (in: hFile=0x237c, lpBuffer=0x3c37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c37f830, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesWritten=0x3c37f830*=0x428, lpOverlapped=0x0) returned 1 [0185.920] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.920] ReadFile (in: hFile=0x237c, lpBuffer=0x7850000, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x7850000*, lpNumberOfBytesRead=0x3c37f61c*=0x60c2, lpOverlapped=0x0) returned 1 [0185.921] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0xffff9f3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.921] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7850000, cbInput=0x60c2, pPaddingInfo=0x0, pbIV=0x3c37f848, cbIV=0x10, pbOutput=0x7850000, cbOutput=0x100000, pcbResult=0x3c37f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c37f848, pbOutput=0x7850000, pcbResult=0x3c37f618) returned 0x0 [0185.921] WriteFile (in: hFile=0x237c, lpBuffer=0x7850000*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x7850000*, lpNumberOfBytesWritten=0x3c37f61c*=0x60d0, lpOverlapped=0x0) returned 1 [0185.921] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c37f60c | out: lpNewFilePointer=0x0) returned 1 [0185.921] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.921] WriteFile (in: hFile=0x237c, lpBuffer=0x3c37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c37f83c*, lpNumberOfBytesWritten=0x3c37f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.921] SetFilePointerEx (in: hFile=0x237c, liDistanceToMove=0x60d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.921] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.921] CloseHandle (hObject=0x237c) returned 1 [0185.922] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.play")) returned 1 [0185.925] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2976 os_tid = 0x2cc0 [0185.929] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.929] ReadFile (in: hFile=0x2384, lpBuffer=0x3c4bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c4bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesRead=0x3c4bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.930] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.930] ReadFile (in: hFile=0x2384, lpBuffer=0x3c4bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c4bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesRead=0x3c4bf85c*=0x428, lpOverlapped=0x0) returned 1 [0185.930] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.932] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.933] BCryptSetProperty (in: hObject=0x735ee0, pszProperty="ChainingMode", pbInput=0x3c4bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ee0) returned 0x0 [0185.933] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ee0, phKey=0x3c4bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ee0, phKey=0x3c4bf828, pbKeyObject=0x0) returned 0x0 [0185.933] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c4bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c4bf500) returned 0x0 [0185.933] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.933] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c4bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c4bf500) returned 0x0 [0185.937] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.939] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.939] WriteFile (in: hFile=0x2384, lpBuffer=0x3c4bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c4bf830, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesWritten=0x3c4bf830*=0x428, lpOverlapped=0x0) returned 1 [0185.939] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.940] ReadFile (in: hFile=0x2384, lpBuffer=0x7950000, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7950000*, lpNumberOfBytesRead=0x3c4bf61c*=0x51be, lpOverlapped=0x0) returned 1 [0185.940] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xffffae42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.940] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7950000, cbInput=0x51be, pPaddingInfo=0x0, pbIV=0x3c4bf848, cbIV=0x10, pbOutput=0x7950000, cbOutput=0x100000, pcbResult=0x3c4bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c4bf848, pbOutput=0x7950000, pcbResult=0x3c4bf618) returned 0x0 [0185.940] WriteFile (in: hFile=0x2384, lpBuffer=0x7950000*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7950000*, lpNumberOfBytesWritten=0x3c4bf61c*=0x51c0, lpOverlapped=0x0) returned 1 [0185.941] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c4bf60c | out: lpNewFilePointer=0x0) returned 1 [0185.941] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.941] WriteFile (in: hFile=0x2384, lpBuffer=0x3c4bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bf83c*, lpNumberOfBytesWritten=0x3c4bf61c*=0x8, lpOverlapped=0x0) returned 1 [0185.941] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x51c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.941] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.941] CloseHandle (hObject=0x2384) returned 1 [0185.941] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.play")) returned 1 [0185.944] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2977 os_tid = 0x2cc4 [0185.948] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.948] ReadFile (in: hFile=0x238c, lpBuffer=0x3c5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesRead=0x3c5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.949] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.949] ReadFile (in: hFile=0x238c, lpBuffer=0x3c5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesRead=0x3c5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0185.949] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.951] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.952] BCryptSetProperty (in: hObject=0x735c20, pszProperty="ChainingMode", pbInput=0x3c5ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735c20) returned 0x0 [0185.952] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735c20, phKey=0x3c5ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735c20, phKey=0x3c5ff828, pbKeyObject=0x0) returned 0x0 [0185.952] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c5ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c5ff500) returned 0x0 [0185.952] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.952] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c5ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c5ff500) returned 0x0 [0185.955] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.958] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.958] WriteFile (in: hFile=0x238c, lpBuffer=0x3c5ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c5ff830, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesWritten=0x3c5ff830*=0x428, lpOverlapped=0x0) returned 1 [0185.958] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.958] ReadFile (in: hFile=0x238c, lpBuffer=0x7a50000, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7a50000*, lpNumberOfBytesRead=0x3c5ff61c*=0x59a0, lpOverlapped=0x0) returned 1 [0185.959] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0xffffa660, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.959] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7a50000, cbInput=0x59a0, pPaddingInfo=0x0, pbIV=0x3c5ff848, cbIV=0x10, pbOutput=0x7a50000, cbOutput=0x100000, pcbResult=0x3c5ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c5ff848, pbOutput=0x7a50000, pcbResult=0x3c5ff618) returned 0x0 [0185.959] WriteFile (in: hFile=0x238c, lpBuffer=0x7a50000*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7a50000*, lpNumberOfBytesWritten=0x3c5ff61c*=0x59b0, lpOverlapped=0x0) returned 1 [0185.959] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5ff60c | out: lpNewFilePointer=0x0) returned 1 [0185.959] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.959] WriteFile (in: hFile=0x238c, lpBuffer=0x3c5ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ff83c*, lpNumberOfBytesWritten=0x3c5ff61c*=0x8, lpOverlapped=0x0) returned 1 [0185.959] SetFilePointerEx (in: hFile=0x238c, liDistanceToMove=0x59b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.959] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.959] CloseHandle (hObject=0x238c) returned 1 [0185.960] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.play")) returned 1 [0185.963] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2978 os_tid = 0x2cc8 [0185.967] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.967] ReadFile (in: hFile=0x2394, lpBuffer=0x3c73fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c73f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c73fb34*, lpNumberOfBytesRead=0x3c73f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.968] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.969] ReadFile (in: hFile=0x2394, lpBuffer=0x3c73fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c73f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c73fb34*, lpNumberOfBytesRead=0x3c73f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.969] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.971] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.971] BCryptSetProperty (in: hObject=0x735e30, pszProperty="ChainingMode", pbInput=0x3c73f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735e30) returned 0x0 [0185.971] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735e30, phKey=0x3c73f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735e30, phKey=0x3c73f828, pbKeyObject=0x0) returned 0x0 [0185.971] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c73f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c73f500) returned 0x0 [0185.971] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.971] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c73f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c73f500) returned 0x0 [0185.974] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.977] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.977] WriteFile (in: hFile=0x2394, lpBuffer=0x3c73fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c73f830, lpOverlapped=0x0 | out: lpBuffer=0x3c73fb34*, lpNumberOfBytesWritten=0x3c73f830*=0x428, lpOverlapped=0x0) returned 1 [0185.977] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.977] ReadFile (in: hFile=0x2394, lpBuffer=0x7b50000, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x3c73f61c, lpOverlapped=0x0 | out: lpBuffer=0x7b50000*, lpNumberOfBytesRead=0x3c73f61c*=0x1334, lpOverlapped=0x0) returned 1 [0185.977] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xffffeccc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.977] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7b50000, cbInput=0x1334, pPaddingInfo=0x0, pbIV=0x3c73f848, cbIV=0x10, pbOutput=0x7b50000, cbOutput=0x100000, pcbResult=0x3c73f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c73f848, pbOutput=0x7b50000, pcbResult=0x3c73f618) returned 0x0 [0185.978] WriteFile (in: hFile=0x2394, lpBuffer=0x7b50000*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x3c73f61c, lpOverlapped=0x0 | out: lpBuffer=0x7b50000*, lpNumberOfBytesWritten=0x3c73f61c*=0x1340, lpOverlapped=0x0) returned 1 [0185.978] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c73f60c | out: lpNewFilePointer=0x0) returned 1 [0185.978] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.978] WriteFile (in: hFile=0x2394, lpBuffer=0x3c73f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c73f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c73f83c*, lpNumberOfBytesWritten=0x3c73f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.978] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0x1340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.978] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.978] CloseHandle (hObject=0x2394) returned 1 [0185.978] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.980] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.play")) returned 1 [0185.981] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2979 os_tid = 0x2ccc [0185.985] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.985] ReadFile (in: hFile=0x239c, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.987] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.987] ReadFile (in: hFile=0x239c, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0185.987] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0185.989] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0185.989] BCryptSetProperty (in: hObject=0x7360f0, pszProperty="ChainingMode", pbInput=0x3c87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7360f0) returned 0x0 [0185.989] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7360f0, phKey=0x3c87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7360f0, phKey=0x3c87f828, pbKeyObject=0x0) returned 0x0 [0185.989] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c87f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0185.989] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0185.990] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0185.993] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.995] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.995] WriteFile (in: hFile=0x239c, lpBuffer=0x3c87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c87f830, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesWritten=0x3c87f830*=0x428, lpOverlapped=0x0) returned 1 [0185.995] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.995] ReadFile (in: hFile=0x239c, lpBuffer=0x7c50000, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x3c87f61c*=0x1d3c, lpOverlapped=0x0) returned 1 [0185.996] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0xffffe2c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.996] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7c50000, cbInput=0x1d3c, pPaddingInfo=0x0, pbIV=0x3c87f848, cbIV=0x10, pbOutput=0x7c50000, cbOutput=0x100000, pcbResult=0x3c87f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c87f848, pbOutput=0x7c50000, pcbResult=0x3c87f618) returned 0x0 [0185.996] WriteFile (in: hFile=0x239c, lpBuffer=0x7c50000*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesWritten=0x3c87f61c*=0x1d40, lpOverlapped=0x0) returned 1 [0185.996] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c87f60c | out: lpNewFilePointer=0x0) returned 1 [0185.996] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.996] WriteFile (in: hFile=0x239c, lpBuffer=0x3c87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c87f83c*, lpNumberOfBytesWritten=0x3c87f61c*=0x8, lpOverlapped=0x0) returned 1 [0185.997] SetFilePointerEx (in: hFile=0x239c, liDistanceToMove=0x1d40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.997] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0185.997] CloseHandle (hObject=0x239c) returned 1 [0185.997] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0185.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.play")) returned 1 [0186.000] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2980 os_tid = 0x2cd0 [0186.004] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.004] ReadFile (in: hFile=0x23a4, lpBuffer=0x3c9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c9bfb34*, lpNumberOfBytesRead=0x3c9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.006] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.006] ReadFile (in: hFile=0x23a4, lpBuffer=0x3c9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c9bfb34*, lpNumberOfBytesRead=0x3c9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.006] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.008] BCryptSetProperty (in: hObject=0x734af0, pszProperty="ChainingMode", pbInput=0x3c9bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734af0) returned 0x0 [0186.008] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734af0, phKey=0x3c9bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734af0, phKey=0x3c9bf828, pbKeyObject=0x0) returned 0x0 [0186.008] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c9bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c9bf500) returned 0x0 [0186.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.008] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c9bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c9bf500) returned 0x0 [0186.011] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.014] WriteFile (in: hFile=0x23a4, lpBuffer=0x3c9bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c9bf830, lpOverlapped=0x0 | out: lpBuffer=0x3c9bfb34*, lpNumberOfBytesWritten=0x3c9bf830*=0x428, lpOverlapped=0x0) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.014] ReadFile (in: hFile=0x23a4, lpBuffer=0x7d50000, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x3c9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7d50000*, lpNumberOfBytesRead=0x3c9bf61c*=0x13b8, lpOverlapped=0x0) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xffffec48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.014] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7d50000, cbInput=0x13b8, pPaddingInfo=0x0, pbIV=0x3c9bf848, cbIV=0x10, pbOutput=0x7d50000, cbOutput=0x100000, pcbResult=0x3c9bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3c9bf848, pbOutput=0x7d50000, pcbResult=0x3c9bf618) returned 0x0 [0186.014] WriteFile (in: hFile=0x23a4, lpBuffer=0x7d50000*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x3c9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x7d50000*, lpNumberOfBytesWritten=0x3c9bf61c*=0x13c0, lpOverlapped=0x0) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c9bf60c | out: lpNewFilePointer=0x0) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.015] WriteFile (in: hFile=0x23a4, lpBuffer=0x3c9bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c9bf83c*, lpNumberOfBytesWritten=0x3c9bf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.015] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x13c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.015] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.015] CloseHandle (hObject=0x23a4) returned 1 [0186.015] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.play")) returned 1 [0186.018] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2981 os_tid = 0x2cd4 [0186.022] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.022] ReadFile (in: hFile=0x23ac, lpBuffer=0x3caffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3caff85c, lpOverlapped=0x0 | out: lpBuffer=0x3caffb34*, lpNumberOfBytesRead=0x3caff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.023] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.024] ReadFile (in: hFile=0x23ac, lpBuffer=0x3caffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3caff85c, lpOverlapped=0x0 | out: lpBuffer=0x3caffb34*, lpNumberOfBytesRead=0x3caff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.024] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.026] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.026] BCryptSetProperty (in: hObject=0x7358b0, pszProperty="ChainingMode", pbInput=0x3caff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7358b0) returned 0x0 [0186.026] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7358b0, phKey=0x3caff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7358b0, phKey=0x3caff828, pbKeyObject=0x0) returned 0x0 [0186.026] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3caff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3caff500) returned 0x0 [0186.026] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.026] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3caff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3caff500) returned 0x0 [0186.029] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.032] WriteFile (in: hFile=0x23ac, lpBuffer=0x3caffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3caff830, lpOverlapped=0x0 | out: lpBuffer=0x3caffb34*, lpNumberOfBytesWritten=0x3caff830*=0x428, lpOverlapped=0x0) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.032] ReadFile (in: hFile=0x23ac, lpBuffer=0x7e50000, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x3caff61c, lpOverlapped=0x0 | out: lpBuffer=0x7e50000*, lpNumberOfBytesRead=0x3caff61c*=0x1284, lpOverlapped=0x0) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0xffffed7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.032] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7e50000, cbInput=0x1284, pPaddingInfo=0x0, pbIV=0x3caff848, cbIV=0x10, pbOutput=0x7e50000, cbOutput=0x100000, pcbResult=0x3caff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3caff848, pbOutput=0x7e50000, pcbResult=0x3caff618) returned 0x0 [0186.032] WriteFile (in: hFile=0x23ac, lpBuffer=0x7e50000*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x3caff61c, lpOverlapped=0x0 | out: lpBuffer=0x7e50000*, lpNumberOfBytesWritten=0x3caff61c*=0x1290, lpOverlapped=0x0) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caff60c | out: lpNewFilePointer=0x0) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.033] WriteFile (in: hFile=0x23ac, lpBuffer=0x3caff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3caff61c, lpOverlapped=0x0 | out: lpBuffer=0x3caff83c*, lpNumberOfBytesWritten=0x3caff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.033] SetFilePointerEx (in: hFile=0x23ac, liDistanceToMove=0x1290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.033] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.033] CloseHandle (hObject=0x23ac) returned 1 [0186.033] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.play")) returned 1 [0186.039] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2982 os_tid = 0x2cd8 [0186.042] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.043] ReadFile (in: hFile=0x23b4, lpBuffer=0x3cc3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cc3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cc3fb34*, lpNumberOfBytesRead=0x3cc3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.044] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.044] ReadFile (in: hFile=0x23b4, lpBuffer=0x3cc3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cc3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cc3fb34*, lpNumberOfBytesRead=0x3cc3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.045] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.049] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.049] BCryptSetProperty (in: hObject=0x7346d0, pszProperty="ChainingMode", pbInput=0x3cc3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7346d0) returned 0x0 [0186.049] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7346d0, phKey=0x3cc3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7346d0, phKey=0x3cc3f828, pbKeyObject=0x0) returned 0x0 [0186.049] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cc3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cc3f500) returned 0x0 [0186.049] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.049] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cc3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cc3f500) returned 0x0 [0186.053] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.055] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.055] WriteFile (in: hFile=0x23b4, lpBuffer=0x3cc3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cc3f830, lpOverlapped=0x0 | out: lpBuffer=0x3cc3fb34*, lpNumberOfBytesWritten=0x3cc3f830*=0x428, lpOverlapped=0x0) returned 1 [0186.056] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.056] ReadFile (in: hFile=0x23b4, lpBuffer=0x7f50000, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x3cc3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7f50000*, lpNumberOfBytesRead=0x3cc3f61c*=0x16fc, lpOverlapped=0x0) returned 1 [0186.056] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xffffe904, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.056] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x7f50000, cbInput=0x16fc, pPaddingInfo=0x0, pbIV=0x3cc3f848, cbIV=0x10, pbOutput=0x7f50000, cbOutput=0x100000, pcbResult=0x3cc3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3cc3f848, pbOutput=0x7f50000, pcbResult=0x3cc3f618) returned 0x0 [0186.056] WriteFile (in: hFile=0x23b4, lpBuffer=0x7f50000*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x3cc3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7f50000*, lpNumberOfBytesWritten=0x3cc3f61c*=0x1700, lpOverlapped=0x0) returned 1 [0186.056] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cc3f60c | out: lpNewFilePointer=0x0) returned 1 [0186.056] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.056] WriteFile (in: hFile=0x23b4, lpBuffer=0x3cc3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cc3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3cc3f83c*, lpNumberOfBytesWritten=0x3cc3f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.056] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x1700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.056] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.056] CloseHandle (hObject=0x23b4) returned 1 [0186.056] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.play")) returned 1 [0186.060] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2983 os_tid = 0x2cdc [0186.064] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.064] ReadFile (in: hFile=0x23bc, lpBuffer=0x3cd7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cd7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cd7fb34*, lpNumberOfBytesRead=0x3cd7f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.065] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.065] ReadFile (in: hFile=0x23bc, lpBuffer=0x3cd7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cd7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cd7fb34*, lpNumberOfBytesRead=0x3cd7f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.065] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.067] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.067] BCryptSetProperty (in: hObject=0x7344c0, pszProperty="ChainingMode", pbInput=0x3cd7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7344c0) returned 0x0 [0186.068] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7344c0, phKey=0x3cd7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7344c0, phKey=0x3cd7f828, pbKeyObject=0x0) returned 0x0 [0186.068] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cd7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cd7f500) returned 0x0 [0186.068] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.068] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cd7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cd7f500) returned 0x0 [0186.071] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.073] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.073] WriteFile (in: hFile=0x23bc, lpBuffer=0x3cd7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cd7f830, lpOverlapped=0x0 | out: lpBuffer=0x3cd7fb34*, lpNumberOfBytesWritten=0x3cd7f830*=0x428, lpOverlapped=0x0) returned 1 [0186.074] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.074] ReadFile (in: hFile=0x23bc, lpBuffer=0x8050000, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x3cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8050000*, lpNumberOfBytesRead=0x3cd7f61c*=0x1294, lpOverlapped=0x0) returned 1 [0186.074] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0xffffed6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.074] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8050000, cbInput=0x1294, pPaddingInfo=0x0, pbIV=0x3cd7f848, cbIV=0x10, pbOutput=0x8050000, cbOutput=0x100000, pcbResult=0x3cd7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3cd7f848, pbOutput=0x8050000, pcbResult=0x3cd7f618) returned 0x0 [0186.074] WriteFile (in: hFile=0x23bc, lpBuffer=0x8050000*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x3cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8050000*, lpNumberOfBytesWritten=0x3cd7f61c*=0x12a0, lpOverlapped=0x0) returned 1 [0186.074] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cd7f60c | out: lpNewFilePointer=0x0) returned 1 [0186.074] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.074] WriteFile (in: hFile=0x23bc, lpBuffer=0x3cd7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3cd7f83c*, lpNumberOfBytesWritten=0x3cd7f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.074] SetFilePointerEx (in: hFile=0x23bc, liDistanceToMove=0x12a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.074] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.074] CloseHandle (hObject=0x23bc) returned 1 [0186.074] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.play")) returned 1 [0186.078] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2984 os_tid = 0x2ce0 [0186.081] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.081] ReadFile (in: hFile=0x23c4, lpBuffer=0x3cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x3cebfb34*, lpNumberOfBytesRead=0x3cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.083] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.083] ReadFile (in: hFile=0x23c4, lpBuffer=0x3cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x3cebfb34*, lpNumberOfBytesRead=0x3cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.085] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.085] BCryptSetProperty (in: hObject=0x735800, pszProperty="ChainingMode", pbInput=0x3cebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735800) returned 0x0 [0186.085] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735800, phKey=0x3cebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735800, phKey=0x3cebf828, pbKeyObject=0x0) returned 0x0 [0186.085] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cebf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cebf500) returned 0x0 [0186.086] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.086] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cebf500) returned 0x0 [0186.089] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.091] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.091] WriteFile (in: hFile=0x23c4, lpBuffer=0x3cebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cebf830, lpOverlapped=0x0 | out: lpBuffer=0x3cebfb34*, lpNumberOfBytesWritten=0x3cebf830*=0x428, lpOverlapped=0x0) returned 1 [0186.092] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.092] ReadFile (in: hFile=0x23c4, lpBuffer=0x8150000, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x3cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x8150000*, lpNumberOfBytesRead=0x3cebf61c*=0x1464, lpOverlapped=0x0) returned 1 [0186.092] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xffffeb9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.092] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8150000, cbInput=0x1464, pPaddingInfo=0x0, pbIV=0x3cebf848, cbIV=0x10, pbOutput=0x8150000, cbOutput=0x100000, pcbResult=0x3cebf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3cebf848, pbOutput=0x8150000, pcbResult=0x3cebf618) returned 0x0 [0186.092] WriteFile (in: hFile=0x23c4, lpBuffer=0x8150000*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x3cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x8150000*, lpNumberOfBytesWritten=0x3cebf61c*=0x1470, lpOverlapped=0x0) returned 1 [0186.092] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cebf60c | out: lpNewFilePointer=0x0) returned 1 [0186.092] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.092] WriteFile (in: hFile=0x23c4, lpBuffer=0x3cebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3cebf83c*, lpNumberOfBytesWritten=0x3cebf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.092] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x1470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.092] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.093] CloseHandle (hObject=0x23c4) returned 1 [0186.093] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.play")) returned 1 [0186.096] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2985 os_tid = 0x2ce4 [0186.100] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.100] ReadFile (in: hFile=0x23cc, lpBuffer=0x3cfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cfff85c, lpOverlapped=0x0 | out: lpBuffer=0x3cfffb34*, lpNumberOfBytesRead=0x3cfff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.101] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.101] ReadFile (in: hFile=0x23cc, lpBuffer=0x3cfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cfff85c, lpOverlapped=0x0 | out: lpBuffer=0x3cfffb34*, lpNumberOfBytesRead=0x3cfff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.101] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.103] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.104] BCryptSetProperty (in: hObject=0x7356a0, pszProperty="ChainingMode", pbInput=0x3cfff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7356a0) returned 0x0 [0186.104] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7356a0, phKey=0x3cfff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7356a0, phKey=0x3cfff828, pbKeyObject=0x0) returned 0x0 [0186.104] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cfff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cfff500) returned 0x0 [0186.104] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.104] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cfff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cfff500) returned 0x0 [0186.107] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.110] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.110] WriteFile (in: hFile=0x23cc, lpBuffer=0x3cfffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cfff830, lpOverlapped=0x0 | out: lpBuffer=0x3cfffb34*, lpNumberOfBytesWritten=0x3cfff830*=0x428, lpOverlapped=0x0) returned 1 [0186.110] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.110] ReadFile (in: hFile=0x23cc, lpBuffer=0x8250000, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x3cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x8250000*, lpNumberOfBytesRead=0x3cfff61c*=0x8424, lpOverlapped=0x0) returned 1 [0186.111] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0xffff7bdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.111] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8250000, cbInput=0x8424, pPaddingInfo=0x0, pbIV=0x3cfff848, cbIV=0x10, pbOutput=0x8250000, cbOutput=0x100000, pcbResult=0x3cfff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3cfff848, pbOutput=0x8250000, pcbResult=0x3cfff618) returned 0x0 [0186.111] WriteFile (in: hFile=0x23cc, lpBuffer=0x8250000*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x3cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x8250000*, lpNumberOfBytesWritten=0x3cfff61c*=0x8430, lpOverlapped=0x0) returned 1 [0186.111] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cfff60c | out: lpNewFilePointer=0x0) returned 1 [0186.111] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.111] WriteFile (in: hFile=0x23cc, lpBuffer=0x3cfff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x3cfff83c*, lpNumberOfBytesWritten=0x3cfff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.111] SetFilePointerEx (in: hFile=0x23cc, liDistanceToMove=0x8430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.112] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.112] CloseHandle (hObject=0x23cc) returned 1 [0186.112] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.play")) returned 1 [0186.115] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2986 os_tid = 0x2ce8 [0186.118] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.118] ReadFile (in: hFile=0x2048, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.121] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.121] ReadFile (in: hFile=0x2048, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.121] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.123] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.123] BCryptSetProperty (in: hObject=0x735540, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735540) returned 0x0 [0186.123] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735540, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735540, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0186.123] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0186.123] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.123] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0186.127] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.129] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.129] WriteFile (in: hFile=0x2048, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0186.130] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.130] ReadFile (in: hFile=0x2048, lpBuffer=0x8350000, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x8350000*, lpNumberOfBytesRead=0x2d47f61c*=0x1314, lpOverlapped=0x0) returned 1 [0186.130] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xffffecec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.130] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8350000, cbInput=0x1314, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x8350000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d47f848, pbOutput=0x8350000, pcbResult=0x2d47f618) returned 0x0 [0186.130] WriteFile (in: hFile=0x2048, lpBuffer=0x8350000*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x8350000*, lpNumberOfBytesWritten=0x2d47f61c*=0x1320, lpOverlapped=0x0) returned 1 [0186.130] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0186.130] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.130] WriteFile (in: hFile=0x2048, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.130] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x1320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.130] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.130] CloseHandle (hObject=0x2048) returned 1 [0186.130] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.play")) returned 1 [0186.134] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2987 os_tid = 0x2cec [0186.137] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.137] ReadFile (in: hFile=0x23d8, lpBuffer=0x3d13fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d13f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d13fb34*, lpNumberOfBytesRead=0x3d13f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.139] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.139] ReadFile (in: hFile=0x23d8, lpBuffer=0x3d13fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d13f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d13fb34*, lpNumberOfBytesRead=0x3d13f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.140] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.141] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.142] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x3d13f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0186.142] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x3d13f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x3d13f828, pbKeyObject=0x0) returned 0x0 [0186.142] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d13f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d13f500) returned 0x0 [0186.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.142] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d13f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d13f500) returned 0x0 [0186.145] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.148] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.148] WriteFile (in: hFile=0x23d8, lpBuffer=0x3d13fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d13f830, lpOverlapped=0x0 | out: lpBuffer=0x3d13fb34*, lpNumberOfBytesWritten=0x3d13f830*=0x428, lpOverlapped=0x0) returned 1 [0186.148] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.148] ReadFile (in: hFile=0x23d8, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x3d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x3d13f61c*=0x1418, lpOverlapped=0x0) returned 1 [0186.148] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0xffffebe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.148] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2b50000, cbInput=0x1418, pPaddingInfo=0x0, pbIV=0x3d13f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x3d13f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d13f848, pbOutput=0x2b50000, pcbResult=0x3d13f618) returned 0x0 [0186.149] WriteFile (in: hFile=0x23d8, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x3d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x3d13f61c*=0x1420, lpOverlapped=0x0) returned 1 [0186.149] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d13f60c | out: lpNewFilePointer=0x0) returned 1 [0186.149] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.149] WriteFile (in: hFile=0x23d8, lpBuffer=0x3d13f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d13f83c*, lpNumberOfBytesWritten=0x3d13f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.149] SetFilePointerEx (in: hFile=0x23d8, liDistanceToMove=0x1420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.149] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.149] CloseHandle (hObject=0x23d8) returned 1 [0186.149] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.play")) returned 1 [0186.153] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2988 os_tid = 0x2cf0 [0186.156] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.156] ReadFile (in: hFile=0x23e0, lpBuffer=0x3d27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d27f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d27fb34*, lpNumberOfBytesRead=0x3d27f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.158] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.158] ReadFile (in: hFile=0x23e0, lpBuffer=0x3d27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d27f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d27fb34*, lpNumberOfBytesRead=0x3d27f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.158] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.160] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.160] BCryptSetProperty (in: hObject=0x734ba0, pszProperty="ChainingMode", pbInput=0x3d27f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734ba0) returned 0x0 [0186.160] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734ba0, phKey=0x3d27f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734ba0, phKey=0x3d27f828, pbKeyObject=0x0) returned 0x0 [0186.160] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d27f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d27f500) returned 0x0 [0186.160] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.160] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d27f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d27f500) returned 0x0 [0186.163] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.166] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.166] WriteFile (in: hFile=0x23e0, lpBuffer=0x3d27fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d27f830, lpOverlapped=0x0 | out: lpBuffer=0x3d27fb34*, lpNumberOfBytesWritten=0x3d27f830*=0x428, lpOverlapped=0x0) returned 1 [0186.166] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.166] ReadFile (in: hFile=0x23e0, lpBuffer=0x8450000, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x3d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x8450000*, lpNumberOfBytesRead=0x3d27f61c*=0x1998, lpOverlapped=0x0) returned 1 [0186.167] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xffffe668, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.167] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8450000, cbInput=0x1998, pPaddingInfo=0x0, pbIV=0x3d27f848, cbIV=0x10, pbOutput=0x8450000, cbOutput=0x100000, pcbResult=0x3d27f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d27f848, pbOutput=0x8450000, pcbResult=0x3d27f618) returned 0x0 [0186.167] WriteFile (in: hFile=0x23e0, lpBuffer=0x8450000*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x3d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x8450000*, lpNumberOfBytesWritten=0x3d27f61c*=0x19a0, lpOverlapped=0x0) returned 1 [0186.167] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d27f60c | out: lpNewFilePointer=0x0) returned 1 [0186.167] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.167] WriteFile (in: hFile=0x23e0, lpBuffer=0x3d27f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d27f83c*, lpNumberOfBytesWritten=0x3d27f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.167] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x19a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.167] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.167] CloseHandle (hObject=0x23e0) returned 1 [0186.167] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.play")) returned 1 [0186.171] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2989 os_tid = 0x2cf4 [0186.175] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.175] ReadFile (in: hFile=0x23e8, lpBuffer=0x3d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d3bfb34*, lpNumberOfBytesRead=0x3d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.176] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.176] ReadFile (in: hFile=0x23e8, lpBuffer=0x3d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d3bfb34*, lpNumberOfBytesRead=0x3d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.176] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.178] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.179] BCryptSetProperty (in: hObject=0x735a10, pszProperty="ChainingMode", pbInput=0x3d3bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735a10) returned 0x0 [0186.179] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735a10, phKey=0x3d3bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735a10, phKey=0x3d3bf828, pbKeyObject=0x0) returned 0x0 [0186.179] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d3bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d3bf500) returned 0x0 [0186.179] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.179] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d3bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d3bf500) returned 0x0 [0186.183] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.186] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.186] WriteFile (in: hFile=0x23e8, lpBuffer=0x3d3bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d3bf830, lpOverlapped=0x0 | out: lpBuffer=0x3d3bfb34*, lpNumberOfBytesWritten=0x3d3bf830*=0x428, lpOverlapped=0x0) returned 1 [0186.186] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.186] ReadFile (in: hFile=0x23e8, lpBuffer=0x8550000, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x3d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8550000*, lpNumberOfBytesRead=0x3d3bf61c*=0x1c40, lpOverlapped=0x0) returned 1 [0186.187] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0xffffe3c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.187] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8550000, cbInput=0x1c40, pPaddingInfo=0x0, pbIV=0x3d3bf848, cbIV=0x10, pbOutput=0x8550000, cbOutput=0x100000, pcbResult=0x3d3bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d3bf848, pbOutput=0x8550000, pcbResult=0x3d3bf618) returned 0x0 [0186.187] WriteFile (in: hFile=0x23e8, lpBuffer=0x8550000*, nNumberOfBytesToWrite=0x1c50, lpNumberOfBytesWritten=0x3d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8550000*, lpNumberOfBytesWritten=0x3d3bf61c*=0x1c50, lpOverlapped=0x0) returned 1 [0186.187] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3bf60c | out: lpNewFilePointer=0x0) returned 1 [0186.187] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.187] WriteFile (in: hFile=0x23e8, lpBuffer=0x3d3bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d3bf83c*, lpNumberOfBytesWritten=0x3d3bf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.187] SetFilePointerEx (in: hFile=0x23e8, liDistanceToMove=0x1c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.187] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.187] CloseHandle (hObject=0x23e8) returned 1 [0186.188] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.play")) returned 1 [0186.191] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2990 os_tid = 0x2cf8 [0186.194] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.195] ReadFile (in: hFile=0x23f0, lpBuffer=0x3d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d4ffb34*, lpNumberOfBytesRead=0x3d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.196] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.196] ReadFile (in: hFile=0x23f0, lpBuffer=0x3d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d4ffb34*, lpNumberOfBytesRead=0x3d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.196] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.198] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.198] BCryptSetProperty (in: hObject=0x735960, pszProperty="ChainingMode", pbInput=0x3d4ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735960) returned 0x0 [0186.198] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735960, phKey=0x3d4ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735960, phKey=0x3d4ff828, pbKeyObject=0x0) returned 0x0 [0186.198] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d4ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d4ff500) returned 0x0 [0186.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.199] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d4ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d4ff500) returned 0x0 [0186.216] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.219] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.219] WriteFile (in: hFile=0x23f0, lpBuffer=0x3d4ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d4ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d4ffb34*, lpNumberOfBytesWritten=0x3d4ff830*=0x428, lpOverlapped=0x0) returned 1 [0186.220] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.220] ReadFile (in: hFile=0x23f0, lpBuffer=0x8650000, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x3d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8650000*, lpNumberOfBytesRead=0x3d4ff61c*=0x1bc8, lpOverlapped=0x0) returned 1 [0186.221] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xffffe438, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.221] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8650000, cbInput=0x1bc8, pPaddingInfo=0x0, pbIV=0x3d4ff848, cbIV=0x10, pbOutput=0x8650000, cbOutput=0x100000, pcbResult=0x3d4ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d4ff848, pbOutput=0x8650000, pcbResult=0x3d4ff618) returned 0x0 [0186.222] WriteFile (in: hFile=0x23f0, lpBuffer=0x8650000*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x3d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8650000*, lpNumberOfBytesWritten=0x3d4ff61c*=0x1bd0, lpOverlapped=0x0) returned 1 [0186.222] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d4ff60c | out: lpNewFilePointer=0x0) returned 1 [0186.222] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.222] WriteFile (in: hFile=0x23f0, lpBuffer=0x3d4ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d4ff83c*, lpNumberOfBytesWritten=0x3d4ff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.222] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x1bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.222] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.222] CloseHandle (hObject=0x23f0) returned 1 [0186.222] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.play")) returned 1 [0186.226] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2991 os_tid = 0x2cfc [0186.230] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.230] ReadFile (in: hFile=0x23f8, lpBuffer=0x3d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d63fb34*, lpNumberOfBytesRead=0x3d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.231] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.231] ReadFile (in: hFile=0x23f8, lpBuffer=0x3d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d63fb34*, lpNumberOfBytesRead=0x3d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.232] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.234] BCryptSetProperty (in: hObject=0x735330, pszProperty="ChainingMode", pbInput=0x3d63f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735330) returned 0x0 [0186.234] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735330, phKey=0x3d63f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735330, phKey=0x3d63f828, pbKeyObject=0x0) returned 0x0 [0186.234] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d63f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d63f500) returned 0x0 [0186.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.235] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d63f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d63f500) returned 0x0 [0186.238] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.240] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.241] WriteFile (in: hFile=0x23f8, lpBuffer=0x3d63fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d63f830, lpOverlapped=0x0 | out: lpBuffer=0x3d63fb34*, lpNumberOfBytesWritten=0x3d63f830*=0x428, lpOverlapped=0x0) returned 1 [0186.241] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.241] ReadFile (in: hFile=0x23f8, lpBuffer=0x8750000, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x3d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x8750000*, lpNumberOfBytesRead=0x3d63f61c*=0x1348, lpOverlapped=0x0) returned 1 [0186.241] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0xffffecb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.241] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8750000, cbInput=0x1348, pPaddingInfo=0x0, pbIV=0x3d63f848, cbIV=0x10, pbOutput=0x8750000, cbOutput=0x100000, pcbResult=0x3d63f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d63f848, pbOutput=0x8750000, pcbResult=0x3d63f618) returned 0x0 [0186.241] WriteFile (in: hFile=0x23f8, lpBuffer=0x8750000*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x3d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x8750000*, lpNumberOfBytesWritten=0x3d63f61c*=0x1350, lpOverlapped=0x0) returned 1 [0186.241] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d63f60c | out: lpNewFilePointer=0x0) returned 1 [0186.241] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.241] WriteFile (in: hFile=0x23f8, lpBuffer=0x3d63f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d63f83c*, lpNumberOfBytesWritten=0x3d63f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.241] SetFilePointerEx (in: hFile=0x23f8, liDistanceToMove=0x1350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.241] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.241] CloseHandle (hObject=0x23f8) returned 1 [0186.242] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.play")) returned 1 [0186.245] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2992 os_tid = 0x2d00 [0186.249] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.249] ReadFile (in: hFile=0x2404, lpBuffer=0x3d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d77fb34*, lpNumberOfBytesRead=0x3d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.251] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.251] ReadFile (in: hFile=0x2404, lpBuffer=0x3d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d77fb34*, lpNumberOfBytesRead=0x3d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.251] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.253] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.254] BCryptSetProperty (in: hObject=0x734570, pszProperty="ChainingMode", pbInput=0x3d77f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734570) returned 0x0 [0186.254] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734570, phKey=0x3d77f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734570, phKey=0x3d77f828, pbKeyObject=0x0) returned 0x0 [0186.254] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d77f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d77f500) returned 0x0 [0186.254] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.254] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d77f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d77f500) returned 0x0 [0186.257] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.260] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.260] WriteFile (in: hFile=0x2404, lpBuffer=0x3d77fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d77f830, lpOverlapped=0x0 | out: lpBuffer=0x3d77fb34*, lpNumberOfBytesWritten=0x3d77f830*=0x428, lpOverlapped=0x0) returned 1 [0186.260] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.260] ReadFile (in: hFile=0x2404, lpBuffer=0x8850000, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x3d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x8850000*, lpNumberOfBytesRead=0x3d77f61c*=0x1720, lpOverlapped=0x0) returned 1 [0186.260] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xffffe8e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.260] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8850000, cbInput=0x1720, pPaddingInfo=0x0, pbIV=0x3d77f848, cbIV=0x10, pbOutput=0x8850000, cbOutput=0x100000, pcbResult=0x3d77f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d77f848, pbOutput=0x8850000, pcbResult=0x3d77f618) returned 0x0 [0186.261] WriteFile (in: hFile=0x2404, lpBuffer=0x8850000*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x3d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x8850000*, lpNumberOfBytesWritten=0x3d77f61c*=0x1730, lpOverlapped=0x0) returned 1 [0186.261] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d77f60c | out: lpNewFilePointer=0x0) returned 1 [0186.261] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.261] WriteFile (in: hFile=0x2404, lpBuffer=0x3d77f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d77f83c*, lpNumberOfBytesWritten=0x3d77f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.261] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x1730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.261] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.261] CloseHandle (hObject=0x2404) returned 1 [0186.261] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.play")) returned 1 [0186.265] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2993 os_tid = 0x2d04 [0186.268] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.268] ReadFile (in: hFile=0x240c, lpBuffer=0x3d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d8bfb34*, lpNumberOfBytesRead=0x3d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.270] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.270] ReadFile (in: hFile=0x240c, lpBuffer=0x3d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d8bfb34*, lpNumberOfBytesRead=0x3d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.270] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.272] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.273] BCryptSetProperty (in: hObject=0x734fc0, pszProperty="ChainingMode", pbInput=0x3d8bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734fc0) returned 0x0 [0186.273] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734fc0, phKey=0x3d8bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734fc0, phKey=0x3d8bf828, pbKeyObject=0x0) returned 0x0 [0186.273] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d8bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d8bf500) returned 0x0 [0186.273] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.273] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d8bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d8bf500) returned 0x0 [0186.276] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.280] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.280] WriteFile (in: hFile=0x240c, lpBuffer=0x3d8bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d8bf830, lpOverlapped=0x0 | out: lpBuffer=0x3d8bfb34*, lpNumberOfBytesWritten=0x3d8bf830*=0x428, lpOverlapped=0x0) returned 1 [0186.280] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.280] ReadFile (in: hFile=0x240c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x3d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x3d8bf61c*=0x154c, lpOverlapped=0x0) returned 1 [0186.280] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0xffffeab4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.281] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8950000, cbInput=0x154c, pPaddingInfo=0x0, pbIV=0x3d8bf848, cbIV=0x10, pbOutput=0x8950000, cbOutput=0x100000, pcbResult=0x3d8bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d8bf848, pbOutput=0x8950000, pcbResult=0x3d8bf618) returned 0x0 [0186.281] WriteFile (in: hFile=0x240c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x3d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x3d8bf61c*=0x1550, lpOverlapped=0x0) returned 1 [0186.281] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d8bf60c | out: lpNewFilePointer=0x0) returned 1 [0186.281] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.281] WriteFile (in: hFile=0x240c, lpBuffer=0x3d8bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d8bf83c*, lpNumberOfBytesWritten=0x3d8bf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.281] SetFilePointerEx (in: hFile=0x240c, liDistanceToMove=0x1550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.281] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.281] CloseHandle (hObject=0x240c) returned 1 [0186.281] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.play")) returned 1 [0186.285] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2994 os_tid = 0x2d08 [0186.288] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.289] ReadFile (in: hFile=0x2414, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.290] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.290] ReadFile (in: hFile=0x2414, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.290] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.292] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.292] BCryptSetProperty (in: hObject=0x734620, pszProperty="ChainingMode", pbInput=0x3d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734620) returned 0x0 [0186.292] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734620, phKey=0x3d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734620, phKey=0x3d9ff828, pbKeyObject=0x0) returned 0x0 [0186.292] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d9ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0186.293] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.293] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0186.296] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.299] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.299] WriteFile (in: hFile=0x2414, lpBuffer=0x3d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesWritten=0x3d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0186.299] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.299] ReadFile (in: hFile=0x2414, lpBuffer=0x8a50000, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8a50000*, lpNumberOfBytesRead=0x3d9ff61c*=0x13e8, lpOverlapped=0x0) returned 1 [0186.299] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xffffec18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.299] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8a50000, cbInput=0x13e8, pPaddingInfo=0x0, pbIV=0x3d9ff848, cbIV=0x10, pbOutput=0x8a50000, cbOutput=0x100000, pcbResult=0x3d9ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d9ff848, pbOutput=0x8a50000, pcbResult=0x3d9ff618) returned 0x0 [0186.299] WriteFile (in: hFile=0x2414, lpBuffer=0x8a50000*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x8a50000*, lpNumberOfBytesWritten=0x3d9ff61c*=0x13f0, lpOverlapped=0x0) returned 1 [0186.299] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0186.299] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.299] WriteFile (in: hFile=0x2414, lpBuffer=0x3d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ff83c*, lpNumberOfBytesWritten=0x3d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.299] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x13f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.299] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.300] CloseHandle (hObject=0x2414) returned 1 [0186.300] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.play")) returned 1 [0186.303] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2995 os_tid = 0x2d0c [0186.307] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.307] ReadFile (in: hFile=0x241c, lpBuffer=0x3db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3db3fb34*, lpNumberOfBytesRead=0x3db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.309] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.309] ReadFile (in: hFile=0x241c, lpBuffer=0x3db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3db3fb34*, lpNumberOfBytesRead=0x3db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.309] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.311] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.311] BCryptSetProperty (in: hObject=0x7353e0, pszProperty="ChainingMode", pbInput=0x3db3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7353e0) returned 0x0 [0186.311] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7353e0, phKey=0x3db3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7353e0, phKey=0x3db3f828, pbKeyObject=0x0) returned 0x0 [0186.311] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3db3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3db3f500) returned 0x0 [0186.312] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.312] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3db3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3db3f500) returned 0x0 [0186.315] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.318] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.318] WriteFile (in: hFile=0x241c, lpBuffer=0x3db3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3db3f830, lpOverlapped=0x0 | out: lpBuffer=0x3db3fb34*, lpNumberOfBytesWritten=0x3db3f830*=0x428, lpOverlapped=0x0) returned 1 [0186.318] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.318] ReadFile (in: hFile=0x241c, lpBuffer=0x8b50000, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x3db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x8b50000*, lpNumberOfBytesRead=0x3db3f61c*=0xda0, lpOverlapped=0x0) returned 1 [0186.318] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0xfffff260, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.318] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8b50000, cbInput=0xda0, pPaddingInfo=0x0, pbIV=0x3db3f848, cbIV=0x10, pbOutput=0x8b50000, cbOutput=0x100000, pcbResult=0x3db3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3db3f848, pbOutput=0x8b50000, pcbResult=0x3db3f618) returned 0x0 [0186.318] WriteFile (in: hFile=0x241c, lpBuffer=0x8b50000*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x3db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x8b50000*, lpNumberOfBytesWritten=0x3db3f61c*=0xdb0, lpOverlapped=0x0) returned 1 [0186.318] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3db3f60c | out: lpNewFilePointer=0x0) returned 1 [0186.318] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.319] WriteFile (in: hFile=0x241c, lpBuffer=0x3db3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3db3f83c*, lpNumberOfBytesWritten=0x3db3f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.319] SetFilePointerEx (in: hFile=0x241c, liDistanceToMove=0xdb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.319] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.319] CloseHandle (hObject=0x241c) returned 1 [0186.319] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.play")) returned 1 [0186.322] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2996 os_tid = 0x2d10 [0186.327] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.327] ReadFile (in: hFile=0x2424, lpBuffer=0x3dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3dc7fb34*, lpNumberOfBytesRead=0x3dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.328] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.328] ReadFile (in: hFile=0x2424, lpBuffer=0x3dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3dc7fb34*, lpNumberOfBytesRead=0x3dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.328] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.330] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.331] BCryptSetProperty (in: hObject=0x734db0, pszProperty="ChainingMode", pbInput=0x3dc7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734db0) returned 0x0 [0186.331] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734db0, phKey=0x3dc7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734db0, phKey=0x3dc7f828, pbKeyObject=0x0) returned 0x0 [0186.331] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3dc7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3dc7f500) returned 0x0 [0186.331] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.331] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3dc7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3dc7f500) returned 0x0 [0186.334] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.337] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.337] WriteFile (in: hFile=0x2424, lpBuffer=0x3dc7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3dc7f830, lpOverlapped=0x0 | out: lpBuffer=0x3dc7fb34*, lpNumberOfBytesWritten=0x3dc7f830*=0x428, lpOverlapped=0x0) returned 1 [0186.337] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.337] ReadFile (in: hFile=0x2424, lpBuffer=0x8c50000, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x3dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8c50000*, lpNumberOfBytesRead=0x3dc7f61c*=0xcd8, lpOverlapped=0x0) returned 1 [0186.337] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffff328, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.337] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8c50000, cbInput=0xcd8, pPaddingInfo=0x0, pbIV=0x3dc7f848, cbIV=0x10, pbOutput=0x8c50000, cbOutput=0x100000, pcbResult=0x3dc7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3dc7f848, pbOutput=0x8c50000, pcbResult=0x3dc7f618) returned 0x0 [0186.337] WriteFile (in: hFile=0x2424, lpBuffer=0x8c50000*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x3dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x8c50000*, lpNumberOfBytesWritten=0x3dc7f61c*=0xce0, lpOverlapped=0x0) returned 1 [0186.337] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dc7f60c | out: lpNewFilePointer=0x0) returned 1 [0186.337] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.337] WriteFile (in: hFile=0x2424, lpBuffer=0x3dc7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3dc7f83c*, lpNumberOfBytesWritten=0x3dc7f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.338] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.338] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.338] CloseHandle (hObject=0x2424) returned 1 [0186.338] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.play")) returned 1 [0186.341] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2997 os_tid = 0x2d14 [0186.345] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.345] ReadFile (in: hFile=0x242c, lpBuffer=0x3ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3ddbfb34*, lpNumberOfBytesRead=0x3ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.347] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.347] ReadFile (in: hFile=0x242c, lpBuffer=0x3ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3ddbfb34*, lpNumberOfBytesRead=0x3ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.347] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.350] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.350] BCryptSetProperty (in: hObject=0x735750, pszProperty="ChainingMode", pbInput=0x3ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735750) returned 0x0 [0186.350] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735750, phKey=0x3ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735750, phKey=0x3ddbf828, pbKeyObject=0x0) returned 0x0 [0186.350] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ddbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ddbf500) returned 0x0 [0186.350] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.350] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ddbf500) returned 0x0 [0186.354] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.357] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.357] WriteFile (in: hFile=0x242c, lpBuffer=0x3ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x3ddbfb34*, lpNumberOfBytesWritten=0x3ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0186.358] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.358] ReadFile (in: hFile=0x242c, lpBuffer=0x8d50000, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x3ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x8d50000*, lpNumberOfBytesRead=0x3ddbf61c*=0x1df8, lpOverlapped=0x0) returned 1 [0186.358] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0xffffe208, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.358] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8d50000, cbInput=0x1df8, pPaddingInfo=0x0, pbIV=0x3ddbf848, cbIV=0x10, pbOutput=0x8d50000, cbOutput=0x100000, pcbResult=0x3ddbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3ddbf848, pbOutput=0x8d50000, pcbResult=0x3ddbf618) returned 0x0 [0186.358] WriteFile (in: hFile=0x242c, lpBuffer=0x8d50000*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x8d50000*, lpNumberOfBytesWritten=0x3ddbf61c*=0x1e00, lpOverlapped=0x0) returned 1 [0186.359] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0186.359] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.359] WriteFile (in: hFile=0x242c, lpBuffer=0x3ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3ddbf83c*, lpNumberOfBytesWritten=0x3ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.359] SetFilePointerEx (in: hFile=0x242c, liDistanceToMove=0x1e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.359] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.359] CloseHandle (hObject=0x242c) returned 1 [0186.359] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.play")) returned 1 [0186.363] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2998 os_tid = 0x2d18 [0186.366] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.366] ReadFile (in: hFile=0x2434, lpBuffer=0x3deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3deff85c, lpOverlapped=0x0 | out: lpBuffer=0x3deffb34*, lpNumberOfBytesRead=0x3deff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.368] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.368] ReadFile (in: hFile=0x2434, lpBuffer=0x3deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3deff85c, lpOverlapped=0x0 | out: lpBuffer=0x3deffb34*, lpNumberOfBytesRead=0x3deff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.368] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.370] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.370] BCryptSetProperty (in: hObject=0x734c50, pszProperty="ChainingMode", pbInput=0x3deff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734c50) returned 0x0 [0186.371] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734c50, phKey=0x3deff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734c50, phKey=0x3deff828, pbKeyObject=0x0) returned 0x0 [0186.371] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3deff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3deff500) returned 0x0 [0186.371] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.371] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3deff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3deff500) returned 0x0 [0186.374] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.378] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.378] WriteFile (in: hFile=0x2434, lpBuffer=0x3deffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3deff830, lpOverlapped=0x0 | out: lpBuffer=0x3deffb34*, lpNumberOfBytesWritten=0x3deff830*=0x428, lpOverlapped=0x0) returned 1 [0186.378] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.378] ReadFile (in: hFile=0x2434, lpBuffer=0x8e50000, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x3deff61c, lpOverlapped=0x0 | out: lpBuffer=0x8e50000*, lpNumberOfBytesRead=0x3deff61c*=0xa410, lpOverlapped=0x0) returned 1 [0186.379] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xffff5bf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.379] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8e50000, cbInput=0xa410, pPaddingInfo=0x0, pbIV=0x3deff848, cbIV=0x10, pbOutput=0x8e50000, cbOutput=0x100000, pcbResult=0x3deff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3deff848, pbOutput=0x8e50000, pcbResult=0x3deff618) returned 0x0 [0186.379] WriteFile (in: hFile=0x2434, lpBuffer=0x8e50000*, nNumberOfBytesToWrite=0xa420, lpNumberOfBytesWritten=0x3deff61c, lpOverlapped=0x0 | out: lpBuffer=0x8e50000*, lpNumberOfBytesWritten=0x3deff61c*=0xa420, lpOverlapped=0x0) returned 1 [0186.379] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3deff60c | out: lpNewFilePointer=0x0) returned 1 [0186.379] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.379] WriteFile (in: hFile=0x2434, lpBuffer=0x3deff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3deff61c, lpOverlapped=0x0 | out: lpBuffer=0x3deff83c*, lpNumberOfBytesWritten=0x3deff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.380] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xa420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.380] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.380] CloseHandle (hObject=0x2434) returned 1 [0186.380] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.play")) returned 1 [0186.383] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 2999 os_tid = 0x2d1c [0186.387] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.387] ReadFile (in: hFile=0x243c, lpBuffer=0x3e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e03fb34*, lpNumberOfBytesRead=0x3e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.389] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.389] ReadFile (in: hFile=0x243c, lpBuffer=0x3e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e03fb34*, lpNumberOfBytesRead=0x3e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.389] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.392] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.392] BCryptSetProperty (in: hObject=0x735120, pszProperty="ChainingMode", pbInput=0x3e03f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735120) returned 0x0 [0186.392] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735120, phKey=0x3e03f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735120, phKey=0x3e03f828, pbKeyObject=0x0) returned 0x0 [0186.392] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e03f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e03f500) returned 0x0 [0186.392] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.392] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e03f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e03f500) returned 0x0 [0186.395] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.399] WriteFile (in: hFile=0x243c, lpBuffer=0x3e03fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e03f830, lpOverlapped=0x0 | out: lpBuffer=0x3e03fb34*, lpNumberOfBytesWritten=0x3e03f830*=0x428, lpOverlapped=0x0) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.399] ReadFile (in: hFile=0x243c, lpBuffer=0x8f50000, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x3e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x8f50000*, lpNumberOfBytesRead=0x3e03f61c*=0xdc4, lpOverlapped=0x0) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0xfffff23c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.399] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x8f50000, cbInput=0xdc4, pPaddingInfo=0x0, pbIV=0x3e03f848, cbIV=0x10, pbOutput=0x8f50000, cbOutput=0x100000, pcbResult=0x3e03f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e03f848, pbOutput=0x8f50000, pcbResult=0x3e03f618) returned 0x0 [0186.400] WriteFile (in: hFile=0x243c, lpBuffer=0x8f50000*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x3e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x8f50000*, lpNumberOfBytesWritten=0x3e03f61c*=0xdd0, lpOverlapped=0x0) returned 1 [0186.400] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e03f60c | out: lpNewFilePointer=0x0) returned 1 [0186.400] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.400] WriteFile (in: hFile=0x243c, lpBuffer=0x3e03f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e03f83c*, lpNumberOfBytesWritten=0x3e03f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.400] SetFilePointerEx (in: hFile=0x243c, liDistanceToMove=0xdd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.400] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.400] CloseHandle (hObject=0x243c) returned 1 [0186.400] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.play")) returned 1 [0186.404] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3000 os_tid = 0x2d20 [0186.409] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.409] ReadFile (in: hFile=0x2028, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.411] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.411] ReadFile (in: hFile=0x2028, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.411] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.414] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.414] BCryptSetProperty (in: hObject=0x734780, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734780) returned 0x0 [0186.414] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734780, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734780, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0186.414] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0186.414] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.415] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0186.418] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.421] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.421] WriteFile (in: hFile=0x2028, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0186.421] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.421] ReadFile (in: hFile=0x2028, lpBuffer=0x9050000, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x9050000*, lpNumberOfBytesRead=0x2d57f61c*=0x1476, lpOverlapped=0x0) returned 1 [0186.421] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xffffeb8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.421] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9050000, cbInput=0x1476, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x9050000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d57f848, pbOutput=0x9050000, pcbResult=0x2d57f618) returned 0x0 [0186.422] WriteFile (in: hFile=0x2028, lpBuffer=0x9050000*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x9050000*, lpNumberOfBytesWritten=0x2d57f61c*=0x1480, lpOverlapped=0x0) returned 1 [0186.422] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0186.422] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.422] WriteFile (in: hFile=0x2028, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.422] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x1480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.422] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.422] CloseHandle (hObject=0x2028) returned 1 [0186.422] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.424] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.play")) returned 1 [0186.426] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3001 os_tid = 0x2d24 [0186.430] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.431] ReadFile (in: hFile=0x2444, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.432] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.432] ReadFile (in: hFile=0x2444, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.432] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.435] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.435] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0186.435] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0186.435] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d67f500) returned 0x0 [0186.435] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.435] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d67f500) returned 0x0 [0186.439] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.442] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.442] WriteFile (in: hFile=0x2444, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0186.442] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.442] ReadFile (in: hFile=0x2444, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x2d67f61c*=0x92e, lpOverlapped=0x0) returned 1 [0186.442] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0xfffff6d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.443] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2c50000, cbInput=0x92e, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d67f848, pbOutput=0x2c50000, pcbResult=0x2d67f618) returned 0x0 [0186.443] WriteFile (in: hFile=0x2444, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x2d67f61c*=0x930, lpOverlapped=0x0) returned 1 [0186.443] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0186.443] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.443] WriteFile (in: hFile=0x2444, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.443] SetFilePointerEx (in: hFile=0x2444, liDistanceToMove=0x930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.443] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.443] CloseHandle (hObject=0x2444) returned 1 [0186.443] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.445] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.play")) returned 1 [0186.447] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3002 os_tid = 0x2d28 [0186.451] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.451] ReadFile (in: hFile=0x244c, lpBuffer=0x3e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e17fb34*, lpNumberOfBytesRead=0x3e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.452] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.453] ReadFile (in: hFile=0x244c, lpBuffer=0x3e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e17fb34*, lpNumberOfBytesRead=0x3e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.453] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.455] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.455] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x3e17f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0186.455] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x3e17f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x3e17f828, pbKeyObject=0x0) returned 0x0 [0186.455] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e17f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e17f500) returned 0x0 [0186.455] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.455] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e17f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e17f500) returned 0x0 [0186.459] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.461] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.461] WriteFile (in: hFile=0x244c, lpBuffer=0x3e17fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e17f830, lpOverlapped=0x0 | out: lpBuffer=0x3e17fb34*, lpNumberOfBytesWritten=0x3e17f830*=0x428, lpOverlapped=0x0) returned 1 [0186.461] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.462] ReadFile (in: hFile=0x244c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x3e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x3e17f61c*=0xa4e, lpOverlapped=0x0) returned 1 [0186.462] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xfffff5b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.462] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2d50000, cbInput=0xa4e, pPaddingInfo=0x0, pbIV=0x3e17f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x3e17f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e17f848, pbOutput=0x2d50000, pcbResult=0x3e17f618) returned 0x0 [0186.462] WriteFile (in: hFile=0x244c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x3e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x3e17f61c*=0xa50, lpOverlapped=0x0) returned 1 [0186.462] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e17f60c | out: lpNewFilePointer=0x0) returned 1 [0186.462] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.462] WriteFile (in: hFile=0x244c, lpBuffer=0x3e17f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e17f83c*, lpNumberOfBytesWritten=0x3e17f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.462] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xa50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.462] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.462] CloseHandle (hObject=0x244c) returned 1 [0186.462] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.play")) returned 1 [0186.466] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3003 os_tid = 0x2d2c [0186.470] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.470] ReadFile (in: hFile=0x2454, lpBuffer=0x3e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3e2bfb34*, lpNumberOfBytesRead=0x3e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.472] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.472] ReadFile (in: hFile=0x2454, lpBuffer=0x3e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3e2bfb34*, lpNumberOfBytesRead=0x3e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.472] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.474] BCryptSetProperty (in: hObject=0x734830, pszProperty="ChainingMode", pbInput=0x3e2bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734830) returned 0x0 [0186.474] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734830, phKey=0x3e2bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734830, phKey=0x3e2bf828, pbKeyObject=0x0) returned 0x0 [0186.474] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e2bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e2bf500) returned 0x0 [0186.474] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.475] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e2bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e2bf500) returned 0x0 [0186.478] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.480] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.481] WriteFile (in: hFile=0x2454, lpBuffer=0x3e2bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x3e2bfb34*, lpNumberOfBytesWritten=0x3e2bf830*=0x428, lpOverlapped=0x0) returned 1 [0186.481] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.481] ReadFile (in: hFile=0x2454, lpBuffer=0x9150000, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x3e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9150000*, lpNumberOfBytesRead=0x3e2bf61c*=0x926, lpOverlapped=0x0) returned 1 [0186.481] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0xfffff6da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.481] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9150000, cbInput=0x926, pPaddingInfo=0x0, pbIV=0x3e2bf848, cbIV=0x10, pbOutput=0x9150000, cbOutput=0x100000, pcbResult=0x3e2bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e2bf848, pbOutput=0x9150000, pcbResult=0x3e2bf618) returned 0x0 [0186.481] WriteFile (in: hFile=0x2454, lpBuffer=0x9150000*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x3e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9150000*, lpNumberOfBytesWritten=0x3e2bf61c*=0x930, lpOverlapped=0x0) returned 1 [0186.481] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e2bf60c | out: lpNewFilePointer=0x0) returned 1 [0186.481] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.481] WriteFile (in: hFile=0x2454, lpBuffer=0x3e2bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e2bf83c*, lpNumberOfBytesWritten=0x3e2bf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.481] SetFilePointerEx (in: hFile=0x2454, liDistanceToMove=0x930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.481] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.481] CloseHandle (hObject=0x2454) returned 1 [0186.482] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.play")) returned 1 [0186.485] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3004 os_tid = 0x2d30 [0186.490] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.490] ReadFile (in: hFile=0x245c, lpBuffer=0x3e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3e3ffb34*, lpNumberOfBytesRead=0x3e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.491] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.491] ReadFile (in: hFile=0x245c, lpBuffer=0x3e3ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e3ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3e3ffb34*, lpNumberOfBytesRead=0x3e3ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.491] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.493] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.494] BCryptSetProperty (in: hObject=0x735280, pszProperty="ChainingMode", pbInput=0x3e3ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735280) returned 0x0 [0186.494] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735280, phKey=0x3e3ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735280, phKey=0x3e3ff828, pbKeyObject=0x0) returned 0x0 [0186.494] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e3ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e3ff500) returned 0x0 [0186.494] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.494] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e3ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e3ff500) returned 0x0 [0186.497] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.500] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.501] WriteFile (in: hFile=0x245c, lpBuffer=0x3e3ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e3ff830, lpOverlapped=0x0 | out: lpBuffer=0x3e3ffb34*, lpNumberOfBytesWritten=0x3e3ff830*=0x428, lpOverlapped=0x0) returned 1 [0186.501] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.501] ReadFile (in: hFile=0x245c, lpBuffer=0x9250000, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x3e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9250000*, lpNumberOfBytesRead=0x3e3ff61c*=0xab2, lpOverlapped=0x0) returned 1 [0186.501] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffff54e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.501] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9250000, cbInput=0xab2, pPaddingInfo=0x0, pbIV=0x3e3ff848, cbIV=0x10, pbOutput=0x9250000, cbOutput=0x100000, pcbResult=0x3e3ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e3ff848, pbOutput=0x9250000, pcbResult=0x3e3ff618) returned 0x0 [0186.501] WriteFile (in: hFile=0x245c, lpBuffer=0x9250000*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x3e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9250000*, lpNumberOfBytesWritten=0x3e3ff61c*=0xac0, lpOverlapped=0x0) returned 1 [0186.501] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3ff60c | out: lpNewFilePointer=0x0) returned 1 [0186.501] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.501] WriteFile (in: hFile=0x245c, lpBuffer=0x3e3ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e3ff83c*, lpNumberOfBytesWritten=0x3e3ff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.501] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.501] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.501] CloseHandle (hObject=0x245c) returned 1 [0186.502] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.play")) returned 1 [0186.505] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3005 os_tid = 0x2d34 [0186.509] SetFilePointerEx (in: hFile=0x2464, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.509] ReadFile (in: hFile=0x2464, lpBuffer=0x3e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e53fb34*, lpNumberOfBytesRead=0x3e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.510] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.513] BCryptSetProperty (in: hObject=0x7348e0, pszProperty="ChainingMode", pbInput=0x3e53f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7348e0) returned 0x0 [0186.513] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7348e0, phKey=0x3e53f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7348e0, phKey=0x3e53f828, pbKeyObject=0x0) returned 0x0 [0186.513] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e53f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e53f500) returned 0x0 [0186.513] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.513] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e53f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e53f500) returned 0x0 [0186.516] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.519] SetFilePointerEx (in: hFile=0x2464, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.519] WriteFile (in: hFile=0x2464, lpBuffer=0x3e53fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e53f830, lpOverlapped=0x0 | out: lpBuffer=0x3e53fb34*, lpNumberOfBytesWritten=0x3e53f830*=0x428, lpOverlapped=0x0) returned 1 [0186.519] SetFilePointerEx (in: hFile=0x2464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.519] ReadFile (in: hFile=0x2464, lpBuffer=0x9350000, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x3e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x9350000*, lpNumberOfBytesRead=0x3e53f61c*=0x82a, lpOverlapped=0x0) returned 1 [0186.519] SetFilePointerEx (in: hFile=0x2464, liDistanceToMove=0xfffff7d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.519] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9350000, cbInput=0x82a, pPaddingInfo=0x0, pbIV=0x3e53f848, cbIV=0x10, pbOutput=0x9350000, cbOutput=0x100000, pcbResult=0x3e53f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e53f848, pbOutput=0x9350000, pcbResult=0x3e53f618) returned 0x0 [0186.519] WriteFile (in: hFile=0x2464, lpBuffer=0x9350000*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x3e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x9350000*, lpNumberOfBytesWritten=0x3e53f61c*=0x830, lpOverlapped=0x0) returned 1 [0186.520] SetFilePointerEx (in: hFile=0x2464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e53f60c | out: lpNewFilePointer=0x0) returned 1 [0186.520] SetFilePointerEx (in: hFile=0x2464, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.520] WriteFile (in: hFile=0x2464, lpBuffer=0x3e53f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e53f83c*, lpNumberOfBytesWritten=0x3e53f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.520] SetFilePointerEx (in: hFile=0x2464, liDistanceToMove=0x830, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.520] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.520] CloseHandle (hObject=0x2464) returned 1 [0186.520] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.522] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.play")) returned 1 [0186.524] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3006 os_tid = 0x2d38 [0186.527] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.527] ReadFile (in: hFile=0x246c, lpBuffer=0x3e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e67fb34*, lpNumberOfBytesRead=0x3e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.530] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.530] ReadFile (in: hFile=0x246c, lpBuffer=0x3e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e67fb34*, lpNumberOfBytesRead=0x3e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.530] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.532] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.532] BCryptSetProperty (in: hObject=0x734990, pszProperty="ChainingMode", pbInput=0x3e67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734990) returned 0x0 [0186.532] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734990, phKey=0x3e67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734990, phKey=0x3e67f828, pbKeyObject=0x0) returned 0x0 [0186.532] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e67f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e67f500) returned 0x0 [0186.533] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.533] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e67f500) returned 0x0 [0186.536] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.538] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.539] WriteFile (in: hFile=0x246c, lpBuffer=0x3e67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e67f830, lpOverlapped=0x0 | out: lpBuffer=0x3e67fb34*, lpNumberOfBytesWritten=0x3e67f830*=0x428, lpOverlapped=0x0) returned 1 [0186.539] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.539] ReadFile (in: hFile=0x246c, lpBuffer=0x9450000, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x3e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x9450000*, lpNumberOfBytesRead=0x3e67f61c*=0xcbe, lpOverlapped=0x0) returned 1 [0186.539] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xfffff342, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.539] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9450000, cbInput=0xcbe, pPaddingInfo=0x0, pbIV=0x3e67f848, cbIV=0x10, pbOutput=0x9450000, cbOutput=0x100000, pcbResult=0x3e67f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e67f848, pbOutput=0x9450000, pcbResult=0x3e67f618) returned 0x0 [0186.539] WriteFile (in: hFile=0x246c, lpBuffer=0x9450000*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x3e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x9450000*, lpNumberOfBytesWritten=0x3e67f61c*=0xcc0, lpOverlapped=0x0) returned 1 [0186.539] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e67f60c | out: lpNewFilePointer=0x0) returned 1 [0186.539] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.539] WriteFile (in: hFile=0x246c, lpBuffer=0x3e67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e67f83c*, lpNumberOfBytesWritten=0x3e67f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.539] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.539] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.540] CloseHandle (hObject=0x246c) returned 1 [0186.540] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.play")) returned 1 [0186.543] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3007 os_tid = 0x2d3c [0186.552] SetFilePointerEx (in: hFile=0x2474, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.552] ReadFile (in: hFile=0x2474, lpBuffer=0x3e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3e7bfb34*, lpNumberOfBytesRead=0x3e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.556] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.556] BCryptSetProperty (in: hObject=0x734a40, pszProperty="ChainingMode", pbInput=0x3e7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734a40) returned 0x0 [0186.556] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734a40, phKey=0x3e7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734a40, phKey=0x3e7bf828, pbKeyObject=0x0) returned 0x0 [0186.556] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e7bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e7bf500) returned 0x0 [0186.556] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.556] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e7bf500) returned 0x0 [0186.560] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.562] SetFilePointerEx (in: hFile=0x2474, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.562] WriteFile (in: hFile=0x2474, lpBuffer=0x3e7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e7bf830, lpOverlapped=0x0 | out: lpBuffer=0x3e7bfb34*, lpNumberOfBytesWritten=0x3e7bf830*=0x428, lpOverlapped=0x0) returned 1 [0186.562] SetFilePointerEx (in: hFile=0x2474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.562] ReadFile (in: hFile=0x2474, lpBuffer=0x9550000, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x3e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9550000*, lpNumberOfBytesRead=0x3e7bf61c*=0x7b2, lpOverlapped=0x0) returned 1 [0186.562] SetFilePointerEx (in: hFile=0x2474, liDistanceToMove=0xfffff84e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.562] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9550000, cbInput=0x7b2, pPaddingInfo=0x0, pbIV=0x3e7bf848, cbIV=0x10, pbOutput=0x9550000, cbOutput=0x100000, pcbResult=0x3e7bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e7bf848, pbOutput=0x9550000, pcbResult=0x3e7bf618) returned 0x0 [0186.562] WriteFile (in: hFile=0x2474, lpBuffer=0x9550000*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x3e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x9550000*, lpNumberOfBytesWritten=0x3e7bf61c*=0x7c0, lpOverlapped=0x0) returned 1 [0186.563] SetFilePointerEx (in: hFile=0x2474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7bf60c | out: lpNewFilePointer=0x0) returned 1 [0186.563] SetFilePointerEx (in: hFile=0x2474, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.563] WriteFile (in: hFile=0x2474, lpBuffer=0x3e7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e7bf83c*, lpNumberOfBytesWritten=0x3e7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.563] SetFilePointerEx (in: hFile=0x2474, liDistanceToMove=0x7c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.563] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.563] CloseHandle (hObject=0x2474) returned 1 [0186.563] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.play")) returned 1 [0186.566] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3008 os_tid = 0x2d40 [0186.570] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.570] ReadFile (in: hFile=0x247c, lpBuffer=0x3e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3e8ffb34*, lpNumberOfBytesRead=0x3e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.571] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.571] ReadFile (in: hFile=0x247c, lpBuffer=0x3e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3e8ffb34*, lpNumberOfBytesRead=0x3e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.571] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.573] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.573] BCryptSetProperty (in: hObject=0x734d00, pszProperty="ChainingMode", pbInput=0x3e8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734d00) returned 0x0 [0186.573] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734d00, phKey=0x3e8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734d00, phKey=0x3e8ff828, pbKeyObject=0x0) returned 0x0 [0186.573] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e8ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e8ff500) returned 0x0 [0186.574] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.574] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e8ff500) returned 0x0 [0186.577] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.579] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.579] WriteFile (in: hFile=0x247c, lpBuffer=0x3e8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e8ff830, lpOverlapped=0x0 | out: lpBuffer=0x3e8ffb34*, lpNumberOfBytesWritten=0x3e8ff830*=0x428, lpOverlapped=0x0) returned 1 [0186.580] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.580] ReadFile (in: hFile=0x247c, lpBuffer=0x9650000, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x3e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9650000*, lpNumberOfBytesRead=0x3e8ff61c*=0x7938, lpOverlapped=0x0) returned 1 [0186.580] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xffff86c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.580] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9650000, cbInput=0x7938, pPaddingInfo=0x0, pbIV=0x3e8ff848, cbIV=0x10, pbOutput=0x9650000, cbOutput=0x100000, pcbResult=0x3e8ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3e8ff848, pbOutput=0x9650000, pcbResult=0x3e8ff618) returned 0x0 [0186.581] WriteFile (in: hFile=0x247c, lpBuffer=0x9650000*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x3e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x9650000*, lpNumberOfBytesWritten=0x3e8ff61c*=0x7940, lpOverlapped=0x0) returned 1 [0186.581] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e8ff60c | out: lpNewFilePointer=0x0) returned 1 [0186.581] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.581] WriteFile (in: hFile=0x247c, lpBuffer=0x3e8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e8ff83c*, lpNumberOfBytesWritten=0x3e8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.581] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x7940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.581] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.581] CloseHandle (hObject=0x247c) returned 1 [0186.581] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.play")) returned 1 [0186.585] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3009 os_tid = 0x2d44 [0186.588] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.588] ReadFile (in: hFile=0x2484, lpBuffer=0x3ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ea3fb34*, lpNumberOfBytesRead=0x3ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.590] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.590] ReadFile (in: hFile=0x2484, lpBuffer=0x3ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ea3fb34*, lpNumberOfBytesRead=0x3ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.590] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.592] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.592] BCryptSetProperty (in: hObject=0x7351d0, pszProperty="ChainingMode", pbInput=0x3ea3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7351d0) returned 0x0 [0186.592] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7351d0, phKey=0x3ea3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7351d0, phKey=0x3ea3f828, pbKeyObject=0x0) returned 0x0 [0186.592] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ea3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ea3f500) returned 0x0 [0186.593] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.593] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ea3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ea3f500) returned 0x0 [0186.596] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.598] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.598] WriteFile (in: hFile=0x2484, lpBuffer=0x3ea3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ea3f830, lpOverlapped=0x0 | out: lpBuffer=0x3ea3fb34*, lpNumberOfBytesWritten=0x3ea3f830*=0x428, lpOverlapped=0x0) returned 1 [0186.599] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.599] ReadFile (in: hFile=0x2484, lpBuffer=0x9750000, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x3ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9750000*, lpNumberOfBytesRead=0x3ea3f61c*=0x6958, lpOverlapped=0x0) returned 1 [0186.599] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0xffff96a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.599] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9750000, cbInput=0x6958, pPaddingInfo=0x0, pbIV=0x3ea3f848, cbIV=0x10, pbOutput=0x9750000, cbOutput=0x100000, pcbResult=0x3ea3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3ea3f848, pbOutput=0x9750000, pcbResult=0x3ea3f618) returned 0x0 [0186.600] WriteFile (in: hFile=0x2484, lpBuffer=0x9750000*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x3ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9750000*, lpNumberOfBytesWritten=0x3ea3f61c*=0x6960, lpOverlapped=0x0) returned 1 [0186.600] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ea3f60c | out: lpNewFilePointer=0x0) returned 1 [0186.600] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.600] WriteFile (in: hFile=0x2484, lpBuffer=0x3ea3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ea3f83c*, lpNumberOfBytesWritten=0x3ea3f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.600] SetFilePointerEx (in: hFile=0x2484, liDistanceToMove=0x6960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.600] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.600] CloseHandle (hObject=0x2484) returned 1 [0186.600] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.play")) returned 1 [0186.603] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3010 os_tid = 0x2d48 [0186.607] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.607] ReadFile (in: hFile=0x248c, lpBuffer=0x3eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3eb7fb34*, lpNumberOfBytesRead=0x3eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.608] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.608] ReadFile (in: hFile=0x248c, lpBuffer=0x3eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3eb7fb34*, lpNumberOfBytesRead=0x3eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.608] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.610] BCryptSetProperty (in: hObject=0x735070, pszProperty="ChainingMode", pbInput=0x3eb7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735070) returned 0x0 [0186.610] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735070, phKey=0x3eb7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735070, phKey=0x3eb7f828, pbKeyObject=0x0) returned 0x0 [0186.611] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3eb7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3eb7f500) returned 0x0 [0186.611] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.611] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3eb7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3eb7f500) returned 0x0 [0186.614] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.617] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.617] WriteFile (in: hFile=0x248c, lpBuffer=0x3eb7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3eb7f830, lpOverlapped=0x0 | out: lpBuffer=0x3eb7fb34*, lpNumberOfBytesWritten=0x3eb7f830*=0x428, lpOverlapped=0x0) returned 1 [0186.618] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.618] ReadFile (in: hFile=0x248c, lpBuffer=0x9850000, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x3eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x9850000*, lpNumberOfBytesRead=0x3eb7f61c*=0x1100c, lpOverlapped=0x0) returned 1 [0186.619] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xfffeeff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.619] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9850000, cbInput=0x1100c, pPaddingInfo=0x0, pbIV=0x3eb7f848, cbIV=0x10, pbOutput=0x9850000, cbOutput=0x100000, pcbResult=0x3eb7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3eb7f848, pbOutput=0x9850000, pcbResult=0x3eb7f618) returned 0x0 [0186.619] WriteFile (in: hFile=0x248c, lpBuffer=0x9850000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x9850000*, lpNumberOfBytesWritten=0x3eb7f61c*=0x11010, lpOverlapped=0x0) returned 1 [0186.619] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3eb7f60c | out: lpNewFilePointer=0x0) returned 1 [0186.620] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.620] WriteFile (in: hFile=0x248c, lpBuffer=0x3eb7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3eb7f83c*, lpNumberOfBytesWritten=0x3eb7f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.620] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0x11010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.620] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.620] CloseHandle (hObject=0x248c) returned 1 [0186.620] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.play")) returned 1 [0186.624] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3011 os_tid = 0x2d4c [0186.627] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.627] ReadFile (in: hFile=0x2494, lpBuffer=0x3ecbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ecbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3ecbfb34*, lpNumberOfBytesRead=0x3ecbf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.629] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.629] ReadFile (in: hFile=0x2494, lpBuffer=0x3ecbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ecbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3ecbfb34*, lpNumberOfBytesRead=0x3ecbf85c*=0x428, lpOverlapped=0x0) returned 1 [0186.629] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.631] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.631] BCryptSetProperty (in: hObject=0x735490, pszProperty="ChainingMode", pbInput=0x3ecbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735490) returned 0x0 [0186.631] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735490, phKey=0x3ecbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735490, phKey=0x3ecbf828, pbKeyObject=0x0) returned 0x0 [0186.631] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ecbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ecbf500) returned 0x0 [0186.631] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.631] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ecbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ecbf500) returned 0x0 [0186.634] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.637] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.637] WriteFile (in: hFile=0x2494, lpBuffer=0x3ecbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ecbf830, lpOverlapped=0x0 | out: lpBuffer=0x3ecbfb34*, lpNumberOfBytesWritten=0x3ecbf830*=0x428, lpOverlapped=0x0) returned 1 [0186.637] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.637] ReadFile (in: hFile=0x2494, lpBuffer=0x9950000, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x3ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x9950000*, lpNumberOfBytesRead=0x3ecbf61c*=0xae2, lpOverlapped=0x0) returned 1 [0186.637] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0xfffff51e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.637] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9950000, cbInput=0xae2, pPaddingInfo=0x0, pbIV=0x3ecbf848, cbIV=0x10, pbOutput=0x9950000, cbOutput=0x100000, pcbResult=0x3ecbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3ecbf848, pbOutput=0x9950000, pcbResult=0x3ecbf618) returned 0x0 [0186.638] WriteFile (in: hFile=0x2494, lpBuffer=0x9950000*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x3ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x9950000*, lpNumberOfBytesWritten=0x3ecbf61c*=0xaf0, lpOverlapped=0x0) returned 1 [0186.638] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ecbf60c | out: lpNewFilePointer=0x0) returned 1 [0186.638] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.638] WriteFile (in: hFile=0x2494, lpBuffer=0x3ecbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3ecbf83c*, lpNumberOfBytesWritten=0x3ecbf61c*=0x8, lpOverlapped=0x0) returned 1 [0186.638] SetFilePointerEx (in: hFile=0x2494, liDistanceToMove=0xaf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.638] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.638] CloseHandle (hObject=0x2494) returned 1 [0186.638] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.play")) returned 1 [0186.642] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3012 os_tid = 0x2d50 [0186.646] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.646] ReadFile (in: hFile=0x249c, lpBuffer=0x3edffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3edff85c, lpOverlapped=0x0 | out: lpBuffer=0x3edffb34*, lpNumberOfBytesRead=0x3edff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.647] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.647] ReadFile (in: hFile=0x249c, lpBuffer=0x3edffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3edff85c, lpOverlapped=0x0 | out: lpBuffer=0x3edffb34*, lpNumberOfBytesRead=0x3edff85c*=0x428, lpOverlapped=0x0) returned 1 [0186.647] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.650] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.650] BCryptSetProperty (in: hObject=0x7355f0, pszProperty="ChainingMode", pbInput=0x3edff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7355f0) returned 0x0 [0186.650] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7355f0, phKey=0x3edff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7355f0, phKey=0x3edff828, pbKeyObject=0x0) returned 0x0 [0186.650] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3edff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3edff500) returned 0x0 [0186.650] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.650] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3edff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3edff500) returned 0x0 [0186.653] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.656] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.656] WriteFile (in: hFile=0x249c, lpBuffer=0x3edffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3edff830, lpOverlapped=0x0 | out: lpBuffer=0x3edffb34*, lpNumberOfBytesWritten=0x3edff830*=0x428, lpOverlapped=0x0) returned 1 [0186.656] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.657] ReadFile (in: hFile=0x249c, lpBuffer=0x9a50000, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x3edff61c, lpOverlapped=0x0 | out: lpBuffer=0x9a50000*, lpNumberOfBytesRead=0x3edff61c*=0xf56, lpOverlapped=0x0) returned 1 [0186.657] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffff0aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.657] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9a50000, cbInput=0xf56, pPaddingInfo=0x0, pbIV=0x3edff848, cbIV=0x10, pbOutput=0x9a50000, cbOutput=0x100000, pcbResult=0x3edff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3edff848, pbOutput=0x9a50000, pcbResult=0x3edff618) returned 0x0 [0186.657] WriteFile (in: hFile=0x249c, lpBuffer=0x9a50000*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x3edff61c, lpOverlapped=0x0 | out: lpBuffer=0x9a50000*, lpNumberOfBytesWritten=0x3edff61c*=0xf60, lpOverlapped=0x0) returned 1 [0186.657] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3edff60c | out: lpNewFilePointer=0x0) returned 1 [0186.657] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.657] WriteFile (in: hFile=0x249c, lpBuffer=0x3edff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3edff61c, lpOverlapped=0x0 | out: lpBuffer=0x3edff83c*, lpNumberOfBytesWritten=0x3edff61c*=0x8, lpOverlapped=0x0) returned 1 [0186.657] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xf60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.657] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.657] CloseHandle (hObject=0x249c) returned 1 [0186.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.play")) returned 1 [0186.661] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3013 os_tid = 0x2d54 [0186.664] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.664] ReadFile (in: hFile=0x24a4, lpBuffer=0x3ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fb34*, lpNumberOfBytesRead=0x3ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.665] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.665] ReadFile (in: hFile=0x24a4, lpBuffer=0x3ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fb34*, lpNumberOfBytesRead=0x3ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.666] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.667] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.668] BCryptSetProperty (in: hObject=0x734e60, pszProperty="ChainingMode", pbInput=0x3ef3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734e60) returned 0x0 [0186.668] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734e60, phKey=0x3ef3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734e60, phKey=0x3ef3f828, pbKeyObject=0x0) returned 0x0 [0186.668] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ef3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ef3f500) returned 0x0 [0186.668] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.668] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ef3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ef3f500) returned 0x0 [0186.671] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.674] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.674] WriteFile (in: hFile=0x24a4, lpBuffer=0x3ef3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ef3f830, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fb34*, lpNumberOfBytesWritten=0x3ef3f830*=0x428, lpOverlapped=0x0) returned 1 [0186.674] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.674] ReadFile (in: hFile=0x24a4, lpBuffer=0x9b50000, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x3ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9b50000*, lpNumberOfBytesRead=0x3ef3f61c*=0xf6a, lpOverlapped=0x0) returned 1 [0186.674] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0xfffff096, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.674] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9b50000, cbInput=0xf6a, pPaddingInfo=0x0, pbIV=0x3ef3f848, cbIV=0x10, pbOutput=0x9b50000, cbOutput=0x100000, pcbResult=0x3ef3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3ef3f848, pbOutput=0x9b50000, pcbResult=0x3ef3f618) returned 0x0 [0186.674] WriteFile (in: hFile=0x24a4, lpBuffer=0x9b50000*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x3ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x9b50000*, lpNumberOfBytesWritten=0x3ef3f61c*=0xf70, lpOverlapped=0x0) returned 1 [0186.674] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ef3f60c | out: lpNewFilePointer=0x0) returned 1 [0186.675] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.675] WriteFile (in: hFile=0x24a4, lpBuffer=0x3ef3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ef3f83c*, lpNumberOfBytesWritten=0x3ef3f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.675] SetFilePointerEx (in: hFile=0x24a4, liDistanceToMove=0xf70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.675] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.675] CloseHandle (hObject=0x24a4) returned 1 [0186.675] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.play")) returned 1 [0186.678] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3014 os_tid = 0x2d58 [0186.938] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.938] ReadFile (in: hFile=0x24ac, lpBuffer=0x3f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f07fb34*, lpNumberOfBytesRead=0x3f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.939] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.939] ReadFile (in: hFile=0x24ac, lpBuffer=0x3f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f07fb34*, lpNumberOfBytesRead=0x3f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.939] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.943] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.943] BCryptSetProperty (in: hObject=0x734f10, pszProperty="ChainingMode", pbInput=0x3f07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x734f10) returned 0x0 [0186.943] BCryptGenerateSymmetricKey (in: hAlgorithm=0x734f10, phKey=0x3f07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x734f10, phKey=0x3f07f828, pbKeyObject=0x0) returned 0x0 [0186.944] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f07f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f07f500) returned 0x0 [0186.944] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.944] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f07f500) returned 0x0 [0186.957] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.961] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.961] WriteFile (in: hFile=0x24ac, lpBuffer=0x3f07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f07f830, lpOverlapped=0x0 | out: lpBuffer=0x3f07fb34*, lpNumberOfBytesWritten=0x3f07f830*=0x428, lpOverlapped=0x0) returned 1 [0186.961] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.961] ReadFile (in: hFile=0x24ac, lpBuffer=0x9c50000, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x3f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x9c50000*, lpNumberOfBytesRead=0x3f07f61c*=0x4330, lpOverlapped=0x0) returned 1 [0186.962] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0xffffbcd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.962] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x9c50000, cbInput=0x4330, pPaddingInfo=0x0, pbIV=0x3f07f848, cbIV=0x10, pbOutput=0x9c50000, cbOutput=0x100000, pcbResult=0x3f07f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3f07f848, pbOutput=0x9c50000, pcbResult=0x3f07f618) returned 0x0 [0186.962] WriteFile (in: hFile=0x24ac, lpBuffer=0x9c50000*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x3f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x9c50000*, lpNumberOfBytesWritten=0x3f07f61c*=0x4340, lpOverlapped=0x0) returned 1 [0186.963] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f07f60c | out: lpNewFilePointer=0x0) returned 1 [0186.963] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.963] WriteFile (in: hFile=0x24ac, lpBuffer=0x3f07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f07f83c*, lpNumberOfBytesWritten=0x3f07f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.963] SetFilePointerEx (in: hFile=0x24ac, liDistanceToMove=0x4340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.963] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.963] CloseHandle (hObject=0x24ac) returned 1 [0186.963] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.play")) returned 1 [0186.967] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3015 os_tid = 0x2d60 [0186.970] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.970] ReadFile (in: hFile=0x249c, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.972] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.972] ReadFile (in: hFile=0x249c, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.972] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.974] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.974] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0186.974] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0186.974] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1444f500) returned 0x0 [0186.974] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.974] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1444f500) returned 0x0 [0186.978] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.980] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.980] WriteFile (in: hFile=0x249c, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0186.981] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.981] ReadFile (in: hFile=0x249c, lpBuffer=0x2750000, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1444f61c*=0x11dee, lpOverlapped=0x0) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffee212, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.982] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2750000, cbInput=0x11dee, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1444f848, pbOutput=0x2750000, pcbResult=0x1444f618) returned 0x0 [0186.982] WriteFile (in: hFile=0x249c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1444f61c*=0x11df0, lpOverlapped=0x0) returned 1 [0186.983] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0186.983] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.983] WriteFile (in: hFile=0x249c, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0186.983] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x11df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.983] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0186.983] CloseHandle (hObject=0x249c) returned 1 [0186.983] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0186.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.play")) returned 1 [0186.987] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3016 os_tid = 0x2d64 [0186.990] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.990] ReadFile (in: hFile=0x248c, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.991] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.991] ReadFile (in: hFile=0x248c, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0186.992] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0186.994] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0186.994] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1484f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0186.994] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1484f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1484f828, pbKeyObject=0x0) returned 0x0 [0186.994] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1484f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1484f500) returned 0x0 [0186.994] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0186.994] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1484f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1484f500) returned 0x0 [0186.997] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.087] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.087] WriteFile (in: hFile=0x248c, lpBuffer=0x1484fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1484f830, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesWritten=0x1484f830*=0x428, lpOverlapped=0x0) returned 1 [0187.087] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.087] ReadFile (in: hFile=0x248c, lpBuffer=0x2850000, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1484f61c*=0x94c4, lpOverlapped=0x0) returned 1 [0187.088] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xffff6b3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.088] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2850000, cbInput=0x94c4, pPaddingInfo=0x0, pbIV=0x1484f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1484f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1484f848, pbOutput=0x2850000, pcbResult=0x1484f618) returned 0x0 [0187.088] WriteFile (in: hFile=0x248c, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1484f61c*=0x94d0, lpOverlapped=0x0) returned 1 [0187.088] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1484f60c | out: lpNewFilePointer=0x0) returned 1 [0187.089] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.089] WriteFile (in: hFile=0x248c, lpBuffer=0x1484f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x1484f83c*, lpNumberOfBytesWritten=0x1484f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.089] SetFilePointerEx (in: hFile=0x248c, liDistanceToMove=0x94d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.089] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.089] CloseHandle (hObject=0x248c) returned 1 [0187.089] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.play")) returned 1 [0187.093] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3017 os_tid = 0x2d68 [0187.097] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.097] ReadFile (in: hFile=0x247c, lpBuffer=0x14d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d8fb34*, lpNumberOfBytesRead=0x14d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.098] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.098] ReadFile (in: hFile=0x247c, lpBuffer=0x14d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d8fb34*, lpNumberOfBytesRead=0x14d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.099] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.101] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.101] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x14d8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0187.101] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x14d8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x14d8f828, pbKeyObject=0x0) returned 0x0 [0187.101] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x14d8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x14d8f500) returned 0x0 [0187.101] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.101] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x14d8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x14d8f500) returned 0x0 [0187.105] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.107] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.107] WriteFile (in: hFile=0x247c, lpBuffer=0x14d8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14d8f830, lpOverlapped=0x0 | out: lpBuffer=0x14d8fb34*, lpNumberOfBytesWritten=0x14d8f830*=0x428, lpOverlapped=0x0) returned 1 [0187.108] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.108] ReadFile (in: hFile=0x247c, lpBuffer=0x2950000, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x14d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x14d8f61c*=0xb5b4, lpOverlapped=0x0) returned 1 [0187.109] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xffff4a4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.109] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2950000, cbInput=0xb5b4, pPaddingInfo=0x0, pbIV=0x14d8f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x14d8f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x14d8f848, pbOutput=0x2950000, pcbResult=0x14d8f618) returned 0x0 [0187.109] WriteFile (in: hFile=0x247c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x14d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x14d8f61c*=0xb5c0, lpOverlapped=0x0) returned 1 [0187.109] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14d8f60c | out: lpNewFilePointer=0x0) returned 1 [0187.109] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.109] WriteFile (in: hFile=0x247c, lpBuffer=0x14d8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x14d8f83c*, lpNumberOfBytesWritten=0x14d8f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.109] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xb5c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.109] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.109] CloseHandle (hObject=0x247c) returned 1 [0187.109] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.play")) returned 1 [0187.113] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3018 os_tid = 0x2d6c [0187.117] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.117] ReadFile (in: hFile=0x246c, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.118] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.118] ReadFile (in: hFile=0x246c, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.119] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.121] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.121] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1508f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0187.121] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1508f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1508f828, pbKeyObject=0x0) returned 0x0 [0187.121] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1508f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1508f500) returned 0x0 [0187.121] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.121] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1508f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1508f500) returned 0x0 [0187.124] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.127] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.127] WriteFile (in: hFile=0x246c, lpBuffer=0x1508fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1508f830, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesWritten=0x1508f830*=0x428, lpOverlapped=0x0) returned 1 [0187.127] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.127] ReadFile (in: hFile=0x246c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1508f61c*=0x31dc, lpOverlapped=0x0) returned 1 [0187.128] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xffffce24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.128] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2a50000, cbInput=0x31dc, pPaddingInfo=0x0, pbIV=0x1508f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1508f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1508f848, pbOutput=0x2a50000, pcbResult=0x1508f618) returned 0x0 [0187.128] WriteFile (in: hFile=0x246c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1508f61c*=0x31e0, lpOverlapped=0x0) returned 1 [0187.131] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1508f60c | out: lpNewFilePointer=0x0) returned 1 [0187.131] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.131] WriteFile (in: hFile=0x246c, lpBuffer=0x1508f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x1508f83c*, lpNumberOfBytesWritten=0x1508f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.131] SetFilePointerEx (in: hFile=0x246c, liDistanceToMove=0x31e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.131] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.131] CloseHandle (hObject=0x246c) returned 1 [0187.131] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.play")) returned 1 [0187.135] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3019 os_tid = 0x2d70 [0187.138] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.138] ReadFile (in: hFile=0x245c, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.140] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.140] ReadFile (in: hFile=0x245c, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.140] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.142] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0187.143] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0187.143] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0187.143] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.143] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0187.146] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.148] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.148] WriteFile (in: hFile=0x245c, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0187.149] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.149] ReadFile (in: hFile=0x245c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x219ff61c*=0x3854, lpOverlapped=0x0) returned 1 [0187.149] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xffffc7ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.149] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2b50000, cbInput=0x3854, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x219ff848, pbOutput=0x2b50000, pcbResult=0x219ff618) returned 0x0 [0187.149] WriteFile (in: hFile=0x245c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x219ff61c*=0x3860, lpOverlapped=0x0) returned 1 [0187.150] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0187.150] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.150] WriteFile (in: hFile=0x245c, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0187.150] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x3860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.150] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.150] CloseHandle (hObject=0x245c) returned 1 [0187.150] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.play")) returned 1 [0187.153] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3020 os_tid = 0x2d74 [0187.157] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.157] ReadFile (in: hFile=0x244c, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.160] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.160] ReadFile (in: hFile=0x244c, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.160] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.163] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0187.163] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0187.163] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0187.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.163] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0187.166] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.169] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.169] WriteFile (in: hFile=0x244c, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0187.170] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.170] ReadFile (in: hFile=0x244c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x2d37f61c*=0x2e88, lpOverlapped=0x0) returned 1 [0187.171] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xffffd178, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.171] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2c50000, cbInput=0x2e88, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d37f848, pbOutput=0x2c50000, pcbResult=0x2d37f618) returned 0x0 [0187.171] WriteFile (in: hFile=0x244c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x2e90, lpOverlapped=0x0) returned 1 [0187.171] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0187.171] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.171] WriteFile (in: hFile=0x244c, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.171] SetFilePointerEx (in: hFile=0x244c, liDistanceToMove=0x2e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.171] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.171] CloseHandle (hObject=0x244c) returned 1 [0187.171] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.play")) returned 1 [0187.175] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3021 os_tid = 0x2d78 [0187.178] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.178] ReadFile (in: hFile=0x2028, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.179] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.179] ReadFile (in: hFile=0x2028, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.180] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.182] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.182] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0187.182] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0187.182] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0187.182] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.182] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0187.185] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.188] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.188] WriteFile (in: hFile=0x2028, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0187.188] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.188] ReadFile (in: hFile=0x2028, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2d47f61c*=0x30f2, lpOverlapped=0x0) returned 1 [0187.189] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xffffcf0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.189] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2d50000, cbInput=0x30f2, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d47f848, pbOutput=0x2d50000, pcbResult=0x2d47f618) returned 0x0 [0187.189] WriteFile (in: hFile=0x2028, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2d47f61c*=0x3100, lpOverlapped=0x0) returned 1 [0187.189] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0187.189] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.189] WriteFile (in: hFile=0x2028, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.189] SetFilePointerEx (in: hFile=0x2028, liDistanceToMove=0x3100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.189] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.189] CloseHandle (hObject=0x2028) returned 1 [0187.190] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.play")) returned 1 [0187.193] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3022 os_tid = 0x2d7c [0187.198] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.198] ReadFile (in: hFile=0x2434, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.200] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.200] ReadFile (in: hFile=0x2434, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.200] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.210] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0187.210] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0187.210] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0187.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.211] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0187.754] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.757] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.757] WriteFile (in: hFile=0x2434, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0187.758] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.758] ReadFile (in: hFile=0x2434, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2d57f61c*=0x3c9e, lpOverlapped=0x0) returned 1 [0187.758] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xffffc362, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.759] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2e50000, cbInput=0x3c9e, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d57f848, pbOutput=0x2e50000, pcbResult=0x2d57f618) returned 0x0 [0187.759] WriteFile (in: hFile=0x2434, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2d57f61c*=0x3ca0, lpOverlapped=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.759] WriteFile (in: hFile=0x2434, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x2434, liDistanceToMove=0x3ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.759] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.759] CloseHandle (hObject=0x2434) returned 1 [0187.759] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.play")) returned 1 [0187.763] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3023 os_tid = 0x2d80 [0187.239] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.239] ReadFile (in: hFile=0x2424, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.246] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.246] ReadFile (in: hFile=0x2424, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.246] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0187.768] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0187.768] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0187.768] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0187.768] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0187.768] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0187.768] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0187.772] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.775] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.775] WriteFile (in: hFile=0x2424, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0187.775] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.775] ReadFile (in: hFile=0x2424, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d67f61c*=0x8166, lpOverlapped=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xffff7e9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.776] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2f50000, cbInput=0x8166, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d67f848, pbOutput=0x2f50000, pcbResult=0x2d67f618) returned 0x0 [0187.776] WriteFile (in: hFile=0x2424, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d67f61c*=0x8170, lpOverlapped=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.776] WriteFile (in: hFile=0x2424, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x8170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.777] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.777] CloseHandle (hObject=0x2424) returned 1 [0187.777] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.play")) returned 1 [0187.780] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3024 os_tid = 0x2d84 [0187.266] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.267] ReadFile (in: hFile=0x2414, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0187.269] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.282] ReadFile (in: hFile=0x2414, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0187.288] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0187.403] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0187.403] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0187.403] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d7bf828, pbKeyObject=0x0) returned 0x0 [0187.403] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d7bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d7bf500) returned 0x0 [0187.403] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0187.403] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d7bf500) returned 0x0 [0187.448] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.452] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.452] WriteFile (in: hFile=0x2414, lpBuffer=0x2d7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesWritten=0x2d7bf830*=0x428, lpOverlapped=0x0) returned 1 [0187.452] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.452] ReadFile (in: hFile=0x2414, lpBuffer=0x3050000, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d7bf61c*=0x3700, lpOverlapped=0x0) returned 1 [0187.490] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xffffc900, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.491] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3050000, cbInput=0x3700, pPaddingInfo=0x0, pbIV=0x2d7bf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d7bf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2d7bf848, pbOutput=0x3050000, pcbResult=0x2d7bf618) returned 0x0 [0187.491] WriteFile (in: hFile=0x2414, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d7bf61c*=0x3710, lpOverlapped=0x0) returned 1 [0187.491] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf60c | out: lpNewFilePointer=0x0) returned 1 [0187.491] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.491] WriteFile (in: hFile=0x2414, lpBuffer=0x2d7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf83c*, lpNumberOfBytesWritten=0x2d7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0187.492] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x3710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.493] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.493] CloseHandle (hObject=0x2414) returned 1 [0187.493] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.play")) returned 1 [0187.503] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3025 os_tid = 0x2d88 [0187.292] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.292] ReadFile (in: hFile=0x2404, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.294] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.294] ReadFile (in: hFile=0x2404, lpBuffer=0x2d8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesRead=0x2d8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.294] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x920000 [0187.737] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x920000) returned 0x0 [0187.737] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0187.737] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x920000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d8ff828, pbKeyObject=0x0) returned 0x0 [0187.737] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x920000, cbOutput=0x230, pcbResult=0x2d8ff500, dwFlags=0x0 | out: pbOutput=0x920000, pcbResult=0x2d8ff500) returned 0x0 [0187.737] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x920230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x920230) returned 0x0 [0187.737] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x920000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x920000, cbOutput=0x400, pcbResult=0x2d8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x920000, pcbResult=0x2d8ff500) returned 0x0 [0187.742] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.744] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.744] WriteFile (in: hFile=0x2404, lpBuffer=0x2d8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d8ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d8ffb34*, lpNumberOfBytesWritten=0x2d8ff830*=0x428, lpOverlapped=0x0) returned 1 [0187.745] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.745] ReadFile (in: hFile=0x2404, lpBuffer=0x3150000, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d8ff61c*=0x388a, lpOverlapped=0x0) returned 1 [0187.746] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xffffc776, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.746] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3150000, cbInput=0x388a, pPaddingInfo=0x0, pbIV=0x2d8ff848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d8ff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2d8ff848, pbOutput=0x3150000, pcbResult=0x2d8ff618) returned 0x0 [0187.746] WriteFile (in: hFile=0x2404, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d8ff61c*=0x3890, lpOverlapped=0x0) returned 1 [0187.746] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8ff60c | out: lpNewFilePointer=0x0) returned 1 [0187.746] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.746] WriteFile (in: hFile=0x2404, lpBuffer=0x2d8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d8ff83c*, lpNumberOfBytesWritten=0x2d8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0187.747] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x3890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.747] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.747] CloseHandle (hObject=0x2404) returned 1 [0187.747] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.749] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.play")) returned 1 [0187.750] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3026 os_tid = 0x2d8c [0187.304] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.304] ReadFile (in: hFile=0x23f0, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.306] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.306] ReadFile (in: hFile=0x23f0, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb110000 [0187.720] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb110000) returned 0x0 [0187.720] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2da3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0187.720] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2da3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb110000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2da3f828, pbKeyObject=0x0) returned 0x0 [0187.720] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb110000, cbOutput=0x230, pcbResult=0x2da3f500, dwFlags=0x0 | out: pbOutput=0xb110000, pcbResult=0x2da3f500) returned 0x0 [0187.720] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb110230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb110230) returned 0x0 [0187.721] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb110000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb110000, cbOutput=0x400, pcbResult=0x2da3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb110000, pcbResult=0x2da3f500) returned 0x0 [0187.724] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.727] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.727] WriteFile (in: hFile=0x23f0, lpBuffer=0x2da3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da3f830, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesWritten=0x2da3f830*=0x428, lpOverlapped=0x0) returned 1 [0187.727] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.728] ReadFile (in: hFile=0x23f0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2da3f61c*=0x2440, lpOverlapped=0x0) returned 1 [0187.728] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xffffdbc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.728] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3250000, cbInput=0x2440, pPaddingInfo=0x0, pbIV=0x2da3f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2da3f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2da3f848, pbOutput=0x3250000, pcbResult=0x2da3f618) returned 0x0 [0187.728] WriteFile (in: hFile=0x23f0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2da3f61c*=0x2450, lpOverlapped=0x0) returned 1 [0187.728] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da3f60c | out: lpNewFilePointer=0x0) returned 1 [0187.728] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.729] WriteFile (in: hFile=0x23f0, lpBuffer=0x2da3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da3f83c*, lpNumberOfBytesWritten=0x2da3f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.729] SetFilePointerEx (in: hFile=0x23f0, liDistanceToMove=0x2450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.729] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.729] CloseHandle (hObject=0x23f0) returned 1 [0187.729] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.play")) returned 1 [0187.733] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3027 os_tid = 0x2d90 [0187.311] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.311] ReadFile (in: hFile=0x23e0, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.313] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.313] ReadFile (in: hFile=0x23e0, lpBuffer=0x2db7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2db7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesRead=0x2db7f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.313] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4a0000 [0187.702] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4a0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4a0000) returned 0x0 [0187.702] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2db7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0187.702] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2db7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4a0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2db7f828, pbKeyObject=0x0) returned 0x0 [0187.702] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4a0000, cbOutput=0x230, pcbResult=0x2db7f500, dwFlags=0x0 | out: pbOutput=0xb4a0000, pcbResult=0x2db7f500) returned 0x0 [0187.702] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4a0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4a0230) returned 0x0 [0187.703] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4a0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4a0000, cbOutput=0x400, pcbResult=0x2db7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4a0000, pcbResult=0x2db7f500) returned 0x0 [0187.707] VirtualFree (lpAddress=0xb4a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.710] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.710] WriteFile (in: hFile=0x23e0, lpBuffer=0x2db7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2db7f830, lpOverlapped=0x0 | out: lpBuffer=0x2db7fb34*, lpNumberOfBytesWritten=0x2db7f830*=0x428, lpOverlapped=0x0) returned 1 [0187.710] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.710] ReadFile (in: hFile=0x23e0, lpBuffer=0x3350000, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2db7f61c*=0x795c, lpOverlapped=0x0) returned 1 [0187.711] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xffff86a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.711] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3350000, cbInput=0x795c, pPaddingInfo=0x0, pbIV=0x2db7f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2db7f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2db7f848, pbOutput=0x3350000, pcbResult=0x2db7f618) returned 0x0 [0187.711] WriteFile (in: hFile=0x23e0, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2db7f61c*=0x7960, lpOverlapped=0x0) returned 1 [0187.712] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db7f60c | out: lpNewFilePointer=0x0) returned 1 [0187.712] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.712] WriteFile (in: hFile=0x23e0, lpBuffer=0x2db7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2db7f83c*, lpNumberOfBytesWritten=0x2db7f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.712] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x7960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.712] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.712] CloseHandle (hObject=0x23e0) returned 1 [0187.712] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.play")) returned 1 [0187.716] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3028 os_tid = 0x2d94 [0187.318] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.318] ReadFile (in: hFile=0x2048, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.320] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.320] ReadFile (in: hFile=0x2048, lpBuffer=0x2ddffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddff85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesRead=0x2ddff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.320] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4b0000 [0187.685] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4b0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4b0000) returned 0x0 [0187.685] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2ddff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0187.685] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2ddff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4b0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2ddff828, pbKeyObject=0x0) returned 0x0 [0187.685] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4b0000, cbOutput=0x230, pcbResult=0x2ddff500, dwFlags=0x0 | out: pbOutput=0xb4b0000, pcbResult=0x2ddff500) returned 0x0 [0187.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4b0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4b0230) returned 0x0 [0187.686] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4b0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4b0000, cbOutput=0x400, pcbResult=0x2ddff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4b0000, pcbResult=0x2ddff500) returned 0x0 [0187.689] VirtualFree (lpAddress=0xb4b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.692] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.692] WriteFile (in: hFile=0x2048, lpBuffer=0x2ddffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddff830, lpOverlapped=0x0 | out: lpBuffer=0x2ddffb34*, lpNumberOfBytesWritten=0x2ddff830*=0x428, lpOverlapped=0x0) returned 1 [0187.693] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.693] ReadFile (in: hFile=0x2048, lpBuffer=0x3450000, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2ddff61c*=0x523e, lpOverlapped=0x0) returned 1 [0187.693] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xffffadc2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.694] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3450000, cbInput=0x523e, pPaddingInfo=0x0, pbIV=0x2ddff848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2ddff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2ddff848, pbOutput=0x3450000, pcbResult=0x2ddff618) returned 0x0 [0187.694] WriteFile (in: hFile=0x2048, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2ddff61c*=0x5240, lpOverlapped=0x0) returned 1 [0187.694] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddff60c | out: lpNewFilePointer=0x0) returned 1 [0187.694] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.694] WriteFile (in: hFile=0x2048, lpBuffer=0x2ddff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddff61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddff83c*, lpNumberOfBytesWritten=0x2ddff61c*=0x8, lpOverlapped=0x0) returned 1 [0187.694] SetFilePointerEx (in: hFile=0x2048, liDistanceToMove=0x5240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.694] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.694] CloseHandle (hObject=0x2048) returned 1 [0187.694] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.697] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.play")) returned 1 [0187.698] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3029 os_tid = 0x2d98 [0187.324] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.325] ReadFile (in: hFile=0x23c4, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.327] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.327] ReadFile (in: hFile=0x23c4, lpBuffer=0x2df3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2df3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesRead=0x2df3f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.327] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xb4c0000 [0187.666] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4c0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xb4c0000) returned 0x0 [0187.666] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2df3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0187.666] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2df3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xb4c0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2df3f828, pbKeyObject=0x0) returned 0x0 [0187.666] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xb4c0000, cbOutput=0x230, pcbResult=0x2df3f500, dwFlags=0x0 | out: pbOutput=0xb4c0000, pcbResult=0x2df3f500) returned 0x0 [0187.666] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xb4c0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xb4c0230) returned 0x0 [0187.666] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xb4c0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xb4c0000, cbOutput=0x400, pcbResult=0x2df3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xb4c0000, pcbResult=0x2df3f500) returned 0x0 [0187.669] VirtualFree (lpAddress=0xb4c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.672] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.673] WriteFile (in: hFile=0x23c4, lpBuffer=0x2df3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2df3f830, lpOverlapped=0x0 | out: lpBuffer=0x2df3fb34*, lpNumberOfBytesWritten=0x2df3f830*=0x428, lpOverlapped=0x0) returned 1 [0187.673] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.673] ReadFile (in: hFile=0x23c4, lpBuffer=0x3550000, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2df3f61c*=0x2eb4, lpOverlapped=0x0) returned 1 [0187.675] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xffffd14c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.675] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3550000, cbInput=0x2eb4, pPaddingInfo=0x0, pbIV=0x2df3f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2df3f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2df3f848, pbOutput=0x3550000, pcbResult=0x2df3f618) returned 0x0 [0187.675] WriteFile (in: hFile=0x23c4, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2df3f61c*=0x2ec0, lpOverlapped=0x0) returned 1 [0187.675] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2df3f60c | out: lpNewFilePointer=0x0) returned 1 [0187.675] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.676] WriteFile (in: hFile=0x23c4, lpBuffer=0x2df3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2df3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2df3f83c*, lpNumberOfBytesWritten=0x2df3f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.676] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x2ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.676] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.676] CloseHandle (hObject=0x23c4) returned 1 [0187.676] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.play")) returned 1 [0187.681] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3030 os_tid = 0x2d9c [0187.331] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.331] ReadFile (in: hFile=0x23b4, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.333] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.333] ReadFile (in: hFile=0x23b4, lpBuffer=0x2e07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e07f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesRead=0x2e07f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.334] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf910000 [0187.645] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf910000) returned 0x0 [0187.645] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2e07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0187.645] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2e07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2e07f828, pbKeyObject=0x0) returned 0x0 [0187.645] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf910000, cbOutput=0x230, pcbResult=0x2e07f500, dwFlags=0x0 | out: pbOutput=0xf910000, pcbResult=0x2e07f500) returned 0x0 [0187.645] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf910230) returned 0x0 [0187.645] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf910000, cbOutput=0x400, pcbResult=0x2e07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf910000, pcbResult=0x2e07f500) returned 0x0 [0187.649] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.652] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.652] WriteFile (in: hFile=0x23b4, lpBuffer=0x2e07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e07f830, lpOverlapped=0x0 | out: lpBuffer=0x2e07fb34*, lpNumberOfBytesWritten=0x2e07f830*=0x428, lpOverlapped=0x0) returned 1 [0187.655] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.655] ReadFile (in: hFile=0x23b4, lpBuffer=0x3650000, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2e07f61c*=0x3550, lpOverlapped=0x0) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xffffcab0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.657] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3650000, cbInput=0x3550, pPaddingInfo=0x0, pbIV=0x2e07f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2e07f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2e07f848, pbOutput=0x3650000, pcbResult=0x2e07f618) returned 0x0 [0187.657] WriteFile (in: hFile=0x23b4, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2e07f61c*=0x3560, lpOverlapped=0x0) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e07f60c | out: lpNewFilePointer=0x0) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.657] WriteFile (in: hFile=0x23b4, lpBuffer=0x2e07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e07f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e07f83c*, lpNumberOfBytesWritten=0x2e07f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.657] SetFilePointerEx (in: hFile=0x23b4, liDistanceToMove=0x3560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.657] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.657] CloseHandle (hObject=0x23b4) returned 1 [0187.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.play")) returned 1 [0187.662] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3031 os_tid = 0x2da0 [0187.337] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.337] ReadFile (in: hFile=0x23a4, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0187.338] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.338] ReadFile (in: hFile=0x23a4, lpBuffer=0x2e1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesRead=0x2e1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0187.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf960000 [0187.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf960000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf960000) returned 0x0 [0187.627] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2e1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0187.627] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2e1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf960000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2e1bf828, pbKeyObject=0x0) returned 0x0 [0187.627] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf960000, cbOutput=0x230, pcbResult=0x2e1bf500, dwFlags=0x0 | out: pbOutput=0xf960000, pcbResult=0x2e1bf500) returned 0x0 [0187.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf960230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf960230) returned 0x0 [0187.627] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf960000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf960000, cbOutput=0x400, pcbResult=0x2e1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf960000, pcbResult=0x2e1bf500) returned 0x0 [0187.631] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.634] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.634] WriteFile (in: hFile=0x23a4, lpBuffer=0x2e1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfb34*, lpNumberOfBytesWritten=0x2e1bf830*=0x428, lpOverlapped=0x0) returned 1 [0187.634] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.634] ReadFile (in: hFile=0x23a4, lpBuffer=0x3750000, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2e1bf61c*=0x23f4, lpOverlapped=0x0) returned 1 [0187.635] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xffffdc0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.635] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3750000, cbInput=0x23f4, pPaddingInfo=0x0, pbIV=0x2e1bf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2e1bf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2e1bf848, pbOutput=0x3750000, pcbResult=0x2e1bf618) returned 0x0 [0187.635] WriteFile (in: hFile=0x23a4, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2e1bf61c*=0x2400, lpOverlapped=0x0) returned 1 [0187.635] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1bf60c | out: lpNewFilePointer=0x0) returned 1 [0187.635] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.635] WriteFile (in: hFile=0x23a4, lpBuffer=0x2e1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1bf83c*, lpNumberOfBytesWritten=0x2e1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0187.636] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x2400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.636] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.636] CloseHandle (hObject=0x23a4) returned 1 [0187.636] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.play")) returned 1 [0187.639] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3032 os_tid = 0x2da4 [0187.340] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.340] ReadFile (in: hFile=0x2394, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.342] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.342] ReadFile (in: hFile=0x2394, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0187.342] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf970000 [0187.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf970000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf970000) returned 0x0 [0187.610] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2e2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0187.610] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2e2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf970000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2e2ff828, pbKeyObject=0x0) returned 0x0 [0187.610] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf970000, cbOutput=0x230, pcbResult=0x2e2ff500, dwFlags=0x0 | out: pbOutput=0xf970000, pcbResult=0x2e2ff500) returned 0x0 [0187.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf970230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf970230) returned 0x0 [0187.610] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf970000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf970000, cbOutput=0x400, pcbResult=0x2e2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf970000, pcbResult=0x2e2ff500) returned 0x0 [0187.615] VirtualFree (lpAddress=0xf970000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.618] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.618] WriteFile (in: hFile=0x2394, lpBuffer=0x2e2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesWritten=0x2e2ff830*=0x428, lpOverlapped=0x0) returned 1 [0187.618] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.618] ReadFile (in: hFile=0x2394, lpBuffer=0x3850000, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2e2ff61c*=0x2210, lpOverlapped=0x0) returned 1 [0187.619] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xffffddf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.619] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3850000, cbInput=0x2210, pPaddingInfo=0x0, pbIV=0x2e2ff848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2e2ff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2e2ff848, pbOutput=0x3850000, pcbResult=0x2e2ff618) returned 0x0 [0187.619] WriteFile (in: hFile=0x2394, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2e2ff61c*=0x2220, lpOverlapped=0x0) returned 1 [0187.619] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2ff60c | out: lpNewFilePointer=0x0) returned 1 [0187.619] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.619] WriteFile (in: hFile=0x2394, lpBuffer=0x2e2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ff83c*, lpNumberOfBytesWritten=0x2e2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0187.619] SetFilePointerEx (in: hFile=0x2394, liDistanceToMove=0x2220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.619] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.620] CloseHandle (hObject=0x2394) returned 1 [0187.620] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.play")) returned 1 [0187.623] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3033 os_tid = 0x2da8 [0187.344] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.344] ReadFile (in: hFile=0x2384, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.346] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.346] ReadFile (in: hFile=0x2384, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.346] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf980000 [0187.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf980000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf980000) returned 0x0 [0187.594] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0187.594] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf980000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e43f828, pbKeyObject=0x0) returned 0x0 [0187.594] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf980000, cbOutput=0x230, pcbResult=0x2e43f500, dwFlags=0x0 | out: pbOutput=0xf980000, pcbResult=0x2e43f500) returned 0x0 [0187.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf980230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf980230) returned 0x0 [0187.594] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf980000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf980000, cbOutput=0x400, pcbResult=0x2e43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf980000, pcbResult=0x2e43f500) returned 0x0 [0187.598] VirtualFree (lpAddress=0xf980000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.601] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.601] WriteFile (in: hFile=0x2384, lpBuffer=0x2e43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e43f830, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesWritten=0x2e43f830*=0x428, lpOverlapped=0x0) returned 1 [0187.601] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.601] ReadFile (in: hFile=0x2384, lpBuffer=0x3950000, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e43f61c*=0x21a0, lpOverlapped=0x0) returned 1 [0187.602] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xffffde60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.602] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3950000, cbInput=0x21a0, pPaddingInfo=0x0, pbIV=0x2e43f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e43f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2e43f848, pbOutput=0x3950000, pcbResult=0x2e43f618) returned 0x0 [0187.602] WriteFile (in: hFile=0x2384, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e43f61c*=0x21b0, lpOverlapped=0x0) returned 1 [0187.602] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e43f60c | out: lpNewFilePointer=0x0) returned 1 [0187.602] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.602] WriteFile (in: hFile=0x2384, lpBuffer=0x2e43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f83c*, lpNumberOfBytesWritten=0x2e43f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.602] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x21b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.603] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.603] CloseHandle (hObject=0x2384) returned 1 [0187.603] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.play")) returned 1 [0187.606] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3034 os_tid = 0x2dac [0187.348] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.348] ReadFile (in: hFile=0x2374, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.378] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.378] ReadFile (in: hFile=0x2374, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.378] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x14d90000 [0187.573] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x14d90000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x14d90000) returned 0x0 [0187.574] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0187.574] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x14d90000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e57f828, pbKeyObject=0x0) returned 0x0 [0187.574] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x14d90000, cbOutput=0x230, pcbResult=0x2e57f500, dwFlags=0x0 | out: pbOutput=0x14d90000, pcbResult=0x2e57f500) returned 0x0 [0187.574] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x14d90230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x14d90230) returned 0x0 [0187.574] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x14d90000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x14d90000, cbOutput=0x400, pcbResult=0x2e57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x14d90000, pcbResult=0x2e57f500) returned 0x0 [0187.577] VirtualFree (lpAddress=0x14d90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.581] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.582] WriteFile (in: hFile=0x2374, lpBuffer=0x2e57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e57f830, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesWritten=0x2e57f830*=0x428, lpOverlapped=0x0) returned 1 [0187.582] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.582] ReadFile (in: hFile=0x2374, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e57f61c*=0x7898, lpOverlapped=0x0) returned 1 [0187.584] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xffff8768, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.584] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3a50000, cbInput=0x7898, pPaddingInfo=0x0, pbIV=0x2e57f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e57f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2e57f848, pbOutput=0x3a50000, pcbResult=0x2e57f618) returned 0x0 [0187.584] WriteFile (in: hFile=0x2374, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e57f61c*=0x78a0, lpOverlapped=0x0) returned 1 [0187.585] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e57f60c | out: lpNewFilePointer=0x0) returned 1 [0187.585] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.585] WriteFile (in: hFile=0x2374, lpBuffer=0x2e57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e57f83c*, lpNumberOfBytesWritten=0x2e57f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.585] SetFilePointerEx (in: hFile=0x2374, liDistanceToMove=0x78a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.585] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.585] CloseHandle (hObject=0x2374) returned 1 [0187.585] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.play")) returned 1 [0187.589] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3035 os_tid = 0x2db0 [0187.349] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.349] ReadFile (in: hFile=0x2058, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0187.382] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.382] ReadFile (in: hFile=0x2058, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0187.382] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x14da0000 [0187.510] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x14da0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x14da0000) returned 0x0 [0187.510] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0187.510] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x14da0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0187.510] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x14da0000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x14da0000, pcbResult=0x2e6bf500) returned 0x0 [0187.510] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x14da0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x14da0230) returned 0x0 [0187.511] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x14da0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x14da0000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x14da0000, pcbResult=0x2e6bf500) returned 0x0 [0187.514] VirtualFree (lpAddress=0x14da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.517] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.517] WriteFile (in: hFile=0x2058, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0187.517] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.517] ReadFile (in: hFile=0x2058, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e6bf61c*=0x931a, lpOverlapped=0x0) returned 1 [0187.528] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xffff6ce6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.528] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3b50000, cbInput=0x931a, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2e6bf848, pbOutput=0x3b50000, pcbResult=0x2e6bf618) returned 0x0 [0187.528] WriteFile (in: hFile=0x2058, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x9320, lpOverlapped=0x0) returned 1 [0187.528] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0187.528] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.528] WriteFile (in: hFile=0x2058, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0187.528] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x9320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.528] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0187.528] CloseHandle (hObject=0x2058) returned 1 [0187.529] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0187.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.play")) returned 1 [0187.533] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3036 os_tid = 0x2dbc [0187.785] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.785] ReadFile (in: hFile=0x2358, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.790] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.790] ReadFile (in: hFile=0x2358, lpBuffer=0x1444fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1444f85c, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesRead=0x1444f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.790] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.793] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.793] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x1444f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0187.793] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x1444f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x1444f828, pbKeyObject=0x0) returned 0x0 [0187.793] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1444f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1444f500) returned 0x0 [0187.794] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.794] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1444f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1444f500) returned 0x0 [0187.797] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.800] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.800] WriteFile (in: hFile=0x2358, lpBuffer=0x1444fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1444f830, lpOverlapped=0x0 | out: lpBuffer=0x1444fb34*, lpNumberOfBytesWritten=0x1444f830*=0x428, lpOverlapped=0x0) returned 1 [0187.800] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.800] ReadFile (in: hFile=0x2358, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x1444f61c*=0x80d8, lpOverlapped=0x0) returned 1 [0187.801] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xffff7f28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.801] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3c50000, cbInput=0x80d8, pPaddingInfo=0x0, pbIV=0x1444f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x1444f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1444f848, pbOutput=0x3c50000, pcbResult=0x1444f618) returned 0x0 [0187.801] WriteFile (in: hFile=0x2358, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x1444f61c*=0x80e0, lpOverlapped=0x0) returned 1 [0187.801] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1444f60c | out: lpNewFilePointer=0x0) returned 1 [0187.802] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.803] WriteFile (in: hFile=0x2358, lpBuffer=0x1444f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1444f61c, lpOverlapped=0x0 | out: lpBuffer=0x1444f83c*, lpNumberOfBytesWritten=0x1444f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.803] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x80e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.803] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.803] CloseHandle (hObject=0x2358) returned 1 [0187.803] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.play")) returned 1 [0187.808] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3037 os_tid = 0x2dc0 [0187.922] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.922] ReadFile (in: hFile=0x75c, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.924] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.924] ReadFile (in: hFile=0x75c, lpBuffer=0x1484fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1484f85c, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesRead=0x1484f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.925] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.929] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.929] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1484f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0187.929] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1484f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1484f828, pbKeyObject=0x0) returned 0x0 [0187.929] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1484f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1484f500) returned 0x0 [0187.929] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.929] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1484f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1484f500) returned 0x0 [0187.933] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.936] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.936] WriteFile (in: hFile=0x75c, lpBuffer=0x1484fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1484f830, lpOverlapped=0x0 | out: lpBuffer=0x1484fb34*, lpNumberOfBytesWritten=0x1484f830*=0x428, lpOverlapped=0x0) returned 1 [0187.936] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.937] ReadFile (in: hFile=0x75c, lpBuffer=0x2750000, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1484f61c*=0xc6d2, lpOverlapped=0x0) returned 1 [0187.938] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xffff392e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.938] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2750000, cbInput=0xc6d2, pPaddingInfo=0x0, pbIV=0x1484f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1484f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1484f848, pbOutput=0x2750000, pcbResult=0x1484f618) returned 0x0 [0187.939] WriteFile (in: hFile=0x75c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1484f61c*=0xc6e0, lpOverlapped=0x0) returned 1 [0187.939] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1484f60c | out: lpNewFilePointer=0x0) returned 1 [0187.939] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.939] WriteFile (in: hFile=0x75c, lpBuffer=0x1484f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1484f61c, lpOverlapped=0x0 | out: lpBuffer=0x1484f83c*, lpNumberOfBytesWritten=0x1484f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.939] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xc6e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.939] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.939] CloseHandle (hObject=0x75c) returned 1 [0187.939] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.play")) returned 1 [0187.944] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3038 os_tid = 0x2dc4 [0187.949] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.950] ReadFile (in: hFile=0x760, lpBuffer=0x14d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d8fb34*, lpNumberOfBytesRead=0x14d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.951] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.951] ReadFile (in: hFile=0x760, lpBuffer=0x14d8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d8f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d8fb34*, lpNumberOfBytesRead=0x14d8f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.951] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.954] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.954] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x14d8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0187.954] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x14d8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x14d8f828, pbKeyObject=0x0) returned 0x0 [0187.954] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x14d8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x14d8f500) returned 0x0 [0187.954] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.954] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x14d8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x14d8f500) returned 0x0 [0187.958] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.961] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.961] WriteFile (in: hFile=0x760, lpBuffer=0x14d8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14d8f830, lpOverlapped=0x0 | out: lpBuffer=0x14d8fb34*, lpNumberOfBytesWritten=0x14d8f830*=0x428, lpOverlapped=0x0) returned 1 [0187.961] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.961] ReadFile (in: hFile=0x760, lpBuffer=0x2850000, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x14d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x14d8f61c*=0xcd10, lpOverlapped=0x0) returned 1 [0187.963] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0xffff32f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.963] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2850000, cbInput=0xcd10, pPaddingInfo=0x0, pbIV=0x14d8f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x14d8f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x14d8f848, pbOutput=0x2850000, pcbResult=0x14d8f618) returned 0x0 [0187.963] WriteFile (in: hFile=0x760, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0xcd20, lpNumberOfBytesWritten=0x14d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x14d8f61c*=0xcd20, lpOverlapped=0x0) returned 1 [0187.963] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14d8f60c | out: lpNewFilePointer=0x0) returned 1 [0187.963] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.963] WriteFile (in: hFile=0x760, lpBuffer=0x14d8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14d8f61c, lpOverlapped=0x0 | out: lpBuffer=0x14d8f83c*, lpNumberOfBytesWritten=0x14d8f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.964] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0xcd20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.964] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.964] CloseHandle (hObject=0x760) returned 1 [0187.964] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.play")) returned 1 [0187.967] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3039 os_tid = 0x2dc8 [0187.971] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.971] ReadFile (in: hFile=0x245c, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.973] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.973] ReadFile (in: hFile=0x245c, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.976] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.977] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1508f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0187.977] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1508f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1508f828, pbKeyObject=0x0) returned 0x0 [0187.977] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1508f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1508f500) returned 0x0 [0187.977] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.977] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1508f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1508f500) returned 0x0 [0187.980] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.983] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.983] WriteFile (in: hFile=0x245c, lpBuffer=0x1508fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1508f830, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesWritten=0x1508f830*=0x428, lpOverlapped=0x0) returned 1 [0187.983] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.983] ReadFile (in: hFile=0x245c, lpBuffer=0x2950000, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1508f61c*=0xa80c, lpOverlapped=0x0) returned 1 [0187.984] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xffff57f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.984] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2950000, cbInput=0xa80c, pPaddingInfo=0x0, pbIV=0x1508f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1508f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1508f848, pbOutput=0x2950000, pcbResult=0x1508f618) returned 0x0 [0187.984] WriteFile (in: hFile=0x245c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1508f61c*=0xa810, lpOverlapped=0x0) returned 1 [0187.986] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1508f60c | out: lpNewFilePointer=0x0) returned 1 [0187.986] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.986] WriteFile (in: hFile=0x245c, lpBuffer=0x1508f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x1508f83c*, lpNumberOfBytesWritten=0x1508f61c*=0x8, lpOverlapped=0x0) returned 1 [0187.986] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xa810, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.986] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0187.986] CloseHandle (hObject=0x245c) returned 1 [0187.986] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0187.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.play")) returned 1 [0187.990] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3040 os_tid = 0x2dcc [0187.973] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.984] ReadFile (in: hFile=0x247c, lpBuffer=0x1518fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1518f85c, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesRead=0x1518f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.996] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.996] ReadFile (in: hFile=0x247c, lpBuffer=0x1518fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1518f85c, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesRead=0x1518f85c*=0x428, lpOverlapped=0x0) returned 1 [0187.996] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0187.999] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0187.999] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1518f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0187.999] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1518f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1518f828, pbKeyObject=0x0) returned 0x0 [0187.999] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1518f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1518f500) returned 0x0 [0187.999] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0187.999] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1518f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1518f500) returned 0x0 [0188.002] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.005] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.005] WriteFile (in: hFile=0x247c, lpBuffer=0x1518fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1518f830, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesWritten=0x1518f830*=0x428, lpOverlapped=0x0) returned 1 [0188.007] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.007] ReadFile (in: hFile=0x247c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1518f61c*=0xd6bc, lpOverlapped=0x0) returned 1 [0188.008] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xffff2944, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.008] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2a50000, cbInput=0xd6bc, pPaddingInfo=0x0, pbIV=0x1518f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1518f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1518f848, pbOutput=0x2a50000, pcbResult=0x1518f618) returned 0x0 [0188.008] WriteFile (in: hFile=0x247c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1518f61c*=0xd6c0, lpOverlapped=0x0) returned 1 [0188.008] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1518f60c | out: lpNewFilePointer=0x0) returned 1 [0188.008] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.008] WriteFile (in: hFile=0x247c, lpBuffer=0x1518f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x1518f83c*, lpNumberOfBytesWritten=0x1518f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.008] SetFilePointerEx (in: hFile=0x247c, liDistanceToMove=0xd6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.008] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.008] CloseHandle (hObject=0x247c) returned 1 [0188.009] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.play")) returned 1 [0188.012] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3041 os_tid = 0x2dd0 [0188.016] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.016] ReadFile (in: hFile=0x249c, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.017] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.017] ReadFile (in: hFile=0x249c, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.017] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.020] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.020] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x152cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0188.020] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x152cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x152cf828, pbKeyObject=0x0) returned 0x0 [0188.020] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x152cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x152cf500) returned 0x0 [0188.020] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.020] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x152cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x152cf500) returned 0x0 [0188.024] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.027] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.027] WriteFile (in: hFile=0x249c, lpBuffer=0x152cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x152cf830, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesWritten=0x152cf830*=0x428, lpOverlapped=0x0) returned 1 [0188.027] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.027] ReadFile (in: hFile=0x249c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x152cf61c*=0x89a4, lpOverlapped=0x0) returned 1 [0188.029] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xffff765c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.029] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2b50000, cbInput=0x89a4, pPaddingInfo=0x0, pbIV=0x152cf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x152cf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x152cf848, pbOutput=0x2b50000, pcbResult=0x152cf618) returned 0x0 [0188.029] WriteFile (in: hFile=0x249c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x152cf61c*=0x89b0, lpOverlapped=0x0) returned 1 [0188.029] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x152cf60c | out: lpNewFilePointer=0x0) returned 1 [0188.029] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.029] WriteFile (in: hFile=0x249c, lpBuffer=0x152cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x152cf83c*, lpNumberOfBytesWritten=0x152cf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.030] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x89b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.030] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.030] CloseHandle (hObject=0x249c) returned 1 [0188.030] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.play")) returned 1 [0188.034] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3042 os_tid = 0x2dd4 [0188.037] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.037] ReadFile (in: hFile=0x1540, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.040] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.040] ReadFile (in: hFile=0x1540, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.040] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.042] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.042] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0188.042] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0188.042] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0188.043] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.043] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0188.046] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.049] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.049] WriteFile (in: hFile=0x1540, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0188.049] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.049] ReadFile (in: hFile=0x1540, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x219ff61c*=0x42d1, lpOverlapped=0x0) returned 1 [0188.051] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xffffbd2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.051] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2c50000, cbInput=0x42d1, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x219ff848, pbOutput=0x2c50000, pcbResult=0x219ff618) returned 0x0 [0188.051] WriteFile (in: hFile=0x1540, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x219ff61c*=0x42e0, lpOverlapped=0x0) returned 1 [0188.051] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0188.051] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.051] WriteFile (in: hFile=0x1540, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0188.051] SetFilePointerEx (in: hFile=0x1540, liDistanceToMove=0x42e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.051] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.051] CloseHandle (hObject=0x1540) returned 1 [0188.051] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.054] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.play")) returned 1 [0188.055] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3043 os_tid = 0x2dd8 [0188.058] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.059] ReadFile (in: hFile=0x2330, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.060] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.060] ReadFile (in: hFile=0x2330, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.060] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.062] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0188.062] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0188.062] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0188.062] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.063] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0188.066] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.070] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.070] WriteFile (in: hFile=0x2330, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0188.070] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.070] ReadFile (in: hFile=0x2330, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2d37f61c*=0x3e91, lpOverlapped=0x0) returned 1 [0188.071] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xffffc16f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.071] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2d50000, cbInput=0x3e91, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d37f848, pbOutput=0x2d50000, pcbResult=0x2d37f618) returned 0x0 [0188.071] WriteFile (in: hFile=0x2330, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x3ea0, lpOverlapped=0x0) returned 1 [0188.071] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0188.071] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.071] WriteFile (in: hFile=0x2330, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.071] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x3ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.071] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.071] CloseHandle (hObject=0x2330) returned 1 [0188.071] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.074] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.play")) returned 1 [0188.075] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3044 os_tid = 0x2ddc [0188.078] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.078] ReadFile (in: hFile=0x2320, lpBuffer=0x2e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesRead=0x2e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.081] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.081] ReadFile (in: hFile=0x2320, lpBuffer=0x2e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesRead=0x2e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.081] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.083] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.083] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0188.083] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e7bf828, pbKeyObject=0x0) returned 0x0 [0188.083] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e7bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e7bf500) returned 0x0 [0188.083] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.084] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e7bf500) returned 0x0 [0188.087] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.090] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.090] WriteFile (in: hFile=0x2320, lpBuffer=0x2e7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfb34*, lpNumberOfBytesWritten=0x2e7bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.090] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.090] ReadFile (in: hFile=0x2320, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e7bf61c*=0x43c5, lpOverlapped=0x0) returned 1 [0188.092] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xffffbc3b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.092] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3d50000, cbInput=0x43c5, pPaddingInfo=0x0, pbIV=0x2e7bf848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e7bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e7bf848, pbOutput=0x3d50000, pcbResult=0x2e7bf618) returned 0x0 [0188.092] WriteFile (in: hFile=0x2320, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e7bf61c*=0x43d0, lpOverlapped=0x0) returned 1 [0188.093] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.093] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.093] WriteFile (in: hFile=0x2320, lpBuffer=0x2e7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7bf83c*, lpNumberOfBytesWritten=0x2e7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.093] SetFilePointerEx (in: hFile=0x2320, liDistanceToMove=0x43d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.093] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.093] CloseHandle (hObject=0x2320) returned 1 [0188.093] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.play")) returned 1 [0188.098] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3045 os_tid = 0x2de0 [0188.104] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.104] ReadFile (in: hFile=0x2310, lpBuffer=0x2e8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8bfb34*, lpNumberOfBytesRead=0x2e8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.106] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.106] ReadFile (in: hFile=0x2310, lpBuffer=0x2e8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e8bfb34*, lpNumberOfBytesRead=0x2e8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.106] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.109] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.109] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2e8bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0188.109] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2e8bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2e8bf828, pbKeyObject=0x0) returned 0x0 [0188.109] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e8bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e8bf500) returned 0x0 [0188.109] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.109] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e8bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e8bf500) returned 0x0 [0188.114] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.120] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.120] WriteFile (in: hFile=0x2310, lpBuffer=0x2e8bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e8bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e8bfb34*, lpNumberOfBytesWritten=0x2e8bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.120] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.120] ReadFile (in: hFile=0x2310, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x2e8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2e8bf61c*=0x8d86, lpOverlapped=0x0) returned 1 [0188.121] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xffff727a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.121] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3e50000, cbInput=0x8d86, pPaddingInfo=0x0, pbIV=0x2e8bf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2e8bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e8bf848, pbOutput=0x3e50000, pcbResult=0x2e8bf618) returned 0x0 [0188.121] WriteFile (in: hFile=0x2310, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x2e8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2e8bf61c*=0x8d90, lpOverlapped=0x0) returned 1 [0188.122] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.122] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.122] WriteFile (in: hFile=0x2310, lpBuffer=0x2e8bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e8bf83c*, lpNumberOfBytesWritten=0x2e8bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.122] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x8d90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.122] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.122] CloseHandle (hObject=0x2310) returned 1 [0188.122] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.play")) returned 1 [0188.127] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3046 os_tid = 0x2de4 [0188.133] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.133] ReadFile (in: hFile=0x2300, lpBuffer=0x2e9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e9bfb34*, lpNumberOfBytesRead=0x2e9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.134] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.134] ReadFile (in: hFile=0x2300, lpBuffer=0x2e9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e9bfb34*, lpNumberOfBytesRead=0x2e9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.135] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.137] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.138] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2e9bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0188.138] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2e9bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2e9bf828, pbKeyObject=0x0) returned 0x0 [0188.138] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e9bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e9bf500) returned 0x0 [0188.138] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.138] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e9bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e9bf500) returned 0x0 [0188.143] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.147] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.147] WriteFile (in: hFile=0x2300, lpBuffer=0x2e9bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e9bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e9bfb34*, lpNumberOfBytesWritten=0x2e9bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.150] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.150] ReadFile (in: hFile=0x2300, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x2e9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2e9bf61c*=0x2d21, lpOverlapped=0x0) returned 1 [0188.151] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xffffd2df, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.151] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3f50000, cbInput=0x2d21, pPaddingInfo=0x0, pbIV=0x2e9bf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2e9bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e9bf848, pbOutput=0x3f50000, pcbResult=0x2e9bf618) returned 0x0 [0188.151] WriteFile (in: hFile=0x2300, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x2e9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2e9bf61c*=0x2d30, lpOverlapped=0x0) returned 1 [0188.151] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.152] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.152] WriteFile (in: hFile=0x2300, lpBuffer=0x2e9bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e9bf83c*, lpNumberOfBytesWritten=0x2e9bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.152] SetFilePointerEx (in: hFile=0x2300, liDistanceToMove=0x2d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.152] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.152] CloseHandle (hObject=0x2300) returned 1 [0188.152] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.play")) returned 1 [0188.157] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3047 os_tid = 0x2de8 [0188.162] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.162] ReadFile (in: hFile=0x22f4, lpBuffer=0x2eabfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eabf85c, lpOverlapped=0x0 | out: lpBuffer=0x2eabfb34*, lpNumberOfBytesRead=0x2eabf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.164] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.164] ReadFile (in: hFile=0x22f4, lpBuffer=0x2eabfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2eabf85c, lpOverlapped=0x0 | out: lpBuffer=0x2eabfb34*, lpNumberOfBytesRead=0x2eabf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.164] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.168] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.168] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2eabf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0188.168] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2eabf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2eabf828, pbKeyObject=0x0) returned 0x0 [0188.168] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2eabf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2eabf500) returned 0x0 [0188.168] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.168] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2eabf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2eabf500) returned 0x0 [0188.173] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.278] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.278] WriteFile (in: hFile=0x22f4, lpBuffer=0x2eabfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2eabf830, lpOverlapped=0x0 | out: lpBuffer=0x2eabfb34*, lpNumberOfBytesWritten=0x2eabf830*=0x428, lpOverlapped=0x0) returned 1 [0188.279] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.279] ReadFile (in: hFile=0x22f4, lpBuffer=0x4050000, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x2eabf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2eabf61c*=0x9e8a, lpOverlapped=0x0) returned 1 [0188.280] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xffff6176, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.280] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4050000, cbInput=0x9e8a, pPaddingInfo=0x0, pbIV=0x2eabf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2eabf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2eabf848, pbOutput=0x4050000, pcbResult=0x2eabf618) returned 0x0 [0188.280] WriteFile (in: hFile=0x22f4, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x2eabf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2eabf61c*=0x9e90, lpOverlapped=0x0) returned 1 [0188.280] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eabf60c | out: lpNewFilePointer=0x0) returned 1 [0188.281] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.281] WriteFile (in: hFile=0x22f4, lpBuffer=0x2eabf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2eabf61c, lpOverlapped=0x0 | out: lpBuffer=0x2eabf83c*, lpNumberOfBytesWritten=0x2eabf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.281] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x9e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.281] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.281] CloseHandle (hObject=0x22f4) returned 1 [0188.281] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.play")) returned 1 [0188.287] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3048 os_tid = 0x2dec [0188.292] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.292] ReadFile (in: hFile=0x22ec, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.293] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.294] ReadFile (in: hFile=0x22ec, lpBuffer=0x30bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesRead=0x30bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.294] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.297] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.298] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x30bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0188.298] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x30bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x30bbf828, pbKeyObject=0x0) returned 0x0 [0188.298] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30bbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30bbf500) returned 0x0 [0188.298] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.298] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30bbf500) returned 0x0 [0188.303] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.307] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.307] WriteFile (in: hFile=0x22ec, lpBuffer=0x30bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30bbf830, lpOverlapped=0x0 | out: lpBuffer=0x30bbfb34*, lpNumberOfBytesWritten=0x30bbf830*=0x428, lpOverlapped=0x0) returned 1 [0188.307] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.307] ReadFile (in: hFile=0x22ec, lpBuffer=0x4150000, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x30bbf61c*=0x2590, lpOverlapped=0x0) returned 1 [0188.308] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xffffda70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.308] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4150000, cbInput=0x2590, pPaddingInfo=0x0, pbIV=0x30bbf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x30bbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30bbf848, pbOutput=0x4150000, pcbResult=0x30bbf618) returned 0x0 [0188.308] WriteFile (in: hFile=0x22ec, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x25a0, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x30bbf61c*=0x25a0, lpOverlapped=0x0) returned 1 [0188.309] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bbf60c | out: lpNewFilePointer=0x0) returned 1 [0188.309] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.309] WriteFile (in: hFile=0x22ec, lpBuffer=0x30bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30bbf83c*, lpNumberOfBytesWritten=0x30bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.309] SetFilePointerEx (in: hFile=0x22ec, liDistanceToMove=0x25a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.309] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.309] CloseHandle (hObject=0x22ec) returned 1 [0188.309] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.312] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.play")) returned 1 [0188.314] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3049 os_tid = 0x2df0 [0188.366] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.366] ReadFile (in: hFile=0x22d4, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.367] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.367] ReadFile (in: hFile=0x22d4, lpBuffer=0x30cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesRead=0x30cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.367] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.370] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.370] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x30cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0188.370] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x30cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x30cbf828, pbKeyObject=0x0) returned 0x0 [0188.370] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30cbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30cbf500) returned 0x0 [0188.371] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.371] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30cbf500) returned 0x0 [0188.376] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.383] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.383] WriteFile (in: hFile=0x22d4, lpBuffer=0x30cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30cbf830, lpOverlapped=0x0 | out: lpBuffer=0x30cbfb34*, lpNumberOfBytesWritten=0x30cbf830*=0x428, lpOverlapped=0x0) returned 1 [0188.383] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.384] ReadFile (in: hFile=0x22d4, lpBuffer=0x4250000, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x30cbf61c*=0x20e4, lpOverlapped=0x0) returned 1 [0188.384] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xffffdf1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.384] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4250000, cbInput=0x20e4, pPaddingInfo=0x0, pbIV=0x30cbf848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x30cbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30cbf848, pbOutput=0x4250000, pcbResult=0x30cbf618) returned 0x0 [0188.384] WriteFile (in: hFile=0x22d4, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x30cbf61c*=0x20f0, lpOverlapped=0x0) returned 1 [0188.385] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cbf60c | out: lpNewFilePointer=0x0) returned 1 [0188.385] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.385] WriteFile (in: hFile=0x22d4, lpBuffer=0x30cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30cbf83c*, lpNumberOfBytesWritten=0x30cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.385] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x20f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.385] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.385] CloseHandle (hObject=0x22d4) returned 1 [0188.385] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.388] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.play")) returned 1 [0188.390] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3050 os_tid = 0x2df4 [0188.394] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.394] ReadFile (in: hFile=0x22c4, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.395] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.396] ReadFile (in: hFile=0x22c4, lpBuffer=0x30dbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30dbf85c, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesRead=0x30dbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.396] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.399] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x30dbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0188.399] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x30dbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x30dbf828, pbKeyObject=0x0) returned 0x0 [0188.399] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30dbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30dbf500) returned 0x0 [0188.399] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.399] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30dbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30dbf500) returned 0x0 [0188.402] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.405] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.405] WriteFile (in: hFile=0x22c4, lpBuffer=0x30dbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30dbf830, lpOverlapped=0x0 | out: lpBuffer=0x30dbfb34*, lpNumberOfBytesWritten=0x30dbf830*=0x428, lpOverlapped=0x0) returned 1 [0188.405] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.405] ReadFile (in: hFile=0x22c4, lpBuffer=0x4350000, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x30dbf61c*=0x7aa6, lpOverlapped=0x0) returned 1 [0188.406] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xffff855a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.406] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4350000, cbInput=0x7aa6, pPaddingInfo=0x0, pbIV=0x30dbf848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x30dbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30dbf848, pbOutput=0x4350000, pcbResult=0x30dbf618) returned 0x0 [0188.406] WriteFile (in: hFile=0x22c4, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x30dbf61c*=0x7ab0, lpOverlapped=0x0) returned 1 [0188.406] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dbf60c | out: lpNewFilePointer=0x0) returned 1 [0188.407] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.407] WriteFile (in: hFile=0x22c4, lpBuffer=0x30dbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30dbf61c, lpOverlapped=0x0 | out: lpBuffer=0x30dbf83c*, lpNumberOfBytesWritten=0x30dbf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.407] SetFilePointerEx (in: hFile=0x22c4, liDistanceToMove=0x7ab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.407] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.407] CloseHandle (hObject=0x22c4) returned 1 [0188.407] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.play")) returned 1 [0188.411] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3051 os_tid = 0x2df8 [0188.415] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.415] ReadFile (in: hFile=0x2414, lpBuffer=0x30effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30eff85c, lpOverlapped=0x0 | out: lpBuffer=0x30effb34*, lpNumberOfBytesRead=0x30eff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.416] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.416] ReadFile (in: hFile=0x2414, lpBuffer=0x30effb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x30eff85c, lpOverlapped=0x0 | out: lpBuffer=0x30effb34*, lpNumberOfBytesRead=0x30eff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.416] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.419] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.419] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x30eff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0188.419] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x30eff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x30eff828, pbKeyObject=0x0) returned 0x0 [0188.419] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x30eff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x30eff500) returned 0x0 [0188.419] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.419] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x30eff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x30eff500) returned 0x0 [0188.423] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.426] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.426] WriteFile (in: hFile=0x2414, lpBuffer=0x30effb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x30eff830, lpOverlapped=0x0 | out: lpBuffer=0x30effb34*, lpNumberOfBytesWritten=0x30eff830*=0x428, lpOverlapped=0x0) returned 1 [0188.427] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.427] ReadFile (in: hFile=0x2414, lpBuffer=0x4450000, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x30eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x30eff61c*=0x1b64, lpOverlapped=0x0) returned 1 [0188.428] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xffffe49c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.428] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4450000, cbInput=0x1b64, pPaddingInfo=0x0, pbIV=0x30eff848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x30eff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x30eff848, pbOutput=0x4450000, pcbResult=0x30eff618) returned 0x0 [0188.428] WriteFile (in: hFile=0x2414, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x30eff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x30eff61c*=0x1b70, lpOverlapped=0x0) returned 1 [0188.428] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30eff60c | out: lpNewFilePointer=0x0) returned 1 [0188.428] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.428] WriteFile (in: hFile=0x2414, lpBuffer=0x30eff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x30eff61c, lpOverlapped=0x0 | out: lpBuffer=0x30eff83c*, lpNumberOfBytesWritten=0x30eff61c*=0x8, lpOverlapped=0x0) returned 1 [0188.428] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x1b70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.428] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.428] CloseHandle (hObject=0x2414) returned 1 [0188.428] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.431] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.play")) returned 1 [0188.435] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3052 os_tid = 0x2dfc [0188.427] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.439] ReadFile (in: hFile=0x22ac, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.441] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.441] ReadFile (in: hFile=0x22ac, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.442] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.444] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.445] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x2d7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0188.445] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x2d7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x2d7bf828, pbKeyObject=0x0) returned 0x0 [0188.445] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d7bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d7bf500) returned 0x0 [0188.445] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.445] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d7bf500) returned 0x0 [0188.448] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.451] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.451] WriteFile (in: hFile=0x22ac, lpBuffer=0x2d7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesWritten=0x2d7bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.451] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.451] ReadFile (in: hFile=0x22ac, lpBuffer=0x4550000, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x2d7bf61c*=0x3658, lpOverlapped=0x0) returned 1 [0188.452] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xffffc9a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.452] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4550000, cbInput=0x3658, pPaddingInfo=0x0, pbIV=0x2d7bf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x2d7bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d7bf848, pbOutput=0x4550000, pcbResult=0x2d7bf618) returned 0x0 [0188.452] WriteFile (in: hFile=0x22ac, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x2d7bf61c*=0x3660, lpOverlapped=0x0) returned 1 [0188.452] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.452] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.453] WriteFile (in: hFile=0x22ac, lpBuffer=0x2d7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf83c*, lpNumberOfBytesWritten=0x2d7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.453] SetFilePointerEx (in: hFile=0x22ac, liDistanceToMove=0x3660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.453] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.453] CloseHandle (hObject=0x22ac) returned 1 [0188.453] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.play")) returned 1 [0188.457] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3053 os_tid = 0x2e00 [0188.452] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.460] ReadFile (in: hFile=0x229c, lpBuffer=0x3103fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3103f85c, lpOverlapped=0x0 | out: lpBuffer=0x3103fb34*, lpNumberOfBytesRead=0x3103f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.462] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.462] ReadFile (in: hFile=0x229c, lpBuffer=0x3103fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3103f85c, lpOverlapped=0x0 | out: lpBuffer=0x3103fb34*, lpNumberOfBytesRead=0x3103f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.462] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.464] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.464] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x3103f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0188.464] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x3103f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x3103f828, pbKeyObject=0x0) returned 0x0 [0188.464] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3103f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3103f500) returned 0x0 [0188.464] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.464] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3103f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3103f500) returned 0x0 [0188.468] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.470] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.470] WriteFile (in: hFile=0x229c, lpBuffer=0x3103fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3103f830, lpOverlapped=0x0 | out: lpBuffer=0x3103fb34*, lpNumberOfBytesWritten=0x3103f830*=0x428, lpOverlapped=0x0) returned 1 [0188.470] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.470] ReadFile (in: hFile=0x229c, lpBuffer=0x3050000, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x3103f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x3103f61c*=0x4b56, lpOverlapped=0x0) returned 1 [0188.471] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xffffb4aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.471] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3050000, cbInput=0x4b56, pPaddingInfo=0x0, pbIV=0x3103f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x3103f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3103f848, pbOutput=0x3050000, pcbResult=0x3103f618) returned 0x0 [0188.471] WriteFile (in: hFile=0x229c, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x3103f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x3103f61c*=0x4b60, lpOverlapped=0x0) returned 1 [0188.472] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3103f60c | out: lpNewFilePointer=0x0) returned 1 [0188.472] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.472] WriteFile (in: hFile=0x229c, lpBuffer=0x3103f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3103f61c, lpOverlapped=0x0 | out: lpBuffer=0x3103f83c*, lpNumberOfBytesWritten=0x3103f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.472] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x4b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.472] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.472] CloseHandle (hObject=0x229c) returned 1 [0188.472] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.play")) returned 1 [0188.476] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3054 os_tid = 0x2e04 [0188.479] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.479] ReadFile (in: hFile=0x2078, lpBuffer=0x3657fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3657f85c, lpOverlapped=0x0 | out: lpBuffer=0x3657fb34*, lpNumberOfBytesRead=0x3657f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.481] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.481] ReadFile (in: hFile=0x2078, lpBuffer=0x3657fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3657f85c, lpOverlapped=0x0 | out: lpBuffer=0x3657fb34*, lpNumberOfBytesRead=0x3657f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.484] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.484] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x3657f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0188.484] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x3657f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x3657f828, pbKeyObject=0x0) returned 0x0 [0188.484] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3657f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3657f500) returned 0x0 [0188.484] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.484] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3657f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3657f500) returned 0x0 [0188.487] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.490] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.490] WriteFile (in: hFile=0x2078, lpBuffer=0x3657fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3657f830, lpOverlapped=0x0 | out: lpBuffer=0x3657fb34*, lpNumberOfBytesWritten=0x3657f830*=0x428, lpOverlapped=0x0) returned 1 [0188.491] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.491] ReadFile (in: hFile=0x2078, lpBuffer=0x4650000, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x3657f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x3657f61c*=0x12a6, lpOverlapped=0x0) returned 1 [0188.491] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xffffed5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.491] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4650000, cbInput=0x12a6, pPaddingInfo=0x0, pbIV=0x3657f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x3657f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3657f848, pbOutput=0x4650000, pcbResult=0x3657f618) returned 0x0 [0188.491] WriteFile (in: hFile=0x2078, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x3657f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x3657f61c*=0x12b0, lpOverlapped=0x0) returned 1 [0188.491] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3657f60c | out: lpNewFilePointer=0x0) returned 1 [0188.491] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.491] WriteFile (in: hFile=0x2078, lpBuffer=0x3657f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3657f61c, lpOverlapped=0x0 | out: lpBuffer=0x3657f83c*, lpNumberOfBytesWritten=0x3657f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.491] SetFilePointerEx (in: hFile=0x2078, liDistanceToMove=0x12b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.491] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.491] CloseHandle (hObject=0x2078) returned 1 [0188.491] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.play")) returned 1 [0188.495] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3055 os_tid = 0x2e08 [0188.498] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.499] ReadFile (in: hFile=0x2280, lpBuffer=0x3667fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3667f85c, lpOverlapped=0x0 | out: lpBuffer=0x3667fb34*, lpNumberOfBytesRead=0x3667f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.500] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.500] ReadFile (in: hFile=0x2280, lpBuffer=0x3667fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3667f85c, lpOverlapped=0x0 | out: lpBuffer=0x3667fb34*, lpNumberOfBytesRead=0x3667f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.503] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.503] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x3667f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0188.503] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x3667f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x3667f828, pbKeyObject=0x0) returned 0x0 [0188.503] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3667f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3667f500) returned 0x0 [0188.503] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.503] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3667f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3667f500) returned 0x0 [0188.507] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.509] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.509] WriteFile (in: hFile=0x2280, lpBuffer=0x3667fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3667f830, lpOverlapped=0x0 | out: lpBuffer=0x3667fb34*, lpNumberOfBytesWritten=0x3667f830*=0x428, lpOverlapped=0x0) returned 1 [0188.509] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.509] ReadFile (in: hFile=0x2280, lpBuffer=0x4750000, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x3667f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x3667f61c*=0x17be, lpOverlapped=0x0) returned 1 [0188.510] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xffffe842, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.510] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4750000, cbInput=0x17be, pPaddingInfo=0x0, pbIV=0x3667f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x3667f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3667f848, pbOutput=0x4750000, pcbResult=0x3667f618) returned 0x0 [0188.510] WriteFile (in: hFile=0x2280, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x3667f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x3667f61c*=0x17c0, lpOverlapped=0x0) returned 1 [0188.510] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3667f60c | out: lpNewFilePointer=0x0) returned 1 [0188.510] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.510] WriteFile (in: hFile=0x2280, lpBuffer=0x3667f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3667f61c, lpOverlapped=0x0 | out: lpBuffer=0x3667f83c*, lpNumberOfBytesWritten=0x3667f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.510] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x17c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.510] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.510] CloseHandle (hObject=0x2280) returned 1 [0188.511] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.513] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.play")) returned 1 [0188.514] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3056 os_tid = 0x2e0c [0188.518] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.518] ReadFile (in: hFile=0x2270, lpBuffer=0x3837fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3837f85c, lpOverlapped=0x0 | out: lpBuffer=0x3837fb34*, lpNumberOfBytesRead=0x3837f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.520] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.520] ReadFile (in: hFile=0x2270, lpBuffer=0x3837fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3837f85c, lpOverlapped=0x0 | out: lpBuffer=0x3837fb34*, lpNumberOfBytesRead=0x3837f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.521] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.523] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x3837f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0188.523] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x3837f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x3837f828, pbKeyObject=0x0) returned 0x0 [0188.524] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3837f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3837f500) returned 0x0 [0188.524] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.524] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3837f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3837f500) returned 0x0 [0188.527] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.530] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.530] WriteFile (in: hFile=0x2270, lpBuffer=0x3837fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3837f830, lpOverlapped=0x0 | out: lpBuffer=0x3837fb34*, lpNumberOfBytesWritten=0x3837f830*=0x428, lpOverlapped=0x0) returned 1 [0188.530] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.530] ReadFile (in: hFile=0x2270, lpBuffer=0x4850000, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x3837f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x3837f61c*=0x37de, lpOverlapped=0x0) returned 1 [0188.531] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xffffc822, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.531] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4850000, cbInput=0x37de, pPaddingInfo=0x0, pbIV=0x3837f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x3837f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3837f848, pbOutput=0x4850000, pcbResult=0x3837f618) returned 0x0 [0188.531] WriteFile (in: hFile=0x2270, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x3837f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x3837f61c*=0x37e0, lpOverlapped=0x0) returned 1 [0188.531] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3837f60c | out: lpNewFilePointer=0x0) returned 1 [0188.531] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.531] WriteFile (in: hFile=0x2270, lpBuffer=0x3837f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3837f61c, lpOverlapped=0x0 | out: lpBuffer=0x3837f83c*, lpNumberOfBytesWritten=0x3837f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.531] SetFilePointerEx (in: hFile=0x2270, liDistanceToMove=0x37e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.532] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.532] CloseHandle (hObject=0x2270) returned 1 [0188.532] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.play")) returned 1 [0188.535] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3057 os_tid = 0x2e10 [0188.539] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.539] ReadFile (in: hFile=0x2260, lpBuffer=0x3847fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3847f85c, lpOverlapped=0x0 | out: lpBuffer=0x3847fb34*, lpNumberOfBytesRead=0x3847f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.541] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.541] ReadFile (in: hFile=0x2260, lpBuffer=0x3847fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3847f85c, lpOverlapped=0x0 | out: lpBuffer=0x3847fb34*, lpNumberOfBytesRead=0x3847f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.543] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.543] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x3847f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0188.543] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x3847f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x3847f828, pbKeyObject=0x0) returned 0x0 [0188.543] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3847f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3847f500) returned 0x0 [0188.543] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.543] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3847f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3847f500) returned 0x0 [0188.547] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.549] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.550] WriteFile (in: hFile=0x2260, lpBuffer=0x3847fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3847f830, lpOverlapped=0x0 | out: lpBuffer=0x3847fb34*, lpNumberOfBytesWritten=0x3847f830*=0x428, lpOverlapped=0x0) returned 1 [0188.550] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.550] ReadFile (in: hFile=0x2260, lpBuffer=0x4950000, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x3847f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x3847f61c*=0x6180, lpOverlapped=0x0) returned 1 [0188.551] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xffff9e80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.551] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4950000, cbInput=0x6180, pPaddingInfo=0x0, pbIV=0x3847f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x3847f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3847f848, pbOutput=0x4950000, pcbResult=0x3847f618) returned 0x0 [0188.551] WriteFile (in: hFile=0x2260, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x3847f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x3847f61c*=0x6190, lpOverlapped=0x0) returned 1 [0188.551] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3847f60c | out: lpNewFilePointer=0x0) returned 1 [0188.551] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.551] WriteFile (in: hFile=0x2260, lpBuffer=0x3847f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3847f61c, lpOverlapped=0x0 | out: lpBuffer=0x3847f83c*, lpNumberOfBytesWritten=0x3847f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.551] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x6190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.551] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.551] CloseHandle (hObject=0x2260) returned 1 [0188.551] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.play")) returned 1 [0188.555] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3058 os_tid = 0x2e14 [0188.559] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.559] ReadFile (in: hFile=0x2250, lpBuffer=0x3857fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3857f85c, lpOverlapped=0x0 | out: lpBuffer=0x3857fb34*, lpNumberOfBytesRead=0x3857f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.561] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.561] ReadFile (in: hFile=0x2250, lpBuffer=0x3857fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3857f85c, lpOverlapped=0x0 | out: lpBuffer=0x3857fb34*, lpNumberOfBytesRead=0x3857f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.563] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x3857f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0188.563] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x3857f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x3857f828, pbKeyObject=0x0) returned 0x0 [0188.563] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3857f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3857f500) returned 0x0 [0188.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.563] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3857f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3857f500) returned 0x0 [0188.567] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x2250, lpBuffer=0x3857fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3857f830, lpOverlapped=0x0 | out: lpBuffer=0x3857fb34*, lpNumberOfBytesWritten=0x3857f830*=0x428, lpOverlapped=0x0) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] ReadFile (in: hFile=0x2250, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x3857f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x3857f61c*=0x21b2, lpOverlapped=0x0) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xffffde4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.570] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4a50000, cbInput=0x21b2, pPaddingInfo=0x0, pbIV=0x3857f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x3857f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3857f848, pbOutput=0x4a50000, pcbResult=0x3857f618) returned 0x0 [0188.571] WriteFile (in: hFile=0x2250, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x3857f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x3857f61c*=0x21c0, lpOverlapped=0x0) returned 1 [0188.571] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3857f60c | out: lpNewFilePointer=0x0) returned 1 [0188.571] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.571] WriteFile (in: hFile=0x2250, lpBuffer=0x3857f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3857f61c, lpOverlapped=0x0 | out: lpBuffer=0x3857f83c*, lpNumberOfBytesWritten=0x3857f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.571] SetFilePointerEx (in: hFile=0x2250, liDistanceToMove=0x21c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.571] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.571] CloseHandle (hObject=0x2250) returned 1 [0188.571] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.play")) returned 1 [0188.574] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3059 os_tid = 0x2e18 [0188.578] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.578] ReadFile (in: hFile=0x2058, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.579] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.580] ReadFile (in: hFile=0x2058, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.580] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.583] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.583] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0188.583] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0188.583] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e6bf500) returned 0x0 [0188.583] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.583] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e6bf500) returned 0x0 [0188.586] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.589] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.589] WriteFile (in: hFile=0x2058, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.589] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.590] ReadFile (in: hFile=0x2058, lpBuffer=0x4b50000, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x2e6bf61c*=0xe42c, lpOverlapped=0x0) returned 1 [0188.592] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xffff1bd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.592] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4b50000, cbInput=0xe42c, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2e6bf848, pbOutput=0x4b50000, pcbResult=0x2e6bf618) returned 0x0 [0188.592] WriteFile (in: hFile=0x2058, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x2e6bf61c*=0xe430, lpOverlapped=0x0) returned 1 [0188.593] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.593] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.593] WriteFile (in: hFile=0x2058, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.593] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xe430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.593] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.593] CloseHandle (hObject=0x2058) returned 1 [0188.593] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.play")) returned 1 [0188.597] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3060 os_tid = 0x2e1c [0188.601] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.601] ReadFile (in: hFile=0x2238, lpBuffer=0x3867fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3867f85c, lpOverlapped=0x0 | out: lpBuffer=0x3867fb34*, lpNumberOfBytesRead=0x3867f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.603] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.603] ReadFile (in: hFile=0x2238, lpBuffer=0x3867fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3867f85c, lpOverlapped=0x0 | out: lpBuffer=0x3867fb34*, lpNumberOfBytesRead=0x3867f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.603] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.605] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.605] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x3867f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0188.605] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x3867f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x3867f828, pbKeyObject=0x0) returned 0x0 [0188.605] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3867f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3867f500) returned 0x0 [0188.605] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.605] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3867f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3867f500) returned 0x0 [0188.609] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.611] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.611] WriteFile (in: hFile=0x2238, lpBuffer=0x3867fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3867f830, lpOverlapped=0x0 | out: lpBuffer=0x3867fb34*, lpNumberOfBytesWritten=0x3867f830*=0x428, lpOverlapped=0x0) returned 1 [0188.612] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.612] ReadFile (in: hFile=0x2238, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x3867f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x3867f61c*=0x1088e, lpOverlapped=0x0) returned 1 [0188.613] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0xfffef772, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.613] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3b50000, cbInput=0x1088e, pPaddingInfo=0x0, pbIV=0x3867f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x3867f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3867f848, pbOutput=0x3b50000, pcbResult=0x3867f618) returned 0x0 [0188.613] WriteFile (in: hFile=0x2238, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x3867f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x3867f61c*=0x10890, lpOverlapped=0x0) returned 1 [0188.613] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3867f60c | out: lpNewFilePointer=0x0) returned 1 [0188.613] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.613] WriteFile (in: hFile=0x2238, lpBuffer=0x3867f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3867f61c, lpOverlapped=0x0 | out: lpBuffer=0x3867f83c*, lpNumberOfBytesWritten=0x3867f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.614] SetFilePointerEx (in: hFile=0x2238, liDistanceToMove=0x10890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.614] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.614] CloseHandle (hObject=0x2238) returned 1 [0188.614] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.play")) returned 1 [0188.618] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3061 os_tid = 0x2e20 [0188.612] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.612] ReadFile (in: hFile=0x2228, lpBuffer=0x387bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x387bf85c, lpOverlapped=0x0 | out: lpBuffer=0x387bfb34*, lpNumberOfBytesRead=0x387bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.623] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.623] ReadFile (in: hFile=0x2228, lpBuffer=0x387bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x387bf85c, lpOverlapped=0x0 | out: lpBuffer=0x387bfb34*, lpNumberOfBytesRead=0x387bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.623] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.626] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.626] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x387bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0188.626] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x387bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x387bf828, pbKeyObject=0x0) returned 0x0 [0188.626] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x387bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x387bf500) returned 0x0 [0188.626] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.626] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x387bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x387bf500) returned 0x0 [0188.629] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.632] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.632] WriteFile (in: hFile=0x2228, lpBuffer=0x387bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x387bf830, lpOverlapped=0x0 | out: lpBuffer=0x387bfb34*, lpNumberOfBytesWritten=0x387bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.633] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.633] ReadFile (in: hFile=0x2228, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x387bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x387bf61c*=0x107ec, lpOverlapped=0x0) returned 1 [0188.634] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffef814, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.634] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4c50000, cbInput=0x107ec, pPaddingInfo=0x0, pbIV=0x387bf848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x387bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x387bf848, pbOutput=0x4c50000, pcbResult=0x387bf618) returned 0x0 [0188.634] WriteFile (in: hFile=0x2228, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x387bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x387bf61c*=0x107f0, lpOverlapped=0x0) returned 1 [0188.634] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x387bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.634] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.634] WriteFile (in: hFile=0x2228, lpBuffer=0x387bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x387bf61c, lpOverlapped=0x0 | out: lpBuffer=0x387bf83c*, lpNumberOfBytesWritten=0x387bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.634] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x107f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.634] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.634] CloseHandle (hObject=0x2228) returned 1 [0188.635] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.play")) returned 1 [0188.638] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3062 os_tid = 0x2e24 [0188.642] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.642] ReadFile (in: hFile=0x2218, lpBuffer=0x388ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x388ff85c, lpOverlapped=0x0 | out: lpBuffer=0x388ffb34*, lpNumberOfBytesRead=0x388ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.643] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.643] ReadFile (in: hFile=0x2218, lpBuffer=0x388ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x388ff85c, lpOverlapped=0x0 | out: lpBuffer=0x388ffb34*, lpNumberOfBytesRead=0x388ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.643] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.646] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.646] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x388ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0188.646] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x388ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x388ff828, pbKeyObject=0x0) returned 0x0 [0188.646] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x388ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x388ff500) returned 0x0 [0188.646] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.646] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x388ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x388ff500) returned 0x0 [0188.650] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.652] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.652] WriteFile (in: hFile=0x2218, lpBuffer=0x388ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x388ff830, lpOverlapped=0x0 | out: lpBuffer=0x388ffb34*, lpNumberOfBytesWritten=0x388ff830*=0x428, lpOverlapped=0x0) returned 1 [0188.653] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.653] ReadFile (in: hFile=0x2218, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x388ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x388ff61c*=0x59ce, lpOverlapped=0x0) returned 1 [0188.653] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xffffa632, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.654] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4d50000, cbInput=0x59ce, pPaddingInfo=0x0, pbIV=0x388ff848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x388ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x388ff848, pbOutput=0x4d50000, pcbResult=0x388ff618) returned 0x0 [0188.654] WriteFile (in: hFile=0x2218, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x388ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x388ff61c*=0x59d0, lpOverlapped=0x0) returned 1 [0188.654] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x388ff60c | out: lpNewFilePointer=0x0) returned 1 [0188.654] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.654] WriteFile (in: hFile=0x2218, lpBuffer=0x388ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x388ff61c, lpOverlapped=0x0 | out: lpBuffer=0x388ff83c*, lpNumberOfBytesWritten=0x388ff61c*=0x8, lpOverlapped=0x0) returned 1 [0188.654] SetFilePointerEx (in: hFile=0x2218, liDistanceToMove=0x59d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.654] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.654] CloseHandle (hObject=0x2218) returned 1 [0188.654] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.play")) returned 1 [0188.658] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3063 os_tid = 0x2e28 [0188.663] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.663] ReadFile (in: hFile=0x2208, lpBuffer=0x38a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38a3fb34*, lpNumberOfBytesRead=0x38a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.664] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.664] ReadFile (in: hFile=0x2208, lpBuffer=0x38a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38a3fb34*, lpNumberOfBytesRead=0x38a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.664] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.667] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.667] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x38a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0188.667] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x38a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x38a3f828, pbKeyObject=0x0) returned 0x0 [0188.667] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38a3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38a3f500) returned 0x0 [0188.667] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.667] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38a3f500) returned 0x0 [0188.671] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.673] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.673] WriteFile (in: hFile=0x2208, lpBuffer=0x38a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38a3f830, lpOverlapped=0x0 | out: lpBuffer=0x38a3fb34*, lpNumberOfBytesWritten=0x38a3f830*=0x428, lpOverlapped=0x0) returned 1 [0188.674] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.674] ReadFile (in: hFile=0x2208, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x38a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x38a3f61c*=0x3d24, lpOverlapped=0x0) returned 1 [0188.675] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xffffc2dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.675] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4e50000, cbInput=0x3d24, pPaddingInfo=0x0, pbIV=0x38a3f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x38a3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38a3f848, pbOutput=0x4e50000, pcbResult=0x38a3f618) returned 0x0 [0188.675] WriteFile (in: hFile=0x2208, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x38a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x38a3f61c*=0x3d30, lpOverlapped=0x0) returned 1 [0188.675] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38a3f60c | out: lpNewFilePointer=0x0) returned 1 [0188.675] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.675] WriteFile (in: hFile=0x2208, lpBuffer=0x38a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x38a3f83c*, lpNumberOfBytesWritten=0x38a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.675] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x3d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.675] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.675] CloseHandle (hObject=0x2208) returned 1 [0188.675] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.play")) returned 1 [0188.679] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3064 os_tid = 0x2e2c [0188.683] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.683] ReadFile (in: hFile=0x21fc, lpBuffer=0x38b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x38b7fb34*, lpNumberOfBytesRead=0x38b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.685] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.685] ReadFile (in: hFile=0x21fc, lpBuffer=0x38b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x38b7fb34*, lpNumberOfBytesRead=0x38b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.685] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.687] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.687] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x38b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0188.687] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x38b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x38b7f828, pbKeyObject=0x0) returned 0x0 [0188.687] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38b7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38b7f500) returned 0x0 [0188.687] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.687] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38b7f500) returned 0x0 [0188.691] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.695] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.695] WriteFile (in: hFile=0x21fc, lpBuffer=0x38b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38b7f830, lpOverlapped=0x0 | out: lpBuffer=0x38b7fb34*, lpNumberOfBytesWritten=0x38b7f830*=0x428, lpOverlapped=0x0) returned 1 [0188.695] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.695] ReadFile (in: hFile=0x21fc, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x38b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x38b7f61c*=0x4236, lpOverlapped=0x0) returned 1 [0188.696] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xffffbdca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.696] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x4f50000, cbInput=0x4236, pPaddingInfo=0x0, pbIV=0x38b7f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x38b7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38b7f848, pbOutput=0x4f50000, pcbResult=0x38b7f618) returned 0x0 [0188.696] WriteFile (in: hFile=0x21fc, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x38b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x38b7f61c*=0x4240, lpOverlapped=0x0) returned 1 [0188.696] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38b7f60c | out: lpNewFilePointer=0x0) returned 1 [0188.696] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.696] WriteFile (in: hFile=0x21fc, lpBuffer=0x38b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x38b7f83c*, lpNumberOfBytesWritten=0x38b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.696] SetFilePointerEx (in: hFile=0x21fc, liDistanceToMove=0x4240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.696] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.696] CloseHandle (hObject=0x21fc) returned 1 [0188.696] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.play")) returned 1 [0188.700] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3065 os_tid = 0x2e30 [0188.703] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.704] ReadFile (in: hFile=0x21ec, lpBuffer=0x38cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x38cbfb34*, lpNumberOfBytesRead=0x38cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.705] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.705] ReadFile (in: hFile=0x21ec, lpBuffer=0x38cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x38cbfb34*, lpNumberOfBytesRead=0x38cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.705] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.707] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.707] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x38cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0188.707] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x38cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x38cbf828, pbKeyObject=0x0) returned 0x0 [0188.707] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38cbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38cbf500) returned 0x0 [0188.708] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.708] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38cbf500) returned 0x0 [0188.711] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.714] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.714] WriteFile (in: hFile=0x21ec, lpBuffer=0x38cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38cbf830, lpOverlapped=0x0 | out: lpBuffer=0x38cbfb34*, lpNumberOfBytesWritten=0x38cbf830*=0x428, lpOverlapped=0x0) returned 1 [0188.714] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.714] ReadFile (in: hFile=0x21ec, lpBuffer=0x5050000, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x38cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x38cbf61c*=0x3c9c, lpOverlapped=0x0) returned 1 [0188.715] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xffffc364, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.715] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5050000, cbInput=0x3c9c, pPaddingInfo=0x0, pbIV=0x38cbf848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x38cbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38cbf848, pbOutput=0x5050000, pcbResult=0x38cbf618) returned 0x0 [0188.715] WriteFile (in: hFile=0x21ec, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x38cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x38cbf61c*=0x3ca0, lpOverlapped=0x0) returned 1 [0188.715] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cbf60c | out: lpNewFilePointer=0x0) returned 1 [0188.715] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.715] WriteFile (in: hFile=0x21ec, lpBuffer=0x38cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x38cbf83c*, lpNumberOfBytesWritten=0x38cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.715] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x3ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.715] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.715] CloseHandle (hObject=0x21ec) returned 1 [0188.716] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.play")) returned 1 [0188.719] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3066 os_tid = 0x2e34 [0188.723] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.723] ReadFile (in: hFile=0x21dc, lpBuffer=0x38dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38dff85c, lpOverlapped=0x0 | out: lpBuffer=0x38dffb34*, lpNumberOfBytesRead=0x38dff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.725] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.725] ReadFile (in: hFile=0x21dc, lpBuffer=0x38dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38dff85c, lpOverlapped=0x0 | out: lpBuffer=0x38dffb34*, lpNumberOfBytesRead=0x38dff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.725] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.727] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x38dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0188.727] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x38dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x38dff828, pbKeyObject=0x0) returned 0x0 [0188.727] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38dff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38dff500) returned 0x0 [0188.727] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.727] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38dff500) returned 0x0 [0188.730] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.733] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.733] WriteFile (in: hFile=0x21dc, lpBuffer=0x38dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38dff830, lpOverlapped=0x0 | out: lpBuffer=0x38dffb34*, lpNumberOfBytesWritten=0x38dff830*=0x428, lpOverlapped=0x0) returned 1 [0188.733] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.733] ReadFile (in: hFile=0x21dc, lpBuffer=0x5150000, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x38dff61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x38dff61c*=0x493e, lpOverlapped=0x0) returned 1 [0188.734] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xffffb6c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.734] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5150000, cbInput=0x493e, pPaddingInfo=0x0, pbIV=0x38dff848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x38dff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38dff848, pbOutput=0x5150000, pcbResult=0x38dff618) returned 0x0 [0188.734] WriteFile (in: hFile=0x21dc, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x38dff61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x38dff61c*=0x4940, lpOverlapped=0x0) returned 1 [0188.734] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dff60c | out: lpNewFilePointer=0x0) returned 1 [0188.734] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.734] WriteFile (in: hFile=0x21dc, lpBuffer=0x38dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38dff61c, lpOverlapped=0x0 | out: lpBuffer=0x38dff83c*, lpNumberOfBytesWritten=0x38dff61c*=0x8, lpOverlapped=0x0) returned 1 [0188.735] SetFilePointerEx (in: hFile=0x21dc, liDistanceToMove=0x4940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.735] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.735] CloseHandle (hObject=0x21dc) returned 1 [0188.735] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.play")) returned 1 [0188.738] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3067 os_tid = 0x2e38 [0188.742] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.742] ReadFile (in: hFile=0x21cc, lpBuffer=0x38f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38f3fb34*, lpNumberOfBytesRead=0x38f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.743] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.743] ReadFile (in: hFile=0x21cc, lpBuffer=0x38f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x38f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x38f3fb34*, lpNumberOfBytesRead=0x38f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.744] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.746] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.746] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x38f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0188.746] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x38f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x38f3f828, pbKeyObject=0x0) returned 0x0 [0188.746] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x38f3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x38f3f500) returned 0x0 [0188.746] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.746] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x38f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x38f3f500) returned 0x0 [0188.749] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.752] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.752] WriteFile (in: hFile=0x21cc, lpBuffer=0x38f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x38f3f830, lpOverlapped=0x0 | out: lpBuffer=0x38f3fb34*, lpNumberOfBytesWritten=0x38f3f830*=0x428, lpOverlapped=0x0) returned 1 [0188.752] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.752] ReadFile (in: hFile=0x21cc, lpBuffer=0x5250000, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x38f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x38f3f61c*=0x4960, lpOverlapped=0x0) returned 1 [0188.753] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xffffb6a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.753] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5250000, cbInput=0x4960, pPaddingInfo=0x0, pbIV=0x38f3f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x38f3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x38f3f848, pbOutput=0x5250000, pcbResult=0x38f3f618) returned 0x0 [0188.753] WriteFile (in: hFile=0x21cc, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x4970, lpNumberOfBytesWritten=0x38f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x38f3f61c*=0x4970, lpOverlapped=0x0) returned 1 [0188.753] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38f3f60c | out: lpNewFilePointer=0x0) returned 1 [0188.753] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.753] WriteFile (in: hFile=0x21cc, lpBuffer=0x38f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x38f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x38f3f83c*, lpNumberOfBytesWritten=0x38f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.754] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x4970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.754] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.754] CloseHandle (hObject=0x21cc) returned 1 [0188.754] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.756] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.play")) returned 1 [0188.758] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3068 os_tid = 0x2e3c [0188.761] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.761] ReadFile (in: hFile=0x21bc, lpBuffer=0x3907fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3907f85c, lpOverlapped=0x0 | out: lpBuffer=0x3907fb34*, lpNumberOfBytesRead=0x3907f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.762] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.763] ReadFile (in: hFile=0x21bc, lpBuffer=0x3907fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3907f85c, lpOverlapped=0x0 | out: lpBuffer=0x3907fb34*, lpNumberOfBytesRead=0x3907f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.763] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.765] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.765] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x3907f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0188.765] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x3907f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x3907f828, pbKeyObject=0x0) returned 0x0 [0188.765] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3907f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3907f500) returned 0x0 [0188.765] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.766] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3907f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3907f500) returned 0x0 [0188.769] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.771] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.771] WriteFile (in: hFile=0x21bc, lpBuffer=0x3907fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3907f830, lpOverlapped=0x0 | out: lpBuffer=0x3907fb34*, lpNumberOfBytesWritten=0x3907f830*=0x428, lpOverlapped=0x0) returned 1 [0188.772] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.772] ReadFile (in: hFile=0x21bc, lpBuffer=0x5350000, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x3907f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x3907f61c*=0x4584, lpOverlapped=0x0) returned 1 [0188.772] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xffffba7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.772] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5350000, cbInput=0x4584, pPaddingInfo=0x0, pbIV=0x3907f848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x3907f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3907f848, pbOutput=0x5350000, pcbResult=0x3907f618) returned 0x0 [0188.772] WriteFile (in: hFile=0x21bc, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x3907f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x3907f61c*=0x4590, lpOverlapped=0x0) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3907f60c | out: lpNewFilePointer=0x0) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.773] WriteFile (in: hFile=0x21bc, lpBuffer=0x3907f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3907f61c, lpOverlapped=0x0 | out: lpBuffer=0x3907f83c*, lpNumberOfBytesWritten=0x3907f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x21bc, liDistanceToMove=0x4590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.773] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.773] CloseHandle (hObject=0x21bc) returned 1 [0188.773] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.play")) returned 1 [0188.777] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3069 os_tid = 0x2e40 [0188.781] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.781] ReadFile (in: hFile=0x21ac, lpBuffer=0x391bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x391bf85c, lpOverlapped=0x0 | out: lpBuffer=0x391bfb34*, lpNumberOfBytesRead=0x391bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.782] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.782] ReadFile (in: hFile=0x21ac, lpBuffer=0x391bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x391bf85c, lpOverlapped=0x0 | out: lpBuffer=0x391bfb34*, lpNumberOfBytesRead=0x391bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.782] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.784] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.784] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x391bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0188.784] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x391bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x391bf828, pbKeyObject=0x0) returned 0x0 [0188.785] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x391bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x391bf500) returned 0x0 [0188.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.785] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x391bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x391bf500) returned 0x0 [0188.788] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.791] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.791] WriteFile (in: hFile=0x21ac, lpBuffer=0x391bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x391bf830, lpOverlapped=0x0 | out: lpBuffer=0x391bfb34*, lpNumberOfBytesWritten=0x391bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.791] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.791] ReadFile (in: hFile=0x21ac, lpBuffer=0x5450000, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x391bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x391bf61c*=0x2b0e, lpOverlapped=0x0) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xffffd4f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.792] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5450000, cbInput=0x2b0e, pPaddingInfo=0x0, pbIV=0x391bf848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x391bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x391bf848, pbOutput=0x5450000, pcbResult=0x391bf618) returned 0x0 [0188.792] WriteFile (in: hFile=0x21ac, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x391bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x391bf61c*=0x2b10, lpOverlapped=0x0) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.792] WriteFile (in: hFile=0x21ac, lpBuffer=0x391bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x391bf61c, lpOverlapped=0x0 | out: lpBuffer=0x391bf83c*, lpNumberOfBytesWritten=0x391bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x2b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.792] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.792] CloseHandle (hObject=0x21ac) returned 1 [0188.792] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.play")) returned 1 [0188.796] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3070 os_tid = 0x2e44 [0188.800] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.800] ReadFile (in: hFile=0x2154, lpBuffer=0x392ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x392ff85c, lpOverlapped=0x0 | out: lpBuffer=0x392ffb34*, lpNumberOfBytesRead=0x392ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.801] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.801] ReadFile (in: hFile=0x2154, lpBuffer=0x392ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x392ff85c, lpOverlapped=0x0 | out: lpBuffer=0x392ffb34*, lpNumberOfBytesRead=0x392ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.801] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.803] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.803] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x392ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0188.803] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x392ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x392ff828, pbKeyObject=0x0) returned 0x0 [0188.803] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x392ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x392ff500) returned 0x0 [0188.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.804] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x392ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x392ff500) returned 0x0 [0188.807] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.809] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.809] WriteFile (in: hFile=0x2154, lpBuffer=0x392ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x392ff830, lpOverlapped=0x0 | out: lpBuffer=0x392ffb34*, lpNumberOfBytesWritten=0x392ff830*=0x428, lpOverlapped=0x0) returned 1 [0188.810] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.810] ReadFile (in: hFile=0x2154, lpBuffer=0x5550000, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x392ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x392ff61c*=0x2ae8, lpOverlapped=0x0) returned 1 [0188.810] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0xffffd518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.810] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5550000, cbInput=0x2ae8, pPaddingInfo=0x0, pbIV=0x392ff848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x392ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x392ff848, pbOutput=0x5550000, pcbResult=0x392ff618) returned 0x0 [0188.810] WriteFile (in: hFile=0x2154, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x392ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x392ff61c*=0x2af0, lpOverlapped=0x0) returned 1 [0188.810] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x392ff60c | out: lpNewFilePointer=0x0) returned 1 [0188.811] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.811] WriteFile (in: hFile=0x2154, lpBuffer=0x392ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x392ff61c, lpOverlapped=0x0 | out: lpBuffer=0x392ff83c*, lpNumberOfBytesWritten=0x392ff61c*=0x8, lpOverlapped=0x0) returned 1 [0188.811] SetFilePointerEx (in: hFile=0x2154, liDistanceToMove=0x2af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.811] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.811] CloseHandle (hObject=0x2154) returned 1 [0188.811] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.play")) returned 1 [0188.814] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3071 os_tid = 0x2e48 [0188.818] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.818] ReadFile (in: hFile=0x214c, lpBuffer=0x3943fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3943f85c, lpOverlapped=0x0 | out: lpBuffer=0x3943fb34*, lpNumberOfBytesRead=0x3943f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.819] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.820] ReadFile (in: hFile=0x214c, lpBuffer=0x3943fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3943f85c, lpOverlapped=0x0 | out: lpBuffer=0x3943fb34*, lpNumberOfBytesRead=0x3943f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.820] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.822] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.822] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x3943f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0188.822] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x3943f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x3943f828, pbKeyObject=0x0) returned 0x0 [0188.822] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3943f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3943f500) returned 0x0 [0188.822] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.822] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3943f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3943f500) returned 0x0 [0188.825] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.828] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x214c, lpBuffer=0x3943fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3943f830, lpOverlapped=0x0 | out: lpBuffer=0x3943fb34*, lpNumberOfBytesWritten=0x3943f830*=0x428, lpOverlapped=0x0) returned 1 [0188.828] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.828] ReadFile (in: hFile=0x214c, lpBuffer=0x5650000, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x3943f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x3943f61c*=0x4a5a, lpOverlapped=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xffffb5a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.829] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5650000, cbInput=0x4a5a, pPaddingInfo=0x0, pbIV=0x3943f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x3943f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3943f848, pbOutput=0x5650000, pcbResult=0x3943f618) returned 0x0 [0188.829] WriteFile (in: hFile=0x214c, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x3943f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x3943f61c*=0x4a60, lpOverlapped=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3943f60c | out: lpNewFilePointer=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.829] WriteFile (in: hFile=0x214c, lpBuffer=0x3943f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3943f61c, lpOverlapped=0x0 | out: lpBuffer=0x3943f83c*, lpNumberOfBytesWritten=0x3943f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x4a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.829] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.829] CloseHandle (hObject=0x214c) returned 1 [0188.829] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.play")) returned 1 [0188.833] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3072 os_tid = 0x2e4c [0188.836] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.836] ReadFile (in: hFile=0x2144, lpBuffer=0x3957fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3957f85c, lpOverlapped=0x0 | out: lpBuffer=0x3957fb34*, lpNumberOfBytesRead=0x3957f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.838] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.838] ReadFile (in: hFile=0x2144, lpBuffer=0x3957fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3957f85c, lpOverlapped=0x0 | out: lpBuffer=0x3957fb34*, lpNumberOfBytesRead=0x3957f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.840] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.840] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x3957f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0188.840] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x3957f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x3957f828, pbKeyObject=0x0) returned 0x0 [0188.840] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3957f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3957f500) returned 0x0 [0188.840] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.840] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3957f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3957f500) returned 0x0 [0188.843] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.845] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.846] WriteFile (in: hFile=0x2144, lpBuffer=0x3957fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3957f830, lpOverlapped=0x0 | out: lpBuffer=0x3957fb34*, lpNumberOfBytesWritten=0x3957f830*=0x428, lpOverlapped=0x0) returned 1 [0188.846] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.846] ReadFile (in: hFile=0x2144, lpBuffer=0x5750000, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x3957f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x3957f61c*=0x4dfa, lpOverlapped=0x0) returned 1 [0188.847] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0xffffb206, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.847] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5750000, cbInput=0x4dfa, pPaddingInfo=0x0, pbIV=0x3957f848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x3957f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3957f848, pbOutput=0x5750000, pcbResult=0x3957f618) returned 0x0 [0188.847] WriteFile (in: hFile=0x2144, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3957f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x3957f61c*=0x4e00, lpOverlapped=0x0) returned 1 [0188.847] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3957f60c | out: lpNewFilePointer=0x0) returned 1 [0188.847] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.847] WriteFile (in: hFile=0x2144, lpBuffer=0x3957f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3957f61c, lpOverlapped=0x0 | out: lpBuffer=0x3957f83c*, lpNumberOfBytesWritten=0x3957f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.847] SetFilePointerEx (in: hFile=0x2144, liDistanceToMove=0x4e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.847] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.847] CloseHandle (hObject=0x2144) returned 1 [0188.847] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.860] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.play")) returned 1 [0188.862] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3073 os_tid = 0x2e50 [0188.867] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.868] ReadFile (in: hFile=0x213c, lpBuffer=0x396bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x396bf85c, lpOverlapped=0x0 | out: lpBuffer=0x396bfb34*, lpNumberOfBytesRead=0x396bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.869] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.869] ReadFile (in: hFile=0x213c, lpBuffer=0x396bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x396bf85c, lpOverlapped=0x0 | out: lpBuffer=0x396bfb34*, lpNumberOfBytesRead=0x396bf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.869] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.872] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.872] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x396bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0188.872] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x396bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x396bf828, pbKeyObject=0x0) returned 0x0 [0188.872] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x396bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x396bf500) returned 0x0 [0188.872] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.872] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x396bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x396bf500) returned 0x0 [0188.875] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.878] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.878] WriteFile (in: hFile=0x213c, lpBuffer=0x396bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x396bf830, lpOverlapped=0x0 | out: lpBuffer=0x396bfb34*, lpNumberOfBytesWritten=0x396bf830*=0x428, lpOverlapped=0x0) returned 1 [0188.878] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.878] ReadFile (in: hFile=0x213c, lpBuffer=0x5850000, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x396bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x396bf61c*=0xe20, lpOverlapped=0x0) returned 1 [0188.878] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffff1e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.879] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5850000, cbInput=0xe20, pPaddingInfo=0x0, pbIV=0x396bf848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x396bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x396bf848, pbOutput=0x5850000, pcbResult=0x396bf618) returned 0x0 [0188.879] WriteFile (in: hFile=0x213c, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x396bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x396bf61c*=0xe30, lpOverlapped=0x0) returned 1 [0188.879] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x396bf60c | out: lpNewFilePointer=0x0) returned 1 [0188.879] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.879] WriteFile (in: hFile=0x213c, lpBuffer=0x396bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x396bf61c, lpOverlapped=0x0 | out: lpBuffer=0x396bf83c*, lpNumberOfBytesWritten=0x396bf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.879] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xe30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.879] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.879] CloseHandle (hObject=0x213c) returned 1 [0188.879] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.play")) returned 1 [0188.883] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3074 os_tid = 0x2e54 [0188.886] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.886] ReadFile (in: hFile=0x2134, lpBuffer=0x397ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x397ff85c, lpOverlapped=0x0 | out: lpBuffer=0x397ffb34*, lpNumberOfBytesRead=0x397ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.889] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.889] ReadFile (in: hFile=0x2134, lpBuffer=0x397ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x397ff85c, lpOverlapped=0x0 | out: lpBuffer=0x397ffb34*, lpNumberOfBytesRead=0x397ff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.889] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.891] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.891] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x397ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0188.892] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x397ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x397ff828, pbKeyObject=0x0) returned 0x0 [0188.892] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x397ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x397ff500) returned 0x0 [0188.892] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.892] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x397ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x397ff500) returned 0x0 [0188.895] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.906] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.906] WriteFile (in: hFile=0x2134, lpBuffer=0x397ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x397ff830, lpOverlapped=0x0 | out: lpBuffer=0x397ffb34*, lpNumberOfBytesWritten=0x397ff830*=0x428, lpOverlapped=0x0) returned 1 [0188.907] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.907] ReadFile (in: hFile=0x2134, lpBuffer=0x5950000, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x397ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x397ff61c*=0x103e, lpOverlapped=0x0) returned 1 [0188.907] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0xffffefc2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.907] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5950000, cbInput=0x103e, pPaddingInfo=0x0, pbIV=0x397ff848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x397ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x397ff848, pbOutput=0x5950000, pcbResult=0x397ff618) returned 0x0 [0188.907] WriteFile (in: hFile=0x2134, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x397ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x397ff61c*=0x1040, lpOverlapped=0x0) returned 1 [0188.907] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397ff60c | out: lpNewFilePointer=0x0) returned 1 [0188.907] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.907] WriteFile (in: hFile=0x2134, lpBuffer=0x397ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x397ff61c, lpOverlapped=0x0 | out: lpBuffer=0x397ff83c*, lpNumberOfBytesWritten=0x397ff61c*=0x8, lpOverlapped=0x0) returned 1 [0188.907] SetFilePointerEx (in: hFile=0x2134, liDistanceToMove=0x1040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.907] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.907] CloseHandle (hObject=0x2134) returned 1 [0188.907] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.play")) returned 1 [0188.912] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3075 os_tid = 0x2e58 [0188.916] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.916] ReadFile (in: hFile=0x1dc0, lpBuffer=0x3993fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3993f85c, lpOverlapped=0x0 | out: lpBuffer=0x3993fb34*, lpNumberOfBytesRead=0x3993f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.918] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.918] ReadFile (in: hFile=0x1dc0, lpBuffer=0x3993fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3993f85c, lpOverlapped=0x0 | out: lpBuffer=0x3993fb34*, lpNumberOfBytesRead=0x3993f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.918] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.920] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.920] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x3993f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0188.920] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x3993f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x3993f828, pbKeyObject=0x0) returned 0x0 [0188.921] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3993f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3993f500) returned 0x0 [0188.921] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.921] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3993f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3993f500) returned 0x0 [0188.924] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.927] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.928] WriteFile (in: hFile=0x1dc0, lpBuffer=0x3993fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3993f830, lpOverlapped=0x0 | out: lpBuffer=0x3993fb34*, lpNumberOfBytesWritten=0x3993f830*=0x428, lpOverlapped=0x0) returned 1 [0188.928] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.928] ReadFile (in: hFile=0x1dc0, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x3993f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x3993f61c*=0x4a0e, lpOverlapped=0x0) returned 1 [0188.929] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xffffb5f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.929] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5a50000, cbInput=0x4a0e, pPaddingInfo=0x0, pbIV=0x3993f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x3993f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3993f848, pbOutput=0x5a50000, pcbResult=0x3993f618) returned 0x0 [0188.929] WriteFile (in: hFile=0x1dc0, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x3993f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x3993f61c*=0x4a10, lpOverlapped=0x0) returned 1 [0188.929] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3993f60c | out: lpNewFilePointer=0x0) returned 1 [0188.929] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.929] WriteFile (in: hFile=0x1dc0, lpBuffer=0x3993f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3993f61c, lpOverlapped=0x0 | out: lpBuffer=0x3993f83c*, lpNumberOfBytesWritten=0x3993f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.929] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x4a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.929] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.929] CloseHandle (hObject=0x1dc0) returned 1 [0188.930] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.932] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.play")) returned 1 [0188.933] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3076 os_tid = 0x2e5c [0188.937] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.937] ReadFile (in: hFile=0x1c20, lpBuffer=0x39a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x39a7fb34*, lpNumberOfBytesRead=0x39a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.939] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.939] ReadFile (in: hFile=0x1c20, lpBuffer=0x39a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x39a7fb34*, lpNumberOfBytesRead=0x39a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0188.939] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.941] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.941] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x39a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0188.941] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x39a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x39a7f828, pbKeyObject=0x0) returned 0x0 [0188.941] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39a7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39a7f500) returned 0x0 [0188.942] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.942] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39a7f500) returned 0x0 [0188.945] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.948] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.948] WriteFile (in: hFile=0x1c20, lpBuffer=0x39a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39a7f830, lpOverlapped=0x0 | out: lpBuffer=0x39a7fb34*, lpNumberOfBytesWritten=0x39a7f830*=0x428, lpOverlapped=0x0) returned 1 [0188.949] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.949] ReadFile (in: hFile=0x1c20, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x39a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x39a7f61c*=0x2cf8, lpOverlapped=0x0) returned 1 [0188.949] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xffffd308, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.949] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5b50000, cbInput=0x2cf8, pPaddingInfo=0x0, pbIV=0x39a7f848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x39a7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39a7f848, pbOutput=0x5b50000, pcbResult=0x39a7f618) returned 0x0 [0188.950] WriteFile (in: hFile=0x1c20, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x39a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x39a7f61c*=0x2d00, lpOverlapped=0x0) returned 1 [0188.950] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39a7f60c | out: lpNewFilePointer=0x0) returned 1 [0188.950] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.950] WriteFile (in: hFile=0x1c20, lpBuffer=0x39a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x39a7f83c*, lpNumberOfBytesWritten=0x39a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0188.950] SetFilePointerEx (in: hFile=0x1c20, liDistanceToMove=0x2d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.950] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.950] CloseHandle (hObject=0x1c20) returned 1 [0188.950] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.play")) returned 1 [0188.954] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3077 os_tid = 0x2e60 [0188.958] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.958] ReadFile (in: hFile=0x1db8, lpBuffer=0x39bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x39bbfb34*, lpNumberOfBytesRead=0x39bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.960] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.960] ReadFile (in: hFile=0x1db8, lpBuffer=0x39bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x39bbfb34*, lpNumberOfBytesRead=0x39bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0188.960] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.962] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.962] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x39bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0188.962] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x39bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x39bbf828, pbKeyObject=0x0) returned 0x0 [0188.962] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39bbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39bbf500) returned 0x0 [0188.963] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.963] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39bbf500) returned 0x0 [0188.966] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.970] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.970] WriteFile (in: hFile=0x1db8, lpBuffer=0x39bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39bbf830, lpOverlapped=0x0 | out: lpBuffer=0x39bbfb34*, lpNumberOfBytesWritten=0x39bbf830*=0x428, lpOverlapped=0x0) returned 1 [0188.970] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.970] ReadFile (in: hFile=0x1db8, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x39bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x39bbf61c*=0x4f8e, lpOverlapped=0x0) returned 1 [0188.971] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xffffb072, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.971] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5c50000, cbInput=0x4f8e, pPaddingInfo=0x0, pbIV=0x39bbf848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x39bbf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39bbf848, pbOutput=0x5c50000, pcbResult=0x39bbf618) returned 0x0 [0188.971] WriteFile (in: hFile=0x1db8, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x39bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x39bbf61c*=0x4f90, lpOverlapped=0x0) returned 1 [0188.971] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39bbf60c | out: lpNewFilePointer=0x0) returned 1 [0188.971] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.971] WriteFile (in: hFile=0x1db8, lpBuffer=0x39bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x39bbf83c*, lpNumberOfBytesWritten=0x39bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0188.971] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x4f90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.971] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.971] CloseHandle (hObject=0x1db8) returned 1 [0188.972] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.play")) returned 1 [0188.976] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3078 os_tid = 0x2e64 [0188.981] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.982] ReadFile (in: hFile=0x1e04, lpBuffer=0x39cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39cff85c, lpOverlapped=0x0 | out: lpBuffer=0x39cffb34*, lpNumberOfBytesRead=0x39cff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.984] ReadFile (in: hFile=0x1e04, lpBuffer=0x39cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39cff85c, lpOverlapped=0x0 | out: lpBuffer=0x39cffb34*, lpNumberOfBytesRead=0x39cff85c*=0x428, lpOverlapped=0x0) returned 1 [0188.984] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0188.987] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0188.987] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x39cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0188.987] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x39cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x39cff828, pbKeyObject=0x0) returned 0x0 [0188.987] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39cff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39cff500) returned 0x0 [0188.987] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0188.987] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39cff500) returned 0x0 [0188.992] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.995] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.995] WriteFile (in: hFile=0x1e04, lpBuffer=0x39cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39cff830, lpOverlapped=0x0 | out: lpBuffer=0x39cffb34*, lpNumberOfBytesWritten=0x39cff830*=0x428, lpOverlapped=0x0) returned 1 [0188.995] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.995] ReadFile (in: hFile=0x1e04, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x39cff61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x39cff61c*=0x29c4, lpOverlapped=0x0) returned 1 [0188.996] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xffffd63c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.996] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5d50000, cbInput=0x29c4, pPaddingInfo=0x0, pbIV=0x39cff848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x39cff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39cff848, pbOutput=0x5d50000, pcbResult=0x39cff618) returned 0x0 [0188.996] WriteFile (in: hFile=0x1e04, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x39cff61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x39cff61c*=0x29d0, lpOverlapped=0x0) returned 1 [0188.996] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39cff60c | out: lpNewFilePointer=0x0) returned 1 [0188.996] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.996] WriteFile (in: hFile=0x1e04, lpBuffer=0x39cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39cff61c, lpOverlapped=0x0 | out: lpBuffer=0x39cff83c*, lpNumberOfBytesWritten=0x39cff61c*=0x8, lpOverlapped=0x0) returned 1 [0188.996] SetFilePointerEx (in: hFile=0x1e04, liDistanceToMove=0x29d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.996] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0188.996] CloseHandle (hObject=0x1e04) returned 1 [0188.997] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0188.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.play")) returned 1 [0189.000] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3079 os_tid = 0x2e68 [0189.004] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.004] ReadFile (in: hFile=0x1e14, lpBuffer=0x39e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x39e3fb34*, lpNumberOfBytesRead=0x39e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.009] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.009] ReadFile (in: hFile=0x1e14, lpBuffer=0x39e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x39e3fb34*, lpNumberOfBytesRead=0x39e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.010] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.013] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.013] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x39e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0189.013] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x39e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x39e3f828, pbKeyObject=0x0) returned 0x0 [0189.013] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39e3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39e3f500) returned 0x0 [0189.013] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.013] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39e3f500) returned 0x0 [0189.016] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.019] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.019] WriteFile (in: hFile=0x1e14, lpBuffer=0x39e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39e3f830, lpOverlapped=0x0 | out: lpBuffer=0x39e3fb34*, lpNumberOfBytesWritten=0x39e3f830*=0x428, lpOverlapped=0x0) returned 1 [0189.020] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.020] ReadFile (in: hFile=0x1e14, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x39e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x39e3f61c*=0x544c, lpOverlapped=0x0) returned 1 [0189.020] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xffffabb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.020] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5e50000, cbInput=0x544c, pPaddingInfo=0x0, pbIV=0x39e3f848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x39e3f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39e3f848, pbOutput=0x5e50000, pcbResult=0x39e3f618) returned 0x0 [0189.020] WriteFile (in: hFile=0x1e14, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x39e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x39e3f61c*=0x5450, lpOverlapped=0x0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39e3f60c | out: lpNewFilePointer=0x0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.021] WriteFile (in: hFile=0x1e14, lpBuffer=0x39e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x39e3f83c*, lpNumberOfBytesWritten=0x39e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x5450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.021] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.021] CloseHandle (hObject=0x1e14) returned 1 [0189.021] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.play")) returned 1 [0189.025] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3080 os_tid = 0x2e6c [0189.030] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.030] ReadFile (in: hFile=0x1e24, lpBuffer=0x39f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x39f7fb34*, lpNumberOfBytesRead=0x39f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.031] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.031] ReadFile (in: hFile=0x1e24, lpBuffer=0x39f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x39f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x39f7fb34*, lpNumberOfBytesRead=0x39f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.031] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.034] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.034] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x39f7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0189.034] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x39f7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x39f7f828, pbKeyObject=0x0) returned 0x0 [0189.034] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x39f7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x39f7f500) returned 0x0 [0189.034] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.034] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x39f7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x39f7f500) returned 0x0 [0189.037] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.040] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.040] WriteFile (in: hFile=0x1e24, lpBuffer=0x39f7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x39f7f830, lpOverlapped=0x0 | out: lpBuffer=0x39f7fb34*, lpNumberOfBytesWritten=0x39f7f830*=0x428, lpOverlapped=0x0) returned 1 [0189.041] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.041] ReadFile (in: hFile=0x1e24, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x39f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x39f7f61c*=0x9a8b, lpOverlapped=0x0) returned 1 [0189.042] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xffff6575, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.042] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5f50000, cbInput=0x9a8b, pPaddingInfo=0x0, pbIV=0x39f7f848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x39f7f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x39f7f848, pbOutput=0x5f50000, pcbResult=0x39f7f618) returned 0x0 [0189.042] WriteFile (in: hFile=0x1e24, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x39f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x39f7f61c*=0x9a90, lpOverlapped=0x0) returned 1 [0189.042] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39f7f60c | out: lpNewFilePointer=0x0) returned 1 [0189.042] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.042] WriteFile (in: hFile=0x1e24, lpBuffer=0x39f7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x39f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x39f7f83c*, lpNumberOfBytesWritten=0x39f7f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.042] SetFilePointerEx (in: hFile=0x1e24, liDistanceToMove=0x9a90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.042] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.042] CloseHandle (hObject=0x1e24) returned 1 [0189.042] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.play")) returned 1 [0189.046] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3081 os_tid = 0x2e70 [0189.270] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.270] ReadFile (in: hFile=0x1e34, lpBuffer=0x3a0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3a0bfb34*, lpNumberOfBytesRead=0x3a0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.274] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.274] ReadFile (in: hFile=0x1e34, lpBuffer=0x3a0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3a0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3a0bfb34*, lpNumberOfBytesRead=0x3a0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.274] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.279] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.279] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x3a0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0189.279] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x3a0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x3a0bf828, pbKeyObject=0x0) returned 0x0 [0189.279] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3a0bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3a0bf500) returned 0x0 [0189.279] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.280] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3a0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3a0bf500) returned 0x0 [0189.285] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.310] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.310] WriteFile (in: hFile=0x1e34, lpBuffer=0x3a0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3a0bf830, lpOverlapped=0x0 | out: lpBuffer=0x3a0bfb34*, lpNumberOfBytesWritten=0x3a0bf830*=0x428, lpOverlapped=0x0) returned 1 [0189.311] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.311] ReadFile (in: hFile=0x1e34, lpBuffer=0x6050000, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x3a0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x3a0bf61c*=0x81f0, lpOverlapped=0x0) returned 1 [0189.312] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xffff7e10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.312] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x6050000, cbInput=0x81f0, pPaddingInfo=0x0, pbIV=0x3a0bf848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x3a0bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3a0bf848, pbOutput=0x6050000, pcbResult=0x3a0bf618) returned 0x0 [0189.312] WriteFile (in: hFile=0x1e34, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x3a0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x3a0bf61c*=0x8200, lpOverlapped=0x0) returned 1 [0189.312] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0bf60c | out: lpNewFilePointer=0x0) returned 1 [0189.312] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.312] WriteFile (in: hFile=0x1e34, lpBuffer=0x3a0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a0bf83c*, lpNumberOfBytesWritten=0x3a0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0189.312] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x8200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.313] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.313] CloseHandle (hObject=0x1e34) returned 1 [0189.313] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.316] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.play")) returned 1 [0189.318] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3082 os_tid = 0x2e78 [0189.328] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.328] ReadFile (in: hFile=0x1e14, lpBuffer=0x1480fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1480f85c, lpOverlapped=0x0 | out: lpBuffer=0x1480fb34*, lpNumberOfBytesRead=0x1480f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.330] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.331] ReadFile (in: hFile=0x1e14, lpBuffer=0x1480fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1480f85c, lpOverlapped=0x0 | out: lpBuffer=0x1480fb34*, lpNumberOfBytesRead=0x1480f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.331] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.335] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.335] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1480f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0189.335] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1480f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1480f828, pbKeyObject=0x0) returned 0x0 [0189.335] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1480f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1480f500) returned 0x0 [0189.335] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.335] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1480f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1480f500) returned 0x0 [0189.340] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.344] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.344] WriteFile (in: hFile=0x1e14, lpBuffer=0x1480fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1480f830, lpOverlapped=0x0 | out: lpBuffer=0x1480fb34*, lpNumberOfBytesWritten=0x1480f830*=0x428, lpOverlapped=0x0) returned 1 [0189.344] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.344] ReadFile (in: hFile=0x1e14, lpBuffer=0x2750000, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x1480f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1480f61c*=0xaabb, lpOverlapped=0x0) returned 1 [0189.345] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xffff5545, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.345] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2750000, cbInput=0xaabb, pPaddingInfo=0x0, pbIV=0x1480f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1480f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1480f848, pbOutput=0x2750000, pcbResult=0x1480f618) returned 0x0 [0189.345] WriteFile (in: hFile=0x1e14, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x1480f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1480f61c*=0xaac0, lpOverlapped=0x0) returned 1 [0189.346] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1480f60c | out: lpNewFilePointer=0x0) returned 1 [0189.346] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.346] WriteFile (in: hFile=0x1e14, lpBuffer=0x1480f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1480f61c, lpOverlapped=0x0 | out: lpBuffer=0x1480f83c*, lpNumberOfBytesWritten=0x1480f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.346] SetFilePointerEx (in: hFile=0x1e14, liDistanceToMove=0xaac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.346] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.346] CloseHandle (hObject=0x1e14) returned 1 [0189.346] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.play")) returned 1 [0189.351] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3083 os_tid = 0x2e7c [0189.356] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.356] ReadFile (in: hFile=0x1db8, lpBuffer=0x14d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d4fb34*, lpNumberOfBytesRead=0x14d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.357] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.358] ReadFile (in: hFile=0x1db8, lpBuffer=0x14d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d4fb34*, lpNumberOfBytesRead=0x14d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.358] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.360] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.360] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x14d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0189.360] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x14d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x14d4f828, pbKeyObject=0x0) returned 0x0 [0189.361] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x14d4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x14d4f500) returned 0x0 [0189.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.361] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x14d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x14d4f500) returned 0x0 [0189.366] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.386] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.386] WriteFile (in: hFile=0x1db8, lpBuffer=0x14d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14d4f830, lpOverlapped=0x0 | out: lpBuffer=0x14d4fb34*, lpNumberOfBytesWritten=0x14d4f830*=0x428, lpOverlapped=0x0) returned 1 [0189.386] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.386] ReadFile (in: hFile=0x1db8, lpBuffer=0x2850000, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x14d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x14d4f61c*=0x4ada, lpOverlapped=0x0) returned 1 [0189.387] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xffffb526, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.387] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2850000, cbInput=0x4ada, pPaddingInfo=0x0, pbIV=0x14d4f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x14d4f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x14d4f848, pbOutput=0x2850000, pcbResult=0x14d4f618) returned 0x0 [0189.387] WriteFile (in: hFile=0x1db8, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x14d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x14d4f61c*=0x4ae0, lpOverlapped=0x0) returned 1 [0189.387] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14d4f60c | out: lpNewFilePointer=0x0) returned 1 [0189.387] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.388] WriteFile (in: hFile=0x1db8, lpBuffer=0x14d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x14d4f83c*, lpNumberOfBytesWritten=0x14d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.388] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x4ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.388] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.388] CloseHandle (hObject=0x1db8) returned 1 [0189.388] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.play")) returned 1 [0189.393] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3084 os_tid = 0x2e80 [0189.397] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.397] ReadFile (in: hFile=0x1dc0, lpBuffer=0x14e4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14e4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14e4fb34*, lpNumberOfBytesRead=0x14e4f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.399] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.399] ReadFile (in: hFile=0x1dc0, lpBuffer=0x14e4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14e4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14e4fb34*, lpNumberOfBytesRead=0x14e4f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.399] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.402] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.402] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x14e4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0189.402] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x14e4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x14e4f828, pbKeyObject=0x0) returned 0x0 [0189.402] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x14e4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x14e4f500) returned 0x0 [0189.402] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.402] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x14e4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x14e4f500) returned 0x0 [0189.407] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x1dc0, lpBuffer=0x14e4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14e4f830, lpOverlapped=0x0 | out: lpBuffer=0x14e4fb34*, lpNumberOfBytesWritten=0x14e4f830*=0x428, lpOverlapped=0x0) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.411] ReadFile (in: hFile=0x1dc0, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x14e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x14e4f61c*=0x1a00, lpOverlapped=0x0) returned 1 [0189.416] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xffffe600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.416] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2950000, cbInput=0x1a00, pPaddingInfo=0x0, pbIV=0x14e4f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x14e4f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x14e4f848, pbOutput=0x2950000, pcbResult=0x14e4f618) returned 0x0 [0189.416] WriteFile (in: hFile=0x1dc0, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x14e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x14e4f61c*=0x1a10, lpOverlapped=0x0) returned 1 [0189.416] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14e4f60c | out: lpNewFilePointer=0x0) returned 1 [0189.416] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.416] WriteFile (in: hFile=0x1dc0, lpBuffer=0x14e4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x14e4f83c*, lpNumberOfBytesWritten=0x14e4f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.416] SetFilePointerEx (in: hFile=0x1dc0, liDistanceToMove=0x1a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.416] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.416] CloseHandle (hObject=0x1dc0) returned 1 [0189.417] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.play")) returned 1 [0189.421] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3085 os_tid = 0x2e84 [0189.426] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.426] ReadFile (in: hFile=0x213c, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.428] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.428] ReadFile (in: hFile=0x213c, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.428] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.431] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1508f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0189.431] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1508f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1508f828, pbKeyObject=0x0) returned 0x0 [0189.431] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1508f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1508f500) returned 0x0 [0189.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.431] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1508f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1508f500) returned 0x0 [0189.436] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.439] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.440] WriteFile (in: hFile=0x213c, lpBuffer=0x1508fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1508f830, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesWritten=0x1508f830*=0x428, lpOverlapped=0x0) returned 1 [0189.440] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.440] ReadFile (in: hFile=0x213c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1508f61c*=0x20e4, lpOverlapped=0x0) returned 1 [0189.442] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xffffdf1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.442] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2a50000, cbInput=0x20e4, pPaddingInfo=0x0, pbIV=0x1508f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1508f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1508f848, pbOutput=0x2a50000, pcbResult=0x1508f618) returned 0x0 [0189.442] WriteFile (in: hFile=0x213c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1508f61c*=0x20f0, lpOverlapped=0x0) returned 1 [0189.442] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1508f60c | out: lpNewFilePointer=0x0) returned 1 [0189.442] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.442] WriteFile (in: hFile=0x213c, lpBuffer=0x1508f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x1508f83c*, lpNumberOfBytesWritten=0x1508f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.442] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x20f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.442] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.442] CloseHandle (hObject=0x213c) returned 1 [0189.443] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.447] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.play")) returned 1 [0189.448] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3086 os_tid = 0x2e88 [0189.453] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.453] ReadFile (in: hFile=0x214c, lpBuffer=0x1518fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1518f85c, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesRead=0x1518f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.455] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.455] ReadFile (in: hFile=0x214c, lpBuffer=0x1518fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1518f85c, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesRead=0x1518f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.455] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.458] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.458] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1518f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0189.458] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1518f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1518f828, pbKeyObject=0x0) returned 0x0 [0189.458] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1518f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1518f500) returned 0x0 [0189.458] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.458] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1518f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1518f500) returned 0x0 [0189.470] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.474] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.474] WriteFile (in: hFile=0x214c, lpBuffer=0x1518fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1518f830, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesWritten=0x1518f830*=0x428, lpOverlapped=0x0) returned 1 [0189.474] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.474] ReadFile (in: hFile=0x214c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1518f61c*=0x2b38, lpOverlapped=0x0) returned 1 [0189.475] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xffffd4c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.475] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2b50000, cbInput=0x2b38, pPaddingInfo=0x0, pbIV=0x1518f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1518f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1518f848, pbOutput=0x2b50000, pcbResult=0x1518f618) returned 0x0 [0189.475] WriteFile (in: hFile=0x214c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1518f61c*=0x2b40, lpOverlapped=0x0) returned 1 [0189.475] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1518f60c | out: lpNewFilePointer=0x0) returned 1 [0189.475] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.476] WriteFile (in: hFile=0x214c, lpBuffer=0x1518f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x1518f83c*, lpNumberOfBytesWritten=0x1518f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.476] SetFilePointerEx (in: hFile=0x214c, liDistanceToMove=0x2b40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.476] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.476] CloseHandle (hObject=0x214c) returned 1 [0189.476] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.play")) returned 1 [0189.480] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3087 os_tid = 0x2e8c [0189.485] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.485] ReadFile (in: hFile=0x21ac, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.487] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.487] ReadFile (in: hFile=0x21ac, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.487] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.489] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.490] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x152cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0189.490] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x152cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x152cf828, pbKeyObject=0x0) returned 0x0 [0189.490] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x152cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x152cf500) returned 0x0 [0189.490] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.491] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x152cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x152cf500) returned 0x0 [0189.495] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.498] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.498] WriteFile (in: hFile=0x21ac, lpBuffer=0x152cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x152cf830, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesWritten=0x152cf830*=0x428, lpOverlapped=0x0) returned 1 [0189.499] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.499] ReadFile (in: hFile=0x21ac, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x152cf61c*=0x911a, lpOverlapped=0x0) returned 1 [0189.500] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xffff6ee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.500] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2c50000, cbInput=0x911a, pPaddingInfo=0x0, pbIV=0x152cf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x152cf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x152cf848, pbOutput=0x2c50000, pcbResult=0x152cf618) returned 0x0 [0189.500] WriteFile (in: hFile=0x21ac, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x152cf61c*=0x9120, lpOverlapped=0x0) returned 1 [0189.500] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x152cf60c | out: lpNewFilePointer=0x0) returned 1 [0189.500] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.500] WriteFile (in: hFile=0x21ac, lpBuffer=0x152cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x152cf83c*, lpNumberOfBytesWritten=0x152cf61c*=0x8, lpOverlapped=0x0) returned 1 [0189.500] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x9120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.500] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.500] CloseHandle (hObject=0x21ac) returned 1 [0189.511] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.play")) returned 1 [0189.517] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3088 os_tid = 0x2e90 [0189.521] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.521] ReadFile (in: hFile=0x21cc, lpBuffer=0x1540fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1540f85c, lpOverlapped=0x0 | out: lpBuffer=0x1540fb34*, lpNumberOfBytesRead=0x1540f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.523] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.523] ReadFile (in: hFile=0x21cc, lpBuffer=0x1540fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1540f85c, lpOverlapped=0x0 | out: lpBuffer=0x1540fb34*, lpNumberOfBytesRead=0x1540f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.523] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.526] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.526] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1540f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0189.526] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1540f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1540f828, pbKeyObject=0x0) returned 0x0 [0189.527] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1540f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1540f500) returned 0x0 [0189.527] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.527] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1540f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1540f500) returned 0x0 [0189.531] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.535] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.535] WriteFile (in: hFile=0x21cc, lpBuffer=0x1540fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1540f830, lpOverlapped=0x0 | out: lpBuffer=0x1540fb34*, lpNumberOfBytesWritten=0x1540f830*=0x428, lpOverlapped=0x0) returned 1 [0189.535] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.535] ReadFile (in: hFile=0x21cc, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x1540f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1540f61c*=0xa75a, lpOverlapped=0x0) returned 1 [0189.536] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xffff58a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.536] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2d50000, cbInput=0xa75a, pPaddingInfo=0x0, pbIV=0x1540f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1540f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1540f848, pbOutput=0x2d50000, pcbResult=0x1540f618) returned 0x0 [0189.536] WriteFile (in: hFile=0x21cc, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x1540f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1540f61c*=0xa760, lpOverlapped=0x0) returned 1 [0189.536] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1540f60c | out: lpNewFilePointer=0x0) returned 1 [0189.536] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.537] WriteFile (in: hFile=0x21cc, lpBuffer=0x1540f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1540f61c, lpOverlapped=0x0 | out: lpBuffer=0x1540f83c*, lpNumberOfBytesWritten=0x1540f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.537] SetFilePointerEx (in: hFile=0x21cc, liDistanceToMove=0xa760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.537] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0189.537] CloseHandle (hObject=0x21cc) returned 1 [0189.537] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.play")) returned 1 [0189.542] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3089 os_tid = 0x2e94 [0189.547] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.547] ReadFile (in: hFile=0x21ec, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0189.549] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.549] ReadFile (in: hFile=0x21ec, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0189.549] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.561] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.561] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0189.561] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0189.561] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0189.561] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.562] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0189.580] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.075] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.075] WriteFile (in: hFile=0x21ec, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0190.075] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.076] ReadFile (in: hFile=0x21ec, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x219ff61c*=0x81ab, lpOverlapped=0x0) returned 1 [0190.076] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xffff7e55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.077] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2e50000, cbInput=0x81ab, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x219ff848, pbOutput=0x2e50000, pcbResult=0x219ff618) returned 0x0 [0190.077] WriteFile (in: hFile=0x21ec, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x219ff61c*=0x81b0, lpOverlapped=0x0) returned 1 [0190.077] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0190.077] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.077] WriteFile (in: hFile=0x21ec, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0190.077] SetFilePointerEx (in: hFile=0x21ec, liDistanceToMove=0x81b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.077] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0190.077] CloseHandle (hObject=0x21ec) returned 1 [0190.077] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.262] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.play")) returned 1 [0190.264] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3090 os_tid = 0x2e98 [0189.594] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.594] ReadFile (in: hFile=0x2208, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.601] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.601] ReadFile (in: hFile=0x2208, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.602] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.613] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.613] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0189.613] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0189.614] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0189.615] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.615] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0189.632] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.078] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.078] WriteFile (in: hFile=0x2208, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0190.078] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.078] ReadFile (in: hFile=0x2208, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d37f61c*=0xb9d1, lpOverlapped=0x0) returned 1 [0190.079] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xffff462f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.079] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2f50000, cbInput=0xb9d1, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2d37f848, pbOutput=0x2f50000, pcbResult=0x2d37f618) returned 0x0 [0190.079] WriteFile (in: hFile=0x2208, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d37f61c*=0xb9e0, lpOverlapped=0x0) returned 1 [0190.079] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0190.079] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.079] WriteFile (in: hFile=0x2208, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.080] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xb9e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.080] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0190.080] CloseHandle (hObject=0x2208) returned 1 [0190.080] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.play")) returned 1 [0190.275] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3091 os_tid = 0x2e9c [0189.638] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.638] ReadFile (in: hFile=0x2228, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.640] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.649] ReadFile (in: hFile=0x2228, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.649] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.652] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.653] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0189.653] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0189.653] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0189.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.653] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0189.658] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.661] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.661] WriteFile (in: hFile=0x2228, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0189.661] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.661] ReadFile (in: hFile=0x2228, lpBuffer=0x3050000, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d47f61c*=0x40f2, lpOverlapped=0x0) returned 1 [0189.663] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xffffbf0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.663] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3050000, cbInput=0x40f2, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2d47f848, pbOutput=0x3050000, pcbResult=0x2d47f618) returned 0x0 [0189.663] WriteFile (in: hFile=0x2228, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d47f61c*=0x4100, lpOverlapped=0x0) returned 1 [0189.664] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0189.664] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.664] WriteFile (in: hFile=0x2228, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.664] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x4100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.664] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.664] CloseHandle (hObject=0x2228) returned 1 [0189.664] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.play")) returned 1 [0189.669] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3092 os_tid = 0x2ea0 [0189.673] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.673] ReadFile (in: hFile=0x2058, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.675] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.676] ReadFile (in: hFile=0x2058, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.676] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.679] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.679] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0189.679] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0189.679] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0189.679] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.679] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0189.684] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.687] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.687] WriteFile (in: hFile=0x2058, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0189.688] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.688] ReadFile (in: hFile=0x2058, lpBuffer=0x3150000, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d57f61c*=0x4b02, lpOverlapped=0x0) returned 1 [0189.689] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xffffb4fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.689] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3150000, cbInput=0x4b02, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2d57f848, pbOutput=0x3150000, pcbResult=0x2d57f618) returned 0x0 [0189.689] WriteFile (in: hFile=0x2058, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d57f61c*=0x4b10, lpOverlapped=0x0) returned 1 [0189.689] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0189.689] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.689] WriteFile (in: hFile=0x2058, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.689] SetFilePointerEx (in: hFile=0x2058, liDistanceToMove=0x4b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.689] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.689] CloseHandle (hObject=0x2058) returned 1 [0189.690] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.play")) returned 1 [0189.694] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3093 os_tid = 0x2ea4 [0189.688] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.698] ReadFile (in: hFile=0x2260, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.700] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.700] ReadFile (in: hFile=0x2260, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.700] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.703] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.703] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0189.703] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d6bf828, pbKeyObject=0x0) returned 0x0 [0189.703] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d6bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d6bf500) returned 0x0 [0189.703] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.703] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d6bf500) returned 0x0 [0189.708] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.712] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.712] WriteFile (in: hFile=0x2260, lpBuffer=0x2d6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesWritten=0x2d6bf830*=0x428, lpOverlapped=0x0) returned 1 [0189.712] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.712] ReadFile (in: hFile=0x2260, lpBuffer=0x3250000, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d6bf61c*=0x423a, lpOverlapped=0x0) returned 1 [0189.713] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xffffbdc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.713] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3250000, cbInput=0x423a, pPaddingInfo=0x0, pbIV=0x2d6bf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d6bf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2d6bf848, pbOutput=0x3250000, pcbResult=0x2d6bf618) returned 0x0 [0189.713] WriteFile (in: hFile=0x2260, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d6bf61c*=0x4240, lpOverlapped=0x0) returned 1 [0189.713] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6bf60c | out: lpNewFilePointer=0x0) returned 1 [0189.713] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.713] WriteFile (in: hFile=0x2260, lpBuffer=0x2d6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf83c*, lpNumberOfBytesWritten=0x2d6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0189.714] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x4240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.714] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.714] CloseHandle (hObject=0x2260) returned 1 [0189.714] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.717] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.play")) returned 1 [0189.718] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3094 os_tid = 0x2ea8 [0189.723] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.723] ReadFile (in: hFile=0x2280, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0189.725] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.725] ReadFile (in: hFile=0x2280, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0189.725] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.728] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.728] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0189.728] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d7ff828, pbKeyObject=0x0) returned 0x0 [0189.728] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d7ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d7ff500) returned 0x0 [0189.728] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.728] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d7ff500) returned 0x0 [0189.733] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.736] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.737] WriteFile (in: hFile=0x2280, lpBuffer=0x2d7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesWritten=0x2d7ff830*=0x428, lpOverlapped=0x0) returned 1 [0189.737] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.737] ReadFile (in: hFile=0x2280, lpBuffer=0x3350000, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d7ff61c*=0x4180, lpOverlapped=0x0) returned 1 [0189.738] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xffffbe80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.738] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3350000, cbInput=0x4180, pPaddingInfo=0x0, pbIV=0x2d7ff848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d7ff618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2d7ff848, pbOutput=0x3350000, pcbResult=0x2d7ff618) returned 0x0 [0189.738] WriteFile (in: hFile=0x2280, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x4190, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d7ff61c*=0x4190, lpOverlapped=0x0) returned 1 [0189.738] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7ff60c | out: lpNewFilePointer=0x0) returned 1 [0189.738] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.738] WriteFile (in: hFile=0x2280, lpBuffer=0x2d7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ff83c*, lpNumberOfBytesWritten=0x2d7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0189.738] SetFilePointerEx (in: hFile=0x2280, liDistanceToMove=0x4190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.738] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.738] CloseHandle (hObject=0x2280) returned 1 [0189.738] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.play")) returned 1 [0189.743] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3095 os_tid = 0x2eac [0189.748] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.748] ReadFile (in: hFile=0x229c, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.750] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.750] ReadFile (in: hFile=0x229c, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.750] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.752] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.753] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2d93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0189.753] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2d93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2d93f828, pbKeyObject=0x0) returned 0x0 [0189.753] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d93f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d93f500) returned 0x0 [0189.753] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.753] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d93f500) returned 0x0 [0189.758] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.761] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.761] WriteFile (in: hFile=0x229c, lpBuffer=0x2d93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d93f830, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesWritten=0x2d93f830*=0x428, lpOverlapped=0x0) returned 1 [0189.762] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.762] ReadFile (in: hFile=0x229c, lpBuffer=0x3450000, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2d93f61c*=0x2dfa, lpOverlapped=0x0) returned 1 [0189.764] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xffffd206, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.764] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3450000, cbInput=0x2dfa, pPaddingInfo=0x0, pbIV=0x2d93f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2d93f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2d93f848, pbOutput=0x3450000, pcbResult=0x2d93f618) returned 0x0 [0189.764] WriteFile (in: hFile=0x229c, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2d93f61c*=0x2e00, lpOverlapped=0x0) returned 1 [0189.764] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d93f60c | out: lpNewFilePointer=0x0) returned 1 [0189.764] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.764] WriteFile (in: hFile=0x229c, lpBuffer=0x2d93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d93f83c*, lpNumberOfBytesWritten=0x2d93f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.764] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x2e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.764] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.764] CloseHandle (hObject=0x229c) returned 1 [0189.765] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.play")) returned 1 [0189.769] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3096 os_tid = 0x2eb0 [0189.774] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.774] ReadFile (in: hFile=0x2414, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.775] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.775] ReadFile (in: hFile=0x2414, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.775] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.778] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.778] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2da7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0189.778] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2da7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2da7f828, pbKeyObject=0x0) returned 0x0 [0189.778] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2da7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2da7f500) returned 0x0 [0189.778] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.778] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2da7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2da7f500) returned 0x0 [0189.783] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.786] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.786] WriteFile (in: hFile=0x2414, lpBuffer=0x2da7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da7f830, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesWritten=0x2da7f830*=0x428, lpOverlapped=0x0) returned 1 [0189.786] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.787] ReadFile (in: hFile=0x2414, lpBuffer=0x3550000, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2da7f61c*=0x28be, lpOverlapped=0x0) returned 1 [0189.789] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xffffd742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.789] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3550000, cbInput=0x28be, pPaddingInfo=0x0, pbIV=0x2da7f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2da7f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2da7f848, pbOutput=0x3550000, pcbResult=0x2da7f618) returned 0x0 [0189.789] WriteFile (in: hFile=0x2414, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2da7f61c*=0x28c0, lpOverlapped=0x0) returned 1 [0189.790] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da7f60c | out: lpNewFilePointer=0x0) returned 1 [0189.790] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.790] WriteFile (in: hFile=0x2414, lpBuffer=0x2da7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da7f83c*, lpNumberOfBytesWritten=0x2da7f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.790] SetFilePointerEx (in: hFile=0x2414, liDistanceToMove=0x28c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.790] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.790] CloseHandle (hObject=0x2414) returned 1 [0189.790] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.play")) returned 1 [0189.795] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3097 os_tid = 0x2eb4 [0189.799] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.799] ReadFile (in: hFile=0x22d4, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.801] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.801] ReadFile (in: hFile=0x22d4, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.801] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.804] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0189.804] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0189.804] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2ddbf500) returned 0x0 [0189.805] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.805] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2ddbf500) returned 0x0 [0189.809] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.812] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.813] WriteFile (in: hFile=0x22d4, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0189.813] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.813] ReadFile (in: hFile=0x22d4, lpBuffer=0x3650000, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2ddbf61c*=0x24d7, lpOverlapped=0x0) returned 1 [0189.814] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xffffdb29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.814] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3650000, cbInput=0x24d7, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2ddbf848, pbOutput=0x3650000, pcbResult=0x2ddbf618) returned 0x0 [0189.814] WriteFile (in: hFile=0x22d4, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x24e0, lpOverlapped=0x0) returned 1 [0189.814] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0189.814] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.814] WriteFile (in: hFile=0x22d4, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0189.814] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x24e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.814] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.814] CloseHandle (hObject=0x22d4) returned 1 [0189.814] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.play")) returned 1 [0189.819] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3098 os_tid = 0x2eb8 [0189.823] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.823] ReadFile (in: hFile=0x22f4, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.825] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.825] ReadFile (in: hFile=0x22f4, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.825] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.828] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.828] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2debf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0189.828] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2debf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2debf828, pbKeyObject=0x0) returned 0x0 [0189.828] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2debf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2debf500) returned 0x0 [0189.828] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.828] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2debf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2debf500) returned 0x0 [0189.833] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.837] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.837] WriteFile (in: hFile=0x22f4, lpBuffer=0x2debfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2debf830, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesWritten=0x2debf830*=0x428, lpOverlapped=0x0) returned 1 [0189.837] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.837] ReadFile (in: hFile=0x22f4, lpBuffer=0x3750000, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2debf61c*=0x2ff8, lpOverlapped=0x0) returned 1 [0189.838] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xffffd008, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.838] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3750000, cbInput=0x2ff8, pPaddingInfo=0x0, pbIV=0x2debf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2debf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2debf848, pbOutput=0x3750000, pcbResult=0x2debf618) returned 0x0 [0189.838] WriteFile (in: hFile=0x22f4, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2debf61c*=0x3000, lpOverlapped=0x0) returned 1 [0189.838] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2debf60c | out: lpNewFilePointer=0x0) returned 1 [0189.838] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.838] WriteFile (in: hFile=0x22f4, lpBuffer=0x2debf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x2debf83c*, lpNumberOfBytesWritten=0x2debf61c*=0x8, lpOverlapped=0x0) returned 1 [0189.838] SetFilePointerEx (in: hFile=0x22f4, liDistanceToMove=0x3000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.838] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.838] CloseHandle (hObject=0x22f4) returned 1 [0189.839] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.play")) returned 1 [0189.843] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3099 os_tid = 0x2ebc [0189.850] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.850] ReadFile (in: hFile=0x2310, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.852] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.852] ReadFile (in: hFile=0x2310, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.852] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.855] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.855] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2dfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0189.855] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2dfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2dfbf828, pbKeyObject=0x0) returned 0x0 [0189.855] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2dfbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2dfbf500) returned 0x0 [0189.855] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.855] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2dfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2dfbf500) returned 0x0 [0189.860] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.863] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.863] WriteFile (in: hFile=0x2310, lpBuffer=0x2dfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dfbf830, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesWritten=0x2dfbf830*=0x428, lpOverlapped=0x0) returned 1 [0189.863] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.863] ReadFile (in: hFile=0x2310, lpBuffer=0x3850000, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2dfbf61c*=0x2e7e, lpOverlapped=0x0) returned 1 [0189.865] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xffffd182, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.865] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3850000, cbInput=0x2e7e, pPaddingInfo=0x0, pbIV=0x2dfbf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2dfbf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2dfbf848, pbOutput=0x3850000, pcbResult=0x2dfbf618) returned 0x0 [0189.865] WriteFile (in: hFile=0x2310, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2dfbf61c*=0x2e80, lpOverlapped=0x0) returned 1 [0189.866] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dfbf60c | out: lpNewFilePointer=0x0) returned 1 [0189.866] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.866] WriteFile (in: hFile=0x2310, lpBuffer=0x2dfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbf83c*, lpNumberOfBytesWritten=0x2dfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0189.866] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x2e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.866] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.866] CloseHandle (hObject=0x2310) returned 1 [0189.866] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.play")) returned 1 [0189.870] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3100 os_tid = 0x2ec0 [0189.874] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.874] ReadFile (in: hFile=0x2330, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.876] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.876] ReadFile (in: hFile=0x2330, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0189.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.879] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.879] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0189.879] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e0bf828, pbKeyObject=0x0) returned 0x0 [0189.879] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e0bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e0bf500) returned 0x0 [0189.879] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.879] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e0bf500) returned 0x0 [0189.884] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.888] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.888] WriteFile (in: hFile=0x2330, lpBuffer=0x2e0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e0bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesWritten=0x2e0bf830*=0x428, lpOverlapped=0x0) returned 1 [0189.888] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.888] ReadFile (in: hFile=0x2330, lpBuffer=0x3950000, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e0bf61c*=0x3260, lpOverlapped=0x0) returned 1 [0189.889] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xffffcda0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.889] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3950000, cbInput=0x3260, pPaddingInfo=0x0, pbIV=0x2e0bf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e0bf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e0bf848, pbOutput=0x3950000, pcbResult=0x2e0bf618) returned 0x0 [0189.889] WriteFile (in: hFile=0x2330, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e0bf61c*=0x3270, lpOverlapped=0x0) returned 1 [0189.889] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0bf60c | out: lpNewFilePointer=0x0) returned 1 [0189.889] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.889] WriteFile (in: hFile=0x2330, lpBuffer=0x2e0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bf83c*, lpNumberOfBytesWritten=0x2e0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0189.889] SetFilePointerEx (in: hFile=0x2330, liDistanceToMove=0x3270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.890] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.890] CloseHandle (hObject=0x2330) returned 1 [0189.890] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.play")) returned 1 [0189.894] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3101 os_tid = 0x2ec4 [0189.908] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.908] ReadFile (in: hFile=0x249c, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0189.910] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.910] ReadFile (in: hFile=0x249c, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0189.910] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.914] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.914] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0189.914] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e1ff828, pbKeyObject=0x0) returned 0x0 [0189.914] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e1ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e1ff500) returned 0x0 [0189.914] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.914] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e1ff500) returned 0x0 [0189.919] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.922] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.923] WriteFile (in: hFile=0x249c, lpBuffer=0x2e1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesWritten=0x2e1ff830*=0x428, lpOverlapped=0x0) returned 1 [0189.923] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.923] ReadFile (in: hFile=0x249c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e1ff61c*=0x27d4, lpOverlapped=0x0) returned 1 [0189.924] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xffffd82c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.924] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3a50000, cbInput=0x27d4, pPaddingInfo=0x0, pbIV=0x2e1ff848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e1ff618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e1ff848, pbOutput=0x3a50000, pcbResult=0x2e1ff618) returned 0x0 [0189.924] WriteFile (in: hFile=0x249c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e1ff61c*=0x27e0, lpOverlapped=0x0) returned 1 [0189.924] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1ff60c | out: lpNewFilePointer=0x0) returned 1 [0189.924] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.924] WriteFile (in: hFile=0x249c, lpBuffer=0x2e1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ff83c*, lpNumberOfBytesWritten=0x2e1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0189.924] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x27e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.924] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.924] CloseHandle (hObject=0x249c) returned 1 [0189.924] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.play")) returned 1 [0189.929] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3102 os_tid = 0x2ec8 [0189.933] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.933] ReadFile (in: hFile=0x245c, lpBuffer=0x2e33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesRead=0x2e33f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.935] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.935] ReadFile (in: hFile=0x245c, lpBuffer=0x2e33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesRead=0x2e33f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.935] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.938] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.938] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e33f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0189.938] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e33f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e33f828, pbKeyObject=0x0) returned 0x0 [0189.938] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e33f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e33f500) returned 0x0 [0189.938] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.938] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e33f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e33f500) returned 0x0 [0189.943] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.946] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.946] WriteFile (in: hFile=0x245c, lpBuffer=0x2e33fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e33f830, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesWritten=0x2e33f830*=0x428, lpOverlapped=0x0) returned 1 [0189.947] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.947] ReadFile (in: hFile=0x245c, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e33f61c*=0x2cdd, lpOverlapped=0x0) returned 1 [0189.948] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xffffd323, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.948] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3b50000, cbInput=0x2cdd, pPaddingInfo=0x0, pbIV=0x2e33f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e33f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e33f848, pbOutput=0x3b50000, pcbResult=0x2e33f618) returned 0x0 [0189.948] WriteFile (in: hFile=0x245c, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e33f61c*=0x2ce0, lpOverlapped=0x0) returned 1 [0189.948] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e33f60c | out: lpNewFilePointer=0x0) returned 1 [0189.948] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.948] WriteFile (in: hFile=0x245c, lpBuffer=0x2e33f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e33f83c*, lpNumberOfBytesWritten=0x2e33f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.948] SetFilePointerEx (in: hFile=0x245c, liDistanceToMove=0x2ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.948] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.948] CloseHandle (hObject=0x245c) returned 1 [0189.949] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.play")) returned 1 [0189.953] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3103 os_tid = 0x2ecc [0189.957] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.957] ReadFile (in: hFile=0x75c, lpBuffer=0x2e47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesRead=0x2e47f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.959] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.959] ReadFile (in: hFile=0x75c, lpBuffer=0x2e47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesRead=0x2e47f85c*=0x428, lpOverlapped=0x0) returned 1 [0189.959] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0189.962] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0189.962] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2e47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0189.962] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2e47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2e47f828, pbKeyObject=0x0) returned 0x0 [0189.962] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e47f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e47f500) returned 0x0 [0189.962] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0189.962] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e47f500) returned 0x0 [0189.967] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.970] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.970] WriteFile (in: hFile=0x75c, lpBuffer=0x2e47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e47f830, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesWritten=0x2e47f830*=0x428, lpOverlapped=0x0) returned 1 [0189.970] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.971] ReadFile (in: hFile=0x75c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2e47f61c*=0x4c6d, lpOverlapped=0x0) returned 1 [0189.972] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xffffb393, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.972] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3c50000, cbInput=0x4c6d, pPaddingInfo=0x0, pbIV=0x2e47f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2e47f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x2e47f848, pbOutput=0x3c50000, pcbResult=0x2e47f618) returned 0x0 [0189.972] WriteFile (in: hFile=0x75c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2e47f61c*=0x4c70, lpOverlapped=0x0) returned 1 [0189.973] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e47f60c | out: lpNewFilePointer=0x0) returned 1 [0189.973] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.973] WriteFile (in: hFile=0x75c, lpBuffer=0x2e47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e47f83c*, lpNumberOfBytesWritten=0x2e47f61c*=0x8, lpOverlapped=0x0) returned 1 [0189.973] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x4c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.973] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0189.973] CloseHandle (hObject=0x75c) returned 1 [0189.973] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0189.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.play")) returned 1 [0189.977] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3104 os_tid = 0x2e74 [0190.030] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0190.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0190.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f000c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e00 [0190.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e94 [0190.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0024, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c [0190.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb4 [0190.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f003c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eac [0190.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc [0190.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0054, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea4 [0190.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec4 [0190.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f006c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ebc [0190.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4 [0190.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0084, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc [0190.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee4 [0190.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f009c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eec [0190.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0190.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca0 [0190.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0190.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0190.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0190.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0190.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0190.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f00fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0190.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0190.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0114, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0190.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0190.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f012c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0190.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0190.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0144, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a4 [0190.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0190.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f015c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0190.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0190.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0174, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x219c [0190.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2194 [0190.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f018c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218c [0190.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2184 [0190.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x217c [0190.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2174 [0190.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2098 [0190.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0190.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0190.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24 [0190.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0190.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f14 [0190.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0204, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f70 [0190.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fec [0190.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f021c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0190.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ffc [0190.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0234, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2008 [0190.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2018 [0190.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f024c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b0 [0190.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b4 [0190.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0264, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b8 [0190.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24bc [0190.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f027c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c0 [0190.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c4 [0190.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0294, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c8 [0190.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24cc [0190.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0190.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0190.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2554 [0190.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2558 [0190.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x255c [0190.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2560 [0190.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f02f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2564 [0190.874] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x76c, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0192.887] CloseHandle (hObject=0x76c) returned 1 [0192.887] CloseHandle (hObject=0x1e00) returned 1 [0192.887] CloseHandle (hObject=0x1e94) returned 1 [0192.887] CloseHandle (hObject=0x1e9c) returned 1 [0192.887] CloseHandle (hObject=0x1eb4) returned 1 [0192.888] CloseHandle (hObject=0x1eac) returned 1 [0192.888] CloseHandle (hObject=0x1ecc) returned 1 [0192.888] CloseHandle (hObject=0x1ea4) returned 1 [0192.888] CloseHandle (hObject=0x1ec4) returned 1 [0192.888] CloseHandle (hObject=0x1ebc) returned 1 [0192.888] CloseHandle (hObject=0x1ed4) returned 1 [0192.888] CloseHandle (hObject=0x1edc) returned 1 [0192.888] CloseHandle (hObject=0x1ee4) returned 1 [0192.888] CloseHandle (hObject=0x1eec) returned 1 [0192.888] CloseHandle (hObject=0x6bc) returned 1 [0192.888] CloseHandle (hObject=0x1ca0) returned 1 [0192.888] CloseHandle (hObject=0x1898) returned 1 [0192.888] CloseHandle (hObject=0x18a0) returned 1 [0192.888] CloseHandle (hObject=0x18a8) returned 1 [0192.888] CloseHandle (hObject=0x18b8) returned 1 [0192.888] CloseHandle (hObject=0x18b0) returned 1 [0192.888] CloseHandle (hObject=0x18c0) returned 1 [0192.888] CloseHandle (hObject=0x18c8) returned 1 [0192.888] CloseHandle (hObject=0x18d0) returned 1 [0192.889] CloseHandle (hObject=0x18d8) returned 1 [0192.889] CloseHandle (hObject=0x18e0) returned 1 [0192.889] CloseHandle (hObject=0x18e8) returned 1 [0192.889] CloseHandle (hObject=0x21a4) returned 1 [0192.889] CloseHandle (hObject=0x18f0) returned 1 [0192.889] CloseHandle (hObject=0x18f8) returned 1 [0192.889] CloseHandle (hObject=0x1900) returned 1 [0192.889] CloseHandle (hObject=0x219c) returned 1 [0192.889] CloseHandle (hObject=0x2194) returned 1 [0192.889] CloseHandle (hObject=0x218c) returned 1 [0192.889] CloseHandle (hObject=0x2184) returned 1 [0192.889] CloseHandle (hObject=0x217c) returned 1 [0192.889] CloseHandle (hObject=0x2174) returned 1 [0192.889] CloseHandle (hObject=0x2098) returned 1 [0192.889] CloseHandle (hObject=0x758) returned 1 [0192.889] CloseHandle (hObject=0x121c) returned 1 [0192.889] CloseHandle (hObject=0x1f24) returned 1 [0192.889] CloseHandle (hObject=0x6b4) returned 1 [0192.889] CloseHandle (hObject=0x1f14) returned 1 [0192.889] CloseHandle (hObject=0x1f70) returned 1 [0192.890] CloseHandle (hObject=0x1fec) returned 1 [0192.890] CloseHandle (hObject=0x1284) returned 1 [0192.890] CloseHandle (hObject=0x1ffc) returned 1 [0192.890] CloseHandle (hObject=0x2008) returned 1 [0192.890] CloseHandle (hObject=0x2018) returned 1 [0192.890] CloseHandle (hObject=0x24b0) returned 1 [0192.890] CloseHandle (hObject=0x24b4) returned 1 [0192.890] CloseHandle (hObject=0x24b8) returned 1 [0192.890] CloseHandle (hObject=0x24bc) returned 1 [0192.890] CloseHandle (hObject=0x24c0) returned 1 [0192.890] CloseHandle (hObject=0x24c4) returned 1 [0192.890] CloseHandle (hObject=0x24c8) returned 1 [0192.890] CloseHandle (hObject=0x24cc) returned 1 [0192.890] CloseHandle (hObject=0x630) returned 1 [0192.890] CloseHandle (hObject=0x774) returned 1 [0192.890] CloseHandle (hObject=0x2554) returned 1 [0192.891] CloseHandle (hObject=0x2558) returned 1 [0192.891] CloseHandle (hObject=0x255c) returned 1 [0192.891] CloseHandle (hObject=0x2560) returned 1 [0192.891] CloseHandle (hObject=0x2564) returned 1 [0192.891] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3105 os_tid = 0x2ed0 [0190.080] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.080] ReadFile (in: hFile=0x75c, lpBuffer=0x1480fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1480f85c, lpOverlapped=0x0 | out: lpBuffer=0x1480fb34*, lpNumberOfBytesRead=0x1480f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.082] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.082] ReadFile (in: hFile=0x75c, lpBuffer=0x1480fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1480f85c, lpOverlapped=0x0 | out: lpBuffer=0x1480fb34*, lpNumberOfBytesRead=0x1480f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.082] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.281] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.281] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1480f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0190.281] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1480f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1480f828, pbKeyObject=0x0) returned 0x0 [0190.281] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1480f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1480f500) returned 0x0 [0190.282] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.282] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1480f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1480f500) returned 0x0 [0190.287] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.291] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.291] WriteFile (in: hFile=0x75c, lpBuffer=0x1480fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1480f830, lpOverlapped=0x0 | out: lpBuffer=0x1480fb34*, lpNumberOfBytesWritten=0x1480f830*=0x428, lpOverlapped=0x0) returned 1 [0190.291] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.291] ReadFile (in: hFile=0x75c, lpBuffer=0x2750000, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x1480f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1480f61c*=0x4ad8, lpOverlapped=0x0) returned 1 [0190.292] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xffffb528, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.292] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2750000, cbInput=0x4ad8, pPaddingInfo=0x0, pbIV=0x1480f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1480f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x1480f848, pbOutput=0x2750000, pcbResult=0x1480f618) returned 0x0 [0190.292] WriteFile (in: hFile=0x75c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x1480f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1480f61c*=0x4ae0, lpOverlapped=0x0) returned 1 [0190.292] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1480f60c | out: lpNewFilePointer=0x0) returned 1 [0190.292] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.292] WriteFile (in: hFile=0x75c, lpBuffer=0x1480f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1480f61c, lpOverlapped=0x0 | out: lpBuffer=0x1480f83c*, lpNumberOfBytesWritten=0x1480f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.292] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x4ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.292] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.293] CloseHandle (hObject=0x75c) returned 1 [0190.293] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.play")) returned 1 [0190.297] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3106 os_tid = 0x2ed4 [0190.082] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.082] ReadFile (in: hFile=0x249c, lpBuffer=0x14d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d4fb34*, lpNumberOfBytesRead=0x14d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.085] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.085] ReadFile (in: hFile=0x249c, lpBuffer=0x14d4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14d4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14d4fb34*, lpNumberOfBytesRead=0x14d4f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.085] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.304] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x14d4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0190.304] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x14d4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x14d4f828, pbKeyObject=0x0) returned 0x0 [0190.304] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x14d4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x14d4f500) returned 0x0 [0190.304] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.305] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x14d4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x14d4f500) returned 0x0 [0190.309] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.313] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.313] WriteFile (in: hFile=0x249c, lpBuffer=0x14d4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14d4f830, lpOverlapped=0x0 | out: lpBuffer=0x14d4fb34*, lpNumberOfBytesWritten=0x14d4f830*=0x428, lpOverlapped=0x0) returned 1 [0190.313] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.313] ReadFile (in: hFile=0x249c, lpBuffer=0x2850000, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x14d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x14d4f61c*=0x52c3, lpOverlapped=0x0) returned 1 [0190.314] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xffffad3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.314] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2850000, cbInput=0x52c3, pPaddingInfo=0x0, pbIV=0x14d4f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x14d4f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x14d4f848, pbOutput=0x2850000, pcbResult=0x14d4f618) returned 0x0 [0190.314] WriteFile (in: hFile=0x249c, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x14d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x14d4f61c*=0x52d0, lpOverlapped=0x0) returned 1 [0190.314] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14d4f60c | out: lpNewFilePointer=0x0) returned 1 [0190.314] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.314] WriteFile (in: hFile=0x249c, lpBuffer=0x14d4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14d4f61c, lpOverlapped=0x0 | out: lpBuffer=0x14d4f83c*, lpNumberOfBytesWritten=0x14d4f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.315] SetFilePointerEx (in: hFile=0x249c, liDistanceToMove=0x52d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.315] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.315] CloseHandle (hObject=0x249c) returned 1 [0190.315] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.play")) returned 1 [0190.319] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3107 os_tid = 0x2ed8 [0190.085] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.085] ReadFile (in: hFile=0x2310, lpBuffer=0x14e4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14e4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14e4fb34*, lpNumberOfBytesRead=0x14e4f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.089] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.089] ReadFile (in: hFile=0x2310, lpBuffer=0x14e4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x14e4f85c, lpOverlapped=0x0 | out: lpBuffer=0x14e4fb34*, lpNumberOfBytesRead=0x14e4f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.090] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.326] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.326] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x14e4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0190.326] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x14e4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x14e4f828, pbKeyObject=0x0) returned 0x0 [0190.326] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x14e4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x14e4f500) returned 0x0 [0190.327] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.327] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x14e4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x14e4f500) returned 0x0 [0190.331] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.335] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.335] WriteFile (in: hFile=0x2310, lpBuffer=0x14e4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x14e4f830, lpOverlapped=0x0 | out: lpBuffer=0x14e4fb34*, lpNumberOfBytesWritten=0x14e4f830*=0x428, lpOverlapped=0x0) returned 1 [0190.335] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.335] ReadFile (in: hFile=0x2310, lpBuffer=0x2950000, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x14e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x14e4f61c*=0x7457, lpOverlapped=0x0) returned 1 [0190.339] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xffff8ba9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.339] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2950000, cbInput=0x7457, pPaddingInfo=0x0, pbIV=0x14e4f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x14e4f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x14e4f848, pbOutput=0x2950000, pcbResult=0x14e4f618) returned 0x0 [0190.339] WriteFile (in: hFile=0x2310, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x14e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x14e4f61c*=0x7460, lpOverlapped=0x0) returned 1 [0190.339] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14e4f60c | out: lpNewFilePointer=0x0) returned 1 [0190.339] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.339] WriteFile (in: hFile=0x2310, lpBuffer=0x14e4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14e4f61c, lpOverlapped=0x0 | out: lpBuffer=0x14e4f83c*, lpNumberOfBytesWritten=0x14e4f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.340] SetFilePointerEx (in: hFile=0x2310, liDistanceToMove=0x7460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.340] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.340] CloseHandle (hObject=0x2310) returned 1 [0190.340] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0190.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.play")) returned 1 [0190.344] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3108 os_tid = 0x2edc [0190.090] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.090] ReadFile (in: hFile=0x22d4, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.092] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.092] ReadFile (in: hFile=0x22d4, lpBuffer=0x1508fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1508f85c, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesRead=0x1508f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.092] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.348] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.348] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1508f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0190.348] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1508f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1508f828, pbKeyObject=0x0) returned 0x0 [0190.348] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1508f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1508f500) returned 0x0 [0190.348] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.349] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1508f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1508f500) returned 0x0 [0190.353] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.357] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.357] WriteFile (in: hFile=0x22d4, lpBuffer=0x1508fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1508f830, lpOverlapped=0x0 | out: lpBuffer=0x1508fb34*, lpNumberOfBytesWritten=0x1508f830*=0x428, lpOverlapped=0x0) returned 1 [0190.357] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.357] ReadFile (in: hFile=0x22d4, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1508f61c*=0xa9e2, lpOverlapped=0x0) returned 1 [0190.362] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xffff561e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.362] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2a50000, cbInput=0xa9e2, pPaddingInfo=0x0, pbIV=0x1508f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1508f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x1508f848, pbOutput=0x2a50000, pcbResult=0x1508f618) returned 0x0 [0190.362] WriteFile (in: hFile=0x22d4, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1508f61c*=0xa9f0, lpOverlapped=0x0) returned 1 [0190.362] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1508f60c | out: lpNewFilePointer=0x0) returned 1 [0190.363] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.363] WriteFile (in: hFile=0x22d4, lpBuffer=0x1508f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1508f61c, lpOverlapped=0x0 | out: lpBuffer=0x1508f83c*, lpNumberOfBytesWritten=0x1508f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.363] SetFilePointerEx (in: hFile=0x22d4, liDistanceToMove=0xa9f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.363] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.363] CloseHandle (hObject=0x22d4) returned 1 [0190.363] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0190.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.play")) returned 1 [0190.368] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3109 os_tid = 0x2ee0 [0190.093] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.093] ReadFile (in: hFile=0x229c, lpBuffer=0x1518fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1518f85c, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesRead=0x1518f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.094] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.095] ReadFile (in: hFile=0x229c, lpBuffer=0x1518fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1518f85c, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesRead=0x1518f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.095] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.361] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.361] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x1518f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0190.361] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x1518f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x1518f828, pbKeyObject=0x0) returned 0x0 [0190.361] BCryptExportKey (in: hKey=0x7f1c80, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1518f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1518f500) returned 0x0 [0190.372] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.372] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1518f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1518f500) returned 0x0 [0190.376] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.380] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.380] WriteFile (in: hFile=0x229c, lpBuffer=0x1518fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1518f830, lpOverlapped=0x0 | out: lpBuffer=0x1518fb34*, lpNumberOfBytesWritten=0x1518f830*=0x428, lpOverlapped=0x0) returned 1 [0190.380] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.380] ReadFile (in: hFile=0x229c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x1518f61c*=0x3ee3, lpOverlapped=0x0) returned 1 [0190.397] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xffffc11d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.397] BCryptEncrypt (in: hKey=0x7f1c80, pbInput=0x2b50000, cbInput=0x3ee3, pPaddingInfo=0x0, pbIV=0x1518f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x1518f618, dwFlags=0x1 | out: hKey=0x7f1c80, pbIV=0x1518f848, pbOutput=0x2b50000, pcbResult=0x1518f618) returned 0x0 [0190.397] WriteFile (in: hFile=0x229c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x1518f61c*=0x3ef0, lpOverlapped=0x0) returned 1 [0190.397] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1518f60c | out: lpNewFilePointer=0x0) returned 1 [0190.397] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.397] WriteFile (in: hFile=0x229c, lpBuffer=0x1518f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1518f61c, lpOverlapped=0x0 | out: lpBuffer=0x1518f83c*, lpNumberOfBytesWritten=0x1518f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.397] SetFilePointerEx (in: hFile=0x229c, liDistanceToMove=0x3ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.397] BCryptDestroyKey (in: hKey=0x7f1c80 | out: hKey=0x7f1c80) returned 0x0 [0190.397] CloseHandle (hObject=0x229c) returned 1 [0190.397] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.play")) returned 1 [0190.403] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3110 os_tid = 0x2ee4 [0190.095] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.095] ReadFile (in: hFile=0x2260, lpBuffer=0x1540fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1540f85c, lpOverlapped=0x0 | out: lpBuffer=0x1540fb34*, lpNumberOfBytesRead=0x1540f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.097] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.097] ReadFile (in: hFile=0x2260, lpBuffer=0x1540fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1540f85c, lpOverlapped=0x0 | out: lpBuffer=0x1540fb34*, lpNumberOfBytesRead=0x1540f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.097] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.410] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.410] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x1540f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0190.410] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x1540f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x1540f828, pbKeyObject=0x0) returned 0x0 [0190.410] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1540f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1540f500) returned 0x0 [0190.410] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.410] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1540f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1540f500) returned 0x0 [0190.415] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.419] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.420] WriteFile (in: hFile=0x2260, lpBuffer=0x1540fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1540f830, lpOverlapped=0x0 | out: lpBuffer=0x1540fb34*, lpNumberOfBytesWritten=0x1540f830*=0x428, lpOverlapped=0x0) returned 1 [0190.420] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.420] ReadFile (in: hFile=0x2260, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x1540f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x1540f61c*=0x1f8a, lpOverlapped=0x0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xffffe076, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.421] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2c50000, cbInput=0x1f8a, pPaddingInfo=0x0, pbIV=0x1540f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x1540f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x1540f848, pbOutput=0x2c50000, pcbResult=0x1540f618) returned 0x0 [0190.421] WriteFile (in: hFile=0x2260, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x1540f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x1540f61c*=0x1f90, lpOverlapped=0x0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1540f60c | out: lpNewFilePointer=0x0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.421] WriteFile (in: hFile=0x2260, lpBuffer=0x1540f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1540f61c, lpOverlapped=0x0 | out: lpBuffer=0x1540f83c*, lpNumberOfBytesWritten=0x1540f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x2260, liDistanceToMove=0x1f90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.421] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.421] CloseHandle (hObject=0x2260) returned 1 [0190.422] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.play")) returned 1 [0190.427] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3111 os_tid = 0x2ee8 [0190.098] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.098] ReadFile (in: hFile=0x2228, lpBuffer=0x155cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x155cf85c, lpOverlapped=0x0 | out: lpBuffer=0x155cfb34*, lpNumberOfBytesRead=0x155cf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.100] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.100] ReadFile (in: hFile=0x2228, lpBuffer=0x155cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x155cf85c, lpOverlapped=0x0 | out: lpBuffer=0x155cfb34*, lpNumberOfBytesRead=0x155cf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.100] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.434] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.434] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x155cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0190.434] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x155cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x155cf828, pbKeyObject=0x0) returned 0x0 [0190.434] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x155cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x155cf500) returned 0x0 [0190.434] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.434] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x155cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x155cf500) returned 0x0 [0190.439] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.443] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.443] WriteFile (in: hFile=0x2228, lpBuffer=0x155cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x155cf830, lpOverlapped=0x0 | out: lpBuffer=0x155cfb34*, lpNumberOfBytesWritten=0x155cf830*=0x428, lpOverlapped=0x0) returned 1 [0190.443] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.443] ReadFile (in: hFile=0x2228, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x155cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x155cf61c*=0x5a56, lpOverlapped=0x0) returned 1 [0190.444] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xffffa5aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.444] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x2d50000, cbInput=0x5a56, pPaddingInfo=0x0, pbIV=0x155cf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x155cf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x155cf848, pbOutput=0x2d50000, pcbResult=0x155cf618) returned 0x0 [0190.444] WriteFile (in: hFile=0x2228, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x155cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x155cf61c*=0x5a60, lpOverlapped=0x0) returned 1 [0190.445] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x155cf60c | out: lpNewFilePointer=0x0) returned 1 [0190.445] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.445] WriteFile (in: hFile=0x2228, lpBuffer=0x155cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x155cf61c, lpOverlapped=0x0 | out: lpBuffer=0x155cf83c*, lpNumberOfBytesWritten=0x155cf61c*=0x8, lpOverlapped=0x0) returned 1 [0190.445] SetFilePointerEx (in: hFile=0x2228, liDistanceToMove=0x5a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.445] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.445] CloseHandle (hObject=0x2228) returned 1 [0190.445] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.play")) returned 1 [0190.450] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3112 os_tid = 0x2eec [0190.101] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.101] ReadFile (in: hFile=0x21ac, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.102] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.102] ReadFile (in: hFile=0x21ac, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.102] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.457] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.457] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0190.457] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0190.457] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0190.457] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.457] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0190.462] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.466] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.466] WriteFile (in: hFile=0x21ac, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0190.467] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.467] ReadFile (in: hFile=0x21ac, lpBuffer=0x3050000, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d57f61c*=0x6f43, lpOverlapped=0x0) returned 1 [0190.467] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xffff90bd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.468] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3050000, cbInput=0x6f43, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2d57f848, pbOutput=0x3050000, pcbResult=0x2d57f618) returned 0x0 [0190.468] WriteFile (in: hFile=0x21ac, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d57f61c*=0x6f50, lpOverlapped=0x0) returned 1 [0190.468] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0190.468] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.468] WriteFile (in: hFile=0x21ac, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.468] SetFilePointerEx (in: hFile=0x21ac, liDistanceToMove=0x6f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.468] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.468] CloseHandle (hObject=0x21ac) returned 1 [0190.468] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.play")) returned 1 [0190.473] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3113 os_tid = 0x2ef0 [0190.103] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.103] ReadFile (in: hFile=0x213c, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.104] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.104] ReadFile (in: hFile=0x213c, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.104] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.480] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0190.480] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d6bf828, pbKeyObject=0x0) returned 0x0 [0190.480] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d6bf500) returned 0x0 [0190.480] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.480] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d6bf500) returned 0x0 [0190.485] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.488] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.488] WriteFile (in: hFile=0x213c, lpBuffer=0x2d6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesWritten=0x2d6bf830*=0x428, lpOverlapped=0x0) returned 1 [0190.489] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.489] ReadFile (in: hFile=0x213c, lpBuffer=0x3150000, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d6bf61c*=0x6aa8, lpOverlapped=0x0) returned 1 [0190.489] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xffff9558, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.490] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3150000, cbInput=0x6aa8, pPaddingInfo=0x0, pbIV=0x2d6bf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d6bf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2d6bf848, pbOutput=0x3150000, pcbResult=0x2d6bf618) returned 0x0 [0190.490] WriteFile (in: hFile=0x213c, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d6bf61c*=0x6ab0, lpOverlapped=0x0) returned 1 [0190.499] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6bf60c | out: lpNewFilePointer=0x0) returned 1 [0190.499] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.499] WriteFile (in: hFile=0x213c, lpBuffer=0x2d6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf83c*, lpNumberOfBytesWritten=0x2d6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0190.499] SetFilePointerEx (in: hFile=0x213c, liDistanceToMove=0x6ab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.499] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.499] CloseHandle (hObject=0x213c) returned 1 [0190.499] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.play")) returned 1 [0190.505] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3114 os_tid = 0x2ef4 [0190.105] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.105] ReadFile (in: hFile=0x1db8, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0190.106] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.107] ReadFile (in: hFile=0x1db8, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0190.107] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.512] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0190.512] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d7ff828, pbKeyObject=0x0) returned 0x0 [0190.512] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d7ff500) returned 0x0 [0190.512] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.512] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d7ff500) returned 0x0 [0190.517] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.522] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.522] WriteFile (in: hFile=0x1db8, lpBuffer=0x2d7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesWritten=0x2d7ff830*=0x428, lpOverlapped=0x0) returned 1 [0190.522] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.522] ReadFile (in: hFile=0x1db8, lpBuffer=0x3250000, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d7ff61c*=0x6873, lpOverlapped=0x0) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xffff978d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.523] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3250000, cbInput=0x6873, pPaddingInfo=0x0, pbIV=0x2d7ff848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d7ff618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2d7ff848, pbOutput=0x3250000, pcbResult=0x2d7ff618) returned 0x0 [0190.523] WriteFile (in: hFile=0x1db8, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d7ff61c*=0x6880, lpOverlapped=0x0) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7ff60c | out: lpNewFilePointer=0x0) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.523] WriteFile (in: hFile=0x1db8, lpBuffer=0x2d7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ff83c*, lpNumberOfBytesWritten=0x2d7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x1db8, liDistanceToMove=0x6880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.524] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.524] CloseHandle (hObject=0x1db8) returned 1 [0190.524] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.play")) returned 1 [0190.529] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3115 os_tid = 0x2ef8 [0190.107] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.107] ReadFile (in: hFile=0x1e34, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.108] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.108] ReadFile (in: hFile=0x1e34, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.109] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.535] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.535] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0190.535] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d93f828, pbKeyObject=0x0) returned 0x0 [0190.535] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d93f500) returned 0x0 [0190.535] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.536] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d93f500) returned 0x0 [0190.539] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.542] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.542] WriteFile (in: hFile=0x1e34, lpBuffer=0x2d93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d93f830, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesWritten=0x2d93f830*=0x428, lpOverlapped=0x0) returned 1 [0190.542] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.542] ReadFile (in: hFile=0x1e34, lpBuffer=0x3350000, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d93f61c*=0xa497, lpOverlapped=0x0) returned 1 [0190.545] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xffff5b69, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.545] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3350000, cbInput=0xa497, pPaddingInfo=0x0, pbIV=0x2d93f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d93f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2d93f848, pbOutput=0x3350000, pcbResult=0x2d93f618) returned 0x0 [0190.545] WriteFile (in: hFile=0x1e34, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d93f61c*=0xa4a0, lpOverlapped=0x0) returned 1 [0190.546] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d93f60c | out: lpNewFilePointer=0x0) returned 1 [0190.546] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.546] WriteFile (in: hFile=0x1e34, lpBuffer=0x2d93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d93f83c*, lpNumberOfBytesWritten=0x2d93f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.546] SetFilePointerEx (in: hFile=0x1e34, liDistanceToMove=0xa4a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.546] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.546] CloseHandle (hObject=0x1e34) returned 1 [0190.546] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0190.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.play")) returned 1 [0190.550] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3116 os_tid = 0x2efc [0190.109] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.109] ReadFile (in: hFile=0x2358, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.111] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.111] ReadFile (in: hFile=0x2358, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.111] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.553] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.553] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2da7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0190.553] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2da7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2da7f828, pbKeyObject=0x0) returned 0x0 [0190.553] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2da7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2da7f500) returned 0x0 [0190.553] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.553] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2da7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2da7f500) returned 0x0 [0190.557] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.559] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.559] WriteFile (in: hFile=0x2358, lpBuffer=0x2da7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da7f830, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesWritten=0x2da7f830*=0x428, lpOverlapped=0x0) returned 1 [0190.560] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.560] ReadFile (in: hFile=0x2358, lpBuffer=0x3450000, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2da7f61c*=0x1e7b, lpOverlapped=0x0) returned 1 [0190.560] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xffffe185, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.560] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3450000, cbInput=0x1e7b, pPaddingInfo=0x0, pbIV=0x2da7f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2da7f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2da7f848, pbOutput=0x3450000, pcbResult=0x2da7f618) returned 0x0 [0190.560] WriteFile (in: hFile=0x2358, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2da7f61c*=0x1e80, lpOverlapped=0x0) returned 1 [0190.560] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da7f60c | out: lpNewFilePointer=0x0) returned 1 [0190.561] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.561] WriteFile (in: hFile=0x2358, lpBuffer=0x2da7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da7f83c*, lpNumberOfBytesWritten=0x2da7f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.561] SetFilePointerEx (in: hFile=0x2358, liDistanceToMove=0x1e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.561] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.561] CloseHandle (hObject=0x2358) returned 1 [0190.561] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.play")) returned 1 [0190.565] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3117 os_tid = 0x2f00 [0190.111] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.111] ReadFile (in: hFile=0x2424, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.113] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.113] ReadFile (in: hFile=0x2424, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.114] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.571] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.571] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0190.571] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0190.571] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0190.571] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.572] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0190.576] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.580] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.580] WriteFile (in: hFile=0x2424, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0190.581] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.581] ReadFile (in: hFile=0x2424, lpBuffer=0x3550000, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2ddbf61c*=0x3615, lpOverlapped=0x0) returned 1 [0190.581] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xffffc9eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.582] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3550000, cbInput=0x3615, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2ddbf848, pbOutput=0x3550000, pcbResult=0x2ddbf618) returned 0x0 [0190.582] WriteFile (in: hFile=0x2424, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x3620, lpOverlapped=0x0) returned 1 [0190.582] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0190.582] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.582] WriteFile (in: hFile=0x2424, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0190.582] SetFilePointerEx (in: hFile=0x2424, liDistanceToMove=0x3620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.582] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.582] CloseHandle (hObject=0x2424) returned 1 [0190.582] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.play")) returned 1 [0190.588] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3118 os_tid = 0x2f04 [0190.113] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.114] ReadFile (in: hFile=0x2404, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.116] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.116] ReadFile (in: hFile=0x2404, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.594] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.594] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2debf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0190.594] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2debf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2debf828, pbKeyObject=0x0) returned 0x0 [0190.594] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2debf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2debf500) returned 0x0 [0190.595] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.595] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2debf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2debf500) returned 0x0 [0190.600] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.603] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.603] WriteFile (in: hFile=0x2404, lpBuffer=0x2debfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2debf830, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesWritten=0x2debf830*=0x428, lpOverlapped=0x0) returned 1 [0190.604] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.604] ReadFile (in: hFile=0x2404, lpBuffer=0x3650000, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2debf61c*=0x2026, lpOverlapped=0x0) returned 1 [0190.608] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xffffdfda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.608] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3650000, cbInput=0x2026, pPaddingInfo=0x0, pbIV=0x2debf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2debf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2debf848, pbOutput=0x3650000, pcbResult=0x2debf618) returned 0x0 [0190.608] WriteFile (in: hFile=0x2404, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2debf61c*=0x2030, lpOverlapped=0x0) returned 1 [0190.608] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2debf60c | out: lpNewFilePointer=0x0) returned 1 [0190.608] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.608] WriteFile (in: hFile=0x2404, lpBuffer=0x2debf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x2debf83c*, lpNumberOfBytesWritten=0x2debf61c*=0x8, lpOverlapped=0x0) returned 1 [0190.609] SetFilePointerEx (in: hFile=0x2404, liDistanceToMove=0x2030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.609] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.609] CloseHandle (hObject=0x2404) returned 1 [0190.609] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.play")) returned 1 [0190.614] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3119 os_tid = 0x2f08 [0190.117] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.117] ReadFile (in: hFile=0x23e0, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.118] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.118] ReadFile (in: hFile=0x23e0, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.118] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.622] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.622] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2dfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0190.622] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2dfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2dfbf828, pbKeyObject=0x0) returned 0x0 [0190.622] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2dfbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2dfbf500) returned 0x0 [0190.622] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.622] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2dfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2dfbf500) returned 0x0 [0190.627] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.631] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.631] WriteFile (in: hFile=0x23e0, lpBuffer=0x2dfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dfbf830, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesWritten=0x2dfbf830*=0x428, lpOverlapped=0x0) returned 1 [0190.632] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.632] ReadFile (in: hFile=0x23e0, lpBuffer=0x3750000, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2dfbf61c*=0x3df7, lpOverlapped=0x0) returned 1 [0190.633] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xffffc209, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.633] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3750000, cbInput=0x3df7, pPaddingInfo=0x0, pbIV=0x2dfbf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2dfbf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2dfbf848, pbOutput=0x3750000, pcbResult=0x2dfbf618) returned 0x0 [0190.633] WriteFile (in: hFile=0x23e0, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2dfbf61c*=0x3e00, lpOverlapped=0x0) returned 1 [0190.633] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dfbf60c | out: lpNewFilePointer=0x0) returned 1 [0190.633] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.633] WriteFile (in: hFile=0x23e0, lpBuffer=0x2dfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbf83c*, lpNumberOfBytesWritten=0x2dfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0190.633] SetFilePointerEx (in: hFile=0x23e0, liDistanceToMove=0x3e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.633] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.633] CloseHandle (hObject=0x23e0) returned 1 [0190.634] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.play")) returned 1 [0190.638] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3120 os_tid = 0x2f0c [0190.119] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.119] ReadFile (in: hFile=0x23c4, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.120] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.120] ReadFile (in: hFile=0x23c4, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.120] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.644] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.644] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2e0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0190.644] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2e0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2e0bf828, pbKeyObject=0x0) returned 0x0 [0190.644] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e0bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e0bf500) returned 0x0 [0190.644] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.644] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e0bf500) returned 0x0 [0190.648] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.651] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.651] WriteFile (in: hFile=0x23c4, lpBuffer=0x2e0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e0bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesWritten=0x2e0bf830*=0x428, lpOverlapped=0x0) returned 1 [0190.651] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.651] ReadFile (in: hFile=0x23c4, lpBuffer=0x3850000, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2e0bf61c*=0x3d7f, lpOverlapped=0x0) returned 1 [0190.654] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xffffc281, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.654] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3850000, cbInput=0x3d7f, pPaddingInfo=0x0, pbIV=0x2e0bf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2e0bf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2e0bf848, pbOutput=0x3850000, pcbResult=0x2e0bf618) returned 0x0 [0190.654] WriteFile (in: hFile=0x23c4, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2e0bf61c*=0x3d80, lpOverlapped=0x0) returned 1 [0190.655] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0bf60c | out: lpNewFilePointer=0x0) returned 1 [0190.655] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.655] WriteFile (in: hFile=0x23c4, lpBuffer=0x2e0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bf83c*, lpNumberOfBytesWritten=0x2e0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0190.655] SetFilePointerEx (in: hFile=0x23c4, liDistanceToMove=0x3d80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.655] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.655] CloseHandle (hObject=0x23c4) returned 1 [0190.655] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0190.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.play")) returned 1 [0190.659] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3121 os_tid = 0x2f10 [0190.121] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.121] ReadFile (in: hFile=0x23a4, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0190.122] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.122] ReadFile (in: hFile=0x23a4, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0190.123] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.662] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.662] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0190.662] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e1ff828, pbKeyObject=0x0) returned 0x0 [0190.662] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e1ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e1ff500) returned 0x0 [0190.662] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.662] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e1ff500) returned 0x0 [0190.665] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.668] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.668] WriteFile (in: hFile=0x23a4, lpBuffer=0x2e1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesWritten=0x2e1ff830*=0x428, lpOverlapped=0x0) returned 1 [0190.669] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.669] ReadFile (in: hFile=0x23a4, lpBuffer=0x3950000, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e1ff61c*=0x4ec6, lpOverlapped=0x0) returned 1 [0190.672] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xffffb13a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.672] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3950000, cbInput=0x4ec6, pPaddingInfo=0x0, pbIV=0x2e1ff848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e1ff618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2e1ff848, pbOutput=0x3950000, pcbResult=0x2e1ff618) returned 0x0 [0190.672] WriteFile (in: hFile=0x23a4, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e1ff61c*=0x4ed0, lpOverlapped=0x0) returned 1 [0190.672] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1ff60c | out: lpNewFilePointer=0x0) returned 1 [0190.672] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.672] WriteFile (in: hFile=0x23a4, lpBuffer=0x2e1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ff83c*, lpNumberOfBytesWritten=0x2e1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0190.672] SetFilePointerEx (in: hFile=0x23a4, liDistanceToMove=0x4ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.672] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.672] CloseHandle (hObject=0x23a4) returned 1 [0190.673] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.play")) returned 1 [0190.676] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3122 os_tid = 0x2f14 [0190.123] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.123] ReadFile (in: hFile=0x2384, lpBuffer=0x2e33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesRead=0x2e33f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.124] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.124] ReadFile (in: hFile=0x2384, lpBuffer=0x2e33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesRead=0x2e33f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.125] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.682] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.682] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e33f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0190.682] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e33f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e33f828, pbKeyObject=0x0) returned 0x0 [0190.682] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e33f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e33f500) returned 0x0 [0190.682] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.682] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e33f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e33f500) returned 0x0 [0190.686] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.691] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.691] WriteFile (in: hFile=0x2384, lpBuffer=0x2e33fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e33f830, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesWritten=0x2e33f830*=0x428, lpOverlapped=0x0) returned 1 [0190.691] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.691] ReadFile (in: hFile=0x2384, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e33f61c*=0x49ba, lpOverlapped=0x0) returned 1 [0190.692] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xffffb646, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.692] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3a50000, cbInput=0x49ba, pPaddingInfo=0x0, pbIV=0x2e33f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e33f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2e33f848, pbOutput=0x3a50000, pcbResult=0x2e33f618) returned 0x0 [0190.692] WriteFile (in: hFile=0x2384, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e33f61c*=0x49c0, lpOverlapped=0x0) returned 1 [0190.692] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e33f60c | out: lpNewFilePointer=0x0) returned 1 [0190.692] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.692] WriteFile (in: hFile=0x2384, lpBuffer=0x2e33f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e33f83c*, lpNumberOfBytesWritten=0x2e33f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.693] SetFilePointerEx (in: hFile=0x2384, liDistanceToMove=0x49c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.693] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.693] CloseHandle (hObject=0x2384) returned 1 [0190.693] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.play")) returned 1 [0190.698] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3123 os_tid = 0x2f18 [0190.125] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.125] ReadFile (in: hFile=0x1e3c, lpBuffer=0x2e47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesRead=0x2e47f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.126] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.126] ReadFile (in: hFile=0x1e3c, lpBuffer=0x2e47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesRead=0x2e47f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.126] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.705] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.705] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0190.705] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e47f828, pbKeyObject=0x0) returned 0x0 [0190.705] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e47f500) returned 0x0 [0190.706] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.706] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e47f500) returned 0x0 [0190.712] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.716] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.716] WriteFile (in: hFile=0x1e3c, lpBuffer=0x2e47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e47f830, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesWritten=0x2e47f830*=0x428, lpOverlapped=0x0) returned 1 [0190.717] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.717] ReadFile (in: hFile=0x1e3c, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e47f61c*=0x10bdc, lpOverlapped=0x0) returned 1 [0190.719] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xfffef424, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.719] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3b50000, cbInput=0x10bdc, pPaddingInfo=0x0, pbIV=0x2e47f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e47f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2e47f848, pbOutput=0x3b50000, pcbResult=0x2e47f618) returned 0x0 [0190.719] WriteFile (in: hFile=0x1e3c, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e47f61c*=0x10be0, lpOverlapped=0x0) returned 1 [0190.720] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e47f60c | out: lpNewFilePointer=0x0) returned 1 [0190.720] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.720] WriteFile (in: hFile=0x1e3c, lpBuffer=0x2e47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e47f83c*, lpNumberOfBytesWritten=0x2e47f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.720] SetFilePointerEx (in: hFile=0x1e3c, liDistanceToMove=0x10be0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.720] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.720] CloseHandle (hObject=0x1e3c) returned 1 [0190.720] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.724] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.play")) returned 1 [0190.726] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3124 os_tid = 0x2f1c [0190.127] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.127] ReadFile (in: hFile=0x1e4c, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.128] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.128] ReadFile (in: hFile=0x1e4c, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0190.129] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.733] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.733] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0190.733] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0190.733] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0190.733] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.733] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0190.739] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.743] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.743] WriteFile (in: hFile=0x1e4c, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0190.743] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.744] ReadFile (in: hFile=0x1e4c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2e6bf61c*=0x1ce5a, lpOverlapped=0x0) returned 1 [0190.749] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xfffe31a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.749] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3c50000, cbInput=0x1ce5a, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2e6bf848, pbOutput=0x3c50000, pcbResult=0x2e6bf618) returned 0x0 [0190.749] WriteFile (in: hFile=0x1e4c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x1ce60, lpOverlapped=0x0) returned 1 [0190.750] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0190.750] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.750] WriteFile (in: hFile=0x1e4c, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0190.750] SetFilePointerEx (in: hFile=0x1e4c, liDistanceToMove=0x1ce60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.750] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.750] CloseHandle (hObject=0x1e4c) returned 1 [0190.750] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0190.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.play")) returned 1 [0190.755] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3125 os_tid = 0x2f20 [0190.129] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.129] ReadFile (in: hFile=0x1e5c, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0190.131] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.131] ReadFile (in: hFile=0x1e5c, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0190.131] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.760] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.761] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0190.761] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e7ff828, pbKeyObject=0x0) returned 0x0 [0190.761] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0190.761] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.761] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0190.764] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.767] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.767] WriteFile (in: hFile=0x1e5c, lpBuffer=0x2e7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesWritten=0x2e7ff830*=0x428, lpOverlapped=0x0) returned 1 [0190.768] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.768] ReadFile (in: hFile=0x1e5c, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e7ff61c*=0x1672c, lpOverlapped=0x0) returned 1 [0190.769] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xfffe98d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.769] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3d50000, cbInput=0x1672c, pPaddingInfo=0x0, pbIV=0x2e7ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e7ff618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2e7ff848, pbOutput=0x3d50000, pcbResult=0x2e7ff618) returned 0x0 [0190.769] WriteFile (in: hFile=0x1e5c, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e7ff61c*=0x16730, lpOverlapped=0x0) returned 1 [0190.770] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7ff60c | out: lpNewFilePointer=0x0) returned 1 [0190.770] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.770] WriteFile (in: hFile=0x1e5c, lpBuffer=0x2e7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ff83c*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0190.770] SetFilePointerEx (in: hFile=0x1e5c, liDistanceToMove=0x16730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.770] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.770] CloseHandle (hObject=0x1e5c) returned 1 [0190.770] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.play")) returned 1 [0190.777] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3126 os_tid = 0x2f24 [0190.131] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.131] ReadFile (in: hFile=0x1e6c, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.133] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.133] ReadFile (in: hFile=0x1e6c, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0190.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0190.783] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0190.783] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2e93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0190.783] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2e93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2e93f828, pbKeyObject=0x0) returned 0x0 [0190.784] BCryptExportKey (in: hKey=0x7f1a00, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0190.784] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0190.784] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0190.787] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.790] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.790] WriteFile (in: hFile=0x1e6c, lpBuffer=0x2e93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e93f830, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesWritten=0x2e93f830*=0x428, lpOverlapped=0x0) returned 1 [0190.790] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.790] ReadFile (in: hFile=0x1e6c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2e93f61c*=0x1f86c, lpOverlapped=0x0) returned 1 [0190.792] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xfffe0794, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.792] BCryptEncrypt (in: hKey=0x7f1a00, pbInput=0x3e50000, cbInput=0x1f86c, pPaddingInfo=0x0, pbIV=0x2e93f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2e93f618, dwFlags=0x1 | out: hKey=0x7f1a00, pbIV=0x2e93f848, pbOutput=0x3e50000, pcbResult=0x2e93f618) returned 0x0 [0190.792] WriteFile (in: hFile=0x1e6c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2e93f61c*=0x1f870, lpOverlapped=0x0) returned 1 [0190.793] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93f60c | out: lpNewFilePointer=0x0) returned 1 [0190.793] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.793] WriteFile (in: hFile=0x1e6c, lpBuffer=0x2e93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e93f83c*, lpNumberOfBytesWritten=0x2e93f61c*=0x8, lpOverlapped=0x0) returned 1 [0190.793] SetFilePointerEx (in: hFile=0x1e6c, liDistanceToMove=0x1f870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.793] BCryptDestroyKey (in: hKey=0x7f1a00 | out: hKey=0x7f1a00) returned 0x0 [0190.793] CloseHandle (hObject=0x1e6c) returned 1 [0190.793] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0190.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.play")) returned 1 [0190.797] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3127 os_tid = 0x2f28 [0190.140] GetLastError () returned 0x57 [0190.141] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72d848 [0190.141] SetLastError (dwErrCode=0x57) [0190.141] IcmpCreateFile () returned 0x805770 [0190.141] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790cc8 [0190.141] IcmpSendEcho2 (IcmpHandle=0x805770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x100a8c0, RequestData=0x1570ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790cc8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3128 os_tid = 0x2f2c [0190.143] GetLastError () returned 0x57 [0190.143] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7298b8 [0190.143] SetLastError (dwErrCode=0x57) [0190.143] IcmpCreateFile () returned 0x75d7a8 [0190.143] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790d18 [0190.143] IcmpSendEcho2 (IcmpHandle=0x75d7a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x200a8c0, RequestData=0x2ea7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790d18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3129 os_tid = 0x2f30 [0190.145] GetLastError () returned 0x57 [0190.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a729c40 [0190.145] SetLastError (dwErrCode=0x57) [0190.145] IcmpCreateFile () returned 0x75d738 [0190.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790368 [0190.145] IcmpSendEcho2 (IcmpHandle=0x75d738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x300a8c0, RequestData=0x30bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790368, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3130 os_tid = 0x2f34 [0190.146] GetLastError () returned 0x57 [0190.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7310c8 [0190.147] SetLastError (dwErrCode=0x57) [0190.147] IcmpCreateFile () returned 0x75d770 [0190.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7903b8 [0190.147] IcmpSendEcho2 (IcmpHandle=0x75d770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x400a8c0, RequestData=0x30cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7903b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3131 os_tid = 0x2f38 [0190.148] GetLastError () returned 0x57 [0190.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a731450 [0190.148] SetLastError (dwErrCode=0x57) [0190.148] IcmpCreateFile () returned 0x75d268 [0190.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7904f8 [0190.149] IcmpSendEcho2 (IcmpHandle=0x75d268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x500a8c0, RequestData=0x30dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7904f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3132 os_tid = 0x2f3c [0190.153] GetLastError () returned 0x57 [0190.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7317d8 [0190.153] SetLastError (dwErrCode=0x57) [0190.153] IcmpCreateFile () returned 0x75d2a0 [0190.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790548 [0190.153] IcmpSendEcho2 (IcmpHandle=0x75d2a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x600a8c0, RequestData=0x30ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790548, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3133 os_tid = 0x2f40 [0190.154] GetLastError () returned 0x57 [0190.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a731b60 [0190.155] SetLastError (dwErrCode=0x57) [0190.155] IcmpCreateFile () returned 0x75d2d8 [0190.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790598 [0190.155] IcmpSendEcho2 (IcmpHandle=0x75d2d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x700a8c0, RequestData=0x30ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790598, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3134 os_tid = 0x2f44 [0190.156] GetLastError () returned 0x57 [0190.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a731ee8 [0190.156] SetLastError (dwErrCode=0x57) [0190.156] IcmpCreateFile () returned 0x76a738 [0190.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7905e8 [0190.156] IcmpSendEcho2 (IcmpHandle=0x76a738, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x800a8c0, RequestData=0x3113ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7905e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3135 os_tid = 0x2f48 [0190.157] GetLastError () returned 0x57 [0190.157] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a732270 [0190.158] SetLastError (dwErrCode=0x57) [0190.158] IcmpCreateFile () returned 0x76a770 [0190.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790638 [0190.158] IcmpSendEcho2 (IcmpHandle=0x76a770, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x900a8c0, RequestData=0x365bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790638, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3136 os_tid = 0x2f4c [0190.159] GetLastError () returned 0x57 [0190.159] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7325f8 [0190.159] SetLastError (dwErrCode=0x57) [0190.159] IcmpCreateFile () returned 0x76a428 [0190.159] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790688 [0190.159] IcmpSendEcho2 (IcmpHandle=0x76a428, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa00a8c0, RequestData=0x366fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790688, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3137 os_tid = 0x2f50 [0190.160] GetLastError () returned 0x57 [0190.161] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a732980 [0190.161] SetLastError (dwErrCode=0x57) [0190.161] IcmpCreateFile () returned 0x74f448 [0190.161] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790f48 [0190.161] IcmpSendEcho2 (IcmpHandle=0x74f448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb00a8c0, RequestData=0x383bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790f48, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3138 os_tid = 0x2f54 [0190.162] GetLastError () returned 0x57 [0190.162] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a732d08 [0190.162] SetLastError (dwErrCode=0x57) [0190.162] IcmpCreateFile () returned 0x74f3d8 [0190.162] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790f98 [0190.162] IcmpSendEcho2 (IcmpHandle=0x74f3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xc00a8c0, RequestData=0x384fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790f98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3139 os_tid = 0x2f58 [0190.164] GetLastError () returned 0x57 [0190.164] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a733090 [0190.164] SetLastError (dwErrCode=0x57) [0190.164] IcmpCreateFile () returned 0x74f410 [0190.164] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790fe8 [0190.164] IcmpSendEcho2 (IcmpHandle=0x74f410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xd00a8c0, RequestData=0x3863ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790fe8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3140 os_tid = 0x2f5c [0190.165] GetLastError () returned 0x57 [0190.165] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a733418 [0190.165] SetLastError (dwErrCode=0x57) [0190.165] IcmpCreateFile () returned 0x728a58 [0190.165] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x791038 [0190.165] IcmpSendEcho2 (IcmpHandle=0x728a58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xe00a8c0, RequestData=0x3877ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x791038, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3141 os_tid = 0x2f60 [0190.167] GetLastError () returned 0x57 [0190.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7337a0 [0190.167] SetLastError (dwErrCode=0x57) [0190.167] IcmpCreateFile () returned 0x724be8 [0190.167] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x791088 [0190.167] IcmpSendEcho2 (IcmpHandle=0x724be8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xf00a8c0, RequestData=0x388bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x791088, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3142 os_tid = 0x2f64 [0190.168] GetLastError () returned 0x57 [0190.168] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a733b28 [0190.168] SetLastError (dwErrCode=0x57) [0190.168] IcmpCreateFile () returned 0x80c410 [0190.168] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x791268 [0190.169] IcmpSendEcho2 (IcmpHandle=0x80c410, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1000a8c0, RequestData=0x389fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x791268, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3143 os_tid = 0x2f68 [0190.170] GetLastError () returned 0x57 [0190.170] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a733eb0 [0190.170] SetLastError (dwErrCode=0x57) [0190.170] IcmpCreateFile () returned 0x80c448 [0190.170] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7910d8 [0190.170] IcmpSendEcho2 (IcmpHandle=0x80c448, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1100a8c0, RequestData=0x38b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7910d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3144 os_tid = 0x2f6c [0190.172] GetLastError () returned 0x57 [0190.172] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a734238 [0190.172] SetLastError (dwErrCode=0x57) [0190.172] IcmpCreateFile () returned 0x80c480 [0190.173] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x791128 [0190.173] IcmpSendEcho2 (IcmpHandle=0x80c480, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1200a8c0, RequestData=0x38c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x791128, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3145 os_tid = 0x2f70 [0190.174] GetLastError () returned 0x57 [0190.174] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7345c0 [0190.174] SetLastError (dwErrCode=0x57) [0190.174] IcmpCreateFile () returned 0x80c4b8 [0190.174] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x791178 [0190.174] IcmpSendEcho2 (IcmpHandle=0x80c4b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1300a8c0, RequestData=0x38dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x791178, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3146 os_tid = 0x2f74 [0190.175] GetLastError () returned 0x57 [0190.175] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a734948 [0190.175] SetLastError (dwErrCode=0x57) [0190.175] IcmpCreateFile () returned 0x80c4f0 [0190.175] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7911c8 [0190.176] IcmpSendEcho2 (IcmpHandle=0x80c4f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1400a8c0, RequestData=0x38efff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7911c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3147 os_tid = 0x2f78 [0190.177] GetLastError () returned 0x57 [0190.177] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a734cd0 [0190.177] SetLastError (dwErrCode=0x57) [0190.177] IcmpCreateFile () returned 0x80c528 [0190.177] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x791218 [0190.177] IcmpSendEcho2 (IcmpHandle=0x80c528, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1500a8c0, RequestData=0x3903ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x791218, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3148 os_tid = 0x2f7c [0190.178] GetLastError () returned 0x57 [0190.179] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a735058 [0190.179] SetLastError (dwErrCode=0x57) [0190.179] IcmpCreateFile () returned 0x80c560 [0190.179] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7912b8 [0190.179] IcmpSendEcho2 (IcmpHandle=0x80c560, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1600a8c0, RequestData=0x3917ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7912b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3149 os_tid = 0x2f80 [0190.180] GetLastError () returned 0x57 [0190.180] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7353e0 [0190.180] SetLastError (dwErrCode=0x57) [0190.180] IcmpCreateFile () returned 0x80c598 [0190.180] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790d68 [0190.180] IcmpSendEcho2 (IcmpHandle=0x80c598, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1700a8c0, RequestData=0x392bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790d68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3150 os_tid = 0x2f84 [0190.181] GetLastError () returned 0x57 [0190.182] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a735768 [0190.182] SetLastError (dwErrCode=0x57) [0190.182] IcmpCreateFile () returned 0x80c5d0 [0190.182] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790db8 [0190.182] IcmpSendEcho2 (IcmpHandle=0x80c5d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1800a8c0, RequestData=0x393fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790db8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3151 os_tid = 0x2f88 [0190.183] GetLastError () returned 0x57 [0190.183] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72e9f0 [0190.183] SetLastError (dwErrCode=0x57) [0190.183] IcmpCreateFile () returned 0x80c608 [0190.183] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790e08 [0190.183] IcmpSendEcho2 (IcmpHandle=0x80c608, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1900a8c0, RequestData=0x3953ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790e08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3152 os_tid = 0x2f8c [0190.184] GetLastError () returned 0x57 [0190.185] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72ed78 [0190.185] SetLastError (dwErrCode=0x57) [0190.185] IcmpCreateFile () returned 0x80bf40 [0190.185] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790e58 [0190.185] IcmpSendEcho2 (IcmpHandle=0x80bf40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1a00a8c0, RequestData=0x3967ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790e58, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3153 os_tid = 0x2f90 [0190.186] GetLastError () returned 0x57 [0190.186] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72f100 [0190.186] SetLastError (dwErrCode=0x57) [0190.186] IcmpCreateFile () returned 0x80bf78 [0190.186] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790ea8 [0190.186] IcmpSendEcho2 (IcmpHandle=0x80bf78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b00a8c0, RequestData=0x397bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790ea8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3154 os_tid = 0x2f94 [0190.187] GetLastError () returned 0x57 [0190.188] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72f488 [0190.188] SetLastError (dwErrCode=0x57) [0190.188] IcmpCreateFile () returned 0x80bfb0 [0190.188] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x790ef8 [0190.188] IcmpSendEcho2 (IcmpHandle=0x80bfb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1c00a8c0, RequestData=0x398fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x790ef8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3155 os_tid = 0x2f98 [0190.189] GetLastError () returned 0x57 [0190.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72f810 [0190.189] SetLastError (dwErrCode=0x57) [0190.189] IcmpCreateFile () returned 0x80bfe8 [0190.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf988 [0190.189] IcmpSendEcho2 (IcmpHandle=0x80bfe8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1d00a8c0, RequestData=0x39a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf988, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3156 os_tid = 0x2f9c [0190.190] GetLastError () returned 0x57 [0190.190] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72fb98 [0190.191] SetLastError (dwErrCode=0x57) [0190.191] IcmpCreateFile () returned 0x80c020 [0190.191] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf9d8 [0190.191] IcmpSendEcho2 (IcmpHandle=0x80c020, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1e00a8c0, RequestData=0x39b7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf9d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3157 os_tid = 0x2fa0 [0190.192] GetLastError () returned 0x57 [0190.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a72ff20 [0190.192] SetLastError (dwErrCode=0x57) [0190.192] IcmpCreateFile () returned 0x80c058 [0190.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfa28 [0190.192] IcmpSendEcho2 (IcmpHandle=0x80c058, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1f00a8c0, RequestData=0x39cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfa28, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3158 os_tid = 0x2fa4 [0190.193] GetLastError () returned 0x57 [0190.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7302a8 [0190.194] SetLastError (dwErrCode=0x57) [0190.194] IcmpCreateFile () returned 0x80c090 [0190.194] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf7a8 [0190.194] IcmpSendEcho2 (IcmpHandle=0x80c090, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2000a8c0, RequestData=0x39dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf7a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3159 os_tid = 0x2fa8 [0190.195] GetLastError () returned 0x57 [0190.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a730630 [0190.195] SetLastError (dwErrCode=0x57) [0190.195] IcmpCreateFile () returned 0x80c0c8 [0190.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf898 [0190.195] IcmpSendEcho2 (IcmpHandle=0x80c0c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2100a8c0, RequestData=0x39f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf898, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3160 os_tid = 0x2fac [0190.196] GetLastError () returned 0x57 [0190.196] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7309b8 [0190.197] SetLastError (dwErrCode=0x57) [0190.197] IcmpCreateFile () returned 0x80c100 [0190.197] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf8e8 [0190.197] IcmpSendEcho2 (IcmpHandle=0x80c100, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2200a8c0, RequestData=0x3a07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf8e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3161 os_tid = 0x2fb0 [0190.198] GetLastError () returned 0x57 [0190.198] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a730d40 [0190.198] SetLastError (dwErrCode=0x57) [0190.198] IcmpCreateFile () returned 0x80c138 [0190.198] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf938 [0190.198] IcmpSendEcho2 (IcmpHandle=0x80c138, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2300a8c0, RequestData=0x3a1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf938, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3162 os_tid = 0x2fb4 [0190.866] GetLastError () returned 0x57 [0190.866] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74e170 [0190.866] SetLastError (dwErrCode=0x57) [0190.866] IcmpCreateFile () returned 0x80cb10 [0190.866] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737f40 [0190.866] IcmpSendEcho2 (IcmpHandle=0x80cb10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2400a8c0, RequestData=0x3a2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737f40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3163 os_tid = 0x2fb8 [0190.808] GetLastError () returned 0x57 [0190.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a736200 [0190.808] SetLastError (dwErrCode=0x57) [0190.808] IcmpCreateFile () returned 0x80c170 [0190.808] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfca8 [0190.809] IcmpSendEcho2 (IcmpHandle=0x80c170, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2500a8c0, RequestData=0x3a43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfca8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3164 os_tid = 0x2fbc [0190.810] GetLastError () returned 0x57 [0190.810] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a736588 [0190.810] SetLastError (dwErrCode=0x57) [0190.810] IcmpCreateFile () returned 0x80c1a8 [0190.810] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfcf8 [0190.810] IcmpSendEcho2 (IcmpHandle=0x80c1a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2600a8c0, RequestData=0x3a57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfcf8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3165 os_tid = 0x2fc0 [0190.811] GetLastError () returned 0x57 [0190.811] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a736910 [0190.811] SetLastError (dwErrCode=0x57) [0190.811] IcmpCreateFile () returned 0x80c1e0 [0190.811] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737e00 [0190.814] IcmpSendEcho2 (IcmpHandle=0x80c1e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2700a8c0, RequestData=0x3a6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737e00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3166 os_tid = 0x2fc4 [0190.815] GetLastError () returned 0x57 [0190.815] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a736c98 [0190.815] SetLastError (dwErrCode=0x57) [0190.815] IcmpCreateFile () returned 0x80c218 [0190.815] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737a40 [0190.815] IcmpSendEcho2 (IcmpHandle=0x80c218, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2800a8c0, RequestData=0x3a7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737a40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3167 os_tid = 0x2fc8 [0190.816] GetLastError () returned 0x57 [0190.816] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a737020 [0190.816] SetLastError (dwErrCode=0x57) [0190.816] IcmpCreateFile () returned 0x80c250 [0190.816] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737a90 [0190.816] IcmpSendEcho2 (IcmpHandle=0x80c250, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2900a8c0, RequestData=0x3a93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737a90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3168 os_tid = 0x2fcc [0190.818] GetLastError () returned 0x57 [0190.818] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7373a8 [0190.819] SetLastError (dwErrCode=0x57) [0190.819] IcmpCreateFile () returned 0x80c288 [0190.819] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737ae0 [0190.819] IcmpSendEcho2 (IcmpHandle=0x80c288, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2a00a8c0, RequestData=0x3aa7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737ae0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3169 os_tid = 0x2fd0 [0190.820] GetLastError () returned 0x57 [0190.820] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a735af0 [0190.820] SetLastError (dwErrCode=0x57) [0190.820] IcmpCreateFile () returned 0x80c2c0 [0190.820] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737b30 [0190.820] IcmpSendEcho2 (IcmpHandle=0x80c2c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2b00a8c0, RequestData=0x3abbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737b30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3170 os_tid = 0x2fd4 [0190.821] GetLastError () returned 0x57 [0190.821] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a735e78 [0190.821] SetLastError (dwErrCode=0x57) [0190.821] IcmpCreateFile () returned 0x80c2f8 [0190.821] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737b80 [0190.821] IcmpSendEcho2 (IcmpHandle=0x80c2f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2c00a8c0, RequestData=0x3acfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737b80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3171 os_tid = 0x2fd8 [0190.822] GetLastError () returned 0x57 [0190.822] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aa280 [0190.822] SetLastError (dwErrCode=0x57) [0190.822] IcmpCreateFile () returned 0x80c330 [0190.822] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737bd0 [0190.822] IcmpSendEcho2 (IcmpHandle=0x80c330, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2d00a8c0, RequestData=0x3ae3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737bd0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3172 os_tid = 0x2fdc [0190.823] GetLastError () returned 0x57 [0190.823] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aa608 [0190.823] SetLastError (dwErrCode=0x57) [0190.823] IcmpCreateFile () returned 0x80c368 [0190.823] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737c20 [0190.823] IcmpSendEcho2 (IcmpHandle=0x80c368, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2e00a8c0, RequestData=0x3af7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737c20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3173 os_tid = 0x2fe0 [0190.824] GetLastError () returned 0x57 [0190.824] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aa990 [0190.825] SetLastError (dwErrCode=0x57) [0190.825] IcmpCreateFile () returned 0x80c3a0 [0190.825] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737c70 [0190.825] IcmpSendEcho2 (IcmpHandle=0x80c3a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x2f00a8c0, RequestData=0x3b0bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737c70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3174 os_tid = 0x2fe4 [0190.826] GetLastError () returned 0x57 [0190.826] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7aad18 [0190.826] SetLastError (dwErrCode=0x57) [0190.826] IcmpCreateFile () returned 0x80c3d8 [0190.826] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737cc0 [0190.826] IcmpSendEcho2 (IcmpHandle=0x80c3d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3000a8c0, RequestData=0x3b1fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737cc0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3175 os_tid = 0x2fe8 [0190.827] GetLastError () returned 0x57 [0190.827] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a9ef8 [0190.828] SetLastError (dwErrCode=0x57) [0190.828] IcmpCreateFile () returned 0x80cbf0 [0190.828] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737e50 [0190.828] IcmpSendEcho2 (IcmpHandle=0x80cbf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3100a8c0, RequestData=0x3b33ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737e50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3176 os_tid = 0x2fec [0190.829] GetLastError () returned 0x57 [0190.829] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7ab0a0 [0190.829] SetLastError (dwErrCode=0x57) [0190.829] IcmpCreateFile () returned 0x80c790 [0190.829] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737d10 [0190.829] IcmpSendEcho2 (IcmpHandle=0x80c790, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3200a8c0, RequestData=0x3b47ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737d10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3177 os_tid = 0x2ff0 [0190.830] GetLastError () returned 0x57 [0190.830] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x7a9460 [0190.830] SetLastError (dwErrCode=0x57) [0190.831] IcmpCreateFile () returned 0x80c7c8 [0190.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737d60 [0190.831] IcmpSendEcho2 (IcmpHandle=0x80c7c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3300a8c0, RequestData=0x3b5bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737d60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3178 os_tid = 0x2ff4 [0190.832] GetLastError () returned 0x57 [0190.832] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78ed10 [0190.832] SetLastError (dwErrCode=0x57) [0190.832] IcmpCreateFile () returned 0x80c800 [0190.832] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737db0 [0190.832] IcmpSendEcho2 (IcmpHandle=0x80c800, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3400a8c0, RequestData=0x3b6fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737db0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3179 os_tid = 0x2ff8 [0190.833] GetLastError () returned 0x57 [0190.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x78db68 [0190.833] SetLastError (dwErrCode=0x57) [0190.833] IcmpCreateFile () returned 0x80c838 [0190.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737ea0 [0190.833] IcmpSendEcho2 (IcmpHandle=0x80c838, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3500a8c0, RequestData=0x3b83ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737ea0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3180 os_tid = 0x2ffc [0190.835] GetLastError () returned 0x57 [0190.835] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74dde8 [0190.842] SetLastError (dwErrCode=0x57) [0190.842] IcmpCreateFile () returned 0x80cad8 [0190.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737ef0 [0190.842] IcmpSendEcho2 (IcmpHandle=0x80cad8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3600a8c0, RequestData=0x3b97ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737ef0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3181 os_tid = 0x123c [0190.843] GetLastError () returned 0x57 [0190.843] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a749748 [0190.843] SetLastError (dwErrCode=0x57) [0190.843] IcmpCreateFile () returned 0x80cc98 [0190.844] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7381c0 [0190.844] IcmpSendEcho2 (IcmpHandle=0x80cc98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3700a8c0, RequestData=0x3babff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7381c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3182 os_tid = 0x1230 [0190.845] GetLastError () returned 0x57 [0190.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a749ad0 [0190.845] SetLastError (dwErrCode=0x57) [0190.845] IcmpCreateFile () returned 0x80ccd0 [0190.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738210 [0190.845] IcmpSendEcho2 (IcmpHandle=0x80ccd0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3800a8c0, RequestData=0x3bbfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738210, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3183 os_tid = 0x29e0 [0190.846] GetLastError () returned 0x57 [0190.846] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a749e58 [0190.847] SetLastError (dwErrCode=0x57) [0190.847] IcmpCreateFile () returned 0x80cd08 [0190.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738260 [0190.847] IcmpSendEcho2 (IcmpHandle=0x80cd08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3900a8c0, RequestData=0x3bd3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738260, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3184 os_tid = 0x1238 [0191.147] GetLastError () returned 0x57 [0191.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74a1e0 [0191.147] SetLastError (dwErrCode=0x57) [0191.147] IcmpCreateFile () returned 0x80c640 [0191.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7382b0 [0191.147] IcmpSendEcho2 (IcmpHandle=0x80c640, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3a00a8c0, RequestData=0x3be7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7382b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3185 os_tid = 0x122c [0191.149] GetLastError () returned 0x57 [0191.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74a568 [0191.149] SetLastError (dwErrCode=0x57) [0191.149] IcmpCreateFile () returned 0x80c678 [0191.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737900 [0191.149] IcmpSendEcho2 (IcmpHandle=0x80c678, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3b00a8c0, RequestData=0x1480ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737900, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3186 os_tid = 0x1048 [0191.151] GetLastError () returned 0x57 [0191.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74a8f0 [0191.151] SetLastError (dwErrCode=0x57) [0191.151] IcmpCreateFile () returned 0x80c6b0 [0191.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737950 [0191.151] IcmpSendEcho2 (IcmpHandle=0x80c6b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3c00a8c0, RequestData=0x14d4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737950, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3187 os_tid = 0x328 [0191.153] GetLastError () returned 0x57 [0191.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74ac78 [0191.153] SetLastError (dwErrCode=0x57) [0191.153] IcmpCreateFile () returned 0x80c6e8 [0191.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7379a0 [0191.153] IcmpSendEcho2 (IcmpHandle=0x80c6e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3d00a8c0, RequestData=0x14e4ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7379a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3188 os_tid = 0x4ac [0191.154] GetLastError () returned 0x57 [0191.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74b000 [0191.155] SetLastError (dwErrCode=0x57) [0191.155] IcmpCreateFile () returned 0x80c720 [0191.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7379f0 [0191.155] IcmpSendEcho2 (IcmpHandle=0x80c720, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3e00a8c0, RequestData=0x1508ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7379f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3189 os_tid = 0xab4 [0191.156] GetLastError () returned 0x57 [0191.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74b388 [0191.156] SetLastError (dwErrCode=0x57) [0191.156] IcmpCreateFile () returned 0x80c758 [0191.156] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737f90 [0191.156] IcmpSendEcho2 (IcmpHandle=0x80c758, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x3f00a8c0, RequestData=0x1518ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737f90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3190 os_tid = 0x3004 [0191.158] GetLastError () returned 0x57 [0191.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74b710 [0191.158] SetLastError (dwErrCode=0x57) [0191.158] IcmpCreateFile () returned 0x80c870 [0191.158] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a737fe0 [0191.158] IcmpSendEcho2 (IcmpHandle=0x80c870, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4000a8c0, RequestData=0x1540ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a737fe0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3191 os_tid = 0x1234 [0191.204] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.204] ReadFile (in: hFile=0x2208, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.206] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.206] ReadFile (in: hFile=0x2208, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.206] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.210] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x152cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0191.210] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x152cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x152cf828, pbKeyObject=0x0) returned 0x0 [0191.210] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x152cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x152cf500) returned 0x0 [0191.210] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.210] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x152cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x152cf500) returned 0x0 [0191.213] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.217] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.217] WriteFile (in: hFile=0x2208, lpBuffer=0x152cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x152cf830, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesWritten=0x152cf830*=0x428, lpOverlapped=0x0) returned 1 [0191.217] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.217] ReadFile (in: hFile=0x2208, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x152cf61c*=0x1b83a, lpOverlapped=0x0) returned 1 [0191.219] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffe47c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.219] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0x1b83a, pPaddingInfo=0x0, pbIV=0x152cf848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x152cf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x152cf848, pbOutput=0x3f50000, pcbResult=0x152cf618) returned 0x0 [0191.220] WriteFile (in: hFile=0x2208, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x152cf61c*=0x1b840, lpOverlapped=0x0) returned 1 [0191.220] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x152cf60c | out: lpNewFilePointer=0x0) returned 1 [0191.220] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.220] WriteFile (in: hFile=0x2208, lpBuffer=0x152cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x152cf83c*, lpNumberOfBytesWritten=0x152cf61c*=0x8, lpOverlapped=0x0) returned 1 [0191.220] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x1b840, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.220] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.220] CloseHandle (hObject=0x2208) returned 1 [0191.221] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.play")) returned 1 [0191.225] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3192 os_tid = 0x300c [0191.229] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.229] ReadFile (in: hFile=0x2568, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.231] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.231] ReadFile (in: hFile=0x2568, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.231] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.234] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1554f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0191.234] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1554f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1554f828, pbKeyObject=0x0) returned 0x0 [0191.234] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1554f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1554f500) returned 0x0 [0191.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.234] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1554f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1554f500) returned 0x0 [0191.238] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.241] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.241] WriteFile (in: hFile=0x2568, lpBuffer=0x1554fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1554f830, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesWritten=0x1554f830*=0x428, lpOverlapped=0x0) returned 1 [0191.242] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.242] ReadFile (in: hFile=0x2568, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1554f61c*=0x1df43, lpOverlapped=0x0) returned 1 [0191.243] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0xfffe20bd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.243] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x1df43, pPaddingInfo=0x0, pbIV=0x1554f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1554f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1554f848, pbOutput=0x2750000, pcbResult=0x1554f618) returned 0x0 [0191.244] WriteFile (in: hFile=0x2568, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1554f61c*=0x1df50, lpOverlapped=0x0) returned 1 [0191.244] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1554f60c | out: lpNewFilePointer=0x0) returned 1 [0191.244] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.244] WriteFile (in: hFile=0x2568, lpBuffer=0x1554f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x1554f83c*, lpNumberOfBytesWritten=0x1554f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.244] SetFilePointerEx (in: hFile=0x2568, liDistanceToMove=0x1df50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.244] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.244] CloseHandle (hObject=0x2568) returned 1 [0191.244] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.play")) returned 1 [0191.248] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3193 os_tid = 0x3010 [0191.252] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.253] ReadFile (in: hFile=0x2570, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.254] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.254] ReadFile (in: hFile=0x2570, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.255] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.260] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1580f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0191.260] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1580f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1580f828, pbKeyObject=0x0) returned 0x0 [0191.260] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1580f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0191.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.260] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1580f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0191.263] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.266] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.266] WriteFile (in: hFile=0x2570, lpBuffer=0x1580fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1580f830, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesWritten=0x1580f830*=0x428, lpOverlapped=0x0) returned 1 [0191.267] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.267] ReadFile (in: hFile=0x2570, lpBuffer=0x2850000, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1580f61c*=0x184d3, lpOverlapped=0x0) returned 1 [0191.268] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffe7b2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.268] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x184d3, pPaddingInfo=0x0, pbIV=0x1580f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1580f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1580f848, pbOutput=0x2850000, pcbResult=0x1580f618) returned 0x0 [0191.268] WriteFile (in: hFile=0x2570, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1580f61c*=0x184e0, lpOverlapped=0x0) returned 1 [0191.268] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1580f60c | out: lpNewFilePointer=0x0) returned 1 [0191.269] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.269] WriteFile (in: hFile=0x2570, lpBuffer=0x1580f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x1580f83c*, lpNumberOfBytesWritten=0x1580f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.269] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x184e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.269] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.269] CloseHandle (hObject=0x2570) returned 1 [0191.269] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.play")) returned 1 [0191.273] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3194 os_tid = 0x3014 [0191.277] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.277] ReadFile (in: hFile=0x2578, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.279] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.279] ReadFile (in: hFile=0x2578, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.279] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.282] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.282] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0191.282] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0191.282] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0191.282] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.282] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0191.285] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.289] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.289] WriteFile (in: hFile=0x2578, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0191.289] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.289] ReadFile (in: hFile=0x2578, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1590f61c*=0x1aba5, lpOverlapped=0x0) returned 1 [0191.291] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0xfffe545b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.291] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x1aba5, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2950000, pcbResult=0x1590f618) returned 0x0 [0191.291] WriteFile (in: hFile=0x2578, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1590f61c*=0x1abb0, lpOverlapped=0x0) returned 1 [0191.292] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0191.292] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.292] WriteFile (in: hFile=0x2578, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.292] SetFilePointerEx (in: hFile=0x2578, liDistanceToMove=0x1abb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.292] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.292] CloseHandle (hObject=0x2578) returned 1 [0191.292] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.play")) returned 1 [0191.296] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3195 os_tid = 0x3018 [0191.290] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.290] ReadFile (in: hFile=0x2580, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.302] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.302] ReadFile (in: hFile=0x2580, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.303] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.305] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.305] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x15a4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0191.306] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x15a4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x15a4f828, pbKeyObject=0x0) returned 0x0 [0191.306] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15a4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15a4f500) returned 0x0 [0191.306] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.306] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15a4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15a4f500) returned 0x0 [0191.309] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.312] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.312] WriteFile (in: hFile=0x2580, lpBuffer=0x15a4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a4f830, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesWritten=0x15a4f830*=0x428, lpOverlapped=0x0) returned 1 [0191.312] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.312] ReadFile (in: hFile=0x2580, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x15a4f61c*=0x1653a, lpOverlapped=0x0) returned 1 [0191.314] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffe9ac6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.314] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0x1653a, pPaddingInfo=0x0, pbIV=0x15a4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x15a4f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a4f848, pbOutput=0x2a50000, pcbResult=0x15a4f618) returned 0x0 [0191.314] WriteFile (in: hFile=0x2580, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x15a4f61c*=0x16540, lpOverlapped=0x0) returned 1 [0191.314] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a4f60c | out: lpNewFilePointer=0x0) returned 1 [0191.314] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.315] WriteFile (in: hFile=0x2580, lpBuffer=0x15a4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a4f83c*, lpNumberOfBytesWritten=0x15a4f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.315] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x16540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.315] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.315] CloseHandle (hObject=0x2580) returned 1 [0191.315] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.play")) returned 1 [0191.319] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3196 os_tid = 0x301c [0191.313] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.325] ReadFile (in: hFile=0x2588, lpBuffer=0x15b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesRead=0x15b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.326] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.326] ReadFile (in: hFile=0x2588, lpBuffer=0x15b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesRead=0x15b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.326] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.329] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.329] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15b8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0191.329] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15b8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15b8f828, pbKeyObject=0x0) returned 0x0 [0191.329] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15b8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15b8f500) returned 0x0 [0191.329] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.329] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15b8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15b8f500) returned 0x0 [0191.332] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.335] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.335] WriteFile (in: hFile=0x2588, lpBuffer=0x15b8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b8f830, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesWritten=0x15b8f830*=0x428, lpOverlapped=0x0) returned 1 [0191.336] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.336] ReadFile (in: hFile=0x2588, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15b8f61c*=0x13e1d, lpOverlapped=0x0) returned 1 [0191.350] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0xfffec1e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.350] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0x13e1d, pPaddingInfo=0x0, pbIV=0x15b8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15b8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15b8f848, pbOutput=0x2b50000, pcbResult=0x15b8f618) returned 0x0 [0191.350] WriteFile (in: hFile=0x2588, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15b8f61c*=0x13e20, lpOverlapped=0x0) returned 1 [0191.350] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b8f60c | out: lpNewFilePointer=0x0) returned 1 [0191.350] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.350] WriteFile (in: hFile=0x2588, lpBuffer=0x15b8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b8f83c*, lpNumberOfBytesWritten=0x15b8f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.350] SetFilePointerEx (in: hFile=0x2588, liDistanceToMove=0x13e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.350] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.351] CloseHandle (hObject=0x2588) returned 1 [0191.351] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.play")) returned 1 [0191.355] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3197 os_tid = 0x3020 [0191.337] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.337] ReadFile (in: hFile=0x2590, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0191.338] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.338] ReadFile (in: hFile=0x2590, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0191.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.341] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.341] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0191.341] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0191.341] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0191.341] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.341] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0191.344] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.348] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.348] WriteFile (in: hFile=0x2590, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0191.348] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.348] ReadFile (in: hFile=0x2590, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x219ff61c*=0x1531c, lpOverlapped=0x0) returned 1 [0191.359] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffeace4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.359] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x2c50000, cbInput=0x1531c, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x219ff848, pbOutput=0x2c50000, pcbResult=0x219ff618) returned 0x0 [0191.359] WriteFile (in: hFile=0x2590, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x219ff61c*=0x15320, lpOverlapped=0x0) returned 1 [0191.360] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0191.360] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.360] WriteFile (in: hFile=0x2590, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0191.360] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x15320, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.360] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0191.360] CloseHandle (hObject=0x2590) returned 1 [0191.360] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.play")) returned 1 [0191.364] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3198 os_tid = 0x3024 [0191.369] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.369] ReadFile (in: hFile=0x2598, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.370] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.370] ReadFile (in: hFile=0x2598, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.370] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.373] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.373] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0191.373] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0191.373] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0191.373] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.373] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0191.376] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.379] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.380] WriteFile (in: hFile=0x2598, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0191.380] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.380] ReadFile (in: hFile=0x2598, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x2d37f61c*=0x1ad37, lpOverlapped=0x0) returned 1 [0191.393] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0xfffe52c9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.393] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x1ad37, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x2d50000, pcbResult=0x2d37f618) returned 0x0 [0191.393] WriteFile (in: hFile=0x2598, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x1ad40, lpOverlapped=0x0) returned 1 [0191.394] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0191.394] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.394] WriteFile (in: hFile=0x2598, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.394] SetFilePointerEx (in: hFile=0x2598, liDistanceToMove=0x1ad40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.394] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.394] CloseHandle (hObject=0x2598) returned 1 [0191.394] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.play")) returned 1 [0191.399] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3199 os_tid = 0x3028 [0191.404] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.404] ReadFile (in: hFile=0x25a0, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.405] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.405] ReadFile (in: hFile=0x25a0, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.405] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.408] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.408] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0191.408] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0191.408] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0191.408] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.408] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0191.412] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.415] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.415] WriteFile (in: hFile=0x25a0, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0191.415] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.415] ReadFile (in: hFile=0x25a0, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2d47f61c*=0x178d2, lpOverlapped=0x0) returned 1 [0191.417] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffe872e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.417] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0x178d2, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d47f848, pbOutput=0x2e50000, pcbResult=0x2d47f618) returned 0x0 [0191.417] WriteFile (in: hFile=0x25a0, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2d47f61c*=0x178e0, lpOverlapped=0x0) returned 1 [0191.418] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0191.418] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.418] WriteFile (in: hFile=0x25a0, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.418] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x178e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.418] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.418] CloseHandle (hObject=0x25a0) returned 1 [0191.418] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.play")) returned 1 [0191.422] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3200 os_tid = 0x302c [0191.416] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.416] ReadFile (in: hFile=0x25a8, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.428] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.428] ReadFile (in: hFile=0x25a8, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.432] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.432] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0191.432] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0191.432] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0191.432] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.432] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0191.435] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.441] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.442] WriteFile (in: hFile=0x25a8, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0191.442] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.442] ReadFile (in: hFile=0x25a8, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d57f61c*=0x17749, lpOverlapped=0x0) returned 1 [0191.445] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0xfffe88b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.445] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2f50000, cbInput=0x17749, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x2f50000, pcbResult=0x2d57f618) returned 0x0 [0191.445] WriteFile (in: hFile=0x25a8, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d57f61c*=0x17750, lpOverlapped=0x0) returned 1 [0191.446] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0191.446] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.446] WriteFile (in: hFile=0x25a8, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.446] SetFilePointerEx (in: hFile=0x25a8, liDistanceToMove=0x17750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.446] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.446] CloseHandle (hObject=0x25a8) returned 1 [0191.446] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.play")) returned 1 [0191.451] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3201 os_tid = 0x3030 [0191.456] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.457] ReadFile (in: hFile=0x25b0, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.458] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.458] ReadFile (in: hFile=0x25b0, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.458] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.461] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.462] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0191.462] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d6bf828, pbKeyObject=0x0) returned 0x0 [0191.462] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d6bf500) returned 0x0 [0191.462] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.462] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d6bf500) returned 0x0 [0191.466] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.469] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.469] WriteFile (in: hFile=0x25b0, lpBuffer=0x2d6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesWritten=0x2d6bf830*=0x428, lpOverlapped=0x0) returned 1 [0191.469] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.469] ReadFile (in: hFile=0x25b0, lpBuffer=0x3050000, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d6bf61c*=0x15a7f, lpOverlapped=0x0) returned 1 [0191.470] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffea581, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.470] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x15a7f, pPaddingInfo=0x0, pbIV=0x2d6bf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d6bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d6bf848, pbOutput=0x3050000, pcbResult=0x2d6bf618) returned 0x0 [0191.470] WriteFile (in: hFile=0x25b0, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d6bf61c*=0x15a80, lpOverlapped=0x0) returned 1 [0191.471] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6bf60c | out: lpNewFilePointer=0x0) returned 1 [0191.471] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.471] WriteFile (in: hFile=0x25b0, lpBuffer=0x2d6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf83c*, lpNumberOfBytesWritten=0x2d6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0191.471] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x15a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.471] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.471] CloseHandle (hObject=0x25b0) returned 1 [0191.471] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.play")) returned 1 [0191.475] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3202 os_tid = 0x3034 [0191.479] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.480] ReadFile (in: hFile=0x25b8, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0191.481] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.481] ReadFile (in: hFile=0x25b8, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0191.481] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.484] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.484] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0191.484] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d7ff828, pbKeyObject=0x0) returned 0x0 [0191.484] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d7ff500) returned 0x0 [0191.484] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.484] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d7ff500) returned 0x0 [0191.487] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.493] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.493] WriteFile (in: hFile=0x25b8, lpBuffer=0x2d7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesWritten=0x2d7ff830*=0x428, lpOverlapped=0x0) returned 1 [0191.494] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.494] ReadFile (in: hFile=0x25b8, lpBuffer=0x3150000, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d7ff61c*=0x15fef, lpOverlapped=0x0) returned 1 [0191.495] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0xfffea011, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.495] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x15fef, pPaddingInfo=0x0, pbIV=0x2d7ff848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d7ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d7ff848, pbOutput=0x3150000, pcbResult=0x2d7ff618) returned 0x0 [0191.496] WriteFile (in: hFile=0x25b8, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d7ff61c*=0x15ff0, lpOverlapped=0x0) returned 1 [0191.496] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7ff60c | out: lpNewFilePointer=0x0) returned 1 [0191.496] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.496] WriteFile (in: hFile=0x25b8, lpBuffer=0x2d7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ff83c*, lpNumberOfBytesWritten=0x2d7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0191.496] SetFilePointerEx (in: hFile=0x25b8, liDistanceToMove=0x15ff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.496] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.496] CloseHandle (hObject=0x25b8) returned 1 [0191.496] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.play")) returned 1 [0191.501] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3203 os_tid = 0x3038 [0191.505] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.505] ReadFile (in: hFile=0x25c0, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.507] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.507] ReadFile (in: hFile=0x25c0, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.507] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.509] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.509] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0191.509] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d93f828, pbKeyObject=0x0) returned 0x0 [0191.509] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d93f500) returned 0x0 [0191.510] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.510] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d93f500) returned 0x0 [0191.513] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.516] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.516] WriteFile (in: hFile=0x25c0, lpBuffer=0x2d93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d93f830, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesWritten=0x2d93f830*=0x428, lpOverlapped=0x0) returned 1 [0191.516] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.516] ReadFile (in: hFile=0x25c0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d93f61c*=0x1a9ed, lpOverlapped=0x0) returned 1 [0191.520] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffe5613, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.520] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x1a9ed, pPaddingInfo=0x0, pbIV=0x2d93f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d93f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d93f848, pbOutput=0x3250000, pcbResult=0x2d93f618) returned 0x0 [0191.520] WriteFile (in: hFile=0x25c0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d93f61c*=0x1a9f0, lpOverlapped=0x0) returned 1 [0191.521] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d93f60c | out: lpNewFilePointer=0x0) returned 1 [0191.521] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.521] WriteFile (in: hFile=0x25c0, lpBuffer=0x2d93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d93f83c*, lpNumberOfBytesWritten=0x2d93f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.521] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0x1a9f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.521] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.521] CloseHandle (hObject=0x25c0) returned 1 [0191.521] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.play")) returned 1 [0191.526] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3204 os_tid = 0x303c [0191.530] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.531] ReadFile (in: hFile=0x25c8, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.532] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.533] ReadFile (in: hFile=0x25c8, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.533] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.536] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.536] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2da7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0191.536] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2da7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2da7f828, pbKeyObject=0x0) returned 0x0 [0191.536] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2da7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2da7f500) returned 0x0 [0191.537] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.537] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2da7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2da7f500) returned 0x0 [0191.542] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.546] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.546] WriteFile (in: hFile=0x25c8, lpBuffer=0x2da7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da7f830, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesWritten=0x2da7f830*=0x428, lpOverlapped=0x0) returned 1 [0191.546] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.546] ReadFile (in: hFile=0x25c8, lpBuffer=0x3350000, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2da7f61c*=0x193e7, lpOverlapped=0x0) returned 1 [0191.548] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0xfffe6c19, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.548] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0x193e7, pPaddingInfo=0x0, pbIV=0x2da7f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2da7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2da7f848, pbOutput=0x3350000, pcbResult=0x2da7f618) returned 0x0 [0191.549] WriteFile (in: hFile=0x25c8, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2da7f61c*=0x193f0, lpOverlapped=0x0) returned 1 [0191.549] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da7f60c | out: lpNewFilePointer=0x0) returned 1 [0191.549] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.549] WriteFile (in: hFile=0x25c8, lpBuffer=0x2da7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da7f83c*, lpNumberOfBytesWritten=0x2da7f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.549] SetFilePointerEx (in: hFile=0x25c8, liDistanceToMove=0x193f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.549] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.549] CloseHandle (hObject=0x25c8) returned 1 [0191.550] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.play")) returned 1 [0191.555] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3205 os_tid = 0x3040 [0191.547] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.547] ReadFile (in: hFile=0x25d0, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.561] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.561] ReadFile (in: hFile=0x25d0, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.565] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.565] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0191.565] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0191.565] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0191.565] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.565] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0191.570] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.574] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.574] WriteFile (in: hFile=0x25d0, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0191.575] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.575] ReadFile (in: hFile=0x25d0, lpBuffer=0x3450000, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2ddbf61c*=0x14f8a, lpOverlapped=0x0) returned 1 [0191.576] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffeb076, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.577] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0x14f8a, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2ddbf848, pbOutput=0x3450000, pcbResult=0x2ddbf618) returned 0x0 [0191.577] WriteFile (in: hFile=0x25d0, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x14f90, lpOverlapped=0x0) returned 1 [0191.577] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0191.577] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.577] WriteFile (in: hFile=0x25d0, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0191.578] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x14f90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.578] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.578] CloseHandle (hObject=0x25d0) returned 1 [0191.578] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.play")) returned 1 [0191.583] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3206 os_tid = 0x3048 [0191.635] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.635] ReadFile (in: hFile=0x25d0, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.637] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.637] ReadFile (in: hFile=0x25d0, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.638] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.643] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.643] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x152cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0191.643] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x152cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x152cf828, pbKeyObject=0x0) returned 0x0 [0191.643] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x152cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x152cf500) returned 0x0 [0191.643] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.643] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x152cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x152cf500) returned 0x0 [0191.648] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.653] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.653] WriteFile (in: hFile=0x25d0, lpBuffer=0x152cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x152cf830, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesWritten=0x152cf830*=0x428, lpOverlapped=0x0) returned 1 [0191.653] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.653] ReadFile (in: hFile=0x25d0, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x152cf61c*=0x1a3f4, lpOverlapped=0x0) returned 1 [0191.655] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffe5c0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.655] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x1a3f4, pPaddingInfo=0x0, pbIV=0x152cf848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x152cf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x152cf848, pbOutput=0x2750000, pcbResult=0x152cf618) returned 0x0 [0191.655] WriteFile (in: hFile=0x25d0, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x152cf61c*=0x1a400, lpOverlapped=0x0) returned 1 [0191.656] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x152cf60c | out: lpNewFilePointer=0x0) returned 1 [0191.656] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.657] WriteFile (in: hFile=0x25d0, lpBuffer=0x152cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x152cf83c*, lpNumberOfBytesWritten=0x152cf61c*=0x8, lpOverlapped=0x0) returned 1 [0191.657] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x1a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.657] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.657] CloseHandle (hObject=0x25d0) returned 1 [0191.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.play")) returned 1 [0191.663] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3207 os_tid = 0x304c [0191.705] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.705] ReadFile (in: hFile=0x25c0, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.707] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.707] ReadFile (in: hFile=0x25c0, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.707] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.715] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1554f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0191.715] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1554f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1554f828, pbKeyObject=0x0) returned 0x0 [0191.715] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1554f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1554f500) returned 0x0 [0191.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.715] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1554f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1554f500) returned 0x0 [0191.720] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.724] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.724] WriteFile (in: hFile=0x25c0, lpBuffer=0x1554fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1554f830, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesWritten=0x1554f830*=0x428, lpOverlapped=0x0) returned 1 [0191.725] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.725] ReadFile (in: hFile=0x25c0, lpBuffer=0x2850000, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1554f61c*=0x18ac4, lpOverlapped=0x0) returned 1 [0191.726] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffe753c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.726] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x18ac4, pPaddingInfo=0x0, pbIV=0x1554f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1554f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1554f848, pbOutput=0x2850000, pcbResult=0x1554f618) returned 0x0 [0191.727] WriteFile (in: hFile=0x25c0, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1554f61c*=0x18ad0, lpOverlapped=0x0) returned 1 [0191.727] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1554f60c | out: lpNewFilePointer=0x0) returned 1 [0191.727] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.727] WriteFile (in: hFile=0x25c0, lpBuffer=0x1554f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x1554f83c*, lpNumberOfBytesWritten=0x1554f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.727] SetFilePointerEx (in: hFile=0x25c0, liDistanceToMove=0x18ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.727] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.727] CloseHandle (hObject=0x25c0) returned 1 [0191.728] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.play")) returned 1 [0191.733] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3208 os_tid = 0x3050 [0191.739] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.739] ReadFile (in: hFile=0x25b0, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.789] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.789] ReadFile (in: hFile=0x25b0, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.789] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.792] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.793] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1580f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0191.793] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1580f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1580f828, pbKeyObject=0x0) returned 0x0 [0191.793] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1580f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0191.793] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.793] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1580f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0191.798] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.802] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.802] WriteFile (in: hFile=0x25b0, lpBuffer=0x1580fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1580f830, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesWritten=0x1580f830*=0x428, lpOverlapped=0x0) returned 1 [0191.803] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.803] ReadFile (in: hFile=0x25b0, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1580f61c*=0x1bef7, lpOverlapped=0x0) returned 1 [0191.805] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffe4109, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.805] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x1bef7, pPaddingInfo=0x0, pbIV=0x1580f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1580f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1580f848, pbOutput=0x2950000, pcbResult=0x1580f618) returned 0x0 [0191.805] WriteFile (in: hFile=0x25b0, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1580f61c*=0x1bf00, lpOverlapped=0x0) returned 1 [0191.806] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1580f60c | out: lpNewFilePointer=0x0) returned 1 [0191.806] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.806] WriteFile (in: hFile=0x25b0, lpBuffer=0x1580f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x1580f83c*, lpNumberOfBytesWritten=0x1580f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.806] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x1bf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.806] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.806] CloseHandle (hObject=0x25b0) returned 1 [0191.806] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.play")) returned 1 [0191.812] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3209 os_tid = 0x3054 [0191.818] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.818] ReadFile (in: hFile=0x25a0, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.820] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.820] ReadFile (in: hFile=0x25a0, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.820] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.824] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0191.824] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0191.824] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0191.824] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.825] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0191.829] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.834] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.834] WriteFile (in: hFile=0x25a0, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0191.835] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.835] ReadFile (in: hFile=0x25a0, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1590f61c*=0x17dee, lpOverlapped=0x0) returned 1 [0191.836] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffe8212, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.836] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0x17dee, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2a50000, pcbResult=0x1590f618) returned 0x0 [0191.836] WriteFile (in: hFile=0x25a0, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1590f61c*=0x17df0, lpOverlapped=0x0) returned 1 [0191.837] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0191.837] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.837] WriteFile (in: hFile=0x25a0, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.837] SetFilePointerEx (in: hFile=0x25a0, liDistanceToMove=0x17df0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.837] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.837] CloseHandle (hObject=0x25a0) returned 1 [0191.837] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.play")) returned 1 [0191.842] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3210 os_tid = 0x3058 [0191.850] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.850] ReadFile (in: hFile=0x2590, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.852] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.852] ReadFile (in: hFile=0x2590, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.852] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.856] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.856] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15a4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0191.856] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15a4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15a4f828, pbKeyObject=0x0) returned 0x0 [0191.856] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15a4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15a4f500) returned 0x0 [0191.857] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.857] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15a4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15a4f500) returned 0x0 [0191.862] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.867] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.867] WriteFile (in: hFile=0x2590, lpBuffer=0x15a4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a4f830, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesWritten=0x15a4f830*=0x428, lpOverlapped=0x0) returned 1 [0191.867] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.867] ReadFile (in: hFile=0x2590, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15a4f61c*=0x1bb02, lpOverlapped=0x0) returned 1 [0191.869] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffe44fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.869] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0x1bb02, pPaddingInfo=0x0, pbIV=0x15a4f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15a4f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a4f848, pbOutput=0x2b50000, pcbResult=0x15a4f618) returned 0x0 [0191.869] WriteFile (in: hFile=0x2590, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15a4f61c*=0x1bb10, lpOverlapped=0x0) returned 1 [0191.870] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a4f60c | out: lpNewFilePointer=0x0) returned 1 [0191.870] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.870] WriteFile (in: hFile=0x2590, lpBuffer=0x15a4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a4f83c*, lpNumberOfBytesWritten=0x15a4f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.870] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x1bb10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.870] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.870] CloseHandle (hObject=0x2590) returned 1 [0191.870] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.play")) returned 1 [0191.875] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3211 os_tid = 0x305c [0191.881] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.881] ReadFile (in: hFile=0x2580, lpBuffer=0x15b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesRead=0x15b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.883] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.883] ReadFile (in: hFile=0x2580, lpBuffer=0x15b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesRead=0x15b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.883] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.887] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.887] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x15b8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0191.887] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x15b8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x15b8f828, pbKeyObject=0x0) returned 0x0 [0191.887] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15b8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15b8f500) returned 0x0 [0191.888] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.888] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15b8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15b8f500) returned 0x0 [0191.893] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.906] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.906] WriteFile (in: hFile=0x2580, lpBuffer=0x15b8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b8f830, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesWritten=0x15b8f830*=0x428, lpOverlapped=0x0) returned 1 [0191.907] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.907] ReadFile (in: hFile=0x2580, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x15b8f61c*=0x18888, lpOverlapped=0x0) returned 1 [0191.908] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffe7778, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.908] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2c50000, cbInput=0x18888, pPaddingInfo=0x0, pbIV=0x15b8f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x15b8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15b8f848, pbOutput=0x2c50000, pcbResult=0x15b8f618) returned 0x0 [0191.908] WriteFile (in: hFile=0x2580, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x15b8f61c*=0x18890, lpOverlapped=0x0) returned 1 [0191.909] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b8f60c | out: lpNewFilePointer=0x0) returned 1 [0191.909] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.909] WriteFile (in: hFile=0x2580, lpBuffer=0x15b8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b8f83c*, lpNumberOfBytesWritten=0x15b8f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.909] SetFilePointerEx (in: hFile=0x2580, liDistanceToMove=0x18890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.909] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.909] CloseHandle (hObject=0x2580) returned 1 [0191.909] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.play")) returned 1 [0191.915] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3212 os_tid = 0x3060 [0191.883] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.921] ReadFile (in: hFile=0x2570, lpBuffer=0x15ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesRead=0x15ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.922] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.922] ReadFile (in: hFile=0x2570, lpBuffer=0x15ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesRead=0x15ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0191.922] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.926] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.926] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x15ccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0191.926] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x15ccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x15ccf828, pbKeyObject=0x0) returned 0x0 [0191.926] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15ccf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15ccf500) returned 0x0 [0191.926] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.927] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15ccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15ccf500) returned 0x0 [0191.931] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.936] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.936] WriteFile (in: hFile=0x2570, lpBuffer=0x15ccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15ccf830, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesWritten=0x15ccf830*=0x428, lpOverlapped=0x0) returned 1 [0191.936] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.936] ReadFile (in: hFile=0x2570, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x15ccf61c*=0x16d08, lpOverlapped=0x0) returned 1 [0191.938] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffe92f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.938] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x16d08, pPaddingInfo=0x0, pbIV=0x15ccf848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x15ccf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15ccf848, pbOutput=0x2d50000, pcbResult=0x15ccf618) returned 0x0 [0191.938] WriteFile (in: hFile=0x2570, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x15ccf61c*=0x16d10, lpOverlapped=0x0) returned 1 [0191.938] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15ccf60c | out: lpNewFilePointer=0x0) returned 1 [0191.939] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.939] WriteFile (in: hFile=0x2570, lpBuffer=0x15ccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x15ccf83c*, lpNumberOfBytesWritten=0x15ccf61c*=0x8, lpOverlapped=0x0) returned 1 [0191.939] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x16d10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.939] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.939] CloseHandle (hObject=0x2570) returned 1 [0191.939] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.play")) returned 1 [0191.944] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3213 os_tid = 0x3064 [0191.951] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.951] ReadFile (in: hFile=0x2208, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0191.953] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.953] ReadFile (in: hFile=0x2208, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0191.954] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.957] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.957] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0191.957] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0191.957] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0191.958] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.958] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0191.963] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.967] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.967] WriteFile (in: hFile=0x2208, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0191.967] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.967] ReadFile (in: hFile=0x2208, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x219ff61c*=0x1b75f, lpOverlapped=0x0) returned 1 [0191.969] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffe48a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.969] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0x1b75f, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x219ff848, pbOutput=0x2e50000, pcbResult=0x219ff618) returned 0x0 [0191.969] WriteFile (in: hFile=0x2208, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x219ff61c*=0x1b760, lpOverlapped=0x0) returned 1 [0191.969] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0191.969] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.970] WriteFile (in: hFile=0x2208, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0191.970] SetFilePointerEx (in: hFile=0x2208, liDistanceToMove=0x1b760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.970] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0191.970] CloseHandle (hObject=0x2208) returned 1 [0191.970] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0191.973] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.play")) returned 1 [0191.975] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3214 os_tid = 0x3068 [0191.980] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.980] ReadFile (in: hFile=0x25f4, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.982] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.982] ReadFile (in: hFile=0x25f4, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0191.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0191.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0191.986] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0191.986] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0191.986] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0191.986] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0191.986] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0191.993] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.997] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.997] WriteFile (in: hFile=0x25f4, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0191.997] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.997] ReadFile (in: hFile=0x25f4, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d37f61c*=0x1779f, lpOverlapped=0x0) returned 1 [0191.998] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffe8861, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.999] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2f50000, cbInput=0x1779f, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x2f50000, pcbResult=0x2d37f618) returned 0x0 [0191.999] WriteFile (in: hFile=0x25f4, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x177a0, lpOverlapped=0x0) returned 1 [0191.999] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0191.999] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.999] WriteFile (in: hFile=0x25f4, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0191.999] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x177a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.000] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.000] CloseHandle (hObject=0x25f4) returned 1 [0192.000] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.play")) returned 1 [0192.004] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3215 os_tid = 0x306c [0192.009] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.009] ReadFile (in: hFile=0x25fc, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.011] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.011] ReadFile (in: hFile=0x25fc, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.011] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.014] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.014] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0192.014] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0192.014] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0192.015] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.015] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0192.020] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.025] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.025] WriteFile (in: hFile=0x25fc, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0192.025] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.025] ReadFile (in: hFile=0x25fc, lpBuffer=0x3050000, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d47f61c*=0x15b94, lpOverlapped=0x0) returned 1 [0192.026] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0xfffea46c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.026] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x15b94, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d47f848, pbOutput=0x3050000, pcbResult=0x2d47f618) returned 0x0 [0192.027] WriteFile (in: hFile=0x25fc, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d47f61c*=0x15ba0, lpOverlapped=0x0) returned 1 [0192.027] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0192.027] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.027] WriteFile (in: hFile=0x25fc, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.027] SetFilePointerEx (in: hFile=0x25fc, liDistanceToMove=0x15ba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.027] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.027] CloseHandle (hObject=0x25fc) returned 1 [0192.028] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.play")) returned 1 [0192.033] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3216 os_tid = 0x3070 [0192.038] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.039] ReadFile (in: hFile=0x2604, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.046] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.046] ReadFile (in: hFile=0x2604, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.046] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.050] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.050] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0192.050] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0192.050] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0192.050] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.050] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0192.055] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.059] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.059] WriteFile (in: hFile=0x2604, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0192.060] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.060] ReadFile (in: hFile=0x2604, lpBuffer=0x3150000, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d57f61c*=0x190e9, lpOverlapped=0x0) returned 1 [0192.062] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffe6f17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.062] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x190e9, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x3150000, pcbResult=0x2d57f618) returned 0x0 [0192.063] WriteFile (in: hFile=0x2604, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d57f61c*=0x190f0, lpOverlapped=0x0) returned 1 [0192.063] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0192.063] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.063] WriteFile (in: hFile=0x2604, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.063] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x190f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.064] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.064] CloseHandle (hObject=0x2604) returned 1 [0192.064] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.play")) returned 1 [0192.069] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3217 os_tid = 0x3074 [0192.074] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.074] ReadFile (in: hFile=0x260c, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.076] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.076] ReadFile (in: hFile=0x260c, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.076] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.079] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.079] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0192.079] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d6bf828, pbKeyObject=0x0) returned 0x0 [0192.080] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d6bf500) returned 0x0 [0192.080] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.080] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d6bf500) returned 0x0 [0192.085] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.089] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.089] WriteFile (in: hFile=0x260c, lpBuffer=0x2d6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesWritten=0x2d6bf830*=0x428, lpOverlapped=0x0) returned 1 [0192.089] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.089] ReadFile (in: hFile=0x260c, lpBuffer=0x3250000, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d6bf61c*=0x17b79, lpOverlapped=0x0) returned 1 [0192.091] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0xfffe8487, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.091] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x17b79, pPaddingInfo=0x0, pbIV=0x2d6bf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d6bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d6bf848, pbOutput=0x3250000, pcbResult=0x2d6bf618) returned 0x0 [0192.091] WriteFile (in: hFile=0x260c, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d6bf61c*=0x17b80, lpOverlapped=0x0) returned 1 [0192.091] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6bf60c | out: lpNewFilePointer=0x0) returned 1 [0192.091] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.092] WriteFile (in: hFile=0x260c, lpBuffer=0x2d6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf83c*, lpNumberOfBytesWritten=0x2d6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.092] SetFilePointerEx (in: hFile=0x260c, liDistanceToMove=0x17b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.092] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.092] CloseHandle (hObject=0x260c) returned 1 [0192.092] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.play")) returned 1 [0192.097] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3218 os_tid = 0x3078 [0192.103] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.103] ReadFile (in: hFile=0x2614, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.107] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.107] ReadFile (in: hFile=0x2614, lpBuffer=0x2d7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesRead=0x2d7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.107] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.111] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.111] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0192.111] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d7ff828, pbKeyObject=0x0) returned 0x0 [0192.111] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d7ff500) returned 0x0 [0192.111] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.112] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d7ff500) returned 0x0 [0192.118] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.122] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.122] WriteFile (in: hFile=0x2614, lpBuffer=0x2d7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2d7ffb34*, lpNumberOfBytesWritten=0x2d7ff830*=0x428, lpOverlapped=0x0) returned 1 [0192.123] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.123] ReadFile (in: hFile=0x2614, lpBuffer=0x3350000, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d7ff61c*=0x14033, lpOverlapped=0x0) returned 1 [0192.124] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffebfcd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.124] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0x14033, pPaddingInfo=0x0, pbIV=0x2d7ff848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d7ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d7ff848, pbOutput=0x3350000, pcbResult=0x2d7ff618) returned 0x0 [0192.124] WriteFile (in: hFile=0x2614, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d7ff61c*=0x14040, lpOverlapped=0x0) returned 1 [0192.125] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7ff60c | out: lpNewFilePointer=0x0) returned 1 [0192.125] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.125] WriteFile (in: hFile=0x2614, lpBuffer=0x2d7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7ff83c*, lpNumberOfBytesWritten=0x2d7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0192.125] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0x14040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.125] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.125] CloseHandle (hObject=0x2614) returned 1 [0192.125] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.play")) returned 1 [0192.131] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3219 os_tid = 0x307c [0192.136] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.136] ReadFile (in: hFile=0x261c, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.138] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.138] ReadFile (in: hFile=0x261c, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.138] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.142] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2d93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0192.142] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2d93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2d93f828, pbKeyObject=0x0) returned 0x0 [0192.142] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d93f500) returned 0x0 [0192.142] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.142] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d93f500) returned 0x0 [0192.149] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.153] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.153] WriteFile (in: hFile=0x261c, lpBuffer=0x2d93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d93f830, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesWritten=0x2d93f830*=0x428, lpOverlapped=0x0) returned 1 [0192.154] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.154] ReadFile (in: hFile=0x261c, lpBuffer=0x3450000, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2d93f61c*=0xd8f6, lpOverlapped=0x0) returned 1 [0192.155] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0xffff270a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.155] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0xd8f6, pPaddingInfo=0x0, pbIV=0x2d93f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2d93f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d93f848, pbOutput=0x3450000, pcbResult=0x2d93f618) returned 0x0 [0192.155] WriteFile (in: hFile=0x261c, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2d93f61c*=0xd900, lpOverlapped=0x0) returned 1 [0192.155] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d93f60c | out: lpNewFilePointer=0x0) returned 1 [0192.156] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.156] WriteFile (in: hFile=0x261c, lpBuffer=0x2d93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d93f83c*, lpNumberOfBytesWritten=0x2d93f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.156] SetFilePointerEx (in: hFile=0x261c, liDistanceToMove=0xd900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.156] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.156] CloseHandle (hObject=0x261c) returned 1 [0192.156] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.play")) returned 1 [0192.161] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3220 os_tid = 0x3080 [0192.168] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.168] ReadFile (in: hFile=0x2624, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.178] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.178] ReadFile (in: hFile=0x2624, lpBuffer=0x2da7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da7f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesRead=0x2da7f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.179] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.183] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2da7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0192.183] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2da7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2da7f828, pbKeyObject=0x0) returned 0x0 [0192.183] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2da7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2da7f500) returned 0x0 [0192.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.184] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2da7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2da7f500) returned 0x0 [0192.189] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.193] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.210] WriteFile (in: hFile=0x2624, lpBuffer=0x2da7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da7f830, lpOverlapped=0x0 | out: lpBuffer=0x2da7fb34*, lpNumberOfBytesWritten=0x2da7f830*=0x428, lpOverlapped=0x0) returned 1 [0192.210] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.210] ReadFile (in: hFile=0x2624, lpBuffer=0x3550000, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2da7f61c*=0x11780, lpOverlapped=0x0) returned 1 [0192.211] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffee880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.211] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3550000, cbInput=0x11780, pPaddingInfo=0x0, pbIV=0x2da7f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2da7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2da7f848, pbOutput=0x3550000, pcbResult=0x2da7f618) returned 0x0 [0192.212] WriteFile (in: hFile=0x2624, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x11790, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2da7f61c*=0x11790, lpOverlapped=0x0) returned 1 [0192.212] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da7f60c | out: lpNewFilePointer=0x0) returned 1 [0192.213] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.213] WriteFile (in: hFile=0x2624, lpBuffer=0x2da7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da7f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da7f83c*, lpNumberOfBytesWritten=0x2da7f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.213] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x11790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.213] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.213] CloseHandle (hObject=0x2624) returned 1 [0192.214] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.play")) returned 1 [0192.222] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3221 os_tid = 0x3084 [0192.226] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.226] ReadFile (in: hFile=0x262c, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.228] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.228] ReadFile (in: hFile=0x262c, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.228] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.231] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.231] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0192.231] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0192.231] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0192.231] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.231] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2ddbf500) returned 0x0 [0192.235] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.238] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.238] WriteFile (in: hFile=0x262c, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0192.238] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.238] ReadFile (in: hFile=0x262c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2ddbf61c*=0x787a, lpOverlapped=0x0) returned 1 [0192.239] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0xffff8786, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.239] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3650000, cbInput=0x787a, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2ddbf848, pbOutput=0x3650000, pcbResult=0x2ddbf618) returned 0x0 [0192.239] WriteFile (in: hFile=0x262c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x7880, lpOverlapped=0x0) returned 1 [0192.239] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0192.239] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.239] WriteFile (in: hFile=0x262c, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.240] SetFilePointerEx (in: hFile=0x262c, liDistanceToMove=0x7880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.240] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.240] CloseHandle (hObject=0x262c) returned 1 [0192.240] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.243] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.play")) returned 1 [0192.244] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3222 os_tid = 0x3088 [0192.269] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.269] ReadFile (in: hFile=0x25d0, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.270] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.270] ReadFile (in: hFile=0x25d0, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.270] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.274] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.274] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x152cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0192.274] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x152cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x152cf828, pbKeyObject=0x0) returned 0x0 [0192.274] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x152cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x152cf500) returned 0x0 [0192.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.275] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x152cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x152cf500) returned 0x0 [0192.278] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.281] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.281] WriteFile (in: hFile=0x25d0, lpBuffer=0x152cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x152cf830, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesWritten=0x152cf830*=0x428, lpOverlapped=0x0) returned 1 [0192.281] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.281] ReadFile (in: hFile=0x25d0, lpBuffer=0x3750000, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x152cf61c*=0xa91e, lpOverlapped=0x0) returned 1 [0192.283] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xffff56e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.283] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3750000, cbInput=0xa91e, pPaddingInfo=0x0, pbIV=0x152cf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x152cf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x152cf848, pbOutput=0x3750000, pcbResult=0x152cf618) returned 0x0 [0192.283] WriteFile (in: hFile=0x25d0, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x152cf61c*=0xa920, lpOverlapped=0x0) returned 1 [0192.284] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x152cf60c | out: lpNewFilePointer=0x0) returned 1 [0192.284] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.284] WriteFile (in: hFile=0x25d0, lpBuffer=0x152cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x152cf83c*, lpNumberOfBytesWritten=0x152cf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.284] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xa920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.284] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.284] CloseHandle (hObject=0x25d0) returned 1 [0192.284] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.play")) returned 1 [0192.292] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3223 os_tid = 0x308c [0192.296] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.296] ReadFile (in: hFile=0x2634, lpBuffer=0x15e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15e8fb34*, lpNumberOfBytesRead=0x15e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.297] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.297] ReadFile (in: hFile=0x2634, lpBuffer=0x15e8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15e8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15e8fb34*, lpNumberOfBytesRead=0x15e8f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.297] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.300] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.300] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x15e8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0192.300] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x15e8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x15e8f828, pbKeyObject=0x0) returned 0x0 [0192.300] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15e8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15e8f500) returned 0x0 [0192.300] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.301] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15e8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15e8f500) returned 0x0 [0192.304] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.307] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.307] WriteFile (in: hFile=0x2634, lpBuffer=0x15e8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15e8f830, lpOverlapped=0x0 | out: lpBuffer=0x15e8fb34*, lpNumberOfBytesWritten=0x15e8f830*=0x428, lpOverlapped=0x0) returned 1 [0192.307] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.307] ReadFile (in: hFile=0x2634, lpBuffer=0x2750000, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x15e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x15e8f61c*=0x3b43, lpOverlapped=0x0) returned 1 [0192.308] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0xffffc4bd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.308] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x3b43, pPaddingInfo=0x0, pbIV=0x15e8f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x15e8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15e8f848, pbOutput=0x2750000, pcbResult=0x15e8f618) returned 0x0 [0192.308] WriteFile (in: hFile=0x2634, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x15e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x15e8f61c*=0x3b50, lpOverlapped=0x0) returned 1 [0192.308] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15e8f60c | out: lpNewFilePointer=0x0) returned 1 [0192.308] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.309] WriteFile (in: hFile=0x2634, lpBuffer=0x15e8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15e8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15e8f83c*, lpNumberOfBytesWritten=0x15e8f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.309] SetFilePointerEx (in: hFile=0x2634, liDistanceToMove=0x3b50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.309] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.309] CloseHandle (hObject=0x2634) returned 1 [0192.309] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.play")) returned 1 [0192.313] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3224 os_tid = 0x3090 [0192.318] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.319] ReadFile (in: hFile=0x263c, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.320] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.320] ReadFile (in: hFile=0x263c, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.321] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.324] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.324] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2debf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0192.324] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2debf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2debf828, pbKeyObject=0x0) returned 0x0 [0192.324] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2debf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2debf500) returned 0x0 [0192.325] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.325] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2debf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2debf500) returned 0x0 [0192.329] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.333] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.333] WriteFile (in: hFile=0x263c, lpBuffer=0x2debfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2debf830, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesWritten=0x2debf830*=0x428, lpOverlapped=0x0) returned 1 [0192.333] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.333] ReadFile (in: hFile=0x263c, lpBuffer=0x3850000, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2debf61c*=0x396a, lpOverlapped=0x0) returned 1 [0192.335] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xffffc696, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.335] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3850000, cbInput=0x396a, pPaddingInfo=0x0, pbIV=0x2debf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2debf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2debf848, pbOutput=0x3850000, pcbResult=0x2debf618) returned 0x0 [0192.335] WriteFile (in: hFile=0x263c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2debf61c*=0x3970, lpOverlapped=0x0) returned 1 [0192.335] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2debf60c | out: lpNewFilePointer=0x0) returned 1 [0192.335] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.335] WriteFile (in: hFile=0x263c, lpBuffer=0x2debf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x2debf83c*, lpNumberOfBytesWritten=0x2debf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.335] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0x3970, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.335] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.335] CloseHandle (hObject=0x263c) returned 1 [0192.335] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.play")) returned 1 [0192.340] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3225 os_tid = 0x3094 [0192.345] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.345] ReadFile (in: hFile=0x2644, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.347] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.347] ReadFile (in: hFile=0x2644, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.347] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.350] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.350] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2dfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0192.351] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2dfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2dfbf828, pbKeyObject=0x0) returned 0x0 [0192.351] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2dfbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2dfbf500) returned 0x0 [0192.351] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.351] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2dfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2dfbf500) returned 0x0 [0192.356] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.359] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.360] WriteFile (in: hFile=0x2644, lpBuffer=0x2dfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dfbf830, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesWritten=0x2dfbf830*=0x428, lpOverlapped=0x0) returned 1 [0192.360] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.360] ReadFile (in: hFile=0x2644, lpBuffer=0x3950000, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2dfbf61c*=0x693e, lpOverlapped=0x0) returned 1 [0192.361] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0xffff96c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.361] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3950000, cbInput=0x693e, pPaddingInfo=0x0, pbIV=0x2dfbf848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2dfbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2dfbf848, pbOutput=0x3950000, pcbResult=0x2dfbf618) returned 0x0 [0192.362] WriteFile (in: hFile=0x2644, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2dfbf61c*=0x6940, lpOverlapped=0x0) returned 1 [0192.362] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dfbf60c | out: lpNewFilePointer=0x0) returned 1 [0192.362] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.362] WriteFile (in: hFile=0x2644, lpBuffer=0x2dfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbf83c*, lpNumberOfBytesWritten=0x2dfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.362] SetFilePointerEx (in: hFile=0x2644, liDistanceToMove=0x6940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.362] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.362] CloseHandle (hObject=0x2644) returned 1 [0192.362] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.play")) returned 1 [0192.367] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3226 os_tid = 0x3098 [0192.376] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.376] ReadFile (in: hFile=0x264c, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.378] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.378] ReadFile (in: hFile=0x264c, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.378] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.382] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.382] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x2e0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0192.382] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x2e0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x2e0bf828, pbKeyObject=0x0) returned 0x0 [0192.382] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e0bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e0bf500) returned 0x0 [0192.383] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.383] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e0bf500) returned 0x0 [0192.387] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.392] WriteFile (in: hFile=0x264c, lpBuffer=0x2e0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e0bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesWritten=0x2e0bf830*=0x428, lpOverlapped=0x0) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.392] ReadFile (in: hFile=0x264c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x2e0bf61c*=0xcb0a, lpOverlapped=0x0) returned 1 [0192.393] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xffff34f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.393] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3a50000, cbInput=0xcb0a, pPaddingInfo=0x0, pbIV=0x2e0bf848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x2e0bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e0bf848, pbOutput=0x3a50000, pcbResult=0x2e0bf618) returned 0x0 [0192.393] WriteFile (in: hFile=0x264c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x2e0bf61c*=0xcb10, lpOverlapped=0x0) returned 1 [0192.394] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0bf60c | out: lpNewFilePointer=0x0) returned 1 [0192.394] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.394] WriteFile (in: hFile=0x264c, lpBuffer=0x2e0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bf83c*, lpNumberOfBytesWritten=0x2e0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.394] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xcb10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.394] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.394] CloseHandle (hObject=0x264c) returned 1 [0192.394] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.play")) returned 1 [0192.417] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3227 os_tid = 0x309c [0192.425] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.425] ReadFile (in: hFile=0x2654, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.428] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.429] ReadFile (in: hFile=0x2654, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.432] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.432] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2e1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0192.432] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2e1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2e1ff828, pbKeyObject=0x0) returned 0x0 [0192.432] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e1ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e1ff500) returned 0x0 [0192.432] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.433] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e1ff500) returned 0x0 [0192.438] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.442] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.443] WriteFile (in: hFile=0x2654, lpBuffer=0x2e1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesWritten=0x2e1ff830*=0x428, lpOverlapped=0x0) returned 1 [0192.443] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.443] ReadFile (in: hFile=0x2654, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2e1ff61c*=0x6cec, lpOverlapped=0x0) returned 1 [0192.444] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0xffff9314, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.444] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3b50000, cbInput=0x6cec, pPaddingInfo=0x0, pbIV=0x2e1ff848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2e1ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e1ff848, pbOutput=0x3b50000, pcbResult=0x2e1ff618) returned 0x0 [0192.445] WriteFile (in: hFile=0x2654, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2e1ff61c*=0x6cf0, lpOverlapped=0x0) returned 1 [0192.445] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1ff60c | out: lpNewFilePointer=0x0) returned 1 [0192.445] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.445] WriteFile (in: hFile=0x2654, lpBuffer=0x2e1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ff83c*, lpNumberOfBytesWritten=0x2e1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0192.445] SetFilePointerEx (in: hFile=0x2654, liDistanceToMove=0x6cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.445] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.445] CloseHandle (hObject=0x2654) returned 1 [0192.445] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.play")) returned 1 [0192.450] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3228 os_tid = 0x30a0 [0192.456] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.456] ReadFile (in: hFile=0x265c, lpBuffer=0x2e33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesRead=0x2e33f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.458] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.458] ReadFile (in: hFile=0x265c, lpBuffer=0x2e33fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e33f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesRead=0x2e33f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.458] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.461] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.461] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2e33f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0192.461] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2e33f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2e33f828, pbKeyObject=0x0) returned 0x0 [0192.461] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e33f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e33f500) returned 0x0 [0192.461] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.461] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e33f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e33f500) returned 0x0 [0192.466] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.471] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.472] WriteFile (in: hFile=0x265c, lpBuffer=0x2e33fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e33f830, lpOverlapped=0x0 | out: lpBuffer=0x2e33fb34*, lpNumberOfBytesWritten=0x2e33f830*=0x428, lpOverlapped=0x0) returned 1 [0192.472] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.472] ReadFile (in: hFile=0x265c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2e33f61c*=0x98c7, lpOverlapped=0x0) returned 1 [0192.474] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xffff6739, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.474] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3c50000, cbInput=0x98c7, pPaddingInfo=0x0, pbIV=0x2e33f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2e33f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e33f848, pbOutput=0x3c50000, pcbResult=0x2e33f618) returned 0x0 [0192.474] WriteFile (in: hFile=0x265c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2e33f61c*=0x98d0, lpOverlapped=0x0) returned 1 [0192.474] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e33f60c | out: lpNewFilePointer=0x0) returned 1 [0192.474] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.475] WriteFile (in: hFile=0x265c, lpBuffer=0x2e33f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e33f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e33f83c*, lpNumberOfBytesWritten=0x2e33f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.475] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x98d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.475] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.475] CloseHandle (hObject=0x265c) returned 1 [0192.475] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.play")) returned 1 [0192.480] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3229 os_tid = 0x30a4 [0192.486] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.486] ReadFile (in: hFile=0x2664, lpBuffer=0x2e47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesRead=0x2e47f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.488] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.488] ReadFile (in: hFile=0x2664, lpBuffer=0x2e47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesRead=0x2e47f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.488] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.491] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.491] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0192.491] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e47f828, pbKeyObject=0x0) returned 0x0 [0192.491] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e47f500) returned 0x0 [0192.492] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.492] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e47f500) returned 0x0 [0192.496] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.501] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.501] WriteFile (in: hFile=0x2664, lpBuffer=0x2e47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e47f830, lpOverlapped=0x0 | out: lpBuffer=0x2e47fb34*, lpNumberOfBytesWritten=0x2e47f830*=0x428, lpOverlapped=0x0) returned 1 [0192.501] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.501] ReadFile (in: hFile=0x2664, lpBuffer=0x3d50000, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e47f61c*=0xb9bf, lpOverlapped=0x0) returned 1 [0192.503] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0xffff4641, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.503] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3d50000, cbInput=0xb9bf, pPaddingInfo=0x0, pbIV=0x2e47f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e47f848, pbOutput=0x3d50000, pcbResult=0x2e47f618) returned 0x0 [0192.503] WriteFile (in: hFile=0x2664, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e47f61c*=0xb9c0, lpOverlapped=0x0) returned 1 [0192.503] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e47f60c | out: lpNewFilePointer=0x0) returned 1 [0192.503] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.503] WriteFile (in: hFile=0x2664, lpBuffer=0x2e47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e47f83c*, lpNumberOfBytesWritten=0x2e47f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.503] SetFilePointerEx (in: hFile=0x2664, liDistanceToMove=0xb9c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.503] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.503] CloseHandle (hObject=0x2664) returned 1 [0192.503] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.play")) returned 1 [0192.508] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3230 os_tid = 0x30a8 [0192.513] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.513] ReadFile (in: hFile=0x266c, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.515] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.515] ReadFile (in: hFile=0x266c, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.515] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.518] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.518] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0192.518] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0192.518] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0192.518] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.518] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e6bf500) returned 0x0 [0192.523] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.527] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.528] WriteFile (in: hFile=0x266c, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0192.528] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.528] ReadFile (in: hFile=0x266c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2e6bf61c*=0x98ec, lpOverlapped=0x0) returned 1 [0192.529] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xffff6714, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.530] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3e50000, cbInput=0x98ec, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e6bf848, pbOutput=0x3e50000, pcbResult=0x2e6bf618) returned 0x0 [0192.530] WriteFile (in: hFile=0x266c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x98f0, lpOverlapped=0x0) returned 1 [0192.530] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0192.530] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.530] WriteFile (in: hFile=0x266c, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.530] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x98f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.530] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.530] CloseHandle (hObject=0x266c) returned 1 [0192.531] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.play")) returned 1 [0192.537] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3231 os_tid = 0x30ac [0192.542] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.542] ReadFile (in: hFile=0x2674, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.543] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.543] ReadFile (in: hFile=0x2674, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.547] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2e7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0192.547] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2e7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2e7ff828, pbKeyObject=0x0) returned 0x0 [0192.547] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e7ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0192.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.547] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e7ff500) returned 0x0 [0192.552] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.556] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.556] WriteFile (in: hFile=0x2674, lpBuffer=0x2e7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesWritten=0x2e7ff830*=0x428, lpOverlapped=0x0) returned 1 [0192.557] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.557] ReadFile (in: hFile=0x2674, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2e7ff61c*=0x7df3, lpOverlapped=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0xffff820d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.558] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0x7df3, pPaddingInfo=0x0, pbIV=0x2e7ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2e7ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e7ff848, pbOutput=0x3f50000, pcbResult=0x2e7ff618) returned 0x0 [0192.558] WriteFile (in: hFile=0x2674, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2e7ff61c*=0x7e00, lpOverlapped=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7ff60c | out: lpNewFilePointer=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.558] WriteFile (in: hFile=0x2674, lpBuffer=0x2e7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ff83c*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x2674, liDistanceToMove=0x7e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.558] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.558] CloseHandle (hObject=0x2674) returned 1 [0192.559] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.play")) returned 1 [0192.563] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3232 os_tid = 0x30b0 [0192.568] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.568] ReadFile (in: hFile=0x267c, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.570] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.570] ReadFile (in: hFile=0x267c, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.571] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.574] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.574] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2e93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0192.574] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2e93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2e93f828, pbKeyObject=0x0) returned 0x0 [0192.574] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2e93f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0192.574] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.574] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2e93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2e93f500) returned 0x0 [0192.580] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.583] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.583] WriteFile (in: hFile=0x267c, lpBuffer=0x2e93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e93f830, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesWritten=0x2e93f830*=0x428, lpOverlapped=0x0) returned 1 [0192.584] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.584] ReadFile (in: hFile=0x267c, lpBuffer=0x4050000, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2e93f61c*=0x351c, lpOverlapped=0x0) returned 1 [0192.585] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xffffcae4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.585] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4050000, cbInput=0x351c, pPaddingInfo=0x0, pbIV=0x2e93f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2e93f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e93f848, pbOutput=0x4050000, pcbResult=0x2e93f618) returned 0x0 [0192.585] WriteFile (in: hFile=0x267c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2e93f61c*=0x3520, lpOverlapped=0x0) returned 1 [0192.585] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93f60c | out: lpNewFilePointer=0x0) returned 1 [0192.585] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.585] WriteFile (in: hFile=0x267c, lpBuffer=0x2e93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e93f83c*, lpNumberOfBytesWritten=0x2e93f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.585] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x3520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.585] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.585] CloseHandle (hObject=0x267c) returned 1 [0192.585] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.play")) returned 1 [0192.590] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3233 os_tid = 0x30b4 [0192.595] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.595] ReadFile (in: hFile=0x2684, lpBuffer=0x3bfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesRead=0x3bfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.596] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.597] ReadFile (in: hFile=0x2684, lpBuffer=0x3bfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesRead=0x3bfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.597] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.599] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.600] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x3bfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0192.600] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x3bfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x3bfbf828, pbKeyObject=0x0) returned 0x0 [0192.600] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3bfbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3bfbf500) returned 0x0 [0192.600] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.600] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3bfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3bfbf500) returned 0x0 [0192.605] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.608] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.608] WriteFile (in: hFile=0x2684, lpBuffer=0x3bfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3bfbf830, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesWritten=0x3bfbf830*=0x428, lpOverlapped=0x0) returned 1 [0192.609] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.609] ReadFile (in: hFile=0x2684, lpBuffer=0x4150000, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x3bfbf61c*=0x31883, lpOverlapped=0x0) returned 1 [0192.612] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0xfffce77d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.612] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4150000, cbInput=0x31883, pPaddingInfo=0x0, pbIV=0x3bfbf848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x3bfbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3bfbf848, pbOutput=0x4150000, pcbResult=0x3bfbf618) returned 0x0 [0192.612] WriteFile (in: hFile=0x2684, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x3bfbf61c*=0x31890, lpOverlapped=0x0) returned 1 [0192.613] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bfbf60c | out: lpNewFilePointer=0x0) returned 1 [0192.613] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.613] WriteFile (in: hFile=0x2684, lpBuffer=0x3bfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbf83c*, lpNumberOfBytesWritten=0x3bfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.613] SetFilePointerEx (in: hFile=0x2684, liDistanceToMove=0x31890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.614] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.614] CloseHandle (hObject=0x2684) returned 1 [0192.614] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400001.png.play")) returned 1 [0192.618] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3234 os_tid = 0x30b8 [0192.623] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.623] ReadFile (in: hFile=0x268c, lpBuffer=0x3c0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesRead=0x3c0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.625] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.625] ReadFile (in: hFile=0x268c, lpBuffer=0x3c0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesRead=0x3c0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.625] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.628] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.628] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x3c0ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0192.628] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x3c0ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x3c0ff828, pbKeyObject=0x0) returned 0x0 [0192.628] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c0ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c0ff500) returned 0x0 [0192.629] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.629] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c0ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c0ff500) returned 0x0 [0192.633] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.637] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.637] WriteFile (in: hFile=0x268c, lpBuffer=0x3c0ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c0ff830, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesWritten=0x3c0ff830*=0x428, lpOverlapped=0x0) returned 1 [0192.638] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.638] ReadFile (in: hFile=0x268c, lpBuffer=0x4250000, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x3c0ff61c*=0x15d49, lpOverlapped=0x0) returned 1 [0192.639] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xfffea2b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.639] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4250000, cbInput=0x15d49, pPaddingInfo=0x0, pbIV=0x3c0ff848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x3c0ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c0ff848, pbOutput=0x4250000, pcbResult=0x3c0ff618) returned 0x0 [0192.639] WriteFile (in: hFile=0x268c, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x3c0ff61c*=0x15d50, lpOverlapped=0x0) returned 1 [0192.640] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c0ff60c | out: lpNewFilePointer=0x0) returned 1 [0192.640] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.640] WriteFile (in: hFile=0x268c, lpBuffer=0x3c0ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ff83c*, lpNumberOfBytesWritten=0x3c0ff61c*=0x8, lpOverlapped=0x0) returned 1 [0192.640] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x15d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.640] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.640] CloseHandle (hObject=0x268c) returned 1 [0192.641] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400002.png.play")) returned 1 [0192.645] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3235 os_tid = 0x30bc [0192.650] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.650] ReadFile (in: hFile=0x2694, lpBuffer=0x3c23fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c23f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesRead=0x3c23f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.652] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.652] ReadFile (in: hFile=0x2694, lpBuffer=0x3c23fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c23f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesRead=0x3c23f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.652] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.655] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x3c23f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0192.655] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x3c23f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x3c23f828, pbKeyObject=0x0) returned 0x0 [0192.655] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c23f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c23f500) returned 0x0 [0192.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.655] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c23f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c23f500) returned 0x0 [0192.660] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.664] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.664] WriteFile (in: hFile=0x2694, lpBuffer=0x3c23fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c23f830, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesWritten=0x3c23f830*=0x428, lpOverlapped=0x0) returned 1 [0192.664] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.664] ReadFile (in: hFile=0x2694, lpBuffer=0x4350000, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x3c23f61c*=0x1e836, lpOverlapped=0x0) returned 1 [0192.666] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0xfffe17ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.666] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4350000, cbInput=0x1e836, pPaddingInfo=0x0, pbIV=0x3c23f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x3c23f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c23f848, pbOutput=0x4350000, pcbResult=0x3c23f618) returned 0x0 [0192.666] WriteFile (in: hFile=0x2694, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x3c23f61c*=0x1e840, lpOverlapped=0x0) returned 1 [0192.667] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c23f60c | out: lpNewFilePointer=0x0) returned 1 [0192.667] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.667] WriteFile (in: hFile=0x2694, lpBuffer=0x3c23f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c23f83c*, lpNumberOfBytesWritten=0x3c23f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.667] SetFilePointerEx (in: hFile=0x2694, liDistanceToMove=0x1e840, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.667] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.667] CloseHandle (hObject=0x2694) returned 1 [0192.667] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400003.png.play")) returned 1 [0192.672] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3236 os_tid = 0x30c0 [0192.677] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.677] ReadFile (in: hFile=0x269c, lpBuffer=0x3c37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c37f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesRead=0x3c37f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.682] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.682] ReadFile (in: hFile=0x269c, lpBuffer=0x3c37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c37f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesRead=0x3c37f85c*=0x428, lpOverlapped=0x0) returned 1 [0192.682] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.686] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x3c37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0192.686] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x3c37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x3c37f828, pbKeyObject=0x0) returned 0x0 [0192.686] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c37f500) returned 0x0 [0192.686] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.686] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c37f500) returned 0x0 [0192.691] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.695] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.695] WriteFile (in: hFile=0x269c, lpBuffer=0x3c37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c37f830, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesWritten=0x3c37f830*=0x428, lpOverlapped=0x0) returned 1 [0192.695] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.695] ReadFile (in: hFile=0x269c, lpBuffer=0x4450000, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x3c37f61c*=0x19a5d, lpOverlapped=0x0) returned 1 [0192.698] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xfffe65a3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.698] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4450000, cbInput=0x19a5d, pPaddingInfo=0x0, pbIV=0x3c37f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x3c37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c37f848, pbOutput=0x4450000, pcbResult=0x3c37f618) returned 0x0 [0192.698] WriteFile (in: hFile=0x269c, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x3c37f61c*=0x19a60, lpOverlapped=0x0) returned 1 [0192.699] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c37f60c | out: lpNewFilePointer=0x0) returned 1 [0192.699] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.699] WriteFile (in: hFile=0x269c, lpBuffer=0x3c37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c37f83c*, lpNumberOfBytesWritten=0x3c37f61c*=0x8, lpOverlapped=0x0) returned 1 [0192.699] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0x19a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.699] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.699] CloseHandle (hObject=0x269c) returned 1 [0192.699] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400004.png.play")) returned 1 [0192.704] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3237 os_tid = 0x30c4 [0192.680] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.680] ReadFile (in: hFile=0x26a4, lpBuffer=0x3c4bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c4bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesRead=0x3c4bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.709] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.709] ReadFile (in: hFile=0x26a4, lpBuffer=0x3c4bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c4bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesRead=0x3c4bf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.710] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.713] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.713] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x3c4bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0192.713] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x3c4bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x3c4bf828, pbKeyObject=0x0) returned 0x0 [0192.713] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c4bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c4bf500) returned 0x0 [0192.713] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.713] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c4bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c4bf500) returned 0x0 [0192.718] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.722] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.722] WriteFile (in: hFile=0x26a4, lpBuffer=0x3c4bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c4bf830, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesWritten=0x3c4bf830*=0x428, lpOverlapped=0x0) returned 1 [0192.722] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.722] ReadFile (in: hFile=0x26a4, lpBuffer=0x4550000, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x3c4bf61c*=0x17742, lpOverlapped=0x0) returned 1 [0192.724] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0xfffe88be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.724] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4550000, cbInput=0x17742, pPaddingInfo=0x0, pbIV=0x3c4bf848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x3c4bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c4bf848, pbOutput=0x4550000, pcbResult=0x3c4bf618) returned 0x0 [0192.724] WriteFile (in: hFile=0x26a4, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x3c4bf61c*=0x17750, lpOverlapped=0x0) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c4bf60c | out: lpNewFilePointer=0x0) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.725] WriteFile (in: hFile=0x26a4, lpBuffer=0x3c4bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bf83c*, lpNumberOfBytesWritten=0x3c4bf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x26a4, liDistanceToMove=0x17750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.725] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.725] CloseHandle (hObject=0x26a4) returned 1 [0192.725] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\j0400005.png.play")) returned 1 [0192.733] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3238 os_tid = 0x30c8 [0192.738] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.738] ReadFile (in: hFile=0x26ac, lpBuffer=0x3c5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesRead=0x3c5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.740] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.740] ReadFile (in: hFile=0x26ac, lpBuffer=0x3c5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesRead=0x3c5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0192.740] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0192.743] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0192.744] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x3c5ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0192.744] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x3c5ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x3c5ff828, pbKeyObject=0x0) returned 0x0 [0192.744] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c5ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c5ff500) returned 0x0 [0192.744] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0192.744] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c5ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c5ff500) returned 0x0 [0192.749] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.752] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.752] WriteFile (in: hFile=0x26ac, lpBuffer=0x3c5ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c5ff830, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesWritten=0x3c5ff830*=0x428, lpOverlapped=0x0) returned 1 [0192.753] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.753] ReadFile (in: hFile=0x26ac, lpBuffer=0x4650000, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x3c5ff61c*=0x2645, lpOverlapped=0x0) returned 1 [0192.753] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xffffd9bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.753] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4650000, cbInput=0x2645, pPaddingInfo=0x0, pbIV=0x3c5ff848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x3c5ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c5ff848, pbOutput=0x4650000, pcbResult=0x3c5ff618) returned 0x0 [0192.754] WriteFile (in: hFile=0x26ac, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x3c5ff61c*=0x2650, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5ff60c | out: lpNewFilePointer=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.754] WriteFile (in: hFile=0x26ac, lpBuffer=0x3c5ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ff83c*, lpNumberOfBytesWritten=0x3c5ff61c*=0x8, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x2650, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.754] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.754] CloseHandle (hObject=0x26ac) returned 1 [0192.754] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0192.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\java_01.mid.play")) returned 1 [0192.759] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3239 os_tid = 0x30cc [0192.979] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.980] ReadFile (in: hFile=0x26ac, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.982] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.982] ReadFile (in: hFile=0x26ac, lpBuffer=0x152cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x152cf85c, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesRead=0x152cf85c*=0x428, lpOverlapped=0x0) returned 1 [0192.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0192.987] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0192.987] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x152cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0192.987] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x152cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x152cf828, pbKeyObject=0x0) returned 0x0 [0192.987] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x152cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x152cf500) returned 0x0 [0192.988] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0192.988] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x152cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x152cf500) returned 0x0 [0192.991] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.994] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.994] WriteFile (in: hFile=0x26ac, lpBuffer=0x152cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x152cf830, lpOverlapped=0x0 | out: lpBuffer=0x152cfb34*, lpNumberOfBytesWritten=0x152cf830*=0x428, lpOverlapped=0x0) returned 1 [0192.994] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.994] ReadFile (in: hFile=0x26ac, lpBuffer=0x4750000, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x152cf61c*=0x16d3, lpOverlapped=0x0) returned 1 [0192.995] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xffffe92d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.995] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4750000, cbInput=0x16d3, pPaddingInfo=0x0, pbIV=0x152cf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x152cf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x152cf848, pbOutput=0x4750000, pcbResult=0x152cf618) returned 0x0 [0192.995] WriteFile (in: hFile=0x26ac, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x152cf61c*=0x16e0, lpOverlapped=0x0) returned 1 [0192.995] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x152cf60c | out: lpNewFilePointer=0x0) returned 1 [0192.995] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.995] WriteFile (in: hFile=0x26ac, lpBuffer=0x152cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x152cf61c, lpOverlapped=0x0 | out: lpBuffer=0x152cf83c*, lpNumberOfBytesWritten=0x152cf61c*=0x8, lpOverlapped=0x0) returned 1 [0192.995] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x16e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.995] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0192.995] CloseHandle (hObject=0x26ac) returned 1 [0192.995] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0192.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.play")) returned 1 [0193.004] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3240 os_tid = 0x30d0 [0193.038] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.038] ReadFile (in: hFile=0x269c, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.039] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.039] ReadFile (in: hFile=0x269c, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.040] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.044] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1554f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0193.044] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1554f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1554f828, pbKeyObject=0x0) returned 0x0 [0193.044] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1554f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1554f500) returned 0x0 [0193.044] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.044] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1554f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1554f500) returned 0x0 [0193.048] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.052] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.052] WriteFile (in: hFile=0x269c, lpBuffer=0x1554fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1554f830, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesWritten=0x1554f830*=0x428, lpOverlapped=0x0) returned 1 [0193.053] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.053] ReadFile (in: hFile=0x269c, lpBuffer=0x2750000, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1554f61c*=0x15f6, lpOverlapped=0x0) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xffffea0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.054] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x15f6, pPaddingInfo=0x0, pbIV=0x1554f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1554f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1554f848, pbOutput=0x2750000, pcbResult=0x1554f618) returned 0x0 [0193.054] WriteFile (in: hFile=0x269c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1554f61c*=0x1600, lpOverlapped=0x0) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1554f60c | out: lpNewFilePointer=0x0) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.054] WriteFile (in: hFile=0x269c, lpBuffer=0x1554f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x1554f83c*, lpNumberOfBytesWritten=0x1554f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x269c, liDistanceToMove=0x1600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.054] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.054] CloseHandle (hObject=0x269c) returned 1 [0193.054] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.play")) returned 1 [0193.462] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3241 os_tid = 0x30d4 [0193.059] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.059] ReadFile (in: hFile=0x268c, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.070] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.070] ReadFile (in: hFile=0x268c, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.070] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0193.073] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0193.073] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1580f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0193.073] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1580f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1580f828, pbKeyObject=0x0) returned 0x0 [0193.073] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1580f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0193.073] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0193.073] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1580f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0193.077] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.080] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.080] WriteFile (in: hFile=0x268c, lpBuffer=0x1580fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1580f830, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesWritten=0x1580f830*=0x428, lpOverlapped=0x0) returned 1 [0193.081] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.081] ReadFile (in: hFile=0x268c, lpBuffer=0x2850000, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1580f61c*=0x1090, lpOverlapped=0x0) returned 1 [0193.081] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xffffef70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.081] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x1090, pPaddingInfo=0x0, pbIV=0x1580f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1580f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1580f848, pbOutput=0x2850000, pcbResult=0x1580f618) returned 0x0 [0193.081] WriteFile (in: hFile=0x268c, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1580f61c*=0x10a0, lpOverlapped=0x0) returned 1 [0193.081] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1580f60c | out: lpNewFilePointer=0x0) returned 1 [0193.081] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.081] WriteFile (in: hFile=0x268c, lpBuffer=0x1580f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x1580f83c*, lpNumberOfBytesWritten=0x1580f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.081] SetFilePointerEx (in: hFile=0x268c, liDistanceToMove=0x10a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.081] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.081] CloseHandle (hObject=0x268c) returned 1 [0193.320] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0193.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.play")) returned 1 [0193.498] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3242 os_tid = 0x30d8 [0193.083] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.083] ReadFile (in: hFile=0x267c, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.084] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.084] ReadFile (in: hFile=0x267c, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.084] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0193.087] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0193.087] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0193.087] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0193.087] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0193.087] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0193.087] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0193.091] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.094] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.094] WriteFile (in: hFile=0x267c, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0193.095] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.095] ReadFile (in: hFile=0x267c, lpBuffer=0x2950000, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1590f61c*=0x31e2, lpOverlapped=0x0) returned 1 [0193.095] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xffffce1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.096] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x31e2, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2950000, pcbResult=0x1590f618) returned 0x0 [0193.096] WriteFile (in: hFile=0x267c, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1590f61c*=0x31f0, lpOverlapped=0x0) returned 1 [0193.096] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0193.096] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.096] WriteFile (in: hFile=0x267c, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.096] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x31f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.096] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.096] CloseHandle (hObject=0x267c) returned 1 [0193.442] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0193.445] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.play")) returned 1 [0193.479] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3243 os_tid = 0x30dc [0193.097] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.097] ReadFile (in: hFile=0x266c, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.310] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.310] ReadFile (in: hFile=0x266c, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.310] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.313] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.313] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x15a4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0193.313] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x15a4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x15a4f828, pbKeyObject=0x0) returned 0x0 [0193.313] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x15a4f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x15a4f500) returned 0x0 [0193.313] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.313] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x15a4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x15a4f500) returned 0x0 [0193.317] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.319] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.320] WriteFile (in: hFile=0x266c, lpBuffer=0x15a4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a4f830, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesWritten=0x15a4f830*=0x428, lpOverlapped=0x0) returned 1 [0193.320] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.320] ReadFile (in: hFile=0x266c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x15a4f61c*=0x1ae0, lpOverlapped=0x0) returned 1 [0193.345] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xffffe520, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.345] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x2a50000, cbInput=0x1ae0, pPaddingInfo=0x0, pbIV=0x15a4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x15a4f618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x15a4f848, pbOutput=0x2a50000, pcbResult=0x15a4f618) returned 0x0 [0193.345] WriteFile (in: hFile=0x266c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x15a4f61c*=0x1af0, lpOverlapped=0x0) returned 1 [0193.345] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a4f60c | out: lpNewFilePointer=0x0) returned 1 [0193.345] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.345] WriteFile (in: hFile=0x266c, lpBuffer=0x15a4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a4f83c*, lpNumberOfBytesWritten=0x15a4f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.345] SetFilePointerEx (in: hFile=0x266c, liDistanceToMove=0x1af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.346] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0193.346] CloseHandle (hObject=0x266c) returned 1 [0193.374] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf910000 [0193.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\music_01.mid.play")) returned 1 [0193.378] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3244 os_tid = 0x30e0 [0193.098] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.098] ReadFile (in: hFile=0x265c, lpBuffer=0x15b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesRead=0x15b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.299] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.300] ReadFile (in: hFile=0x265c, lpBuffer=0x15b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesRead=0x15b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.302] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.303] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15b8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0193.303] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15b8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15b8f828, pbKeyObject=0x0) returned 0x0 [0193.303] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x15b8f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x15b8f500) returned 0x0 [0193.303] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.303] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x15b8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x15b8f500) returned 0x0 [0193.306] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.309] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.309] WriteFile (in: hFile=0x265c, lpBuffer=0x15b8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b8f830, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesWritten=0x15b8f830*=0x428, lpOverlapped=0x0) returned 1 [0193.310] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.310] ReadFile (in: hFile=0x265c, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15b8f61c*=0x5044, lpOverlapped=0x0) returned 1 [0193.344] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xffffafbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.344] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x2b50000, cbInput=0x5044, pPaddingInfo=0x0, pbIV=0x15b8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15b8f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x15b8f848, pbOutput=0x2b50000, pcbResult=0x15b8f618) returned 0x0 [0193.344] WriteFile (in: hFile=0x265c, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15b8f61c*=0x5050, lpOverlapped=0x0) returned 1 [0193.344] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b8f60c | out: lpNewFilePointer=0x0) returned 1 [0193.344] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.344] WriteFile (in: hFile=0x265c, lpBuffer=0x15b8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b8f83c*, lpNumberOfBytesWritten=0x15b8f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.345] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x5050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.345] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0193.345] CloseHandle (hObject=0x265c) returned 1 [0193.351] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf980000 [0193.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.play")) returned 1 [0193.356] VirtualFree (lpAddress=0xf980000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3245 os_tid = 0x30e4 [0193.099] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.099] ReadFile (in: hFile=0x264c, lpBuffer=0x15ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesRead=0x15ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.288] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.288] ReadFile (in: hFile=0x264c, lpBuffer=0x15ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesRead=0x15ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.289] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.291] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x15ccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0193.291] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x15ccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x15ccf828, pbKeyObject=0x0) returned 0x0 [0193.291] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x15ccf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x15ccf500) returned 0x0 [0193.292] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.292] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x15ccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x15ccf500) returned 0x0 [0193.295] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.299] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.299] WriteFile (in: hFile=0x264c, lpBuffer=0x15ccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15ccf830, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesWritten=0x15ccf830*=0x428, lpOverlapped=0x0) returned 1 [0193.299] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.299] ReadFile (in: hFile=0x264c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x15ccf61c*=0x2a42, lpOverlapped=0x0) returned 1 [0193.329] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xffffd5be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.329] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2c50000, cbInput=0x2a42, pPaddingInfo=0x0, pbIV=0x15ccf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x15ccf618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x15ccf848, pbOutput=0x2c50000, pcbResult=0x15ccf618) returned 0x0 [0193.329] WriteFile (in: hFile=0x264c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x15ccf61c*=0x2a50, lpOverlapped=0x0) returned 1 [0193.329] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15ccf60c | out: lpNewFilePointer=0x0) returned 1 [0193.329] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.329] WriteFile (in: hFile=0x264c, lpBuffer=0x15ccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x15ccf83c*, lpNumberOfBytesWritten=0x15ccf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.330] SetFilePointerEx (in: hFile=0x264c, liDistanceToMove=0x2a50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.330] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0193.330] CloseHandle (hObject=0x264c) returned 1 [0193.381] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf910000 [0193.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.play")) returned 1 [0193.385] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3246 os_tid = 0x30e8 [0193.101] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.101] ReadFile (in: hFile=0x263c, lpBuffer=0x15e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15e0fb34*, lpNumberOfBytesRead=0x15e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.231] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.231] ReadFile (in: hFile=0x263c, lpBuffer=0x15e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15e0fb34*, lpNumberOfBytesRead=0x15e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.231] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.234] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.234] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x15e0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0193.234] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x15e0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x15e0f828, pbKeyObject=0x0) returned 0x0 [0193.279] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x15e0f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x15e0f500) returned 0x0 [0193.279] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.279] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x15e0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x15e0f500) returned 0x0 [0193.283] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.286] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.286] WriteFile (in: hFile=0x263c, lpBuffer=0x15e0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15e0f830, lpOverlapped=0x0 | out: lpBuffer=0x15e0fb34*, lpNumberOfBytesWritten=0x15e0f830*=0x428, lpOverlapped=0x0) returned 1 [0193.287] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.287] ReadFile (in: hFile=0x263c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x15e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x15e0f61c*=0xeaa, lpOverlapped=0x0) returned 1 [0193.287] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xfffff156, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.287] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2d50000, cbInput=0xeaa, pPaddingInfo=0x0, pbIV=0x15e0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x15e0f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x15e0f848, pbOutput=0x2d50000, pcbResult=0x15e0f618) returned 0x0 [0193.287] WriteFile (in: hFile=0x263c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x15e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x15e0f61c*=0xeb0, lpOverlapped=0x0) returned 1 [0193.287] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15e0f60c | out: lpNewFilePointer=0x0) returned 1 [0193.287] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.287] WriteFile (in: hFile=0x263c, lpBuffer=0x15e0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15e0f83c*, lpNumberOfBytesWritten=0x15e0f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.287] SetFilePointerEx (in: hFile=0x263c, liDistanceToMove=0xeb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.287] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0193.287] CloseHandle (hObject=0x263c) returned 1 [0193.438] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf910000 [0193.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.play")) returned 1 [0193.495] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3247 os_tid = 0x30ec [0193.102] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.102] ReadFile (in: hFile=0x25d0, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.221] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.221] ReadFile (in: hFile=0x25d0, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.221] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.223] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0193.223] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0193.223] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x219ff500) returned 0x0 [0193.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.224] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x219ff500) returned 0x0 [0193.227] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.230] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.230] WriteFile (in: hFile=0x25d0, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0193.230] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.230] ReadFile (in: hFile=0x25d0, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x219ff61c*=0x1324, lpOverlapped=0x0) returned 1 [0193.231] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xffffecdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.231] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2e50000, cbInput=0x1324, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x219ff848, pbOutput=0x2e50000, pcbResult=0x219ff618) returned 0x0 [0193.231] WriteFile (in: hFile=0x25d0, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x219ff61c*=0x1330, lpOverlapped=0x0) returned 1 [0193.231] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0193.231] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.231] WriteFile (in: hFile=0x25d0, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0193.231] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x1330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.231] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0193.231] CloseHandle (hObject=0x25d0) returned 1 [0193.338] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4c0000 [0193.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.play")) returned 1 [0193.519] VirtualFree (lpAddress=0xb4c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3248 os_tid = 0x30f0 [0193.104] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.104] ReadFile (in: hFile=0x2624, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.210] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.210] ReadFile (in: hFile=0x2624, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.210] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.212] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0193.212] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0193.212] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d37f500) returned 0x0 [0193.213] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.213] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d37f500) returned 0x0 [0193.216] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.219] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.219] WriteFile (in: hFile=0x2624, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0193.220] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.220] ReadFile (in: hFile=0x2624, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d37f61c*=0x1384, lpOverlapped=0x0) returned 1 [0193.220] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xffffec7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.220] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2f50000, cbInput=0x1384, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2d37f848, pbOutput=0x2f50000, pcbResult=0x2d37f618) returned 0x0 [0193.220] WriteFile (in: hFile=0x2624, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x1390, lpOverlapped=0x0) returned 1 [0193.220] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0193.220] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.220] WriteFile (in: hFile=0x2624, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.220] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x1390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.220] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0193.220] CloseHandle (hObject=0x2624) returned 1 [0193.336] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4b0000 [0193.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.play")) returned 1 [0193.514] VirtualFree (lpAddress=0xb4b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3249 os_tid = 0x30f4 [0193.106] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.106] ReadFile (in: hFile=0x2614, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.199] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.199] ReadFile (in: hFile=0x2614, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.199] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.201] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.201] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0193.201] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0193.202] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d47f500) returned 0x0 [0193.202] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.202] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d47f500) returned 0x0 [0193.205] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.208] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.208] WriteFile (in: hFile=0x2614, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0193.209] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.209] ReadFile (in: hFile=0x2614, lpBuffer=0x3050000, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d47f61c*=0x864, lpOverlapped=0x0) returned 1 [0193.209] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffff79c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.209] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3050000, cbInput=0x864, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2d47f848, pbOutput=0x3050000, pcbResult=0x2d47f618) returned 0x0 [0193.209] WriteFile (in: hFile=0x2614, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d47f61c*=0x870, lpOverlapped=0x0) returned 1 [0193.209] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0193.209] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.209] WriteFile (in: hFile=0x2614, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.209] SetFilePointerEx (in: hFile=0x2614, liDistanceToMove=0x870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.209] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0193.209] CloseHandle (hObject=0x2614) returned 1 [0193.333] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb4a0000 [0193.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.play")) returned 1 [0193.510] VirtualFree (lpAddress=0xb4a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3250 os_tid = 0x30f8 [0193.109] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.109] ReadFile (in: hFile=0x2604, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.187] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.187] ReadFile (in: hFile=0x2604, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.187] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.190] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.190] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0193.190] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0193.190] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d57f500) returned 0x0 [0193.191] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.191] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d57f500) returned 0x0 [0193.194] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.197] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.197] WriteFile (in: hFile=0x2604, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0193.198] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.198] ReadFile (in: hFile=0x2604, lpBuffer=0x3150000, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d57f61c*=0x1172, lpOverlapped=0x0) returned 1 [0193.198] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xffffee8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.198] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3150000, cbInput=0x1172, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x2d57f848, pbOutput=0x3150000, pcbResult=0x2d57f618) returned 0x0 [0193.198] WriteFile (in: hFile=0x2604, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d57f61c*=0x1180, lpOverlapped=0x0) returned 1 [0193.198] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0193.198] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.198] WriteFile (in: hFile=0x2604, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.198] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x1180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.198] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0193.198] CloseHandle (hObject=0x2604) returned 1 [0193.330] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xb110000 [0193.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.play")) returned 1 [0193.507] VirtualFree (lpAddress=0xb110000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3251 os_tid = 0x30fc [0193.110] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.111] ReadFile (in: hFile=0x25f4, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.172] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.172] ReadFile (in: hFile=0x25f4, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.172] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.175] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.175] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0193.175] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d6bf828, pbKeyObject=0x0) returned 0x0 [0193.175] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d6bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d6bf500) returned 0x0 [0193.175] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.176] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d6bf500) returned 0x0 [0193.179] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.182] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.182] WriteFile (in: hFile=0x25f4, lpBuffer=0x2d6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesWritten=0x2d6bf830*=0x428, lpOverlapped=0x0) returned 1 [0193.183] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.183] ReadFile (in: hFile=0x25f4, lpBuffer=0x3250000, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d6bf61c*=0x20ca, lpOverlapped=0x0) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xffffdf36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.328] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3250000, cbInput=0x20ca, pPaddingInfo=0x0, pbIV=0x2d6bf848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d6bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x2d6bf848, pbOutput=0x3250000, pcbResult=0x2d6bf618) returned 0x0 [0193.328] WriteFile (in: hFile=0x25f4, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d6bf61c*=0x20d0, lpOverlapped=0x0) returned 1 [0193.329] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6bf60c | out: lpNewFilePointer=0x0) returned 1 [0193.329] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.329] WriteFile (in: hFile=0x25f4, lpBuffer=0x2d6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf83c*, lpNumberOfBytesWritten=0x2d6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.329] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x20d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.329] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0193.329] CloseHandle (hObject=0x25f4) returned 1 [0193.348] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf970000 [0193.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.play")) returned 1 [0193.360] VirtualFree (lpAddress=0xf970000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3252 os_tid = 0x3100 [0193.112] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.112] ReadFile (in: hFile=0x2570, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.161] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.161] ReadFile (in: hFile=0x2570, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.161] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.164] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.164] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0193.164] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d93f828, pbKeyObject=0x0) returned 0x0 [0193.164] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2d93f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2d93f500) returned 0x0 [0193.164] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.164] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2d93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2d93f500) returned 0x0 [0193.168] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.171] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.171] WriteFile (in: hFile=0x2570, lpBuffer=0x2d93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d93f830, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesWritten=0x2d93f830*=0x428, lpOverlapped=0x0) returned 1 [0193.171] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.171] ReadFile (in: hFile=0x2570, lpBuffer=0x3350000, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d93f61c*=0x21c2, lpOverlapped=0x0) returned 1 [0193.327] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xffffde3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.327] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x3350000, cbInput=0x21c2, pPaddingInfo=0x0, pbIV=0x2d93f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d93f618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x2d93f848, pbOutput=0x3350000, pcbResult=0x2d93f618) returned 0x0 [0193.327] WriteFile (in: hFile=0x2570, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d93f61c*=0x21d0, lpOverlapped=0x0) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d93f60c | out: lpNewFilePointer=0x0) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.328] WriteFile (in: hFile=0x2570, lpBuffer=0x2d93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d93f83c*, lpNumberOfBytesWritten=0x2d93f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x2570, liDistanceToMove=0x21d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.328] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0193.328] CloseHandle (hObject=0x2570) returned 1 [0193.346] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf960000 [0193.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.play")) returned 1 [0193.365] VirtualFree (lpAddress=0xf960000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3253 os_tid = 0x3104 [0193.113] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.113] ReadFile (in: hFile=0x2590, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.150] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.150] ReadFile (in: hFile=0x2590, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.150] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0193.153] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0193.153] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0193.153] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0193.153] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x2ddbf500) returned 0x0 [0193.153] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0193.153] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x2ddbf500) returned 0x0 [0193.157] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.160] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.160] WriteFile (in: hFile=0x2590, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0193.160] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.160] ReadFile (in: hFile=0x2590, lpBuffer=0x3450000, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2ddbf61c*=0x21ec, lpOverlapped=0x0) returned 1 [0193.326] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xffffde14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.327] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0x21ec, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2ddbf848, pbOutput=0x3450000, pcbResult=0x2ddbf618) returned 0x0 [0193.327] WriteFile (in: hFile=0x2590, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2ddbf61c*=0x21f0, lpOverlapped=0x0) returned 1 [0193.327] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0193.327] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.327] WriteFile (in: hFile=0x2590, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.327] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x21f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.327] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.327] CloseHandle (hObject=0x2590) returned 1 [0193.341] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0xf910000 [0193.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.play")) returned 1 [0193.370] VirtualFree (lpAddress=0xf910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3254 os_tid = 0x3108 [0193.114] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.114] ReadFile (in: hFile=0x25b0, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.116] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.116] ReadFile (in: hFile=0x25b0, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0193.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0193.119] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2debf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0193.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2debf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2debf828, pbKeyObject=0x0) returned 0x0 [0193.119] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2debf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2debf500) returned 0x0 [0193.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0193.119] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2debf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2debf500) returned 0x0 [0193.123] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.126] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.126] WriteFile (in: hFile=0x25b0, lpBuffer=0x2debfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2debf830, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesWritten=0x2debf830*=0x428, lpOverlapped=0x0) returned 1 [0193.127] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.127] ReadFile (in: hFile=0x25b0, lpBuffer=0x3650000, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2debf61c*=0x2ad4, lpOverlapped=0x0) returned 1 [0193.127] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xffffd52c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.127] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3650000, cbInput=0x2ad4, pPaddingInfo=0x0, pbIV=0x2debf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2debf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2debf848, pbOutput=0x3650000, pcbResult=0x2debf618) returned 0x0 [0193.128] WriteFile (in: hFile=0x25b0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2debf61c*=0x2ae0, lpOverlapped=0x0) returned 1 [0193.128] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2debf60c | out: lpNewFilePointer=0x0) returned 1 [0193.128] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.128] WriteFile (in: hFile=0x25b0, lpBuffer=0x2debf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x2debf83c*, lpNumberOfBytesWritten=0x2debf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.128] SetFilePointerEx (in: hFile=0x25b0, liDistanceToMove=0x2ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.128] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.128] CloseHandle (hObject=0x25b0) returned 1 [0193.144] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0193.147] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.play")) returned 1 [0193.489] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3255 os_tid = 0x310c [0193.128] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.129] ReadFile (in: hFile=0x26b4, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.130] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.130] ReadFile (in: hFile=0x26b4, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.130] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0193.133] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0193.133] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2dfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0193.133] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2dfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2dfbf828, pbKeyObject=0x0) returned 0x0 [0193.133] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2dfbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2dfbf500) returned 0x0 [0193.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0193.135] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2dfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2dfbf500) returned 0x0 [0193.138] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.142] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.142] WriteFile (in: hFile=0x26b4, lpBuffer=0x2dfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dfbf830, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesWritten=0x2dfbf830*=0x428, lpOverlapped=0x0) returned 1 [0193.142] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.142] ReadFile (in: hFile=0x26b4, lpBuffer=0x3750000, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2dfbf61c*=0x194a, lpOverlapped=0x0) returned 1 [0193.149] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0xffffe6b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.149] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3750000, cbInput=0x194a, pPaddingInfo=0x0, pbIV=0x2dfbf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2dfbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2dfbf848, pbOutput=0x3750000, pcbResult=0x2dfbf618) returned 0x0 [0193.149] WriteFile (in: hFile=0x26b4, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2dfbf61c*=0x1950, lpOverlapped=0x0) returned 1 [0193.149] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dfbf60c | out: lpNewFilePointer=0x0) returned 1 [0193.149] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.149] WriteFile (in: hFile=0x26b4, lpBuffer=0x2dfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbf83c*, lpNumberOfBytesWritten=0x2dfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.149] SetFilePointerEx (in: hFile=0x26b4, liDistanceToMove=0x1950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.150] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.150] CloseHandle (hObject=0x26b4) returned 1 [0193.323] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0193.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.play")) returned 1 [0193.503] VirtualFree (lpAddress=0x920000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3256 os_tid = 0x3110 [0193.446] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.447] ReadFile (in: hFile=0x26bc, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.448] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.448] ReadFile (in: hFile=0x26bc, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.448] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0xf970000 [0193.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf970000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0xf970000) returned 0x0 [0193.451] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x2e0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0193.451] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x2e0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0xf970000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x2e0bf828, pbKeyObject=0x0) returned 0x0 [0193.451] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0xf970000, cbOutput=0x230, pcbResult=0x2e0bf500, dwFlags=0x0 | out: pbOutput=0xf970000, pcbResult=0x2e0bf500) returned 0x0 [0193.451] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0xf970230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0xf970230) returned 0x0 [0193.451] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0xf970000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0xf970000, cbOutput=0x400, pcbResult=0x2e0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0xf970000, pcbResult=0x2e0bf500) returned 0x0 [0193.455] VirtualFree (lpAddress=0xf970000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.457] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x26bc, lpBuffer=0x2e0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e0bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesWritten=0x2e0bf830*=0x428, lpOverlapped=0x0) returned 1 [0193.458] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.458] ReadFile (in: hFile=0x26bc, lpBuffer=0x3850000, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x2e0bf61c*=0x38c6, lpOverlapped=0x0) returned 1 [0193.459] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xffffc73a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.459] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3850000, cbInput=0x38c6, pPaddingInfo=0x0, pbIV=0x2e0bf848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x2e0bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e0bf848, pbOutput=0x3850000, pcbResult=0x2e0bf618) returned 0x0 [0193.459] WriteFile (in: hFile=0x26bc, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x2e0bf61c*=0x38d0, lpOverlapped=0x0) returned 1 [0193.459] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0bf60c | out: lpNewFilePointer=0x0) returned 1 [0193.459] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.459] WriteFile (in: hFile=0x26bc, lpBuffer=0x2e0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bf83c*, lpNumberOfBytesWritten=0x2e0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.459] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0x38d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.459] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.459] CloseHandle (hObject=0x26bc) returned 1 [0193.467] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.play")) returned 1 [0193.473] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3257 os_tid = 0x3114 [0193.557] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.557] ReadFile (in: hFile=0x26c4, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.558] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.559] ReadFile (in: hFile=0x26c4, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.559] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.563] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.563] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x2e1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0193.563] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x2e1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x2e1ff828, pbKeyObject=0x0) returned 0x0 [0193.563] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e1ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e1ff500) returned 0x0 [0193.564] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.564] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e1ff500) returned 0x0 [0193.567] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.570] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.570] WriteFile (in: hFile=0x26c4, lpBuffer=0x2e1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesWritten=0x2e1ff830*=0x428, lpOverlapped=0x0) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.571] ReadFile (in: hFile=0x26c4, lpBuffer=0x3950000, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x2e1ff61c*=0x173e, lpOverlapped=0x0) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xffffe8c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.571] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3950000, cbInput=0x173e, pPaddingInfo=0x0, pbIV=0x2e1ff848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x2e1ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e1ff848, pbOutput=0x3950000, pcbResult=0x2e1ff618) returned 0x0 [0193.571] WriteFile (in: hFile=0x26c4, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x2e1ff61c*=0x1740, lpOverlapped=0x0) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1ff60c | out: lpNewFilePointer=0x0) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.571] WriteFile (in: hFile=0x26c4, lpBuffer=0x2e1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ff83c*, lpNumberOfBytesWritten=0x2e1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x1740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.571] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.571] CloseHandle (hObject=0x26c4) returned 1 [0193.571] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.play")) returned 1 [0193.576] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3258 os_tid = 0x3118 [0193.643] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.643] ReadFile (in: hFile=0x26ac, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.726] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.726] ReadFile (in: hFile=0x26ac, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.761] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.763] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.763] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x1528f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0193.764] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x1528f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x1528f828, pbKeyObject=0x0) returned 0x0 [0193.764] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1528f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1528f500) returned 0x0 [0193.764] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.764] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1528f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1528f500) returned 0x0 [0193.767] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.770] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.770] WriteFile (in: hFile=0x26ac, lpBuffer=0x1528fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1528f830, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesWritten=0x1528f830*=0x428, lpOverlapped=0x0) returned 1 [0193.770] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.770] ReadFile (in: hFile=0x26ac, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x1528f61c*=0x4696, lpOverlapped=0x0) returned 1 [0193.780] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xffffb96a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.780] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3a50000, cbInput=0x4696, pPaddingInfo=0x0, pbIV=0x1528f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x1528f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1528f848, pbOutput=0x3a50000, pcbResult=0x1528f618) returned 0x0 [0193.780] WriteFile (in: hFile=0x26ac, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x1528f61c*=0x46a0, lpOverlapped=0x0) returned 1 [0193.780] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1528f60c | out: lpNewFilePointer=0x0) returned 1 [0193.780] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.780] WriteFile (in: hFile=0x26ac, lpBuffer=0x1528f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x1528f83c*, lpNumberOfBytesWritten=0x1528f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.780] SetFilePointerEx (in: hFile=0x26ac, liDistanceToMove=0x46a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.780] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.780] CloseHandle (hObject=0x26ac) returned 1 [0193.781] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.play")) returned 1 [0193.789] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3259 os_tid = 0x311c [0193.645] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.645] ReadFile (in: hFile=0x2560, lpBuffer=0x15f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f8fb34*, lpNumberOfBytesRead=0x15f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.714] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.714] ReadFile (in: hFile=0x2560, lpBuffer=0x15f8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f8fb34*, lpNumberOfBytesRead=0x15f8f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.714] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.717] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.717] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x15f8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0193.717] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x15f8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x15f8f828, pbKeyObject=0x0) returned 0x0 [0193.718] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15f8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15f8f500) returned 0x0 [0193.718] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.718] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15f8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15f8f500) returned 0x0 [0193.721] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.724] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.724] WriteFile (in: hFile=0x2560, lpBuffer=0x15f8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15f8f830, lpOverlapped=0x0 | out: lpBuffer=0x15f8fb34*, lpNumberOfBytesWritten=0x15f8f830*=0x428, lpOverlapped=0x0) returned 1 [0193.725] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.725] ReadFile (in: hFile=0x2560, lpBuffer=0x3550000, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x15f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x15f8f61c*=0x2f38, lpOverlapped=0x0) returned 1 [0193.771] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xffffd0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.771] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x3550000, cbInput=0x2f38, pPaddingInfo=0x0, pbIV=0x15f8f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x15f8f618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x15f8f848, pbOutput=0x3550000, pcbResult=0x15f8f618) returned 0x0 [0193.771] WriteFile (in: hFile=0x2560, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x15f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x15f8f61c*=0x2f40, lpOverlapped=0x0) returned 1 [0193.771] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15f8f60c | out: lpNewFilePointer=0x0) returned 1 [0193.771] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.772] WriteFile (in: hFile=0x2560, lpBuffer=0x15f8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15f8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15f8f83c*, lpNumberOfBytesWritten=0x15f8f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.772] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x2f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.772] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0193.772] CloseHandle (hObject=0x2560) returned 1 [0193.772] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.play")) returned 1 [0193.776] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3260 os_tid = 0x3120 [0193.646] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.646] ReadFile (in: hFile=0x2558, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.714] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.714] ReadFile (in: hFile=0x2558, lpBuffer=0x2d7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesRead=0x2d7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.736] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.739] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.739] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x2d7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0193.739] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x2d7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x2d7bf828, pbKeyObject=0x0) returned 0x0 [0193.739] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d7bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d7bf500) returned 0x0 [0193.739] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.739] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d7bf500) returned 0x0 [0193.744] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.747] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.748] WriteFile (in: hFile=0x2558, lpBuffer=0x2d7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d7bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d7bfb34*, lpNumberOfBytesWritten=0x2d7bf830*=0x428, lpOverlapped=0x0) returned 1 [0193.748] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.748] ReadFile (in: hFile=0x2558, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x2d7bf61c*=0x14bc, lpOverlapped=0x0) returned 1 [0193.748] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0xffffeb44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.748] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3b50000, cbInput=0x14bc, pPaddingInfo=0x0, pbIV=0x2d7bf848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x2d7bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d7bf848, pbOutput=0x3b50000, pcbResult=0x2d7bf618) returned 0x0 [0193.748] WriteFile (in: hFile=0x2558, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x2d7bf61c*=0x14c0, lpOverlapped=0x0) returned 1 [0193.748] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf60c | out: lpNewFilePointer=0x0) returned 1 [0193.748] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.749] WriteFile (in: hFile=0x2558, lpBuffer=0x2d7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf83c*, lpNumberOfBytesWritten=0x2d7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.749] SetFilePointerEx (in: hFile=0x2558, liDistanceToMove=0x14c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.749] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.749] CloseHandle (hObject=0x2558) returned 1 [0193.749] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.play")) returned 1 [0193.756] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3261 os_tid = 0x3124 [0193.647] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.647] ReadFile (in: hFile=0x774, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.649] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.649] ReadFile (in: hFile=0x774, lpBuffer=0x2da3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2da3f85c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesRead=0x2da3f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.649] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.654] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.654] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x2da3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0193.654] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x2da3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x2da3f828, pbKeyObject=0x0) returned 0x0 [0193.654] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2da3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2da3f500) returned 0x0 [0193.654] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.654] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2da3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2da3f500) returned 0x0 [0193.658] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.661] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.661] WriteFile (in: hFile=0x774, lpBuffer=0x2da3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2da3f830, lpOverlapped=0x0 | out: lpBuffer=0x2da3fb34*, lpNumberOfBytesWritten=0x2da3f830*=0x428, lpOverlapped=0x0) returned 1 [0193.661] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.661] ReadFile (in: hFile=0x774, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x2da3f61c*=0x1580, lpOverlapped=0x0) returned 1 [0193.661] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xffffea80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.661] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3c50000, cbInput=0x1580, pPaddingInfo=0x0, pbIV=0x2da3f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x2da3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2da3f848, pbOutput=0x3c50000, pcbResult=0x2da3f618) returned 0x0 [0193.661] WriteFile (in: hFile=0x774, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x2da3f61c*=0x1590, lpOverlapped=0x0) returned 1 [0193.661] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da3f60c | out: lpNewFilePointer=0x0) returned 1 [0193.662] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.662] WriteFile (in: hFile=0x774, lpBuffer=0x2da3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da3f61c, lpOverlapped=0x0 | out: lpBuffer=0x2da3f83c*, lpNumberOfBytesWritten=0x2da3f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.662] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x1590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.662] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.662] CloseHandle (hObject=0x774) returned 1 [0193.662] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.play")) returned 1 [0193.666] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3262 os_tid = 0x3128 [0193.671] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.671] ReadFile (in: hFile=0x24cc, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.673] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.673] ReadFile (in: hFile=0x24cc, lpBuffer=0x2e2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesRead=0x2e2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.676] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.676] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x2e2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0193.676] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x2e2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x2e2ff828, pbKeyObject=0x0) returned 0x0 [0193.676] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e2ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e2ff500) returned 0x0 [0193.676] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.677] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e2ff500) returned 0x0 [0193.680] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.683] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.683] WriteFile (in: hFile=0x24cc, lpBuffer=0x2e2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e2ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e2ffb34*, lpNumberOfBytesWritten=0x2e2ff830*=0x428, lpOverlapped=0x0) returned 1 [0193.683] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.683] ReadFile (in: hFile=0x24cc, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x2e2ff61c*=0x27a4, lpOverlapped=0x0) returned 1 [0193.686] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0xffffd85c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.687] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3d50000, cbInput=0x27a4, pPaddingInfo=0x0, pbIV=0x2e2ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x2e2ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e2ff848, pbOutput=0x3d50000, pcbResult=0x2e2ff618) returned 0x0 [0193.687] WriteFile (in: hFile=0x24cc, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x2e2ff61c*=0x27b0, lpOverlapped=0x0) returned 1 [0193.687] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2ff60c | out: lpNewFilePointer=0x0) returned 1 [0193.687] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.689] WriteFile (in: hFile=0x24cc, lpBuffer=0x2e2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e2ff83c*, lpNumberOfBytesWritten=0x2e2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0193.689] SetFilePointerEx (in: hFile=0x24cc, liDistanceToMove=0x27b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.689] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.690] CloseHandle (hObject=0x24cc) returned 1 [0193.690] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.play")) returned 1 [0193.695] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3263 os_tid = 0x312c [0193.699] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.699] ReadFile (in: hFile=0x24c4, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.701] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.701] ReadFile (in: hFile=0x24c4, lpBuffer=0x2e43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e43f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesRead=0x2e43f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.701] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.704] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.704] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x2e43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0193.704] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x2e43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x2e43f828, pbKeyObject=0x0) returned 0x0 [0193.704] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e43f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e43f500) returned 0x0 [0193.705] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.705] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e43f500) returned 0x0 [0193.709] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.712] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.712] WriteFile (in: hFile=0x24c4, lpBuffer=0x2e43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e43f830, lpOverlapped=0x0 | out: lpBuffer=0x2e43fb34*, lpNumberOfBytesWritten=0x2e43f830*=0x428, lpOverlapped=0x0) returned 1 [0193.713] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.713] ReadFile (in: hFile=0x24c4, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x2e43f61c*=0x4f6c, lpOverlapped=0x0) returned 1 [0193.726] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xffffb094, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.726] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3e50000, cbInput=0x4f6c, pPaddingInfo=0x0, pbIV=0x2e43f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x2e43f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e43f848, pbOutput=0x3e50000, pcbResult=0x2e43f618) returned 0x0 [0193.726] WriteFile (in: hFile=0x24c4, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x2e43f61c*=0x4f70, lpOverlapped=0x0) returned 1 [0193.727] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e43f60c | out: lpNewFilePointer=0x0) returned 1 [0193.727] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.727] WriteFile (in: hFile=0x24c4, lpBuffer=0x2e43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e43f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f83c*, lpNumberOfBytesWritten=0x2e43f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.727] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x4f70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.727] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.727] CloseHandle (hObject=0x24c4) returned 1 [0193.727] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.730] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.play")) returned 1 [0193.731] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3264 os_tid = 0x3130 [0193.794] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.794] ReadFile (in: hFile=0x24bc, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.796] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.796] ReadFile (in: hFile=0x24bc, lpBuffer=0x2e57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesRead=0x2e57f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.796] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.799] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.799] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x2e57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0193.799] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x2e57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x2e57f828, pbKeyObject=0x0) returned 0x0 [0193.799] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e57f500) returned 0x0 [0193.799] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.799] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e57f500) returned 0x0 [0193.802] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.805] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.805] WriteFile (in: hFile=0x24bc, lpBuffer=0x2e57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e57f830, lpOverlapped=0x0 | out: lpBuffer=0x2e57fb34*, lpNumberOfBytesWritten=0x2e57f830*=0x428, lpOverlapped=0x0) returned 1 [0193.805] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.806] ReadFile (in: hFile=0x24bc, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x2e57f61c*=0xc10, lpOverlapped=0x0) returned 1 [0193.806] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffff3f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.806] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0xc10, pPaddingInfo=0x0, pbIV=0x2e57f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x2e57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e57f848, pbOutput=0x3f50000, pcbResult=0x2e57f618) returned 0x0 [0193.806] WriteFile (in: hFile=0x24bc, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x2e57f61c*=0xc20, lpOverlapped=0x0) returned 1 [0193.806] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e57f60c | out: lpNewFilePointer=0x0) returned 1 [0193.806] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.806] WriteFile (in: hFile=0x24bc, lpBuffer=0x2e57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e57f83c*, lpNumberOfBytesWritten=0x2e57f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.806] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xc20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.806] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.806] CloseHandle (hObject=0x24bc) returned 1 [0193.807] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.play")) returned 1 [0193.811] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3265 os_tid = 0x3134 [0193.815] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.815] ReadFile (in: hFile=0x24b4, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.816] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.816] ReadFile (in: hFile=0x24b4, lpBuffer=0x2e6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesRead=0x2e6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.817] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.819] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.819] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x2e6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0193.819] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x2e6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x2e6bf828, pbKeyObject=0x0) returned 0x0 [0193.819] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e6bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e6bf500) returned 0x0 [0193.819] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.819] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e6bf500) returned 0x0 [0193.823] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.825] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.825] WriteFile (in: hFile=0x24b4, lpBuffer=0x2e6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e6bfb34*, lpNumberOfBytesWritten=0x2e6bf830*=0x428, lpOverlapped=0x0) returned 1 [0193.826] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.826] ReadFile (in: hFile=0x24b4, lpBuffer=0x4050000, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x2e6bf61c*=0x938, lpOverlapped=0x0) returned 1 [0193.826] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0xfffff6c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.826] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4050000, cbInput=0x938, pPaddingInfo=0x0, pbIV=0x2e6bf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x2e6bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e6bf848, pbOutput=0x4050000, pcbResult=0x2e6bf618) returned 0x0 [0193.826] WriteFile (in: hFile=0x24b4, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x2e6bf61c*=0x940, lpOverlapped=0x0) returned 1 [0193.826] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf60c | out: lpNewFilePointer=0x0) returned 1 [0193.826] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.826] WriteFile (in: hFile=0x24b4, lpBuffer=0x2e6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf83c*, lpNumberOfBytesWritten=0x2e6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.826] SetFilePointerEx (in: hFile=0x24b4, liDistanceToMove=0x940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.826] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.826] CloseHandle (hObject=0x24b4) returned 1 [0193.826] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.829] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.play")) returned 1 [0193.831] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3266 os_tid = 0x3138 [0193.835] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.835] ReadFile (in: hFile=0x2018, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.836] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.836] ReadFile (in: hFile=0x2018, lpBuffer=0x2e7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesRead=0x2e7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.836] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.839] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x2e7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0193.839] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x2e7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x2e7ff828, pbKeyObject=0x0) returned 0x0 [0193.839] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e7ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e7ff500) returned 0x0 [0193.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.839] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e7ff500) returned 0x0 [0193.842] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.845] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.845] WriteFile (in: hFile=0x2018, lpBuffer=0x2e7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e7ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e7ffb34*, lpNumberOfBytesWritten=0x2e7ff830*=0x428, lpOverlapped=0x0) returned 1 [0193.846] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.846] ReadFile (in: hFile=0x2018, lpBuffer=0x4150000, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x2e7ff61c*=0xb60, lpOverlapped=0x0) returned 1 [0193.846] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffff4a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.846] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4150000, cbInput=0xb60, pPaddingInfo=0x0, pbIV=0x2e7ff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x2e7ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e7ff848, pbOutput=0x4150000, pcbResult=0x2e7ff618) returned 0x0 [0193.846] WriteFile (in: hFile=0x2018, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x2e7ff61c*=0xb70, lpOverlapped=0x0) returned 1 [0193.846] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7ff60c | out: lpNewFilePointer=0x0) returned 1 [0193.846] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.846] WriteFile (in: hFile=0x2018, lpBuffer=0x2e7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e7ff83c*, lpNumberOfBytesWritten=0x2e7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0193.846] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xb70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.846] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.846] CloseHandle (hObject=0x2018) returned 1 [0193.846] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.play")) returned 1 [0193.850] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3267 os_tid = 0x313c [0193.854] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.855] ReadFile (in: hFile=0x1ffc, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.856] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.856] ReadFile (in: hFile=0x1ffc, lpBuffer=0x2e93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesRead=0x2e93f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.856] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.859] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.859] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x2e93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0193.859] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x2e93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x2e93f828, pbKeyObject=0x0) returned 0x0 [0193.859] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e93f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e93f500) returned 0x0 [0193.859] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.859] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e93f500) returned 0x0 [0193.863] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.866] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.866] WriteFile (in: hFile=0x1ffc, lpBuffer=0x2e93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e93f830, lpOverlapped=0x0 | out: lpBuffer=0x2e93fb34*, lpNumberOfBytesWritten=0x2e93f830*=0x428, lpOverlapped=0x0) returned 1 [0193.867] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.867] ReadFile (in: hFile=0x1ffc, lpBuffer=0x4250000, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x2e93f61c*=0x6efa, lpOverlapped=0x0) returned 1 [0193.867] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xffff9106, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.868] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4250000, cbInput=0x6efa, pPaddingInfo=0x0, pbIV=0x2e93f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x2e93f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e93f848, pbOutput=0x4250000, pcbResult=0x2e93f618) returned 0x0 [0193.868] WriteFile (in: hFile=0x1ffc, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x2e93f61c*=0x6f00, lpOverlapped=0x0) returned 1 [0193.868] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93f60c | out: lpNewFilePointer=0x0) returned 1 [0193.868] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.868] WriteFile (in: hFile=0x1ffc, lpBuffer=0x2e93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e93f83c*, lpNumberOfBytesWritten=0x2e93f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.868] SetFilePointerEx (in: hFile=0x1ffc, liDistanceToMove=0x6f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.868] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.868] CloseHandle (hObject=0x1ffc) returned 1 [0193.868] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.play")) returned 1 [0193.872] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3268 os_tid = 0x3140 [0193.877] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.877] ReadFile (in: hFile=0x1fec, lpBuffer=0x3bfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesRead=0x3bfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.878] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.878] ReadFile (in: hFile=0x1fec, lpBuffer=0x3bfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3bfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesRead=0x3bfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.878] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.881] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.881] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x3bfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0193.881] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x3bfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x3bfbf828, pbKeyObject=0x0) returned 0x0 [0193.881] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3bfbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3bfbf500) returned 0x0 [0193.881] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.881] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3bfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3bfbf500) returned 0x0 [0193.884] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.888] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.888] WriteFile (in: hFile=0x1fec, lpBuffer=0x3bfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3bfbf830, lpOverlapped=0x0 | out: lpBuffer=0x3bfbfb34*, lpNumberOfBytesWritten=0x3bfbf830*=0x428, lpOverlapped=0x0) returned 1 [0193.888] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.888] ReadFile (in: hFile=0x1fec, lpBuffer=0x4350000, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x3bfbf61c*=0x5880, lpOverlapped=0x0) returned 1 [0193.889] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xffffa780, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.889] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4350000, cbInput=0x5880, pPaddingInfo=0x0, pbIV=0x3bfbf848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x3bfbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3bfbf848, pbOutput=0x4350000, pcbResult=0x3bfbf618) returned 0x0 [0193.889] WriteFile (in: hFile=0x1fec, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x5890, lpNumberOfBytesWritten=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x3bfbf61c*=0x5890, lpOverlapped=0x0) returned 1 [0193.889] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bfbf60c | out: lpNewFilePointer=0x0) returned 1 [0193.889] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.889] WriteFile (in: hFile=0x1fec, lpBuffer=0x3bfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3bfbf83c*, lpNumberOfBytesWritten=0x3bfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.889] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x5890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.889] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.890] CloseHandle (hObject=0x1fec) returned 1 [0193.890] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.play")) returned 1 [0193.898] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3269 os_tid = 0x3144 [0193.910] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.910] ReadFile (in: hFile=0x1f14, lpBuffer=0x3c0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesRead=0x3c0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.911] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.911] ReadFile (in: hFile=0x1f14, lpBuffer=0x3c0ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c0ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesRead=0x3c0ff85c*=0x428, lpOverlapped=0x0) returned 1 [0193.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.915] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.915] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x3c0ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0193.915] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x3c0ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x3c0ff828, pbKeyObject=0x0) returned 0x0 [0193.915] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c0ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c0ff500) returned 0x0 [0193.916] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.916] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c0ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c0ff500) returned 0x0 [0193.919] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.922] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.922] WriteFile (in: hFile=0x1f14, lpBuffer=0x3c0ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c0ff830, lpOverlapped=0x0 | out: lpBuffer=0x3c0ffb34*, lpNumberOfBytesWritten=0x3c0ff830*=0x428, lpOverlapped=0x0) returned 1 [0193.923] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.923] ReadFile (in: hFile=0x1f14, lpBuffer=0x4450000, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x3c0ff61c*=0x477c, lpOverlapped=0x0) returned 1 [0193.924] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xffffb884, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.924] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4450000, cbInput=0x477c, pPaddingInfo=0x0, pbIV=0x3c0ff848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x3c0ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c0ff848, pbOutput=0x4450000, pcbResult=0x3c0ff618) returned 0x0 [0193.924] WriteFile (in: hFile=0x1f14, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x3c0ff61c*=0x4780, lpOverlapped=0x0) returned 1 [0193.924] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c0ff60c | out: lpNewFilePointer=0x0) returned 1 [0193.924] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.924] WriteFile (in: hFile=0x1f14, lpBuffer=0x3c0ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c0ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c0ff83c*, lpNumberOfBytesWritten=0x3c0ff61c*=0x8, lpOverlapped=0x0) returned 1 [0193.924] SetFilePointerEx (in: hFile=0x1f14, liDistanceToMove=0x4780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.924] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.924] CloseHandle (hObject=0x1f14) returned 1 [0193.924] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.play")) returned 1 [0193.929] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3270 os_tid = 0x3148 [0193.933] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.933] ReadFile (in: hFile=0x1f24, lpBuffer=0x3c23fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c23f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesRead=0x3c23f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.935] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.938] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.938] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x3c23f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0193.938] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x3c23f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x3c23f828, pbKeyObject=0x0) returned 0x0 [0193.938] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c23f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c23f500) returned 0x0 [0193.938] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.938] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c23f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c23f500) returned 0x0 [0193.942] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.945] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.945] WriteFile (in: hFile=0x1f24, lpBuffer=0x3c23fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c23f830, lpOverlapped=0x0 | out: lpBuffer=0x3c23fb34*, lpNumberOfBytesWritten=0x3c23f830*=0x428, lpOverlapped=0x0) returned 1 [0193.945] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.945] ReadFile (in: hFile=0x1f24, lpBuffer=0x4550000, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x3c23f61c*=0x530, lpOverlapped=0x0) returned 1 [0193.945] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffad0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.945] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4550000, cbInput=0x530, pPaddingInfo=0x0, pbIV=0x3c23f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x3c23f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c23f848, pbOutput=0x4550000, pcbResult=0x3c23f618) returned 0x0 [0193.945] WriteFile (in: hFile=0x1f24, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x3c23f61c*=0x540, lpOverlapped=0x0) returned 1 [0193.945] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c23f60c | out: lpNewFilePointer=0x0) returned 1 [0193.945] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.945] WriteFile (in: hFile=0x1f24, lpBuffer=0x3c23f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c23f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c23f83c*, lpNumberOfBytesWritten=0x3c23f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.946] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.946] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.946] CloseHandle (hObject=0x1f24) returned 1 [0193.946] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.play")) returned 1 [0193.950] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3271 os_tid = 0x314c [0193.955] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.955] ReadFile (in: hFile=0x758, lpBuffer=0x3c37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c37f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesRead=0x3c37f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.957] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.957] ReadFile (in: hFile=0x758, lpBuffer=0x3c37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c37f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesRead=0x3c37f85c*=0x428, lpOverlapped=0x0) returned 1 [0193.957] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.960] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.960] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x3c37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0193.960] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x3c37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x3c37f828, pbKeyObject=0x0) returned 0x0 [0193.960] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c37f500) returned 0x0 [0193.960] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.961] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c37f500) returned 0x0 [0193.964] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.967] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.967] WriteFile (in: hFile=0x758, lpBuffer=0x3c37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c37f830, lpOverlapped=0x0 | out: lpBuffer=0x3c37fb34*, lpNumberOfBytesWritten=0x3c37f830*=0x428, lpOverlapped=0x0) returned 1 [0193.967] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.967] ReadFile (in: hFile=0x758, lpBuffer=0x4650000, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x3c37f61c*=0x7d14, lpOverlapped=0x0) returned 1 [0193.968] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0xffff82ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.968] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4650000, cbInput=0x7d14, pPaddingInfo=0x0, pbIV=0x3c37f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x3c37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c37f848, pbOutput=0x4650000, pcbResult=0x3c37f618) returned 0x0 [0193.969] WriteFile (in: hFile=0x758, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x3c37f61c*=0x7d20, lpOverlapped=0x0) returned 1 [0193.969] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c37f60c | out: lpNewFilePointer=0x0) returned 1 [0193.969] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.969] WriteFile (in: hFile=0x758, lpBuffer=0x3c37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c37f83c*, lpNumberOfBytesWritten=0x3c37f61c*=0x8, lpOverlapped=0x0) returned 1 [0193.969] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x7d20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.969] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.969] CloseHandle (hObject=0x758) returned 1 [0193.969] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.play")) returned 1 [0193.974] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3272 os_tid = 0x3150 [0193.968] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.979] ReadFile (in: hFile=0x2174, lpBuffer=0x3c4bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c4bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesRead=0x3c4bf85c*=0x428, lpOverlapped=0x0) returned 1 [0193.980] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0193.984] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0193.984] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x3c4bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0193.984] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x3c4bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x3c4bf828, pbKeyObject=0x0) returned 0x0 [0193.984] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c4bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c4bf500) returned 0x0 [0193.984] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0193.985] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c4bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c4bf500) returned 0x0 [0193.989] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.992] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.992] WriteFile (in: hFile=0x2174, lpBuffer=0x3c4bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c4bf830, lpOverlapped=0x0 | out: lpBuffer=0x3c4bfb34*, lpNumberOfBytesWritten=0x3c4bf830*=0x428, lpOverlapped=0x0) returned 1 [0193.992] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.992] ReadFile (in: hFile=0x2174, lpBuffer=0x4750000, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x3c4bf61c*=0x64c, lpOverlapped=0x0) returned 1 [0193.992] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffff9b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.992] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4750000, cbInput=0x64c, pPaddingInfo=0x0, pbIV=0x3c4bf848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x3c4bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c4bf848, pbOutput=0x4750000, pcbResult=0x3c4bf618) returned 0x0 [0193.992] WriteFile (in: hFile=0x2174, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x3c4bf61c*=0x650, lpOverlapped=0x0) returned 1 [0193.992] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c4bf60c | out: lpNewFilePointer=0x0) returned 1 [0193.993] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.993] WriteFile (in: hFile=0x2174, lpBuffer=0x3c4bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c4bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c4bf83c*, lpNumberOfBytesWritten=0x3c4bf61c*=0x8, lpOverlapped=0x0) returned 1 [0193.993] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x650, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.993] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0193.993] CloseHandle (hObject=0x2174) returned 1 [0193.993] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0193.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.play")) returned 1 [0193.997] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3273 os_tid = 0x3154 [0194.003] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.003] ReadFile (in: hFile=0x2184, lpBuffer=0x3c5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesRead=0x3c5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.004] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.004] ReadFile (in: hFile=0x2184, lpBuffer=0x3c5ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c5ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesRead=0x3c5ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.005] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.007] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.008] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x3c5ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0194.008] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x3c5ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x3c5ff828, pbKeyObject=0x0) returned 0x0 [0194.008] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c5ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c5ff500) returned 0x0 [0194.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.008] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c5ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c5ff500) returned 0x0 [0194.012] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.016] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.016] WriteFile (in: hFile=0x2184, lpBuffer=0x3c5ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c5ff830, lpOverlapped=0x0 | out: lpBuffer=0x3c5ffb34*, lpNumberOfBytesWritten=0x3c5ff830*=0x428, lpOverlapped=0x0) returned 1 [0194.016] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.016] ReadFile (in: hFile=0x2184, lpBuffer=0x4850000, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x3c5ff61c*=0x7658, lpOverlapped=0x0) returned 1 [0194.017] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xffff89a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.017] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4850000, cbInput=0x7658, pPaddingInfo=0x0, pbIV=0x3c5ff848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x3c5ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c5ff848, pbOutput=0x4850000, pcbResult=0x3c5ff618) returned 0x0 [0194.018] WriteFile (in: hFile=0x2184, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x3c5ff61c*=0x7660, lpOverlapped=0x0) returned 1 [0194.018] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c5ff60c | out: lpNewFilePointer=0x0) returned 1 [0194.018] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.018] WriteFile (in: hFile=0x2184, lpBuffer=0x3c5ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c5ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3c5ff83c*, lpNumberOfBytesWritten=0x3c5ff61c*=0x8, lpOverlapped=0x0) returned 1 [0194.018] SetFilePointerEx (in: hFile=0x2184, liDistanceToMove=0x7660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.018] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.018] CloseHandle (hObject=0x2184) returned 1 [0194.018] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.play")) returned 1 [0194.022] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3274 os_tid = 0x3158 [0194.027] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.027] ReadFile (in: hFile=0x2624, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.029] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.029] ReadFile (in: hFile=0x2624, lpBuffer=0x15a4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesRead=0x15a4f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.029] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.032] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x15a4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0194.032] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x15a4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x15a4f828, pbKeyObject=0x0) returned 0x0 [0194.032] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15a4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15a4f500) returned 0x0 [0194.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.032] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15a4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15a4f500) returned 0x0 [0194.036] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.039] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.039] WriteFile (in: hFile=0x2624, lpBuffer=0x15a4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a4f830, lpOverlapped=0x0 | out: lpBuffer=0x15a4fb34*, lpNumberOfBytesWritten=0x15a4f830*=0x428, lpOverlapped=0x0) returned 1 [0194.040] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.040] ReadFile (in: hFile=0x2624, lpBuffer=0x4950000, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x15a4f61c*=0x23f8, lpOverlapped=0x0) returned 1 [0194.040] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xffffdc08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.040] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4950000, cbInput=0x23f8, pPaddingInfo=0x0, pbIV=0x15a4f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x15a4f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a4f848, pbOutput=0x4950000, pcbResult=0x15a4f618) returned 0x0 [0194.041] WriteFile (in: hFile=0x2624, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x15a4f61c*=0x2400, lpOverlapped=0x0) returned 1 [0194.041] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a4f60c | out: lpNewFilePointer=0x0) returned 1 [0194.041] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.041] WriteFile (in: hFile=0x2624, lpBuffer=0x15a4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a4f83c*, lpNumberOfBytesWritten=0x15a4f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.041] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x2400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.041] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.041] CloseHandle (hObject=0x2624) returned 1 [0194.041] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.play")) returned 1 [0194.046] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3275 os_tid = 0x315c [0194.050] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.051] ReadFile (in: hFile=0x265c, lpBuffer=0x15b8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesRead=0x15b8f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.052] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.055] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.055] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x15b8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0194.055] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x15b8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x15b8f828, pbKeyObject=0x0) returned 0x0 [0194.055] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15b8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15b8f500) returned 0x0 [0194.055] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.055] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15b8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15b8f500) returned 0x0 [0194.058] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.066] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.067] WriteFile (in: hFile=0x265c, lpBuffer=0x15b8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b8f830, lpOverlapped=0x0 | out: lpBuffer=0x15b8fb34*, lpNumberOfBytesWritten=0x15b8f830*=0x428, lpOverlapped=0x0) returned 1 [0194.067] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.067] ReadFile (in: hFile=0x265c, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x15b8f61c*=0x788, lpOverlapped=0x0) returned 1 [0194.067] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffff878, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.067] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0x788, pPaddingInfo=0x0, pbIV=0x15b8f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x15b8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15b8f848, pbOutput=0x2a50000, pcbResult=0x15b8f618) returned 0x0 [0194.068] WriteFile (in: hFile=0x265c, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x15b8f61c*=0x790, lpOverlapped=0x0) returned 1 [0194.068] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b8f60c | out: lpNewFilePointer=0x0) returned 1 [0194.068] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.068] WriteFile (in: hFile=0x265c, lpBuffer=0x15b8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b8f83c*, lpNumberOfBytesWritten=0x15b8f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.068] SetFilePointerEx (in: hFile=0x265c, liDistanceToMove=0x790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.069] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.069] CloseHandle (hObject=0x265c) returned 1 [0194.069] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.play")) returned 1 [0194.075] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3276 os_tid = 0x3160 [0194.080] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.080] ReadFile (in: hFile=0x2604, lpBuffer=0x15ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesRead=0x15ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.081] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.081] ReadFile (in: hFile=0x2604, lpBuffer=0x15ccfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15ccf85c, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesRead=0x15ccf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.081] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.084] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.084] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15ccf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0194.084] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15ccf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15ccf828, pbKeyObject=0x0) returned 0x0 [0194.084] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15ccf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15ccf500) returned 0x0 [0194.085] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.085] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15ccf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15ccf500) returned 0x0 [0194.089] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.092] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.092] WriteFile (in: hFile=0x2604, lpBuffer=0x15ccfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15ccf830, lpOverlapped=0x0 | out: lpBuffer=0x15ccfb34*, lpNumberOfBytesWritten=0x15ccf830*=0x428, lpOverlapped=0x0) returned 1 [0194.092] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.092] ReadFile (in: hFile=0x2604, lpBuffer=0x2b50000, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15ccf61c*=0xba4, lpOverlapped=0x0) returned 1 [0194.092] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffff45c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.092] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0xba4, pPaddingInfo=0x0, pbIV=0x15ccf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15ccf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15ccf848, pbOutput=0x2b50000, pcbResult=0x15ccf618) returned 0x0 [0194.093] WriteFile (in: hFile=0x2604, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15ccf61c*=0xbb0, lpOverlapped=0x0) returned 1 [0194.093] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15ccf60c | out: lpNewFilePointer=0x0) returned 1 [0194.093] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.093] WriteFile (in: hFile=0x2604, lpBuffer=0x15ccf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15ccf61c, lpOverlapped=0x0 | out: lpBuffer=0x15ccf83c*, lpNumberOfBytesWritten=0x15ccf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.093] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xbb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.093] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.093] CloseHandle (hObject=0x2604) returned 1 [0194.093] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.play")) returned 1 [0194.098] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3277 os_tid = 0x3164 [0194.103] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.103] ReadFile (in: hFile=0x267c, lpBuffer=0x2d6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesRead=0x2d6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.105] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.107] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.107] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x2d6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0194.107] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x2d6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x2d6bf828, pbKeyObject=0x0) returned 0x0 [0194.107] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d6bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d6bf500) returned 0x0 [0194.107] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.108] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d6bf500) returned 0x0 [0194.174] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.178] WriteFile (in: hFile=0x267c, lpBuffer=0x2d6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d6bf830, lpOverlapped=0x0 | out: lpBuffer=0x2d6bfb34*, lpNumberOfBytesWritten=0x2d6bf830*=0x428, lpOverlapped=0x0) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.178] ReadFile (in: hFile=0x267c, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x2d6bf61c*=0x514, lpOverlapped=0x0) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffffaec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.178] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2c50000, cbInput=0x514, pPaddingInfo=0x0, pbIV=0x2d6bf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x2d6bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d6bf848, pbOutput=0x2c50000, pcbResult=0x2d6bf618) returned 0x0 [0194.178] WriteFile (in: hFile=0x267c, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x2d6bf61c*=0x520, lpOverlapped=0x0) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6bf60c | out: lpNewFilePointer=0x0) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.178] WriteFile (in: hFile=0x267c, lpBuffer=0x2d6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf83c*, lpNumberOfBytesWritten=0x2d6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x267c, liDistanceToMove=0x520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.179] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.179] CloseHandle (hObject=0x267c) returned 1 [0194.179] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.play")) returned 1 [0194.184] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3278 os_tid = 0x3168 [0194.188] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.188] ReadFile (in: hFile=0x2194, lpBuffer=0x2d93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d93f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesRead=0x2d93f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.189] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.193] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.193] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0194.193] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d93f828, pbKeyObject=0x0) returned 0x0 [0194.193] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d93f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d93f500) returned 0x0 [0194.193] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.193] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d93f500) returned 0x0 [0194.196] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.199] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.199] WriteFile (in: hFile=0x2194, lpBuffer=0x2d93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d93f830, lpOverlapped=0x0 | out: lpBuffer=0x2d93fb34*, lpNumberOfBytesWritten=0x2d93f830*=0x428, lpOverlapped=0x0) returned 1 [0194.200] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.200] ReadFile (in: hFile=0x2194, lpBuffer=0x3250000, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d93f61c*=0x608, lpOverlapped=0x0) returned 1 [0194.200] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffff9f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.200] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x608, pPaddingInfo=0x0, pbIV=0x2d93f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d93f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d93f848, pbOutput=0x3250000, pcbResult=0x2d93f618) returned 0x0 [0194.200] WriteFile (in: hFile=0x2194, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d93f61c*=0x610, lpOverlapped=0x0) returned 1 [0194.200] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d93f60c | out: lpNewFilePointer=0x0) returned 1 [0194.200] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.200] WriteFile (in: hFile=0x2194, lpBuffer=0x2d93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d93f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d93f83c*, lpNumberOfBytesWritten=0x2d93f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.200] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.200] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.200] CloseHandle (hObject=0x2194) returned 1 [0194.200] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.play")) returned 1 [0194.206] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3279 os_tid = 0x316c [0194.210] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.210] ReadFile (in: hFile=0x1900, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.211] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.212] ReadFile (in: hFile=0x1900, lpBuffer=0x2ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesRead=0x2ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.212] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.214] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.214] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0194.214] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2ddbf828, pbKeyObject=0x0) returned 0x0 [0194.214] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2ddbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2ddbf500) returned 0x0 [0194.215] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.215] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2ddbf500) returned 0x0 [0194.218] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.221] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.221] WriteFile (in: hFile=0x1900, lpBuffer=0x2ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfb34*, lpNumberOfBytesWritten=0x2ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0194.221] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.221] ReadFile (in: hFile=0x1900, lpBuffer=0x3350000, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2ddbf61c*=0xd58, lpOverlapped=0x0) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xfffff2a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.222] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0xd58, pPaddingInfo=0x0, pbIV=0x2ddbf848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2ddbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2ddbf848, pbOutput=0x3350000, pcbResult=0x2ddbf618) returned 0x0 [0194.222] WriteFile (in: hFile=0x1900, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2ddbf61c*=0xd60, lpOverlapped=0x0) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.222] WriteFile (in: hFile=0x1900, lpBuffer=0x2ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbf83c*, lpNumberOfBytesWritten=0x2ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x1900, liDistanceToMove=0xd60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.222] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.222] CloseHandle (hObject=0x1900) returned 1 [0194.222] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.play")) returned 1 [0194.226] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3280 os_tid = 0x3170 [0194.231] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.231] ReadFile (in: hFile=0x18f0, lpBuffer=0x3c73fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c73f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c73fb34*, lpNumberOfBytesRead=0x3c73f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.232] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.232] ReadFile (in: hFile=0x18f0, lpBuffer=0x3c73fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c73f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c73fb34*, lpNumberOfBytesRead=0x3c73f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.232] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.237] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x3c73f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0194.237] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x3c73f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x3c73f828, pbKeyObject=0x0) returned 0x0 [0194.237] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c73f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c73f500) returned 0x0 [0194.237] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.237] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c73f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c73f500) returned 0x0 [0194.243] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.249] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.249] WriteFile (in: hFile=0x18f0, lpBuffer=0x3c73fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c73f830, lpOverlapped=0x0 | out: lpBuffer=0x3c73fb34*, lpNumberOfBytesWritten=0x3c73f830*=0x428, lpOverlapped=0x0) returned 1 [0194.250] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.250] ReadFile (in: hFile=0x18f0, lpBuffer=0x3450000, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x3c73f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x3c73f61c*=0x3210, lpOverlapped=0x0) returned 1 [0194.251] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xffffcdf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.251] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0x3210, pPaddingInfo=0x0, pbIV=0x3c73f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x3c73f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c73f848, pbOutput=0x3450000, pcbResult=0x3c73f618) returned 0x0 [0194.251] WriteFile (in: hFile=0x18f0, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x3c73f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x3c73f61c*=0x3220, lpOverlapped=0x0) returned 1 [0194.252] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c73f60c | out: lpNewFilePointer=0x0) returned 1 [0194.252] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.252] WriteFile (in: hFile=0x18f0, lpBuffer=0x3c73f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c73f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c73f83c*, lpNumberOfBytesWritten=0x3c73f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.252] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x3220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.252] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.252] CloseHandle (hObject=0x18f0) returned 1 [0194.253] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.play")) returned 1 [0194.260] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3281 os_tid = 0x3174 [0194.267] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.267] ReadFile (in: hFile=0x18e8, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.270] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.271] ReadFile (in: hFile=0x18e8, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.271] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.275] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x3c87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0194.275] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x3c87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x3c87f828, pbKeyObject=0x0) returned 0x0 [0194.275] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c87f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0194.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.275] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0194.283] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.288] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.288] WriteFile (in: hFile=0x18e8, lpBuffer=0x3c87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c87f830, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesWritten=0x3c87f830*=0x428, lpOverlapped=0x0) returned 1 [0194.289] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.290] ReadFile (in: hFile=0x18e8, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x3c87f61c*=0x7c46, lpOverlapped=0x0) returned 1 [0194.291] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xffff83ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.291] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4a50000, cbInput=0x7c46, pPaddingInfo=0x0, pbIV=0x3c87f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x3c87f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c87f848, pbOutput=0x4a50000, pcbResult=0x3c87f618) returned 0x0 [0194.291] WriteFile (in: hFile=0x18e8, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x3c87f61c*=0x7c50, lpOverlapped=0x0) returned 1 [0194.291] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c87f60c | out: lpNewFilePointer=0x0) returned 1 [0194.291] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.291] WriteFile (in: hFile=0x18e8, lpBuffer=0x3c87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c87f83c*, lpNumberOfBytesWritten=0x3c87f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.292] SetFilePointerEx (in: hFile=0x18e8, liDistanceToMove=0x7c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.292] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.292] CloseHandle (hObject=0x18e8) returned 1 [0194.292] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.play")) returned 1 [0194.298] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3282 os_tid = 0x3178 [0194.302] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.304] ReadFile (in: hFile=0x18d8, lpBuffer=0x3c9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c9bfb34*, lpNumberOfBytesRead=0x3c9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.306] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.306] ReadFile (in: hFile=0x18d8, lpBuffer=0x3c9bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3c9bfb34*, lpNumberOfBytesRead=0x3c9bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.306] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.311] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.311] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x3c9bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0194.311] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x3c9bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x3c9bf828, pbKeyObject=0x0) returned 0x0 [0194.311] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c9bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c9bf500) returned 0x0 [0194.311] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.311] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c9bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c9bf500) returned 0x0 [0194.317] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.322] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.322] WriteFile (in: hFile=0x18d8, lpBuffer=0x3c9bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c9bf830, lpOverlapped=0x0 | out: lpBuffer=0x3c9bfb34*, lpNumberOfBytesWritten=0x3c9bf830*=0x428, lpOverlapped=0x0) returned 1 [0194.322] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.322] ReadFile (in: hFile=0x18d8, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x3c9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x3c9bf61c*=0x54a8, lpOverlapped=0x0) returned 1 [0194.323] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xffffab58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.323] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4b50000, cbInput=0x54a8, pPaddingInfo=0x0, pbIV=0x3c9bf848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x3c9bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c9bf848, pbOutput=0x4b50000, pcbResult=0x3c9bf618) returned 0x0 [0194.323] WriteFile (in: hFile=0x18d8, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x3c9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x3c9bf61c*=0x54b0, lpOverlapped=0x0) returned 1 [0194.324] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c9bf60c | out: lpNewFilePointer=0x0) returned 1 [0194.324] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.324] WriteFile (in: hFile=0x18d8, lpBuffer=0x3c9bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c9bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c9bf83c*, lpNumberOfBytesWritten=0x3c9bf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.324] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x54b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.324] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.324] CloseHandle (hObject=0x18d8) returned 1 [0194.324] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.play")) returned 1 [0194.330] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3283 os_tid = 0x317c [0194.335] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.335] ReadFile (in: hFile=0x18c8, lpBuffer=0x3caffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3caff85c, lpOverlapped=0x0 | out: lpBuffer=0x3caffb34*, lpNumberOfBytesRead=0x3caff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.337] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.337] ReadFile (in: hFile=0x18c8, lpBuffer=0x3caffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3caff85c, lpOverlapped=0x0 | out: lpBuffer=0x3caffb34*, lpNumberOfBytesRead=0x3caff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.337] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.341] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.341] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x3caff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0194.341] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x3caff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x3caff828, pbKeyObject=0x0) returned 0x0 [0194.341] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3caff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3caff500) returned 0x0 [0194.341] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.342] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3caff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3caff500) returned 0x0 [0194.348] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.352] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.352] WriteFile (in: hFile=0x18c8, lpBuffer=0x3caffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3caff830, lpOverlapped=0x0 | out: lpBuffer=0x3caffb34*, lpNumberOfBytesWritten=0x3caff830*=0x428, lpOverlapped=0x0) returned 1 [0194.353] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.353] ReadFile (in: hFile=0x18c8, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x3caff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x3caff61c*=0x1a7e, lpOverlapped=0x0) returned 1 [0194.354] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xffffe582, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.354] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4c50000, cbInput=0x1a7e, pPaddingInfo=0x0, pbIV=0x3caff848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x3caff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3caff848, pbOutput=0x4c50000, pcbResult=0x3caff618) returned 0x0 [0194.354] WriteFile (in: hFile=0x18c8, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x3caff61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x3caff61c*=0x1a80, lpOverlapped=0x0) returned 1 [0194.354] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3caff60c | out: lpNewFilePointer=0x0) returned 1 [0194.354] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.354] WriteFile (in: hFile=0x18c8, lpBuffer=0x3caff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3caff61c, lpOverlapped=0x0 | out: lpBuffer=0x3caff83c*, lpNumberOfBytesWritten=0x3caff61c*=0x8, lpOverlapped=0x0) returned 1 [0194.354] SetFilePointerEx (in: hFile=0x18c8, liDistanceToMove=0x1a80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.354] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.354] CloseHandle (hObject=0x18c8) returned 1 [0194.354] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.play")) returned 1 [0194.359] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3284 os_tid = 0x3180 [0194.363] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.363] ReadFile (in: hFile=0x18b0, lpBuffer=0x3cc3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cc3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cc3fb34*, lpNumberOfBytesRead=0x3cc3f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.364] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.364] ReadFile (in: hFile=0x18b0, lpBuffer=0x3cc3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cc3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cc3fb34*, lpNumberOfBytesRead=0x3cc3f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.364] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.367] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.367] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x3cc3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0194.367] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x3cc3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x3cc3f828, pbKeyObject=0x0) returned 0x0 [0194.367] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cc3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cc3f500) returned 0x0 [0194.367] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.368] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cc3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cc3f500) returned 0x0 [0194.371] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.374] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] WriteFile (in: hFile=0x18b0, lpBuffer=0x3cc3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cc3f830, lpOverlapped=0x0 | out: lpBuffer=0x3cc3fb34*, lpNumberOfBytesWritten=0x3cc3f830*=0x428, lpOverlapped=0x0) returned 1 [0194.374] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] ReadFile (in: hFile=0x18b0, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x3cc3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x3cc3f61c*=0x1e00, lpOverlapped=0x0) returned 1 [0194.375] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xffffe200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.375] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4d50000, cbInput=0x1e00, pPaddingInfo=0x0, pbIV=0x3cc3f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x3cc3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3cc3f848, pbOutput=0x4d50000, pcbResult=0x3cc3f618) returned 0x0 [0194.375] WriteFile (in: hFile=0x18b0, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x3cc3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x3cc3f61c*=0x1e10, lpOverlapped=0x0) returned 1 [0194.375] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cc3f60c | out: lpNewFilePointer=0x0) returned 1 [0194.375] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.375] WriteFile (in: hFile=0x18b0, lpBuffer=0x3cc3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cc3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3cc3f83c*, lpNumberOfBytesWritten=0x3cc3f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.375] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x1e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.375] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.376] CloseHandle (hObject=0x18b0) returned 1 [0194.376] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.play")) returned 1 [0194.380] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3285 os_tid = 0x3184 [0194.383] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.383] ReadFile (in: hFile=0x18a8, lpBuffer=0x3cd7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cd7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cd7fb34*, lpNumberOfBytesRead=0x3cd7f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.385] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.385] ReadFile (in: hFile=0x18a8, lpBuffer=0x3cd7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cd7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3cd7fb34*, lpNumberOfBytesRead=0x3cd7f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.385] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.387] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x3cd7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0194.387] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x3cd7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x3cd7f828, pbKeyObject=0x0) returned 0x0 [0194.387] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cd7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cd7f500) returned 0x0 [0194.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.387] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cd7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cd7f500) returned 0x0 [0194.391] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.393] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x18a8, lpBuffer=0x3cd7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cd7f830, lpOverlapped=0x0 | out: lpBuffer=0x3cd7fb34*, lpNumberOfBytesWritten=0x3cd7f830*=0x428, lpOverlapped=0x0) returned 1 [0194.394] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.394] ReadFile (in: hFile=0x18a8, lpBuffer=0x4e50000, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x3cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x3cd7f61c*=0xb70, lpOverlapped=0x0) returned 1 [0194.394] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffff490, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.394] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4e50000, cbInput=0xb70, pPaddingInfo=0x0, pbIV=0x3cd7f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x3cd7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3cd7f848, pbOutput=0x4e50000, pcbResult=0x3cd7f618) returned 0x0 [0194.394] WriteFile (in: hFile=0x18a8, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x3cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x3cd7f61c*=0xb80, lpOverlapped=0x0) returned 1 [0194.394] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cd7f60c | out: lpNewFilePointer=0x0) returned 1 [0194.394] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.394] WriteFile (in: hFile=0x18a8, lpBuffer=0x3cd7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cd7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3cd7f83c*, lpNumberOfBytesWritten=0x3cd7f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.394] SetFilePointerEx (in: hFile=0x18a8, liDistanceToMove=0xb80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.394] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.394] CloseHandle (hObject=0x18a8) returned 1 [0194.394] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.play")) returned 1 [0194.398] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3286 os_tid = 0x3188 [0194.402] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.402] ReadFile (in: hFile=0x1898, lpBuffer=0x3cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x3cebfb34*, lpNumberOfBytesRead=0x3cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.404] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.404] ReadFile (in: hFile=0x1898, lpBuffer=0x3cebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cebf85c, lpOverlapped=0x0 | out: lpBuffer=0x3cebfb34*, lpNumberOfBytesRead=0x3cebf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.405] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.407] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.407] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x3cebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0194.407] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x3cebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x3cebf828, pbKeyObject=0x0) returned 0x0 [0194.407] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cebf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cebf500) returned 0x0 [0194.408] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.408] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cebf500) returned 0x0 [0194.411] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.414] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.414] WriteFile (in: hFile=0x1898, lpBuffer=0x3cebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cebf830, lpOverlapped=0x0 | out: lpBuffer=0x3cebfb34*, lpNumberOfBytesWritten=0x3cebf830*=0x428, lpOverlapped=0x0) returned 1 [0194.414] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.414] ReadFile (in: hFile=0x1898, lpBuffer=0x4f50000, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x3cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x3cebf61c*=0x16a0, lpOverlapped=0x0) returned 1 [0194.414] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xffffe960, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.414] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4f50000, cbInput=0x16a0, pPaddingInfo=0x0, pbIV=0x3cebf848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x3cebf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3cebf848, pbOutput=0x4f50000, pcbResult=0x3cebf618) returned 0x0 [0194.414] WriteFile (in: hFile=0x1898, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x3cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x3cebf61c*=0x16b0, lpOverlapped=0x0) returned 1 [0194.415] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cebf60c | out: lpNewFilePointer=0x0) returned 1 [0194.415] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.415] WriteFile (in: hFile=0x1898, lpBuffer=0x3cebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cebf61c, lpOverlapped=0x0 | out: lpBuffer=0x3cebf83c*, lpNumberOfBytesWritten=0x3cebf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.415] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x16b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.415] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.415] CloseHandle (hObject=0x1898) returned 1 [0194.415] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.play")) returned 1 [0194.419] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3287 os_tid = 0x318c [0194.425] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.425] ReadFile (in: hFile=0x6bc, lpBuffer=0x3cfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cfff85c, lpOverlapped=0x0 | out: lpBuffer=0x3cfffb34*, lpNumberOfBytesRead=0x3cfff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.427] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.427] ReadFile (in: hFile=0x6bc, lpBuffer=0x3cfffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3cfff85c, lpOverlapped=0x0 | out: lpBuffer=0x3cfffb34*, lpNumberOfBytesRead=0x3cfff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.428] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.431] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x3cfff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0194.431] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x3cfff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x3cfff828, pbKeyObject=0x0) returned 0x0 [0194.431] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3cfff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3cfff500) returned 0x0 [0194.431] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.431] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3cfff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3cfff500) returned 0x0 [0194.436] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.451] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.451] WriteFile (in: hFile=0x6bc, lpBuffer=0x3cfffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3cfff830, lpOverlapped=0x0 | out: lpBuffer=0x3cfffb34*, lpNumberOfBytesWritten=0x3cfff830*=0x428, lpOverlapped=0x0) returned 1 [0194.452] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.452] ReadFile (in: hFile=0x6bc, lpBuffer=0x5050000, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x3cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x3cfff61c*=0x16d8, lpOverlapped=0x0) returned 1 [0194.452] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0xffffe928, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.452] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5050000, cbInput=0x16d8, pPaddingInfo=0x0, pbIV=0x3cfff848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x3cfff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3cfff848, pbOutput=0x5050000, pcbResult=0x3cfff618) returned 0x0 [0194.452] WriteFile (in: hFile=0x6bc, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x3cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x3cfff61c*=0x16e0, lpOverlapped=0x0) returned 1 [0194.452] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cfff60c | out: lpNewFilePointer=0x0) returned 1 [0194.452] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.452] WriteFile (in: hFile=0x6bc, lpBuffer=0x3cfff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cfff61c, lpOverlapped=0x0 | out: lpBuffer=0x3cfff83c*, lpNumberOfBytesWritten=0x3cfff61c*=0x8, lpOverlapped=0x0) returned 1 [0194.452] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x16e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.452] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.452] CloseHandle (hObject=0x6bc) returned 1 [0194.453] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.play")) returned 1 [0194.457] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3288 os_tid = 0x3190 [0194.461] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.461] ReadFile (in: hFile=0x1ee4, lpBuffer=0x3d13fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d13f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d13fb34*, lpNumberOfBytesRead=0x3d13f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.463] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.463] ReadFile (in: hFile=0x1ee4, lpBuffer=0x3d13fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d13f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d13fb34*, lpNumberOfBytesRead=0x3d13f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.463] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.465] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.465] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x3d13f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0194.465] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x3d13f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x3d13f828, pbKeyObject=0x0) returned 0x0 [0194.465] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d13f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d13f500) returned 0x0 [0194.466] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.466] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d13f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d13f500) returned 0x0 [0194.469] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.472] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.472] WriteFile (in: hFile=0x1ee4, lpBuffer=0x3d13fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d13f830, lpOverlapped=0x0 | out: lpBuffer=0x3d13fb34*, lpNumberOfBytesWritten=0x3d13f830*=0x428, lpOverlapped=0x0) returned 1 [0194.472] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.472] ReadFile (in: hFile=0x1ee4, lpBuffer=0x5150000, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x3d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x3d13f61c*=0x1f38, lpOverlapped=0x0) returned 1 [0194.473] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xffffe0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.473] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5150000, cbInput=0x1f38, pPaddingInfo=0x0, pbIV=0x3d13f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x3d13f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d13f848, pbOutput=0x5150000, pcbResult=0x3d13f618) returned 0x0 [0194.473] WriteFile (in: hFile=0x1ee4, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x3d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x3d13f61c*=0x1f40, lpOverlapped=0x0) returned 1 [0194.473] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d13f60c | out: lpNewFilePointer=0x0) returned 1 [0194.473] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.473] WriteFile (in: hFile=0x1ee4, lpBuffer=0x3d13f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d13f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d13f83c*, lpNumberOfBytesWritten=0x3d13f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.473] SetFilePointerEx (in: hFile=0x1ee4, liDistanceToMove=0x1f40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.474] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.474] CloseHandle (hObject=0x1ee4) returned 1 [0194.474] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.play")) returned 1 [0194.478] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3289 os_tid = 0x3194 [0194.482] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.482] ReadFile (in: hFile=0x1ed4, lpBuffer=0x3d27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d27f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d27fb34*, lpNumberOfBytesRead=0x3d27f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.484] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.484] ReadFile (in: hFile=0x1ed4, lpBuffer=0x3d27fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d27f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d27fb34*, lpNumberOfBytesRead=0x3d27f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.484] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.487] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x3d27f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0194.487] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x3d27f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x3d27f828, pbKeyObject=0x0) returned 0x0 [0194.487] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d27f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d27f500) returned 0x0 [0194.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.487] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d27f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d27f500) returned 0x0 [0194.491] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.494] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.494] WriteFile (in: hFile=0x1ed4, lpBuffer=0x3d27fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d27f830, lpOverlapped=0x0 | out: lpBuffer=0x3d27fb34*, lpNumberOfBytesWritten=0x3d27f830*=0x428, lpOverlapped=0x0) returned 1 [0194.494] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.495] ReadFile (in: hFile=0x1ed4, lpBuffer=0x5250000, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x3d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x3d27f61c*=0x1248, lpOverlapped=0x0) returned 1 [0194.495] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xffffedb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.495] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5250000, cbInput=0x1248, pPaddingInfo=0x0, pbIV=0x3d27f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x3d27f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d27f848, pbOutput=0x5250000, pcbResult=0x3d27f618) returned 0x0 [0194.495] WriteFile (in: hFile=0x1ed4, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x3d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x3d27f61c*=0x1250, lpOverlapped=0x0) returned 1 [0194.495] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d27f60c | out: lpNewFilePointer=0x0) returned 1 [0194.495] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.495] WriteFile (in: hFile=0x1ed4, lpBuffer=0x3d27f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d27f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d27f83c*, lpNumberOfBytesWritten=0x3d27f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.495] SetFilePointerEx (in: hFile=0x1ed4, liDistanceToMove=0x1250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.495] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.495] CloseHandle (hObject=0x1ed4) returned 1 [0194.495] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.play")) returned 1 [0194.499] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3290 os_tid = 0x3198 [0194.504] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.505] ReadFile (in: hFile=0x1ec4, lpBuffer=0x3d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d3bfb34*, lpNumberOfBytesRead=0x3d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.506] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.506] ReadFile (in: hFile=0x1ec4, lpBuffer=0x3d3bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d3bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d3bfb34*, lpNumberOfBytesRead=0x3d3bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.506] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.509] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.509] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x3d3bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0194.509] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x3d3bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x3d3bf828, pbKeyObject=0x0) returned 0x0 [0194.509] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d3bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d3bf500) returned 0x0 [0194.509] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.509] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d3bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d3bf500) returned 0x0 [0194.512] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.515] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.515] WriteFile (in: hFile=0x1ec4, lpBuffer=0x3d3bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d3bf830, lpOverlapped=0x0 | out: lpBuffer=0x3d3bfb34*, lpNumberOfBytesWritten=0x3d3bf830*=0x428, lpOverlapped=0x0) returned 1 [0194.515] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.515] ReadFile (in: hFile=0x1ec4, lpBuffer=0x5350000, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x3d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x3d3bf61c*=0x2230, lpOverlapped=0x0) returned 1 [0194.516] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xffffddd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.516] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5350000, cbInput=0x2230, pPaddingInfo=0x0, pbIV=0x3d3bf848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x3d3bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d3bf848, pbOutput=0x5350000, pcbResult=0x3d3bf618) returned 0x0 [0194.517] WriteFile (in: hFile=0x1ec4, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x3d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x3d3bf61c*=0x2240, lpOverlapped=0x0) returned 1 [0194.517] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3bf60c | out: lpNewFilePointer=0x0) returned 1 [0194.517] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.517] WriteFile (in: hFile=0x1ec4, lpBuffer=0x3d3bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d3bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d3bf83c*, lpNumberOfBytesWritten=0x3d3bf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.517] SetFilePointerEx (in: hFile=0x1ec4, liDistanceToMove=0x2240, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.517] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.517] CloseHandle (hObject=0x1ec4) returned 1 [0194.517] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.play")) returned 1 [0194.521] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3291 os_tid = 0x319c [0194.525] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.525] ReadFile (in: hFile=0x1ecc, lpBuffer=0x3d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d4ffb34*, lpNumberOfBytesRead=0x3d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.527] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.527] ReadFile (in: hFile=0x1ecc, lpBuffer=0x3d4ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d4ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d4ffb34*, lpNumberOfBytesRead=0x3d4ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.527] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.530] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.530] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x3d4ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0194.530] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x3d4ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x3d4ff828, pbKeyObject=0x0) returned 0x0 [0194.530] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d4ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d4ff500) returned 0x0 [0194.530] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.530] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d4ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d4ff500) returned 0x0 [0194.533] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.536] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.536] WriteFile (in: hFile=0x1ecc, lpBuffer=0x3d4ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d4ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d4ffb34*, lpNumberOfBytesWritten=0x3d4ff830*=0x428, lpOverlapped=0x0) returned 1 [0194.536] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.536] ReadFile (in: hFile=0x1ecc, lpBuffer=0x5450000, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x3d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x3d4ff61c*=0x15b0, lpOverlapped=0x0) returned 1 [0194.536] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xffffea50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.536] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5450000, cbInput=0x15b0, pPaddingInfo=0x0, pbIV=0x3d4ff848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x3d4ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d4ff848, pbOutput=0x5450000, pcbResult=0x3d4ff618) returned 0x0 [0194.536] WriteFile (in: hFile=0x1ecc, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x3d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x3d4ff61c*=0x15c0, lpOverlapped=0x0) returned 1 [0194.537] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d4ff60c | out: lpNewFilePointer=0x0) returned 1 [0194.537] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.537] WriteFile (in: hFile=0x1ecc, lpBuffer=0x3d4ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d4ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d4ff83c*, lpNumberOfBytesWritten=0x3d4ff61c*=0x8, lpOverlapped=0x0) returned 1 [0194.537] SetFilePointerEx (in: hFile=0x1ecc, liDistanceToMove=0x15c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.537] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.537] CloseHandle (hObject=0x1ecc) returned 1 [0194.537] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.play")) returned 1 [0194.541] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3292 os_tid = 0x31a0 [0194.545] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.545] ReadFile (in: hFile=0x1eb4, lpBuffer=0x3d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d63fb34*, lpNumberOfBytesRead=0x3d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.546] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.546] ReadFile (in: hFile=0x1eb4, lpBuffer=0x3d63fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d63f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d63fb34*, lpNumberOfBytesRead=0x3d63f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.547] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.549] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.549] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x3d63f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0194.549] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x3d63f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x3d63f828, pbKeyObject=0x0) returned 0x0 [0194.549] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d63f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d63f500) returned 0x0 [0194.549] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.549] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d63f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d63f500) returned 0x0 [0194.552] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.556] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.556] WriteFile (in: hFile=0x1eb4, lpBuffer=0x3d63fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d63f830, lpOverlapped=0x0 | out: lpBuffer=0x3d63fb34*, lpNumberOfBytesWritten=0x3d63f830*=0x428, lpOverlapped=0x0) returned 1 [0194.556] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.556] ReadFile (in: hFile=0x1eb4, lpBuffer=0x5550000, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x3d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x3d63f61c*=0x1858, lpOverlapped=0x0) returned 1 [0194.556] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xffffe7a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.557] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5550000, cbInput=0x1858, pPaddingInfo=0x0, pbIV=0x3d63f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x3d63f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d63f848, pbOutput=0x5550000, pcbResult=0x3d63f618) returned 0x0 [0194.557] WriteFile (in: hFile=0x1eb4, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x3d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x3d63f61c*=0x1860, lpOverlapped=0x0) returned 1 [0194.557] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d63f60c | out: lpNewFilePointer=0x0) returned 1 [0194.557] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.557] WriteFile (in: hFile=0x1eb4, lpBuffer=0x3d63f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d63f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d63f83c*, lpNumberOfBytesWritten=0x3d63f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.557] SetFilePointerEx (in: hFile=0x1eb4, liDistanceToMove=0x1860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.557] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.557] CloseHandle (hObject=0x1eb4) returned 1 [0194.557] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.play")) returned 1 [0194.561] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3293 os_tid = 0x31a4 [0194.565] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.565] ReadFile (in: hFile=0x1e94, lpBuffer=0x3d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d77fb34*, lpNumberOfBytesRead=0x3d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.566] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.566] ReadFile (in: hFile=0x1e94, lpBuffer=0x3d77fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d77f85c, lpOverlapped=0x0 | out: lpBuffer=0x3d77fb34*, lpNumberOfBytesRead=0x3d77f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.566] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.568] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.568] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x3d77f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0194.569] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x3d77f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x3d77f828, pbKeyObject=0x0) returned 0x0 [0194.569] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d77f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d77f500) returned 0x0 [0194.569] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.569] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d77f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d77f500) returned 0x0 [0194.572] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.575] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.575] WriteFile (in: hFile=0x1e94, lpBuffer=0x3d77fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d77f830, lpOverlapped=0x0 | out: lpBuffer=0x3d77fb34*, lpNumberOfBytesWritten=0x3d77f830*=0x428, lpOverlapped=0x0) returned 1 [0194.575] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.575] ReadFile (in: hFile=0x1e94, lpBuffer=0x5650000, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x3d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x3d77f61c*=0x1c74, lpOverlapped=0x0) returned 1 [0194.576] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xffffe38c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.576] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5650000, cbInput=0x1c74, pPaddingInfo=0x0, pbIV=0x3d77f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x3d77f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d77f848, pbOutput=0x5650000, pcbResult=0x3d77f618) returned 0x0 [0194.576] WriteFile (in: hFile=0x1e94, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x3d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x3d77f61c*=0x1c80, lpOverlapped=0x0) returned 1 [0194.576] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d77f60c | out: lpNewFilePointer=0x0) returned 1 [0194.576] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.576] WriteFile (in: hFile=0x1e94, lpBuffer=0x3d77f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d77f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d77f83c*, lpNumberOfBytesWritten=0x3d77f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.576] SetFilePointerEx (in: hFile=0x1e94, liDistanceToMove=0x1c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.576] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.576] CloseHandle (hObject=0x1e94) returned 1 [0194.576] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.play")) returned 1 [0194.580] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3294 os_tid = 0x31a8 [0194.584] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.584] ReadFile (in: hFile=0x76c, lpBuffer=0x3d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d8bfb34*, lpNumberOfBytesRead=0x3d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.585] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.585] ReadFile (in: hFile=0x76c, lpBuffer=0x3d8bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d8bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3d8bfb34*, lpNumberOfBytesRead=0x3d8bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.586] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.588] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.588] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x3d8bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0194.588] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x3d8bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x3d8bf828, pbKeyObject=0x0) returned 0x0 [0194.588] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d8bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d8bf500) returned 0x0 [0194.588] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.588] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d8bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d8bf500) returned 0x0 [0194.591] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.594] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.594] WriteFile (in: hFile=0x76c, lpBuffer=0x3d8bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d8bf830, lpOverlapped=0x0 | out: lpBuffer=0x3d8bfb34*, lpNumberOfBytesWritten=0x3d8bf830*=0x428, lpOverlapped=0x0) returned 1 [0194.594] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.594] ReadFile (in: hFile=0x76c, lpBuffer=0x5750000, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x3d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x3d8bf61c*=0x1694, lpOverlapped=0x0) returned 1 [0194.594] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xffffe96c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.595] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5750000, cbInput=0x1694, pPaddingInfo=0x0, pbIV=0x3d8bf848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x3d8bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d8bf848, pbOutput=0x5750000, pcbResult=0x3d8bf618) returned 0x0 [0194.595] WriteFile (in: hFile=0x76c, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x3d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x3d8bf61c*=0x16a0, lpOverlapped=0x0) returned 1 [0194.595] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d8bf60c | out: lpNewFilePointer=0x0) returned 1 [0194.595] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.595] WriteFile (in: hFile=0x76c, lpBuffer=0x3d8bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d8bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3d8bf83c*, lpNumberOfBytesWritten=0x3d8bf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.595] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x16a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.595] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.595] CloseHandle (hObject=0x76c) returned 1 [0194.595] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.play")) returned 1 [0194.599] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3295 os_tid = 0x31ac [0194.603] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.604] ReadFile (in: hFile=0x2590, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.605] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.605] ReadFile (in: hFile=0x2590, lpBuffer=0x1554fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1554f85c, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesRead=0x1554f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.605] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.607] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.607] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x1554f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0194.607] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x1554f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x1554f828, pbKeyObject=0x0) returned 0x0 [0194.607] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1554f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1554f500) returned 0x0 [0194.608] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.608] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1554f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1554f500) returned 0x0 [0194.611] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.614] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.614] WriteFile (in: hFile=0x2590, lpBuffer=0x1554fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1554f830, lpOverlapped=0x0 | out: lpBuffer=0x1554fb34*, lpNumberOfBytesWritten=0x1554f830*=0x428, lpOverlapped=0x0) returned 1 [0194.614] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.614] ReadFile (in: hFile=0x2590, lpBuffer=0x5850000, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x1554f61c*=0xa04, lpOverlapped=0x0) returned 1 [0194.614] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffff5fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.614] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5850000, cbInput=0xa04, pPaddingInfo=0x0, pbIV=0x1554f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x1554f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1554f848, pbOutput=0x5850000, pcbResult=0x1554f618) returned 0x0 [0194.614] WriteFile (in: hFile=0x2590, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x1554f61c*=0xa10, lpOverlapped=0x0) returned 1 [0194.614] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1554f60c | out: lpNewFilePointer=0x0) returned 1 [0194.615] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.615] WriteFile (in: hFile=0x2590, lpBuffer=0x1554f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1554f61c, lpOverlapped=0x0 | out: lpBuffer=0x1554f83c*, lpNumberOfBytesWritten=0x1554f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.615] SetFilePointerEx (in: hFile=0x2590, liDistanceToMove=0xa10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.615] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.615] CloseHandle (hObject=0x2590) returned 1 [0194.615] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.play")) returned 1 [0194.619] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3296 os_tid = 0x31b0 [0194.623] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.623] ReadFile (in: hFile=0x25f4, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.624] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.624] ReadFile (in: hFile=0x25f4, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.624] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.627] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1580f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0194.627] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1580f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1580f828, pbKeyObject=0x0) returned 0x0 [0194.627] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1580f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1580f500) returned 0x0 [0194.627] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.627] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1580f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1580f500) returned 0x0 [0194.630] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.633] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.633] WriteFile (in: hFile=0x25f4, lpBuffer=0x1580fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1580f830, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesWritten=0x1580f830*=0x428, lpOverlapped=0x0) returned 1 [0194.633] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.633] ReadFile (in: hFile=0x25f4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1580f61c*=0x70f0, lpOverlapped=0x0) returned 1 [0194.634] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xffff8f10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.634] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x70f0, pPaddingInfo=0x0, pbIV=0x1580f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1580f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1580f848, pbOutput=0x2750000, pcbResult=0x1580f618) returned 0x0 [0194.634] WriteFile (in: hFile=0x25f4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x7100, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1580f61c*=0x7100, lpOverlapped=0x0) returned 1 [0194.634] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1580f60c | out: lpNewFilePointer=0x0) returned 1 [0194.634] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.634] WriteFile (in: hFile=0x25f4, lpBuffer=0x1580f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x1580f83c*, lpNumberOfBytesWritten=0x1580f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.635] SetFilePointerEx (in: hFile=0x25f4, liDistanceToMove=0x7100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.635] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.635] CloseHandle (hObject=0x25f4) returned 1 [0194.635] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.play")) returned 1 [0194.638] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3297 os_tid = 0x31b4 [0194.642] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.642] ReadFile (in: hFile=0x25d0, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.643] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.643] ReadFile (in: hFile=0x25d0, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.644] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.646] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.646] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0194.646] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0194.646] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1590f500) returned 0x0 [0194.646] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.646] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1590f500) returned 0x0 [0194.650] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.655] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.655] WriteFile (in: hFile=0x25d0, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0194.655] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.656] ReadFile (in: hFile=0x25d0, lpBuffer=0x2850000, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1590f61c*=0x16ae, lpOverlapped=0x0) returned 1 [0194.656] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xffffe952, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.656] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x16ae, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2850000, pcbResult=0x1590f618) returned 0x0 [0194.656] WriteFile (in: hFile=0x25d0, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1590f61c*=0x16b0, lpOverlapped=0x0) returned 1 [0194.656] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0194.656] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.656] WriteFile (in: hFile=0x25d0, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.656] SetFilePointerEx (in: hFile=0x25d0, liDistanceToMove=0x16b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.656] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.656] CloseHandle (hObject=0x25d0) returned 1 [0194.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.play")) returned 1 [0194.661] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3298 os_tid = 0x31b8 [0194.666] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.666] ReadFile (in: hFile=0x26cc, lpBuffer=0x15e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15e0fb34*, lpNumberOfBytesRead=0x15e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.668] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.668] ReadFile (in: hFile=0x26cc, lpBuffer=0x15e0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15e0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15e0fb34*, lpNumberOfBytesRead=0x15e0f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.669] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.671] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.671] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x15e0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0194.671] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x15e0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x15e0f828, pbKeyObject=0x0) returned 0x0 [0194.671] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15e0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15e0f500) returned 0x0 [0194.671] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.672] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15e0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15e0f500) returned 0x0 [0194.675] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.678] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.678] WriteFile (in: hFile=0x26cc, lpBuffer=0x15e0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15e0f830, lpOverlapped=0x0 | out: lpBuffer=0x15e0fb34*, lpNumberOfBytesWritten=0x15e0f830*=0x428, lpOverlapped=0x0) returned 1 [0194.678] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.678] ReadFile (in: hFile=0x26cc, lpBuffer=0x2950000, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x15e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x15e0f61c*=0x4732, lpOverlapped=0x0) returned 1 [0194.679] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0xffffb8ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.679] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x4732, pPaddingInfo=0x0, pbIV=0x15e0f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x15e0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15e0f848, pbOutput=0x2950000, pcbResult=0x15e0f618) returned 0x0 [0194.679] WriteFile (in: hFile=0x26cc, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x15e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x15e0f61c*=0x4740, lpOverlapped=0x0) returned 1 [0194.679] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15e0f60c | out: lpNewFilePointer=0x0) returned 1 [0194.679] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.679] WriteFile (in: hFile=0x26cc, lpBuffer=0x15e0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15e0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15e0f83c*, lpNumberOfBytesWritten=0x15e0f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.679] SetFilePointerEx (in: hFile=0x26cc, liDistanceToMove=0x4740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.679] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.679] CloseHandle (hObject=0x26cc) returned 1 [0194.679] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.play")) returned 1 [0194.683] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3299 os_tid = 0x31bc [0194.687] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.687] ReadFile (in: hFile=0x26d0, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.689] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.689] ReadFile (in: hFile=0x26d0, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.689] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.691] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.691] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0194.691] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0194.691] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0194.692] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.692] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0194.695] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.698] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.698] WriteFile (in: hFile=0x26d0, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0194.698] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.699] ReadFile (in: hFile=0x26d0, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x219ff61c*=0x6bf6, lpOverlapped=0x0) returned 1 [0194.699] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0xffff940a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.699] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x6bf6, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x219ff848, pbOutput=0x2d50000, pcbResult=0x219ff618) returned 0x0 [0194.699] WriteFile (in: hFile=0x26d0, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x219ff61c*=0x6c00, lpOverlapped=0x0) returned 1 [0194.700] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0194.700] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.700] WriteFile (in: hFile=0x26d0, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0194.700] SetFilePointerEx (in: hFile=0x26d0, liDistanceToMove=0x6c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.700] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.700] CloseHandle (hObject=0x26d0) returned 1 [0194.700] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.play")) returned 1 [0194.707] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3300 os_tid = 0x31c0 [0194.712] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.712] ReadFile (in: hFile=0x26bc, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.713] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.713] ReadFile (in: hFile=0x26bc, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.714] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.716] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.716] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0194.716] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0194.716] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0194.716] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.716] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0194.719] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.723] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.723] WriteFile (in: hFile=0x26bc, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0194.723] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.723] ReadFile (in: hFile=0x26bc, lpBuffer=0x2e50000, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x2d37f61c*=0xd6e, lpOverlapped=0x0) returned 1 [0194.723] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xfffff292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.723] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0xd6e, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x2e50000, pcbResult=0x2d37f618) returned 0x0 [0194.723] WriteFile (in: hFile=0x26bc, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x2d37f61c*=0xd70, lpOverlapped=0x0) returned 1 [0194.724] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0194.724] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.724] WriteFile (in: hFile=0x26bc, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.724] SetFilePointerEx (in: hFile=0x26bc, liDistanceToMove=0xd70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.724] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.724] CloseHandle (hObject=0x26bc) returned 1 [0194.724] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.728] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.play")) returned 1 [0194.730] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3301 os_tid = 0x31c4 [0194.734] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.734] ReadFile (in: hFile=0x26d8, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.736] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.736] ReadFile (in: hFile=0x26d8, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.736] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.740] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.740] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0194.740] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0194.740] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0194.741] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.741] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0194.747] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.751] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.751] WriteFile (in: hFile=0x26d8, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0194.751] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.751] ReadFile (in: hFile=0x26d8, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d47f61c*=0x1b74, lpOverlapped=0x0) returned 1 [0194.752] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0xffffe48c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.752] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2f50000, cbInput=0x1b74, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d47f848, pbOutput=0x2f50000, pcbResult=0x2d47f618) returned 0x0 [0194.752] WriteFile (in: hFile=0x26d8, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d47f61c*=0x1b80, lpOverlapped=0x0) returned 1 [0194.752] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0194.753] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.753] WriteFile (in: hFile=0x26d8, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.753] SetFilePointerEx (in: hFile=0x26d8, liDistanceToMove=0x1b80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.753] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.753] CloseHandle (hObject=0x26d8) returned 1 [0194.753] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.play")) returned 1 [0194.759] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3302 os_tid = 0x31c8 [0194.763] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.764] ReadFile (in: hFile=0x26e0, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.766] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.766] ReadFile (in: hFile=0x26e0, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.767] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.770] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.770] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0194.770] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0194.770] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0194.770] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.771] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0194.776] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.780] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.780] WriteFile (in: hFile=0x26e0, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0194.781] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.781] ReadFile (in: hFile=0x26e0, lpBuffer=0x3050000, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d57f61c*=0x40412, lpOverlapped=0x0) returned 1 [0194.785] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0xfffbfbee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.785] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x40412, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x3050000, pcbResult=0x2d57f618) returned 0x0 [0194.785] WriteFile (in: hFile=0x26e0, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x40420, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d57f61c*=0x40420, lpOverlapped=0x0) returned 1 [0194.786] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0194.786] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.786] WriteFile (in: hFile=0x26e0, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.787] SetFilePointerEx (in: hFile=0x26e0, liDistanceToMove=0x40420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.787] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.787] CloseHandle (hObject=0x26e0) returned 1 [0194.787] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.791] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.play")) returned 1 [0194.793] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3303 os_tid = 0x31cc [0194.797] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.798] ReadFile (in: hFile=0x26e8, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.800] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.800] ReadFile (in: hFile=0x26e8, lpBuffer=0x2debfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2debf85c, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesRead=0x2debf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.800] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.804] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2debf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0194.804] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2debf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2debf828, pbKeyObject=0x0) returned 0x0 [0194.804] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2debf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2debf500) returned 0x0 [0194.804] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.804] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2debf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2debf500) returned 0x0 [0194.810] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.814] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.814] WriteFile (in: hFile=0x26e8, lpBuffer=0x2debfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2debf830, lpOverlapped=0x0 | out: lpBuffer=0x2debfb34*, lpNumberOfBytesWritten=0x2debf830*=0x428, lpOverlapped=0x0) returned 1 [0194.814] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.814] ReadFile (in: hFile=0x26e8, lpBuffer=0x3150000, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2debf61c*=0x2b16e, lpOverlapped=0x0) returned 1 [0194.818] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0xfffd4e92, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.818] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x2b16e, pPaddingInfo=0x0, pbIV=0x2debf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2debf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2debf848, pbOutput=0x3150000, pcbResult=0x2debf618) returned 0x0 [0194.818] WriteFile (in: hFile=0x26e8, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2debf61c*=0x2b170, lpOverlapped=0x0) returned 1 [0194.819] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2debf60c | out: lpNewFilePointer=0x0) returned 1 [0194.819] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.819] WriteFile (in: hFile=0x26e8, lpBuffer=0x2debf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2debf61c, lpOverlapped=0x0 | out: lpBuffer=0x2debf83c*, lpNumberOfBytesWritten=0x2debf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.819] SetFilePointerEx (in: hFile=0x26e8, liDistanceToMove=0x2b170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.819] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.819] CloseHandle (hObject=0x26e8) returned 1 [0194.820] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.823] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.play")) returned 1 [0194.825] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3304 os_tid = 0x31d0 [0194.799] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.829] ReadFile (in: hFile=0x26f0, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.831] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.831] ReadFile (in: hFile=0x26f0, lpBuffer=0x2dfbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2dfbf85c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesRead=0x2dfbf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.831] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.835] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.835] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x2dfbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0194.835] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x2dfbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x2dfbf828, pbKeyObject=0x0) returned 0x0 [0194.835] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2dfbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2dfbf500) returned 0x0 [0194.835] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.835] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2dfbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2dfbf500) returned 0x0 [0194.841] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.845] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.845] WriteFile (in: hFile=0x26f0, lpBuffer=0x2dfbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2dfbf830, lpOverlapped=0x0 | out: lpBuffer=0x2dfbfb34*, lpNumberOfBytesWritten=0x2dfbf830*=0x428, lpOverlapped=0x0) returned 1 [0194.846] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.846] ReadFile (in: hFile=0x26f0, lpBuffer=0x3650000, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x2dfbf61c*=0x4e82, lpOverlapped=0x0) returned 1 [0194.847] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0xffffb17e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.847] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3650000, cbInput=0x4e82, pPaddingInfo=0x0, pbIV=0x2dfbf848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x2dfbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2dfbf848, pbOutput=0x3650000, pcbResult=0x2dfbf618) returned 0x0 [0194.847] WriteFile (in: hFile=0x26f0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x2dfbf61c*=0x4e90, lpOverlapped=0x0) returned 1 [0194.847] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dfbf60c | out: lpNewFilePointer=0x0) returned 1 [0194.847] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.847] WriteFile (in: hFile=0x26f0, lpBuffer=0x2dfbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dfbf61c, lpOverlapped=0x0 | out: lpBuffer=0x2dfbf83c*, lpNumberOfBytesWritten=0x2dfbf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.847] SetFilePointerEx (in: hFile=0x26f0, liDistanceToMove=0x4e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.847] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.847] CloseHandle (hObject=0x26f0) returned 1 [0194.848] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.851] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.play")) returned 1 [0194.853] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3305 os_tid = 0x31d4 [0194.858] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.858] ReadFile (in: hFile=0x26f8, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.860] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.860] ReadFile (in: hFile=0x26f8, lpBuffer=0x2e0bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e0bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesRead=0x2e0bf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.860] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.864] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.864] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x2e0bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0194.864] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x2e0bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x2e0bf828, pbKeyObject=0x0) returned 0x0 [0194.864] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e0bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e0bf500) returned 0x0 [0194.864] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.864] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e0bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e0bf500) returned 0x0 [0194.871] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.874] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.875] WriteFile (in: hFile=0x26f8, lpBuffer=0x2e0bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e0bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfb34*, lpNumberOfBytesWritten=0x2e0bf830*=0x428, lpOverlapped=0x0) returned 1 [0194.875] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.875] ReadFile (in: hFile=0x26f8, lpBuffer=0x3750000, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x2e0bf61c*=0x4ada, lpOverlapped=0x0) returned 1 [0194.876] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0xffffb526, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.876] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3750000, cbInput=0x4ada, pPaddingInfo=0x0, pbIV=0x2e0bf848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x2e0bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e0bf848, pbOutput=0x3750000, pcbResult=0x2e0bf618) returned 0x0 [0194.876] WriteFile (in: hFile=0x26f8, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x2e0bf61c*=0x4ae0, lpOverlapped=0x0) returned 1 [0194.876] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0bf60c | out: lpNewFilePointer=0x0) returned 1 [0194.876] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.876] WriteFile (in: hFile=0x26f8, lpBuffer=0x2e0bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e0bf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e0bf83c*, lpNumberOfBytesWritten=0x2e0bf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.876] SetFilePointerEx (in: hFile=0x26f8, liDistanceToMove=0x4ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.876] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.876] CloseHandle (hObject=0x26f8) returned 1 [0194.877] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.play")) returned 1 [0194.882] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3306 os_tid = 0x31d8 [0194.888] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.888] ReadFile (in: hFile=0x2700, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.890] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.890] ReadFile (in: hFile=0x2700, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.890] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.894] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.894] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x3d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0194.894] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x3d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x3d9ff828, pbKeyObject=0x0) returned 0x0 [0194.894] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d9ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0194.894] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.894] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0194.900] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.903] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.903] WriteFile (in: hFile=0x2700, lpBuffer=0x3d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesWritten=0x3d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0194.903] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.903] ReadFile (in: hFile=0x2700, lpBuffer=0x3850000, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x3d9ff61c*=0x2028, lpOverlapped=0x0) returned 1 [0194.911] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0xffffdfd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.911] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3850000, cbInput=0x2028, pPaddingInfo=0x0, pbIV=0x3d9ff848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x3d9ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d9ff848, pbOutput=0x3850000, pcbResult=0x3d9ff618) returned 0x0 [0194.911] WriteFile (in: hFile=0x2700, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x3d9ff61c*=0x2030, lpOverlapped=0x0) returned 1 [0194.912] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0194.912] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.912] WriteFile (in: hFile=0x2700, lpBuffer=0x3d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ff83c*, lpNumberOfBytesWritten=0x3d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0194.912] SetFilePointerEx (in: hFile=0x2700, liDistanceToMove=0x2030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.912] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.912] CloseHandle (hObject=0x2700) returned 1 [0194.912] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.915] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.play")) returned 1 [0194.917] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3307 os_tid = 0x31dc [0194.922] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.922] ReadFile (in: hFile=0x2708, lpBuffer=0x3db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3db3fb34*, lpNumberOfBytesRead=0x3db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.923] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.923] ReadFile (in: hFile=0x2708, lpBuffer=0x3db3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3db3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3db3fb34*, lpNumberOfBytesRead=0x3db3f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.923] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.926] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.926] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x3db3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0194.926] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x3db3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x3db3f828, pbKeyObject=0x0) returned 0x0 [0194.926] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3db3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3db3f500) returned 0x0 [0194.926] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.926] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3db3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3db3f500) returned 0x0 [0194.930] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.933] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.933] WriteFile (in: hFile=0x2708, lpBuffer=0x3db3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3db3f830, lpOverlapped=0x0 | out: lpBuffer=0x3db3fb34*, lpNumberOfBytesWritten=0x3db3f830*=0x428, lpOverlapped=0x0) returned 1 [0194.934] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.934] ReadFile (in: hFile=0x2708, lpBuffer=0x5950000, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x3db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x3db3f61c*=0x28ae, lpOverlapped=0x0) returned 1 [0194.934] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0xffffd752, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.934] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5950000, cbInput=0x28ae, pPaddingInfo=0x0, pbIV=0x3db3f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x3db3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3db3f848, pbOutput=0x5950000, pcbResult=0x3db3f618) returned 0x0 [0194.934] WriteFile (in: hFile=0x2708, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x3db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x3db3f61c*=0x28b0, lpOverlapped=0x0) returned 1 [0194.935] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3db3f60c | out: lpNewFilePointer=0x0) returned 1 [0194.935] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.935] WriteFile (in: hFile=0x2708, lpBuffer=0x3db3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3db3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3db3f83c*, lpNumberOfBytesWritten=0x3db3f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.935] SetFilePointerEx (in: hFile=0x2708, liDistanceToMove=0x28b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.935] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.935] CloseHandle (hObject=0x2708) returned 1 [0194.935] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.938] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.play")) returned 1 [0194.940] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3308 os_tid = 0x31e0 [0194.944] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.944] ReadFile (in: hFile=0x2710, lpBuffer=0x3dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3dc7fb34*, lpNumberOfBytesRead=0x3dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.945] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.946] ReadFile (in: hFile=0x2710, lpBuffer=0x3dc7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3dc7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3dc7fb34*, lpNumberOfBytesRead=0x3dc7f85c*=0x428, lpOverlapped=0x0) returned 1 [0194.946] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.949] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.949] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x3dc7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0194.949] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x3dc7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x3dc7f828, pbKeyObject=0x0) returned 0x0 [0194.949] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3dc7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3dc7f500) returned 0x0 [0194.949] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.949] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3dc7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3dc7f500) returned 0x0 [0194.952] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.956] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.956] WriteFile (in: hFile=0x2710, lpBuffer=0x3dc7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3dc7f830, lpOverlapped=0x0 | out: lpBuffer=0x3dc7fb34*, lpNumberOfBytesWritten=0x3dc7f830*=0x428, lpOverlapped=0x0) returned 1 [0194.957] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.957] ReadFile (in: hFile=0x2710, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x3dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x3dc7f61c*=0x349c, lpOverlapped=0x0) returned 1 [0194.957] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0xffffcb64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.957] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5a50000, cbInput=0x349c, pPaddingInfo=0x0, pbIV=0x3dc7f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x3dc7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3dc7f848, pbOutput=0x5a50000, pcbResult=0x3dc7f618) returned 0x0 [0194.957] WriteFile (in: hFile=0x2710, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x3dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x3dc7f61c*=0x34a0, lpOverlapped=0x0) returned 1 [0194.958] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3dc7f60c | out: lpNewFilePointer=0x0) returned 1 [0194.958] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.958] WriteFile (in: hFile=0x2710, lpBuffer=0x3dc7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3dc7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3dc7f83c*, lpNumberOfBytesWritten=0x3dc7f61c*=0x8, lpOverlapped=0x0) returned 1 [0194.958] SetFilePointerEx (in: hFile=0x2710, liDistanceToMove=0x34a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.958] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.958] CloseHandle (hObject=0x2710) returned 1 [0194.958] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.play")) returned 1 [0194.963] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3309 os_tid = 0x31e4 [0194.967] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.967] ReadFile (in: hFile=0x2718, lpBuffer=0x3ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3ddbfb34*, lpNumberOfBytesRead=0x3ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.968] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.968] ReadFile (in: hFile=0x2718, lpBuffer=0x3ddbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ddbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3ddbfb34*, lpNumberOfBytesRead=0x3ddbf85c*=0x428, lpOverlapped=0x0) returned 1 [0194.968] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.971] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.971] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x3ddbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0194.971] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x3ddbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x3ddbf828, pbKeyObject=0x0) returned 0x0 [0194.971] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ddbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ddbf500) returned 0x0 [0194.971] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.972] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ddbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ddbf500) returned 0x0 [0194.975] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.978] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.978] WriteFile (in: hFile=0x2718, lpBuffer=0x3ddbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ddbf830, lpOverlapped=0x0 | out: lpBuffer=0x3ddbfb34*, lpNumberOfBytesWritten=0x3ddbf830*=0x428, lpOverlapped=0x0) returned 1 [0194.978] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.978] ReadFile (in: hFile=0x2718, lpBuffer=0x5b50000, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x3ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x3ddbf61c*=0xce0, lpOverlapped=0x0) returned 1 [0194.978] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0xfffff320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.978] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5b50000, cbInput=0xce0, pPaddingInfo=0x0, pbIV=0x3ddbf848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x3ddbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ddbf848, pbOutput=0x5b50000, pcbResult=0x3ddbf618) returned 0x0 [0194.979] WriteFile (in: hFile=0x2718, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x3ddbf61c*=0xcf0, lpOverlapped=0x0) returned 1 [0194.979] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ddbf60c | out: lpNewFilePointer=0x0) returned 1 [0194.979] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.979] WriteFile (in: hFile=0x2718, lpBuffer=0x3ddbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ddbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3ddbf83c*, lpNumberOfBytesWritten=0x3ddbf61c*=0x8, lpOverlapped=0x0) returned 1 [0194.979] SetFilePointerEx (in: hFile=0x2718, liDistanceToMove=0xcf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.979] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0194.979] CloseHandle (hObject=0x2718) returned 1 [0194.979] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0194.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.play")) returned 1 [0194.983] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3310 os_tid = 0x31e8 [0194.987] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.987] ReadFile (in: hFile=0x2720, lpBuffer=0x3deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3deff85c, lpOverlapped=0x0 | out: lpBuffer=0x3deffb34*, lpNumberOfBytesRead=0x3deff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.989] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.989] ReadFile (in: hFile=0x2720, lpBuffer=0x3deffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3deff85c, lpOverlapped=0x0 | out: lpBuffer=0x3deffb34*, lpNumberOfBytesRead=0x3deff85c*=0x428, lpOverlapped=0x0) returned 1 [0194.989] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0194.992] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0194.993] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x3deff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0194.993] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x3deff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x3deff828, pbKeyObject=0x0) returned 0x0 [0194.993] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3deff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3deff500) returned 0x0 [0194.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0194.993] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3deff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3deff500) returned 0x0 [0194.997] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.000] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.000] WriteFile (in: hFile=0x2720, lpBuffer=0x3deffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3deff830, lpOverlapped=0x0 | out: lpBuffer=0x3deffb34*, lpNumberOfBytesWritten=0x3deff830*=0x428, lpOverlapped=0x0) returned 1 [0195.001] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.001] ReadFile (in: hFile=0x2720, lpBuffer=0x5c50000, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x3deff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x3deff61c*=0xb9e, lpOverlapped=0x0) returned 1 [0195.001] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0xfffff462, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.001] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5c50000, cbInput=0xb9e, pPaddingInfo=0x0, pbIV=0x3deff848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x3deff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3deff848, pbOutput=0x5c50000, pcbResult=0x3deff618) returned 0x0 [0195.001] WriteFile (in: hFile=0x2720, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x3deff61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x3deff61c*=0xba0, lpOverlapped=0x0) returned 1 [0195.001] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3deff60c | out: lpNewFilePointer=0x0) returned 1 [0195.001] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.001] WriteFile (in: hFile=0x2720, lpBuffer=0x3deff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3deff61c, lpOverlapped=0x0 | out: lpBuffer=0x3deff83c*, lpNumberOfBytesWritten=0x3deff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.001] SetFilePointerEx (in: hFile=0x2720, liDistanceToMove=0xba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.001] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.001] CloseHandle (hObject=0x2720) returned 1 [0195.001] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.play")) returned 1 [0195.006] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3311 os_tid = 0x31ec [0195.011] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.011] ReadFile (in: hFile=0x2728, lpBuffer=0x3e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e03fb34*, lpNumberOfBytesRead=0x3e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.013] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.013] ReadFile (in: hFile=0x2728, lpBuffer=0x3e03fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e03f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e03fb34*, lpNumberOfBytesRead=0x3e03f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.013] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.016] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.016] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x3e03f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0195.016] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x3e03f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x3e03f828, pbKeyObject=0x0) returned 0x0 [0195.017] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e03f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e03f500) returned 0x0 [0195.017] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.017] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e03f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e03f500) returned 0x0 [0195.020] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.025] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.025] WriteFile (in: hFile=0x2728, lpBuffer=0x3e03fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e03f830, lpOverlapped=0x0 | out: lpBuffer=0x3e03fb34*, lpNumberOfBytesWritten=0x3e03f830*=0x428, lpOverlapped=0x0) returned 1 [0195.025] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.025] ReadFile (in: hFile=0x2728, lpBuffer=0x5d50000, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x3e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x3e03f61c*=0xc88, lpOverlapped=0x0) returned 1 [0195.025] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0xfffff378, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.025] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5d50000, cbInput=0xc88, pPaddingInfo=0x0, pbIV=0x3e03f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x3e03f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e03f848, pbOutput=0x5d50000, pcbResult=0x3e03f618) returned 0x0 [0195.026] WriteFile (in: hFile=0x2728, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x3e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x3e03f61c*=0xc90, lpOverlapped=0x0) returned 1 [0195.026] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e03f60c | out: lpNewFilePointer=0x0) returned 1 [0195.026] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.026] WriteFile (in: hFile=0x2728, lpBuffer=0x3e03f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e03f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e03f83c*, lpNumberOfBytesWritten=0x3e03f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.026] SetFilePointerEx (in: hFile=0x2728, liDistanceToMove=0xc90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.026] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.026] CloseHandle (hObject=0x2728) returned 1 [0195.026] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.play")) returned 1 [0195.031] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3312 os_tid = 0x31f0 [0195.013] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.035] ReadFile (in: hFile=0x2730, lpBuffer=0x3e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e17fb34*, lpNumberOfBytesRead=0x3e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.036] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.036] ReadFile (in: hFile=0x2730, lpBuffer=0x3e17fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e17f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e17fb34*, lpNumberOfBytesRead=0x3e17f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.037] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.039] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.039] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x3e17f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0195.039] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x3e17f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x3e17f828, pbKeyObject=0x0) returned 0x0 [0195.039] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e17f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e17f500) returned 0x0 [0195.039] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.040] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e17f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e17f500) returned 0x0 [0195.043] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.046] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.046] WriteFile (in: hFile=0x2730, lpBuffer=0x3e17fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e17f830, lpOverlapped=0x0 | out: lpBuffer=0x3e17fb34*, lpNumberOfBytesWritten=0x3e17f830*=0x428, lpOverlapped=0x0) returned 1 [0195.046] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.046] ReadFile (in: hFile=0x2730, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x3e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x3e17f61c*=0x14c4, lpOverlapped=0x0) returned 1 [0195.046] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0xffffeb3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.046] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5e50000, cbInput=0x14c4, pPaddingInfo=0x0, pbIV=0x3e17f848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x3e17f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e17f848, pbOutput=0x5e50000, pcbResult=0x3e17f618) returned 0x0 [0195.046] WriteFile (in: hFile=0x2730, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x3e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x3e17f61c*=0x14d0, lpOverlapped=0x0) returned 1 [0195.047] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e17f60c | out: lpNewFilePointer=0x0) returned 1 [0195.047] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.047] WriteFile (in: hFile=0x2730, lpBuffer=0x3e17f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e17f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e17f83c*, lpNumberOfBytesWritten=0x3e17f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.047] SetFilePointerEx (in: hFile=0x2730, liDistanceToMove=0x14d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.047] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.047] CloseHandle (hObject=0x2730) returned 1 [0195.047] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.play")) returned 1 [0195.051] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3313 os_tid = 0x31f4 [0195.055] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.055] ReadFile (in: hFile=0x2738, lpBuffer=0x3e2bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e2bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3e2bfb34*, lpNumberOfBytesRead=0x3e2bf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.056] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.059] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.059] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x3e2bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0195.059] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x3e2bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x3e2bf828, pbKeyObject=0x0) returned 0x0 [0195.059] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e2bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e2bf500) returned 0x0 [0195.059] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.059] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e2bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e2bf500) returned 0x0 [0195.062] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.065] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.066] WriteFile (in: hFile=0x2738, lpBuffer=0x3e2bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x3e2bfb34*, lpNumberOfBytesWritten=0x3e2bf830*=0x428, lpOverlapped=0x0) returned 1 [0195.066] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.066] ReadFile (in: hFile=0x2738, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x3e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x3e2bf61c*=0x460, lpOverlapped=0x0) returned 1 [0195.066] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0xfffffba0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.066] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5f50000, cbInput=0x460, pPaddingInfo=0x0, pbIV=0x3e2bf848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x3e2bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e2bf848, pbOutput=0x5f50000, pcbResult=0x3e2bf618) returned 0x0 [0195.066] WriteFile (in: hFile=0x2738, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x3e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x3e2bf61c*=0x470, lpOverlapped=0x0) returned 1 [0195.066] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e2bf60c | out: lpNewFilePointer=0x0) returned 1 [0195.066] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.066] WriteFile (in: hFile=0x2738, lpBuffer=0x3e2bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e2bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e2bf83c*, lpNumberOfBytesWritten=0x3e2bf61c*=0x8, lpOverlapped=0x0) returned 1 [0195.066] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.066] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.066] CloseHandle (hObject=0x2738) returned 1 [0195.067] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.play")) returned 1 [0195.071] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3314 os_tid = 0x31f8 [0195.075] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.077] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.077] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x3e3ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0195.077] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x3e3ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x3e3ff828, pbKeyObject=0x0) returned 0x0 [0195.077] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e3ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e3ff500) returned 0x0 [0195.078] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.078] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e3ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e3ff500) returned 0x0 [0195.081] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.084] SetFilePointerEx (in: hFile=0x2740, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.084] WriteFile (in: hFile=0x2740, lpBuffer=0x3e3ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e3ff830, lpOverlapped=0x0 | out: lpBuffer=0x3e3ffb34*, lpNumberOfBytesWritten=0x3e3ff830*=0x428, lpOverlapped=0x0) returned 1 [0195.087] SetFilePointerEx (in: hFile=0x2740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.087] ReadFile (in: hFile=0x2740, lpBuffer=0x6050000, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x3e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x3e3ff61c*=0x270, lpOverlapped=0x0) returned 1 [0195.087] SetFilePointerEx (in: hFile=0x2740, liDistanceToMove=0xfffffd90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.087] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6050000, cbInput=0x270, pPaddingInfo=0x0, pbIV=0x3e3ff848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x3e3ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e3ff848, pbOutput=0x6050000, pcbResult=0x3e3ff618) returned 0x0 [0195.087] WriteFile (in: hFile=0x2740, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x3e3ff61c*=0x280, lpOverlapped=0x0) returned 1 [0195.087] SetFilePointerEx (in: hFile=0x2740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3ff60c | out: lpNewFilePointer=0x0) returned 1 [0195.088] SetFilePointerEx (in: hFile=0x2740, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.088] WriteFile (in: hFile=0x2740, lpBuffer=0x3e3ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e3ff83c*, lpNumberOfBytesWritten=0x3e3ff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.088] SetFilePointerEx (in: hFile=0x2740, liDistanceToMove=0x280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.088] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.088] CloseHandle (hObject=0x2740) returned 1 [0195.088] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.play")) returned 1 [0195.092] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3315 os_tid = 0x31fc [0195.086] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.086] ReadFile (in: hFile=0x2748, lpBuffer=0x3e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e53fb34*, lpNumberOfBytesRead=0x3e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.097] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.097] ReadFile (in: hFile=0x2748, lpBuffer=0x3e53fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e53f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e53fb34*, lpNumberOfBytesRead=0x3e53f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.097] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.100] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.100] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x3e53f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0195.100] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x3e53f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x3e53f828, pbKeyObject=0x0) returned 0x0 [0195.100] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e53f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e53f500) returned 0x0 [0195.100] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.100] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e53f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e53f500) returned 0x0 [0195.104] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.107] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.107] WriteFile (in: hFile=0x2748, lpBuffer=0x3e53fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e53f830, lpOverlapped=0x0 | out: lpBuffer=0x3e53fb34*, lpNumberOfBytesWritten=0x3e53f830*=0x428, lpOverlapped=0x0) returned 1 [0195.107] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.107] ReadFile (in: hFile=0x2748, lpBuffer=0x6150000, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x3e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x3e53f61c*=0x1138, lpOverlapped=0x0) returned 1 [0195.107] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xffffeec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.107] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6150000, cbInput=0x1138, pPaddingInfo=0x0, pbIV=0x3e53f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x3e53f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e53f848, pbOutput=0x6150000, pcbResult=0x3e53f618) returned 0x0 [0195.107] WriteFile (in: hFile=0x2748, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x3e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x3e53f61c*=0x1140, lpOverlapped=0x0) returned 1 [0195.107] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e53f60c | out: lpNewFilePointer=0x0) returned 1 [0195.107] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.108] WriteFile (in: hFile=0x2748, lpBuffer=0x3e53f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e53f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e53f83c*, lpNumberOfBytesWritten=0x3e53f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.108] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x1140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.108] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.108] CloseHandle (hObject=0x2748) returned 1 [0195.108] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.play")) returned 1 [0195.112] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3316 os_tid = 0x3200 [0195.116] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.116] ReadFile (in: hFile=0x26c4, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.117] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.118] ReadFile (in: hFile=0x26c4, lpBuffer=0x2e1ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2e1ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesRead=0x2e1ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.118] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.120] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x2e1ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0195.120] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x2e1ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x2e1ff828, pbKeyObject=0x0) returned 0x0 [0195.120] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2e1ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2e1ff500) returned 0x0 [0195.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.121] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2e1ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2e1ff500) returned 0x0 [0195.124] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.129] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.129] WriteFile (in: hFile=0x26c4, lpBuffer=0x2e1ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2e1ff830, lpOverlapped=0x0 | out: lpBuffer=0x2e1ffb34*, lpNumberOfBytesWritten=0x2e1ff830*=0x428, lpOverlapped=0x0) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.130] ReadFile (in: hFile=0x26c4, lpBuffer=0x6250000, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x2e1ff61c*=0x10c8, lpOverlapped=0x0) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xffffef38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.130] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6250000, cbInput=0x10c8, pPaddingInfo=0x0, pbIV=0x2e1ff848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x2e1ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2e1ff848, pbOutput=0x6250000, pcbResult=0x2e1ff618) returned 0x0 [0195.130] WriteFile (in: hFile=0x26c4, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x2e1ff61c*=0x10d0, lpOverlapped=0x0) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1ff60c | out: lpNewFilePointer=0x0) returned 1 [0195.131] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.131] WriteFile (in: hFile=0x26c4, lpBuffer=0x2e1ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e1ff83c*, lpNumberOfBytesWritten=0x2e1ff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.131] SetFilePointerEx (in: hFile=0x26c4, liDistanceToMove=0x10d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.131] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.133] CloseHandle (hObject=0x26c4) returned 1 [0195.133] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.play")) returned 1 [0195.138] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3317 os_tid = 0x3204 [0195.143] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.143] ReadFile (in: hFile=0x2754, lpBuffer=0x3e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e67fb34*, lpNumberOfBytesRead=0x3e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.144] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.144] ReadFile (in: hFile=0x2754, lpBuffer=0x3e67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e67f85c, lpOverlapped=0x0 | out: lpBuffer=0x3e67fb34*, lpNumberOfBytesRead=0x3e67f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.145] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.148] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.148] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x3e67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0195.148] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x3e67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x3e67f828, pbKeyObject=0x0) returned 0x0 [0195.148] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e67f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e67f500) returned 0x0 [0195.148] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.149] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e67f500) returned 0x0 [0195.152] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.155] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.155] WriteFile (in: hFile=0x2754, lpBuffer=0x3e67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e67f830, lpOverlapped=0x0 | out: lpBuffer=0x3e67fb34*, lpNumberOfBytesWritten=0x3e67f830*=0x428, lpOverlapped=0x0) returned 1 [0195.155] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.155] ReadFile (in: hFile=0x2754, lpBuffer=0x3950000, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x3e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x3e67f61c*=0xdb8, lpOverlapped=0x0) returned 1 [0195.155] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xfffff248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.155] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3950000, cbInput=0xdb8, pPaddingInfo=0x0, pbIV=0x3e67f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x3e67f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e67f848, pbOutput=0x3950000, pcbResult=0x3e67f618) returned 0x0 [0195.155] WriteFile (in: hFile=0x2754, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x3e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x3e67f61c*=0xdc0, lpOverlapped=0x0) returned 1 [0195.155] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e67f60c | out: lpNewFilePointer=0x0) returned 1 [0195.156] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.156] WriteFile (in: hFile=0x2754, lpBuffer=0x3e67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e67f83c*, lpNumberOfBytesWritten=0x3e67f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.156] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xdc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.156] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.156] CloseHandle (hObject=0x2754) returned 1 [0195.156] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.play")) returned 1 [0195.165] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3318 os_tid = 0x3208 [0195.161] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.161] ReadFile (in: hFile=0x275c, lpBuffer=0x3e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3e7bfb34*, lpNumberOfBytesRead=0x3e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.170] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.170] ReadFile (in: hFile=0x275c, lpBuffer=0x3e7bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e7bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3e7bfb34*, lpNumberOfBytesRead=0x3e7bf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.170] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.172] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.173] BCryptSetProperty (in: hObject=0x732d30, pszProperty="ChainingMode", pbInput=0x3e7bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732d30) returned 0x0 [0195.173] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732d30, phKey=0x3e7bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732d30, phKey=0x3e7bf828, pbKeyObject=0x0) returned 0x0 [0195.173] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e7bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e7bf500) returned 0x0 [0195.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.173] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e7bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e7bf500) returned 0x0 [0195.176] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.179] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.179] WriteFile (in: hFile=0x275c, lpBuffer=0x3e7bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e7bf830, lpOverlapped=0x0 | out: lpBuffer=0x3e7bfb34*, lpNumberOfBytesWritten=0x3e7bf830*=0x428, lpOverlapped=0x0) returned 1 [0195.179] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.179] ReadFile (in: hFile=0x275c, lpBuffer=0x6350000, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x3e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x3e7bf61c*=0x27e0, lpOverlapped=0x0) returned 1 [0195.180] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0xffffd820, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.180] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6350000, cbInput=0x27e0, pPaddingInfo=0x0, pbIV=0x3e7bf848, cbIV=0x10, pbOutput=0x6350000, cbOutput=0x100000, pcbResult=0x3e7bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e7bf848, pbOutput=0x6350000, pcbResult=0x3e7bf618) returned 0x0 [0195.180] WriteFile (in: hFile=0x275c, lpBuffer=0x6350000*, nNumberOfBytesToWrite=0x27f0, lpNumberOfBytesWritten=0x3e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesWritten=0x3e7bf61c*=0x27f0, lpOverlapped=0x0) returned 1 [0195.180] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7bf60c | out: lpNewFilePointer=0x0) returned 1 [0195.180] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.180] WriteFile (in: hFile=0x275c, lpBuffer=0x3e7bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e7bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e7bf83c*, lpNumberOfBytesWritten=0x3e7bf61c*=0x8, lpOverlapped=0x0) returned 1 [0195.180] SetFilePointerEx (in: hFile=0x275c, liDistanceToMove=0x27f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.180] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.181] CloseHandle (hObject=0x275c) returned 1 [0195.181] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.play")) returned 1 [0195.184] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3319 os_tid = 0x320c [0195.188] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.188] ReadFile (in: hFile=0x2764, lpBuffer=0x3e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3e8ffb34*, lpNumberOfBytesRead=0x3e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.190] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.190] ReadFile (in: hFile=0x2764, lpBuffer=0x3e8ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3e8ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3e8ffb34*, lpNumberOfBytesRead=0x3e8ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.190] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.192] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.192] BCryptSetProperty (in: hObject=0x731d60, pszProperty="ChainingMode", pbInput=0x3e8ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731d60) returned 0x0 [0195.192] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731d60, phKey=0x3e8ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731d60, phKey=0x3e8ff828, pbKeyObject=0x0) returned 0x0 [0195.192] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3e8ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3e8ff500) returned 0x0 [0195.192] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.192] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3e8ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3e8ff500) returned 0x0 [0195.196] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.199] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.199] WriteFile (in: hFile=0x2764, lpBuffer=0x3e8ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3e8ff830, lpOverlapped=0x0 | out: lpBuffer=0x3e8ffb34*, lpNumberOfBytesWritten=0x3e8ff830*=0x428, lpOverlapped=0x0) returned 1 [0195.199] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.199] ReadFile (in: hFile=0x2764, lpBuffer=0x6450000, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x3e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesRead=0x3e8ff61c*=0x918, lpOverlapped=0x0) returned 1 [0195.199] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xfffff6e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.199] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6450000, cbInput=0x918, pPaddingInfo=0x0, pbIV=0x3e8ff848, cbIV=0x10, pbOutput=0x6450000, cbOutput=0x100000, pcbResult=0x3e8ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3e8ff848, pbOutput=0x6450000, pcbResult=0x3e8ff618) returned 0x0 [0195.199] WriteFile (in: hFile=0x2764, lpBuffer=0x6450000*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x3e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesWritten=0x3e8ff61c*=0x920, lpOverlapped=0x0) returned 1 [0195.200] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e8ff60c | out: lpNewFilePointer=0x0) returned 1 [0195.200] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.200] WriteFile (in: hFile=0x2764, lpBuffer=0x3e8ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e8ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3e8ff83c*, lpNumberOfBytesWritten=0x3e8ff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.200] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.200] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.200] CloseHandle (hObject=0x2764) returned 1 [0195.200] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.202] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.play")) returned 1 [0195.204] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3320 os_tid = 0x3210 [0195.208] SetFilePointerEx (in: hFile=0x276c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.208] ReadFile (in: hFile=0x276c, lpBuffer=0x3ea3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ea3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ea3fb34*, lpNumberOfBytesRead=0x3ea3f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.210] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.212] BCryptSetProperty (in: hObject=0x7329c0, pszProperty="ChainingMode", pbInput=0x3ea3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7329c0) returned 0x0 [0195.212] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7329c0, phKey=0x3ea3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7329c0, phKey=0x3ea3f828, pbKeyObject=0x0) returned 0x0 [0195.212] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ea3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ea3f500) returned 0x0 [0195.212] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.212] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ea3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ea3f500) returned 0x0 [0195.215] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.218] SetFilePointerEx (in: hFile=0x276c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.218] WriteFile (in: hFile=0x276c, lpBuffer=0x3ea3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ea3f830, lpOverlapped=0x0 | out: lpBuffer=0x3ea3fb34*, lpNumberOfBytesWritten=0x3ea3f830*=0x428, lpOverlapped=0x0) returned 1 [0195.218] SetFilePointerEx (in: hFile=0x276c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.218] ReadFile (in: hFile=0x276c, lpBuffer=0x6550000, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x3ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesRead=0x3ea3f61c*=0x43c, lpOverlapped=0x0) returned 1 [0195.218] SetFilePointerEx (in: hFile=0x276c, liDistanceToMove=0xfffffbc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.218] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6550000, cbInput=0x43c, pPaddingInfo=0x0, pbIV=0x3ea3f848, cbIV=0x10, pbOutput=0x6550000, cbOutput=0x100000, pcbResult=0x3ea3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ea3f848, pbOutput=0x6550000, pcbResult=0x3ea3f618) returned 0x0 [0195.218] WriteFile (in: hFile=0x276c, lpBuffer=0x6550000*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x3ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesWritten=0x3ea3f61c*=0x440, lpOverlapped=0x0) returned 1 [0195.219] SetFilePointerEx (in: hFile=0x276c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ea3f60c | out: lpNewFilePointer=0x0) returned 1 [0195.219] SetFilePointerEx (in: hFile=0x276c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.219] WriteFile (in: hFile=0x276c, lpBuffer=0x3ea3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ea3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ea3f83c*, lpNumberOfBytesWritten=0x3ea3f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.219] SetFilePointerEx (in: hFile=0x276c, liDistanceToMove=0x440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.219] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.219] CloseHandle (hObject=0x276c) returned 1 [0195.219] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.play")) returned 1 [0195.223] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3321 os_tid = 0x3214 [0195.233] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.233] ReadFile (in: hFile=0x2774, lpBuffer=0x3eb7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3eb7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3eb7fb34*, lpNumberOfBytesRead=0x3eb7f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.234] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.237] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.237] BCryptSetProperty (in: hObject=0x732020, pszProperty="ChainingMode", pbInput=0x3eb7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732020) returned 0x0 [0195.237] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732020, phKey=0x3eb7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732020, phKey=0x3eb7f828, pbKeyObject=0x0) returned 0x0 [0195.237] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3eb7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3eb7f500) returned 0x0 [0195.238] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.238] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3eb7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3eb7f500) returned 0x0 [0195.241] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.244] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.244] WriteFile (in: hFile=0x2774, lpBuffer=0x3eb7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3eb7f830, lpOverlapped=0x0 | out: lpBuffer=0x3eb7fb34*, lpNumberOfBytesWritten=0x3eb7f830*=0x428, lpOverlapped=0x0) returned 1 [0195.245] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.245] ReadFile (in: hFile=0x2774, lpBuffer=0x6650000, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x3eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesRead=0x3eb7f61c*=0x474, lpOverlapped=0x0) returned 1 [0195.245] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xfffffb8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.245] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6650000, cbInput=0x474, pPaddingInfo=0x0, pbIV=0x3eb7f848, cbIV=0x10, pbOutput=0x6650000, cbOutput=0x100000, pcbResult=0x3eb7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3eb7f848, pbOutput=0x6650000, pcbResult=0x3eb7f618) returned 0x0 [0195.245] WriteFile (in: hFile=0x2774, lpBuffer=0x6650000*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x3eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesWritten=0x3eb7f61c*=0x480, lpOverlapped=0x0) returned 1 [0195.245] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3eb7f60c | out: lpNewFilePointer=0x0) returned 1 [0195.245] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.245] WriteFile (in: hFile=0x2774, lpBuffer=0x3eb7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3eb7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3eb7f83c*, lpNumberOfBytesWritten=0x3eb7f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.245] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0x480, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.245] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.245] CloseHandle (hObject=0x2774) returned 1 [0195.245] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.play")) returned 1 [0195.249] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3322 os_tid = 0x3218 [0195.253] SetFilePointerEx (in: hFile=0x277c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.253] ReadFile (in: hFile=0x277c, lpBuffer=0x3ecbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ecbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3ecbfb34*, lpNumberOfBytesRead=0x3ecbf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.255] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.257] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.258] BCryptSetProperty (in: hObject=0x732a70, pszProperty="ChainingMode", pbInput=0x3ecbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732a70) returned 0x0 [0195.258] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732a70, phKey=0x3ecbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732a70, phKey=0x3ecbf828, pbKeyObject=0x0) returned 0x0 [0195.258] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ecbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ecbf500) returned 0x0 [0195.258] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.258] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ecbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ecbf500) returned 0x0 [0195.261] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.264] SetFilePointerEx (in: hFile=0x277c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.264] WriteFile (in: hFile=0x277c, lpBuffer=0x3ecbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ecbf830, lpOverlapped=0x0 | out: lpBuffer=0x3ecbfb34*, lpNumberOfBytesWritten=0x3ecbf830*=0x428, lpOverlapped=0x0) returned 1 [0195.264] SetFilePointerEx (in: hFile=0x277c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.264] ReadFile (in: hFile=0x277c, lpBuffer=0x6750000, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x3ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesRead=0x3ecbf61c*=0x66c, lpOverlapped=0x0) returned 1 [0195.264] SetFilePointerEx (in: hFile=0x277c, liDistanceToMove=0xfffff994, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.264] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6750000, cbInput=0x66c, pPaddingInfo=0x0, pbIV=0x3ecbf848, cbIV=0x10, pbOutput=0x6750000, cbOutput=0x100000, pcbResult=0x3ecbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ecbf848, pbOutput=0x6750000, pcbResult=0x3ecbf618) returned 0x0 [0195.264] WriteFile (in: hFile=0x277c, lpBuffer=0x6750000*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x3ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesWritten=0x3ecbf61c*=0x670, lpOverlapped=0x0) returned 1 [0195.264] SetFilePointerEx (in: hFile=0x277c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ecbf60c | out: lpNewFilePointer=0x0) returned 1 [0195.264] SetFilePointerEx (in: hFile=0x277c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.264] WriteFile (in: hFile=0x277c, lpBuffer=0x3ecbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ecbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3ecbf83c*, lpNumberOfBytesWritten=0x3ecbf61c*=0x8, lpOverlapped=0x0) returned 1 [0195.265] SetFilePointerEx (in: hFile=0x277c, liDistanceToMove=0x670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.265] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.265] CloseHandle (hObject=0x277c) returned 1 [0195.265] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.play")) returned 1 [0195.269] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3323 os_tid = 0x321c [0195.272] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.275] BCryptSetProperty (in: hObject=0x732bd0, pszProperty="ChainingMode", pbInput=0x3edff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732bd0) returned 0x0 [0195.275] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732bd0, phKey=0x3edff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732bd0, phKey=0x3edff828, pbKeyObject=0x0) returned 0x0 [0195.275] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3edff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3edff500) returned 0x0 [0195.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.275] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3edff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3edff500) returned 0x0 [0195.278] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.281] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.281] WriteFile (in: hFile=0x2784, lpBuffer=0x3edffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3edff830, lpOverlapped=0x0 | out: lpBuffer=0x3edffb34*, lpNumberOfBytesWritten=0x3edff830*=0x428, lpOverlapped=0x0) returned 1 [0195.283] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.283] ReadFile (in: hFile=0x2784, lpBuffer=0x6850000, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x3edff61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesRead=0x3edff61c*=0x2a0, lpOverlapped=0x0) returned 1 [0195.283] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0xfffffd60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.283] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6850000, cbInput=0x2a0, pPaddingInfo=0x0, pbIV=0x3edff848, cbIV=0x10, pbOutput=0x6850000, cbOutput=0x100000, pcbResult=0x3edff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3edff848, pbOutput=0x6850000, pcbResult=0x3edff618) returned 0x0 [0195.283] WriteFile (in: hFile=0x2784, lpBuffer=0x6850000*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x3edff61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesWritten=0x3edff61c*=0x2b0, lpOverlapped=0x0) returned 1 [0195.283] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3edff60c | out: lpNewFilePointer=0x0) returned 1 [0195.283] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.283] WriteFile (in: hFile=0x2784, lpBuffer=0x3edff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3edff61c, lpOverlapped=0x0 | out: lpBuffer=0x3edff83c*, lpNumberOfBytesWritten=0x3edff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.283] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x2b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.283] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.284] CloseHandle (hObject=0x2784) returned 1 [0195.284] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.play")) returned 1 [0195.288] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3324 os_tid = 0x3220 [0195.291] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.291] ReadFile (in: hFile=0x278c, lpBuffer=0x3ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fb34*, lpNumberOfBytesRead=0x3ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.292] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.293] ReadFile (in: hFile=0x278c, lpBuffer=0x3ef3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ef3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fb34*, lpNumberOfBytesRead=0x3ef3f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.293] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.295] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.295] BCryptSetProperty (in: hObject=0x733200, pszProperty="ChainingMode", pbInput=0x3ef3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733200) returned 0x0 [0195.295] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733200, phKey=0x3ef3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733200, phKey=0x3ef3f828, pbKeyObject=0x0) returned 0x0 [0195.295] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ef3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ef3f500) returned 0x0 [0195.295] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.295] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ef3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ef3f500) returned 0x0 [0195.298] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.301] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.301] WriteFile (in: hFile=0x278c, lpBuffer=0x3ef3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ef3f830, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fb34*, lpNumberOfBytesWritten=0x3ef3f830*=0x428, lpOverlapped=0x0) returned 1 [0195.301] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.301] ReadFile (in: hFile=0x278c, lpBuffer=0x6950000, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x3ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesRead=0x3ef3f61c*=0x1fe8, lpOverlapped=0x0) returned 1 [0195.302] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0xffffe018, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.302] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6950000, cbInput=0x1fe8, pPaddingInfo=0x0, pbIV=0x3ef3f848, cbIV=0x10, pbOutput=0x6950000, cbOutput=0x100000, pcbResult=0x3ef3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ef3f848, pbOutput=0x6950000, pcbResult=0x3ef3f618) returned 0x0 [0195.302] WriteFile (in: hFile=0x278c, lpBuffer=0x6950000*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x3ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesWritten=0x3ef3f61c*=0x1ff0, lpOverlapped=0x0) returned 1 [0195.302] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ef3f60c | out: lpNewFilePointer=0x0) returned 1 [0195.302] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.302] WriteFile (in: hFile=0x278c, lpBuffer=0x3ef3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ef3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ef3f83c*, lpNumberOfBytesWritten=0x3ef3f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.302] SetFilePointerEx (in: hFile=0x278c, liDistanceToMove=0x1ff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.303] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.303] CloseHandle (hObject=0x278c) returned 1 [0195.303] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.play")) returned 1 [0195.337] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3325 os_tid = 0x3224 [0195.341] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.342] ReadFile (in: hFile=0x2794, lpBuffer=0x3f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f07fb34*, lpNumberOfBytesRead=0x3f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.343] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.343] ReadFile (in: hFile=0x2794, lpBuffer=0x3f07fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f07f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f07fb34*, lpNumberOfBytesRead=0x3f07f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.344] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.346] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.346] BCryptSetProperty (in: hObject=0x731cb0, pszProperty="ChainingMode", pbInput=0x3f07f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731cb0) returned 0x0 [0195.346] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731cb0, phKey=0x3f07f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731cb0, phKey=0x3f07f828, pbKeyObject=0x0) returned 0x0 [0195.346] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f07f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f07f500) returned 0x0 [0195.346] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.347] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f07f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f07f500) returned 0x0 [0195.350] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.353] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.353] WriteFile (in: hFile=0x2794, lpBuffer=0x3f07fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f07f830, lpOverlapped=0x0 | out: lpBuffer=0x3f07fb34*, lpNumberOfBytesWritten=0x3f07f830*=0x428, lpOverlapped=0x0) returned 1 [0195.353] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.353] ReadFile (in: hFile=0x2794, lpBuffer=0x6a50000, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x3f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesRead=0x3f07f61c*=0x4816, lpOverlapped=0x0) returned 1 [0195.354] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xffffb7ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.354] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6a50000, cbInput=0x4816, pPaddingInfo=0x0, pbIV=0x3f07f848, cbIV=0x10, pbOutput=0x6a50000, cbOutput=0x100000, pcbResult=0x3f07f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f07f848, pbOutput=0x6a50000, pcbResult=0x3f07f618) returned 0x0 [0195.354] WriteFile (in: hFile=0x2794, lpBuffer=0x6a50000*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x3f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesWritten=0x3f07f61c*=0x4820, lpOverlapped=0x0) returned 1 [0195.354] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f07f60c | out: lpNewFilePointer=0x0) returned 1 [0195.354] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.354] WriteFile (in: hFile=0x2794, lpBuffer=0x3f07f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f07f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f07f83c*, lpNumberOfBytesWritten=0x3f07f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.355] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0x4820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.355] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.355] CloseHandle (hObject=0x2794) returned 1 [0195.355] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.play")) returned 1 [0195.359] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3326 os_tid = 0x3228 [0195.363] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.363] ReadFile (in: hFile=0x279c, lpBuffer=0x3f1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3f1bfb34*, lpNumberOfBytesRead=0x3f1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.364] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.364] ReadFile (in: hFile=0x279c, lpBuffer=0x3f1bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f1bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3f1bfb34*, lpNumberOfBytesRead=0x3f1bf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.364] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.367] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.367] BCryptSetProperty (in: hObject=0x732230, pszProperty="ChainingMode", pbInput=0x3f1bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732230) returned 0x0 [0195.367] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732230, phKey=0x3f1bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732230, phKey=0x3f1bf828, pbKeyObject=0x0) returned 0x0 [0195.367] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f1bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f1bf500) returned 0x0 [0195.367] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.367] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f1bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f1bf500) returned 0x0 [0195.370] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.373] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.373] WriteFile (in: hFile=0x279c, lpBuffer=0x3f1bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f1bf830, lpOverlapped=0x0 | out: lpBuffer=0x3f1bfb34*, lpNumberOfBytesWritten=0x3f1bf830*=0x428, lpOverlapped=0x0) returned 1 [0195.373] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.373] ReadFile (in: hFile=0x279c, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x3f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x3f1bf61c*=0x7c50, lpOverlapped=0x0) returned 1 [0195.374] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0xffff83b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.374] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6b50000, cbInput=0x7c50, pPaddingInfo=0x0, pbIV=0x3f1bf848, cbIV=0x10, pbOutput=0x6b50000, cbOutput=0x100000, pcbResult=0x3f1bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f1bf848, pbOutput=0x6b50000, pcbResult=0x3f1bf618) returned 0x0 [0195.374] WriteFile (in: hFile=0x279c, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x3f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x3f1bf61c*=0x7c60, lpOverlapped=0x0) returned 1 [0195.375] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f1bf60c | out: lpNewFilePointer=0x0) returned 1 [0195.375] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.375] WriteFile (in: hFile=0x279c, lpBuffer=0x3f1bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f1bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f1bf83c*, lpNumberOfBytesWritten=0x3f1bf61c*=0x8, lpOverlapped=0x0) returned 1 [0195.375] SetFilePointerEx (in: hFile=0x279c, liDistanceToMove=0x7c60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.375] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.375] CloseHandle (hObject=0x279c) returned 1 [0195.375] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.play")) returned 1 [0195.379] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3327 os_tid = 0x322c [0195.383] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.383] ReadFile (in: hFile=0x27a4, lpBuffer=0x3f2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3f2ffb34*, lpNumberOfBytesRead=0x3f2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.384] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.384] ReadFile (in: hFile=0x27a4, lpBuffer=0x3f2ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f2ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3f2ffb34*, lpNumberOfBytesRead=0x3f2ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.384] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.387] BCryptSetProperty (in: hObject=0x732440, pszProperty="ChainingMode", pbInput=0x3f2ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732440) returned 0x0 [0195.387] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732440, phKey=0x3f2ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732440, phKey=0x3f2ff828, pbKeyObject=0x0) returned 0x0 [0195.387] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f2ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f2ff500) returned 0x0 [0195.387] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.387] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f2ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f2ff500) returned 0x0 [0195.390] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.393] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.393] WriteFile (in: hFile=0x27a4, lpBuffer=0x3f2ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f2ff830, lpOverlapped=0x0 | out: lpBuffer=0x3f2ffb34*, lpNumberOfBytesWritten=0x3f2ff830*=0x428, lpOverlapped=0x0) returned 1 [0195.394] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.394] ReadFile (in: hFile=0x27a4, lpBuffer=0x6c50000, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x3f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesRead=0x3f2ff61c*=0xfe4, lpOverlapped=0x0) returned 1 [0195.394] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xfffff01c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.394] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6c50000, cbInput=0xfe4, pPaddingInfo=0x0, pbIV=0x3f2ff848, cbIV=0x10, pbOutput=0x6c50000, cbOutput=0x100000, pcbResult=0x3f2ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f2ff848, pbOutput=0x6c50000, pcbResult=0x3f2ff618) returned 0x0 [0195.394] WriteFile (in: hFile=0x27a4, lpBuffer=0x6c50000*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x3f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6c50000*, lpNumberOfBytesWritten=0x3f2ff61c*=0xff0, lpOverlapped=0x0) returned 1 [0195.394] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f2ff60c | out: lpNewFilePointer=0x0) returned 1 [0195.394] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.394] WriteFile (in: hFile=0x27a4, lpBuffer=0x3f2ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f2ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f2ff83c*, lpNumberOfBytesWritten=0x3f2ff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.395] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xff0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.395] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.395] CloseHandle (hObject=0x27a4) returned 1 [0195.395] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.play")) returned 1 [0195.399] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3328 os_tid = 0x3230 [0195.405] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.406] ReadFile (in: hFile=0x27ac, lpBuffer=0x3f43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f43f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f43fb34*, lpNumberOfBytesRead=0x3f43f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.408] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.408] ReadFile (in: hFile=0x27ac, lpBuffer=0x3f43fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f43f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f43fb34*, lpNumberOfBytesRead=0x3f43f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.408] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.411] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.412] BCryptSetProperty (in: hObject=0x7324f0, pszProperty="ChainingMode", pbInput=0x3f43f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7324f0) returned 0x0 [0195.412] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7324f0, phKey=0x3f43f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7324f0, phKey=0x3f43f828, pbKeyObject=0x0) returned 0x0 [0195.412] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f43f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f43f500) returned 0x0 [0195.412] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.412] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f43f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f43f500) returned 0x0 [0195.418] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.422] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.422] WriteFile (in: hFile=0x27ac, lpBuffer=0x3f43fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f43f830, lpOverlapped=0x0 | out: lpBuffer=0x3f43fb34*, lpNumberOfBytesWritten=0x3f43f830*=0x428, lpOverlapped=0x0) returned 1 [0195.423] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.423] ReadFile (in: hFile=0x27ac, lpBuffer=0x6d50000, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x3f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesRead=0x3f43f61c*=0xd00, lpOverlapped=0x0) returned 1 [0195.423] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0xfffff300, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.423] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6d50000, cbInput=0xd00, pPaddingInfo=0x0, pbIV=0x3f43f848, cbIV=0x10, pbOutput=0x6d50000, cbOutput=0x100000, pcbResult=0x3f43f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f43f848, pbOutput=0x6d50000, pcbResult=0x3f43f618) returned 0x0 [0195.423] WriteFile (in: hFile=0x27ac, lpBuffer=0x6d50000*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x3f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x6d50000*, lpNumberOfBytesWritten=0x3f43f61c*=0xd10, lpOverlapped=0x0) returned 1 [0195.423] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f43f60c | out: lpNewFilePointer=0x0) returned 1 [0195.423] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.423] WriteFile (in: hFile=0x27ac, lpBuffer=0x3f43f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f43f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f43f83c*, lpNumberOfBytesWritten=0x3f43f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.423] SetFilePointerEx (in: hFile=0x27ac, liDistanceToMove=0xd10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.423] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.424] CloseHandle (hObject=0x27ac) returned 1 [0195.424] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.play")) returned 1 [0195.429] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3329 os_tid = 0x3234 [0195.436] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.436] ReadFile (in: hFile=0x27b4, lpBuffer=0x3f57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f57f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f57fb34*, lpNumberOfBytesRead=0x3f57f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.438] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.438] ReadFile (in: hFile=0x27b4, lpBuffer=0x3f57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f57f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f57fb34*, lpNumberOfBytesRead=0x3f57f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.438] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.441] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.442] BCryptSetProperty (in: hObject=0x7325a0, pszProperty="ChainingMode", pbInput=0x3f57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7325a0) returned 0x0 [0195.442] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7325a0, phKey=0x3f57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7325a0, phKey=0x3f57f828, pbKeyObject=0x0) returned 0x0 [0195.442] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f57f500) returned 0x0 [0195.442] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.442] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f57f500) returned 0x0 [0195.461] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.466] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.466] WriteFile (in: hFile=0x27b4, lpBuffer=0x3f57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f57f830, lpOverlapped=0x0 | out: lpBuffer=0x3f57fb34*, lpNumberOfBytesWritten=0x3f57f830*=0x428, lpOverlapped=0x0) returned 1 [0195.466] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.466] ReadFile (in: hFile=0x27b4, lpBuffer=0x6e50000, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x3f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesRead=0x3f57f61c*=0x8e0, lpOverlapped=0x0) returned 1 [0195.467] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xfffff720, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.467] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6e50000, cbInput=0x8e0, pPaddingInfo=0x0, pbIV=0x3f57f848, cbIV=0x10, pbOutput=0x6e50000, cbOutput=0x100000, pcbResult=0x3f57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f57f848, pbOutput=0x6e50000, pcbResult=0x3f57f618) returned 0x0 [0195.467] WriteFile (in: hFile=0x27b4, lpBuffer=0x6e50000*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x3f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x6e50000*, lpNumberOfBytesWritten=0x3f57f61c*=0x8f0, lpOverlapped=0x0) returned 1 [0195.467] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f57f60c | out: lpNewFilePointer=0x0) returned 1 [0195.467] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.467] WriteFile (in: hFile=0x27b4, lpBuffer=0x3f57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f57f83c*, lpNumberOfBytesWritten=0x3f57f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.467] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x8f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.467] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.467] CloseHandle (hObject=0x27b4) returned 1 [0195.468] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.play")) returned 1 [0195.473] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3330 os_tid = 0x3238 [0195.480] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.480] ReadFile (in: hFile=0x27bc, lpBuffer=0x3f6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3f6bfb34*, lpNumberOfBytesRead=0x3f6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.481] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.482] ReadFile (in: hFile=0x27bc, lpBuffer=0x3f6bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f6bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3f6bfb34*, lpNumberOfBytesRead=0x3f6bf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.485] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.485] BCryptSetProperty (in: hObject=0x736300, pszProperty="ChainingMode", pbInput=0x3f6bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736300) returned 0x0 [0195.486] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736300, phKey=0x3f6bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736300, phKey=0x3f6bf828, pbKeyObject=0x0) returned 0x0 [0195.486] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f6bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f6bf500) returned 0x0 [0195.486] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.486] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f6bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f6bf500) returned 0x0 [0195.492] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.497] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.497] WriteFile (in: hFile=0x27bc, lpBuffer=0x3f6bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f6bf830, lpOverlapped=0x0 | out: lpBuffer=0x3f6bfb34*, lpNumberOfBytesWritten=0x3f6bf830*=0x428, lpOverlapped=0x0) returned 1 [0195.498] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.498] ReadFile (in: hFile=0x27bc, lpBuffer=0x6f50000, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x3f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesRead=0x3f6bf61c*=0xe14, lpOverlapped=0x0) returned 1 [0195.498] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0xfffff1ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.498] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6f50000, cbInput=0xe14, pPaddingInfo=0x0, pbIV=0x3f6bf848, cbIV=0x10, pbOutput=0x6f50000, cbOutput=0x100000, pcbResult=0x3f6bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f6bf848, pbOutput=0x6f50000, pcbResult=0x3f6bf618) returned 0x0 [0195.498] WriteFile (in: hFile=0x27bc, lpBuffer=0x6f50000*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6f50000*, lpNumberOfBytesWritten=0x3f6bf61c*=0xe20, lpOverlapped=0x0) returned 1 [0195.498] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f6bf60c | out: lpNewFilePointer=0x0) returned 1 [0195.498] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.498] WriteFile (in: hFile=0x27bc, lpBuffer=0x3f6bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f6bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3f6bf83c*, lpNumberOfBytesWritten=0x3f6bf61c*=0x8, lpOverlapped=0x0) returned 1 [0195.498] SetFilePointerEx (in: hFile=0x27bc, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.498] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.499] CloseHandle (hObject=0x27bc) returned 1 [0195.499] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.play")) returned 1 [0195.504] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3331 os_tid = 0x323c [0195.510] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.510] ReadFile (in: hFile=0x27c4, lpBuffer=0x3f7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3f7ffb34*, lpNumberOfBytesRead=0x3f7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.512] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.512] ReadFile (in: hFile=0x27c4, lpBuffer=0x3f7ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f7ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3f7ffb34*, lpNumberOfBytesRead=0x3f7ff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.513] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.517] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.517] BCryptSetProperty (in: hObject=0x736250, pszProperty="ChainingMode", pbInput=0x3f7ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x736250) returned 0x0 [0195.517] BCryptGenerateSymmetricKey (in: hAlgorithm=0x736250, phKey=0x3f7ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x736250, phKey=0x3f7ff828, pbKeyObject=0x0) returned 0x0 [0195.517] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f7ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f7ff500) returned 0x0 [0195.517] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.517] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f7ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f7ff500) returned 0x0 [0195.523] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.527] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.527] WriteFile (in: hFile=0x27c4, lpBuffer=0x3f7ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f7ff830, lpOverlapped=0x0 | out: lpBuffer=0x3f7ffb34*, lpNumberOfBytesWritten=0x3f7ff830*=0x428, lpOverlapped=0x0) returned 1 [0195.528] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.528] ReadFile (in: hFile=0x27c4, lpBuffer=0x7050000, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x3f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesRead=0x3f7ff61c*=0x17c4, lpOverlapped=0x0) returned 1 [0195.528] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xffffe83c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.528] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x7050000, cbInput=0x17c4, pPaddingInfo=0x0, pbIV=0x3f7ff848, cbIV=0x10, pbOutput=0x7050000, cbOutput=0x100000, pcbResult=0x3f7ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f7ff848, pbOutput=0x7050000, pcbResult=0x3f7ff618) returned 0x0 [0195.528] WriteFile (in: hFile=0x27c4, lpBuffer=0x7050000*, nNumberOfBytesToWrite=0x17d0, lpNumberOfBytesWritten=0x3f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x7050000*, lpNumberOfBytesWritten=0x3f7ff61c*=0x17d0, lpOverlapped=0x0) returned 1 [0195.528] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7ff60c | out: lpNewFilePointer=0x0) returned 1 [0195.528] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.528] WriteFile (in: hFile=0x27c4, lpBuffer=0x3f7ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f7ff83c*, lpNumberOfBytesWritten=0x3f7ff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.528] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0x17d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.528] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.529] CloseHandle (hObject=0x27c4) returned 1 [0195.529] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.play")) returned 1 [0195.534] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3332 os_tid = 0x3240 [0195.540] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.541] ReadFile (in: hFile=0x27cc, lpBuffer=0x3f93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f93f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f93fb34*, lpNumberOfBytesRead=0x3f93f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.542] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.543] ReadFile (in: hFile=0x27cc, lpBuffer=0x3f93fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3f93f85c, lpOverlapped=0x0 | out: lpBuffer=0x3f93fb34*, lpNumberOfBytesRead=0x3f93f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.543] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.546] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.546] BCryptSetProperty (in: hObject=0x7361a0, pszProperty="ChainingMode", pbInput=0x3f93f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7361a0) returned 0x0 [0195.546] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7361a0, phKey=0x3f93f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7361a0, phKey=0x3f93f828, pbKeyObject=0x0) returned 0x0 [0195.546] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3f93f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3f93f500) returned 0x0 [0195.547] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.547] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3f93f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3f93f500) returned 0x0 [0195.552] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.557] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.557] WriteFile (in: hFile=0x27cc, lpBuffer=0x3f93fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3f93f830, lpOverlapped=0x0 | out: lpBuffer=0x3f93fb34*, lpNumberOfBytesWritten=0x3f93f830*=0x428, lpOverlapped=0x0) returned 1 [0195.558] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.558] ReadFile (in: hFile=0x27cc, lpBuffer=0x7150000, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x3f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesRead=0x3f93f61c*=0xd28, lpOverlapped=0x0) returned 1 [0195.558] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0xfffff2d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.558] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x7150000, cbInput=0xd28, pPaddingInfo=0x0, pbIV=0x3f93f848, cbIV=0x10, pbOutput=0x7150000, cbOutput=0x100000, pcbResult=0x3f93f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3f93f848, pbOutput=0x7150000, pcbResult=0x3f93f618) returned 0x0 [0195.558] WriteFile (in: hFile=0x27cc, lpBuffer=0x7150000*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x3f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x7150000*, lpNumberOfBytesWritten=0x3f93f61c*=0xd30, lpOverlapped=0x0) returned 1 [0195.558] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f93f60c | out: lpNewFilePointer=0x0) returned 1 [0195.558] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.558] WriteFile (in: hFile=0x27cc, lpBuffer=0x3f93f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f93f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f93f83c*, lpNumberOfBytesWritten=0x3f93f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.559] SetFilePointerEx (in: hFile=0x27cc, liDistanceToMove=0xd30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.559] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.559] CloseHandle (hObject=0x27cc) returned 1 [0195.559] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.play")) returned 1 [0195.564] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3333 os_tid = 0x3244 [0195.569] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.570] ReadFile (in: hFile=0x27d4, lpBuffer=0x3fa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fa7fb34*, lpNumberOfBytesRead=0x3fa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.571] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.571] ReadFile (in: hFile=0x27d4, lpBuffer=0x3fa7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fa7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fa7fb34*, lpNumberOfBytesRead=0x3fa7f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.571] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.575] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.575] BCryptSetProperty (in: hObject=0x7363b0, pszProperty="ChainingMode", pbInput=0x3fa7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7363b0) returned 0x0 [0195.575] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7363b0, phKey=0x3fa7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7363b0, phKey=0x3fa7f828, pbKeyObject=0x0) returned 0x0 [0195.575] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fa7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fa7f500) returned 0x0 [0195.575] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.575] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fa7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fa7f500) returned 0x0 [0195.581] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.585] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.585] WriteFile (in: hFile=0x27d4, lpBuffer=0x3fa7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fa7f830, lpOverlapped=0x0 | out: lpBuffer=0x3fa7fb34*, lpNumberOfBytesWritten=0x3fa7f830*=0x428, lpOverlapped=0x0) returned 1 [0195.586] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.586] ReadFile (in: hFile=0x27d4, lpBuffer=0x7250000, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x3fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesRead=0x3fa7f61c*=0xc74, lpOverlapped=0x0) returned 1 [0195.586] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xfffff38c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.586] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x7250000, cbInput=0xc74, pPaddingInfo=0x0, pbIV=0x3fa7f848, cbIV=0x10, pbOutput=0x7250000, cbOutput=0x100000, pcbResult=0x3fa7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fa7f848, pbOutput=0x7250000, pcbResult=0x3fa7f618) returned 0x0 [0195.586] WriteFile (in: hFile=0x27d4, lpBuffer=0x7250000*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x3fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7250000*, lpNumberOfBytesWritten=0x3fa7f61c*=0xc80, lpOverlapped=0x0) returned 1 [0195.586] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fa7f60c | out: lpNewFilePointer=0x0) returned 1 [0195.586] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.586] WriteFile (in: hFile=0x27d4, lpBuffer=0x3fa7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fa7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3fa7f83c*, lpNumberOfBytesWritten=0x3fa7f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.587] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.587] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.587] CloseHandle (hObject=0x27d4) returned 1 [0195.587] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.play")) returned 1 [0195.592] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3334 os_tid = 0x3248 [0195.597] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.597] ReadFile (in: hFile=0x27dc, lpBuffer=0x3fbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3fbbfb34*, lpNumberOfBytesRead=0x3fbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.599] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.599] ReadFile (in: hFile=0x27dc, lpBuffer=0x3fbbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fbbf85c, lpOverlapped=0x0 | out: lpBuffer=0x3fbbfb34*, lpNumberOfBytesRead=0x3fbbf85c*=0x428, lpOverlapped=0x0) returned 1 [0195.599] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.603] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.603] BCryptSetProperty (in: hObject=0x735f90, pszProperty="ChainingMode", pbInput=0x3fbbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735f90) returned 0x0 [0195.603] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735f90, phKey=0x3fbbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735f90, phKey=0x3fbbf828, pbKeyObject=0x0) returned 0x0 [0195.603] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fbbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fbbf500) returned 0x0 [0195.604] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.604] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fbbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fbbf500) returned 0x0 [0195.609] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.613] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.613] WriteFile (in: hFile=0x27dc, lpBuffer=0x3fbbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fbbf830, lpOverlapped=0x0 | out: lpBuffer=0x3fbbfb34*, lpNumberOfBytesWritten=0x3fbbf830*=0x428, lpOverlapped=0x0) returned 1 [0195.614] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.614] ReadFile (in: hFile=0x27dc, lpBuffer=0x7350000, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x3fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesRead=0x3fbbf61c*=0xcec, lpOverlapped=0x0) returned 1 [0195.614] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0xfffff314, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.614] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x7350000, cbInput=0xcec, pPaddingInfo=0x0, pbIV=0x3fbbf848, cbIV=0x10, pbOutput=0x7350000, cbOutput=0x100000, pcbResult=0x3fbbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fbbf848, pbOutput=0x7350000, pcbResult=0x3fbbf618) returned 0x0 [0195.614] WriteFile (in: hFile=0x27dc, lpBuffer=0x7350000*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x7350000*, lpNumberOfBytesWritten=0x3fbbf61c*=0xcf0, lpOverlapped=0x0) returned 1 [0195.615] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbbf60c | out: lpNewFilePointer=0x0) returned 1 [0195.615] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.615] WriteFile (in: hFile=0x27dc, lpBuffer=0x3fbbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fbbf61c, lpOverlapped=0x0 | out: lpBuffer=0x3fbbf83c*, lpNumberOfBytesWritten=0x3fbbf61c*=0x8, lpOverlapped=0x0) returned 1 [0195.615] SetFilePointerEx (in: hFile=0x27dc, liDistanceToMove=0xcf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.615] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.615] CloseHandle (hObject=0x27dc) returned 1 [0195.615] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.play")) returned 1 [0195.621] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3335 os_tid = 0x324c [0195.626] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.626] ReadFile (in: hFile=0x27e4, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.628] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.628] ReadFile (in: hFile=0x27e4, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0195.628] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.631] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.631] BCryptSetProperty (in: hObject=0x735ac0, pszProperty="ChainingMode", pbInput=0x3fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735ac0) returned 0x0 [0195.632] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735ac0, phKey=0x3fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735ac0, phKey=0x3fcff828, pbKeyObject=0x0) returned 0x0 [0195.632] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fcff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fcff500) returned 0x0 [0195.632] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.632] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fcff500) returned 0x0 [0195.637] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.642] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.642] WriteFile (in: hFile=0x27e4, lpBuffer=0x3fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fcff830, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesWritten=0x3fcff830*=0x428, lpOverlapped=0x0) returned 1 [0195.643] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.643] ReadFile (in: hFile=0x27e4, lpBuffer=0x7450000, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesRead=0x3fcff61c*=0xbd8, lpOverlapped=0x0) returned 1 [0195.643] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffff428, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.643] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x7450000, cbInput=0xbd8, pPaddingInfo=0x0, pbIV=0x3fcff848, cbIV=0x10, pbOutput=0x7450000, cbOutput=0x100000, pcbResult=0x3fcff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fcff848, pbOutput=0x7450000, pcbResult=0x3fcff618) returned 0x0 [0195.643] WriteFile (in: hFile=0x27e4, lpBuffer=0x7450000*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x7450000*, lpNumberOfBytesWritten=0x3fcff61c*=0xbe0, lpOverlapped=0x0) returned 1 [0195.643] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fcff60c | out: lpNewFilePointer=0x0) returned 1 [0195.643] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.643] WriteFile (in: hFile=0x27e4, lpBuffer=0x3fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3fcff83c*, lpNumberOfBytesWritten=0x3fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0195.643] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.643] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.643] CloseHandle (hObject=0x27e4) returned 1 [0195.644] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.play")) returned 1 [0195.653] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3336 os_tid = 0x3250 [0195.660] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.660] ReadFile (in: hFile=0x27ec, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.661] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.661] ReadFile (in: hFile=0x27ec, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.661] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.665] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.666] BCryptSetProperty (in: hObject=0x735d80, pszProperty="ChainingMode", pbInput=0x3fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735d80) returned 0x0 [0195.666] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735d80, phKey=0x3fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735d80, phKey=0x3fe3f828, pbKeyObject=0x0) returned 0x0 [0195.666] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fe3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fe3f500) returned 0x0 [0195.666] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.666] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fe3f500) returned 0x0 [0195.671] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.675] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.675] WriteFile (in: hFile=0x27ec, lpBuffer=0x3fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesWritten=0x3fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0195.675] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.675] ReadFile (in: hFile=0x27ec, lpBuffer=0x7550000, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesRead=0x3fe3f61c*=0x948, lpOverlapped=0x0) returned 1 [0195.675] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0xfffff6b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.675] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x7550000, cbInput=0x948, pPaddingInfo=0x0, pbIV=0x3fe3f848, cbIV=0x10, pbOutput=0x7550000, cbOutput=0x100000, pcbResult=0x3fe3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fe3f848, pbOutput=0x7550000, pcbResult=0x3fe3f618) returned 0x0 [0195.675] WriteFile (in: hFile=0x27ec, lpBuffer=0x7550000*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x7550000*, lpNumberOfBytesWritten=0x3fe3f61c*=0x950, lpOverlapped=0x0) returned 1 [0195.676] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0195.676] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.676] WriteFile (in: hFile=0x27ec, lpBuffer=0x3fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3f83c*, lpNumberOfBytesWritten=0x3fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.676] SetFilePointerEx (in: hFile=0x27ec, liDistanceToMove=0x950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.676] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.676] CloseHandle (hObject=0x27ec) returned 1 [0195.676] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.play")) returned 1 [0195.681] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3337 os_tid = 0x3254 [0195.687] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.687] ReadFile (in: hFile=0x27f4, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.689] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.689] ReadFile (in: hFile=0x27f4, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0195.689] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0195.692] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0195.692] BCryptSetProperty (in: hObject=0x735cd0, pszProperty="ChainingMode", pbInput=0x3ff7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x735cd0) returned 0x0 [0195.692] BCryptGenerateSymmetricKey (in: hAlgorithm=0x735cd0, phKey=0x3ff7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x735cd0, phKey=0x3ff7f828, pbKeyObject=0x0) returned 0x0 [0195.692] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ff7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ff7f500) returned 0x0 [0195.693] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0195.693] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ff7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ff7f500) returned 0x0 [0195.698] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.701] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.701] WriteFile (in: hFile=0x27f4, lpBuffer=0x3ff7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ff7f830, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesWritten=0x3ff7f830*=0x428, lpOverlapped=0x0) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.702] ReadFile (in: hFile=0x27f4, lpBuffer=0x7650000, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesRead=0x3ff7f61c*=0xc84, lpOverlapped=0x0) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffff37c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.702] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x7650000, cbInput=0xc84, pPaddingInfo=0x0, pbIV=0x3ff7f848, cbIV=0x10, pbOutput=0x7650000, cbOutput=0x100000, pcbResult=0x3ff7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ff7f848, pbOutput=0x7650000, pcbResult=0x3ff7f618) returned 0x0 [0195.702] WriteFile (in: hFile=0x27f4, lpBuffer=0x7650000*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x7650000*, lpNumberOfBytesWritten=0x3ff7f61c*=0xc90, lpOverlapped=0x0) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ff7f60c | out: lpNewFilePointer=0x0) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.702] WriteFile (in: hFile=0x27f4, lpBuffer=0x3ff7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7f83c*, lpNumberOfBytesWritten=0x3ff7f61c*=0x8, lpOverlapped=0x0) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xc90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.702] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0195.702] CloseHandle (hObject=0x27f4) returned 1 [0195.703] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.play")) returned 1 [0195.707] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3338 os_tid = 0x3258 [0195.776] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0195.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0195.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f030c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2728 [0195.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2720 [0195.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0324, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2718 [0195.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2710 [0195.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f033c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2708 [0195.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2700 [0195.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0354, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f8 [0195.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f0 [0195.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f036c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e8 [0195.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e0 [0195.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0384, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d8 [0195.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26bc [0195.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f039c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d0 [0195.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26cc [0195.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d0 [0195.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f4 [0195.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2590 [0195.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0195.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e94 [0195.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb4 [0195.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f03fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc [0195.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec4 [0195.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0414, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4 [0195.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee4 [0195.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f042c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0195.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0195.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0444, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0195.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0195.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f045c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0195.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0195.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0474, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0195.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0195.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f048c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0195.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2194 [0195.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x267c [0195.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2604 [0195.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x265c [0195.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2624 [0195.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2184 [0195.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2174 [0195.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0195.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24 [0195.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f14 [0195.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fec [0195.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f051c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ffc [0195.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2018 [0195.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0534, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b4 [0195.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24bc [0195.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f054c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ac [0195.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2560 [0195.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0564, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2558 [0195.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c4 [0195.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f057c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24cc [0195.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0195.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0594, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27fc [0195.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2804 [0195.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2808 [0195.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280c [0195.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2810 [0195.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2814 [0195.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2970 [0196.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2974 [0196.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f05f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2978 [0196.598] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x788, bWaitAll=1, dwMilliseconds=0x578) returned 0x102 [0199.653] CloseHandle (hObject=0x788) returned 1 [0199.653] CloseHandle (hObject=0x2728) returned 1 [0199.653] CloseHandle (hObject=0x2720) returned 1 [0199.654] CloseHandle (hObject=0x2718) returned 1 [0199.654] CloseHandle (hObject=0x2710) returned 1 [0199.654] CloseHandle (hObject=0x2708) returned 1 [0199.654] CloseHandle (hObject=0x2700) returned 1 [0199.654] CloseHandle (hObject=0x26f8) returned 1 [0199.654] CloseHandle (hObject=0x26f0) returned 1 [0199.654] CloseHandle (hObject=0x26e8) returned 1 [0199.654] CloseHandle (hObject=0x26e0) returned 1 [0199.654] CloseHandle (hObject=0x26d8) returned 1 [0199.654] CloseHandle (hObject=0x26bc) returned 1 [0199.654] CloseHandle (hObject=0x26d0) returned 1 [0199.654] CloseHandle (hObject=0x26cc) returned 1 [0199.654] CloseHandle (hObject=0x25d0) returned 1 [0199.654] CloseHandle (hObject=0x25f4) returned 1 [0199.654] CloseHandle (hObject=0x2590) returned 1 [0199.654] CloseHandle (hObject=0x76c) returned 1 [0199.654] CloseHandle (hObject=0x1e94) returned 1 [0199.654] CloseHandle (hObject=0x1eb4) returned 1 [0199.654] CloseHandle (hObject=0x1ecc) returned 1 [0199.654] CloseHandle (hObject=0x1ec4) returned 1 [0199.654] CloseHandle (hObject=0x1ed4) returned 1 [0199.654] CloseHandle (hObject=0x1ee4) returned 1 [0199.654] CloseHandle (hObject=0x6bc) returned 1 [0199.655] CloseHandle (hObject=0x1898) returned 1 [0199.655] CloseHandle (hObject=0x18a8) returned 1 [0199.655] CloseHandle (hObject=0x18b0) returned 1 [0199.655] CloseHandle (hObject=0x18c8) returned 1 [0199.655] CloseHandle (hObject=0x18d8) returned 1 [0199.655] CloseHandle (hObject=0x18e8) returned 1 [0199.655] CloseHandle (hObject=0x18f0) returned 1 [0199.655] CloseHandle (hObject=0x1900) returned 1 [0199.655] CloseHandle (hObject=0x2194) returned 1 [0199.655] CloseHandle (hObject=0x267c) returned 1 [0199.655] CloseHandle (hObject=0x2604) returned 1 [0199.655] CloseHandle (hObject=0x265c) returned 1 [0199.655] CloseHandle (hObject=0x2624) returned 1 [0199.655] CloseHandle (hObject=0x2184) returned 1 [0199.655] CloseHandle (hObject=0x2174) returned 1 [0199.655] CloseHandle (hObject=0x758) returned 1 [0199.655] CloseHandle (hObject=0x1f24) returned 1 [0199.655] CloseHandle (hObject=0x1f14) returned 1 [0199.655] CloseHandle (hObject=0x1fec) returned 1 [0199.655] CloseHandle (hObject=0x1ffc) returned 1 [0199.655] CloseHandle (hObject=0x2018) returned 1 [0199.656] CloseHandle (hObject=0x24b4) returned 1 [0199.656] CloseHandle (hObject=0x24bc) returned 1 [0199.656] CloseHandle (hObject=0x26ac) returned 1 [0199.656] CloseHandle (hObject=0x2560) returned 1 [0199.656] CloseHandle (hObject=0x2558) returned 1 [0199.656] CloseHandle (hObject=0x24c4) returned 1 [0199.656] CloseHandle (hObject=0x24cc) returned 1 [0199.656] CloseHandle (hObject=0x774) returned 1 [0199.656] CloseHandle (hObject=0x27fc) returned 1 [0199.656] CloseHandle (hObject=0x2804) returned 1 [0199.656] CloseHandle (hObject=0x2808) returned 1 [0199.656] CloseHandle (hObject=0x280c) returned 1 [0199.656] CloseHandle (hObject=0x2810) returned 1 [0199.656] CloseHandle (hObject=0x2814) returned 1 [0199.656] CloseHandle (hObject=0x2970) returned 1 [0199.656] CloseHandle (hObject=0x2974) returned 1 [0199.656] CloseHandle (hObject=0x2978) returned 1 [0199.656] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3339 os_tid = 0x325c [0196.009] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.010] ReadFile (in: hFile=0x27f4, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.012] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.012] ReadFile (in: hFile=0x27f4, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.012] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.022] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.023] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1528f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0196.023] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0) returned 0x0 [0196.023] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1528f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0196.023] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.023] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1528f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0196.029] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.034] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.034] WriteFile (in: hFile=0x27f4, lpBuffer=0x1528fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1528f830, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesWritten=0x1528f830*=0x428, lpOverlapped=0x0) returned 1 [0196.035] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.035] ReadFile (in: hFile=0x27f4, lpBuffer=0x2750000, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1528f61c*=0xb2c, lpOverlapped=0x0) returned 1 [0196.035] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffff4d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.035] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0xb2c, pPaddingInfo=0x0, pbIV=0x1528f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1528f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1528f848, pbOutput=0x2750000, pcbResult=0x1528f618) returned 0x0 [0196.035] WriteFile (in: hFile=0x27f4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1528f61c*=0xb30, lpOverlapped=0x0) returned 1 [0196.035] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1528f60c | out: lpNewFilePointer=0x0) returned 1 [0196.035] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.035] WriteFile (in: hFile=0x27f4, lpBuffer=0x1528f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x1528f83c*, lpNumberOfBytesWritten=0x1528f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.035] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xb30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.036] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.036] CloseHandle (hObject=0x27f4) returned 1 [0196.036] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.play")) returned 1 [0196.043] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3340 os_tid = 0x3260 [0196.085] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.085] ReadFile (in: hFile=0x27e4, lpBuffer=0x1550fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1550f85c, lpOverlapped=0x0 | out: lpBuffer=0x1550fb34*, lpNumberOfBytesRead=0x1550f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.087] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.087] ReadFile (in: hFile=0x27e4, lpBuffer=0x1550fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1550f85c, lpOverlapped=0x0 | out: lpBuffer=0x1550fb34*, lpNumberOfBytesRead=0x1550f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.087] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.092] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.092] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1550f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0196.092] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1550f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1550f828, pbKeyObject=0x0) returned 0x0 [0196.092] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1550f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1550f500) returned 0x0 [0196.092] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.092] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1550f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1550f500) returned 0x0 [0196.097] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.101] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.101] WriteFile (in: hFile=0x27e4, lpBuffer=0x1550fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1550f830, lpOverlapped=0x0 | out: lpBuffer=0x1550fb34*, lpNumberOfBytesWritten=0x1550f830*=0x428, lpOverlapped=0x0) returned 1 [0196.102] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.102] ReadFile (in: hFile=0x27e4, lpBuffer=0x2850000, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x1550f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1550f61c*=0xe64, lpOverlapped=0x0) returned 1 [0196.102] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffff19c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.102] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0xe64, pPaddingInfo=0x0, pbIV=0x1550f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1550f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1550f848, pbOutput=0x2850000, pcbResult=0x1550f618) returned 0x0 [0196.102] WriteFile (in: hFile=0x27e4, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x1550f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1550f61c*=0xe70, lpOverlapped=0x0) returned 1 [0196.102] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1550f60c | out: lpNewFilePointer=0x0) returned 1 [0196.103] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.103] WriteFile (in: hFile=0x27e4, lpBuffer=0x1550f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1550f61c, lpOverlapped=0x0 | out: lpBuffer=0x1550f83c*, lpNumberOfBytesWritten=0x1550f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.103] SetFilePointerEx (in: hFile=0x27e4, liDistanceToMove=0xe70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.103] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.103] CloseHandle (hObject=0x27e4) returned 1 [0196.103] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.play")) returned 1 [0196.108] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3341 os_tid = 0x3264 [0196.114] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.114] ReadFile (in: hFile=0x27d4, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.116] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.116] ReadFile (in: hFile=0x27d4, lpBuffer=0x1580fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1580f85c, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesRead=0x1580f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.120] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x1580f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0196.120] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x1580f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x1580f828, pbKeyObject=0x0) returned 0x0 [0196.120] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1580f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0196.120] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.120] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1580f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1580f500) returned 0x0 [0196.125] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.129] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.129] WriteFile (in: hFile=0x27d4, lpBuffer=0x1580fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1580f830, lpOverlapped=0x0 | out: lpBuffer=0x1580fb34*, lpNumberOfBytesWritten=0x1580f830*=0x428, lpOverlapped=0x0) returned 1 [0196.129] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.129] ReadFile (in: hFile=0x27d4, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x1580f61c*=0x1e98, lpOverlapped=0x0) returned 1 [0196.130] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xffffe168, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.130] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x1e98, pPaddingInfo=0x0, pbIV=0x1580f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x1580f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1580f848, pbOutput=0x2950000, pcbResult=0x1580f618) returned 0x0 [0196.130] WriteFile (in: hFile=0x27d4, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x1580f61c*=0x1ea0, lpOverlapped=0x0) returned 1 [0196.131] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1580f60c | out: lpNewFilePointer=0x0) returned 1 [0196.131] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.131] WriteFile (in: hFile=0x27d4, lpBuffer=0x1580f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1580f61c, lpOverlapped=0x0 | out: lpBuffer=0x1580f83c*, lpNumberOfBytesWritten=0x1580f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.131] SetFilePointerEx (in: hFile=0x27d4, liDistanceToMove=0x1ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.131] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.131] CloseHandle (hObject=0x27d4) returned 1 [0196.131] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.play")) returned 1 [0196.136] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3342 os_tid = 0x3268 [0196.115] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.141] ReadFile (in: hFile=0x27c4, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.143] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.143] ReadFile (in: hFile=0x27c4, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.143] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.146] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.146] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0196.146] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0196.146] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0196.147] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.147] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0196.152] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.155] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.155] WriteFile (in: hFile=0x27c4, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0196.156] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.156] ReadFile (in: hFile=0x27c4, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x1590f61c*=0xd24, lpOverlapped=0x0) returned 1 [0196.156] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xfffff2dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.156] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0xd24, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2a50000, pcbResult=0x1590f618) returned 0x0 [0196.156] WriteFile (in: hFile=0x27c4, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x1590f61c*=0xd30, lpOverlapped=0x0) returned 1 [0196.156] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0196.157] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.157] WriteFile (in: hFile=0x27c4, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.157] SetFilePointerEx (in: hFile=0x27c4, liDistanceToMove=0xd30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.157] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.157] CloseHandle (hObject=0x27c4) returned 1 [0196.157] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.play")) returned 1 [0196.162] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3343 os_tid = 0x326c [0196.167] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.167] ReadFile (in: hFile=0x27b4, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.170] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.170] ReadFile (in: hFile=0x27b4, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.170] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.173] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0196.173] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15a0f828, pbKeyObject=0x0) returned 0x0 [0196.173] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15a0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15a0f500) returned 0x0 [0196.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.174] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15a0f500) returned 0x0 [0196.179] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.183] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.183] WriteFile (in: hFile=0x27b4, lpBuffer=0x15a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a0f830, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesWritten=0x15a0f830*=0x428, lpOverlapped=0x0) returned 1 [0196.183] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.183] ReadFile (in: hFile=0x27b4, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15a0f61c*=0x2120, lpOverlapped=0x0) returned 1 [0196.184] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xffffdee0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.184] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0x2120, pPaddingInfo=0x0, pbIV=0x15a0f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15a0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a0f848, pbOutput=0x2b50000, pcbResult=0x15a0f618) returned 0x0 [0196.184] WriteFile (in: hFile=0x27b4, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15a0f61c*=0x2130, lpOverlapped=0x0) returned 1 [0196.184] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a0f60c | out: lpNewFilePointer=0x0) returned 1 [0196.184] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.184] WriteFile (in: hFile=0x27b4, lpBuffer=0x15a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a0f83c*, lpNumberOfBytesWritten=0x15a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.184] SetFilePointerEx (in: hFile=0x27b4, liDistanceToMove=0x2130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.184] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.184] CloseHandle (hObject=0x27b4) returned 1 [0196.184] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.play")) returned 1 [0196.189] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3344 os_tid = 0x3270 [0196.195] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.195] ReadFile (in: hFile=0x27a4, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.196] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.196] ReadFile (in: hFile=0x27a4, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.196] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.200] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.200] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x15b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0196.200] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x15b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x15b4f828, pbKeyObject=0x0) returned 0x0 [0196.200] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15b4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15b4f500) returned 0x0 [0196.200] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.200] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15b4f500) returned 0x0 [0196.205] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.209] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.209] WriteFile (in: hFile=0x27a4, lpBuffer=0x15b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b4f830, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesWritten=0x15b4f830*=0x428, lpOverlapped=0x0) returned 1 [0196.209] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.209] ReadFile (in: hFile=0x27a4, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x15b4f61c*=0x5080, lpOverlapped=0x0) returned 1 [0196.210] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xffffaf80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.210] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2c50000, cbInput=0x5080, pPaddingInfo=0x0, pbIV=0x15b4f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x15b4f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15b4f848, pbOutput=0x2c50000, pcbResult=0x15b4f618) returned 0x0 [0196.210] WriteFile (in: hFile=0x27a4, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x15b4f61c*=0x5090, lpOverlapped=0x0) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b4f60c | out: lpNewFilePointer=0x0) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.211] WriteFile (in: hFile=0x27a4, lpBuffer=0x15b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b4f83c*, lpNumberOfBytesWritten=0x15b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x27a4, liDistanceToMove=0x5090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.211] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.211] CloseHandle (hObject=0x27a4) returned 1 [0196.211] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.214] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.play")) returned 1 [0196.216] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3345 os_tid = 0x3274 [0196.222] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.222] ReadFile (in: hFile=0x2794, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.224] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.224] ReadFile (in: hFile=0x2794, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.224] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.228] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x15c8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0196.228] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x15c8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x15c8f828, pbKeyObject=0x0) returned 0x0 [0196.228] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15c8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15c8f500) returned 0x0 [0196.228] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.228] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15c8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15c8f500) returned 0x0 [0196.233] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.237] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.237] WriteFile (in: hFile=0x2794, lpBuffer=0x15c8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15c8f830, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesWritten=0x15c8f830*=0x428, lpOverlapped=0x0) returned 1 [0196.237] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.237] ReadFile (in: hFile=0x2794, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x15c8f61c*=0x1fc8, lpOverlapped=0x0) returned 1 [0196.238] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xffffe038, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.238] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x1fc8, pPaddingInfo=0x0, pbIV=0x15c8f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x15c8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15c8f848, pbOutput=0x2d50000, pcbResult=0x15c8f618) returned 0x0 [0196.238] WriteFile (in: hFile=0x2794, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x15c8f61c*=0x1fd0, lpOverlapped=0x0) returned 1 [0196.238] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15c8f60c | out: lpNewFilePointer=0x0) returned 1 [0196.238] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.238] WriteFile (in: hFile=0x2794, lpBuffer=0x15c8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15c8f83c*, lpNumberOfBytesWritten=0x15c8f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.239] SetFilePointerEx (in: hFile=0x2794, liDistanceToMove=0x1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.239] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.239] CloseHandle (hObject=0x2794) returned 1 [0196.239] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.243] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.play")) returned 1 [0196.244] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3346 os_tid = 0x3278 [0196.250] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.250] ReadFile (in: hFile=0x2784, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0196.251] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.252] ReadFile (in: hFile=0x2784, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0196.252] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.255] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.255] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x15dcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0196.255] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x15dcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x15dcf828, pbKeyObject=0x0) returned 0x0 [0196.255] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15dcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15dcf500) returned 0x0 [0196.255] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.256] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15dcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15dcf500) returned 0x0 [0196.260] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.264] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.264] WriteFile (in: hFile=0x2784, lpBuffer=0x15dcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15dcf830, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesWritten=0x15dcf830*=0x428, lpOverlapped=0x0) returned 1 [0196.265] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.265] ReadFile (in: hFile=0x2784, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x15dcf61c*=0x28ec, lpOverlapped=0x0) returned 1 [0196.266] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0xffffd714, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.266] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0x28ec, pPaddingInfo=0x0, pbIV=0x15dcf848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x15dcf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15dcf848, pbOutput=0x2e50000, pcbResult=0x15dcf618) returned 0x0 [0196.266] WriteFile (in: hFile=0x2784, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x15dcf61c*=0x28f0, lpOverlapped=0x0) returned 1 [0196.266] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15dcf60c | out: lpNewFilePointer=0x0) returned 1 [0196.266] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.266] WriteFile (in: hFile=0x2784, lpBuffer=0x15dcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15dcf83c*, lpNumberOfBytesWritten=0x15dcf61c*=0x8, lpOverlapped=0x0) returned 1 [0196.266] SetFilePointerEx (in: hFile=0x2784, liDistanceToMove=0x28f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.266] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.266] CloseHandle (hObject=0x2784) returned 1 [0196.266] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.play")) returned 1 [0196.272] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3347 os_tid = 0x327c [0196.277] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.277] ReadFile (in: hFile=0x2774, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.279] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.279] ReadFile (in: hFile=0x2774, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.279] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.283] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.283] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x15f0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0196.283] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x15f0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x15f0f828, pbKeyObject=0x0) returned 0x0 [0196.283] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15f0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15f0f500) returned 0x0 [0196.283] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.283] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15f0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15f0f500) returned 0x0 [0196.288] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.292] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.293] WriteFile (in: hFile=0x2774, lpBuffer=0x15f0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15f0f830, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesWritten=0x15f0f830*=0x428, lpOverlapped=0x0) returned 1 [0196.293] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.293] ReadFile (in: hFile=0x2774, lpBuffer=0x2f50000, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x15f0f61c*=0xb24, lpOverlapped=0x0) returned 1 [0196.293] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xfffff4dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.293] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2f50000, cbInput=0xb24, pPaddingInfo=0x0, pbIV=0x15f0f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x15f0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15f0f848, pbOutput=0x2f50000, pcbResult=0x15f0f618) returned 0x0 [0196.293] WriteFile (in: hFile=0x2774, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x15f0f61c*=0xb30, lpOverlapped=0x0) returned 1 [0196.293] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15f0f60c | out: lpNewFilePointer=0x0) returned 1 [0196.293] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.293] WriteFile (in: hFile=0x2774, lpBuffer=0x15f0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15f0f83c*, lpNumberOfBytesWritten=0x15f0f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.293] SetFilePointerEx (in: hFile=0x2774, liDistanceToMove=0xb30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.293] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.293] CloseHandle (hObject=0x2774) returned 1 [0196.294] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.play")) returned 1 [0196.299] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3348 os_tid = 0x3280 [0196.305] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.305] ReadFile (in: hFile=0x2764, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.307] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.308] ReadFile (in: hFile=0x2764, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.308] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.312] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.312] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0196.312] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0196.312] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0196.312] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.312] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0196.317] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.323] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.323] WriteFile (in: hFile=0x2764, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0196.324] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.324] ReadFile (in: hFile=0x2764, lpBuffer=0x3050000, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x219ff61c*=0x2fb8, lpOverlapped=0x0) returned 1 [0196.324] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xffffd048, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.325] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x2fb8, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x219ff848, pbOutput=0x3050000, pcbResult=0x219ff618) returned 0x0 [0196.325] WriteFile (in: hFile=0x2764, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x219ff61c*=0x2fc0, lpOverlapped=0x0) returned 1 [0196.325] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0196.325] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.325] WriteFile (in: hFile=0x2764, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0196.325] SetFilePointerEx (in: hFile=0x2764, liDistanceToMove=0x2fc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.325] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.325] CloseHandle (hObject=0x2764) returned 1 [0196.325] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.play")) returned 1 [0196.331] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3349 os_tid = 0x3284 [0196.336] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.337] ReadFile (in: hFile=0x2754, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.342] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0196.342] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0196.342] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0196.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.342] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0196.347] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.351] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.351] WriteFile (in: hFile=0x2754, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0196.351] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.352] ReadFile (in: hFile=0x2754, lpBuffer=0x3150000, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d37f61c*=0x53c, lpOverlapped=0x0) returned 1 [0196.352] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xfffffac4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.352] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x53c, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x3150000, pcbResult=0x2d37f618) returned 0x0 [0196.352] WriteFile (in: hFile=0x2754, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d37f61c*=0x540, lpOverlapped=0x0) returned 1 [0196.352] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0196.352] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.352] WriteFile (in: hFile=0x2754, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.352] SetFilePointerEx (in: hFile=0x2754, liDistanceToMove=0x540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.352] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.352] CloseHandle (hObject=0x2754) returned 1 [0196.352] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.play")) returned 1 [0196.357] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3350 os_tid = 0x3288 [0196.362] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.362] ReadFile (in: hFile=0x2748, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.364] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.364] ReadFile (in: hFile=0x2748, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.364] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.368] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0196.368] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0196.368] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0196.368] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.368] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0196.373] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.377] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.377] WriteFile (in: hFile=0x2748, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0196.377] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.377] ReadFile (in: hFile=0x2748, lpBuffer=0x3250000, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d47f61c*=0x1948, lpOverlapped=0x0) returned 1 [0196.378] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xffffe6b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.378] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x1948, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d47f848, pbOutput=0x3250000, pcbResult=0x2d47f618) returned 0x0 [0196.378] WriteFile (in: hFile=0x2748, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d47f61c*=0x1950, lpOverlapped=0x0) returned 1 [0196.378] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0196.378] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.379] WriteFile (in: hFile=0x2748, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.379] SetFilePointerEx (in: hFile=0x2748, liDistanceToMove=0x1950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.379] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.379] CloseHandle (hObject=0x2748) returned 1 [0196.379] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.play")) returned 1 [0196.384] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3351 os_tid = 0x328c [0196.389] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.389] ReadFile (in: hFile=0x2738, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.391] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.391] ReadFile (in: hFile=0x2738, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.391] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.394] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.395] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0196.395] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0196.395] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0196.395] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.395] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0196.400] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.404] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.404] WriteFile (in: hFile=0x2738, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0196.404] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.404] ReadFile (in: hFile=0x2738, lpBuffer=0x3350000, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d67f61c*=0x1c2c, lpOverlapped=0x0) returned 1 [0196.405] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0xffffe3d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.405] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0x1c2c, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d67f848, pbOutput=0x3350000, pcbResult=0x2d67f618) returned 0x0 [0196.405] WriteFile (in: hFile=0x2738, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d67f61c*=0x1c30, lpOverlapped=0x0) returned 1 [0196.406] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0196.406] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.406] WriteFile (in: hFile=0x2738, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.406] SetFilePointerEx (in: hFile=0x2738, liDistanceToMove=0x1c30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.406] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.406] CloseHandle (hObject=0x2738) returned 1 [0196.406] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.play")) returned 1 [0196.411] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3352 os_tid = 0x3290 [0196.420] GetLastError () returned 0x57 [0196.420] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74ba98 [0196.420] SetLastError (dwErrCode=0x57) [0196.420] IcmpCreateFile () returned 0x80c8a8 [0196.420] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738030 [0196.420] IcmpSendEcho2 (IcmpHandle=0x80c8a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4100a8c0, RequestData=0x1610ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738030, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3353 os_tid = 0x3294 [0196.427] GetLastError () returned 0x57 [0196.428] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74be20 [0196.428] SetLastError (dwErrCode=0x57) [0196.428] IcmpCreateFile () returned 0x80c8e0 [0196.428] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738080 [0196.428] IcmpSendEcho2 (IcmpHandle=0x80c8e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4200a8c0, RequestData=0x2d7bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738080, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3354 os_tid = 0x3298 [0196.430] GetLastError () returned 0x57 [0196.430] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74c1a8 [0196.430] SetLastError (dwErrCode=0x57) [0196.430] IcmpCreateFile () returned 0x80c918 [0196.430] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7380d0 [0196.430] IcmpSendEcho2 (IcmpHandle=0x80c918, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4300a8c0, RequestData=0x2d8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7380d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3355 os_tid = 0x329c [0196.431] GetLastError () returned 0x57 [0196.431] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74c530 [0196.431] SetLastError (dwErrCode=0x57) [0196.431] IcmpCreateFile () returned 0x80c950 [0196.431] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738120 [0196.432] IcmpSendEcho2 (IcmpHandle=0x80c950, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4400a8c0, RequestData=0x2da3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738120, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3356 os_tid = 0x32a0 [0196.433] GetLastError () returned 0x57 [0196.433] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74c8b8 [0196.433] SetLastError (dwErrCode=0x57) [0196.433] IcmpCreateFile () returned 0x80c988 [0196.433] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738170 [0196.433] IcmpSendEcho2 (IcmpHandle=0x80c988, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4500a8c0, RequestData=0x2db7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738170, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3357 os_tid = 0x32a4 [0196.434] GetLastError () returned 0x57 [0196.434] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74cc40 [0196.434] SetLastError (dwErrCode=0x57) [0196.434] IcmpCreateFile () returned 0x80c9c0 [0196.435] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738bc0 [0196.435] IcmpSendEcho2 (IcmpHandle=0x80c9c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4600a8c0, RequestData=0x2ddfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738bc0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3358 os_tid = 0x32a8 [0196.436] GetLastError () returned 0x57 [0196.436] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74cfc8 [0196.436] SetLastError (dwErrCode=0x57) [0196.436] IcmpCreateFile () returned 0x80c9f8 [0196.436] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738c10 [0196.436] IcmpSendEcho2 (IcmpHandle=0x80c9f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4700a8c0, RequestData=0x2df3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738c10, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3359 os_tid = 0x32ac [0196.437] GetLastError () returned 0x57 [0196.437] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74d350 [0196.437] SetLastError (dwErrCode=0x57) [0196.438] IcmpCreateFile () returned 0x80ca30 [0196.438] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738c60 [0196.438] IcmpSendEcho2 (IcmpHandle=0x80ca30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4800a8c0, RequestData=0x2e07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738c60, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3360 os_tid = 0x32b0 [0196.439] GetLastError () returned 0x57 [0196.439] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74d6d8 [0196.439] SetLastError (dwErrCode=0x57) [0196.439] IcmpCreateFile () returned 0x80ca68 [0196.439] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738cb0 [0196.439] IcmpSendEcho2 (IcmpHandle=0x80ca68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4900a8c0, RequestData=0x2e1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738cb0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3361 os_tid = 0x32b4 [0196.440] GetLastError () returned 0x57 [0196.440] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74da60 [0196.440] SetLastError (dwErrCode=0x57) [0196.440] IcmpCreateFile () returned 0x80caa0 [0196.441] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738300 [0196.441] IcmpSendEcho2 (IcmpHandle=0x80caa0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4a00a8c0, RequestData=0x2e2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738300, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3362 os_tid = 0x32b8 [0196.442] GetLastError () returned 0x57 [0196.442] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74e4f8 [0196.442] SetLastError (dwErrCode=0x57) [0196.442] IcmpCreateFile () returned 0x80cb48 [0196.442] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738350 [0196.442] IcmpSendEcho2 (IcmpHandle=0x80cb48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4b00a8c0, RequestData=0x2e43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738350, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3363 os_tid = 0x32bc [0196.443] GetLastError () returned 0x57 [0196.443] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74e880 [0196.444] SetLastError (dwErrCode=0x57) [0196.444] IcmpCreateFile () returned 0x80cb80 [0196.444] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7383a0 [0196.444] IcmpSendEcho2 (IcmpHandle=0x80cb80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4c00a8c0, RequestData=0x2e57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7383a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3364 os_tid = 0x32c0 [0196.445] GetLastError () returned 0x57 [0196.445] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a747b08 [0196.445] SetLastError (dwErrCode=0x57) [0196.445] IcmpCreateFile () returned 0x80cbb8 [0196.445] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7383f0 [0196.445] IcmpSendEcho2 (IcmpHandle=0x80cbb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4d00a8c0, RequestData=0x2e6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7383f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3365 os_tid = 0x32c4 [0196.446] GetLastError () returned 0x57 [0196.446] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a747e90 [0196.447] SetLastError (dwErrCode=0x57) [0196.447] IcmpCreateFile () returned 0x80cc28 [0196.447] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738440 [0196.447] IcmpSendEcho2 (IcmpHandle=0x80cc28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4e00a8c0, RequestData=0x2e7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738440, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3366 os_tid = 0x32c8 [0196.448] GetLastError () returned 0x57 [0196.448] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a748218 [0196.448] SetLastError (dwErrCode=0x57) [0196.448] IcmpCreateFile () returned 0x80cc60 [0196.448] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738490 [0196.448] IcmpSendEcho2 (IcmpHandle=0x80cc60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x4f00a8c0, RequestData=0x2e93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738490, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3367 os_tid = 0x32cc [0196.449] GetLastError () returned 0x57 [0196.449] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7485a0 [0196.449] SetLastError (dwErrCode=0x57) [0196.450] IcmpCreateFile () returned 0x80d398 [0196.450] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7384e0 [0196.450] IcmpSendEcho2 (IcmpHandle=0x80d398, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5000a8c0, RequestData=0x3bfbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7384e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3368 os_tid = 0x32d0 [0196.451] GetLastError () returned 0x57 [0196.451] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a748928 [0196.451] SetLastError (dwErrCode=0x57) [0196.451] IcmpCreateFile () returned 0x80d3d0 [0196.451] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738530 [0196.451] IcmpSendEcho2 (IcmpHandle=0x80d3d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5100a8c0, RequestData=0x3c0fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738530, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3369 os_tid = 0x32d4 [0196.452] GetLastError () returned 0x57 [0196.452] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a748cb0 [0196.452] SetLastError (dwErrCode=0x57) [0196.452] IcmpCreateFile () returned 0x80d408 [0196.452] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738580 [0196.452] IcmpSendEcho2 (IcmpHandle=0x80d408, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5200a8c0, RequestData=0x3c23ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738580, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3370 os_tid = 0x32d8 [0196.454] GetLastError () returned 0x57 [0196.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a749038 [0196.454] SetLastError (dwErrCode=0x57) [0196.454] IcmpCreateFile () returned 0x80cd40 [0196.454] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7385d0 [0196.454] IcmpSendEcho2 (IcmpHandle=0x80cd40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5300a8c0, RequestData=0x3c37ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7385d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3371 os_tid = 0x32dc [0196.455] GetLastError () returned 0x57 [0196.455] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7493c0 [0196.455] SetLastError (dwErrCode=0x57) [0196.455] IcmpCreateFile () returned 0x80cf00 [0196.455] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738710 [0196.455] IcmpSendEcho2 (IcmpHandle=0x80cf00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5400a8c0, RequestData=0x3c4bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738710, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3372 os_tid = 0x32e0 [0196.457] GetLastError () returned 0x57 [0196.457] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a750848 [0196.457] SetLastError (dwErrCode=0x57) [0196.457] IcmpCreateFile () returned 0x80cf38 [0196.457] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738760 [0196.457] IcmpSendEcho2 (IcmpHandle=0x80cf38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5500a8c0, RequestData=0x3c5fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738760, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3373 os_tid = 0x32e4 [0196.458] GetLastError () returned 0x57 [0196.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a750bd0 [0196.458] SetLastError (dwErrCode=0x57) [0196.458] IcmpCreateFile () returned 0x80cf70 [0196.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7387b0 [0196.458] IcmpSendEcho2 (IcmpHandle=0x80cf70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5600a8c0, RequestData=0x3c73ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7387b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3374 os_tid = 0x32e8 [0196.477] GetLastError () returned 0x57 [0196.477] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a750f58 [0196.478] SetLastError (dwErrCode=0x57) [0196.478] IcmpCreateFile () returned 0x80cfa8 [0196.478] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738800 [0196.478] IcmpSendEcho2 (IcmpHandle=0x80cfa8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5700a8c0, RequestData=0x3c9bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738800, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3375 os_tid = 0x32ec [0196.479] GetLastError () returned 0x57 [0196.479] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7512e0 [0196.479] SetLastError (dwErrCode=0x57) [0196.479] IcmpCreateFile () returned 0x80cfe0 [0196.479] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738850 [0196.479] IcmpSendEcho2 (IcmpHandle=0x80cfe0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5800a8c0, RequestData=0x3cafff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738850, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3376 os_tid = 0x32f0 [0196.481] GetLastError () returned 0x57 [0196.481] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a751668 [0196.481] SetLastError (dwErrCode=0x57) [0196.481] IcmpCreateFile () returned 0x80d018 [0196.481] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7388a0 [0196.481] IcmpSendEcho2 (IcmpHandle=0x80d018, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5900a8c0, RequestData=0x3cc3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7388a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3377 os_tid = 0x32f4 [0196.482] GetLastError () returned 0x57 [0196.482] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7519f0 [0196.482] SetLastError (dwErrCode=0x57) [0196.482] IcmpCreateFile () returned 0x80d050 [0196.482] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7388f0 [0196.482] IcmpSendEcho2 (IcmpHandle=0x80d050, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5a00a8c0, RequestData=0x3cd7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7388f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3378 os_tid = 0x32f8 [0196.484] GetLastError () returned 0x57 [0196.484] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a751d78 [0196.484] SetLastError (dwErrCode=0x57) [0196.484] IcmpCreateFile () returned 0x80d088 [0196.484] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738940 [0196.484] IcmpSendEcho2 (IcmpHandle=0x80d088, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5b00a8c0, RequestData=0x3cebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738940, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3379 os_tid = 0x32fc [0196.485] GetLastError () returned 0x57 [0196.485] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a752100 [0196.485] SetLastError (dwErrCode=0x57) [0196.485] IcmpCreateFile () returned 0x80d0c0 [0196.485] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738990 [0196.485] IcmpSendEcho2 (IcmpHandle=0x80d0c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5c00a8c0, RequestData=0x3cffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738990, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3380 os_tid = 0x3300 [0196.486] GetLastError () returned 0x57 [0196.487] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a752488 [0196.487] SetLastError (dwErrCode=0x57) [0196.487] IcmpCreateFile () returned 0x80d0f8 [0196.487] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7389e0 [0196.487] IcmpSendEcho2 (IcmpHandle=0x80d0f8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5d00a8c0, RequestData=0x3d13ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7389e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3381 os_tid = 0x3304 [0196.488] GetLastError () returned 0x57 [0196.488] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a752810 [0196.488] SetLastError (dwErrCode=0x57) [0196.488] IcmpCreateFile () returned 0x80d130 [0196.488] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738a30 [0196.488] IcmpSendEcho2 (IcmpHandle=0x80d130, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5e00a8c0, RequestData=0x3d27ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738a30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3382 os_tid = 0x3308 [0196.489] GetLastError () returned 0x57 [0196.489] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a752b98 [0196.490] SetLastError (dwErrCode=0x57) [0196.490] IcmpCreateFile () returned 0x80d168 [0196.490] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738a80 [0196.490] IcmpSendEcho2 (IcmpHandle=0x80d168, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x5f00a8c0, RequestData=0x3d3bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738a80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3383 os_tid = 0x330c [0196.546] GetLastError () returned 0x57 [0196.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a752f20 [0196.547] SetLastError (dwErrCode=0x57) [0196.547] IcmpCreateFile () returned 0x80d1a0 [0196.547] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738ad0 [0196.547] IcmpSendEcho2 (IcmpHandle=0x80d1a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6000a8c0, RequestData=0x3d4fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738ad0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3384 os_tid = 0x3310 [0196.548] GetLastError () returned 0x57 [0196.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7532a8 [0196.548] SetLastError (dwErrCode=0x57) [0196.548] IcmpCreateFile () returned 0x80d1d8 [0196.548] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738b20 [0196.548] IcmpSendEcho2 (IcmpHandle=0x80d1d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6100a8c0, RequestData=0x3d63ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738b20, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3385 os_tid = 0x3314 [0196.550] GetLastError () returned 0x57 [0196.550] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a753630 [0196.550] SetLastError (dwErrCode=0x57) [0196.550] IcmpCreateFile () returned 0x80d210 [0196.550] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738b70 [0196.550] IcmpSendEcho2 (IcmpHandle=0x80d210, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6200a8c0, RequestData=0x3d77ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738b70, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3386 os_tid = 0x3318 [0196.551] GetLastError () returned 0x57 [0196.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7539b8 [0196.551] SetLastError (dwErrCode=0x57) [0196.551] IcmpCreateFile () returned 0x80d248 [0196.551] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738620 [0196.551] IcmpSendEcho2 (IcmpHandle=0x80d248, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6300a8c0, RequestData=0x3d8bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738620, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3387 os_tid = 0x331c [0196.553] GetLastError () returned 0x57 [0196.553] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a753d40 [0196.553] SetLastError (dwErrCode=0x57) [0196.553] IcmpCreateFile () returned 0x80d280 [0196.553] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738670 [0196.553] IcmpSendEcho2 (IcmpHandle=0x80d280, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6400a8c0, RequestData=0x3db3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738670, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3388 os_tid = 0x3320 [0196.554] GetLastError () returned 0x57 [0196.554] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7540c8 [0196.555] SetLastError (dwErrCode=0x57) [0196.555] IcmpCreateFile () returned 0x80d2b8 [0196.555] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7386c0 [0196.555] IcmpSendEcho2 (IcmpHandle=0x80d2b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6500a8c0, RequestData=0x3dc7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7386c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3389 os_tid = 0x3324 [0196.556] GetLastError () returned 0x57 [0196.556] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a754450 [0196.556] SetLastError (dwErrCode=0x57) [0196.556] IcmpCreateFile () returned 0x80d2f0 [0196.556] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739110 [0196.556] IcmpSendEcho2 (IcmpHandle=0x80d2f0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6600a8c0, RequestData=0x3ddbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739110, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3390 os_tid = 0x3328 [0196.557] GetLastError () returned 0x57 [0196.557] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7547d8 [0196.558] SetLastError (dwErrCode=0x57) [0196.558] IcmpCreateFile () returned 0x80d328 [0196.558] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739160 [0196.558] IcmpSendEcho2 (IcmpHandle=0x80d328, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6700a8c0, RequestData=0x3defff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739160, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3391 os_tid = 0x332c [0196.559] GetLastError () returned 0x57 [0196.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a754b60 [0196.559] SetLastError (dwErrCode=0x57) [0196.559] IcmpCreateFile () returned 0x80d360 [0196.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7391b0 [0196.559] IcmpSendEcho2 (IcmpHandle=0x80d360, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6800a8c0, RequestData=0x3e03ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7391b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3392 os_tid = 0x3330 [0196.560] GetLastError () returned 0x57 [0196.560] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a754ee8 [0196.560] SetLastError (dwErrCode=0x57) [0196.561] IcmpCreateFile () returned 0x80cd78 [0196.561] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739200 [0196.561] IcmpSendEcho2 (IcmpHandle=0x80cd78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6900a8c0, RequestData=0x3e17ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739200, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3393 os_tid = 0x3334 [0196.562] GetLastError () returned 0x57 [0196.562] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a755270 [0196.562] SetLastError (dwErrCode=0x57) [0196.562] IcmpCreateFile () returned 0x80cdb0 [0196.562] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739250 [0196.562] IcmpSendEcho2 (IcmpHandle=0x80cdb0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6a00a8c0, RequestData=0x3e2bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739250, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3394 os_tid = 0x3338 [0196.563] GetLastError () returned 0x57 [0196.563] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7555f8 [0196.563] SetLastError (dwErrCode=0x57) [0196.563] IcmpCreateFile () returned 0x80cde8 [0196.563] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7392a0 [0196.564] IcmpSendEcho2 (IcmpHandle=0x80cde8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6b00a8c0, RequestData=0x3e3fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7392a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3395 os_tid = 0x333c [0196.565] GetLastError () returned 0x57 [0196.565] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a755980 [0196.565] SetLastError (dwErrCode=0x57) [0196.565] IcmpCreateFile () returned 0x80ce20 [0196.565] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7392f0 [0196.565] IcmpSendEcho2 (IcmpHandle=0x80ce20, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6c00a8c0, RequestData=0x3e53ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7392f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3396 os_tid = 0x3340 [0196.566] GetLastError () returned 0x57 [0196.566] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74ec08 [0196.566] SetLastError (dwErrCode=0x57) [0196.566] IcmpCreateFile () returned 0x80ce58 [0196.566] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739340 [0196.566] IcmpSendEcho2 (IcmpHandle=0x80ce58, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6d00a8c0, RequestData=0x3e67ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739340, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3397 os_tid = 0x3344 [0196.573] GetLastError () returned 0x57 [0196.573] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74ef90 [0196.573] SetLastError (dwErrCode=0x57) [0196.573] IcmpCreateFile () returned 0x80ce90 [0196.573] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738da0 [0196.573] IcmpSendEcho2 (IcmpHandle=0x80ce90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6e00a8c0, RequestData=0x3e7bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738da0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3398 os_tid = 0x3348 [0196.575] GetLastError () returned 0x57 [0196.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74f318 [0196.575] SetLastError (dwErrCode=0x57) [0196.575] IcmpCreateFile () returned 0x80cec8 [0196.575] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739390 [0196.575] IcmpSendEcho2 (IcmpHandle=0x80cec8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x6f00a8c0, RequestData=0x3e8fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739390, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3399 os_tid = 0x334c [0196.576] GetLastError () returned 0x57 [0196.576] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74f6a0 [0196.577] SetLastError (dwErrCode=0x57) [0196.577] IcmpCreateFile () returned 0x80d7c0 [0196.577] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7393e0 [0196.577] IcmpSendEcho2 (IcmpHandle=0x80d7c0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7000a8c0, RequestData=0x3ea3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7393e0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3400 os_tid = 0x3350 [0196.578] GetLastError () returned 0x57 [0196.578] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74fa28 [0196.578] SetLastError (dwErrCode=0x57) [0196.578] IcmpCreateFile () returned 0x80d440 [0196.578] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739430 [0196.578] IcmpSendEcho2 (IcmpHandle=0x80d440, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7100a8c0, RequestData=0x3eb7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739430, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3401 os_tid = 0x3354 [0196.579] GetLastError () returned 0x57 [0196.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a74fdb0 [0196.579] SetLastError (dwErrCode=0x57) [0196.579] IcmpCreateFile () returned 0x80d478 [0196.579] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739480 [0196.580] IcmpSendEcho2 (IcmpHandle=0x80d478, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7200a8c0, RequestData=0x3ecbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739480, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3402 os_tid = 0x3358 [0196.581] GetLastError () returned 0x57 [0196.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a750138 [0196.581] SetLastError (dwErrCode=0x57) [0196.581] IcmpCreateFile () returned 0x80d4b0 [0196.581] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7394d0 [0196.581] IcmpSendEcho2 (IcmpHandle=0x80d4b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7300a8c0, RequestData=0x3edfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7394d0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3403 os_tid = 0x335c [0196.582] GetLastError () returned 0x57 [0196.582] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7504c0 [0196.582] SetLastError (dwErrCode=0x57) [0196.582] IcmpCreateFile () returned 0x80d4e8 [0196.582] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739520 [0196.583] IcmpSendEcho2 (IcmpHandle=0x80d4e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7400a8c0, RequestData=0x3ef3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739520, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3404 os_tid = 0x3360 [0196.584] GetLastError () returned 0x57 [0196.584] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a756b28 [0196.584] SetLastError (dwErrCode=0x57) [0196.584] IcmpCreateFile () returned 0x80d520 [0196.584] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739570 [0196.584] IcmpSendEcho2 (IcmpHandle=0x80d520, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7500a8c0, RequestData=0x3f07ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739570, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3405 os_tid = 0x3364 [0196.585] GetLastError () returned 0x57 [0196.585] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a756eb0 [0196.586] SetLastError (dwErrCode=0x57) [0196.586] IcmpCreateFile () returned 0x80d558 [0196.586] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7395c0 [0196.586] IcmpSendEcho2 (IcmpHandle=0x80d558, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7600a8c0, RequestData=0x3f1bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7395c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3406 os_tid = 0x3368 [0196.587] GetLastError () returned 0x57 [0196.587] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a757238 [0196.587] SetLastError (dwErrCode=0x57) [0196.587] IcmpCreateFile () returned 0x80d590 [0196.587] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739610 [0196.587] IcmpSendEcho2 (IcmpHandle=0x80d590, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7700a8c0, RequestData=0x3f2fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739610, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3407 os_tid = 0x336c [0196.588] GetLastError () returned 0x57 [0196.588] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7575c0 [0196.588] SetLastError (dwErrCode=0x57) [0196.588] IcmpCreateFile () returned 0x80d5c8 [0196.589] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739660 [0196.589] IcmpSendEcho2 (IcmpHandle=0x80d5c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7800a8c0, RequestData=0x3f43ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739660, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3408 os_tid = 0x3370 [0196.590] GetLastError () returned 0x57 [0196.590] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a757948 [0196.590] SetLastError (dwErrCode=0x57) [0196.590] IcmpCreateFile () returned 0x80d600 [0196.590] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7396b0 [0196.590] IcmpSendEcho2 (IcmpHandle=0x80d600, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7900a8c0, RequestData=0x3f57ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7396b0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3409 os_tid = 0x3374 [0196.591] GetLastError () returned 0x57 [0196.591] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a757cd0 [0196.591] SetLastError (dwErrCode=0x57) [0196.591] IcmpCreateFile () returned 0x80d638 [0196.591] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738d00 [0196.592] IcmpSendEcho2 (IcmpHandle=0x80d638, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7a00a8c0, RequestData=0x3f6bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738d00, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3410 os_tid = 0x3378 [0196.593] GetLastError () returned 0x57 [0196.593] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a758058 [0196.593] SetLastError (dwErrCode=0x57) [0196.593] IcmpCreateFile () returned 0x80d670 [0196.593] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738d50 [0196.593] IcmpSendEcho2 (IcmpHandle=0x80d670, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7b00a8c0, RequestData=0x3f7fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738d50, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3411 os_tid = 0x337c [0196.594] GetLastError () returned 0x57 [0196.594] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7583e0 [0196.594] SetLastError (dwErrCode=0x57) [0196.594] IcmpCreateFile () returned 0x80d6a8 [0196.594] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738df0 [0196.594] IcmpSendEcho2 (IcmpHandle=0x80d6a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7c00a8c0, RequestData=0x3f93ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738df0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3412 os_tid = 0x3380 [0196.596] GetLastError () returned 0x57 [0196.596] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a758768 [0196.596] SetLastError (dwErrCode=0x57) [0196.596] IcmpCreateFile () returned 0x80d6e0 [0196.596] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738e40 [0196.596] IcmpSendEcho2 (IcmpHandle=0x80d6e0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7d00a8c0, RequestData=0x3fa7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738e40, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3413 os_tid = 0x3388 [0196.604] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.604] ReadFile (in: hFile=0x27f4, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.606] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.606] ReadFile (in: hFile=0x27f4, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.606] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.610] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0196.610] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0196.610] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0196.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.611] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0196.615] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.619] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.620] WriteFile (in: hFile=0x27f4, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0196.620] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.620] ReadFile (in: hFile=0x27f4, lpBuffer=0x3450000, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2d57f61c*=0xff8, lpOverlapped=0x0) returned 1 [0196.620] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffff008, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.620] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0xff8, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x3450000, pcbResult=0x2d57f618) returned 0x0 [0196.620] WriteFile (in: hFile=0x27f4, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2d57f61c*=0x1000, lpOverlapped=0x0) returned 1 [0196.620] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0196.621] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.621] WriteFile (in: hFile=0x27f4, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.621] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.621] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.621] CloseHandle (hObject=0x27f4) returned 1 [0196.621] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.play")) returned 1 [0196.626] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3414 os_tid = 0x338c [0196.631] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.631] ReadFile (in: hFile=0x281c, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.633] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.633] ReadFile (in: hFile=0x281c, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.633] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.637] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.637] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x3c87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0196.637] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x3c87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x3c87f828, pbKeyObject=0x0) returned 0x0 [0196.637] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c87f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c87f500) returned 0x0 [0196.637] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.637] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c87f500) returned 0x0 [0196.642] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.645] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.646] WriteFile (in: hFile=0x281c, lpBuffer=0x3c87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c87f830, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesWritten=0x3c87f830*=0x428, lpOverlapped=0x0) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.646] ReadFile (in: hFile=0x281c, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x3c87f61c*=0x1434, lpOverlapped=0x0) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0xffffebcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.646] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x1434, pPaddingInfo=0x0, pbIV=0x3c87f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x3c87f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c87f848, pbOutput=0x2750000, pcbResult=0x3c87f618) returned 0x0 [0196.646] WriteFile (in: hFile=0x281c, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x3c87f61c*=0x1440, lpOverlapped=0x0) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c87f60c | out: lpNewFilePointer=0x0) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.646] WriteFile (in: hFile=0x281c, lpBuffer=0x3c87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c87f83c*, lpNumberOfBytesWritten=0x3c87f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x281c, liDistanceToMove=0x1440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.646] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.647] CloseHandle (hObject=0x281c) returned 1 [0196.648] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.play")) returned 1 [0196.653] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3415 os_tid = 0x3390 [0196.658] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.658] ReadFile (in: hFile=0x2824, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.660] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.660] ReadFile (in: hFile=0x2824, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.660] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.663] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.663] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x3d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0196.663] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x3d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x3d9ff828, pbKeyObject=0x0) returned 0x0 [0196.663] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3d9ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3d9ff500) returned 0x0 [0196.663] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.664] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3d9ff500) returned 0x0 [0196.668] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.672] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.672] WriteFile (in: hFile=0x2824, lpBuffer=0x3d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesWritten=0x3d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0196.672] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.672] ReadFile (in: hFile=0x2824, lpBuffer=0x3550000, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x3d9ff61c*=0x3218, lpOverlapped=0x0) returned 1 [0196.673] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xffffcde8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.673] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3550000, cbInput=0x3218, pPaddingInfo=0x0, pbIV=0x3d9ff848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x3d9ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d9ff848, pbOutput=0x3550000, pcbResult=0x3d9ff618) returned 0x0 [0196.673] WriteFile (in: hFile=0x2824, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x3d9ff61c*=0x3220, lpOverlapped=0x0) returned 1 [0196.674] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0196.674] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.674] WriteFile (in: hFile=0x2824, lpBuffer=0x3d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ff83c*, lpNumberOfBytesWritten=0x3d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0196.674] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x3220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.674] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.674] CloseHandle (hObject=0x2824) returned 1 [0196.674] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.play")) returned 1 [0196.679] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3416 os_tid = 0x3394 [0196.684] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.684] ReadFile (in: hFile=0x282c, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.689] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.689] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x3fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0196.690] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x3fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x3fcff828, pbKeyObject=0x0) returned 0x0 [0196.690] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3fcff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3fcff500) returned 0x0 [0196.690] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.690] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3fcff500) returned 0x0 [0196.695] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.699] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.699] WriteFile (in: hFile=0x282c, lpBuffer=0x3fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fcff830, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesWritten=0x3fcff830*=0x428, lpOverlapped=0x0) returned 1 [0196.699] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.699] ReadFile (in: hFile=0x282c, lpBuffer=0x3650000, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x3fcff61c*=0x55c, lpOverlapped=0x0) returned 1 [0196.699] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0xfffffaa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.699] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3650000, cbInput=0x55c, pPaddingInfo=0x0, pbIV=0x3fcff848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x3fcff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fcff848, pbOutput=0x3650000, pcbResult=0x3fcff618) returned 0x0 [0196.699] WriteFile (in: hFile=0x282c, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x3fcff61c*=0x560, lpOverlapped=0x0) returned 1 [0196.699] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fcff60c | out: lpNewFilePointer=0x0) returned 1 [0196.699] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.700] WriteFile (in: hFile=0x282c, lpBuffer=0x3fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3fcff83c*, lpNumberOfBytesWritten=0x3fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0196.700] SetFilePointerEx (in: hFile=0x282c, liDistanceToMove=0x560, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.700] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.700] CloseHandle (hObject=0x282c) returned 1 [0196.700] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.play")) returned 1 [0196.705] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3417 os_tid = 0x3398 [0196.710] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.710] ReadFile (in: hFile=0x2834, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.712] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.712] ReadFile (in: hFile=0x2834, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.712] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.716] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x3fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0196.716] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x3fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x3fe3f828, pbKeyObject=0x0) returned 0x0 [0196.716] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3fe3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3fe3f500) returned 0x0 [0196.716] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.716] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3fe3f500) returned 0x0 [0196.721] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.724] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.724] WriteFile (in: hFile=0x2834, lpBuffer=0x3fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesWritten=0x3fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0196.724] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.724] ReadFile (in: hFile=0x2834, lpBuffer=0x3750000, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x3fe3f61c*=0x88c, lpOverlapped=0x0) returned 1 [0196.724] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xfffff774, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.725] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3750000, cbInput=0x88c, pPaddingInfo=0x0, pbIV=0x3fe3f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x3fe3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fe3f848, pbOutput=0x3750000, pcbResult=0x3fe3f618) returned 0x0 [0196.725] WriteFile (in: hFile=0x2834, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x3fe3f61c*=0x890, lpOverlapped=0x0) returned 1 [0196.725] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0196.725] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.725] WriteFile (in: hFile=0x2834, lpBuffer=0x3fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3f83c*, lpNumberOfBytesWritten=0x3fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.725] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.725] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.725] CloseHandle (hObject=0x2834) returned 1 [0196.725] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.728] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.play")) returned 1 [0196.730] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3418 os_tid = 0x339c [0196.735] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.735] ReadFile (in: hFile=0x283c, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.736] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.736] ReadFile (in: hFile=0x283c, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.736] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.739] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.740] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x3ff7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0196.740] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x3ff7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x3ff7f828, pbKeyObject=0x0) returned 0x0 [0196.740] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3ff7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3ff7f500) returned 0x0 [0196.740] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.740] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3ff7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3ff7f500) returned 0x0 [0196.745] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.749] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.749] WriteFile (in: hFile=0x283c, lpBuffer=0x3ff7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ff7f830, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesWritten=0x3ff7f830*=0x428, lpOverlapped=0x0) returned 1 [0196.749] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.749] ReadFile (in: hFile=0x283c, lpBuffer=0x3850000, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x3ff7f61c*=0xa34, lpOverlapped=0x0) returned 1 [0196.749] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xfffff5cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.749] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3850000, cbInput=0xa34, pPaddingInfo=0x0, pbIV=0x3ff7f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x3ff7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ff7f848, pbOutput=0x3850000, pcbResult=0x3ff7f618) returned 0x0 [0196.749] WriteFile (in: hFile=0x283c, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x3ff7f61c*=0xa40, lpOverlapped=0x0) returned 1 [0196.749] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ff7f60c | out: lpNewFilePointer=0x0) returned 1 [0196.749] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.750] WriteFile (in: hFile=0x283c, lpBuffer=0x3ff7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7f83c*, lpNumberOfBytesWritten=0x3ff7f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.750] SetFilePointerEx (in: hFile=0x283c, liDistanceToMove=0xa40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.750] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.750] CloseHandle (hObject=0x283c) returned 1 [0196.750] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.play")) returned 1 [0196.755] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3419 os_tid = 0x33a0 [0196.760] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.760] ReadFile (in: hFile=0x2844, lpBuffer=0x403ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x403ff85c, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesRead=0x403ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.762] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.762] ReadFile (in: hFile=0x2844, lpBuffer=0x403ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x403ff85c, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesRead=0x403ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.762] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.765] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.765] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x403ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0196.765] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x403ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x403ff828, pbKeyObject=0x0) returned 0x0 [0196.765] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x403ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x403ff500) returned 0x0 [0196.766] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.766] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x403ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x403ff500) returned 0x0 [0196.770] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.774] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.774] WriteFile (in: hFile=0x2844, lpBuffer=0x403ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x403ff830, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesWritten=0x403ff830*=0x428, lpOverlapped=0x0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.775] ReadFile (in: hFile=0x2844, lpBuffer=0x3950000, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x403ff61c*=0x8a0, lpOverlapped=0x0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffff760, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.775] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3950000, cbInput=0x8a0, pPaddingInfo=0x0, pbIV=0x403ff848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x403ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x403ff848, pbOutput=0x3950000, pcbResult=0x403ff618) returned 0x0 [0196.775] WriteFile (in: hFile=0x2844, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x403ff61c*=0x8b0, lpOverlapped=0x0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x403ff60c | out: lpNewFilePointer=0x0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.775] WriteFile (in: hFile=0x2844, lpBuffer=0x403ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x403ff83c*, lpNumberOfBytesWritten=0x403ff61c*=0x8, lpOverlapped=0x0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x8b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.775] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.775] CloseHandle (hObject=0x2844) returned 1 [0196.776] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.778] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.play")) returned 1 [0196.780] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3420 os_tid = 0x33a4 [0196.785] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.785] ReadFile (in: hFile=0x284c, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.786] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.786] ReadFile (in: hFile=0x284c, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.786] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.790] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.790] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x4053f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0196.790] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x4053f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x4053f828, pbKeyObject=0x0) returned 0x0 [0196.790] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4053f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4053f500) returned 0x0 [0196.790] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.790] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4053f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4053f500) returned 0x0 [0196.795] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.798] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.799] WriteFile (in: hFile=0x284c, lpBuffer=0x4053fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4053f830, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesWritten=0x4053f830*=0x428, lpOverlapped=0x0) returned 1 [0196.799] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.799] ReadFile (in: hFile=0x284c, lpBuffer=0x3a50000, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x4053f61c*=0xc28, lpOverlapped=0x0) returned 1 [0196.799] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0xfffff3d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.799] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3a50000, cbInput=0xc28, pPaddingInfo=0x0, pbIV=0x4053f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x4053f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4053f848, pbOutput=0x3a50000, pcbResult=0x4053f618) returned 0x0 [0196.799] WriteFile (in: hFile=0x284c, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x4053f61c*=0xc30, lpOverlapped=0x0) returned 1 [0196.799] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4053f60c | out: lpNewFilePointer=0x0) returned 1 [0196.799] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.799] WriteFile (in: hFile=0x284c, lpBuffer=0x4053f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x4053f83c*, lpNumberOfBytesWritten=0x4053f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.800] SetFilePointerEx (in: hFile=0x284c, liDistanceToMove=0xc30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.800] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.800] CloseHandle (hObject=0x284c) returned 1 [0196.800] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.play")) returned 1 [0196.805] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3421 os_tid = 0x33a8 [0196.809] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.809] ReadFile (in: hFile=0x2854, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.811] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.811] ReadFile (in: hFile=0x2854, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.811] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.814] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x4067f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0196.814] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x4067f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x4067f828, pbKeyObject=0x0) returned 0x0 [0196.814] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4067f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4067f500) returned 0x0 [0196.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.814] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4067f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4067f500) returned 0x0 [0196.819] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.822] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.823] WriteFile (in: hFile=0x2854, lpBuffer=0x4067fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4067f830, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesWritten=0x4067f830*=0x428, lpOverlapped=0x0) returned 1 [0196.823] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.823] ReadFile (in: hFile=0x2854, lpBuffer=0x3b50000, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x4067f61c*=0xd70, lpOverlapped=0x0) returned 1 [0196.823] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xfffff290, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.823] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3b50000, cbInput=0xd70, pPaddingInfo=0x0, pbIV=0x4067f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x4067f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4067f848, pbOutput=0x3b50000, pcbResult=0x4067f618) returned 0x0 [0196.823] WriteFile (in: hFile=0x2854, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x4067f61c*=0xd80, lpOverlapped=0x0) returned 1 [0196.823] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4067f60c | out: lpNewFilePointer=0x0) returned 1 [0196.823] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.824] WriteFile (in: hFile=0x2854, lpBuffer=0x4067f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x4067f83c*, lpNumberOfBytesWritten=0x4067f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.824] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xd80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.824] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.824] CloseHandle (hObject=0x2854) returned 1 [0196.824] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.play")) returned 1 [0196.829] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3422 os_tid = 0x33ac [0196.833] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.833] ReadFile (in: hFile=0x285c, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0196.835] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.835] ReadFile (in: hFile=0x285c, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0196.835] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.838] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.838] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x407bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0196.838] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x407bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x407bf828, pbKeyObject=0x0) returned 0x0 [0196.838] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x407bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x407bf500) returned 0x0 [0196.838] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.838] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x407bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x407bf500) returned 0x0 [0196.843] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.846] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.846] WriteFile (in: hFile=0x285c, lpBuffer=0x407bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x407bf830, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesWritten=0x407bf830*=0x428, lpOverlapped=0x0) returned 1 [0196.846] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.846] ReadFile (in: hFile=0x285c, lpBuffer=0x3c50000, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x407bf61c*=0xd3c, lpOverlapped=0x0) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0xfffff2c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.847] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3c50000, cbInput=0xd3c, pPaddingInfo=0x0, pbIV=0x407bf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x407bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x407bf848, pbOutput=0x3c50000, pcbResult=0x407bf618) returned 0x0 [0196.847] WriteFile (in: hFile=0x285c, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x407bf61c*=0xd40, lpOverlapped=0x0) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407bf60c | out: lpNewFilePointer=0x0) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.847] WriteFile (in: hFile=0x285c, lpBuffer=0x407bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x407bf83c*, lpNumberOfBytesWritten=0x407bf61c*=0x8, lpOverlapped=0x0) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x285c, liDistanceToMove=0xd40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.847] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.847] CloseHandle (hObject=0x285c) returned 1 [0196.847] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.851] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.play")) returned 1 [0196.852] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3423 os_tid = 0x33b0 [0196.857] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.857] ReadFile (in: hFile=0x2864, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.860] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.860] ReadFile (in: hFile=0x2864, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.860] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.864] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.864] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x408ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0196.864] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x408ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x408ff828, pbKeyObject=0x0) returned 0x0 [0196.864] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x408ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x408ff500) returned 0x0 [0196.864] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.864] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x408ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x408ff500) returned 0x0 [0196.869] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.873] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.873] WriteFile (in: hFile=0x2864, lpBuffer=0x408ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x408ff830, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesWritten=0x408ff830*=0x428, lpOverlapped=0x0) returned 1 [0196.873] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.873] ReadFile (in: hFile=0x2864, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x408ff61c*=0x1750, lpOverlapped=0x0) returned 1 [0196.873] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xffffe8b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.873] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3d50000, cbInput=0x1750, pPaddingInfo=0x0, pbIV=0x408ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x408ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x408ff848, pbOutput=0x3d50000, pcbResult=0x408ff618) returned 0x0 [0196.873] WriteFile (in: hFile=0x2864, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x408ff61c*=0x1760, lpOverlapped=0x0) returned 1 [0196.873] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x408ff60c | out: lpNewFilePointer=0x0) returned 1 [0196.873] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.873] WriteFile (in: hFile=0x2864, lpBuffer=0x408ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x408ff83c*, lpNumberOfBytesWritten=0x408ff61c*=0x8, lpOverlapped=0x0) returned 1 [0196.874] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x1760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.874] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.874] CloseHandle (hObject=0x2864) returned 1 [0196.874] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.play")) returned 1 [0196.878] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3424 os_tid = 0x33b4 [0196.883] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.883] ReadFile (in: hFile=0x286c, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.885] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.885] ReadFile (in: hFile=0x286c, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.886] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.889] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.889] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x40a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0196.889] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x40a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x40a3f828, pbKeyObject=0x0) returned 0x0 [0196.889] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x40a3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x40a3f500) returned 0x0 [0196.889] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.889] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x40a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x40a3f500) returned 0x0 [0196.894] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.897] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.897] WriteFile (in: hFile=0x286c, lpBuffer=0x40a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40a3f830, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesWritten=0x40a3f830*=0x428, lpOverlapped=0x0) returned 1 [0196.898] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.898] ReadFile (in: hFile=0x286c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x40a3f61c*=0x1540, lpOverlapped=0x0) returned 1 [0196.898] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0xffffeac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.898] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3e50000, cbInput=0x1540, pPaddingInfo=0x0, pbIV=0x40a3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x40a3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40a3f848, pbOutput=0x3e50000, pcbResult=0x40a3f618) returned 0x0 [0196.898] WriteFile (in: hFile=0x286c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x40a3f61c*=0x1550, lpOverlapped=0x0) returned 1 [0196.898] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40a3f60c | out: lpNewFilePointer=0x0) returned 1 [0196.898] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.898] WriteFile (in: hFile=0x286c, lpBuffer=0x40a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x40a3f83c*, lpNumberOfBytesWritten=0x40a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.898] SetFilePointerEx (in: hFile=0x286c, liDistanceToMove=0x1550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.898] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.898] CloseHandle (hObject=0x286c) returned 1 [0196.899] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.902] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.play")) returned 1 [0196.903] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3425 os_tid = 0x33b8 [0196.885] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.917] ReadFile (in: hFile=0x2874, lpBuffer=0x40b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesRead=0x40b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.918] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.919] ReadFile (in: hFile=0x2874, lpBuffer=0x40b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesRead=0x40b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0196.919] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.922] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.922] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x40b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0196.922] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x40b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x40b7f828, pbKeyObject=0x0) returned 0x0 [0196.923] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x40b7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x40b7f500) returned 0x0 [0196.923] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.923] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x40b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x40b7f500) returned 0x0 [0196.927] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.931] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.931] WriteFile (in: hFile=0x2874, lpBuffer=0x40b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40b7f830, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesWritten=0x40b7f830*=0x428, lpOverlapped=0x0) returned 1 [0196.932] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.932] ReadFile (in: hFile=0x2874, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x40b7f61c*=0x19f4, lpOverlapped=0x0) returned 1 [0196.933] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xffffe60c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.933] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0x19f4, pPaddingInfo=0x0, pbIV=0x40b7f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x40b7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40b7f848, pbOutput=0x3f50000, pcbResult=0x40b7f618) returned 0x0 [0196.933] WriteFile (in: hFile=0x2874, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x40b7f61c*=0x1a00, lpOverlapped=0x0) returned 1 [0196.933] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40b7f60c | out: lpNewFilePointer=0x0) returned 1 [0196.933] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.933] WriteFile (in: hFile=0x2874, lpBuffer=0x40b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x40b7f83c*, lpNumberOfBytesWritten=0x40b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0196.933] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0x1a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.933] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.933] CloseHandle (hObject=0x2874) returned 1 [0196.933] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.play")) returned 1 [0196.938] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3426 os_tid = 0x33bc [0196.943] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.943] ReadFile (in: hFile=0x287c, lpBuffer=0x40cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesRead=0x40cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0196.945] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.945] ReadFile (in: hFile=0x287c, lpBuffer=0x40cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesRead=0x40cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0196.945] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.948] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x40cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0196.948] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x40cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x40cbf828, pbKeyObject=0x0) returned 0x0 [0196.948] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x40cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x40cbf500) returned 0x0 [0196.948] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.949] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x40cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x40cbf500) returned 0x0 [0196.953] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.957] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.957] WriteFile (in: hFile=0x287c, lpBuffer=0x40cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40cbf830, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesWritten=0x40cbf830*=0x428, lpOverlapped=0x0) returned 1 [0196.957] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.957] ReadFile (in: hFile=0x287c, lpBuffer=0x4050000, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x40cbf61c*=0x1a6b, lpOverlapped=0x0) returned 1 [0196.959] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0xffffe595, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.959] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4050000, cbInput=0x1a6b, pPaddingInfo=0x0, pbIV=0x40cbf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x40cbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40cbf848, pbOutput=0x4050000, pcbResult=0x40cbf618) returned 0x0 [0196.960] WriteFile (in: hFile=0x287c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x40cbf61c*=0x1a70, lpOverlapped=0x0) returned 1 [0196.960] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40cbf60c | out: lpNewFilePointer=0x0) returned 1 [0196.960] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.960] WriteFile (in: hFile=0x287c, lpBuffer=0x40cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x40cbf83c*, lpNumberOfBytesWritten=0x40cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0196.960] SetFilePointerEx (in: hFile=0x287c, liDistanceToMove=0x1a70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.960] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.960] CloseHandle (hObject=0x287c) returned 1 [0196.960] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.963] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\paper_01.mid.play")) returned 1 [0196.965] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3427 os_tid = 0x33c0 [0196.970] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.970] ReadFile (in: hFile=0x2884, lpBuffer=0x40dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40dff85c, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesRead=0x40dff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.971] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.972] ReadFile (in: hFile=0x2884, lpBuffer=0x40dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40dff85c, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesRead=0x40dff85c*=0x428, lpOverlapped=0x0) returned 1 [0196.972] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0196.975] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0196.975] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x40dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0196.975] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x40dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x40dff828, pbKeyObject=0x0) returned 0x0 [0196.975] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x40dff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x40dff500) returned 0x0 [0196.975] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0196.975] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x40dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x40dff500) returned 0x0 [0196.980] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.983] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.983] WriteFile (in: hFile=0x2884, lpBuffer=0x40dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40dff830, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesWritten=0x40dff830*=0x428, lpOverlapped=0x0) returned 1 [0196.984] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.984] ReadFile (in: hFile=0x2884, lpBuffer=0x4150000, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x40dff61c*=0x195b, lpOverlapped=0x0) returned 1 [0196.985] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xffffe6a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.985] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4150000, cbInput=0x195b, pPaddingInfo=0x0, pbIV=0x40dff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x40dff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40dff848, pbOutput=0x4150000, pcbResult=0x40dff618) returned 0x0 [0196.985] WriteFile (in: hFile=0x2884, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x40dff61c*=0x1960, lpOverlapped=0x0) returned 1 [0196.985] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40dff60c | out: lpNewFilePointer=0x0) returned 1 [0196.985] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.985] WriteFile (in: hFile=0x2884, lpBuffer=0x40dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x40dff83c*, lpNumberOfBytesWritten=0x40dff61c*=0x8, lpOverlapped=0x0) returned 1 [0196.985] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x1960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.985] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0196.985] CloseHandle (hObject=0x2884) returned 1 [0196.985] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0196.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.play")) returned 1 [0196.990] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3428 os_tid = 0x33c4 [0197.002] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.002] ReadFile (in: hFile=0x288c, lpBuffer=0x40f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40f3fb34*, lpNumberOfBytesRead=0x40f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.004] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.004] ReadFile (in: hFile=0x288c, lpBuffer=0x40f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40f3fb34*, lpNumberOfBytesRead=0x40f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.005] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.008] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x40f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0197.008] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x40f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x40f3f828, pbKeyObject=0x0) returned 0x0 [0197.008] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x40f3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x40f3f500) returned 0x0 [0197.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.008] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x40f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x40f3f500) returned 0x0 [0197.013] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.018] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.018] WriteFile (in: hFile=0x288c, lpBuffer=0x40f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40f3f830, lpOverlapped=0x0 | out: lpBuffer=0x40f3fb34*, lpNumberOfBytesWritten=0x40f3f830*=0x428, lpOverlapped=0x0) returned 1 [0197.018] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.018] ReadFile (in: hFile=0x288c, lpBuffer=0x4250000, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x40f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x40f3f61c*=0x1652, lpOverlapped=0x0) returned 1 [0197.018] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0xffffe9ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.018] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4250000, cbInput=0x1652, pPaddingInfo=0x0, pbIV=0x40f3f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x40f3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40f3f848, pbOutput=0x4250000, pcbResult=0x40f3f618) returned 0x0 [0197.018] WriteFile (in: hFile=0x288c, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x40f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x40f3f61c*=0x1660, lpOverlapped=0x0) returned 1 [0197.019] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40f3f60c | out: lpNewFilePointer=0x0) returned 1 [0197.019] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.019] WriteFile (in: hFile=0x288c, lpBuffer=0x40f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x40f3f83c*, lpNumberOfBytesWritten=0x40f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.019] SetFilePointerEx (in: hFile=0x288c, liDistanceToMove=0x1660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.019] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.019] CloseHandle (hObject=0x288c) returned 1 [0197.019] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.022] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.play")) returned 1 [0197.024] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3429 os_tid = 0x33c8 [0197.028] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.028] ReadFile (in: hFile=0x2894, lpBuffer=0x4107fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4107f85c, lpOverlapped=0x0 | out: lpBuffer=0x4107fb34*, lpNumberOfBytesRead=0x4107f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.029] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.029] ReadFile (in: hFile=0x2894, lpBuffer=0x4107fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4107f85c, lpOverlapped=0x0 | out: lpBuffer=0x4107fb34*, lpNumberOfBytesRead=0x4107f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.030] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.032] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x4107f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0197.032] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x4107f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x4107f828, pbKeyObject=0x0) returned 0x0 [0197.032] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4107f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4107f500) returned 0x0 [0197.033] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.033] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4107f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4107f500) returned 0x0 [0197.038] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.041] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.041] WriteFile (in: hFile=0x2894, lpBuffer=0x4107fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4107f830, lpOverlapped=0x0 | out: lpBuffer=0x4107fb34*, lpNumberOfBytesWritten=0x4107f830*=0x428, lpOverlapped=0x0) returned 1 [0197.041] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.041] ReadFile (in: hFile=0x2894, lpBuffer=0x4350000, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x4107f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x4107f61c*=0x215a, lpOverlapped=0x0) returned 1 [0197.042] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xffffdea6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.042] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4350000, cbInput=0x215a, pPaddingInfo=0x0, pbIV=0x4107f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x4107f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4107f848, pbOutput=0x4350000, pcbResult=0x4107f618) returned 0x0 [0197.042] WriteFile (in: hFile=0x2894, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x4107f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x4107f61c*=0x2160, lpOverlapped=0x0) returned 1 [0197.042] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4107f60c | out: lpNewFilePointer=0x0) returned 1 [0197.042] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.043] WriteFile (in: hFile=0x2894, lpBuffer=0x4107f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4107f61c, lpOverlapped=0x0 | out: lpBuffer=0x4107f83c*, lpNumberOfBytesWritten=0x4107f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.043] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x2160, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.043] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.043] CloseHandle (hObject=0x2894) returned 1 [0197.043] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.play")) returned 1 [0197.047] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3430 os_tid = 0x33cc [0197.052] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.052] ReadFile (in: hFile=0x289c, lpBuffer=0x411bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x411bf85c, lpOverlapped=0x0 | out: lpBuffer=0x411bfb34*, lpNumberOfBytesRead=0x411bf85c*=0x428, lpOverlapped=0x0) returned 1 [0197.054] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.054] ReadFile (in: hFile=0x289c, lpBuffer=0x411bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x411bf85c, lpOverlapped=0x0 | out: lpBuffer=0x411bfb34*, lpNumberOfBytesRead=0x411bf85c*=0x428, lpOverlapped=0x0) returned 1 [0197.055] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.057] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.057] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x411bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0197.057] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x411bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x411bf828, pbKeyObject=0x0) returned 0x0 [0197.057] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x411bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x411bf500) returned 0x0 [0197.058] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.058] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x411bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x411bf500) returned 0x0 [0197.062] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.066] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.066] WriteFile (in: hFile=0x289c, lpBuffer=0x411bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x411bf830, lpOverlapped=0x0 | out: lpBuffer=0x411bfb34*, lpNumberOfBytesWritten=0x411bf830*=0x428, lpOverlapped=0x0) returned 1 [0197.066] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.066] ReadFile (in: hFile=0x289c, lpBuffer=0x4450000, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x411bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x411bf61c*=0x17b6, lpOverlapped=0x0) returned 1 [0197.066] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0xffffe84a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.066] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4450000, cbInput=0x17b6, pPaddingInfo=0x0, pbIV=0x411bf848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x411bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x411bf848, pbOutput=0x4450000, pcbResult=0x411bf618) returned 0x0 [0197.066] WriteFile (in: hFile=0x289c, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x411bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x411bf61c*=0x17c0, lpOverlapped=0x0) returned 1 [0197.067] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x411bf60c | out: lpNewFilePointer=0x0) returned 1 [0197.067] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.067] WriteFile (in: hFile=0x289c, lpBuffer=0x411bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x411bf61c, lpOverlapped=0x0 | out: lpBuffer=0x411bf83c*, lpNumberOfBytesWritten=0x411bf61c*=0x8, lpOverlapped=0x0) returned 1 [0197.067] SetFilePointerEx (in: hFile=0x289c, liDistanceToMove=0x17c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.067] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.067] CloseHandle (hObject=0x289c) returned 1 [0197.067] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.play")) returned 1 [0197.073] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3431 os_tid = 0x33d0 [0197.053] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.077] ReadFile (in: hFile=0x28a4, lpBuffer=0x412ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x412ff85c, lpOverlapped=0x0 | out: lpBuffer=0x412ffb34*, lpNumberOfBytesRead=0x412ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.078] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.079] ReadFile (in: hFile=0x28a4, lpBuffer=0x412ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x412ff85c, lpOverlapped=0x0 | out: lpBuffer=0x412ffb34*, lpNumberOfBytesRead=0x412ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.082] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.082] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x412ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0197.082] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x412ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x412ff828, pbKeyObject=0x0) returned 0x0 [0197.082] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x412ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x412ff500) returned 0x0 [0197.082] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.083] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x412ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x412ff500) returned 0x0 [0197.087] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.091] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.091] WriteFile (in: hFile=0x28a4, lpBuffer=0x412ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x412ff830, lpOverlapped=0x0 | out: lpBuffer=0x412ffb34*, lpNumberOfBytesWritten=0x412ff830*=0x428, lpOverlapped=0x0) returned 1 [0197.091] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.091] ReadFile (in: hFile=0x28a4, lpBuffer=0x4550000, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x412ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x412ff61c*=0x1784, lpOverlapped=0x0) returned 1 [0197.091] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xffffe87c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.091] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4550000, cbInput=0x1784, pPaddingInfo=0x0, pbIV=0x412ff848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x412ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x412ff848, pbOutput=0x4550000, pcbResult=0x412ff618) returned 0x0 [0197.091] WriteFile (in: hFile=0x28a4, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x412ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x412ff61c*=0x1790, lpOverlapped=0x0) returned 1 [0197.091] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x412ff60c | out: lpNewFilePointer=0x0) returned 1 [0197.092] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.092] WriteFile (in: hFile=0x28a4, lpBuffer=0x412ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x412ff61c, lpOverlapped=0x0 | out: lpBuffer=0x412ff83c*, lpNumberOfBytesWritten=0x412ff61c*=0x8, lpOverlapped=0x0) returned 1 [0197.092] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x1790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.092] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.092] CloseHandle (hObject=0x28a4) returned 1 [0197.092] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.play")) returned 1 [0197.096] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3432 os_tid = 0x3384 [0197.143] GetLastError () returned 0x57 [0197.143] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a758af0 [0197.143] SetLastError (dwErrCode=0x57) [0197.144] IcmpCreateFile () returned 0x80d718 [0197.144] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738e90 [0197.144] IcmpSendEcho2 (IcmpHandle=0x80d718, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7e00a8c0, RequestData=0x3fbbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738e90, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3433 os_tid = 0x33d4 [0197.145] GetLastError () returned 0x57 [0197.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a758e78 [0197.145] SetLastError (dwErrCode=0x57) [0197.145] IcmpCreateFile () returned 0x80d750 [0197.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738ee0 [0197.145] IcmpSendEcho2 (IcmpHandle=0x80d750, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x7f00a8c0, RequestData=0x1550ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738ee0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3434 os_tid = 0x33d8 [0197.146] GetLastError () returned 0x57 [0197.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a759200 [0197.147] SetLastError (dwErrCode=0x57) [0197.147] IcmpCreateFile () returned 0x80d788 [0197.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738f30 [0197.147] IcmpSendEcho2 (IcmpHandle=0x80d788, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8000a8c0, RequestData=0x1580ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738f30, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3435 os_tid = 0x33dc [0197.151] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.151] ReadFile (in: hFile=0x28a4, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.153] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.153] ReadFile (in: hFile=0x28a4, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.153] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.158] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.158] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1528f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0197.158] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0) returned 0x0 [0197.158] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1528f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0197.158] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.159] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1528f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0197.163] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.167] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.167] WriteFile (in: hFile=0x28a4, lpBuffer=0x1528fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1528f830, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesWritten=0x1528f830*=0x428, lpOverlapped=0x0) returned 1 [0197.167] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.168] ReadFile (in: hFile=0x28a4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1528f61c*=0x1e58, lpOverlapped=0x0) returned 1 [0197.168] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xffffe1a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.168] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x1e58, pPaddingInfo=0x0, pbIV=0x1528f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1528f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1528f848, pbOutput=0x2750000, pcbResult=0x1528f618) returned 0x0 [0197.168] WriteFile (in: hFile=0x28a4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1528f61c*=0x1e60, lpOverlapped=0x0) returned 1 [0197.169] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1528f60c | out: lpNewFilePointer=0x0) returned 1 [0197.169] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.169] WriteFile (in: hFile=0x28a4, lpBuffer=0x1528f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x1528f83c*, lpNumberOfBytesWritten=0x1528f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.169] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x1e60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.169] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.169] CloseHandle (hObject=0x28a4) returned 1 [0197.169] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.play")) returned 1 [0197.175] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3436 os_tid = 0x33e0 [0197.213] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.213] ReadFile (in: hFile=0x2894, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.214] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.215] ReadFile (in: hFile=0x2894, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.215] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.219] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.220] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0197.220] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0197.220] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0197.220] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.220] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0197.224] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.228] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.228] WriteFile (in: hFile=0x2894, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0197.229] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.229] ReadFile (in: hFile=0x2894, lpBuffer=0x2850000, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1590f61c*=0x19a4, lpOverlapped=0x0) returned 1 [0197.229] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xffffe65c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.230] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x19a4, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2850000, pcbResult=0x1590f618) returned 0x0 [0197.230] WriteFile (in: hFile=0x2894, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1590f61c*=0x19b0, lpOverlapped=0x0) returned 1 [0197.230] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0197.230] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.230] WriteFile (in: hFile=0x2894, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.230] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x19b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.230] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.230] CloseHandle (hObject=0x2894) returned 1 [0197.230] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.play")) returned 1 [0197.235] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3437 os_tid = 0x33e4 [0197.284] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.284] ReadFile (in: hFile=0x2884, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.286] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.286] ReadFile (in: hFile=0x2884, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.286] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.291] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x15a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0197.291] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x15a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x15a0f828, pbKeyObject=0x0) returned 0x0 [0197.291] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15a0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15a0f500) returned 0x0 [0197.291] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.291] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15a0f500) returned 0x0 [0197.296] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.301] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.301] WriteFile (in: hFile=0x2884, lpBuffer=0x15a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a0f830, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesWritten=0x15a0f830*=0x428, lpOverlapped=0x0) returned 1 [0197.301] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.301] ReadFile (in: hFile=0x2884, lpBuffer=0x2950000, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x15a0f61c*=0x1cb3, lpOverlapped=0x0) returned 1 [0197.302] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xffffe34d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.302] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x1cb3, pPaddingInfo=0x0, pbIV=0x15a0f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x15a0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a0f848, pbOutput=0x2950000, pcbResult=0x15a0f618) returned 0x0 [0197.302] WriteFile (in: hFile=0x2884, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x15a0f61c*=0x1cc0, lpOverlapped=0x0) returned 1 [0197.305] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a0f60c | out: lpNewFilePointer=0x0) returned 1 [0197.305] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.306] WriteFile (in: hFile=0x2884, lpBuffer=0x15a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a0f83c*, lpNumberOfBytesWritten=0x15a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.306] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x1cc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.306] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.306] CloseHandle (hObject=0x2884) returned 1 [0197.306] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.play")) returned 1 [0197.312] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3438 os_tid = 0x33e8 [0197.350] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.350] ReadFile (in: hFile=0x2874, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.352] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.352] ReadFile (in: hFile=0x2874, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.352] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.357] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.357] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x15b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0197.357] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x15b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x15b4f828, pbKeyObject=0x0) returned 0x0 [0197.357] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15b4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15b4f500) returned 0x0 [0197.357] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.357] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15b4f500) returned 0x0 [0197.362] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.366] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.367] WriteFile (in: hFile=0x2874, lpBuffer=0x15b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b4f830, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesWritten=0x15b4f830*=0x428, lpOverlapped=0x0) returned 1 [0197.367] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.367] ReadFile (in: hFile=0x2874, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x15b4f61c*=0x1a6c, lpOverlapped=0x0) returned 1 [0197.368] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xffffe594, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.368] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0x1a6c, pPaddingInfo=0x0, pbIV=0x15b4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x15b4f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15b4f848, pbOutput=0x2a50000, pcbResult=0x15b4f618) returned 0x0 [0197.368] WriteFile (in: hFile=0x2874, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x15b4f61c*=0x1a70, lpOverlapped=0x0) returned 1 [0197.368] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b4f60c | out: lpNewFilePointer=0x0) returned 1 [0197.368] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.368] WriteFile (in: hFile=0x2874, lpBuffer=0x15b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b4f83c*, lpNumberOfBytesWritten=0x15b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.368] SetFilePointerEx (in: hFile=0x2874, liDistanceToMove=0x1a70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.368] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.368] CloseHandle (hObject=0x2874) returned 1 [0197.368] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.play")) returned 1 [0197.373] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3439 os_tid = 0x33ec [0197.383] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.383] ReadFile (in: hFile=0x2864, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.386] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.386] ReadFile (in: hFile=0x2864, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.387] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.393] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.393] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15c8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0197.393] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15c8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15c8f828, pbKeyObject=0x0) returned 0x0 [0197.393] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15c8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15c8f500) returned 0x0 [0197.394] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.394] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15c8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15c8f500) returned 0x0 [0197.399] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.403] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.403] WriteFile (in: hFile=0x2864, lpBuffer=0x15c8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15c8f830, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesWritten=0x15c8f830*=0x428, lpOverlapped=0x0) returned 1 [0197.403] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.403] ReadFile (in: hFile=0x2864, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15c8f61c*=0x1511, lpOverlapped=0x0) returned 1 [0197.403] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xffffeaef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.403] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0x1511, pPaddingInfo=0x0, pbIV=0x15c8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15c8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15c8f848, pbOutput=0x2b50000, pcbResult=0x15c8f618) returned 0x0 [0197.403] WriteFile (in: hFile=0x2864, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15c8f61c*=0x1520, lpOverlapped=0x0) returned 1 [0197.403] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15c8f60c | out: lpNewFilePointer=0x0) returned 1 [0197.403] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.403] WriteFile (in: hFile=0x2864, lpBuffer=0x15c8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15c8f83c*, lpNumberOfBytesWritten=0x15c8f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.403] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x1520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.403] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.404] CloseHandle (hObject=0x2864) returned 1 [0197.404] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.play")) returned 1 [0197.409] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3440 os_tid = 0x33f0 [0197.413] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.413] ReadFile (in: hFile=0x2854, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0197.415] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.415] ReadFile (in: hFile=0x2854, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0197.415] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.418] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x15dcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0197.418] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x15dcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x15dcf828, pbKeyObject=0x0) returned 0x0 [0197.418] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15dcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15dcf500) returned 0x0 [0197.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.418] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15dcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15dcf500) returned 0x0 [0197.421] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.425] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.425] WriteFile (in: hFile=0x2854, lpBuffer=0x15dcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15dcf830, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesWritten=0x15dcf830*=0x428, lpOverlapped=0x0) returned 1 [0197.425] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.425] ReadFile (in: hFile=0x2854, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x15dcf61c*=0x6140, lpOverlapped=0x0) returned 1 [0197.426] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xffff9ec0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.426] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2c50000, cbInput=0x6140, pPaddingInfo=0x0, pbIV=0x15dcf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x15dcf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15dcf848, pbOutput=0x2c50000, pcbResult=0x15dcf618) returned 0x0 [0197.426] WriteFile (in: hFile=0x2854, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x15dcf61c*=0x6150, lpOverlapped=0x0) returned 1 [0197.426] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15dcf60c | out: lpNewFilePointer=0x0) returned 1 [0197.426] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.426] WriteFile (in: hFile=0x2854, lpBuffer=0x15dcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15dcf83c*, lpNumberOfBytesWritten=0x15dcf61c*=0x8, lpOverlapped=0x0) returned 1 [0197.426] SetFilePointerEx (in: hFile=0x2854, liDistanceToMove=0x6150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.426] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.426] CloseHandle (hObject=0x2854) returned 1 [0197.426] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.play")) returned 1 [0197.433] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3441 os_tid = 0x33f4 [0197.437] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.437] ReadFile (in: hFile=0x2844, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.439] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.439] ReadFile (in: hFile=0x2844, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.439] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.443] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.444] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x15f0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0197.444] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x15f0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x15f0f828, pbKeyObject=0x0) returned 0x0 [0197.444] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15f0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15f0f500) returned 0x0 [0197.444] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.444] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15f0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15f0f500) returned 0x0 [0197.449] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.456] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.456] WriteFile (in: hFile=0x2844, lpBuffer=0x15f0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15f0f830, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesWritten=0x15f0f830*=0x428, lpOverlapped=0x0) returned 1 [0197.456] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.457] ReadFile (in: hFile=0x2844, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x15f0f61c*=0x411a, lpOverlapped=0x0) returned 1 [0197.457] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xffffbee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.457] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x411a, pPaddingInfo=0x0, pbIV=0x15f0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x15f0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15f0f848, pbOutput=0x2d50000, pcbResult=0x15f0f618) returned 0x0 [0197.457] WriteFile (in: hFile=0x2844, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x15f0f61c*=0x4120, lpOverlapped=0x0) returned 1 [0197.458] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15f0f60c | out: lpNewFilePointer=0x0) returned 1 [0197.458] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.472] WriteFile (in: hFile=0x2844, lpBuffer=0x15f0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15f0f83c*, lpNumberOfBytesWritten=0x15f0f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.473] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x4120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.473] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.473] CloseHandle (hObject=0x2844) returned 1 [0197.473] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.play")) returned 1 [0197.479] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3442 os_tid = 0x33f8 [0197.484] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.484] ReadFile (in: hFile=0x2834, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.488] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.488] ReadFile (in: hFile=0x2834, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.488] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.494] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.494] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0197.494] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0197.494] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0197.494] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.494] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0197.498] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.504] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.504] WriteFile (in: hFile=0x2834, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0197.504] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.504] ReadFile (in: hFile=0x2834, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x219ff61c*=0x3d5c, lpOverlapped=0x0) returned 1 [0197.507] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xffffc2a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.507] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0x3d5c, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x219ff848, pbOutput=0x2e50000, pcbResult=0x219ff618) returned 0x0 [0197.507] WriteFile (in: hFile=0x2834, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x219ff61c*=0x3d60, lpOverlapped=0x0) returned 1 [0197.507] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0197.507] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.508] WriteFile (in: hFile=0x2834, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0197.508] SetFilePointerEx (in: hFile=0x2834, liDistanceToMove=0x3d60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.508] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.508] CloseHandle (hObject=0x2834) returned 1 [0197.508] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.play")) returned 1 [0197.513] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3443 os_tid = 0x33fc [0197.523] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.523] ReadFile (in: hFile=0x2824, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.525] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.525] ReadFile (in: hFile=0x2824, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.525] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.528] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.528] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0197.528] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0197.528] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0197.529] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.529] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0197.532] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.535] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.536] WriteFile (in: hFile=0x2824, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0197.536] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.536] ReadFile (in: hFile=0x2824, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x2d37f61c*=0x4040, lpOverlapped=0x0) returned 1 [0197.539] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xffffbfc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.539] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2f50000, cbInput=0x4040, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x2f50000, pcbResult=0x2d37f618) returned 0x0 [0197.539] WriteFile (in: hFile=0x2824, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x2d37f61c*=0x4050, lpOverlapped=0x0) returned 1 [0197.539] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0197.539] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.539] WriteFile (in: hFile=0x2824, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.539] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x4050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.539] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.539] CloseHandle (hObject=0x2824) returned 1 [0197.540] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.play")) returned 1 [0197.545] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3444 os_tid = 0x480 [0197.549] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.549] ReadFile (in: hFile=0x27f4, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.553] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.553] ReadFile (in: hFile=0x27f4, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.553] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.556] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.556] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0197.556] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0197.556] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0197.556] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.556] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0197.560] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.563] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.563] WriteFile (in: hFile=0x27f4, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0197.563] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.563] ReadFile (in: hFile=0x27f4, lpBuffer=0x3050000, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d47f61c*=0x4d18, lpOverlapped=0x0) returned 1 [0197.566] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xffffb2e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.566] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x4d18, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d47f848, pbOutput=0x3050000, pcbResult=0x2d47f618) returned 0x0 [0197.566] WriteFile (in: hFile=0x27f4, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d47f61c*=0x4d20, lpOverlapped=0x0) returned 1 [0197.567] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0197.567] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.567] WriteFile (in: hFile=0x27f4, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.567] SetFilePointerEx (in: hFile=0x27f4, liDistanceToMove=0x4d20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.567] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.567] CloseHandle (hObject=0x27f4) returned 1 [0197.567] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.play")) returned 1 [0197.572] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3445 os_tid = 0x2f8 [0197.579] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.579] ReadFile (in: hFile=0x2980, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.581] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.581] ReadFile (in: hFile=0x2980, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.581] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.585] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0197.585] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0197.585] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0197.585] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.585] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0197.588] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.591] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.591] WriteFile (in: hFile=0x2980, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0197.592] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.592] ReadFile (in: hFile=0x2980, lpBuffer=0x3150000, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d57f61c*=0x47ec, lpOverlapped=0x0) returned 1 [0197.592] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xffffb814, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.592] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x47ec, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x3150000, pcbResult=0x2d57f618) returned 0x0 [0197.593] WriteFile (in: hFile=0x2980, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d57f61c*=0x47f0, lpOverlapped=0x0) returned 1 [0197.593] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0197.593] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.593] WriteFile (in: hFile=0x2980, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.595] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x47f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.595] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.595] CloseHandle (hObject=0x2980) returned 1 [0197.595] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.play")) returned 1 [0197.599] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3446 os_tid = 0x1cc [0197.603] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.603] ReadFile (in: hFile=0x2988, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.607] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.607] ReadFile (in: hFile=0x2988, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.607] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.609] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.610] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0197.610] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0197.610] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0197.610] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.610] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0197.613] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.618] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.618] WriteFile (in: hFile=0x2988, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0197.619] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.619] ReadFile (in: hFile=0x2988, lpBuffer=0x3250000, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d67f61c*=0x8b4, lpOverlapped=0x0) returned 1 [0197.619] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0xfffff74c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.619] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x8b4, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d67f848, pbOutput=0x3250000, pcbResult=0x2d67f618) returned 0x0 [0197.619] WriteFile (in: hFile=0x2988, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d67f61c*=0x8c0, lpOverlapped=0x0) returned 1 [0197.619] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0197.619] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.619] WriteFile (in: hFile=0x2988, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.619] SetFilePointerEx (in: hFile=0x2988, liDistanceToMove=0x8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.619] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.619] CloseHandle (hObject=0x2988) returned 1 [0197.619] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.play")) returned 1 [0197.625] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3447 os_tid = 0x630 [0197.633] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.633] ReadFile (in: hFile=0x2990, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.635] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.635] ReadFile (in: hFile=0x2990, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.635] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.638] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.638] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x3c87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0197.639] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x3c87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x3c87f828, pbKeyObject=0x0) returned 0x0 [0197.639] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c87f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c87f500) returned 0x0 [0197.639] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.639] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c87f500) returned 0x0 [0197.645] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.652] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.652] WriteFile (in: hFile=0x2990, lpBuffer=0x3c87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c87f830, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesWritten=0x3c87f830*=0x428, lpOverlapped=0x0) returned 1 [0197.653] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.653] ReadFile (in: hFile=0x2990, lpBuffer=0x3350000, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x3c87f61c*=0xaf4, lpOverlapped=0x0) returned 1 [0197.653] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xfffff50c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.653] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0xaf4, pPaddingInfo=0x0, pbIV=0x3c87f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x3c87f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c87f848, pbOutput=0x3350000, pcbResult=0x3c87f618) returned 0x0 [0197.653] WriteFile (in: hFile=0x2990, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x3c87f61c*=0xb00, lpOverlapped=0x0) returned 1 [0197.653] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c87f60c | out: lpNewFilePointer=0x0) returned 1 [0197.653] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.653] WriteFile (in: hFile=0x2990, lpBuffer=0x3c87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c87f83c*, lpNumberOfBytesWritten=0x3c87f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.653] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xb00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.653] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.653] CloseHandle (hObject=0x2990) returned 1 [0197.654] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.play")) returned 1 [0197.659] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3448 os_tid = 0x3044 [0197.667] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.667] ReadFile (in: hFile=0x2998, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.669] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.669] ReadFile (in: hFile=0x2998, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.669] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.673] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.673] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x3d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0197.674] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x3d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x3d9ff828, pbKeyObject=0x0) returned 0x0 [0197.674] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3d9ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3d9ff500) returned 0x0 [0197.674] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.674] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3d9ff500) returned 0x0 [0197.729] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.734] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.734] WriteFile (in: hFile=0x2998, lpBuffer=0x3d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesWritten=0x3d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0197.734] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.734] ReadFile (in: hFile=0x2998, lpBuffer=0x3450000, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x3d9ff61c*=0x5aa4, lpOverlapped=0x0) returned 1 [0197.738] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0xffffa55c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.738] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0x5aa4, pPaddingInfo=0x0, pbIV=0x3d9ff848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x3d9ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d9ff848, pbOutput=0x3450000, pcbResult=0x3d9ff618) returned 0x0 [0197.738] WriteFile (in: hFile=0x2998, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x3d9ff61c*=0x5ab0, lpOverlapped=0x0) returned 1 [0197.738] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0197.738] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.738] WriteFile (in: hFile=0x2998, lpBuffer=0x3d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ff83c*, lpNumberOfBytesWritten=0x3d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0197.739] SetFilePointerEx (in: hFile=0x2998, liDistanceToMove=0x5ab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.739] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.739] CloseHandle (hObject=0x2998) returned 1 [0197.739] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.play")) returned 1 [0197.745] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3449 os_tid = 0x66c [0197.750] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.750] ReadFile (in: hFile=0x29a0, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.754] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.754] ReadFile (in: hFile=0x29a0, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.755] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.759] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.759] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x3fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0197.759] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x3fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x3fcff828, pbKeyObject=0x0) returned 0x0 [0197.759] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3fcff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3fcff500) returned 0x0 [0197.759] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.759] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3fcff500) returned 0x0 [0197.765] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.769] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.769] WriteFile (in: hFile=0x29a0, lpBuffer=0x3fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fcff830, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesWritten=0x3fcff830*=0x428, lpOverlapped=0x0) returned 1 [0197.770] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.770] ReadFile (in: hFile=0x29a0, lpBuffer=0x3550000, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x3fcff61c*=0x1cf8, lpOverlapped=0x0) returned 1 [0197.771] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xffffe308, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.771] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3550000, cbInput=0x1cf8, pPaddingInfo=0x0, pbIV=0x3fcff848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x3fcff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fcff848, pbOutput=0x3550000, pcbResult=0x3fcff618) returned 0x0 [0197.771] WriteFile (in: hFile=0x29a0, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x3fcff61c*=0x1d00, lpOverlapped=0x0) returned 1 [0197.773] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fcff60c | out: lpNewFilePointer=0x0) returned 1 [0197.773] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.773] WriteFile (in: hFile=0x29a0, lpBuffer=0x3fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3fcff83c*, lpNumberOfBytesWritten=0x3fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0197.774] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x1d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.774] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.774] CloseHandle (hObject=0x29a0) returned 1 [0197.774] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.778] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.play")) returned 1 [0197.780] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3450 os_tid = 0x430 [0197.787] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.787] ReadFile (in: hFile=0x29a8, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.791] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.791] ReadFile (in: hFile=0x29a8, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.791] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.795] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.795] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x3fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0197.795] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x3fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x3fe3f828, pbKeyObject=0x0) returned 0x0 [0197.795] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3fe3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3fe3f500) returned 0x0 [0197.796] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.796] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3fe3f500) returned 0x0 [0197.804] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.809] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.809] WriteFile (in: hFile=0x29a8, lpBuffer=0x3fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesWritten=0x3fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0197.809] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.809] ReadFile (in: hFile=0x29a8, lpBuffer=0x3650000, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x3fe3f61c*=0x4124, lpOverlapped=0x0) returned 1 [0197.810] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0xffffbedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.810] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3650000, cbInput=0x4124, pPaddingInfo=0x0, pbIV=0x3fe3f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x3fe3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fe3f848, pbOutput=0x3650000, pcbResult=0x3fe3f618) returned 0x0 [0197.810] WriteFile (in: hFile=0x29a8, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x3fe3f61c*=0x4130, lpOverlapped=0x0) returned 1 [0197.810] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0197.810] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.811] WriteFile (in: hFile=0x29a8, lpBuffer=0x3fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3f83c*, lpNumberOfBytesWritten=0x3fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.811] SetFilePointerEx (in: hFile=0x29a8, liDistanceToMove=0x4130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.811] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.811] CloseHandle (hObject=0x29a8) returned 1 [0197.811] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.815] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.play")) returned 1 [0197.817] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3451 os_tid = 0x474 [0197.824] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.825] ReadFile (in: hFile=0x29b0, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.827] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.827] ReadFile (in: hFile=0x29b0, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.827] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.830] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.831] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x3ff7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0197.831] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x3ff7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x3ff7f828, pbKeyObject=0x0) returned 0x0 [0197.831] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3ff7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3ff7f500) returned 0x0 [0197.831] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.831] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3ff7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3ff7f500) returned 0x0 [0197.839] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.844] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.844] WriteFile (in: hFile=0x29b0, lpBuffer=0x3ff7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ff7f830, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesWritten=0x3ff7f830*=0x428, lpOverlapped=0x0) returned 1 [0197.845] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.845] ReadFile (in: hFile=0x29b0, lpBuffer=0x3750000, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x3ff7f61c*=0x1402c, lpOverlapped=0x0) returned 1 [0197.852] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xfffebfd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.852] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3750000, cbInput=0x1402c, pPaddingInfo=0x0, pbIV=0x3ff7f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x3ff7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ff7f848, pbOutput=0x3750000, pcbResult=0x3ff7f618) returned 0x0 [0197.852] WriteFile (in: hFile=0x29b0, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x3ff7f61c*=0x14030, lpOverlapped=0x0) returned 1 [0197.853] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ff7f60c | out: lpNewFilePointer=0x0) returned 1 [0197.853] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.853] WriteFile (in: hFile=0x29b0, lpBuffer=0x3ff7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7f83c*, lpNumberOfBytesWritten=0x3ff7f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.853] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x14030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.853] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.853] CloseHandle (hObject=0x29b0) returned 1 [0197.854] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.play")) returned 1 [0197.865] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3452 os_tid = 0x2e74 [0197.872] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.872] ReadFile (in: hFile=0x29b8, lpBuffer=0x403ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x403ff85c, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesRead=0x403ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.877] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.877] ReadFile (in: hFile=0x29b8, lpBuffer=0x403ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x403ff85c, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesRead=0x403ff85c*=0x428, lpOverlapped=0x0) returned 1 [0197.877] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0197.883] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0197.883] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x403ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0197.883] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x403ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x403ff828, pbKeyObject=0x0) returned 0x0 [0197.883] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x403ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x403ff500) returned 0x0 [0197.884] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0197.884] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x403ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x403ff500) returned 0x0 [0197.892] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.897] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.897] WriteFile (in: hFile=0x29b8, lpBuffer=0x403ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x403ff830, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesWritten=0x403ff830*=0x428, lpOverlapped=0x0) returned 1 [0197.904] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.904] ReadFile (in: hFile=0x29b8, lpBuffer=0x3850000, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x403ff61c*=0x1ee4, lpOverlapped=0x0) returned 1 [0197.904] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0xffffe11c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.905] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3850000, cbInput=0x1ee4, pPaddingInfo=0x0, pbIV=0x403ff848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x403ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x403ff848, pbOutput=0x3850000, pcbResult=0x403ff618) returned 0x0 [0197.905] WriteFile (in: hFile=0x29b8, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x403ff61c*=0x1ef0, lpOverlapped=0x0) returned 1 [0197.905] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x403ff60c | out: lpNewFilePointer=0x0) returned 1 [0197.905] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.905] WriteFile (in: hFile=0x29b8, lpBuffer=0x403ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x403ff83c*, lpNumberOfBytesWritten=0x403ff61c*=0x8, lpOverlapped=0x0) returned 1 [0197.905] SetFilePointerEx (in: hFile=0x29b8, liDistanceToMove=0x1ef0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.906] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.906] CloseHandle (hObject=0x29b8) returned 1 [0197.906] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0197.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.play")) returned 1 [0199.624] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3453 os_tid = 0xbac [0197.933] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.933] ReadFile (in: hFile=0x28a4, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.935] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.935] ReadFile (in: hFile=0x28a4, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.935] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0197.943] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0197.943] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x1528f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0197.943] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x1528f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x1528f828, pbKeyObject=0x0) returned 0x0 [0197.943] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1528f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1528f500) returned 0x0 [0197.944] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0197.944] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1528f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1528f500) returned 0x0 [0197.953] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.957] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.957] WriteFile (in: hFile=0x28a4, lpBuffer=0x1528fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1528f830, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesWritten=0x1528f830*=0x428, lpOverlapped=0x0) returned 1 [0197.958] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.958] ReadFile (in: hFile=0x28a4, lpBuffer=0x3950000, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x1528f61c*=0x8da8, lpOverlapped=0x0) returned 1 [0197.965] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xffff7258, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.965] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3950000, cbInput=0x8da8, pPaddingInfo=0x0, pbIV=0x1528f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x1528f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1528f848, pbOutput=0x3950000, pcbResult=0x1528f618) returned 0x0 [0197.965] WriteFile (in: hFile=0x28a4, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x1528f61c*=0x8db0, lpOverlapped=0x0) returned 1 [0197.965] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1528f60c | out: lpNewFilePointer=0x0) returned 1 [0197.966] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.966] WriteFile (in: hFile=0x28a4, lpBuffer=0x1528f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x1528f83c*, lpNumberOfBytesWritten=0x1528f61c*=0x8, lpOverlapped=0x0) returned 1 [0197.966] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x8db0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.966] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0197.966] CloseHandle (hObject=0x28a4) returned 1 [0197.966] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0197.970] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.play")) returned 1 [0197.972] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3454 os_tid = 0xb5c [0197.978] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.978] ReadFile (in: hFile=0x29cc, lpBuffer=0x1624fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1624f85c, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesRead=0x1624f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.980] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.980] ReadFile (in: hFile=0x29cc, lpBuffer=0x1624fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1624f85c, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesRead=0x1624f85c*=0x428, lpOverlapped=0x0) returned 1 [0197.980] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0197.984] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0197.984] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1624f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0197.984] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1624f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1624f828, pbKeyObject=0x0) returned 0x0 [0197.984] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1624f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1624f500) returned 0x0 [0197.985] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0197.985] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1624f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1624f500) returned 0x0 [0197.994] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.998] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.998] WriteFile (in: hFile=0x29cc, lpBuffer=0x1624fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1624f830, lpOverlapped=0x0 | out: lpBuffer=0x1624fb34*, lpNumberOfBytesWritten=0x1624f830*=0x428, lpOverlapped=0x0) returned 1 [0197.999] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.999] ReadFile (in: hFile=0x29cc, lpBuffer=0x2750000, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1624f61c*=0x140c, lpOverlapped=0x0) returned 1 [0197.999] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0xffffebf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.999] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x140c, pPaddingInfo=0x0, pbIV=0x1624f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1624f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1624f848, pbOutput=0x2750000, pcbResult=0x1624f618) returned 0x0 [0197.999] WriteFile (in: hFile=0x29cc, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1624f61c*=0x1410, lpOverlapped=0x0) returned 1 [0197.999] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1624f60c | out: lpNewFilePointer=0x0) returned 1 [0197.999] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.999] WriteFile (in: hFile=0x29cc, lpBuffer=0x1624f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1624f61c, lpOverlapped=0x0 | out: lpBuffer=0x1624f83c*, lpNumberOfBytesWritten=0x1624f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.000] SetFilePointerEx (in: hFile=0x29cc, liDistanceToMove=0x1410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.000] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.000] CloseHandle (hObject=0x29cc) returned 1 [0198.000] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.play")) returned 1 [0198.009] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3455 os_tid = 0x3404 [0198.015] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.015] ReadFile (in: hFile=0x29d4, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.017] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.017] ReadFile (in: hFile=0x29d4, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.020] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.024] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.024] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x4053f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0198.024] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x4053f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x4053f828, pbKeyObject=0x0) returned 0x0 [0198.024] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4053f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4053f500) returned 0x0 [0198.024] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.025] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4053f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4053f500) returned 0x0 [0198.029] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.033] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.034] WriteFile (in: hFile=0x29d4, lpBuffer=0x4053fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4053f830, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesWritten=0x4053f830*=0x428, lpOverlapped=0x0) returned 1 [0198.034] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.034] ReadFile (in: hFile=0x29d4, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x4053f61c*=0x26b0, lpOverlapped=0x0) returned 1 [0198.037] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xffffd950, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.037] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3a50000, cbInput=0x26b0, pPaddingInfo=0x0, pbIV=0x4053f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x4053f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4053f848, pbOutput=0x3a50000, pcbResult=0x4053f618) returned 0x0 [0198.037] WriteFile (in: hFile=0x29d4, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x26c0, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x4053f61c*=0x26c0, lpOverlapped=0x0) returned 1 [0198.037] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4053f60c | out: lpNewFilePointer=0x0) returned 1 [0198.037] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.038] WriteFile (in: hFile=0x29d4, lpBuffer=0x4053f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x4053f83c*, lpNumberOfBytesWritten=0x4053f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.038] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x26c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.038] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.038] CloseHandle (hObject=0x29d4) returned 1 [0198.038] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.042] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.play")) returned 1 [0198.044] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3456 os_tid = 0x3408 [0198.049] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.049] ReadFile (in: hFile=0x29dc, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.054] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.054] ReadFile (in: hFile=0x29dc, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.055] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.059] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.059] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x4067f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0198.059] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x4067f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x4067f828, pbKeyObject=0x0) returned 0x0 [0198.059] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4067f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4067f500) returned 0x0 [0198.059] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.059] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4067f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4067f500) returned 0x0 [0198.064] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.069] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.069] WriteFile (in: hFile=0x29dc, lpBuffer=0x4067fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4067f830, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesWritten=0x4067f830*=0x428, lpOverlapped=0x0) returned 1 [0198.069] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.069] ReadFile (in: hFile=0x29dc, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x4067f61c*=0x5670, lpOverlapped=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0xffffa990, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.073] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3b50000, cbInput=0x5670, pPaddingInfo=0x0, pbIV=0x4067f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x4067f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4067f848, pbOutput=0x3b50000, pcbResult=0x4067f618) returned 0x0 [0198.073] WriteFile (in: hFile=0x29dc, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x4067f61c*=0x5680, lpOverlapped=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4067f60c | out: lpNewFilePointer=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.073] WriteFile (in: hFile=0x29dc, lpBuffer=0x4067f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x4067f83c*, lpNumberOfBytesWritten=0x4067f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x29dc, liDistanceToMove=0x5680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.073] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.073] CloseHandle (hObject=0x29dc) returned 1 [0198.074] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.play")) returned 1 [0198.079] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3457 os_tid = 0x340c [0198.087] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.087] ReadFile (in: hFile=0x29e4, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.089] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.089] ReadFile (in: hFile=0x29e4, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.089] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.093] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.093] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x407bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0198.093] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x407bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x407bf828, pbKeyObject=0x0) returned 0x0 [0198.093] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x407bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x407bf500) returned 0x0 [0198.093] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.094] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x407bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x407bf500) returned 0x0 [0198.098] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.105] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.105] WriteFile (in: hFile=0x29e4, lpBuffer=0x407bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x407bf830, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesWritten=0x407bf830*=0x428, lpOverlapped=0x0) returned 1 [0198.105] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.106] ReadFile (in: hFile=0x29e4, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x407bf61c*=0x1ae6, lpOverlapped=0x0) returned 1 [0198.107] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xffffe51a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.108] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3c50000, cbInput=0x1ae6, pPaddingInfo=0x0, pbIV=0x407bf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x407bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x407bf848, pbOutput=0x3c50000, pcbResult=0x407bf618) returned 0x0 [0198.108] WriteFile (in: hFile=0x29e4, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x407bf61c*=0x1af0, lpOverlapped=0x0) returned 1 [0198.108] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407bf60c | out: lpNewFilePointer=0x0) returned 1 [0198.108] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.108] WriteFile (in: hFile=0x29e4, lpBuffer=0x407bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x407bf83c*, lpNumberOfBytesWritten=0x407bf61c*=0x8, lpOverlapped=0x0) returned 1 [0198.108] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0x1af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.108] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.108] CloseHandle (hObject=0x29e4) returned 1 [0198.108] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.play")) returned 1 [0198.114] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3458 os_tid = 0x3410 [0198.122] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.122] ReadFile (in: hFile=0x29ec, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.124] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.124] ReadFile (in: hFile=0x29ec, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.124] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.128] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.128] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x408ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0198.128] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x408ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x408ff828, pbKeyObject=0x0) returned 0x0 [0198.128] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x408ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x408ff500) returned 0x0 [0198.128] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.128] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x408ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x408ff500) returned 0x0 [0198.135] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.140] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.140] WriteFile (in: hFile=0x29ec, lpBuffer=0x408ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x408ff830, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesWritten=0x408ff830*=0x428, lpOverlapped=0x0) returned 1 [0198.140] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.140] ReadFile (in: hFile=0x29ec, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x408ff61c*=0x1928, lpOverlapped=0x0) returned 1 [0198.144] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0xffffe6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.144] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3d50000, cbInput=0x1928, pPaddingInfo=0x0, pbIV=0x408ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x408ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x408ff848, pbOutput=0x3d50000, pcbResult=0x408ff618) returned 0x0 [0198.144] WriteFile (in: hFile=0x29ec, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x408ff61c*=0x1930, lpOverlapped=0x0) returned 1 [0198.144] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x408ff60c | out: lpNewFilePointer=0x0) returned 1 [0198.144] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.144] WriteFile (in: hFile=0x29ec, lpBuffer=0x408ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x408ff83c*, lpNumberOfBytesWritten=0x408ff61c*=0x8, lpOverlapped=0x0) returned 1 [0198.144] SetFilePointerEx (in: hFile=0x29ec, liDistanceToMove=0x1930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.144] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.144] CloseHandle (hObject=0x29ec) returned 1 [0198.145] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.play")) returned 1 [0198.151] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3459 os_tid = 0x3414 [0198.159] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.159] ReadFile (in: hFile=0x29f4, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.160] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.161] ReadFile (in: hFile=0x29f4, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.161] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.165] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.165] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x40a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0198.165] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x40a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x40a3f828, pbKeyObject=0x0) returned 0x0 [0198.165] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x40a3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x40a3f500) returned 0x0 [0198.165] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.165] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x40a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x40a3f500) returned 0x0 [0198.170] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.174] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.174] WriteFile (in: hFile=0x29f4, lpBuffer=0x40a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40a3f830, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesWritten=0x40a3f830*=0x428, lpOverlapped=0x0) returned 1 [0198.175] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.175] ReadFile (in: hFile=0x29f4, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x40a3f61c*=0x4cea, lpOverlapped=0x0) returned 1 [0198.176] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xffffb316, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.176] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3e50000, cbInput=0x4cea, pPaddingInfo=0x0, pbIV=0x40a3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x40a3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40a3f848, pbOutput=0x3e50000, pcbResult=0x40a3f618) returned 0x0 [0198.176] WriteFile (in: hFile=0x29f4, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x40a3f61c*=0x4cf0, lpOverlapped=0x0) returned 1 [0198.179] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40a3f60c | out: lpNewFilePointer=0x0) returned 1 [0198.179] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.179] WriteFile (in: hFile=0x29f4, lpBuffer=0x40a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x40a3f83c*, lpNumberOfBytesWritten=0x40a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.179] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x4cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.179] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.179] CloseHandle (hObject=0x29f4) returned 1 [0198.179] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.play")) returned 1 [0198.185] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3460 os_tid = 0x3418 [0198.192] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.193] ReadFile (in: hFile=0x29fc, lpBuffer=0x40b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesRead=0x40b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.194] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.194] ReadFile (in: hFile=0x29fc, lpBuffer=0x40b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesRead=0x40b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.194] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.198] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.198] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x40b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0198.198] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x40b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x40b7f828, pbKeyObject=0x0) returned 0x0 [0198.198] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x40b7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x40b7f500) returned 0x0 [0198.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.199] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x40b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x40b7f500) returned 0x0 [0198.203] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.207] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.207] WriteFile (in: hFile=0x29fc, lpBuffer=0x40b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40b7f830, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesWritten=0x40b7f830*=0x428, lpOverlapped=0x0) returned 1 [0198.208] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.208] ReadFile (in: hFile=0x29fc, lpBuffer=0x3f50000, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x40b7f61c*=0xb12c, lpOverlapped=0x0) returned 1 [0198.212] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0xffff4ed4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.212] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0xb12c, pPaddingInfo=0x0, pbIV=0x40b7f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x40b7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40b7f848, pbOutput=0x3f50000, pcbResult=0x40b7f618) returned 0x0 [0198.213] WriteFile (in: hFile=0x29fc, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x40b7f61c*=0xb130, lpOverlapped=0x0) returned 1 [0198.213] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40b7f60c | out: lpNewFilePointer=0x0) returned 1 [0198.213] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.213] WriteFile (in: hFile=0x29fc, lpBuffer=0x40b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x40b7f83c*, lpNumberOfBytesWritten=0x40b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.213] SetFilePointerEx (in: hFile=0x29fc, liDistanceToMove=0xb130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.213] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.213] CloseHandle (hObject=0x29fc) returned 1 [0198.213] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.217] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.play")) returned 1 [0198.219] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3461 os_tid = 0x341c [0198.226] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.226] ReadFile (in: hFile=0x2a04, lpBuffer=0x40cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesRead=0x40cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.228] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.228] ReadFile (in: hFile=0x2a04, lpBuffer=0x40cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesRead=0x40cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.228] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.231] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.231] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x40cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0198.231] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x40cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x40cbf828, pbKeyObject=0x0) returned 0x0 [0198.231] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x40cbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x40cbf500) returned 0x0 [0198.232] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.232] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x40cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x40cbf500) returned 0x0 [0198.237] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.241] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.241] WriteFile (in: hFile=0x2a04, lpBuffer=0x40cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40cbf830, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesWritten=0x40cbf830*=0x428, lpOverlapped=0x0) returned 1 [0198.241] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.241] ReadFile (in: hFile=0x2a04, lpBuffer=0x4050000, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x40cbf61c*=0x6028, lpOverlapped=0x0) returned 1 [0198.242] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xffff9fd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.242] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4050000, cbInput=0x6028, pPaddingInfo=0x0, pbIV=0x40cbf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x40cbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40cbf848, pbOutput=0x4050000, pcbResult=0x40cbf618) returned 0x0 [0198.242] WriteFile (in: hFile=0x2a04, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x40cbf61c*=0x6030, lpOverlapped=0x0) returned 1 [0198.243] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40cbf60c | out: lpNewFilePointer=0x0) returned 1 [0198.243] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.243] WriteFile (in: hFile=0x2a04, lpBuffer=0x40cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x40cbf83c*, lpNumberOfBytesWritten=0x40cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0198.243] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x6030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.243] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.243] CloseHandle (hObject=0x2a04) returned 1 [0198.243] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.play")) returned 1 [0198.248] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3462 os_tid = 0x3420 [0198.254] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.254] ReadFile (in: hFile=0x2a0c, lpBuffer=0x40dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40dff85c, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesRead=0x40dff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.255] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.256] ReadFile (in: hFile=0x2a0c, lpBuffer=0x40dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40dff85c, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesRead=0x40dff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.256] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.259] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.259] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x40dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0198.259] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x40dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x40dff828, pbKeyObject=0x0) returned 0x0 [0198.260] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x40dff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x40dff500) returned 0x0 [0198.260] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.260] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x40dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x40dff500) returned 0x0 [0198.264] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.268] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.269] WriteFile (in: hFile=0x2a0c, lpBuffer=0x40dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40dff830, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesWritten=0x40dff830*=0x428, lpOverlapped=0x0) returned 1 [0198.269] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.269] ReadFile (in: hFile=0x2a0c, lpBuffer=0x4150000, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x40dff61c*=0x108a, lpOverlapped=0x0) returned 1 [0198.269] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0xffffef76, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.269] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4150000, cbInput=0x108a, pPaddingInfo=0x0, pbIV=0x40dff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x40dff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40dff848, pbOutput=0x4150000, pcbResult=0x40dff618) returned 0x0 [0198.269] WriteFile (in: hFile=0x2a0c, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x40dff61c*=0x1090, lpOverlapped=0x0) returned 1 [0198.269] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40dff60c | out: lpNewFilePointer=0x0) returned 1 [0198.269] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.269] WriteFile (in: hFile=0x2a0c, lpBuffer=0x40dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x40dff83c*, lpNumberOfBytesWritten=0x40dff61c*=0x8, lpOverlapped=0x0) returned 1 [0198.270] SetFilePointerEx (in: hFile=0x2a0c, liDistanceToMove=0x1090, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.270] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.270] CloseHandle (hObject=0x2a0c) returned 1 [0198.270] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.play")) returned 1 [0198.276] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3463 os_tid = 0x3424 [0198.281] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.281] ReadFile (in: hFile=0x2a14, lpBuffer=0x40f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40f3fb34*, lpNumberOfBytesRead=0x40f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.283] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.283] ReadFile (in: hFile=0x2a14, lpBuffer=0x40f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40f3fb34*, lpNumberOfBytesRead=0x40f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.283] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.287] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.287] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x40f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0198.287] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x40f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x40f3f828, pbKeyObject=0x0) returned 0x0 [0198.287] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x40f3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x40f3f500) returned 0x0 [0198.287] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.287] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x40f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x40f3f500) returned 0x0 [0198.292] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.296] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.296] WriteFile (in: hFile=0x2a14, lpBuffer=0x40f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40f3f830, lpOverlapped=0x0 | out: lpBuffer=0x40f3fb34*, lpNumberOfBytesWritten=0x40f3f830*=0x428, lpOverlapped=0x0) returned 1 [0198.297] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.297] ReadFile (in: hFile=0x2a14, lpBuffer=0x4250000, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x40f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x40f3f61c*=0x112e, lpOverlapped=0x0) returned 1 [0198.297] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xffffeed2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.297] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4250000, cbInput=0x112e, pPaddingInfo=0x0, pbIV=0x40f3f848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x40f3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40f3f848, pbOutput=0x4250000, pcbResult=0x40f3f618) returned 0x0 [0198.297] WriteFile (in: hFile=0x2a14, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x40f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x40f3f61c*=0x1130, lpOverlapped=0x0) returned 1 [0198.297] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40f3f60c | out: lpNewFilePointer=0x0) returned 1 [0198.297] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.297] WriteFile (in: hFile=0x2a14, lpBuffer=0x40f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x40f3f83c*, lpNumberOfBytesWritten=0x40f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.297] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x1130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.297] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.297] CloseHandle (hObject=0x2a14) returned 1 [0198.298] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.play")) returned 1 [0198.303] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3464 os_tid = 0x3428 [0198.309] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.309] ReadFile (in: hFile=0x2a1c, lpBuffer=0x4107fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4107f85c, lpOverlapped=0x0 | out: lpBuffer=0x4107fb34*, lpNumberOfBytesRead=0x4107f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.311] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.311] ReadFile (in: hFile=0x2a1c, lpBuffer=0x4107fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4107f85c, lpOverlapped=0x0 | out: lpBuffer=0x4107fb34*, lpNumberOfBytesRead=0x4107f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.311] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.315] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.315] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x4107f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0198.315] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x4107f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x4107f828, pbKeyObject=0x0) returned 0x0 [0198.315] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4107f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4107f500) returned 0x0 [0198.315] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.315] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4107f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4107f500) returned 0x0 [0198.321] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.325] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.325] WriteFile (in: hFile=0x2a1c, lpBuffer=0x4107fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4107f830, lpOverlapped=0x0 | out: lpBuffer=0x4107fb34*, lpNumberOfBytesWritten=0x4107f830*=0x428, lpOverlapped=0x0) returned 1 [0198.325] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.325] ReadFile (in: hFile=0x2a1c, lpBuffer=0x4350000, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x4107f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x4107f61c*=0x1138, lpOverlapped=0x0) returned 1 [0198.325] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0xffffeec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.325] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4350000, cbInput=0x1138, pPaddingInfo=0x0, pbIV=0x4107f848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x4107f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4107f848, pbOutput=0x4350000, pcbResult=0x4107f618) returned 0x0 [0198.325] WriteFile (in: hFile=0x2a1c, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x4107f61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x4107f61c*=0x1140, lpOverlapped=0x0) returned 1 [0198.325] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4107f60c | out: lpNewFilePointer=0x0) returned 1 [0198.326] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.326] WriteFile (in: hFile=0x2a1c, lpBuffer=0x4107f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4107f61c, lpOverlapped=0x0 | out: lpBuffer=0x4107f83c*, lpNumberOfBytesWritten=0x4107f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.326] SetFilePointerEx (in: hFile=0x2a1c, liDistanceToMove=0x1140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.326] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.326] CloseHandle (hObject=0x2a1c) returned 1 [0198.326] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.play")) returned 1 [0198.332] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3465 os_tid = 0x342c [0198.337] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.337] ReadFile (in: hFile=0x2a24, lpBuffer=0x411bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x411bf85c, lpOverlapped=0x0 | out: lpBuffer=0x411bfb34*, lpNumberOfBytesRead=0x411bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.339] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.339] ReadFile (in: hFile=0x2a24, lpBuffer=0x411bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x411bf85c, lpOverlapped=0x0 | out: lpBuffer=0x411bfb34*, lpNumberOfBytesRead=0x411bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.339] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.343] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x411bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0198.343] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x411bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x411bf828, pbKeyObject=0x0) returned 0x0 [0198.343] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x411bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x411bf500) returned 0x0 [0198.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.343] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x411bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x411bf500) returned 0x0 [0198.348] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.352] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.352] WriteFile (in: hFile=0x2a24, lpBuffer=0x411bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x411bf830, lpOverlapped=0x0 | out: lpBuffer=0x411bfb34*, lpNumberOfBytesWritten=0x411bf830*=0x428, lpOverlapped=0x0) returned 1 [0198.352] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.352] ReadFile (in: hFile=0x2a24, lpBuffer=0x4450000, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x411bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x411bf61c*=0x3926, lpOverlapped=0x0) returned 1 [0198.354] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xffffc6da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.354] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4450000, cbInput=0x3926, pPaddingInfo=0x0, pbIV=0x411bf848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x411bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x411bf848, pbOutput=0x4450000, pcbResult=0x411bf618) returned 0x0 [0198.354] WriteFile (in: hFile=0x2a24, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x411bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x411bf61c*=0x3930, lpOverlapped=0x0) returned 1 [0198.354] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x411bf60c | out: lpNewFilePointer=0x0) returned 1 [0198.354] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.354] WriteFile (in: hFile=0x2a24, lpBuffer=0x411bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x411bf61c, lpOverlapped=0x0 | out: lpBuffer=0x411bf83c*, lpNumberOfBytesWritten=0x411bf61c*=0x8, lpOverlapped=0x0) returned 1 [0198.354] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x3930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.354] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.354] CloseHandle (hObject=0x2a24) returned 1 [0198.355] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.play")) returned 1 [0198.360] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3466 os_tid = 0x3430 [0198.365] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.365] ReadFile (in: hFile=0x2a2c, lpBuffer=0x412ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x412ff85c, lpOverlapped=0x0 | out: lpBuffer=0x412ffb34*, lpNumberOfBytesRead=0x412ff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.366] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.367] ReadFile (in: hFile=0x2a2c, lpBuffer=0x412ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x412ff85c, lpOverlapped=0x0 | out: lpBuffer=0x412ffb34*, lpNumberOfBytesRead=0x412ff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.367] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.370] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.370] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x412ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0198.370] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x412ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x412ff828, pbKeyObject=0x0) returned 0x0 [0198.370] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x412ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x412ff500) returned 0x0 [0198.370] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.371] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x412ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x412ff500) returned 0x0 [0198.375] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.379] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.380] WriteFile (in: hFile=0x2a2c, lpBuffer=0x412ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x412ff830, lpOverlapped=0x0 | out: lpBuffer=0x412ffb34*, lpNumberOfBytesWritten=0x412ff830*=0x428, lpOverlapped=0x0) returned 1 [0198.380] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.380] ReadFile (in: hFile=0x2a2c, lpBuffer=0x4550000, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x412ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x412ff61c*=0x1afc, lpOverlapped=0x0) returned 1 [0198.381] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0xffffe504, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.381] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4550000, cbInput=0x1afc, pPaddingInfo=0x0, pbIV=0x412ff848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x412ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x412ff848, pbOutput=0x4550000, pcbResult=0x412ff618) returned 0x0 [0198.381] WriteFile (in: hFile=0x2a2c, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x412ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x412ff61c*=0x1b00, lpOverlapped=0x0) returned 1 [0198.381] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x412ff60c | out: lpNewFilePointer=0x0) returned 1 [0198.381] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.381] WriteFile (in: hFile=0x2a2c, lpBuffer=0x412ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x412ff61c, lpOverlapped=0x0 | out: lpBuffer=0x412ff83c*, lpNumberOfBytesWritten=0x412ff61c*=0x8, lpOverlapped=0x0) returned 1 [0198.381] SetFilePointerEx (in: hFile=0x2a2c, liDistanceToMove=0x1b00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.382] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.382] CloseHandle (hObject=0x2a2c) returned 1 [0198.382] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.play")) returned 1 [0198.387] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3467 os_tid = 0x3434 [0198.392] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.392] ReadFile (in: hFile=0x2a34, lpBuffer=0x4143fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4143f85c, lpOverlapped=0x0 | out: lpBuffer=0x4143fb34*, lpNumberOfBytesRead=0x4143f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.394] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.394] ReadFile (in: hFile=0x2a34, lpBuffer=0x4143fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4143f85c, lpOverlapped=0x0 | out: lpBuffer=0x4143fb34*, lpNumberOfBytesRead=0x4143f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.394] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.398] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.398] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x4143f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0198.398] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x4143f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x4143f828, pbKeyObject=0x0) returned 0x0 [0198.398] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4143f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4143f500) returned 0x0 [0198.398] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.398] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4143f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4143f500) returned 0x0 [0198.403] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.408] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.408] WriteFile (in: hFile=0x2a34, lpBuffer=0x4143fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4143f830, lpOverlapped=0x0 | out: lpBuffer=0x4143fb34*, lpNumberOfBytesWritten=0x4143f830*=0x428, lpOverlapped=0x0) returned 1 [0198.408] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.408] ReadFile (in: hFile=0x2a34, lpBuffer=0x4650000, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x4143f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x4143f61c*=0xb1a4, lpOverlapped=0x0) returned 1 [0198.530] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xffff4e5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.530] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4650000, cbInput=0xb1a4, pPaddingInfo=0x0, pbIV=0x4143f848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x4143f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4143f848, pbOutput=0x4650000, pcbResult=0x4143f618) returned 0x0 [0198.531] WriteFile (in: hFile=0x2a34, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x4143f61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x4143f61c*=0xb1b0, lpOverlapped=0x0) returned 1 [0198.531] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4143f60c | out: lpNewFilePointer=0x0) returned 1 [0198.531] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.531] WriteFile (in: hFile=0x2a34, lpBuffer=0x4143f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4143f61c, lpOverlapped=0x0 | out: lpBuffer=0x4143f83c*, lpNumberOfBytesWritten=0x4143f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.532] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xb1b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.532] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.532] CloseHandle (hObject=0x2a34) returned 1 [0198.532] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.play")) returned 1 [0198.538] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3468 os_tid = 0x3438 [0198.544] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.545] ReadFile (in: hFile=0x2a3c, lpBuffer=0x4157fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4157f85c, lpOverlapped=0x0 | out: lpBuffer=0x4157fb34*, lpNumberOfBytesRead=0x4157f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.546] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.546] ReadFile (in: hFile=0x2a3c, lpBuffer=0x4157fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4157f85c, lpOverlapped=0x0 | out: lpBuffer=0x4157fb34*, lpNumberOfBytesRead=0x4157f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.550] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.550] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x4157f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0198.550] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x4157f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x4157f828, pbKeyObject=0x0) returned 0x0 [0198.550] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4157f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4157f500) returned 0x0 [0198.550] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.550] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4157f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4157f500) returned 0x0 [0198.555] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.559] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.559] WriteFile (in: hFile=0x2a3c, lpBuffer=0x4157fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4157f830, lpOverlapped=0x0 | out: lpBuffer=0x4157fb34*, lpNumberOfBytesWritten=0x4157f830*=0x428, lpOverlapped=0x0) returned 1 [0198.560] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.560] ReadFile (in: hFile=0x2a3c, lpBuffer=0x4750000, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x4157f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x4157f61c*=0x9e2c, lpOverlapped=0x0) returned 1 [0198.561] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0xffff61d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.561] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4750000, cbInput=0x9e2c, pPaddingInfo=0x0, pbIV=0x4157f848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x4157f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4157f848, pbOutput=0x4750000, pcbResult=0x4157f618) returned 0x0 [0198.561] WriteFile (in: hFile=0x2a3c, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x4157f61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x4157f61c*=0x9e30, lpOverlapped=0x0) returned 1 [0198.562] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4157f60c | out: lpNewFilePointer=0x0) returned 1 [0198.562] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.562] WriteFile (in: hFile=0x2a3c, lpBuffer=0x4157f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4157f61c, lpOverlapped=0x0 | out: lpBuffer=0x4157f83c*, lpNumberOfBytesWritten=0x4157f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.562] SetFilePointerEx (in: hFile=0x2a3c, liDistanceToMove=0x9e30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.562] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.562] CloseHandle (hObject=0x2a3c) returned 1 [0198.562] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.play")) returned 1 [0198.568] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3469 os_tid = 0x343c [0198.572] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.572] ReadFile (in: hFile=0x2a44, lpBuffer=0x416bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x416bf85c, lpOverlapped=0x0 | out: lpBuffer=0x416bfb34*, lpNumberOfBytesRead=0x416bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.574] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.574] ReadFile (in: hFile=0x2a44, lpBuffer=0x416bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x416bf85c, lpOverlapped=0x0 | out: lpBuffer=0x416bfb34*, lpNumberOfBytesRead=0x416bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.574] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.577] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.577] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x416bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0198.577] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x416bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x416bf828, pbKeyObject=0x0) returned 0x0 [0198.577] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x416bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x416bf500) returned 0x0 [0198.577] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.577] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x416bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x416bf500) returned 0x0 [0198.582] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.586] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.586] WriteFile (in: hFile=0x2a44, lpBuffer=0x416bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x416bf830, lpOverlapped=0x0 | out: lpBuffer=0x416bfb34*, lpNumberOfBytesWritten=0x416bf830*=0x428, lpOverlapped=0x0) returned 1 [0198.586] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.586] ReadFile (in: hFile=0x2a44, lpBuffer=0x4850000, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x416bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x416bf61c*=0x1ca0, lpOverlapped=0x0) returned 1 [0198.587] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xffffe360, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.587] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4850000, cbInput=0x1ca0, pPaddingInfo=0x0, pbIV=0x416bf848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x416bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x416bf848, pbOutput=0x4850000, pcbResult=0x416bf618) returned 0x0 [0198.587] WriteFile (in: hFile=0x2a44, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x416bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x416bf61c*=0x1cb0, lpOverlapped=0x0) returned 1 [0198.587] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x416bf60c | out: lpNewFilePointer=0x0) returned 1 [0198.587] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.587] WriteFile (in: hFile=0x2a44, lpBuffer=0x416bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x416bf61c, lpOverlapped=0x0 | out: lpBuffer=0x416bf83c*, lpNumberOfBytesWritten=0x416bf61c*=0x8, lpOverlapped=0x0) returned 1 [0198.588] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0x1cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.588] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.588] CloseHandle (hObject=0x2a44) returned 1 [0198.588] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.play")) returned 1 [0198.593] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3470 os_tid = 0x3440 [0198.597] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.597] ReadFile (in: hFile=0x2894, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.599] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.599] ReadFile (in: hFile=0x2894, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.599] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.602] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.602] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0198.603] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0198.603] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1590f500) returned 0x0 [0198.603] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.603] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1590f500) returned 0x0 [0198.608] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.611] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.611] WriteFile (in: hFile=0x2894, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0198.612] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.612] ReadFile (in: hFile=0x2894, lpBuffer=0x2850000, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1590f61c*=0x1908, lpOverlapped=0x0) returned 1 [0198.613] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xffffe6f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.614] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x1908, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2850000, pcbResult=0x1590f618) returned 0x0 [0198.614] WriteFile (in: hFile=0x2894, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1590f61c*=0x1910, lpOverlapped=0x0) returned 1 [0198.614] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0198.614] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.614] WriteFile (in: hFile=0x2894, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.614] SetFilePointerEx (in: hFile=0x2894, liDistanceToMove=0x1910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.614] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.614] CloseHandle (hObject=0x2894) returned 1 [0198.615] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.play")) returned 1 [0198.620] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3471 os_tid = 0x3444 [0198.625] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.625] ReadFile (in: hFile=0x2a50, lpBuffer=0x417ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x417ff85c, lpOverlapped=0x0 | out: lpBuffer=0x417ffb34*, lpNumberOfBytesRead=0x417ff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.626] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.626] ReadFile (in: hFile=0x2a50, lpBuffer=0x417ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x417ff85c, lpOverlapped=0x0 | out: lpBuffer=0x417ffb34*, lpNumberOfBytesRead=0x417ff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.626] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.630] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.630] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x417ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0198.630] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x417ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x417ff828, pbKeyObject=0x0) returned 0x0 [0198.630] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x417ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x417ff500) returned 0x0 [0198.631] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.631] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x417ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x417ff500) returned 0x0 [0198.635] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.639] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.639] WriteFile (in: hFile=0x2a50, lpBuffer=0x417ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x417ff830, lpOverlapped=0x0 | out: lpBuffer=0x417ffb34*, lpNumberOfBytesWritten=0x417ff830*=0x428, lpOverlapped=0x0) returned 1 [0198.639] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.639] ReadFile (in: hFile=0x2a50, lpBuffer=0x4950000, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x417ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x417ff61c*=0x3100, lpOverlapped=0x0) returned 1 [0198.640] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xffffcf00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.640] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4950000, cbInput=0x3100, pPaddingInfo=0x0, pbIV=0x417ff848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x417ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x417ff848, pbOutput=0x4950000, pcbResult=0x417ff618) returned 0x0 [0198.640] WriteFile (in: hFile=0x2a50, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x3110, lpNumberOfBytesWritten=0x417ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x417ff61c*=0x3110, lpOverlapped=0x0) returned 1 [0198.640] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x417ff60c | out: lpNewFilePointer=0x0) returned 1 [0198.640] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.641] WriteFile (in: hFile=0x2a50, lpBuffer=0x417ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x417ff61c, lpOverlapped=0x0 | out: lpBuffer=0x417ff83c*, lpNumberOfBytesWritten=0x417ff61c*=0x8, lpOverlapped=0x0) returned 1 [0198.641] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x3110, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.641] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.641] CloseHandle (hObject=0x2a50) returned 1 [0198.641] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.play")) returned 1 [0198.646] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3472 os_tid = 0x3448 [0198.651] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.651] ReadFile (in: hFile=0x2a58, lpBuffer=0x4193fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4193f85c, lpOverlapped=0x0 | out: lpBuffer=0x4193fb34*, lpNumberOfBytesRead=0x4193f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.652] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.652] ReadFile (in: hFile=0x2a58, lpBuffer=0x4193fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4193f85c, lpOverlapped=0x0 | out: lpBuffer=0x4193fb34*, lpNumberOfBytesRead=0x4193f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.652] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.655] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.655] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x4193f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0198.655] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x4193f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x4193f828, pbKeyObject=0x0) returned 0x0 [0198.655] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4193f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4193f500) returned 0x0 [0198.656] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.656] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4193f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4193f500) returned 0x0 [0198.660] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.664] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.664] WriteFile (in: hFile=0x2a58, lpBuffer=0x4193fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4193f830, lpOverlapped=0x0 | out: lpBuffer=0x4193fb34*, lpNumberOfBytesWritten=0x4193f830*=0x428, lpOverlapped=0x0) returned 1 [0198.665] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.665] ReadFile (in: hFile=0x2a58, lpBuffer=0x4a50000, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x4193f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x4193f61c*=0x2904, lpOverlapped=0x0) returned 1 [0198.667] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0xffffd6fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.667] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4a50000, cbInput=0x2904, pPaddingInfo=0x0, pbIV=0x4193f848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x4193f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4193f848, pbOutput=0x4a50000, pcbResult=0x4193f618) returned 0x0 [0198.667] WriteFile (in: hFile=0x2a58, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x4193f61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x4193f61c*=0x2910, lpOverlapped=0x0) returned 1 [0198.667] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4193f60c | out: lpNewFilePointer=0x0) returned 1 [0198.667] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.667] WriteFile (in: hFile=0x2a58, lpBuffer=0x4193f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4193f61c, lpOverlapped=0x0 | out: lpBuffer=0x4193f83c*, lpNumberOfBytesWritten=0x4193f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.667] SetFilePointerEx (in: hFile=0x2a58, liDistanceToMove=0x2910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.667] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.667] CloseHandle (hObject=0x2a58) returned 1 [0198.667] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.play")) returned 1 [0198.672] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3473 os_tid = 0x344c [0198.677] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.677] ReadFile (in: hFile=0x2a60, lpBuffer=0x41a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x41a7fb34*, lpNumberOfBytesRead=0x41a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.678] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.679] ReadFile (in: hFile=0x2a60, lpBuffer=0x41a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x41a7fb34*, lpNumberOfBytesRead=0x41a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.679] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.682] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.682] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x41a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0198.682] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x41a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x41a7f828, pbKeyObject=0x0) returned 0x0 [0198.682] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x41a7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x41a7f500) returned 0x0 [0198.682] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.682] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x41a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x41a7f500) returned 0x0 [0198.687] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.690] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.691] WriteFile (in: hFile=0x2a60, lpBuffer=0x41a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x41a7f830, lpOverlapped=0x0 | out: lpBuffer=0x41a7fb34*, lpNumberOfBytesWritten=0x41a7f830*=0x428, lpOverlapped=0x0) returned 1 [0198.691] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.691] ReadFile (in: hFile=0x2a60, lpBuffer=0x4b50000, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x41a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x41a7f61c*=0x984, lpOverlapped=0x0) returned 1 [0198.691] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffff67c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.691] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4b50000, cbInput=0x984, pPaddingInfo=0x0, pbIV=0x41a7f848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x41a7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x41a7f848, pbOutput=0x4b50000, pcbResult=0x41a7f618) returned 0x0 [0198.691] WriteFile (in: hFile=0x2a60, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x41a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x41a7f61c*=0x990, lpOverlapped=0x0) returned 1 [0198.691] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x41a7f60c | out: lpNewFilePointer=0x0) returned 1 [0198.691] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.691] WriteFile (in: hFile=0x2a60, lpBuffer=0x41a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x41a7f83c*, lpNumberOfBytesWritten=0x41a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.691] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0x990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.691] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.691] CloseHandle (hObject=0x2a60) returned 1 [0198.692] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.play")) returned 1 [0198.697] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3474 os_tid = 0x3450 [0198.702] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.702] ReadFile (in: hFile=0x2a68, lpBuffer=0x41bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x41bbfb34*, lpNumberOfBytesRead=0x41bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.703] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.706] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.706] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x41bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0198.706] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x41bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x41bbf828, pbKeyObject=0x0) returned 0x0 [0198.707] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x41bbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x41bbf500) returned 0x0 [0198.707] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.707] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x41bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x41bbf500) returned 0x0 [0198.712] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.715] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.715] WriteFile (in: hFile=0x2a68, lpBuffer=0x41bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x41bbf830, lpOverlapped=0x0 | out: lpBuffer=0x41bbfb34*, lpNumberOfBytesWritten=0x41bbf830*=0x428, lpOverlapped=0x0) returned 1 [0198.716] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.716] ReadFile (in: hFile=0x2a68, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x41bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x41bbf61c*=0x59c, lpOverlapped=0x0) returned 1 [0198.716] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0xfffffa64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.716] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4c50000, cbInput=0x59c, pPaddingInfo=0x0, pbIV=0x41bbf848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x41bbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x41bbf848, pbOutput=0x4c50000, pcbResult=0x41bbf618) returned 0x0 [0198.716] WriteFile (in: hFile=0x2a68, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x41bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x41bbf61c*=0x5a0, lpOverlapped=0x0) returned 1 [0198.716] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x41bbf60c | out: lpNewFilePointer=0x0) returned 1 [0198.716] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.716] WriteFile (in: hFile=0x2a68, lpBuffer=0x41bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x41bbf83c*, lpNumberOfBytesWritten=0x41bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0198.716] SetFilePointerEx (in: hFile=0x2a68, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.716] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.716] CloseHandle (hObject=0x2a68) returned 1 [0198.716] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.play")) returned 1 [0198.721] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3475 os_tid = 0x3454 [0198.727] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.727] ReadFile (in: hFile=0x2a70, lpBuffer=0x41cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41cff85c, lpOverlapped=0x0 | out: lpBuffer=0x41cffb34*, lpNumberOfBytesRead=0x41cff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.728] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.729] ReadFile (in: hFile=0x2a70, lpBuffer=0x41cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41cff85c, lpOverlapped=0x0 | out: lpBuffer=0x41cffb34*, lpNumberOfBytesRead=0x41cff85c*=0x428, lpOverlapped=0x0) returned 1 [0198.729] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.732] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.732] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x41cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0198.732] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x41cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x41cff828, pbKeyObject=0x0) returned 0x0 [0198.732] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x41cff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x41cff500) returned 0x0 [0198.732] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.732] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x41cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x41cff500) returned 0x0 [0198.737] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.741] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.741] WriteFile (in: hFile=0x2a70, lpBuffer=0x41cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x41cff830, lpOverlapped=0x0 | out: lpBuffer=0x41cffb34*, lpNumberOfBytesWritten=0x41cff830*=0x428, lpOverlapped=0x0) returned 1 [0198.742] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.742] ReadFile (in: hFile=0x2a70, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x41cff61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x41cff61c*=0x3f9c, lpOverlapped=0x0) returned 1 [0198.742] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xffffc064, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.743] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4d50000, cbInput=0x3f9c, pPaddingInfo=0x0, pbIV=0x41cff848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x41cff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x41cff848, pbOutput=0x4d50000, pcbResult=0x41cff618) returned 0x0 [0198.743] WriteFile (in: hFile=0x2a70, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x41cff61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x41cff61c*=0x3fa0, lpOverlapped=0x0) returned 1 [0198.743] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x41cff60c | out: lpNewFilePointer=0x0) returned 1 [0198.743] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.743] WriteFile (in: hFile=0x2a70, lpBuffer=0x41cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41cff61c, lpOverlapped=0x0 | out: lpBuffer=0x41cff83c*, lpNumberOfBytesWritten=0x41cff61c*=0x8, lpOverlapped=0x0) returned 1 [0198.743] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x3fa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.743] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.743] CloseHandle (hObject=0x2a70) returned 1 [0198.743] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.play")) returned 1 [0198.748] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3476 os_tid = 0x3458 [0198.755] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.755] ReadFile (in: hFile=0x2a78, lpBuffer=0x41e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x41e3fb34*, lpNumberOfBytesRead=0x41e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.760] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.760] ReadFile (in: hFile=0x2a78, lpBuffer=0x41e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x41e3fb34*, lpNumberOfBytesRead=0x41e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.760] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.766] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.766] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x41e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0198.766] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x41e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x41e3f828, pbKeyObject=0x0) returned 0x0 [0198.766] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x41e3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x41e3f500) returned 0x0 [0198.766] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.766] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x41e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x41e3f500) returned 0x0 [0198.769] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.773] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.773] WriteFile (in: hFile=0x2a78, lpBuffer=0x41e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x41e3f830, lpOverlapped=0x0 | out: lpBuffer=0x41e3fb34*, lpNumberOfBytesWritten=0x41e3f830*=0x428, lpOverlapped=0x0) returned 1 [0198.773] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.773] ReadFile (in: hFile=0x2a78, lpBuffer=0x4e50000, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x41e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x41e3f61c*=0x1418, lpOverlapped=0x0) returned 1 [0198.774] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0xffffebe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.774] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4e50000, cbInput=0x1418, pPaddingInfo=0x0, pbIV=0x41e3f848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x41e3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x41e3f848, pbOutput=0x4e50000, pcbResult=0x41e3f618) returned 0x0 [0198.774] WriteFile (in: hFile=0x2a78, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x41e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x41e3f61c*=0x1420, lpOverlapped=0x0) returned 1 [0198.774] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x41e3f60c | out: lpNewFilePointer=0x0) returned 1 [0198.774] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.774] WriteFile (in: hFile=0x2a78, lpBuffer=0x41e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x41e3f83c*, lpNumberOfBytesWritten=0x41e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.774] SetFilePointerEx (in: hFile=0x2a78, liDistanceToMove=0x1420, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.774] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.774] CloseHandle (hObject=0x2a78) returned 1 [0198.777] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.play")) returned 1 [0198.782] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3477 os_tid = 0x345c [0198.788] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.788] ReadFile (in: hFile=0x2a80, lpBuffer=0x41f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x41f7fb34*, lpNumberOfBytesRead=0x41f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.789] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.789] ReadFile (in: hFile=0x2a80, lpBuffer=0x41f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x41f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x41f7fb34*, lpNumberOfBytesRead=0x41f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.789] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.792] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.792] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x41f7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0198.792] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x41f7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x41f7f828, pbKeyObject=0x0) returned 0x0 [0198.792] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x41f7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x41f7f500) returned 0x0 [0198.792] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.793] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x41f7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x41f7f500) returned 0x0 [0198.796] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.799] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.799] WriteFile (in: hFile=0x2a80, lpBuffer=0x41f7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x41f7f830, lpOverlapped=0x0 | out: lpBuffer=0x41f7fb34*, lpNumberOfBytesWritten=0x41f7f830*=0x428, lpOverlapped=0x0) returned 1 [0198.799] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.799] ReadFile (in: hFile=0x2a80, lpBuffer=0x4f50000, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x41f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x41f7f61c*=0xdda, lpOverlapped=0x0) returned 1 [0198.800] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xfffff226, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.800] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4f50000, cbInput=0xdda, pPaddingInfo=0x0, pbIV=0x41f7f848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x41f7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x41f7f848, pbOutput=0x4f50000, pcbResult=0x41f7f618) returned 0x0 [0198.800] WriteFile (in: hFile=0x2a80, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x41f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x41f7f61c*=0xde0, lpOverlapped=0x0) returned 1 [0198.800] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x41f7f60c | out: lpNewFilePointer=0x0) returned 1 [0198.800] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.800] WriteFile (in: hFile=0x2a80, lpBuffer=0x41f7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x41f7f83c*, lpNumberOfBytesWritten=0x41f7f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.800] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xde0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.800] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.800] CloseHandle (hObject=0x2a80) returned 1 [0198.800] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.play")) returned 1 [0198.805] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3478 os_tid = 0x3460 [0198.809] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.809] ReadFile (in: hFile=0x2a88, lpBuffer=0x420bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x420bf85c, lpOverlapped=0x0 | out: lpBuffer=0x420bfb34*, lpNumberOfBytesRead=0x420bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.811] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.811] ReadFile (in: hFile=0x2a88, lpBuffer=0x420bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x420bf85c, lpOverlapped=0x0 | out: lpBuffer=0x420bfb34*, lpNumberOfBytesRead=0x420bf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.811] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.814] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x420bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0198.814] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x420bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x420bf828, pbKeyObject=0x0) returned 0x0 [0198.814] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x420bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x420bf500) returned 0x0 [0198.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.814] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x420bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x420bf500) returned 0x0 [0198.818] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] WriteFile (in: hFile=0x2a88, lpBuffer=0x420bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x420bf830, lpOverlapped=0x0 | out: lpBuffer=0x420bfb34*, lpNumberOfBytesWritten=0x420bf830*=0x428, lpOverlapped=0x0) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] ReadFile (in: hFile=0x2a88, lpBuffer=0x5050000, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x420bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x420bf61c*=0x23d4, lpOverlapped=0x0) returned 1 [0198.822] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0xffffdc2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.822] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5050000, cbInput=0x23d4, pPaddingInfo=0x0, pbIV=0x420bf848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x420bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x420bf848, pbOutput=0x5050000, pcbResult=0x420bf618) returned 0x0 [0198.822] WriteFile (in: hFile=0x2a88, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x420bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x420bf61c*=0x23e0, lpOverlapped=0x0) returned 1 [0198.822] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x420bf60c | out: lpNewFilePointer=0x0) returned 1 [0198.822] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.822] WriteFile (in: hFile=0x2a88, lpBuffer=0x420bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x420bf61c, lpOverlapped=0x0 | out: lpBuffer=0x420bf83c*, lpNumberOfBytesWritten=0x420bf61c*=0x8, lpOverlapped=0x0) returned 1 [0198.822] SetFilePointerEx (in: hFile=0x2a88, liDistanceToMove=0x23e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.822] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.822] CloseHandle (hObject=0x2a88) returned 1 [0198.823] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.play")) returned 1 [0198.827] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3479 os_tid = 0x3464 [0198.832] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.832] ReadFile (in: hFile=0x2a90, lpBuffer=0x421ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x421ff85c, lpOverlapped=0x0 | out: lpBuffer=0x421ffb34*, lpNumberOfBytesRead=0x421ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.026] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.026] ReadFile (in: hFile=0x2a90, lpBuffer=0x421ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x421ff85c, lpOverlapped=0x0 | out: lpBuffer=0x421ffb34*, lpNumberOfBytesRead=0x421ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.026] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.029] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.030] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x421ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0199.030] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x421ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x421ff828, pbKeyObject=0x0) returned 0x0 [0199.030] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x421ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x421ff500) returned 0x0 [0199.030] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.030] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x421ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x421ff500) returned 0x0 [0199.033] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.038] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.038] WriteFile (in: hFile=0x2a90, lpBuffer=0x421ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x421ff830, lpOverlapped=0x0 | out: lpBuffer=0x421ffb34*, lpNumberOfBytesWritten=0x421ff830*=0x428, lpOverlapped=0x0) returned 1 [0199.039] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.039] ReadFile (in: hFile=0x2a90, lpBuffer=0x5150000, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x421ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x421ff61c*=0x1fc4, lpOverlapped=0x0) returned 1 [0199.070] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0xffffe03c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.070] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x5150000, cbInput=0x1fc4, pPaddingInfo=0x0, pbIV=0x421ff848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x421ff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x421ff848, pbOutput=0x5150000, pcbResult=0x421ff618) returned 0x0 [0199.070] WriteFile (in: hFile=0x2a90, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x421ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x421ff61c*=0x1fd0, lpOverlapped=0x0) returned 1 [0199.070] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x421ff60c | out: lpNewFilePointer=0x0) returned 1 [0199.070] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.070] WriteFile (in: hFile=0x2a90, lpBuffer=0x421ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x421ff61c, lpOverlapped=0x0 | out: lpBuffer=0x421ff83c*, lpNumberOfBytesWritten=0x421ff61c*=0x8, lpOverlapped=0x0) returned 1 [0199.071] SetFilePointerEx (in: hFile=0x2a90, liDistanceToMove=0x1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.071] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0199.071] CloseHandle (hObject=0x2a90) returned 1 [0199.071] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.074] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.play")) returned 1 [0199.075] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3480 os_tid = 0x3468 [0198.834] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.834] ReadFile (in: hFile=0x2a98, lpBuffer=0x4233fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4233f85c, lpOverlapped=0x0 | out: lpBuffer=0x4233fb34*, lpNumberOfBytesRead=0x4233f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.835] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.835] ReadFile (in: hFile=0x2a98, lpBuffer=0x4233fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4233f85c, lpOverlapped=0x0 | out: lpBuffer=0x4233fb34*, lpNumberOfBytesRead=0x4233f85c*=0x428, lpOverlapped=0x0) returned 1 [0198.836] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.839] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x4233f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0198.839] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x4233f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x4233f828, pbKeyObject=0x0) returned 0x0 [0198.839] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4233f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4233f500) returned 0x0 [0198.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.839] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4233f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4233f500) returned 0x0 [0198.842] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.846] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.846] WriteFile (in: hFile=0x2a98, lpBuffer=0x4233fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4233f830, lpOverlapped=0x0 | out: lpBuffer=0x4233fb34*, lpNumberOfBytesWritten=0x4233f830*=0x428, lpOverlapped=0x0) returned 1 [0198.846] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.846] ReadFile (in: hFile=0x2a98, lpBuffer=0x5250000, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x4233f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x4233f61c*=0x75e2, lpOverlapped=0x0) returned 1 [0198.847] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xffff8a1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.847] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5250000, cbInput=0x75e2, pPaddingInfo=0x0, pbIV=0x4233f848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x4233f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4233f848, pbOutput=0x5250000, pcbResult=0x4233f618) returned 0x0 [0198.847] WriteFile (in: hFile=0x2a98, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x4233f61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x4233f61c*=0x75f0, lpOverlapped=0x0) returned 1 [0198.847] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4233f60c | out: lpNewFilePointer=0x0) returned 1 [0198.847] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.847] WriteFile (in: hFile=0x2a98, lpBuffer=0x4233f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4233f61c, lpOverlapped=0x0 | out: lpBuffer=0x4233f83c*, lpNumberOfBytesWritten=0x4233f61c*=0x8, lpOverlapped=0x0) returned 1 [0198.848] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x75f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.848] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0198.848] CloseHandle (hObject=0x2a98) returned 1 [0198.848] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0198.851] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.play")) returned 1 [0198.853] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3481 os_tid = 0x346c [0198.857] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.857] ReadFile (in: hFile=0x2aa0, lpBuffer=0x4247fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4247f85c, lpOverlapped=0x0 | out: lpBuffer=0x4247fb34*, lpNumberOfBytesRead=0x4247f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.015] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.015] ReadFile (in: hFile=0x2aa0, lpBuffer=0x4247fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4247f85c, lpOverlapped=0x0 | out: lpBuffer=0x4247fb34*, lpNumberOfBytesRead=0x4247f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.015] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.017] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.018] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x4247f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0199.018] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x4247f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x4247f828, pbKeyObject=0x0) returned 0x0 [0199.018] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4247f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4247f500) returned 0x0 [0199.018] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.018] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4247f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4247f500) returned 0x0 [0199.022] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.025] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.025] WriteFile (in: hFile=0x2aa0, lpBuffer=0x4247fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4247f830, lpOverlapped=0x0 | out: lpBuffer=0x4247fb34*, lpNumberOfBytesWritten=0x4247f830*=0x428, lpOverlapped=0x0) returned 1 [0199.026] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.026] ReadFile (in: hFile=0x2aa0, lpBuffer=0x5350000, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x4247f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x4247f61c*=0x824e, lpOverlapped=0x0) returned 1 [0199.061] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0xffff7db2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.061] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5350000, cbInput=0x824e, pPaddingInfo=0x0, pbIV=0x4247f848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x4247f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x4247f848, pbOutput=0x5350000, pcbResult=0x4247f618) returned 0x0 [0199.061] WriteFile (in: hFile=0x2aa0, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x4247f61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x4247f61c*=0x8250, lpOverlapped=0x0) returned 1 [0199.062] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4247f60c | out: lpNewFilePointer=0x0) returned 1 [0199.062] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.062] WriteFile (in: hFile=0x2aa0, lpBuffer=0x4247f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4247f61c, lpOverlapped=0x0 | out: lpBuffer=0x4247f83c*, lpNumberOfBytesWritten=0x4247f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.062] SetFilePointerEx (in: hFile=0x2aa0, liDistanceToMove=0x8250, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.062] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0199.062] CloseHandle (hObject=0x2aa0) returned 1 [0199.062] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.play")) returned 1 [0199.066] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3482 os_tid = 0x3470 [0198.859] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.859] ReadFile (in: hFile=0x2aa8, lpBuffer=0x425bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x425bf85c, lpOverlapped=0x0 | out: lpBuffer=0x425bfb34*, lpNumberOfBytesRead=0x425bf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.101] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.102] ReadFile (in: hFile=0x2aa8, lpBuffer=0x425bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x425bf85c, lpOverlapped=0x0 | out: lpBuffer=0x425bfb34*, lpNumberOfBytesRead=0x425bf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.102] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.104] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.104] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x425bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0199.104] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x425bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x425bf828, pbKeyObject=0x0) returned 0x0 [0199.105] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x425bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x425bf500) returned 0x0 [0199.105] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.105] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x425bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x425bf500) returned 0x0 [0199.108] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.111] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.111] WriteFile (in: hFile=0x2aa8, lpBuffer=0x425bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x425bf830, lpOverlapped=0x0 | out: lpBuffer=0x425bfb34*, lpNumberOfBytesWritten=0x425bf830*=0x428, lpOverlapped=0x0) returned 1 [0199.111] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.111] ReadFile (in: hFile=0x2aa8, lpBuffer=0x5450000, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x425bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x425bf61c*=0x62b2, lpOverlapped=0x0) returned 1 [0199.401] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0xffff9d4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.401] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x5450000, cbInput=0x62b2, pPaddingInfo=0x0, pbIV=0x425bf848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x425bf618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x425bf848, pbOutput=0x5450000, pcbResult=0x425bf618) returned 0x0 [0199.401] WriteFile (in: hFile=0x2aa8, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x425bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x425bf61c*=0x62c0, lpOverlapped=0x0) returned 1 [0199.401] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x425bf60c | out: lpNewFilePointer=0x0) returned 1 [0199.401] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.401] WriteFile (in: hFile=0x2aa8, lpBuffer=0x425bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x425bf61c, lpOverlapped=0x0 | out: lpBuffer=0x425bf83c*, lpNumberOfBytesWritten=0x425bf61c*=0x8, lpOverlapped=0x0) returned 1 [0199.401] SetFilePointerEx (in: hFile=0x2aa8, liDistanceToMove=0x62c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.401] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0199.401] CloseHandle (hObject=0x2aa8) returned 1 [0199.402] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.play")) returned 1 [0199.407] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3483 os_tid = 0x3474 [0198.860] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.860] ReadFile (in: hFile=0x2ab0, lpBuffer=0x426ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x426ff85c, lpOverlapped=0x0 | out: lpBuffer=0x426ffb34*, lpNumberOfBytesRead=0x426ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.090] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.090] ReadFile (in: hFile=0x2ab0, lpBuffer=0x426ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x426ff85c, lpOverlapped=0x0 | out: lpBuffer=0x426ffb34*, lpNumberOfBytesRead=0x426ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.090] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.093] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.093] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x426ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0199.094] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x426ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x426ff828, pbKeyObject=0x0) returned 0x0 [0199.094] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x426ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x426ff500) returned 0x0 [0199.094] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.094] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x426ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x426ff500) returned 0x0 [0199.097] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.101] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.101] WriteFile (in: hFile=0x2ab0, lpBuffer=0x426ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x426ff830, lpOverlapped=0x0 | out: lpBuffer=0x426ffb34*, lpNumberOfBytesWritten=0x426ff830*=0x428, lpOverlapped=0x0) returned 1 [0199.101] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.101] ReadFile (in: hFile=0x2ab0, lpBuffer=0x5550000, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x426ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x426ff61c*=0x78e0, lpOverlapped=0x0) returned 1 [0199.389] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0xffff8720, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.389] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x5550000, cbInput=0x78e0, pPaddingInfo=0x0, pbIV=0x426ff848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x426ff618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x426ff848, pbOutput=0x5550000, pcbResult=0x426ff618) returned 0x0 [0199.389] WriteFile (in: hFile=0x2ab0, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x426ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x426ff61c*=0x78f0, lpOverlapped=0x0) returned 1 [0199.389] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x426ff60c | out: lpNewFilePointer=0x0) returned 1 [0199.389] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.389] WriteFile (in: hFile=0x2ab0, lpBuffer=0x426ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x426ff61c, lpOverlapped=0x0 | out: lpBuffer=0x426ff83c*, lpNumberOfBytesWritten=0x426ff61c*=0x8, lpOverlapped=0x0) returned 1 [0199.390] SetFilePointerEx (in: hFile=0x2ab0, liDistanceToMove=0x78f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.390] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0199.390] CloseHandle (hObject=0x2ab0) returned 1 [0199.390] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.play")) returned 1 [0199.396] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3484 os_tid = 0x3478 [0198.861] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.861] ReadFile (in: hFile=0x2ab8, lpBuffer=0x4283fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4283f85c, lpOverlapped=0x0 | out: lpBuffer=0x4283fb34*, lpNumberOfBytesRead=0x4283f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.079] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.079] ReadFile (in: hFile=0x2ab8, lpBuffer=0x4283fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4283f85c, lpOverlapped=0x0 | out: lpBuffer=0x4283fb34*, lpNumberOfBytesRead=0x4283f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.082] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.082] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x4283f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0199.082] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x4283f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x4283f828, pbKeyObject=0x0) returned 0x0 [0199.082] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4283f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4283f500) returned 0x0 [0199.082] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.082] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4283f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4283f500) returned 0x0 [0199.086] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.089] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.089] WriteFile (in: hFile=0x2ab8, lpBuffer=0x4283fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4283f830, lpOverlapped=0x0 | out: lpBuffer=0x4283fb34*, lpNumberOfBytesWritten=0x4283f830*=0x428, lpOverlapped=0x0) returned 1 [0199.090] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.090] ReadFile (in: hFile=0x2ab8, lpBuffer=0x5650000, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x4283f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x4283f61c*=0x6f26, lpOverlapped=0x0) returned 1 [0199.320] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0xffff90da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.320] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5650000, cbInput=0x6f26, pPaddingInfo=0x0, pbIV=0x4283f848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x4283f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4283f848, pbOutput=0x5650000, pcbResult=0x4283f618) returned 0x0 [0199.320] WriteFile (in: hFile=0x2ab8, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x4283f61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x4283f61c*=0x6f30, lpOverlapped=0x0) returned 1 [0199.320] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4283f60c | out: lpNewFilePointer=0x0) returned 1 [0199.320] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.320] WriteFile (in: hFile=0x2ab8, lpBuffer=0x4283f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4283f61c, lpOverlapped=0x0 | out: lpBuffer=0x4283f83c*, lpNumberOfBytesWritten=0x4283f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.320] SetFilePointerEx (in: hFile=0x2ab8, liDistanceToMove=0x6f30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.320] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.321] CloseHandle (hObject=0x2ab8) returned 1 [0199.321] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.play")) returned 1 [0199.326] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3485 os_tid = 0x347c [0198.863] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.863] ReadFile (in: hFile=0x2ac0, lpBuffer=0x4297fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4297f85c, lpOverlapped=0x0 | out: lpBuffer=0x4297fb34*, lpNumberOfBytesRead=0x4297f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.004] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.004] ReadFile (in: hFile=0x2ac0, lpBuffer=0x4297fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4297f85c, lpOverlapped=0x0 | out: lpBuffer=0x4297fb34*, lpNumberOfBytesRead=0x4297f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.004] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.007] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.007] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x4297f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0199.007] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x4297f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x4297f828, pbKeyObject=0x0) returned 0x0 [0199.007] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4297f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4297f500) returned 0x0 [0199.007] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.007] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4297f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4297f500) returned 0x0 [0199.010] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.013] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.014] WriteFile (in: hFile=0x2ac0, lpBuffer=0x4297fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4297f830, lpOverlapped=0x0 | out: lpBuffer=0x4297fb34*, lpNumberOfBytesWritten=0x4297f830*=0x428, lpOverlapped=0x0) returned 1 [0199.014] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.014] ReadFile (in: hFile=0x2ac0, lpBuffer=0x5750000, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x4297f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x4297f61c*=0xb9c4, lpOverlapped=0x0) returned 1 [0199.051] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0xffff463c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.051] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x5750000, cbInput=0xb9c4, pPaddingInfo=0x0, pbIV=0x4297f848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x4297f618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x4297f848, pbOutput=0x5750000, pcbResult=0x4297f618) returned 0x0 [0199.051] WriteFile (in: hFile=0x2ac0, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x4297f61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x4297f61c*=0xb9d0, lpOverlapped=0x0) returned 1 [0199.051] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4297f60c | out: lpNewFilePointer=0x0) returned 1 [0199.051] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.051] WriteFile (in: hFile=0x2ac0, lpBuffer=0x4297f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4297f61c, lpOverlapped=0x0 | out: lpBuffer=0x4297f83c*, lpNumberOfBytesWritten=0x4297f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.052] SetFilePointerEx (in: hFile=0x2ac0, liDistanceToMove=0xb9d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.052] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0199.052] CloseHandle (hObject=0x2ac0) returned 1 [0199.052] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.play")) returned 1 [0199.057] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3486 os_tid = 0x3480 [0198.864] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.864] ReadFile (in: hFile=0x2ac8, lpBuffer=0x42abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42abf85c, lpOverlapped=0x0 | out: lpBuffer=0x42abfb34*, lpNumberOfBytesRead=0x42abf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.991] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.991] ReadFile (in: hFile=0x2ac8, lpBuffer=0x42abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42abf85c, lpOverlapped=0x0 | out: lpBuffer=0x42abfb34*, lpNumberOfBytesRead=0x42abf85c*=0x428, lpOverlapped=0x0) returned 1 [0198.991] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0198.995] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0198.996] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x42abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0198.996] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x42abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x42abf828, pbKeyObject=0x0) returned 0x0 [0198.996] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x42abf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x42abf500) returned 0x0 [0198.996] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0198.996] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x42abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x42abf500) returned 0x0 [0198.999] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.003] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.003] WriteFile (in: hFile=0x2ac8, lpBuffer=0x42abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x42abf830, lpOverlapped=0x0 | out: lpBuffer=0x42abfb34*, lpNumberOfBytesWritten=0x42abf830*=0x428, lpOverlapped=0x0) returned 1 [0199.003] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.003] ReadFile (in: hFile=0x2ac8, lpBuffer=0x5850000, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x42abf61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x42abf61c*=0x6928, lpOverlapped=0x0) returned 1 [0199.041] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0xffff96d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.041] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5850000, cbInput=0x6928, pPaddingInfo=0x0, pbIV=0x42abf848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x42abf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x42abf848, pbOutput=0x5850000, pcbResult=0x42abf618) returned 0x0 [0199.041] WriteFile (in: hFile=0x2ac8, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x42abf61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x42abf61c*=0x6930, lpOverlapped=0x0) returned 1 [0199.041] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x42abf60c | out: lpNewFilePointer=0x0) returned 1 [0199.041] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.041] WriteFile (in: hFile=0x2ac8, lpBuffer=0x42abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x42abf61c, lpOverlapped=0x0 | out: lpBuffer=0x42abf83c*, lpNumberOfBytesWritten=0x42abf61c*=0x8, lpOverlapped=0x0) returned 1 [0199.041] SetFilePointerEx (in: hFile=0x2ac8, liDistanceToMove=0x6930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.041] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.041] CloseHandle (hObject=0x2ac8) returned 1 [0199.041] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.play")) returned 1 [0199.046] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3487 os_tid = 0x3484 [0198.919] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.920] ReadFile (in: hFile=0x2ad0, lpBuffer=0x42bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42bff85c, lpOverlapped=0x0 | out: lpBuffer=0x42bffb34*, lpNumberOfBytesRead=0x42bff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.133] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.133] ReadFile (in: hFile=0x2ad0, lpBuffer=0x42bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42bff85c, lpOverlapped=0x0 | out: lpBuffer=0x42bffb34*, lpNumberOfBytesRead=0x42bff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.136] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.136] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x42bff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0199.136] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x42bff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x42bff828, pbKeyObject=0x0) returned 0x0 [0199.136] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x42bff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x42bff500) returned 0x0 [0199.136] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.136] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x42bff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x42bff500) returned 0x0 [0199.140] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.142] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.142] WriteFile (in: hFile=0x2ad0, lpBuffer=0x42bffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x42bff830, lpOverlapped=0x0 | out: lpBuffer=0x42bffb34*, lpNumberOfBytesWritten=0x42bff830*=0x428, lpOverlapped=0x0) returned 1 [0199.142] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.142] ReadFile (in: hFile=0x2ad0, lpBuffer=0x5950000, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x42bff61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x42bff61c*=0x7400, lpOverlapped=0x0) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0xffff8c00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.451] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x5950000, cbInput=0x7400, pPaddingInfo=0x0, pbIV=0x42bff848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x42bff618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x42bff848, pbOutput=0x5950000, pcbResult=0x42bff618) returned 0x0 [0199.451] WriteFile (in: hFile=0x2ad0, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x7410, lpNumberOfBytesWritten=0x42bff61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x42bff61c*=0x7410, lpOverlapped=0x0) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x42bff60c | out: lpNewFilePointer=0x0) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.451] WriteFile (in: hFile=0x2ad0, lpBuffer=0x42bff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x42bff61c, lpOverlapped=0x0 | out: lpBuffer=0x42bff83c*, lpNumberOfBytesWritten=0x42bff61c*=0x8, lpOverlapped=0x0) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x2ad0, liDistanceToMove=0x7410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.451] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0199.451] CloseHandle (hObject=0x2ad0) returned 1 [0199.452] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.play")) returned 1 [0199.456] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3488 os_tid = 0x3488 [0198.921] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.921] ReadFile (in: hFile=0x2ad8, lpBuffer=0x42d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x42d3fb34*, lpNumberOfBytesRead=0x42d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.123] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.123] ReadFile (in: hFile=0x2ad8, lpBuffer=0x42d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x42d3fb34*, lpNumberOfBytesRead=0x42d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.123] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.126] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.126] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x42d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0199.126] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x42d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x42d3f828, pbKeyObject=0x0) returned 0x0 [0199.126] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x42d3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x42d3f500) returned 0x0 [0199.126] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.126] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x42d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x42d3f500) returned 0x0 [0199.129] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.132] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.133] WriteFile (in: hFile=0x2ad8, lpBuffer=0x42d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x42d3f830, lpOverlapped=0x0 | out: lpBuffer=0x42d3fb34*, lpNumberOfBytesWritten=0x42d3f830*=0x428, lpOverlapped=0x0) returned 1 [0199.133] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.133] ReadFile (in: hFile=0x2ad8, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x42d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x42d3f61c*=0x4090, lpOverlapped=0x0) returned 1 [0199.438] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0xffffbf70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.438] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x5a50000, cbInput=0x4090, pPaddingInfo=0x0, pbIV=0x42d3f848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x42d3f618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x42d3f848, pbOutput=0x5a50000, pcbResult=0x42d3f618) returned 0x0 [0199.439] WriteFile (in: hFile=0x2ad8, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x42d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x42d3f61c*=0x40a0, lpOverlapped=0x0) returned 1 [0199.439] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x42d3f60c | out: lpNewFilePointer=0x0) returned 1 [0199.439] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.439] WriteFile (in: hFile=0x2ad8, lpBuffer=0x42d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x42d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x42d3f83c*, lpNumberOfBytesWritten=0x42d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.439] SetFilePointerEx (in: hFile=0x2ad8, liDistanceToMove=0x40a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.439] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0199.439] CloseHandle (hObject=0x2ad8) returned 1 [0199.440] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.play")) returned 1 [0199.445] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3489 os_tid = 0x348c [0198.922] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.922] ReadFile (in: hFile=0x2ae0, lpBuffer=0x42e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x42e7fb34*, lpNumberOfBytesRead=0x42e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.412] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.412] ReadFile (in: hFile=0x2ae0, lpBuffer=0x42e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x42e7fb34*, lpNumberOfBytesRead=0x42e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.595] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.597] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.597] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x42e7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0199.597] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x42e7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x42e7f828, pbKeyObject=0x0) returned 0x0 [0199.597] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x42e7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x42e7f500) returned 0x0 [0199.597] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.597] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x42e7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x42e7f500) returned 0x0 [0199.601] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.604] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.604] WriteFile (in: hFile=0x2ae0, lpBuffer=0x42e7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x42e7f830, lpOverlapped=0x0 | out: lpBuffer=0x42e7fb34*, lpNumberOfBytesWritten=0x42e7f830*=0x428, lpOverlapped=0x0) returned 1 [0199.604] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.604] ReadFile (in: hFile=0x2ae0, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x42e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x42e7f61c*=0x4584, lpOverlapped=0x0) returned 1 [0199.613] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0xffffba7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.613] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5b50000, cbInput=0x4584, pPaddingInfo=0x0, pbIV=0x42e7f848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x42e7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x42e7f848, pbOutput=0x5b50000, pcbResult=0x42e7f618) returned 0x0 [0199.613] WriteFile (in: hFile=0x2ae0, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x42e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x42e7f61c*=0x4590, lpOverlapped=0x0) returned 1 [0199.613] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x42e7f60c | out: lpNewFilePointer=0x0) returned 1 [0199.614] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.614] WriteFile (in: hFile=0x2ae0, lpBuffer=0x42e7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x42e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x42e7f83c*, lpNumberOfBytesWritten=0x42e7f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.614] SetFilePointerEx (in: hFile=0x2ae0, liDistanceToMove=0x4590, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.614] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.614] CloseHandle (hObject=0x2ae0) returned 1 [0199.614] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.play")) returned 1 [0199.618] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3490 os_tid = 0x3490 [0198.925] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.925] ReadFile (in: hFile=0x2ae8, lpBuffer=0x42fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x42fbfb34*, lpNumberOfBytesRead=0x42fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.123] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.123] ReadFile (in: hFile=0x2ae8, lpBuffer=0x42fbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x42fbf85c, lpOverlapped=0x0 | out: lpBuffer=0x42fbfb34*, lpNumberOfBytesRead=0x42fbf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.424] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.427] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.427] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x42fbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0199.427] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x42fbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x42fbf828, pbKeyObject=0x0) returned 0x0 [0199.427] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x42fbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x42fbf500) returned 0x0 [0199.427] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.428] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x42fbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x42fbf500) returned 0x0 [0199.432] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.436] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.436] WriteFile (in: hFile=0x2ae8, lpBuffer=0x42fbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x42fbf830, lpOverlapped=0x0 | out: lpBuffer=0x42fbfb34*, lpNumberOfBytesWritten=0x42fbf830*=0x428, lpOverlapped=0x0) returned 1 [0199.436] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.436] ReadFile (in: hFile=0x2ae8, lpBuffer=0x5c50000, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x42fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x42fbf61c*=0x76e0, lpOverlapped=0x0) returned 1 [0199.605] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0xffff8920, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.605] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x5c50000, cbInput=0x76e0, pPaddingInfo=0x0, pbIV=0x42fbf848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x42fbf618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x42fbf848, pbOutput=0x5c50000, pcbResult=0x42fbf618) returned 0x0 [0199.605] WriteFile (in: hFile=0x2ae8, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0x76f0, lpNumberOfBytesWritten=0x42fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x42fbf61c*=0x76f0, lpOverlapped=0x0) returned 1 [0199.605] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x42fbf60c | out: lpNewFilePointer=0x0) returned 1 [0199.606] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.606] WriteFile (in: hFile=0x2ae8, lpBuffer=0x42fbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x42fbf61c, lpOverlapped=0x0 | out: lpBuffer=0x42fbf83c*, lpNumberOfBytesWritten=0x42fbf61c*=0x8, lpOverlapped=0x0) returned 1 [0199.606] SetFilePointerEx (in: hFile=0x2ae8, liDistanceToMove=0x76f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.606] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0199.606] CloseHandle (hObject=0x2ae8) returned 1 [0199.606] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.play")) returned 1 [0199.610] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3491 os_tid = 0x3494 [0198.927] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.927] ReadFile (in: hFile=0x2884, lpBuffer=0x430ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x430ff85c, lpOverlapped=0x0 | out: lpBuffer=0x430ffb34*, lpNumberOfBytesRead=0x430ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.232] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.232] ReadFile (in: hFile=0x2884, lpBuffer=0x430ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x430ff85c, lpOverlapped=0x0 | out: lpBuffer=0x430ffb34*, lpNumberOfBytesRead=0x430ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.232] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.235] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.236] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x430ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0199.236] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x430ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x430ff828, pbKeyObject=0x0) returned 0x0 [0199.236] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x430ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x430ff500) returned 0x0 [0199.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.236] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x430ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x430ff500) returned 0x0 [0199.239] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.242] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.243] WriteFile (in: hFile=0x2884, lpBuffer=0x430ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x430ff830, lpOverlapped=0x0 | out: lpBuffer=0x430ffb34*, lpNumberOfBytesWritten=0x430ff830*=0x428, lpOverlapped=0x0) returned 1 [0199.243] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.243] ReadFile (in: hFile=0x2884, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x430ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x430ff61c*=0x5850, lpOverlapped=0x0) returned 1 [0199.554] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xffffa7b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.554] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5d50000, cbInput=0x5850, pPaddingInfo=0x0, pbIV=0x430ff848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x430ff618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x430ff848, pbOutput=0x5d50000, pcbResult=0x430ff618) returned 0x0 [0199.554] WriteFile (in: hFile=0x2884, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x5860, lpNumberOfBytesWritten=0x430ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x430ff61c*=0x5860, lpOverlapped=0x0) returned 1 [0199.554] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x430ff60c | out: lpNewFilePointer=0x0) returned 1 [0199.554] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.554] WriteFile (in: hFile=0x2884, lpBuffer=0x430ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x430ff61c, lpOverlapped=0x0 | out: lpBuffer=0x430ff83c*, lpNumberOfBytesWritten=0x430ff61c*=0x8, lpOverlapped=0x0) returned 1 [0199.554] SetFilePointerEx (in: hFile=0x2884, liDistanceToMove=0x5860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.554] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0199.554] CloseHandle (hObject=0x2884) returned 1 [0199.554] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.play")) returned 1 [0199.558] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3492 os_tid = 0x3498 [0198.929] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.929] ReadFile (in: hFile=0x2af4, lpBuffer=0x4323fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4323f85c, lpOverlapped=0x0 | out: lpBuffer=0x4323fb34*, lpNumberOfBytesRead=0x4323f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.112] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.112] ReadFile (in: hFile=0x2af4, lpBuffer=0x4323fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4323f85c, lpOverlapped=0x0 | out: lpBuffer=0x4323fb34*, lpNumberOfBytesRead=0x4323f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.112] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.115] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.115] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x4323f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0199.115] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x4323f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x4323f828, pbKeyObject=0x0) returned 0x0 [0199.115] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4323f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4323f500) returned 0x0 [0199.116] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.116] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4323f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4323f500) returned 0x0 [0199.119] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.122] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.122] WriteFile (in: hFile=0x2af4, lpBuffer=0x4323fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4323f830, lpOverlapped=0x0 | out: lpBuffer=0x4323fb34*, lpNumberOfBytesWritten=0x4323f830*=0x428, lpOverlapped=0x0) returned 1 [0199.122] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.122] ReadFile (in: hFile=0x2af4, lpBuffer=0x2950000, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x4323f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x4323f61c*=0x5328, lpOverlapped=0x0) returned 1 [0199.413] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0xffffacd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.413] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x2950000, cbInput=0x5328, pPaddingInfo=0x0, pbIV=0x4323f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x4323f618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x4323f848, pbOutput=0x2950000, pcbResult=0x4323f618) returned 0x0 [0199.413] WriteFile (in: hFile=0x2af4, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x4323f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x4323f61c*=0x5330, lpOverlapped=0x0) returned 1 [0199.413] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4323f60c | out: lpNewFilePointer=0x0) returned 1 [0199.413] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.413] WriteFile (in: hFile=0x2af4, lpBuffer=0x4323f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4323f61c, lpOverlapped=0x0 | out: lpBuffer=0x4323f83c*, lpNumberOfBytesWritten=0x4323f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.413] SetFilePointerEx (in: hFile=0x2af4, liDistanceToMove=0x5330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.413] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0199.413] CloseHandle (hObject=0x2af4) returned 1 [0199.414] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.play")) returned 1 [0199.419] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3493 os_tid = 0x349c [0198.931] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.931] ReadFile (in: hFile=0x2afc, lpBuffer=0x4337fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4337f85c, lpOverlapped=0x0 | out: lpBuffer=0x4337fb34*, lpNumberOfBytesRead=0x4337f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.211] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.211] ReadFile (in: hFile=0x2afc, lpBuffer=0x4337fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4337f85c, lpOverlapped=0x0 | out: lpBuffer=0x4337fb34*, lpNumberOfBytesRead=0x4337f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.211] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.214] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.214] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x4337f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0199.214] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x4337f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x4337f828, pbKeyObject=0x0) returned 0x0 [0199.214] BCryptExportKey (in: hKey=0x7f35d0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4337f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4337f500) returned 0x0 [0199.214] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.214] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4337f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4337f500) returned 0x0 [0199.218] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.221] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.221] WriteFile (in: hFile=0x2afc, lpBuffer=0x4337fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4337f830, lpOverlapped=0x0 | out: lpBuffer=0x4337fb34*, lpNumberOfBytesWritten=0x4337f830*=0x428, lpOverlapped=0x0) returned 1 [0199.222] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.222] ReadFile (in: hFile=0x2afc, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x4337f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x4337f61c*=0x8c0, lpOverlapped=0x0) returned 1 [0199.222] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0xfffff740, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.222] BCryptEncrypt (in: hKey=0x7f35d0, pbInput=0x5e50000, cbInput=0x8c0, pPaddingInfo=0x0, pbIV=0x4337f848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x4337f618, dwFlags=0x1 | out: hKey=0x7f35d0, pbIV=0x4337f848, pbOutput=0x5e50000, pcbResult=0x4337f618) returned 0x0 [0199.222] WriteFile (in: hFile=0x2afc, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x4337f61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x4337f61c*=0x8d0, lpOverlapped=0x0) returned 1 [0199.222] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4337f60c | out: lpNewFilePointer=0x0) returned 1 [0199.222] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.222] WriteFile (in: hFile=0x2afc, lpBuffer=0x4337f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4337f61c, lpOverlapped=0x0 | out: lpBuffer=0x4337f83c*, lpNumberOfBytesWritten=0x4337f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.222] SetFilePointerEx (in: hFile=0x2afc, liDistanceToMove=0x8d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.222] BCryptDestroyKey (in: hKey=0x7f35d0 | out: hKey=0x7f35d0) returned 0x0 [0199.222] CloseHandle (hObject=0x2afc) returned 1 [0199.222] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.play")) returned 1 [0199.227] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3494 os_tid = 0x34a0 [0198.932] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.932] ReadFile (in: hFile=0x2b04, lpBuffer=0x434bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x434bf85c, lpOverlapped=0x0 | out: lpBuffer=0x434bfb34*, lpNumberOfBytesRead=0x434bf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.200] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.200] ReadFile (in: hFile=0x2b04, lpBuffer=0x434bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x434bf85c, lpOverlapped=0x0 | out: lpBuffer=0x434bfb34*, lpNumberOfBytesRead=0x434bf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.200] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.203] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.203] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x434bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0199.203] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x434bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x434bf828, pbKeyObject=0x0) returned 0x0 [0199.203] BCryptExportKey (in: hKey=0x7f3350, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x434bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x434bf500) returned 0x0 [0199.203] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.203] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x434bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x434bf500) returned 0x0 [0199.207] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.210] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.210] WriteFile (in: hFile=0x2b04, lpBuffer=0x434bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x434bf830, lpOverlapped=0x0 | out: lpBuffer=0x434bfb34*, lpNumberOfBytesWritten=0x434bf830*=0x428, lpOverlapped=0x0) returned 1 [0199.210] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.210] ReadFile (in: hFile=0x2b04, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x434bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x434bf61c*=0x39f8, lpOverlapped=0x0) returned 1 [0199.544] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0xffffc608, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.544] BCryptEncrypt (in: hKey=0x7f3350, pbInput=0x5f50000, cbInput=0x39f8, pPaddingInfo=0x0, pbIV=0x434bf848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x434bf618, dwFlags=0x1 | out: hKey=0x7f3350, pbIV=0x434bf848, pbOutput=0x5f50000, pcbResult=0x434bf618) returned 0x0 [0199.544] WriteFile (in: hFile=0x2b04, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x434bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x434bf61c*=0x3a00, lpOverlapped=0x0) returned 1 [0199.544] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x434bf60c | out: lpNewFilePointer=0x0) returned 1 [0199.544] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.545] WriteFile (in: hFile=0x2b04, lpBuffer=0x434bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x434bf61c, lpOverlapped=0x0 | out: lpBuffer=0x434bf83c*, lpNumberOfBytesWritten=0x434bf61c*=0x8, lpOverlapped=0x0) returned 1 [0199.545] SetFilePointerEx (in: hFile=0x2b04, liDistanceToMove=0x3a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.545] BCryptDestroyKey (in: hKey=0x7f3350 | out: hKey=0x7f3350) returned 0x0 [0199.545] CloseHandle (hObject=0x2b04) returned 1 [0199.545] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.play")) returned 1 [0199.549] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3495 os_tid = 0x34a4 [0198.934] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.934] ReadFile (in: hFile=0x2b0c, lpBuffer=0x435ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x435ff85c, lpOverlapped=0x0 | out: lpBuffer=0x435ffb34*, lpNumberOfBytesRead=0x435ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.188] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.188] ReadFile (in: hFile=0x2b0c, lpBuffer=0x435ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x435ff85c, lpOverlapped=0x0 | out: lpBuffer=0x435ffb34*, lpNumberOfBytesRead=0x435ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.188] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.191] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.191] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x435ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0199.191] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x435ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x435ff828, pbKeyObject=0x0) returned 0x0 [0199.191] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x435ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x435ff500) returned 0x0 [0199.191] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.192] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x435ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x435ff500) returned 0x0 [0199.195] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.198] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.199] WriteFile (in: hFile=0x2b0c, lpBuffer=0x435ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x435ff830, lpOverlapped=0x0 | out: lpBuffer=0x435ffb34*, lpNumberOfBytesWritten=0x435ff830*=0x428, lpOverlapped=0x0) returned 1 [0199.199] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.199] ReadFile (in: hFile=0x2b0c, lpBuffer=0x6050000, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x435ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x435ff61c*=0x1d2a, lpOverlapped=0x0) returned 1 [0199.471] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0xffffe2d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.471] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x6050000, cbInput=0x1d2a, pPaddingInfo=0x0, pbIV=0x435ff848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x435ff618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x435ff848, pbOutput=0x6050000, pcbResult=0x435ff618) returned 0x0 [0199.471] WriteFile (in: hFile=0x2b0c, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x435ff61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x435ff61c*=0x1d30, lpOverlapped=0x0) returned 1 [0199.472] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x435ff60c | out: lpNewFilePointer=0x0) returned 1 [0199.472] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.472] WriteFile (in: hFile=0x2b0c, lpBuffer=0x435ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x435ff61c, lpOverlapped=0x0 | out: lpBuffer=0x435ff83c*, lpNumberOfBytesWritten=0x435ff61c*=0x8, lpOverlapped=0x0) returned 1 [0199.472] SetFilePointerEx (in: hFile=0x2b0c, liDistanceToMove=0x1d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.472] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0199.472] CloseHandle (hObject=0x2b0c) returned 1 [0199.472] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.play")) returned 1 [0199.540] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3496 os_tid = 0x34a8 [0198.935] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.935] ReadFile (in: hFile=0x2b14, lpBuffer=0x4373fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4373f85c, lpOverlapped=0x0 | out: lpBuffer=0x4373fb34*, lpNumberOfBytesRead=0x4373f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.154] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.154] ReadFile (in: hFile=0x2b14, lpBuffer=0x4373fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4373f85c, lpOverlapped=0x0 | out: lpBuffer=0x4373fb34*, lpNumberOfBytesRead=0x4373f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.154] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.157] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.157] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x4373f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0199.157] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x4373f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x4373f828, pbKeyObject=0x0) returned 0x0 [0199.157] BCryptExportKey (in: hKey=0x7f30c0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4373f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4373f500) returned 0x0 [0199.157] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.157] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4373f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4373f500) returned 0x0 [0199.161] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.173] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.174] WriteFile (in: hFile=0x2b14, lpBuffer=0x4373fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4373f830, lpOverlapped=0x0 | out: lpBuffer=0x4373fb34*, lpNumberOfBytesWritten=0x4373f830*=0x428, lpOverlapped=0x0) returned 1 [0199.175] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.175] ReadFile (in: hFile=0x2b14, lpBuffer=0x6150000, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x4373f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x4373f61c*=0xc70, lpOverlapped=0x0) returned 1 [0199.175] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0xfffff390, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.175] BCryptEncrypt (in: hKey=0x7f30c0, pbInput=0x6150000, cbInput=0xc70, pPaddingInfo=0x0, pbIV=0x4373f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x4373f618, dwFlags=0x1 | out: hKey=0x7f30c0, pbIV=0x4373f848, pbOutput=0x6150000, pcbResult=0x4373f618) returned 0x0 [0199.175] WriteFile (in: hFile=0x2b14, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x4373f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x4373f61c*=0xc80, lpOverlapped=0x0) returned 1 [0199.175] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4373f60c | out: lpNewFilePointer=0x0) returned 1 [0199.175] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.176] WriteFile (in: hFile=0x2b14, lpBuffer=0x4373f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4373f61c, lpOverlapped=0x0 | out: lpBuffer=0x4373f83c*, lpNumberOfBytesWritten=0x4373f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.176] SetFilePointerEx (in: hFile=0x2b14, liDistanceToMove=0xc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.176] BCryptDestroyKey (in: hKey=0x7f30c0 | out: hKey=0x7f30c0) returned 0x0 [0199.176] CloseHandle (hObject=0x2b14) returned 1 [0199.176] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.play")) returned 1 [0199.183] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3497 os_tid = 0x34ac [0198.936] SetFilePointerEx (in: hFile=0x2b1c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.936] ReadFile (in: hFile=0x2b1c, lpBuffer=0x4387fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4387f85c, lpOverlapped=0x0 | out: lpBuffer=0x4387fb34*, lpNumberOfBytesRead=0x4387f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.297] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.300] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.301] BCryptSetProperty (in: hObject=0x732b20, pszProperty="ChainingMode", pbInput=0x4387f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732b20) returned 0x0 [0199.301] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732b20, phKey=0x4387f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732b20, phKey=0x4387f828, pbKeyObject=0x0) returned 0x0 [0199.301] BCryptExportKey (in: hKey=0x7f3d70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4387f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4387f500) returned 0x0 [0199.301] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.301] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4387f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4387f500) returned 0x0 [0199.305] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.308] SetFilePointerEx (in: hFile=0x2b1c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.308] WriteFile (in: hFile=0x2b1c, lpBuffer=0x4387fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4387f830, lpOverlapped=0x0 | out: lpBuffer=0x4387fb34*, lpNumberOfBytesWritten=0x4387f830*=0x428, lpOverlapped=0x0) returned 1 [0199.309] SetFilePointerEx (in: hFile=0x2b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.309] ReadFile (in: hFile=0x2b1c, lpBuffer=0x6250000, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x4387f61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesRead=0x4387f61c*=0x614, lpOverlapped=0x0) returned 1 [0199.309] SetFilePointerEx (in: hFile=0x2b1c, liDistanceToMove=0xfffff9ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.309] BCryptEncrypt (in: hKey=0x7f3d70, pbInput=0x6250000, cbInput=0x614, pPaddingInfo=0x0, pbIV=0x4387f848, cbIV=0x10, pbOutput=0x6250000, cbOutput=0x100000, pcbResult=0x4387f618, dwFlags=0x1 | out: hKey=0x7f3d70, pbIV=0x4387f848, pbOutput=0x6250000, pcbResult=0x4387f618) returned 0x0 [0199.309] WriteFile (in: hFile=0x2b1c, lpBuffer=0x6250000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4387f61c, lpOverlapped=0x0 | out: lpBuffer=0x6250000*, lpNumberOfBytesWritten=0x4387f61c*=0x620, lpOverlapped=0x0) returned 1 [0199.309] SetFilePointerEx (in: hFile=0x2b1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4387f60c | out: lpNewFilePointer=0x0) returned 1 [0199.309] SetFilePointerEx (in: hFile=0x2b1c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.309] WriteFile (in: hFile=0x2b1c, lpBuffer=0x4387f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4387f61c, lpOverlapped=0x0 | out: lpBuffer=0x4387f83c*, lpNumberOfBytesWritten=0x4387f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.309] SetFilePointerEx (in: hFile=0x2b1c, liDistanceToMove=0x620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.309] BCryptDestroyKey (in: hKey=0x7f3d70 | out: hKey=0x7f3d70) returned 0x0 [0199.309] CloseHandle (hObject=0x2b1c) returned 1 [0199.310] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.312] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.play")) returned 1 [0199.314] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3498 os_tid = 0x34b0 [0198.937] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.938] ReadFile (in: hFile=0x2b24, lpBuffer=0x439bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x439bf85c, lpOverlapped=0x0 | out: lpBuffer=0x439bfb34*, lpNumberOfBytesRead=0x439bf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.347] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.348] ReadFile (in: hFile=0x2b24, lpBuffer=0x439bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x439bf85c, lpOverlapped=0x0 | out: lpBuffer=0x439bfb34*, lpNumberOfBytesRead=0x439bf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.348] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.351] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.351] BCryptSetProperty (in: hObject=0x732d30, pszProperty="ChainingMode", pbInput=0x439bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732d30) returned 0x0 [0199.351] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732d30, phKey=0x439bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732d30, phKey=0x439bf828, pbKeyObject=0x0) returned 0x0 [0199.351] BCryptExportKey (in: hKey=0x7f3d70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x439bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x439bf500) returned 0x0 [0199.352] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.352] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x439bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x439bf500) returned 0x0 [0199.356] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.360] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.361] WriteFile (in: hFile=0x2b24, lpBuffer=0x439bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x439bf830, lpOverlapped=0x0 | out: lpBuffer=0x439bfb34*, lpNumberOfBytesWritten=0x439bf830*=0x428, lpOverlapped=0x0) returned 1 [0199.361] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.361] ReadFile (in: hFile=0x2b24, lpBuffer=0x6350000, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x439bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x439bf61c*=0x8b4, lpOverlapped=0x0) returned 1 [0199.361] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0xfffff74c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.361] BCryptEncrypt (in: hKey=0x7f3d70, pbInput=0x6350000, cbInput=0x8b4, pPaddingInfo=0x0, pbIV=0x439bf848, cbIV=0x10, pbOutput=0x6350000, cbOutput=0x100000, pcbResult=0x439bf618, dwFlags=0x1 | out: hKey=0x7f3d70, pbIV=0x439bf848, pbOutput=0x6350000, pcbResult=0x439bf618) returned 0x0 [0199.361] WriteFile (in: hFile=0x2b24, lpBuffer=0x6350000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x439bf61c, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesWritten=0x439bf61c*=0x8c0, lpOverlapped=0x0) returned 1 [0199.361] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x439bf60c | out: lpNewFilePointer=0x0) returned 1 [0199.361] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.361] WriteFile (in: hFile=0x2b24, lpBuffer=0x439bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x439bf61c, lpOverlapped=0x0 | out: lpBuffer=0x439bf83c*, lpNumberOfBytesWritten=0x439bf61c*=0x8, lpOverlapped=0x0) returned 1 [0199.362] SetFilePointerEx (in: hFile=0x2b24, liDistanceToMove=0x8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.362] BCryptDestroyKey (in: hKey=0x7f3d70 | out: hKey=0x7f3d70) returned 0x0 [0199.362] CloseHandle (hObject=0x2b24) returned 1 [0199.362] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.play")) returned 1 [0199.367] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3499 os_tid = 0x34b4 [0198.939] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.939] ReadFile (in: hFile=0x2b2c, lpBuffer=0x43affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43aff85c, lpOverlapped=0x0 | out: lpBuffer=0x43affb34*, lpNumberOfBytesRead=0x43aff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.284] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.284] ReadFile (in: hFile=0x2b2c, lpBuffer=0x43affb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43aff85c, lpOverlapped=0x0 | out: lpBuffer=0x43affb34*, lpNumberOfBytesRead=0x43aff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.284] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.287] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.287] BCryptSetProperty (in: hObject=0x731d60, pszProperty="ChainingMode", pbInput=0x43aff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731d60) returned 0x0 [0199.287] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731d60, phKey=0x43aff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731d60, phKey=0x43aff828, pbKeyObject=0x0) returned 0x0 [0199.287] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x43aff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x43aff500) returned 0x0 [0199.288] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.288] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x43aff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x43aff500) returned 0x0 [0199.291] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.294] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.294] WriteFile (in: hFile=0x2b2c, lpBuffer=0x43affb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x43aff830, lpOverlapped=0x0 | out: lpBuffer=0x43affb34*, lpNumberOfBytesWritten=0x43aff830*=0x428, lpOverlapped=0x0) returned 1 [0199.294] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.294] ReadFile (in: hFile=0x2b2c, lpBuffer=0x6450000, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x43aff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesRead=0x43aff61c*=0x3380, lpOverlapped=0x0) returned 1 [0199.570] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0xffffcc80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.570] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x6450000, cbInput=0x3380, pPaddingInfo=0x0, pbIV=0x43aff848, cbIV=0x10, pbOutput=0x6450000, cbOutput=0x100000, pcbResult=0x43aff618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x43aff848, pbOutput=0x6450000, pcbResult=0x43aff618) returned 0x0 [0199.570] WriteFile (in: hFile=0x2b2c, lpBuffer=0x6450000*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x43aff61c, lpOverlapped=0x0 | out: lpBuffer=0x6450000*, lpNumberOfBytesWritten=0x43aff61c*=0x3390, lpOverlapped=0x0) returned 1 [0199.570] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x43aff60c | out: lpNewFilePointer=0x0) returned 1 [0199.570] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.570] WriteFile (in: hFile=0x2b2c, lpBuffer=0x43aff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x43aff61c, lpOverlapped=0x0 | out: lpBuffer=0x43aff83c*, lpNumberOfBytesWritten=0x43aff61c*=0x8, lpOverlapped=0x0) returned 1 [0199.571] SetFilePointerEx (in: hFile=0x2b2c, liDistanceToMove=0x3390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.571] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0199.571] CloseHandle (hObject=0x2b2c) returned 1 [0199.571] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.play")) returned 1 [0199.574] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3500 os_tid = 0x34b8 [0198.940] SetFilePointerEx (in: hFile=0x2b34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.940] ReadFile (in: hFile=0x2b34, lpBuffer=0x43c3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x43c3fb34*, lpNumberOfBytesRead=0x43c3f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.260] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.264] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.264] BCryptSetProperty (in: hObject=0x7329c0, pszProperty="ChainingMode", pbInput=0x43c3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7329c0) returned 0x0 [0199.264] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7329c0, phKey=0x43c3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7329c0, phKey=0x43c3f828, pbKeyObject=0x0) returned 0x0 [0199.264] BCryptExportKey (in: hKey=0x7f3ae0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x43c3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x43c3f500) returned 0x0 [0199.264] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.264] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x43c3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x43c3f500) returned 0x0 [0199.268] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.272] SetFilePointerEx (in: hFile=0x2b34, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.273] WriteFile (in: hFile=0x2b34, lpBuffer=0x43c3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x43c3f830, lpOverlapped=0x0 | out: lpBuffer=0x43c3fb34*, lpNumberOfBytesWritten=0x43c3f830*=0x428, lpOverlapped=0x0) returned 1 [0199.273] SetFilePointerEx (in: hFile=0x2b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.273] ReadFile (in: hFile=0x2b34, lpBuffer=0x6550000, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x43c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesRead=0x43c3f61c*=0x692, lpOverlapped=0x0) returned 1 [0199.273] SetFilePointerEx (in: hFile=0x2b34, liDistanceToMove=0xfffff96e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.273] BCryptEncrypt (in: hKey=0x7f3ae0, pbInput=0x6550000, cbInput=0x692, pPaddingInfo=0x0, pbIV=0x43c3f848, cbIV=0x10, pbOutput=0x6550000, cbOutput=0x100000, pcbResult=0x43c3f618, dwFlags=0x1 | out: hKey=0x7f3ae0, pbIV=0x43c3f848, pbOutput=0x6550000, pcbResult=0x43c3f618) returned 0x0 [0199.273] WriteFile (in: hFile=0x2b34, lpBuffer=0x6550000*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x43c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6550000*, lpNumberOfBytesWritten=0x43c3f61c*=0x6a0, lpOverlapped=0x0) returned 1 [0199.273] SetFilePointerEx (in: hFile=0x2b34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x43c3f60c | out: lpNewFilePointer=0x0) returned 1 [0199.273] SetFilePointerEx (in: hFile=0x2b34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.273] WriteFile (in: hFile=0x2b34, lpBuffer=0x43c3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x43c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x43c3f83c*, lpNumberOfBytesWritten=0x43c3f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.273] SetFilePointerEx (in: hFile=0x2b34, liDistanceToMove=0x6a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.274] BCryptDestroyKey (in: hKey=0x7f3ae0 | out: hKey=0x7f3ae0) returned 0x0 [0199.274] CloseHandle (hObject=0x2b34) returned 1 [0199.274] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.play")) returned 1 [0199.279] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3501 os_tid = 0x34bc [0198.942] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.942] ReadFile (in: hFile=0x2b3c, lpBuffer=0x43d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x43d7fb34*, lpNumberOfBytesRead=0x43d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.331] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.331] ReadFile (in: hFile=0x2b3c, lpBuffer=0x43d7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43d7f85c, lpOverlapped=0x0 | out: lpBuffer=0x43d7fb34*, lpNumberOfBytesRead=0x43d7f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.332] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.335] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.336] BCryptSetProperty (in: hObject=0x732020, pszProperty="ChainingMode", pbInput=0x43d7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732020) returned 0x0 [0199.336] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732020, phKey=0x43d7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732020, phKey=0x43d7f828, pbKeyObject=0x0) returned 0x0 [0199.336] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x43d7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x43d7f500) returned 0x0 [0199.336] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.336] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x43d7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x43d7f500) returned 0x0 [0199.341] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.345] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.345] WriteFile (in: hFile=0x2b3c, lpBuffer=0x43d7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x43d7f830, lpOverlapped=0x0 | out: lpBuffer=0x43d7fb34*, lpNumberOfBytesWritten=0x43d7f830*=0x428, lpOverlapped=0x0) returned 1 [0199.346] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.346] ReadFile (in: hFile=0x2b3c, lpBuffer=0x6650000, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x43d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesRead=0x43d7f61c*=0x282c, lpOverlapped=0x0) returned 1 [0199.578] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0xffffd7d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.578] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6650000, cbInput=0x282c, pPaddingInfo=0x0, pbIV=0x43d7f848, cbIV=0x10, pbOutput=0x6650000, cbOutput=0x100000, pcbResult=0x43d7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x43d7f848, pbOutput=0x6650000, pcbResult=0x43d7f618) returned 0x0 [0199.578] WriteFile (in: hFile=0x2b3c, lpBuffer=0x6650000*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x43d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6650000*, lpNumberOfBytesWritten=0x43d7f61c*=0x2830, lpOverlapped=0x0) returned 1 [0199.578] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x43d7f60c | out: lpNewFilePointer=0x0) returned 1 [0199.578] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.578] WriteFile (in: hFile=0x2b3c, lpBuffer=0x43d7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x43d7f61c, lpOverlapped=0x0 | out: lpBuffer=0x43d7f83c*, lpNumberOfBytesWritten=0x43d7f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.578] SetFilePointerEx (in: hFile=0x2b3c, liDistanceToMove=0x2830, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.578] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.578] CloseHandle (hObject=0x2b3c) returned 1 [0199.578] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.play")) returned 1 [0199.582] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3502 os_tid = 0x34c0 [0198.943] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.943] ReadFile (in: hFile=0x2b44, lpBuffer=0x43ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x43ebfb34*, lpNumberOfBytesRead=0x43ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.244] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.244] ReadFile (in: hFile=0x2b44, lpBuffer=0x43ebfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43ebf85c, lpOverlapped=0x0 | out: lpBuffer=0x43ebfb34*, lpNumberOfBytesRead=0x43ebf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.244] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.247] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.247] BCryptSetProperty (in: hObject=0x732a70, pszProperty="ChainingMode", pbInput=0x43ebf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732a70) returned 0x0 [0199.247] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732a70, phKey=0x43ebf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732a70, phKey=0x43ebf828, pbKeyObject=0x0) returned 0x0 [0199.247] BCryptExportKey (in: hKey=0x7f3860, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x43ebf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x43ebf500) returned 0x0 [0199.248] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.248] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x43ebf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x43ebf500) returned 0x0 [0199.251] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.258] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.258] WriteFile (in: hFile=0x2b44, lpBuffer=0x43ebfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x43ebf830, lpOverlapped=0x0 | out: lpBuffer=0x43ebfb34*, lpNumberOfBytesWritten=0x43ebf830*=0x428, lpOverlapped=0x0) returned 1 [0199.259] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.259] ReadFile (in: hFile=0x2b44, lpBuffer=0x6750000, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x43ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesRead=0x43ebf61c*=0x2108, lpOverlapped=0x0) returned 1 [0199.562] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0xffffdef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.562] BCryptEncrypt (in: hKey=0x7f3860, pbInput=0x6750000, cbInput=0x2108, pPaddingInfo=0x0, pbIV=0x43ebf848, cbIV=0x10, pbOutput=0x6750000, cbOutput=0x100000, pcbResult=0x43ebf618, dwFlags=0x1 | out: hKey=0x7f3860, pbIV=0x43ebf848, pbOutput=0x6750000, pcbResult=0x43ebf618) returned 0x0 [0199.562] WriteFile (in: hFile=0x2b44, lpBuffer=0x6750000*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x43ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x6750000*, lpNumberOfBytesWritten=0x43ebf61c*=0x2110, lpOverlapped=0x0) returned 1 [0199.562] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x43ebf60c | out: lpNewFilePointer=0x0) returned 1 [0199.562] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.562] WriteFile (in: hFile=0x2b44, lpBuffer=0x43ebf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x43ebf61c, lpOverlapped=0x0 | out: lpBuffer=0x43ebf83c*, lpNumberOfBytesWritten=0x43ebf61c*=0x8, lpOverlapped=0x0) returned 1 [0199.562] SetFilePointerEx (in: hFile=0x2b44, liDistanceToMove=0x2110, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.562] BCryptDestroyKey (in: hKey=0x7f3860 | out: hKey=0x7f3860) returned 0x0 [0199.562] CloseHandle (hObject=0x2b44) returned 1 [0199.563] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.play")) returned 1 [0199.566] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3503 os_tid = 0x34c4 [0198.944] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.945] ReadFile (in: hFile=0x2b4c, lpBuffer=0x43fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43fff85c, lpOverlapped=0x0 | out: lpBuffer=0x43fffb34*, lpNumberOfBytesRead=0x43fff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.372] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.372] ReadFile (in: hFile=0x2b4c, lpBuffer=0x43fffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x43fff85c, lpOverlapped=0x0 | out: lpBuffer=0x43fffb34*, lpNumberOfBytesRead=0x43fff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.372] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.376] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.376] BCryptSetProperty (in: hObject=0x732bd0, pszProperty="ChainingMode", pbInput=0x43fff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732bd0) returned 0x0 [0199.376] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732bd0, phKey=0x43fff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732bd0, phKey=0x43fff828, pbKeyObject=0x0) returned 0x0 [0199.376] BCryptExportKey (in: hKey=0x7f3d70, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x43fff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x43fff500) returned 0x0 [0199.376] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.376] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x43fff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x43fff500) returned 0x0 [0199.381] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.385] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.385] WriteFile (in: hFile=0x2b4c, lpBuffer=0x43fffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x43fff830, lpOverlapped=0x0 | out: lpBuffer=0x43fffb34*, lpNumberOfBytesWritten=0x43fff830*=0x428, lpOverlapped=0x0) returned 1 [0199.386] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.386] ReadFile (in: hFile=0x2b4c, lpBuffer=0x6850000, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x43fff61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesRead=0x43fff61c*=0x1f24, lpOverlapped=0x0) returned 1 [0199.587] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0xffffe0dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.587] BCryptEncrypt (in: hKey=0x7f3d70, pbInput=0x6850000, cbInput=0x1f24, pPaddingInfo=0x0, pbIV=0x43fff848, cbIV=0x10, pbOutput=0x6850000, cbOutput=0x100000, pcbResult=0x43fff618, dwFlags=0x1 | out: hKey=0x7f3d70, pbIV=0x43fff848, pbOutput=0x6850000, pcbResult=0x43fff618) returned 0x0 [0199.587] WriteFile (in: hFile=0x2b4c, lpBuffer=0x6850000*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x43fff61c, lpOverlapped=0x0 | out: lpBuffer=0x6850000*, lpNumberOfBytesWritten=0x43fff61c*=0x1f30, lpOverlapped=0x0) returned 1 [0199.587] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x43fff60c | out: lpNewFilePointer=0x0) returned 1 [0199.587] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.587] WriteFile (in: hFile=0x2b4c, lpBuffer=0x43fff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x43fff61c, lpOverlapped=0x0 | out: lpBuffer=0x43fff83c*, lpNumberOfBytesWritten=0x43fff61c*=0x8, lpOverlapped=0x0) returned 1 [0199.587] SetFilePointerEx (in: hFile=0x2b4c, liDistanceToMove=0x1f30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.587] BCryptDestroyKey (in: hKey=0x7f3d70 | out: hKey=0x7f3d70) returned 0x0 [0199.587] CloseHandle (hObject=0x2b4c) returned 1 [0199.587] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.play")) returned 1 [0199.591] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3504 os_tid = 0x34c8 [0198.946] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.946] ReadFile (in: hFile=0x2b54, lpBuffer=0x4413fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4413f85c, lpOverlapped=0x0 | out: lpBuffer=0x4413fb34*, lpNumberOfBytesRead=0x4413f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.144] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.144] ReadFile (in: hFile=0x2b54, lpBuffer=0x4413fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4413f85c, lpOverlapped=0x0 | out: lpBuffer=0x4413fb34*, lpNumberOfBytesRead=0x4413f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.144] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0199.147] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0199.147] BCryptSetProperty (in: hObject=0x733200, pszProperty="ChainingMode", pbInput=0x4413f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733200) returned 0x0 [0199.147] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733200, phKey=0x4413f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733200, phKey=0x4413f828, pbKeyObject=0x0) returned 0x0 [0199.147] BCryptExportKey (in: hKey=0x7f2e40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4413f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4413f500) returned 0x0 [0199.147] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0199.147] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4413f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4413f500) returned 0x0 [0199.150] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.153] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.153] WriteFile (in: hFile=0x2b54, lpBuffer=0x4413fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4413f830, lpOverlapped=0x0 | out: lpBuffer=0x4413fb34*, lpNumberOfBytesWritten=0x4413f830*=0x428, lpOverlapped=0x0) returned 1 [0199.154] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.154] ReadFile (in: hFile=0x2b54, lpBuffer=0x6950000, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x4413f61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesRead=0x4413f61c*=0x2178, lpOverlapped=0x0) returned 1 [0199.461] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0xffffde88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.461] BCryptEncrypt (in: hKey=0x7f2e40, pbInput=0x6950000, cbInput=0x2178, pPaddingInfo=0x0, pbIV=0x4413f848, cbIV=0x10, pbOutput=0x6950000, cbOutput=0x100000, pcbResult=0x4413f618, dwFlags=0x1 | out: hKey=0x7f2e40, pbIV=0x4413f848, pbOutput=0x6950000, pcbResult=0x4413f618) returned 0x0 [0199.461] WriteFile (in: hFile=0x2b54, lpBuffer=0x6950000*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x4413f61c, lpOverlapped=0x0 | out: lpBuffer=0x6950000*, lpNumberOfBytesWritten=0x4413f61c*=0x2180, lpOverlapped=0x0) returned 1 [0199.462] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4413f60c | out: lpNewFilePointer=0x0) returned 1 [0199.462] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.462] WriteFile (in: hFile=0x2b54, lpBuffer=0x4413f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4413f61c, lpOverlapped=0x0 | out: lpBuffer=0x4413f83c*, lpNumberOfBytesWritten=0x4413f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.462] SetFilePointerEx (in: hFile=0x2b54, liDistanceToMove=0x2180, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.462] BCryptDestroyKey (in: hKey=0x7f2e40 | out: hKey=0x7f2e40) returned 0x0 [0199.462] CloseHandle (hObject=0x2b54) returned 1 [0199.462] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0199.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.play")) returned 1 [0199.467] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3505 os_tid = 0x34cc [0199.666] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.666] ReadFile (in: hFile=0x2a98, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.667] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.667] ReadFile (in: hFile=0x2a98, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.668] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.671] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.671] BCryptSetProperty (in: hObject=0x731cb0, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731cb0) returned 0x0 [0199.671] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731cb0, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731cb0, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0199.671] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1590f500) returned 0x0 [0199.671] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.671] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1590f500) returned 0x0 [0199.675] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.678] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.678] WriteFile (in: hFile=0x2a98, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0199.678] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.678] ReadFile (in: hFile=0x2a98, lpBuffer=0x6a50000, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesRead=0x1590f61c*=0x1664, lpOverlapped=0x0) returned 1 [0199.679] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xffffe99c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.679] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6a50000, cbInput=0x1664, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x6a50000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x6a50000, pcbResult=0x1590f618) returned 0x0 [0199.679] WriteFile (in: hFile=0x2a98, lpBuffer=0x6a50000*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x6a50000*, lpNumberOfBytesWritten=0x1590f61c*=0x1670, lpOverlapped=0x0) returned 1 [0199.679] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0199.679] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.679] WriteFile (in: hFile=0x2a98, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.679] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x1670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.679] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.679] CloseHandle (hObject=0x2a98) returned 1 [0199.679] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.play")) returned 1 [0199.683] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3506 os_tid = 0x34d0 [0199.687] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.688] ReadFile (in: hFile=0x2a80, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.691] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.691] ReadFile (in: hFile=0x2a80, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.692] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.695] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x15a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0199.695] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x15a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x15a0f828, pbKeyObject=0x0) returned 0x0 [0199.695] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15a0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15a0f500) returned 0x0 [0199.695] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.695] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15a0f500) returned 0x0 [0199.698] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.701] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.701] WriteFile (in: hFile=0x2a80, lpBuffer=0x15a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a0f830, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesWritten=0x15a0f830*=0x428, lpOverlapped=0x0) returned 1 [0199.701] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.702] ReadFile (in: hFile=0x2a80, lpBuffer=0x2750000, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x15a0f61c*=0x41a0, lpOverlapped=0x0) returned 1 [0199.702] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xffffbe60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.702] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x41a0, pPaddingInfo=0x0, pbIV=0x15a0f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x15a0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a0f848, pbOutput=0x2750000, pcbResult=0x15a0f618) returned 0x0 [0199.702] WriteFile (in: hFile=0x2a80, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x41b0, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x15a0f61c*=0x41b0, lpOverlapped=0x0) returned 1 [0199.703] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a0f60c | out: lpNewFilePointer=0x0) returned 1 [0199.703] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.703] WriteFile (in: hFile=0x2a80, lpBuffer=0x15a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a0f83c*, lpNumberOfBytesWritten=0x15a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.703] SetFilePointerEx (in: hFile=0x2a80, liDistanceToMove=0x41b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.703] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.703] CloseHandle (hObject=0x2a80) returned 1 [0199.703] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.play")) returned 1 [0199.707] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3507 os_tid = 0x34d4 [0199.711] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.711] ReadFile (in: hFile=0x2a70, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.713] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.713] ReadFile (in: hFile=0x2a70, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.713] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.715] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x15b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0199.715] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x15b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x15b4f828, pbKeyObject=0x0) returned 0x0 [0199.715] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15b4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15b4f500) returned 0x0 [0199.715] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.716] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15b4f500) returned 0x0 [0199.719] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.722] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.722] WriteFile (in: hFile=0x2a70, lpBuffer=0x15b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b4f830, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesWritten=0x15b4f830*=0x428, lpOverlapped=0x0) returned 1 [0199.722] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.722] ReadFile (in: hFile=0x2a70, lpBuffer=0x2850000, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x15b4f61c*=0x3998, lpOverlapped=0x0) returned 1 [0199.723] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xffffc668, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.723] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x3998, pPaddingInfo=0x0, pbIV=0x15b4f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x15b4f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15b4f848, pbOutput=0x2850000, pcbResult=0x15b4f618) returned 0x0 [0199.723] WriteFile (in: hFile=0x2a70, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x15b4f61c*=0x39a0, lpOverlapped=0x0) returned 1 [0199.723] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b4f60c | out: lpNewFilePointer=0x0) returned 1 [0199.723] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.723] WriteFile (in: hFile=0x2a70, lpBuffer=0x15b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b4f83c*, lpNumberOfBytesWritten=0x15b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.723] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x39a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.723] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.723] CloseHandle (hObject=0x2a70) returned 1 [0199.724] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.play")) returned 1 [0199.728] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3508 os_tid = 0x34d8 [0199.732] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.732] ReadFile (in: hFile=0x2a60, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.733] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.734] ReadFile (in: hFile=0x2a60, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.734] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.736] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.736] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x15c8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0199.736] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x15c8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x15c8f828, pbKeyObject=0x0) returned 0x0 [0199.737] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15c8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15c8f500) returned 0x0 [0199.737] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.737] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15c8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15c8f500) returned 0x0 [0199.740] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.743] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.744] WriteFile (in: hFile=0x2a60, lpBuffer=0x15c8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15c8f830, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesWritten=0x15c8f830*=0x428, lpOverlapped=0x0) returned 1 [0199.744] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.744] ReadFile (in: hFile=0x2a60, lpBuffer=0x2a50000, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x15c8f61c*=0xec4, lpOverlapped=0x0) returned 1 [0199.744] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffff13c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.744] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0xec4, pPaddingInfo=0x0, pbIV=0x15c8f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x15c8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15c8f848, pbOutput=0x2a50000, pcbResult=0x15c8f618) returned 0x0 [0199.744] WriteFile (in: hFile=0x2a60, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x15c8f61c*=0xed0, lpOverlapped=0x0) returned 1 [0199.744] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15c8f60c | out: lpNewFilePointer=0x0) returned 1 [0199.745] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.745] WriteFile (in: hFile=0x2a60, lpBuffer=0x15c8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15c8f83c*, lpNumberOfBytesWritten=0x15c8f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.745] SetFilePointerEx (in: hFile=0x2a60, liDistanceToMove=0xed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.745] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.745] CloseHandle (hObject=0x2a60) returned 1 [0199.745] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.play")) returned 1 [0199.749] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3509 os_tid = 0x34dc [0199.754] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.754] ReadFile (in: hFile=0x2a50, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.756] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.756] ReadFile (in: hFile=0x2a50, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0199.756] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.758] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.758] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15dcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0199.758] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15dcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15dcf828, pbKeyObject=0x0) returned 0x0 [0199.758] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15dcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15dcf500) returned 0x0 [0199.758] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.759] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15dcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15dcf500) returned 0x0 [0199.762] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.765] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.765] WriteFile (in: hFile=0x2a50, lpBuffer=0x15dcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15dcf830, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesWritten=0x15dcf830*=0x428, lpOverlapped=0x0) returned 1 [0199.765] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.765] ReadFile (in: hFile=0x2a50, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15dcf61c*=0x1868, lpOverlapped=0x0) returned 1 [0199.766] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xffffe798, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.766] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0x1868, pPaddingInfo=0x0, pbIV=0x15dcf848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15dcf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15dcf848, pbOutput=0x2b50000, pcbResult=0x15dcf618) returned 0x0 [0199.766] WriteFile (in: hFile=0x2a50, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15dcf61c*=0x1870, lpOverlapped=0x0) returned 1 [0199.766] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15dcf60c | out: lpNewFilePointer=0x0) returned 1 [0199.766] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.766] WriteFile (in: hFile=0x2a50, lpBuffer=0x15dcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15dcf83c*, lpNumberOfBytesWritten=0x15dcf61c*=0x8, lpOverlapped=0x0) returned 1 [0199.766] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x1870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.766] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.766] CloseHandle (hObject=0x2a50) returned 1 [0199.767] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.769] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.play")) returned 1 [0199.771] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3510 os_tid = 0x34e0 [0199.775] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.775] ReadFile (in: hFile=0x2a44, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.777] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.777] ReadFile (in: hFile=0x2a44, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.777] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.779] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.779] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x15f0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0199.779] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x15f0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x15f0f828, pbKeyObject=0x0) returned 0x0 [0199.779] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15f0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15f0f500) returned 0x0 [0199.779] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.779] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15f0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15f0f500) returned 0x0 [0199.783] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.785] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.785] WriteFile (in: hFile=0x2a44, lpBuffer=0x15f0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15f0f830, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesWritten=0x15f0f830*=0x428, lpOverlapped=0x0) returned 1 [0199.786] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.786] ReadFile (in: hFile=0x2a44, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x15f0f61c*=0x9fc, lpOverlapped=0x0) returned 1 [0199.786] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xfffff604, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.786] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2c50000, cbInput=0x9fc, pPaddingInfo=0x0, pbIV=0x15f0f848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x15f0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15f0f848, pbOutput=0x2c50000, pcbResult=0x15f0f618) returned 0x0 [0199.786] WriteFile (in: hFile=0x2a44, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x15f0f61c*=0xa00, lpOverlapped=0x0) returned 1 [0199.786] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15f0f60c | out: lpNewFilePointer=0x0) returned 1 [0199.786] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.787] WriteFile (in: hFile=0x2a44, lpBuffer=0x15f0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15f0f83c*, lpNumberOfBytesWritten=0x15f0f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.787] SetFilePointerEx (in: hFile=0x2a44, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.787] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.787] CloseHandle (hObject=0x2a44) returned 1 [0199.787] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.play")) returned 1 [0199.791] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3511 os_tid = 0x34e4 [0199.795] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.795] ReadFile (in: hFile=0x2a34, lpBuffer=0x1620fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1620f85c, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesRead=0x1620f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.796] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.801] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x1620f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0199.801] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x1620f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x1620f828, pbKeyObject=0x0) returned 0x0 [0199.801] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1620f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1620f500) returned 0x0 [0199.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.801] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1620f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1620f500) returned 0x0 [0199.805] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.808] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.808] WriteFile (in: hFile=0x2a34, lpBuffer=0x1620fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1620f830, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesWritten=0x1620f830*=0x428, lpOverlapped=0x0) returned 1 [0199.808] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.808] ReadFile (in: hFile=0x2a34, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x1620f61c*=0x78a, lpOverlapped=0x0) returned 1 [0199.809] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xfffff876, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.809] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x78a, pPaddingInfo=0x0, pbIV=0x1620f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x1620f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1620f848, pbOutput=0x2d50000, pcbResult=0x1620f618) returned 0x0 [0199.809] WriteFile (in: hFile=0x2a34, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x1620f61c*=0x790, lpOverlapped=0x0) returned 1 [0199.809] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1620f60c | out: lpNewFilePointer=0x0) returned 1 [0199.809] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.809] WriteFile (in: hFile=0x2a34, lpBuffer=0x1620f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x1620f83c*, lpNumberOfBytesWritten=0x1620f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.809] SetFilePointerEx (in: hFile=0x2a34, liDistanceToMove=0x790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.809] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.809] CloseHandle (hObject=0x2a34) returned 1 [0199.809] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.811] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.play")) returned 1 [0199.813] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3512 os_tid = 0x34e8 [0199.820] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.821] ReadFile (in: hFile=0x2a24, lpBuffer=0x1630fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1630f85c, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesRead=0x1630f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.824] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.824] ReadFile (in: hFile=0x2a24, lpBuffer=0x1630fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1630f85c, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesRead=0x1630f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.824] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.826] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.827] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1630f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0199.827] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1630f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1630f828, pbKeyObject=0x0) returned 0x0 [0199.827] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1630f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1630f500) returned 0x0 [0199.827] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.827] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1630f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1630f500) returned 0x0 [0199.830] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.833] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.833] WriteFile (in: hFile=0x2a24, lpBuffer=0x1630fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1630f830, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesWritten=0x1630f830*=0x428, lpOverlapped=0x0) returned 1 [0199.834] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.834] ReadFile (in: hFile=0x2a24, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1630f61c*=0x1020, lpOverlapped=0x0) returned 1 [0199.834] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xffffefe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.834] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0x1020, pPaddingInfo=0x0, pbIV=0x1630f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1630f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1630f848, pbOutput=0x2e50000, pcbResult=0x1630f618) returned 0x0 [0199.834] WriteFile (in: hFile=0x2a24, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1630f61c*=0x1030, lpOverlapped=0x0) returned 1 [0199.834] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1630f60c | out: lpNewFilePointer=0x0) returned 1 [0199.834] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.834] WriteFile (in: hFile=0x2a24, lpBuffer=0x1630f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x1630f83c*, lpNumberOfBytesWritten=0x1630f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.834] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x1030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.834] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.834] CloseHandle (hObject=0x2a24) returned 1 [0199.834] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.play")) returned 1 [0199.838] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3513 os_tid = 0x34ec [0199.842] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.842] ReadFile (in: hFile=0x2a14, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0199.844] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.844] ReadFile (in: hFile=0x2a14, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.649] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.653] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0200.653] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0200.653] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0200.653] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.653] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x219ff500) returned 0x0 [0200.657] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.660] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.660] WriteFile (in: hFile=0x2a14, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0200.660] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.661] ReadFile (in: hFile=0x2a14, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x219ff61c*=0x37f8, lpOverlapped=0x0) returned 1 [0200.669] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xffffc808, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.669] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2f50000, cbInput=0x37f8, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x219ff848, pbOutput=0x2f50000, pcbResult=0x219ff618) returned 0x0 [0200.669] WriteFile (in: hFile=0x2a14, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x219ff61c*=0x3800, lpOverlapped=0x0) returned 1 [0200.670] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0200.670] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.670] WriteFile (in: hFile=0x2a14, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0200.670] SetFilePointerEx (in: hFile=0x2a14, liDistanceToMove=0x3800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.670] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.670] CloseHandle (hObject=0x2a14) returned 1 [0200.670] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.play")) returned 1 [0200.676] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3514 os_tid = 0x34f0 [0199.925] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.925] ReadFile (in: hFile=0x2a04, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.927] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.927] ReadFile (in: hFile=0x2a04, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.928] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.932] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.932] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0199.932] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0199.932] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0199.932] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.932] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0199.938] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.942] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.942] WriteFile (in: hFile=0x2a04, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0199.943] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.943] ReadFile (in: hFile=0x2a04, lpBuffer=0x3050000, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x2d37f61c*=0x167c, lpOverlapped=0x0) returned 1 [0199.943] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xffffe984, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.943] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x167c, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x3050000, pcbResult=0x2d37f618) returned 0x0 [0199.943] WriteFile (in: hFile=0x2a04, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x2d37f61c*=0x1680, lpOverlapped=0x0) returned 1 [0199.943] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0199.943] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.943] WriteFile (in: hFile=0x2a04, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.943] SetFilePointerEx (in: hFile=0x2a04, liDistanceToMove=0x1680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.944] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.944] CloseHandle (hObject=0x2a04) returned 1 [0199.944] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.play")) returned 1 [0199.949] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3515 os_tid = 0x34f4 [0199.954] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.954] ReadFile (in: hFile=0x29f4, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.956] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.961] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.961] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0199.961] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0199.961] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0199.961] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.961] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d47f500) returned 0x0 [0199.966] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.971] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.971] WriteFile (in: hFile=0x29f4, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0199.977] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.977] ReadFile (in: hFile=0x29f4, lpBuffer=0x3150000, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x2d47f61c*=0x608, lpOverlapped=0x0) returned 1 [0199.977] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffff9f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.977] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x608, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d47f848, pbOutput=0x3150000, pcbResult=0x2d47f618) returned 0x0 [0199.977] WriteFile (in: hFile=0x29f4, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x2d47f61c*=0x610, lpOverlapped=0x0) returned 1 [0199.977] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0199.977] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.977] WriteFile (in: hFile=0x29f4, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0199.977] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.977] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0199.977] CloseHandle (hObject=0x29f4) returned 1 [0199.978] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0199.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.play")) returned 1 [0199.983] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3516 os_tid = 0x34f8 [0199.988] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.988] ReadFile (in: hFile=0x29e4, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0199.990] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0199.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0199.993] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0199.993] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0199.993] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0199.993] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0199.993] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0199.996] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.999] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.999] WriteFile (in: hFile=0x29e4, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0199.999] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.999] ReadFile (in: hFile=0x29e4, lpBuffer=0x3250000, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d57f61c*=0x634, lpOverlapped=0x0) returned 1 [0199.999] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xfffff9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.000] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x634, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x3250000, pcbResult=0x2d57f618) returned 0x0 [0200.000] WriteFile (in: hFile=0x29e4, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d57f61c*=0x640, lpOverlapped=0x0) returned 1 [0200.000] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0200.000] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.000] WriteFile (in: hFile=0x29e4, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.000] SetFilePointerEx (in: hFile=0x29e4, liDistanceToMove=0x640, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.000] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.000] CloseHandle (hObject=0x29e4) returned 1 [0200.000] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.play")) returned 1 [0200.004] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3517 os_tid = 0x34fc [0200.008] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.008] ReadFile (in: hFile=0x29d4, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.029] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.029] ReadFile (in: hFile=0x29d4, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.029] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.032] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0200.032] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0200.032] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d67f500) returned 0x0 [0200.032] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.032] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d67f500) returned 0x0 [0200.035] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.038] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.039] WriteFile (in: hFile=0x29d4, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0200.039] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.039] ReadFile (in: hFile=0x29d4, lpBuffer=0x3350000, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d67f61c*=0x7fce, lpOverlapped=0x0) returned 1 [0200.065] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xffff8032, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.065] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0x7fce, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d67f848, pbOutput=0x3350000, pcbResult=0x2d67f618) returned 0x0 [0200.065] WriteFile (in: hFile=0x29d4, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d67f61c*=0x7fd0, lpOverlapped=0x0) returned 1 [0200.065] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0200.065] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.065] WriteFile (in: hFile=0x29d4, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.065] SetFilePointerEx (in: hFile=0x29d4, liDistanceToMove=0x7fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.065] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.065] CloseHandle (hObject=0x29d4) returned 1 [0200.065] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.play")) returned 1 [0200.071] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3518 os_tid = 0x3500 [0200.010] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.010] ReadFile (in: hFile=0x28a4, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.011] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.011] ReadFile (in: hFile=0x28a4, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.011] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.013] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.014] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x3c87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0200.014] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x3c87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x3c87f828, pbKeyObject=0x0) returned 0x0 [0200.014] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c87f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0200.014] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.014] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0200.017] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.020] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.020] WriteFile (in: hFile=0x28a4, lpBuffer=0x3c87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c87f830, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesWritten=0x3c87f830*=0x428, lpOverlapped=0x0) returned 1 [0200.020] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.020] ReadFile (in: hFile=0x28a4, lpBuffer=0x3450000, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x3c87f61c*=0x121c, lpOverlapped=0x0) returned 1 [0200.020] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xffffede4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.020] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0x121c, pPaddingInfo=0x0, pbIV=0x3c87f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x3c87f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c87f848, pbOutput=0x3450000, pcbResult=0x3c87f618) returned 0x0 [0200.020] WriteFile (in: hFile=0x28a4, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x3c87f61c*=0x1220, lpOverlapped=0x0) returned 1 [0200.020] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c87f60c | out: lpNewFilePointer=0x0) returned 1 [0200.021] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.021] WriteFile (in: hFile=0x28a4, lpBuffer=0x3c87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c87f83c*, lpNumberOfBytesWritten=0x3c87f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.021] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x1220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.021] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.021] CloseHandle (hObject=0x28a4) returned 1 [0200.021] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.play")) returned 1 [0200.025] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3519 os_tid = 0x3504 [0200.040] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.040] ReadFile (in: hFile=0x29b0, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.116] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.116] ReadFile (in: hFile=0x29b0, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.119] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x3d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0200.119] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x3d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x3d9ff828, pbKeyObject=0x0) returned 0x0 [0200.119] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d9ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0200.119] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.119] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0200.122] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.126] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.126] WriteFile (in: hFile=0x29b0, lpBuffer=0x3d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesWritten=0x3d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0200.126] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.126] ReadFile (in: hFile=0x29b0, lpBuffer=0x3550000, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x3d9ff61c*=0x4048, lpOverlapped=0x0) returned 1 [0200.183] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xffffbfb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.183] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3550000, cbInput=0x4048, pPaddingInfo=0x0, pbIV=0x3d9ff848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x3d9ff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3d9ff848, pbOutput=0x3550000, pcbResult=0x3d9ff618) returned 0x0 [0200.183] WriteFile (in: hFile=0x29b0, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x3d9ff61c*=0x4050, lpOverlapped=0x0) returned 1 [0200.183] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0200.183] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.183] WriteFile (in: hFile=0x29b0, lpBuffer=0x3d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ff83c*, lpNumberOfBytesWritten=0x3d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0200.184] SetFilePointerEx (in: hFile=0x29b0, liDistanceToMove=0x4050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.184] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0200.184] CloseHandle (hObject=0x29b0) returned 1 [0200.184] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.play")) returned 1 [0200.189] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3520 os_tid = 0x3508 [0200.041] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.041] ReadFile (in: hFile=0x29a0, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.096] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.099] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.099] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x3fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0200.099] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x3fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x3fcff828, pbKeyObject=0x0) returned 0x0 [0200.099] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fcff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fcff500) returned 0x0 [0200.100] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.100] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fcff500) returned 0x0 [0200.103] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.106] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.107] WriteFile (in: hFile=0x29a0, lpBuffer=0x3fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fcff830, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesWritten=0x3fcff830*=0x428, lpOverlapped=0x0) returned 1 [0200.107] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.107] ReadFile (in: hFile=0x29a0, lpBuffer=0x3650000, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x3fcff61c*=0x629, lpOverlapped=0x0) returned 1 [0200.107] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffff9d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.107] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x3650000, cbInput=0x629, pPaddingInfo=0x0, pbIV=0x3fcff848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x3fcff618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x3fcff848, pbOutput=0x3650000, pcbResult=0x3fcff618) returned 0x0 [0200.107] WriteFile (in: hFile=0x29a0, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x3fcff61c*=0x630, lpOverlapped=0x0) returned 1 [0200.107] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fcff60c | out: lpNewFilePointer=0x0) returned 1 [0200.107] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.107] WriteFile (in: hFile=0x29a0, lpBuffer=0x3fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3fcff83c*, lpNumberOfBytesWritten=0x3fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0200.107] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.107] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0200.108] CloseHandle (hObject=0x29a0) returned 1 [0200.108] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.play")) returned 1 [0200.112] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3521 os_tid = 0x350c [0200.043] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.043] ReadFile (in: hFile=0x2990, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.064] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.064] ReadFile (in: hFile=0x2990, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.155] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.158] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.158] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x3fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0200.158] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x3fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x3fe3f828, pbKeyObject=0x0) returned 0x0 [0200.158] BCryptExportKey (in: hKey=0x7f2bb0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fe3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fe3f500) returned 0x0 [0200.159] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.159] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fe3f500) returned 0x0 [0200.163] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.167] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.168] WriteFile (in: hFile=0x2990, lpBuffer=0x3fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesWritten=0x3fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0200.168] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.168] ReadFile (in: hFile=0x2990, lpBuffer=0x3750000, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x3fe3f61c*=0x8628, lpOverlapped=0x0) returned 1 [0200.249] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xffff79d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.249] BCryptEncrypt (in: hKey=0x7f2bb0, pbInput=0x3750000, cbInput=0x8628, pPaddingInfo=0x0, pbIV=0x3fe3f848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x3fe3f618, dwFlags=0x1 | out: hKey=0x7f2bb0, pbIV=0x3fe3f848, pbOutput=0x3750000, pcbResult=0x3fe3f618) returned 0x0 [0200.249] WriteFile (in: hFile=0x2990, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x3fe3f61c*=0x8630, lpOverlapped=0x0) returned 1 [0200.249] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0200.250] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.250] WriteFile (in: hFile=0x2990, lpBuffer=0x3fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3f83c*, lpNumberOfBytesWritten=0x3fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.250] SetFilePointerEx (in: hFile=0x2990, liDistanceToMove=0x8630, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.250] BCryptDestroyKey (in: hKey=0x7f2bb0 | out: hKey=0x7f2bb0) returned 0x0 [0200.250] CloseHandle (hObject=0x2990) returned 1 [0200.250] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.play")) returned 1 [0200.255] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3522 os_tid = 0x3510 [0200.044] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.044] ReadFile (in: hFile=0x2980, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.086] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.086] ReadFile (in: hFile=0x2980, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.086] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.089] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.089] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x4053f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0200.089] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x4053f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x4053f828, pbKeyObject=0x0) returned 0x0 [0200.089] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x4053f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x4053f500) returned 0x0 [0200.089] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.089] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x4053f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x4053f500) returned 0x0 [0200.092] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.095] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.095] WriteFile (in: hFile=0x2980, lpBuffer=0x4053fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4053f830, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesWritten=0x4053f830*=0x428, lpOverlapped=0x0) returned 1 [0200.096] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.096] ReadFile (in: hFile=0x2980, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x4053f61c*=0x7e90, lpOverlapped=0x0) returned 1 [0200.205] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xffff8170, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.205] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x3a50000, cbInput=0x7e90, pPaddingInfo=0x0, pbIV=0x4053f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x4053f618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x4053f848, pbOutput=0x3a50000, pcbResult=0x4053f618) returned 0x0 [0200.205] WriteFile (in: hFile=0x2980, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x4053f61c*=0x7ea0, lpOverlapped=0x0) returned 1 [0200.205] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4053f60c | out: lpNewFilePointer=0x0) returned 1 [0200.205] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.205] WriteFile (in: hFile=0x2980, lpBuffer=0x4053f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x4053f83c*, lpNumberOfBytesWritten=0x4053f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.206] SetFilePointerEx (in: hFile=0x2980, liDistanceToMove=0x7ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.206] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0200.206] CloseHandle (hObject=0x2980) returned 1 [0200.206] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.play")) returned 1 [0200.213] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3523 os_tid = 0x3514 [0200.045] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.046] ReadFile (in: hFile=0x2824, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.075] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.075] ReadFile (in: hFile=0x2824, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.075] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.077] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.078] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x4067f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0200.078] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x4067f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x4067f828, pbKeyObject=0x0) returned 0x0 [0200.078] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x4067f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x4067f500) returned 0x0 [0200.078] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.078] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x4067f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x4067f500) returned 0x0 [0200.081] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.084] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.084] WriteFile (in: hFile=0x2824, lpBuffer=0x4067fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4067f830, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesWritten=0x4067f830*=0x428, lpOverlapped=0x0) returned 1 [0200.085] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.085] ReadFile (in: hFile=0x2824, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x4067f61c*=0x211bb, lpOverlapped=0x0) returned 1 [0200.194] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffdee45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.194] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3b50000, cbInput=0x211bb, pPaddingInfo=0x0, pbIV=0x4067f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x4067f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4067f848, pbOutput=0x3b50000, pcbResult=0x4067f618) returned 0x0 [0200.195] WriteFile (in: hFile=0x2824, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x4067f61c*=0x211c0, lpOverlapped=0x0) returned 1 [0200.195] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4067f60c | out: lpNewFilePointer=0x0) returned 1 [0200.195] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.195] WriteFile (in: hFile=0x2824, lpBuffer=0x4067f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x4067f83c*, lpNumberOfBytesWritten=0x4067f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.195] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x211c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.195] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.195] CloseHandle (hObject=0x2824) returned 1 [0200.196] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.play")) returned 1 [0200.200] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3524 os_tid = 0x3518 [0200.047] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.047] ReadFile (in: hFile=0x2844, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0200.142] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.142] ReadFile (in: hFile=0x2844, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0200.142] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.145] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.145] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x407bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0200.145] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x407bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x407bf828, pbKeyObject=0x0) returned 0x0 [0200.145] BCryptExportKey (in: hKey=0x7f2930, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x407bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x407bf500) returned 0x0 [0200.145] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.146] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x407bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x407bf500) returned 0x0 [0200.151] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.154] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.154] WriteFile (in: hFile=0x2844, lpBuffer=0x407bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x407bf830, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesWritten=0x407bf830*=0x428, lpOverlapped=0x0) returned 1 [0200.154] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.155] ReadFile (in: hFile=0x2844, lpBuffer=0x3c50000, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x407bf61c*=0xa202, lpOverlapped=0x0) returned 1 [0200.229] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xffff5dfe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.229] BCryptEncrypt (in: hKey=0x7f2930, pbInput=0x3c50000, cbInput=0xa202, pPaddingInfo=0x0, pbIV=0x407bf848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x407bf618, dwFlags=0x1 | out: hKey=0x7f2930, pbIV=0x407bf848, pbOutput=0x3c50000, pcbResult=0x407bf618) returned 0x0 [0200.229] WriteFile (in: hFile=0x2844, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x407bf61c*=0xa210, lpOverlapped=0x0) returned 1 [0200.229] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407bf60c | out: lpNewFilePointer=0x0) returned 1 [0200.230] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.230] WriteFile (in: hFile=0x2844, lpBuffer=0x407bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x407bf83c*, lpNumberOfBytesWritten=0x407bf61c*=0x8, lpOverlapped=0x0) returned 1 [0200.230] SetFilePointerEx (in: hFile=0x2844, liDistanceToMove=0xa210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.230] BCryptDestroyKey (in: hKey=0x7f2930 | out: hKey=0x7f2930) returned 0x0 [0200.230] CloseHandle (hObject=0x2844) returned 1 [0200.230] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.play")) returned 1 [0200.235] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3525 os_tid = 0x351c [0200.048] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.048] ReadFile (in: hFile=0x2864, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.128] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.128] ReadFile (in: hFile=0x2864, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.128] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.131] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.132] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x408ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0200.132] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x408ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x408ff828, pbKeyObject=0x0) returned 0x0 [0200.132] BCryptExportKey (in: hKey=0x7f26a0, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x408ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x408ff500) returned 0x0 [0200.132] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.132] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x408ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x408ff500) returned 0x0 [0200.137] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.141] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.141] WriteFile (in: hFile=0x2864, lpBuffer=0x408ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x408ff830, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesWritten=0x408ff830*=0x428, lpOverlapped=0x0) returned 1 [0200.141] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.141] ReadFile (in: hFile=0x2864, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x408ff61c*=0x18be, lpOverlapped=0x0) returned 1 [0200.218] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xffffe742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.218] BCryptEncrypt (in: hKey=0x7f26a0, pbInput=0x3d50000, cbInput=0x18be, pPaddingInfo=0x0, pbIV=0x408ff848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x408ff618, dwFlags=0x1 | out: hKey=0x7f26a0, pbIV=0x408ff848, pbOutput=0x3d50000, pcbResult=0x408ff618) returned 0x0 [0200.218] WriteFile (in: hFile=0x2864, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x408ff61c*=0x18c0, lpOverlapped=0x0) returned 1 [0200.218] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x408ff60c | out: lpNewFilePointer=0x0) returned 1 [0200.218] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.218] WriteFile (in: hFile=0x2864, lpBuffer=0x408ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x408ff83c*, lpNumberOfBytesWritten=0x408ff61c*=0x8, lpOverlapped=0x0) returned 1 [0200.218] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x18c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.218] BCryptDestroyKey (in: hKey=0x7f26a0 | out: hKey=0x7f26a0) returned 0x0 [0200.218] CloseHandle (hObject=0x2864) returned 1 [0200.218] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.play")) returned 1 [0200.223] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3526 os_tid = 0x3520 [0200.050] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.050] ReadFile (in: hFile=0x2b5c, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.168] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.168] ReadFile (in: hFile=0x2b5c, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.168] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.172] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.172] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x40a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0200.172] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x40a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x40a3f828, pbKeyObject=0x0) returned 0x0 [0200.172] BCryptExportKey (in: hKey=0x7f2e40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x40a3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x40a3f500) returned 0x0 [0200.172] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.172] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x40a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x40a3f500) returned 0x0 [0200.178] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.181] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.181] WriteFile (in: hFile=0x2b5c, lpBuffer=0x40a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40a3f830, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesWritten=0x40a3f830*=0x428, lpOverlapped=0x0) returned 1 [0200.182] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.182] ReadFile (in: hFile=0x2b5c, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x40a3f61c*=0x1c94, lpOverlapped=0x0) returned 1 [0200.239] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xffffe36c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.239] BCryptEncrypt (in: hKey=0x7f2e40, pbInput=0x3e50000, cbInput=0x1c94, pPaddingInfo=0x0, pbIV=0x40a3f848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x40a3f618, dwFlags=0x1 | out: hKey=0x7f2e40, pbIV=0x40a3f848, pbOutput=0x3e50000, pcbResult=0x40a3f618) returned 0x0 [0200.239] WriteFile (in: hFile=0x2b5c, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x40a3f61c*=0x1ca0, lpOverlapped=0x0) returned 1 [0200.239] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40a3f60c | out: lpNewFilePointer=0x0) returned 1 [0200.240] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.240] WriteFile (in: hFile=0x2b5c, lpBuffer=0x40a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x40a3f83c*, lpNumberOfBytesWritten=0x40a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.240] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x1ca0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.240] BCryptDestroyKey (in: hKey=0x7f2e40 | out: hKey=0x7f2e40) returned 0x0 [0200.240] CloseHandle (hObject=0x2b5c) returned 1 [0200.240] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.243] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.play")) returned 1 [0200.245] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3527 os_tid = 0x3524 [0200.051] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.051] ReadFile (in: hFile=0x2b64, lpBuffer=0x40b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesRead=0x40b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.354] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.354] ReadFile (in: hFile=0x2b64, lpBuffer=0x40b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesRead=0x40b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.354] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.358] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.358] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x40b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0200.358] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x40b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x40b7f828, pbKeyObject=0x0) returned 0x0 [0200.358] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x40b7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x40b7f500) returned 0x0 [0200.358] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.359] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x40b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x40b7f500) returned 0x0 [0200.363] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.367] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.367] WriteFile (in: hFile=0x2b64, lpBuffer=0x40b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40b7f830, lpOverlapped=0x0 | out: lpBuffer=0x40b7fb34*, lpNumberOfBytesWritten=0x40b7f830*=0x428, lpOverlapped=0x0) returned 1 [0200.368] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.368] ReadFile (in: hFile=0x2b64, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x40b7f61c*=0x7db8, lpOverlapped=0x0) returned 1 [0200.592] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.592] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x40b7f848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x40b7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40b7f848, pbOutput=0x3f50000, pcbResult=0x40b7f618) returned 0x0 [0200.592] WriteFile (in: hFile=0x2b64, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x40b7f61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0200.592] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40b7f60c | out: lpNewFilePointer=0x0) returned 1 [0200.592] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.593] WriteFile (in: hFile=0x2b64, lpBuffer=0x40b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x40b7f83c*, lpNumberOfBytesWritten=0x40b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.593] SetFilePointerEx (in: hFile=0x2b64, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.593] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.593] CloseHandle (hObject=0x2b64) returned 1 [0200.593] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.play")) returned 1 [0200.607] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3528 os_tid = 0x3528 [0200.287] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.287] ReadFile (in: hFile=0x2b6c, lpBuffer=0x40cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesRead=0x40cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0200.368] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.368] ReadFile (in: hFile=0x2b6c, lpBuffer=0x40cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesRead=0x40cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0200.368] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.371] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.371] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x40cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0200.371] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x40cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x40cbf828, pbKeyObject=0x0) returned 0x0 [0200.372] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x40cbf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x40cbf500) returned 0x0 [0200.372] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.372] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x40cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x40cbf500) returned 0x0 [0200.414] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.418] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.418] WriteFile (in: hFile=0x2b6c, lpBuffer=0x40cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40cbf830, lpOverlapped=0x0 | out: lpBuffer=0x40cbfb34*, lpNumberOfBytesWritten=0x40cbf830*=0x428, lpOverlapped=0x0) returned 1 [0200.418] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.418] ReadFile (in: hFile=0x2b6c, lpBuffer=0x4050000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x40cbf61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0200.596] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.596] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x4050000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x40cbf848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x40cbf618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x40cbf848, pbOutput=0x4050000, pcbResult=0x40cbf618) returned 0x0 [0200.597] WriteFile (in: hFile=0x2b6c, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x40cbf61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0200.597] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40cbf60c | out: lpNewFilePointer=0x0) returned 1 [0200.597] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.597] WriteFile (in: hFile=0x2b6c, lpBuffer=0x40cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x40cbf83c*, lpNumberOfBytesWritten=0x40cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0200.597] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.597] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0200.597] CloseHandle (hObject=0x2b6c) returned 1 [0200.598] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0200.601] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.play")) returned 1 [0200.614] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3529 os_tid = 0x352c [0200.288] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.288] ReadFile (in: hFile=0x2b74, lpBuffer=0x40dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40dff85c, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesRead=0x40dff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.290] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.290] ReadFile (in: hFile=0x2b74, lpBuffer=0x40dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40dff85c, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesRead=0x40dff85c*=0x428, lpOverlapped=0x0) returned 1 [0200.291] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.294] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.295] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x40dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0200.295] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x40dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x40dff828, pbKeyObject=0x0) returned 0x0 [0200.295] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x40dff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x40dff500) returned 0x0 [0200.295] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.295] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x40dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x40dff500) returned 0x0 [0200.300] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.304] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.304] WriteFile (in: hFile=0x2b74, lpBuffer=0x40dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40dff830, lpOverlapped=0x0 | out: lpBuffer=0x40dffb34*, lpNumberOfBytesWritten=0x40dff830*=0x428, lpOverlapped=0x0) returned 1 [0200.304] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.304] ReadFile (in: hFile=0x2b74, lpBuffer=0x4150000, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x40dff61c*=0x1764, lpOverlapped=0x0) returned 1 [0200.304] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xffffe89c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.305] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4150000, cbInput=0x1764, pPaddingInfo=0x0, pbIV=0x40dff848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x40dff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40dff848, pbOutput=0x4150000, pcbResult=0x40dff618) returned 0x0 [0200.305] WriteFile (in: hFile=0x2b74, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x40dff61c*=0x1770, lpOverlapped=0x0) returned 1 [0200.305] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40dff60c | out: lpNewFilePointer=0x0) returned 1 [0200.305] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.305] WriteFile (in: hFile=0x2b74, lpBuffer=0x40dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40dff61c, lpOverlapped=0x0 | out: lpBuffer=0x40dff83c*, lpNumberOfBytesWritten=0x40dff61c*=0x8, lpOverlapped=0x0) returned 1 [0200.305] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.305] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.305] CloseHandle (hObject=0x2b74) returned 1 [0200.305] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.play")) returned 1 [0200.310] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3530 os_tid = 0x3534 [0200.684] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.684] ReadFile (in: hFile=0x2b74, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.774] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.774] ReadFile (in: hFile=0x2b74, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.774] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.776] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.776] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1528f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0200.776] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0) returned 0x0 [0200.776] BCryptExportKey (in: hKey=0x7f2420, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1528f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1528f500) returned 0x0 [0200.777] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.777] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1528f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1528f500) returned 0x0 [0200.780] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.783] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.783] WriteFile (in: hFile=0x2b74, lpBuffer=0x1528fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1528f830, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesWritten=0x1528f830*=0x428, lpOverlapped=0x0) returned 1 [0200.783] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.783] ReadFile (in: hFile=0x2b74, lpBuffer=0x2750000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1528f61c*=0x7c08, lpOverlapped=0x0) returned 1 [0200.884] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.884] BCryptEncrypt (in: hKey=0x7f2420, pbInput=0x2750000, cbInput=0x7c08, pPaddingInfo=0x0, pbIV=0x1528f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1528f618, dwFlags=0x1 | out: hKey=0x7f2420, pbIV=0x1528f848, pbOutput=0x2750000, pcbResult=0x1528f618) returned 0x0 [0200.884] WriteFile (in: hFile=0x2b74, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1528f61c*=0x7c10, lpOverlapped=0x0) returned 1 [0200.884] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1528f60c | out: lpNewFilePointer=0x0) returned 1 [0200.884] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.884] WriteFile (in: hFile=0x2b74, lpBuffer=0x1528f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x1528f83c*, lpNumberOfBytesWritten=0x1528f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.884] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x7c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.884] BCryptDestroyKey (in: hKey=0x7f2420 | out: hKey=0x7f2420) returned 0x0 [0200.884] CloseHandle (hObject=0x2b74) returned 1 [0200.885] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.play")) returned 1 [0200.890] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3531 os_tid = 0x3538 [0200.685] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.686] ReadFile (in: hFile=0x2b5c, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.687] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.687] ReadFile (in: hFile=0x2b5c, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.687] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.690] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.690] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0200.690] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0200.690] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1590f500) returned 0x0 [0200.690] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.690] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1590f500) returned 0x0 [0200.694] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.698] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.698] WriteFile (in: hFile=0x2b5c, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0200.699] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.699] ReadFile (in: hFile=0x2b5c, lpBuffer=0x2850000, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1590f61c*=0x1e55, lpOverlapped=0x0) returned 1 [0200.699] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xffffe1ab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.700] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x1e55, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2850000, pcbResult=0x1590f618) returned 0x0 [0200.700] WriteFile (in: hFile=0x2b5c, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1590f61c*=0x1e60, lpOverlapped=0x0) returned 1 [0200.700] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0200.700] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.700] WriteFile (in: hFile=0x2b5c, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.700] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x1e60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.700] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.700] CloseHandle (hObject=0x2b5c) returned 1 [0200.700] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.play")) returned 1 [0200.705] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3532 os_tid = 0x353c [0200.709] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.709] ReadFile (in: hFile=0x2864, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.710] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.710] ReadFile (in: hFile=0x2864, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.710] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.713] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.713] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x15a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0200.713] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x15a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x15a0f828, pbKeyObject=0x0) returned 0x0 [0200.713] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15a0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15a0f500) returned 0x0 [0200.713] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.713] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15a0f500) returned 0x0 [0200.717] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.719] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.719] WriteFile (in: hFile=0x2864, lpBuffer=0x15a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a0f830, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesWritten=0x15a0f830*=0x428, lpOverlapped=0x0) returned 1 [0200.720] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.720] ReadFile (in: hFile=0x2864, lpBuffer=0x2950000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x15a0f61c*=0x7c08, lpOverlapped=0x0) returned 1 [0200.721] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.721] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x7c08, pPaddingInfo=0x0, pbIV=0x15a0f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x15a0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a0f848, pbOutput=0x2950000, pcbResult=0x15a0f618) returned 0x0 [0200.721] WriteFile (in: hFile=0x2864, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x15a0f61c*=0x7c10, lpOverlapped=0x0) returned 1 [0200.721] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a0f60c | out: lpNewFilePointer=0x0) returned 1 [0200.721] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.721] WriteFile (in: hFile=0x2864, lpBuffer=0x15a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a0f83c*, lpNumberOfBytesWritten=0x15a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.721] SetFilePointerEx (in: hFile=0x2864, liDistanceToMove=0x7c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.721] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.721] CloseHandle (hObject=0x2864) returned 1 [0200.721] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.724] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.play")) returned 1 [0200.726] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3533 os_tid = 0x3540 [0200.730] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.730] ReadFile (in: hFile=0x2824, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.762] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.762] ReadFile (in: hFile=0x2824, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.762] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.765] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.766] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x15b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0200.766] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x15b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x15b4f828, pbKeyObject=0x0) returned 0x0 [0200.766] BCryptExportKey (in: hKey=0x7f2190, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15b4f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15b4f500) returned 0x0 [0200.766] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.766] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15b4f500) returned 0x0 [0200.769] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.773] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.773] WriteFile (in: hFile=0x2824, lpBuffer=0x15b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b4f830, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesWritten=0x15b4f830*=0x428, lpOverlapped=0x0) returned 1 [0200.773] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.773] ReadFile (in: hFile=0x2824, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x15b4f61c*=0x7db8, lpOverlapped=0x0) returned 1 [0200.897] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.897] BCryptEncrypt (in: hKey=0x7f2190, pbInput=0x2a50000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x15b4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x15b4f618, dwFlags=0x1 | out: hKey=0x7f2190, pbIV=0x15b4f848, pbOutput=0x2a50000, pcbResult=0x15b4f618) returned 0x0 [0200.897] WriteFile (in: hFile=0x2824, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x15b4f61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0200.897] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b4f60c | out: lpNewFilePointer=0x0) returned 1 [0200.897] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.897] WriteFile (in: hFile=0x2824, lpBuffer=0x15b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b4f83c*, lpNumberOfBytesWritten=0x15b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.897] SetFilePointerEx (in: hFile=0x2824, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.897] BCryptDestroyKey (in: hKey=0x7f2190 | out: hKey=0x7f2190) returned 0x0 [0200.897] CloseHandle (hObject=0x2824) returned 1 [0200.897] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.play")) returned 1 [0200.903] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3534 os_tid = 0x3544 [0200.732] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.732] ReadFile (in: hFile=0x29a0, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.733] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.733] ReadFile (in: hFile=0x29a0, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.733] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.736] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.736] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15c8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0200.736] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15c8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15c8f828, pbKeyObject=0x0) returned 0x0 [0200.736] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15c8f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15c8f500) returned 0x0 [0200.736] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.736] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15c8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15c8f500) returned 0x0 [0200.740] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.742] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.742] WriteFile (in: hFile=0x29a0, lpBuffer=0x15c8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15c8f830, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesWritten=0x15c8f830*=0x428, lpOverlapped=0x0) returned 1 [0200.744] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.744] ReadFile (in: hFile=0x29a0, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15c8f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.785] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x15c8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15c8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15c8f848, pbOutput=0x2b50000, pcbResult=0x15c8f618) returned 0x0 [0200.785] WriteFile (in: hFile=0x29a0, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15c8f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15c8f60c | out: lpNewFilePointer=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.785] WriteFile (in: hFile=0x29a0, lpBuffer=0x15c8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15c8f83c*, lpNumberOfBytesWritten=0x15c8f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.785] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.785] CloseHandle (hObject=0x29a0) returned 1 [0200.785] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.play")) returned 1 [0200.790] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3535 os_tid = 0x3548 [0200.797] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.797] ReadFile (in: hFile=0x28a4, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0200.799] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.799] ReadFile (in: hFile=0x28a4, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0200.799] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.801] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.802] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x15dcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0200.802] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x15dcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x15dcf828, pbKeyObject=0x0) returned 0x0 [0200.802] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15dcf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15dcf500) returned 0x0 [0200.802] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.802] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15dcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15dcf500) returned 0x0 [0200.806] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.809] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.809] WriteFile (in: hFile=0x28a4, lpBuffer=0x15dcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15dcf830, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesWritten=0x15dcf830*=0x428, lpOverlapped=0x0) returned 1 [0200.809] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.809] ReadFile (in: hFile=0x28a4, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x15dcf61c*=0x7db8, lpOverlapped=0x0) returned 1 [0200.810] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.810] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2c50000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x15dcf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x15dcf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15dcf848, pbOutput=0x2c50000, pcbResult=0x15dcf618) returned 0x0 [0200.810] WriteFile (in: hFile=0x28a4, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x15dcf61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0200.810] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15dcf60c | out: lpNewFilePointer=0x0) returned 1 [0200.810] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.810] WriteFile (in: hFile=0x28a4, lpBuffer=0x15dcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15dcf83c*, lpNumberOfBytesWritten=0x15dcf61c*=0x8, lpOverlapped=0x0) returned 1 [0200.811] SetFilePointerEx (in: hFile=0x28a4, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.811] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.811] CloseHandle (hObject=0x28a4) returned 1 [0200.811] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.814] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.play")) returned 1 [0200.815] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3536 os_tid = 0x354c [0200.820] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.820] ReadFile (in: hFile=0x29f4, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.822] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.822] ReadFile (in: hFile=0x29f4, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.822] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.825] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.825] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x15f0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0200.825] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x15f0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x15f0f828, pbKeyObject=0x0) returned 0x0 [0200.825] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x15f0f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x15f0f500) returned 0x0 [0200.825] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.825] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x15f0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x15f0f500) returned 0x0 [0200.877] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.882] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.882] WriteFile (in: hFile=0x29f4, lpBuffer=0x15f0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15f0f830, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesWritten=0x15f0f830*=0x428, lpOverlapped=0x0) returned 1 [0200.883] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.883] ReadFile (in: hFile=0x29f4, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x15f0f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0200.907] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.907] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x15f0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x15f0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15f0f848, pbOutput=0x2d50000, pcbResult=0x15f0f618) returned 0x0 [0200.907] WriteFile (in: hFile=0x29f4, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x15f0f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0200.908] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15f0f60c | out: lpNewFilePointer=0x0) returned 1 [0200.908] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.908] WriteFile (in: hFile=0x29f4, lpBuffer=0x15f0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15f0f83c*, lpNumberOfBytesWritten=0x15f0f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.908] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.908] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.908] CloseHandle (hObject=0x29f4) returned 1 [0200.908] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.play")) returned 1 [0200.913] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3537 os_tid = 0x3550 [0200.927] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.928] ReadFile (in: hFile=0x2a24, lpBuffer=0x1620fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1620f85c, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesRead=0x1620f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.930] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.930] ReadFile (in: hFile=0x2a24, lpBuffer=0x1620fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1620f85c, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesRead=0x1620f85c*=0x428, lpOverlapped=0x0) returned 1 [0200.930] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0200.934] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0200.935] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1620f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0200.935] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1620f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1620f828, pbKeyObject=0x0) returned 0x0 [0200.935] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1620f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1620f500) returned 0x0 [0200.935] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0200.935] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1620f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1620f500) returned 0x0 [0200.940] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.945] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.945] WriteFile (in: hFile=0x2a24, lpBuffer=0x1620fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1620f830, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesWritten=0x1620f830*=0x428, lpOverlapped=0x0) returned 1 [0200.946] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.946] ReadFile (in: hFile=0x2a24, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1620f61c*=0x9abe, lpOverlapped=0x0) returned 1 [0200.947] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xffff6542, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.947] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0x9abe, pPaddingInfo=0x0, pbIV=0x1620f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1620f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1620f848, pbOutput=0x2e50000, pcbResult=0x1620f618) returned 0x0 [0200.947] WriteFile (in: hFile=0x2a24, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1620f61c*=0x9ac0, lpOverlapped=0x0) returned 1 [0200.947] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1620f60c | out: lpNewFilePointer=0x0) returned 1 [0200.947] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.947] WriteFile (in: hFile=0x2a24, lpBuffer=0x1620f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x1620f83c*, lpNumberOfBytesWritten=0x1620f61c*=0x8, lpOverlapped=0x0) returned 1 [0200.948] SetFilePointerEx (in: hFile=0x2a24, liDistanceToMove=0x9ac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.948] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0200.948] CloseHandle (hObject=0x2a24) returned 1 [0200.948] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0200.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.play")) returned 1 [0200.953] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3538 os_tid = 0x3554 [0201.007] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.007] ReadFile (in: hFile=0x734, lpBuffer=0x1630fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1630f85c, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesRead=0x1630f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.008] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.009] ReadFile (in: hFile=0x734, lpBuffer=0x1630fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1630f85c, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesRead=0x1630f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.009] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.013] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.013] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x1630f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0201.014] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x1630f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x1630f828, pbKeyObject=0x0) returned 0x0 [0201.014] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x1630f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x1630f500) returned 0x0 [0201.014] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.014] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x1630f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x1630f500) returned 0x0 [0201.019] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.024] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.024] WriteFile (in: hFile=0x734, lpBuffer=0x1630fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1630f830, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesWritten=0x1630f830*=0x428, lpOverlapped=0x0) returned 1 [0201.024] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.024] ReadFile (in: hFile=0x734, lpBuffer=0x3050000, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x1630f61c*=0x451e, lpOverlapped=0x0) returned 1 [0201.025] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xffffbae2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.025] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x451e, pPaddingInfo=0x0, pbIV=0x1630f848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x1630f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1630f848, pbOutput=0x3050000, pcbResult=0x1630f618) returned 0x0 [0201.025] WriteFile (in: hFile=0x734, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x1630f61c*=0x4520, lpOverlapped=0x0) returned 1 [0201.025] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1630f60c | out: lpNewFilePointer=0x0) returned 1 [0201.025] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.025] WriteFile (in: hFile=0x734, lpBuffer=0x1630f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x1630f83c*, lpNumberOfBytesWritten=0x1630f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.025] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x4520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.025] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.025] CloseHandle (hObject=0x734) returned 1 [0201.026] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.play")) returned 1 [0201.031] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3539 os_tid = 0x3558 [0201.037] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.037] ReadFile (in: hFile=0x2a50, lpBuffer=0x165cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x165cf85c, lpOverlapped=0x0 | out: lpBuffer=0x165cfb34*, lpNumberOfBytesRead=0x165cf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.039] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.039] ReadFile (in: hFile=0x2a50, lpBuffer=0x165cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x165cf85c, lpOverlapped=0x0 | out: lpBuffer=0x165cfb34*, lpNumberOfBytesRead=0x165cf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.039] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.043] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.043] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x165cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0201.043] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x165cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x165cf828, pbKeyObject=0x0) returned 0x0 [0201.043] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x165cf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x165cf500) returned 0x0 [0201.043] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.043] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x165cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x165cf500) returned 0x0 [0201.048] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.052] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.052] WriteFile (in: hFile=0x2a50, lpBuffer=0x165cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x165cf830, lpOverlapped=0x0 | out: lpBuffer=0x165cfb34*, lpNumberOfBytesWritten=0x165cf830*=0x428, lpOverlapped=0x0) returned 1 [0201.053] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.053] ReadFile (in: hFile=0x2a50, lpBuffer=0x3150000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x165cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x165cf61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.053] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.054] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x165cf848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x165cf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x165cf848, pbOutput=0x3150000, pcbResult=0x165cf618) returned 0x0 [0201.054] WriteFile (in: hFile=0x2a50, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x165cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x165cf61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.054] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x165cf60c | out: lpNewFilePointer=0x0) returned 1 [0201.054] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.054] WriteFile (in: hFile=0x2a50, lpBuffer=0x165cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x165cf61c, lpOverlapped=0x0 | out: lpBuffer=0x165cf83c*, lpNumberOfBytesWritten=0x165cf61c*=0x8, lpOverlapped=0x0) returned 1 [0201.054] SetFilePointerEx (in: hFile=0x2a50, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.054] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.054] CloseHandle (hObject=0x2a50) returned 1 [0201.054] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.play")) returned 1 [0201.063] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3540 os_tid = 0x355c [0201.070] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.070] ReadFile (in: hFile=0x2a70, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.071] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.071] ReadFile (in: hFile=0x2a70, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.072] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.075] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.075] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0201.075] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0201.075] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0201.075] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.075] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d37f500) returned 0x0 [0201.081] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.085] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.085] WriteFile (in: hFile=0x2a70, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0201.086] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.086] ReadFile (in: hFile=0x2a70, lpBuffer=0x3250000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d37f61c*=0x7db8, lpOverlapped=0x0) returned 1 [0201.087] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.087] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x3250000, pcbResult=0x2d37f618) returned 0x0 [0201.087] WriteFile (in: hFile=0x2a70, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d37f61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0201.087] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0201.087] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.088] WriteFile (in: hFile=0x2a70, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.088] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.088] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.088] CloseHandle (hObject=0x2a70) returned 1 [0201.088] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.play")) returned 1 [0201.093] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3541 os_tid = 0x3560 [0201.098] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.098] ReadFile (in: hFile=0x2a98, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.100] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.100] ReadFile (in: hFile=0x2a98, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.101] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.104] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.104] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0201.104] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0201.104] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0201.105] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.105] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d57f500) returned 0x0 [0201.110] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.113] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.113] WriteFile (in: hFile=0x2a98, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0201.113] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.113] ReadFile (in: hFile=0x2a98, lpBuffer=0x3350000, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d57f61c*=0x6afc, lpOverlapped=0x0) returned 1 [0201.116] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xffff9504, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.116] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0x6afc, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x3350000, pcbResult=0x2d57f618) returned 0x0 [0201.116] WriteFile (in: hFile=0x2a98, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d57f61c*=0x6b00, lpOverlapped=0x0) returned 1 [0201.116] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0201.116] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.117] WriteFile (in: hFile=0x2a98, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.117] SetFilePointerEx (in: hFile=0x2a98, liDistanceToMove=0x6b00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.117] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.117] CloseHandle (hObject=0x2a98) returned 1 [0201.117] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.play")) returned 1 [0201.125] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3542 os_tid = 0x3564 [0201.129] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.129] ReadFile (in: hFile=0x2b6c, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.131] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.131] ReadFile (in: hFile=0x2b6c, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.131] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.134] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.134] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0201.134] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0201.135] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x2d67f500) returned 0x0 [0201.135] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.135] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x2d67f500) returned 0x0 [0201.140] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.143] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.143] WriteFile (in: hFile=0x2b6c, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0201.144] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.144] ReadFile (in: hFile=0x2b6c, lpBuffer=0x3450000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2d67f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.145] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.145] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d67f848, pbOutput=0x3450000, pcbResult=0x2d67f618) returned 0x0 [0201.145] WriteFile (in: hFile=0x2b6c, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2d67f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.146] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0201.146] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.146] WriteFile (in: hFile=0x2b6c, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.146] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.146] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.146] CloseHandle (hObject=0x2b6c) returned 1 [0201.146] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.play")) returned 1 [0201.151] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3543 os_tid = 0x3568 [0201.156] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.157] ReadFile (in: hFile=0x2974, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.158] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.158] ReadFile (in: hFile=0x2974, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.158] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.162] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.163] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x3c87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0201.163] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x3c87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x3c87f828, pbKeyObject=0x0) returned 0x0 [0201.163] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3c87f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0201.163] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.163] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3c87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3c87f500) returned 0x0 [0201.168] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.172] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.173] WriteFile (in: hFile=0x2974, lpBuffer=0x3c87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c87f830, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesWritten=0x3c87f830*=0x428, lpOverlapped=0x0) returned 1 [0201.173] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.173] ReadFile (in: hFile=0x2974, lpBuffer=0x3550000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x3c87f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.174] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.174] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3550000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x3c87f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x3c87f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c87f848, pbOutput=0x3550000, pcbResult=0x3c87f618) returned 0x0 [0201.174] WriteFile (in: hFile=0x2974, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x3c87f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.175] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c87f60c | out: lpNewFilePointer=0x0) returned 1 [0201.175] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.175] WriteFile (in: hFile=0x2974, lpBuffer=0x3c87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c87f83c*, lpNumberOfBytesWritten=0x3c87f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.175] SetFilePointerEx (in: hFile=0x2974, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.175] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.175] CloseHandle (hObject=0x2974) returned 1 [0201.175] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.play")) returned 1 [0201.181] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3544 os_tid = 0x356c [0201.191] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.191] ReadFile (in: hFile=0x2814, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.194] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.194] ReadFile (in: hFile=0x2814, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.194] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.198] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.198] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x3d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0201.198] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x3d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x3d9ff828, pbKeyObject=0x0) returned 0x0 [0201.198] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3d9ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0201.199] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.199] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3d9ff500) returned 0x0 [0201.203] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.207] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.207] WriteFile (in: hFile=0x2814, lpBuffer=0x3d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesWritten=0x3d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0201.207] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.207] ReadFile (in: hFile=0x2814, lpBuffer=0x3650000, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x3d9ff61c*=0x7297, lpOverlapped=0x0) returned 1 [0201.208] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xffff8d69, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.208] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3650000, cbInput=0x7297, pPaddingInfo=0x0, pbIV=0x3d9ff848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x3d9ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d9ff848, pbOutput=0x3650000, pcbResult=0x3d9ff618) returned 0x0 [0201.208] WriteFile (in: hFile=0x2814, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x3d9ff61c*=0x72a0, lpOverlapped=0x0) returned 1 [0201.208] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0201.209] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.209] WriteFile (in: hFile=0x2814, lpBuffer=0x3d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ff83c*, lpNumberOfBytesWritten=0x3d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0201.209] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x72a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.209] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.209] CloseHandle (hObject=0x2814) returned 1 [0201.209] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.play")) returned 1 [0201.214] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3545 os_tid = 0x3570 [0201.193] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.193] ReadFile (in: hFile=0x280c, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.220] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.220] ReadFile (in: hFile=0x280c, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.220] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.223] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x3fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0201.223] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x3fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x3fcff828, pbKeyObject=0x0) returned 0x0 [0201.223] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fcff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fcff500) returned 0x0 [0201.223] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.223] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fcff500) returned 0x0 [0201.227] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.230] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.231] WriteFile (in: hFile=0x280c, lpBuffer=0x3fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fcff830, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesWritten=0x3fcff830*=0x428, lpOverlapped=0x0) returned 1 [0201.231] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.231] ReadFile (in: hFile=0x280c, lpBuffer=0x3750000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x3fcff61c*=0x7db8, lpOverlapped=0x0) returned 1 [0201.232] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.232] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3750000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x3fcff848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x3fcff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fcff848, pbOutput=0x3750000, pcbResult=0x3fcff618) returned 0x0 [0201.232] WriteFile (in: hFile=0x280c, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x3fcff61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0201.233] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fcff60c | out: lpNewFilePointer=0x0) returned 1 [0201.233] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.233] WriteFile (in: hFile=0x280c, lpBuffer=0x3fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3fcff83c*, lpNumberOfBytesWritten=0x3fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0201.233] SetFilePointerEx (in: hFile=0x280c, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.233] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.233] CloseHandle (hObject=0x280c) returned 1 [0201.233] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.play")) returned 1 [0201.237] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3546 os_tid = 0x3574 [0201.288] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.288] ReadFile (in: hFile=0x2804, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.289] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.289] ReadFile (in: hFile=0x2804, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.289] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.293] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.293] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x3fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0201.293] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x3fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x3fe3f828, pbKeyObject=0x0) returned 0x0 [0201.293] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3fe3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3fe3f500) returned 0x0 [0201.293] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.293] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3fe3f500) returned 0x0 [0201.296] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.300] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.300] WriteFile (in: hFile=0x2804, lpBuffer=0x3fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesWritten=0x3fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0201.300] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.300] ReadFile (in: hFile=0x2804, lpBuffer=0x3850000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x3fe3f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.301] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.301] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3850000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x3fe3f848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x3fe3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fe3f848, pbOutput=0x3850000, pcbResult=0x3fe3f618) returned 0x0 [0201.301] WriteFile (in: hFile=0x2804, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x3fe3f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.301] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0201.301] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.301] WriteFile (in: hFile=0x2804, lpBuffer=0x3fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3f83c*, lpNumberOfBytesWritten=0x3fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.301] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.301] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.301] CloseHandle (hObject=0x2804) returned 1 [0201.302] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.play")) returned 1 [0201.307] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3547 os_tid = 0x3578 [0201.311] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.312] ReadFile (in: hFile=0x774, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.314] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.314] ReadFile (in: hFile=0x774, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.314] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.317] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.317] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x3ff7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0201.317] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x3ff7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x3ff7f828, pbKeyObject=0x0) returned 0x0 [0201.317] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x3ff7f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x3ff7f500) returned 0x0 [0201.319] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.319] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x3ff7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x3ff7f500) returned 0x0 [0201.323] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.326] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.326] WriteFile (in: hFile=0x774, lpBuffer=0x3ff7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ff7f830, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesWritten=0x3ff7f830*=0x428, lpOverlapped=0x0) returned 1 [0201.326] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.326] ReadFile (in: hFile=0x774, lpBuffer=0x3950000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x3ff7f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.328] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.328] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3950000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x3ff7f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x3ff7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ff7f848, pbOutput=0x3950000, pcbResult=0x3ff7f618) returned 0x0 [0201.328] WriteFile (in: hFile=0x774, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x3ff7f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.328] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ff7f60c | out: lpNewFilePointer=0x0) returned 1 [0201.329] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.329] WriteFile (in: hFile=0x774, lpBuffer=0x3ff7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7f83c*, lpNumberOfBytesWritten=0x3ff7f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.329] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.329] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.329] CloseHandle (hObject=0x774) returned 1 [0201.329] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.play")) returned 1 [0201.334] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3548 os_tid = 0x357c [0201.338] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.338] ReadFile (in: hFile=0x24c4, lpBuffer=0x402ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x402ff85c, lpOverlapped=0x0 | out: lpBuffer=0x402ffb34*, lpNumberOfBytesRead=0x402ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.339] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.340] ReadFile (in: hFile=0x24c4, lpBuffer=0x402ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x402ff85c, lpOverlapped=0x0 | out: lpBuffer=0x402ffb34*, lpNumberOfBytesRead=0x402ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.340] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.342] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.342] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x402ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0201.342] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x402ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x402ff828, pbKeyObject=0x0) returned 0x0 [0201.343] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x402ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x402ff500) returned 0x0 [0201.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.343] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x402ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x402ff500) returned 0x0 [0201.346] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.349] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.349] WriteFile (in: hFile=0x24c4, lpBuffer=0x402ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x402ff830, lpOverlapped=0x0 | out: lpBuffer=0x402ffb34*, lpNumberOfBytesWritten=0x402ff830*=0x428, lpOverlapped=0x0) returned 1 [0201.351] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.351] ReadFile (in: hFile=0x24c4, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x402ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x402ff61c*=0x7db8, lpOverlapped=0x0) returned 1 [0201.351] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.352] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3a50000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x402ff848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x402ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x402ff848, pbOutput=0x3a50000, pcbResult=0x402ff618) returned 0x0 [0201.352] WriteFile (in: hFile=0x24c4, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x402ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x402ff61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0201.352] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x402ff60c | out: lpNewFilePointer=0x0) returned 1 [0201.352] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.352] WriteFile (in: hFile=0x24c4, lpBuffer=0x402ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x402ff61c, lpOverlapped=0x0 | out: lpBuffer=0x402ff83c*, lpNumberOfBytesWritten=0x402ff61c*=0x8, lpOverlapped=0x0) returned 1 [0201.352] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.352] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.352] CloseHandle (hObject=0x24c4) returned 1 [0201.352] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.play")) returned 1 [0201.357] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3549 os_tid = 0x3580 [0201.363] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.363] ReadFile (in: hFile=0x2560, lpBuffer=0x403ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x403ff85c, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesRead=0x403ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.366] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.366] ReadFile (in: hFile=0x2560, lpBuffer=0x403ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x403ff85c, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesRead=0x403ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.366] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.369] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.369] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x403ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0201.369] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x403ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x403ff828, pbKeyObject=0x0) returned 0x0 [0201.369] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x403ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x403ff500) returned 0x0 [0201.369] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.370] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x403ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x403ff500) returned 0x0 [0201.375] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.378] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.378] WriteFile (in: hFile=0x2560, lpBuffer=0x403ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x403ff830, lpOverlapped=0x0 | out: lpBuffer=0x403ffb34*, lpNumberOfBytesWritten=0x403ff830*=0x428, lpOverlapped=0x0) returned 1 [0201.379] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.379] ReadFile (in: hFile=0x2560, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x403ff61c*=0x7db8, lpOverlapped=0x0) returned 1 [0201.380] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.380] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3b50000, cbInput=0x7db8, pPaddingInfo=0x0, pbIV=0x403ff848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x403ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x403ff848, pbOutput=0x3b50000, pcbResult=0x403ff618) returned 0x0 [0201.380] WriteFile (in: hFile=0x2560, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x403ff61c*=0x7dc0, lpOverlapped=0x0) returned 1 [0201.380] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x403ff60c | out: lpNewFilePointer=0x0) returned 1 [0201.380] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.380] WriteFile (in: hFile=0x2560, lpBuffer=0x403ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x403ff61c, lpOverlapped=0x0 | out: lpBuffer=0x403ff83c*, lpNumberOfBytesWritten=0x403ff61c*=0x8, lpOverlapped=0x0) returned 1 [0201.380] SetFilePointerEx (in: hFile=0x2560, liDistanceToMove=0x7dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.381] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.381] CloseHandle (hObject=0x2560) returned 1 [0201.381] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.play")) returned 1 [0201.385] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3550 os_tid = 0x3584 [0201.389] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.389] ReadFile (in: hFile=0x24bc, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.391] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.391] ReadFile (in: hFile=0x24bc, lpBuffer=0x4053fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4053f85c, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesRead=0x4053f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.391] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.394] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.394] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x4053f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0201.394] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x4053f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x4053f828, pbKeyObject=0x0) returned 0x0 [0201.394] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x4053f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x4053f500) returned 0x0 [0201.394] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.394] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x4053f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x4053f500) returned 0x0 [0201.398] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.401] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.401] WriteFile (in: hFile=0x24bc, lpBuffer=0x4053fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4053f830, lpOverlapped=0x0 | out: lpBuffer=0x4053fb34*, lpNumberOfBytesWritten=0x4053f830*=0x428, lpOverlapped=0x0) returned 1 [0201.401] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.401] ReadFile (in: hFile=0x24bc, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x4053f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.402] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.402] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3c50000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x4053f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x4053f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4053f848, pbOutput=0x3c50000, pcbResult=0x4053f618) returned 0x0 [0201.402] WriteFile (in: hFile=0x24bc, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x4053f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.402] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4053f60c | out: lpNewFilePointer=0x0) returned 1 [0201.402] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.402] WriteFile (in: hFile=0x24bc, lpBuffer=0x4053f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4053f61c, lpOverlapped=0x0 | out: lpBuffer=0x4053f83c*, lpNumberOfBytesWritten=0x4053f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.402] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.402] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.402] CloseHandle (hObject=0x24bc) returned 1 [0201.403] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.play")) returned 1 [0201.407] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3551 os_tid = 0x3588 [0201.411] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.411] ReadFile (in: hFile=0x2018, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.413] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.413] ReadFile (in: hFile=0x2018, lpBuffer=0x4067fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4067f85c, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesRead=0x4067f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.413] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.415] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x4067f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0201.415] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x4067f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x4067f828, pbKeyObject=0x0) returned 0x0 [0201.415] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x4067f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x4067f500) returned 0x0 [0201.416] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.416] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x4067f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x4067f500) returned 0x0 [0201.419] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.422] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.422] WriteFile (in: hFile=0x2018, lpBuffer=0x4067fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4067f830, lpOverlapped=0x0 | out: lpBuffer=0x4067fb34*, lpNumberOfBytesWritten=0x4067f830*=0x428, lpOverlapped=0x0) returned 1 [0201.422] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.422] ReadFile (in: hFile=0x2018, lpBuffer=0x3d50000, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x4067f61c*=0xdd5, lpOverlapped=0x0) returned 1 [0201.422] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffff22b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.422] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3d50000, cbInput=0xdd5, pPaddingInfo=0x0, pbIV=0x4067f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x4067f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4067f848, pbOutput=0x3d50000, pcbResult=0x4067f618) returned 0x0 [0201.422] WriteFile (in: hFile=0x2018, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x4067f61c*=0xde0, lpOverlapped=0x0) returned 1 [0201.422] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4067f60c | out: lpNewFilePointer=0x0) returned 1 [0201.423] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.423] WriteFile (in: hFile=0x2018, lpBuffer=0x4067f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4067f61c, lpOverlapped=0x0 | out: lpBuffer=0x4067f83c*, lpNumberOfBytesWritten=0x4067f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.423] SetFilePointerEx (in: hFile=0x2018, liDistanceToMove=0xde0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.423] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.423] CloseHandle (hObject=0x2018) returned 1 [0201.426] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.play")) returned 1 [0201.431] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3552 os_tid = 0x358c [0201.435] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.435] ReadFile (in: hFile=0x1fec, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.436] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.437] ReadFile (in: hFile=0x1fec, lpBuffer=0x407bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x407bf85c, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesRead=0x407bf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.437] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.439] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.439] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x407bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0201.439] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x407bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x407bf828, pbKeyObject=0x0) returned 0x0 [0201.439] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x407bf500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x407bf500) returned 0x0 [0201.440] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.440] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x407bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x407bf500) returned 0x0 [0201.443] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.446] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.446] WriteFile (in: hFile=0x1fec, lpBuffer=0x407bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x407bf830, lpOverlapped=0x0 | out: lpBuffer=0x407bfb34*, lpNumberOfBytesWritten=0x407bf830*=0x428, lpOverlapped=0x0) returned 1 [0201.447] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.447] ReadFile (in: hFile=0x1fec, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x407bf61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.450] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.450] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3e50000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x407bf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x407bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x407bf848, pbOutput=0x3e50000, pcbResult=0x407bf618) returned 0x0 [0201.450] WriteFile (in: hFile=0x1fec, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x407bf61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.450] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x407bf60c | out: lpNewFilePointer=0x0) returned 1 [0201.450] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.450] WriteFile (in: hFile=0x1fec, lpBuffer=0x407bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x407bf61c, lpOverlapped=0x0 | out: lpBuffer=0x407bf83c*, lpNumberOfBytesWritten=0x407bf61c*=0x8, lpOverlapped=0x0) returned 1 [0201.450] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.450] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.450] CloseHandle (hObject=0x1fec) returned 1 [0201.450] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.play")) returned 1 [0201.455] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3553 os_tid = 0x3590 [0201.459] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.459] ReadFile (in: hFile=0x1f24, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.460] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.460] ReadFile (in: hFile=0x1f24, lpBuffer=0x408ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x408ff85c, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesRead=0x408ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.460] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.463] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.463] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x408ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0201.463] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x408ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x408ff828, pbKeyObject=0x0) returned 0x0 [0201.463] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x408ff500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x408ff500) returned 0x0 [0201.464] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.464] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x408ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x408ff500) returned 0x0 [0201.467] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.470] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.470] WriteFile (in: hFile=0x1f24, lpBuffer=0x408ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x408ff830, lpOverlapped=0x0 | out: lpBuffer=0x408ffb34*, lpNumberOfBytesWritten=0x408ff830*=0x428, lpOverlapped=0x0) returned 1 [0201.471] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.471] ReadFile (in: hFile=0x1f24, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x408ff61c*=0x7c08, lpOverlapped=0x0) returned 1 [0201.471] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.471] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0x7c08, pPaddingInfo=0x0, pbIV=0x408ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x408ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x408ff848, pbOutput=0x3f50000, pcbResult=0x408ff618) returned 0x0 [0201.471] WriteFile (in: hFile=0x1f24, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x408ff61c*=0x7c10, lpOverlapped=0x0) returned 1 [0201.472] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x408ff60c | out: lpNewFilePointer=0x0) returned 1 [0201.472] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.472] WriteFile (in: hFile=0x1f24, lpBuffer=0x408ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x408ff61c, lpOverlapped=0x0 | out: lpBuffer=0x408ff83c*, lpNumberOfBytesWritten=0x408ff61c*=0x8, lpOverlapped=0x0) returned 1 [0201.472] SetFilePointerEx (in: hFile=0x1f24, liDistanceToMove=0x7c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.472] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.472] CloseHandle (hObject=0x1f24) returned 1 [0201.472] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.475] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.play")) returned 1 [0201.477] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3554 os_tid = 0x3594 [0201.481] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.481] ReadFile (in: hFile=0x2174, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.483] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.483] ReadFile (in: hFile=0x2174, lpBuffer=0x40a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x40a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesRead=0x40a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.483] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x6f0000 [0201.485] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x6f0000) returned 0x0 [0201.485] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x40a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0201.486] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x40a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x6f0000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x40a3f828, pbKeyObject=0x0) returned 0x0 [0201.486] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x6f0000, cbOutput=0x230, pcbResult=0x40a3f500, dwFlags=0x0 | out: pbOutput=0x6f0000, pcbResult=0x40a3f500) returned 0x0 [0201.486] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x6f0230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x6f0230) returned 0x0 [0201.486] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x6f0000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x6f0000, cbOutput=0x400, pcbResult=0x40a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x6f0000, pcbResult=0x40a3f500) returned 0x0 [0201.489] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.493] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.493] WriteFile (in: hFile=0x2174, lpBuffer=0x40a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x40a3f830, lpOverlapped=0x0 | out: lpBuffer=0x40a3fb34*, lpNumberOfBytesWritten=0x40a3f830*=0x428, lpOverlapped=0x0) returned 1 [0201.493] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.493] ReadFile (in: hFile=0x2174, lpBuffer=0x4050000, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x40a3f61c*=0x48fc, lpOverlapped=0x0) returned 1 [0201.494] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xffffb704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.494] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4050000, cbInput=0x48fc, pPaddingInfo=0x0, pbIV=0x40a3f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x40a3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x40a3f848, pbOutput=0x4050000, pcbResult=0x40a3f618) returned 0x0 [0201.494] WriteFile (in: hFile=0x2174, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x40a3f61c*=0x4900, lpOverlapped=0x0) returned 1 [0201.494] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40a3f60c | out: lpNewFilePointer=0x0) returned 1 [0201.494] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.494] WriteFile (in: hFile=0x2174, lpBuffer=0x40a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x40a3f83c*, lpNumberOfBytesWritten=0x40a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.495] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x4900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.495] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.495] CloseHandle (hObject=0x2174) returned 1 [0201.495] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.play")) returned 1 [0201.499] VirtualFree (lpAddress=0x6f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3555 os_tid = 0x3598 [0201.545] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x1000, flProtect=0x4) returned 0x6f0000 [0201.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee4 [0201.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f060c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4 [0201.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec4 [0201.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0624, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc [0201.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb4 [0201.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f063c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e94 [0201.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0201.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0654, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2590 [0201.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f4 [0201.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f066c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d0 [0201.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26cc [0201.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0684, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d0 [0201.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26bc [0201.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f069c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d8 [0201.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e0 [0201.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e8 [0201.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f0 [0201.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06cc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f8 [0201.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2700 [0201.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2708 [0201.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2710 [0201.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f06fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2718 [0201.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2720 [0201.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0714, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2728 [0201.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0201.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f072c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29b8 [0201.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae0 [0201.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0744, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae8 [0201.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4c [0201.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f075c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b3c [0201.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b2c [0201.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0774, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b44 [0201.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2884 [0201.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f078c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b04 [0201.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0c [0201.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07a4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b54 [0201.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad0 [0201.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad8 [0201.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af4 [0201.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07d4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aa8 [0201.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ab0 [0201.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b24 [0201.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f07f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ab8 [0201.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0804, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b1c [0201.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b34 [0201.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f081c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2afc [0201.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b14 [0201.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a90 [0201.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aa0 [0201.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f084c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac0 [0201.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac8 [0201.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0864, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b7c [0201.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b80 [0201.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f087c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b84 [0201.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b88 [0201.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f0894, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8c [0201.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b90 [0201.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08ac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b94 [0201.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b98 [0201.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b9c [0201.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ba0 [0202.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08dc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2da0 [0202.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2da4 [0202.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333d00, lpParameter=0x4f08f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2da8 [0202.374] WaitForMultipleObjects (nCount=0x40, lpHandles=0x6f0000*=0x1ee4, bWaitAll=1, dwMilliseconds=0x578) Thread: id = 3556 os_tid = 0x359c [0201.615] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.615] ReadFile (in: hFile=0x2174, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.617] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.617] ReadFile (in: hFile=0x2174, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.617] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.625] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.625] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1528f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0201.625] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1528f828, pbKeyObject=0x0) returned 0x0 [0201.626] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1528f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0201.626] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.626] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1528f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0201.629] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.634] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.634] WriteFile (in: hFile=0x2174, lpBuffer=0x1528fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1528f830, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesWritten=0x1528f830*=0x428, lpOverlapped=0x0) returned 1 [0201.635] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.635] ReadFile (in: hFile=0x2174, lpBuffer=0x2750000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1528f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.636] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.636] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2750000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x1528f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1528f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1528f848, pbOutput=0x2750000, pcbResult=0x1528f618) returned 0x0 [0201.636] WriteFile (in: hFile=0x2174, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1528f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.636] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1528f60c | out: lpNewFilePointer=0x0) returned 1 [0201.636] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.636] WriteFile (in: hFile=0x2174, lpBuffer=0x1528f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x1528f83c*, lpNumberOfBytesWritten=0x1528f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.636] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.636] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.636] CloseHandle (hObject=0x2174) returned 1 [0201.637] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.play")) returned 1 [0201.642] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3557 os_tid = 0x35a0 [0201.687] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.687] ReadFile (in: hFile=0x1fec, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.688] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.688] ReadFile (in: hFile=0x1fec, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.689] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.694] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0201.694] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0201.694] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0201.694] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.694] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1590f500) returned 0x0 [0201.698] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.702] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.702] WriteFile (in: hFile=0x1fec, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0201.702] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.702] ReadFile (in: hFile=0x1fec, lpBuffer=0x2850000, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x1590f61c*=0x8499, lpOverlapped=0x0) returned 1 [0201.703] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xffff7b67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.703] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x8499, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x2850000, pcbResult=0x1590f618) returned 0x0 [0201.703] WriteFile (in: hFile=0x1fec, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x1590f61c*=0x84a0, lpOverlapped=0x0) returned 1 [0201.704] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0201.704] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.704] WriteFile (in: hFile=0x1fec, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.704] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x84a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.704] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.704] CloseHandle (hObject=0x1fec) returned 1 [0201.704] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.play")) returned 1 [0201.710] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3558 os_tid = 0x35a4 [0201.689] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.703] ReadFile (in: hFile=0x24bc, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.756] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.757] ReadFile (in: hFile=0x24bc, lpBuffer=0x15a0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15a0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesRead=0x15a0f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.757] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.761] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.761] BCryptSetProperty (in: hObject=0x730b88, pszProperty="ChainingMode", pbInput=0x15a0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730b88) returned 0x0 [0201.761] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730b88, phKey=0x15a0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730b88, phKey=0x15a0f828, pbKeyObject=0x0) returned 0x0 [0201.762] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15a0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15a0f500) returned 0x0 [0201.762] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.762] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15a0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15a0f500) returned 0x0 [0201.765] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.769] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.769] WriteFile (in: hFile=0x24bc, lpBuffer=0x15a0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15a0f830, lpOverlapped=0x0 | out: lpBuffer=0x15a0fb34*, lpNumberOfBytesWritten=0x15a0f830*=0x428, lpOverlapped=0x0) returned 1 [0201.770] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.770] ReadFile (in: hFile=0x24bc, lpBuffer=0x2950000, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesRead=0x15a0f61c*=0x639b, lpOverlapped=0x0) returned 1 [0201.771] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xffff9c65, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.771] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2950000, cbInput=0x639b, pPaddingInfo=0x0, pbIV=0x15a0f848, cbIV=0x10, pbOutput=0x2950000, cbOutput=0x100000, pcbResult=0x15a0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15a0f848, pbOutput=0x2950000, pcbResult=0x15a0f618) returned 0x0 [0201.771] WriteFile (in: hFile=0x24bc, lpBuffer=0x2950000*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2950000*, lpNumberOfBytesWritten=0x15a0f61c*=0x63a0, lpOverlapped=0x0) returned 1 [0201.771] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15a0f60c | out: lpNewFilePointer=0x0) returned 1 [0201.771] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.771] WriteFile (in: hFile=0x24bc, lpBuffer=0x15a0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15a0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15a0f83c*, lpNumberOfBytesWritten=0x15a0f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.771] SetFilePointerEx (in: hFile=0x24bc, liDistanceToMove=0x63a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.771] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.771] CloseHandle (hObject=0x24bc) returned 1 [0201.771] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.play")) returned 1 [0201.776] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3559 os_tid = 0x35a8 [0201.780] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.781] ReadFile (in: hFile=0x24c4, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.782] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.782] ReadFile (in: hFile=0x24c4, lpBuffer=0x15b4fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15b4f85c, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesRead=0x15b4f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.782] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.785] BCryptSetProperty (in: hObject=0x730c38, pszProperty="ChainingMode", pbInput=0x15b4f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730c38) returned 0x0 [0201.785] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730c38, phKey=0x15b4f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730c38, phKey=0x15b4f828, pbKeyObject=0x0) returned 0x0 [0201.785] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15b4f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15b4f500) returned 0x0 [0201.785] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.785] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15b4f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15b4f500) returned 0x0 [0201.789] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.792] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.792] WriteFile (in: hFile=0x24c4, lpBuffer=0x15b4fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15b4f830, lpOverlapped=0x0 | out: lpBuffer=0x15b4fb34*, lpNumberOfBytesWritten=0x15b4f830*=0x428, lpOverlapped=0x0) returned 1 [0201.793] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.793] ReadFile (in: hFile=0x24c4, lpBuffer=0x2a50000, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesRead=0x15b4f61c*=0x7e90, lpOverlapped=0x0) returned 1 [0201.794] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xffff8170, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.794] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2a50000, cbInput=0x7e90, pPaddingInfo=0x0, pbIV=0x15b4f848, cbIV=0x10, pbOutput=0x2a50000, cbOutput=0x100000, pcbResult=0x15b4f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15b4f848, pbOutput=0x2a50000, pcbResult=0x15b4f618) returned 0x0 [0201.794] WriteFile (in: hFile=0x24c4, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x15b4f61c*=0x7ea0, lpOverlapped=0x0) returned 1 [0201.795] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15b4f60c | out: lpNewFilePointer=0x0) returned 1 [0201.795] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.795] WriteFile (in: hFile=0x24c4, lpBuffer=0x15b4f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15b4f61c, lpOverlapped=0x0 | out: lpBuffer=0x15b4f83c*, lpNumberOfBytesWritten=0x15b4f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.795] SetFilePointerEx (in: hFile=0x24c4, liDistanceToMove=0x7ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.795] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.795] CloseHandle (hObject=0x24c4) returned 1 [0201.795] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.play")) returned 1 [0201.800] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3560 os_tid = 0x35ac [0201.804] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.804] ReadFile (in: hFile=0x2804, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.806] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.806] ReadFile (in: hFile=0x2804, lpBuffer=0x15c8fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15c8f85c, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesRead=0x15c8f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.806] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.809] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.809] BCryptSetProperty (in: hObject=0x730ce8, pszProperty="ChainingMode", pbInput=0x15c8f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ce8) returned 0x0 [0201.809] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ce8, phKey=0x15c8f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ce8, phKey=0x15c8f828, pbKeyObject=0x0) returned 0x0 [0201.809] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15c8f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15c8f500) returned 0x0 [0201.809] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.809] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15c8f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15c8f500) returned 0x0 [0201.812] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.816] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.816] WriteFile (in: hFile=0x2804, lpBuffer=0x15c8fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15c8f830, lpOverlapped=0x0 | out: lpBuffer=0x15c8fb34*, lpNumberOfBytesWritten=0x15c8f830*=0x428, lpOverlapped=0x0) returned 1 [0201.816] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.816] ReadFile (in: hFile=0x2804, lpBuffer=0x2b50000, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesRead=0x15c8f61c*=0x8118, lpOverlapped=0x0) returned 1 [0201.817] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xffff7ee8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.817] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2b50000, cbInput=0x8118, pPaddingInfo=0x0, pbIV=0x15c8f848, cbIV=0x10, pbOutput=0x2b50000, cbOutput=0x100000, pcbResult=0x15c8f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15c8f848, pbOutput=0x2b50000, pcbResult=0x15c8f618) returned 0x0 [0201.817] WriteFile (in: hFile=0x2804, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x15c8f61c*=0x8120, lpOverlapped=0x0) returned 1 [0201.817] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15c8f60c | out: lpNewFilePointer=0x0) returned 1 [0201.817] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.818] WriteFile (in: hFile=0x2804, lpBuffer=0x15c8f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15c8f61c, lpOverlapped=0x0 | out: lpBuffer=0x15c8f83c*, lpNumberOfBytesWritten=0x15c8f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.818] SetFilePointerEx (in: hFile=0x2804, liDistanceToMove=0x8120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.818] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.818] CloseHandle (hObject=0x2804) returned 1 [0201.818] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.821] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.play")) returned 1 [0201.823] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3561 os_tid = 0x35b0 [0201.827] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.827] ReadFile (in: hFile=0x2814, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.828] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.829] ReadFile (in: hFile=0x2814, lpBuffer=0x15dcfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15dcf85c, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesRead=0x15dcf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.829] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.832] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.832] BCryptSetProperty (in: hObject=0x730d98, pszProperty="ChainingMode", pbInput=0x15dcf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730d98) returned 0x0 [0201.832] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730d98, phKey=0x15dcf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730d98, phKey=0x15dcf828, pbKeyObject=0x0) returned 0x0 [0201.832] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15dcf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15dcf500) returned 0x0 [0201.832] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.832] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15dcf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15dcf500) returned 0x0 [0201.835] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.840] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.840] WriteFile (in: hFile=0x2814, lpBuffer=0x15dcfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15dcf830, lpOverlapped=0x0 | out: lpBuffer=0x15dcfb34*, lpNumberOfBytesWritten=0x15dcf830*=0x428, lpOverlapped=0x0) returned 1 [0201.842] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.842] ReadFile (in: hFile=0x2814, lpBuffer=0x2c50000, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesRead=0x15dcf61c*=0x5f2b, lpOverlapped=0x0) returned 1 [0201.843] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xffffa0d5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.843] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2c50000, cbInput=0x5f2b, pPaddingInfo=0x0, pbIV=0x15dcf848, cbIV=0x10, pbOutput=0x2c50000, cbOutput=0x100000, pcbResult=0x15dcf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15dcf848, pbOutput=0x2c50000, pcbResult=0x15dcf618) returned 0x0 [0201.843] WriteFile (in: hFile=0x2814, lpBuffer=0x2c50000*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x2c50000*, lpNumberOfBytesWritten=0x15dcf61c*=0x5f30, lpOverlapped=0x0) returned 1 [0201.843] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15dcf60c | out: lpNewFilePointer=0x0) returned 1 [0201.843] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.843] WriteFile (in: hFile=0x2814, lpBuffer=0x15dcf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15dcf61c, lpOverlapped=0x0 | out: lpBuffer=0x15dcf83c*, lpNumberOfBytesWritten=0x15dcf61c*=0x8, lpOverlapped=0x0) returned 1 [0201.843] SetFilePointerEx (in: hFile=0x2814, liDistanceToMove=0x5f30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.843] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.843] CloseHandle (hObject=0x2814) returned 1 [0201.844] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.play")) returned 1 [0201.849] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3562 os_tid = 0x35b4 [0201.853] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.853] ReadFile (in: hFile=0x2b6c, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.854] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.855] ReadFile (in: hFile=0x2b6c, lpBuffer=0x15f0fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x15f0f85c, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesRead=0x15f0f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.855] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.858] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.858] BCryptSetProperty (in: hObject=0x730e48, pszProperty="ChainingMode", pbInput=0x15f0f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730e48) returned 0x0 [0201.858] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730e48, phKey=0x15f0f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730e48, phKey=0x15f0f828, pbKeyObject=0x0) returned 0x0 [0201.858] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x15f0f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x15f0f500) returned 0x0 [0201.858] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.858] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x15f0f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x15f0f500) returned 0x0 [0201.861] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.864] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.864] WriteFile (in: hFile=0x2b6c, lpBuffer=0x15f0fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x15f0f830, lpOverlapped=0x0 | out: lpBuffer=0x15f0fb34*, lpNumberOfBytesWritten=0x15f0f830*=0x428, lpOverlapped=0x0) returned 1 [0201.865] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.865] ReadFile (in: hFile=0x2b6c, lpBuffer=0x2d50000, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesRead=0x15f0f61c*=0x7f68, lpOverlapped=0x0) returned 1 [0201.866] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xffff8098, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.866] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2d50000, cbInput=0x7f68, pPaddingInfo=0x0, pbIV=0x15f0f848, cbIV=0x10, pbOutput=0x2d50000, cbOutput=0x100000, pcbResult=0x15f0f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x15f0f848, pbOutput=0x2d50000, pcbResult=0x15f0f618) returned 0x0 [0201.866] WriteFile (in: hFile=0x2b6c, lpBuffer=0x2d50000*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d50000*, lpNumberOfBytesWritten=0x15f0f61c*=0x7f70, lpOverlapped=0x0) returned 1 [0201.866] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x15f0f60c | out: lpNewFilePointer=0x0) returned 1 [0201.866] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.866] WriteFile (in: hFile=0x2b6c, lpBuffer=0x15f0f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x15f0f61c, lpOverlapped=0x0 | out: lpBuffer=0x15f0f83c*, lpNumberOfBytesWritten=0x15f0f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.866] SetFilePointerEx (in: hFile=0x2b6c, liDistanceToMove=0x7f70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.866] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.866] CloseHandle (hObject=0x2b6c) returned 1 [0201.866] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.play")) returned 1 [0201.871] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3563 os_tid = 0x35b8 [0201.875] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.875] ReadFile (in: hFile=0x2a70, lpBuffer=0x1620fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1620f85c, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesRead=0x1620f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.877] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.877] ReadFile (in: hFile=0x2a70, lpBuffer=0x1620fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1620f85c, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesRead=0x1620f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.877] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.880] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.880] BCryptSetProperty (in: hObject=0x730ef8, pszProperty="ChainingMode", pbInput=0x1620f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ef8) returned 0x0 [0201.880] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ef8, phKey=0x1620f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ef8, phKey=0x1620f828, pbKeyObject=0x0) returned 0x0 [0201.881] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1620f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1620f500) returned 0x0 [0201.881] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.881] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1620f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1620f500) returned 0x0 [0201.884] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.887] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.887] WriteFile (in: hFile=0x2a70, lpBuffer=0x1620fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1620f830, lpOverlapped=0x0 | out: lpBuffer=0x1620fb34*, lpNumberOfBytesWritten=0x1620f830*=0x428, lpOverlapped=0x0) returned 1 [0201.888] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.888] ReadFile (in: hFile=0x2a70, lpBuffer=0x2e50000, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesRead=0x1620f61c*=0x50a5, lpOverlapped=0x0) returned 1 [0201.888] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xffffaf5b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.888] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2e50000, cbInput=0x50a5, pPaddingInfo=0x0, pbIV=0x1620f848, cbIV=0x10, pbOutput=0x2e50000, cbOutput=0x100000, pcbResult=0x1620f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1620f848, pbOutput=0x2e50000, pcbResult=0x1620f618) returned 0x0 [0201.889] WriteFile (in: hFile=0x2a70, lpBuffer=0x2e50000*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x2e50000*, lpNumberOfBytesWritten=0x1620f61c*=0x50b0, lpOverlapped=0x0) returned 1 [0201.889] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1620f60c | out: lpNewFilePointer=0x0) returned 1 [0201.889] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.889] WriteFile (in: hFile=0x2a70, lpBuffer=0x1620f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1620f61c, lpOverlapped=0x0 | out: lpBuffer=0x1620f83c*, lpNumberOfBytesWritten=0x1620f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.889] SetFilePointerEx (in: hFile=0x2a70, liDistanceToMove=0x50b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.889] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.889] CloseHandle (hObject=0x2a70) returned 1 [0201.889] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.play")) returned 1 [0201.894] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3564 os_tid = 0x35bc [0201.900] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.900] ReadFile (in: hFile=0x734, lpBuffer=0x1630fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1630f85c, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesRead=0x1630f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.901] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.902] ReadFile (in: hFile=0x734, lpBuffer=0x1630fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1630f85c, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesRead=0x1630f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.902] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.905] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.906] BCryptSetProperty (in: hObject=0x730fa8, pszProperty="ChainingMode", pbInput=0x1630f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730fa8) returned 0x0 [0201.906] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730fa8, phKey=0x1630f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730fa8, phKey=0x1630f828, pbKeyObject=0x0) returned 0x0 [0201.906] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1630f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1630f500) returned 0x0 [0201.906] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.906] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1630f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1630f500) returned 0x0 [0201.911] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.915] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.915] WriteFile (in: hFile=0x734, lpBuffer=0x1630fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1630f830, lpOverlapped=0x0 | out: lpBuffer=0x1630fb34*, lpNumberOfBytesWritten=0x1630f830*=0x428, lpOverlapped=0x0) returned 1 [0201.915] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.915] ReadFile (in: hFile=0x734, lpBuffer=0x2f50000, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesRead=0x1630f61c*=0x7ce0, lpOverlapped=0x0) returned 1 [0201.916] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.916] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2f50000, cbInput=0x7ce0, pPaddingInfo=0x0, pbIV=0x1630f848, cbIV=0x10, pbOutput=0x2f50000, cbOutput=0x100000, pcbResult=0x1630f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1630f848, pbOutput=0x2f50000, pcbResult=0x1630f618) returned 0x0 [0201.916] WriteFile (in: hFile=0x734, lpBuffer=0x2f50000*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x2f50000*, lpNumberOfBytesWritten=0x1630f61c*=0x7cf0, lpOverlapped=0x0) returned 1 [0201.917] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1630f60c | out: lpNewFilePointer=0x0) returned 1 [0201.917] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.917] WriteFile (in: hFile=0x734, lpBuffer=0x1630f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1630f61c, lpOverlapped=0x0 | out: lpBuffer=0x1630f83c*, lpNumberOfBytesWritten=0x1630f61c*=0x8, lpOverlapped=0x0) returned 1 [0201.917] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x7cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.917] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.917] CloseHandle (hObject=0x734) returned 1 [0201.917] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.play")) returned 1 [0201.922] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3565 os_tid = 0x35c0 [0201.935] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.935] ReadFile (in: hFile=0x29f4, lpBuffer=0x165cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x165cf85c, lpOverlapped=0x0 | out: lpBuffer=0x165cfb34*, lpNumberOfBytesRead=0x165cf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.936] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.937] ReadFile (in: hFile=0x29f4, lpBuffer=0x165cfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x165cf85c, lpOverlapped=0x0 | out: lpBuffer=0x165cfb34*, lpNumberOfBytesRead=0x165cf85c*=0x428, lpOverlapped=0x0) returned 1 [0201.937] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.940] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.941] BCryptSetProperty (in: hObject=0x731058, pszProperty="ChainingMode", pbInput=0x165cf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731058) returned 0x0 [0201.941] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731058, phKey=0x165cf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731058, phKey=0x165cf828, pbKeyObject=0x0) returned 0x0 [0201.941] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x165cf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x165cf500) returned 0x0 [0201.941] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.941] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x165cf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x165cf500) returned 0x0 [0201.945] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.949] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.950] WriteFile (in: hFile=0x29f4, lpBuffer=0x165cfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x165cf830, lpOverlapped=0x0 | out: lpBuffer=0x165cfb34*, lpNumberOfBytesWritten=0x165cf830*=0x428, lpOverlapped=0x0) returned 1 [0201.950] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.950] ReadFile (in: hFile=0x29f4, lpBuffer=0x3050000, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x165cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesRead=0x165cf61c*=0x6d86, lpOverlapped=0x0) returned 1 [0201.951] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xffff927a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.951] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3050000, cbInput=0x6d86, pPaddingInfo=0x0, pbIV=0x165cf848, cbIV=0x10, pbOutput=0x3050000, cbOutput=0x100000, pcbResult=0x165cf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x165cf848, pbOutput=0x3050000, pcbResult=0x165cf618) returned 0x0 [0201.951] WriteFile (in: hFile=0x29f4, lpBuffer=0x3050000*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x165cf61c, lpOverlapped=0x0 | out: lpBuffer=0x3050000*, lpNumberOfBytesWritten=0x165cf61c*=0x6d90, lpOverlapped=0x0) returned 1 [0201.951] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x165cf60c | out: lpNewFilePointer=0x0) returned 1 [0201.951] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.951] WriteFile (in: hFile=0x29f4, lpBuffer=0x165cf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x165cf61c, lpOverlapped=0x0 | out: lpBuffer=0x165cf83c*, lpNumberOfBytesWritten=0x165cf61c*=0x8, lpOverlapped=0x0) returned 1 [0201.951] SetFilePointerEx (in: hFile=0x29f4, liDistanceToMove=0x6d90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.951] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.951] CloseHandle (hObject=0x29f4) returned 1 [0201.952] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.play")) returned 1 [0201.956] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3566 os_tid = 0x35c4 [0201.962] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.962] ReadFile (in: hFile=0x2b74, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.964] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.964] ReadFile (in: hFile=0x2b74, lpBuffer=0x219ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x219ff85c, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesRead=0x219ff85c*=0x428, lpOverlapped=0x0) returned 1 [0201.964] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.968] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.968] BCryptSetProperty (in: hObject=0x731108, pszProperty="ChainingMode", pbInput=0x219ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731108) returned 0x0 [0201.968] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731108, phKey=0x219ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731108, phKey=0x219ff828, pbKeyObject=0x0) returned 0x0 [0201.968] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x219ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0201.968] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.968] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x219ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x219ff500) returned 0x0 [0201.973] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.978] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.978] WriteFile (in: hFile=0x2b74, lpBuffer=0x219ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x219ff830, lpOverlapped=0x0 | out: lpBuffer=0x219ffb34*, lpNumberOfBytesWritten=0x219ff830*=0x428, lpOverlapped=0x0) returned 1 [0201.979] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.979] ReadFile (in: hFile=0x2b74, lpBuffer=0x3150000, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesRead=0x219ff61c*=0x5e7b, lpOverlapped=0x0) returned 1 [0201.980] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xffffa185, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.980] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3150000, cbInput=0x5e7b, pPaddingInfo=0x0, pbIV=0x219ff848, cbIV=0x10, pbOutput=0x3150000, cbOutput=0x100000, pcbResult=0x219ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x219ff848, pbOutput=0x3150000, pcbResult=0x219ff618) returned 0x0 [0201.980] WriteFile (in: hFile=0x2b74, lpBuffer=0x3150000*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3150000*, lpNumberOfBytesWritten=0x219ff61c*=0x5e80, lpOverlapped=0x0) returned 1 [0201.980] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x219ff60c | out: lpNewFilePointer=0x0) returned 1 [0201.980] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.980] WriteFile (in: hFile=0x2b74, lpBuffer=0x219ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219ff61c, lpOverlapped=0x0 | out: lpBuffer=0x219ff83c*, lpNumberOfBytesWritten=0x219ff61c*=0x8, lpOverlapped=0x0) returned 1 [0201.980] SetFilePointerEx (in: hFile=0x2b74, liDistanceToMove=0x5e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.980] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0201.980] CloseHandle (hObject=0x2b74) returned 1 [0201.981] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0201.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.play")) returned 1 [0201.986] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3567 os_tid = 0x35c8 [0201.991] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.991] ReadFile (in: hFile=0x29a0, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.993] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.993] ReadFile (in: hFile=0x29a0, lpBuffer=0x2d37fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d37f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesRead=0x2d37f85c*=0x428, lpOverlapped=0x0) returned 1 [0201.993] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0201.997] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0201.997] BCryptSetProperty (in: hObject=0x7311b8, pszProperty="ChainingMode", pbInput=0x2d37f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7311b8) returned 0x0 [0201.997] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7311b8, phKey=0x2d37f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7311b8, phKey=0x2d37f828, pbKeyObject=0x0) returned 0x0 [0201.997] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d37f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0201.997] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0201.997] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d37f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d37f500) returned 0x0 [0202.002] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.006] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.007] WriteFile (in: hFile=0x29a0, lpBuffer=0x2d37fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d37f830, lpOverlapped=0x0 | out: lpBuffer=0x2d37fb34*, lpNumberOfBytesWritten=0x2d37f830*=0x428, lpOverlapped=0x0) returned 1 [0202.007] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.007] ReadFile (in: hFile=0x29a0, lpBuffer=0x3250000, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesRead=0x2d37f61c*=0x7d84, lpOverlapped=0x0) returned 1 [0202.008] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xffff827c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.008] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3250000, cbInput=0x7d84, pPaddingInfo=0x0, pbIV=0x2d37f848, cbIV=0x10, pbOutput=0x3250000, cbOutput=0x100000, pcbResult=0x2d37f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d37f848, pbOutput=0x3250000, pcbResult=0x2d37f618) returned 0x0 [0202.008] WriteFile (in: hFile=0x29a0, lpBuffer=0x3250000*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x3250000*, lpNumberOfBytesWritten=0x2d37f61c*=0x7d90, lpOverlapped=0x0) returned 1 [0202.008] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d37f60c | out: lpNewFilePointer=0x0) returned 1 [0202.008] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.009] WriteFile (in: hFile=0x29a0, lpBuffer=0x2d37f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d37f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d37f83c*, lpNumberOfBytesWritten=0x2d37f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.009] SetFilePointerEx (in: hFile=0x29a0, liDistanceToMove=0x7d90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.009] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.009] CloseHandle (hObject=0x29a0) returned 1 [0202.009] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.play")) returned 1 [0202.014] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3568 os_tid = 0x35cc [0202.019] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.019] ReadFile (in: hFile=0x2b5c, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.021] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.021] ReadFile (in: hFile=0x2b5c, lpBuffer=0x2d47fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d47f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesRead=0x2d47f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.021] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.024] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.025] BCryptSetProperty (in: hObject=0x731268, pszProperty="ChainingMode", pbInput=0x2d47f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731268) returned 0x0 [0202.025] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731268, phKey=0x2d47f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731268, phKey=0x2d47f828, pbKeyObject=0x0) returned 0x0 [0202.025] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d47f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0202.025] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.025] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d47f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d47f500) returned 0x0 [0202.030] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.034] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.034] WriteFile (in: hFile=0x2b5c, lpBuffer=0x2d47fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d47f830, lpOverlapped=0x0 | out: lpBuffer=0x2d47fb34*, lpNumberOfBytesWritten=0x2d47f830*=0x428, lpOverlapped=0x0) returned 1 [0202.034] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.034] ReadFile (in: hFile=0x2b5c, lpBuffer=0x3350000, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesRead=0x2d47f61c*=0x6090, lpOverlapped=0x0) returned 1 [0202.038] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xffff9f70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.038] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3350000, cbInput=0x6090, pPaddingInfo=0x0, pbIV=0x2d47f848, cbIV=0x10, pbOutput=0x3350000, cbOutput=0x100000, pcbResult=0x2d47f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d47f848, pbOutput=0x3350000, pcbResult=0x2d47f618) returned 0x0 [0202.038] WriteFile (in: hFile=0x2b5c, lpBuffer=0x3350000*, nNumberOfBytesToWrite=0x60a0, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x3350000*, lpNumberOfBytesWritten=0x2d47f61c*=0x60a0, lpOverlapped=0x0) returned 1 [0202.039] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d47f60c | out: lpNewFilePointer=0x0) returned 1 [0202.039] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.039] WriteFile (in: hFile=0x2b5c, lpBuffer=0x2d47f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d47f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d47f83c*, lpNumberOfBytesWritten=0x2d47f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.039] SetFilePointerEx (in: hFile=0x2b5c, liDistanceToMove=0x60a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.039] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.039] CloseHandle (hObject=0x2b5c) returned 1 [0202.039] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.043] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.play")) returned 1 [0202.045] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3569 os_tid = 0x35d0 [0202.051] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.051] ReadFile (in: hFile=0x2624, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.053] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.053] ReadFile (in: hFile=0x2624, lpBuffer=0x2d57fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d57f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesRead=0x2d57f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.053] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.057] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.057] BCryptSetProperty (in: hObject=0x731318, pszProperty="ChainingMode", pbInput=0x2d57f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731318) returned 0x0 [0202.057] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731318, phKey=0x2d57f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731318, phKey=0x2d57f828, pbKeyObject=0x0) returned 0x0 [0202.057] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d57f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0202.057] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.058] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d57f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d57f500) returned 0x0 [0202.062] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.066] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.066] WriteFile (in: hFile=0x2624, lpBuffer=0x2d57fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d57f830, lpOverlapped=0x0 | out: lpBuffer=0x2d57fb34*, lpNumberOfBytesWritten=0x2d57f830*=0x428, lpOverlapped=0x0) returned 1 [0202.067] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.067] ReadFile (in: hFile=0x2624, lpBuffer=0x3450000, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesRead=0x2d57f61c*=0x7e90, lpOverlapped=0x0) returned 1 [0202.068] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xffff8170, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.068] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3450000, cbInput=0x7e90, pPaddingInfo=0x0, pbIV=0x2d57f848, cbIV=0x10, pbOutput=0x3450000, cbOutput=0x100000, pcbResult=0x2d57f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d57f848, pbOutput=0x3450000, pcbResult=0x2d57f618) returned 0x0 [0202.068] WriteFile (in: hFile=0x2624, lpBuffer=0x3450000*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x3450000*, lpNumberOfBytesWritten=0x2d57f61c*=0x7ea0, lpOverlapped=0x0) returned 1 [0202.068] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d57f60c | out: lpNewFilePointer=0x0) returned 1 [0202.068] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.068] WriteFile (in: hFile=0x2624, lpBuffer=0x2d57f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d57f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d57f83c*, lpNumberOfBytesWritten=0x2d57f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.069] SetFilePointerEx (in: hFile=0x2624, liDistanceToMove=0x7ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.069] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.069] CloseHandle (hObject=0x2624) returned 1 [0202.069] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.play")) returned 1 [0202.074] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3570 os_tid = 0x35d4 [0202.079] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.080] ReadFile (in: hFile=0x2604, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.081] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.081] ReadFile (in: hFile=0x2604, lpBuffer=0x2d67fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x2d67f85c, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesRead=0x2d67f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.082] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.085] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.086] BCryptSetProperty (in: hObject=0x7313c8, pszProperty="ChainingMode", pbInput=0x2d67f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7313c8) returned 0x0 [0202.086] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7313c8, phKey=0x2d67f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7313c8, phKey=0x2d67f828, pbKeyObject=0x0) returned 0x0 [0202.086] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x2d67f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0202.086] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.086] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x2d67f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x2d67f500) returned 0x0 [0202.091] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.094] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.094] WriteFile (in: hFile=0x2604, lpBuffer=0x2d67fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x2d67f830, lpOverlapped=0x0 | out: lpBuffer=0x2d67fb34*, lpNumberOfBytesWritten=0x2d67f830*=0x428, lpOverlapped=0x0) returned 1 [0202.095] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.095] ReadFile (in: hFile=0x2604, lpBuffer=0x3550000, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesRead=0x2d67f61c*=0x8795, lpOverlapped=0x0) returned 1 [0202.095] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xffff786b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.096] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3550000, cbInput=0x8795, pPaddingInfo=0x0, pbIV=0x2d67f848, cbIV=0x10, pbOutput=0x3550000, cbOutput=0x100000, pcbResult=0x2d67f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x2d67f848, pbOutput=0x3550000, pcbResult=0x2d67f618) returned 0x0 [0202.096] WriteFile (in: hFile=0x2604, lpBuffer=0x3550000*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x3550000*, lpNumberOfBytesWritten=0x2d67f61c*=0x87a0, lpOverlapped=0x0) returned 1 [0202.096] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d67f60c | out: lpNewFilePointer=0x0) returned 1 [0202.096] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.096] WriteFile (in: hFile=0x2604, lpBuffer=0x2d67f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d67f61c, lpOverlapped=0x0 | out: lpBuffer=0x2d67f83c*, lpNumberOfBytesWritten=0x2d67f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.096] SetFilePointerEx (in: hFile=0x2604, liDistanceToMove=0x87a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.096] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.096] CloseHandle (hObject=0x2604) returned 1 [0202.097] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.play")) returned 1 [0202.106] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3571 os_tid = 0x35d8 [0202.111] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.111] ReadFile (in: hFile=0x2194, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.113] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.113] ReadFile (in: hFile=0x2194, lpBuffer=0x3c87fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3c87f85c, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesRead=0x3c87f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.113] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.117] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.117] BCryptSetProperty (in: hObject=0x72db10, pszProperty="ChainingMode", pbInput=0x3c87f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72db10) returned 0x0 [0202.117] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72db10, phKey=0x3c87f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72db10, phKey=0x3c87f828, pbKeyObject=0x0) returned 0x0 [0202.117] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3c87f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3c87f500) returned 0x0 [0202.117] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.117] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3c87f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3c87f500) returned 0x0 [0202.122] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.126] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.126] WriteFile (in: hFile=0x2194, lpBuffer=0x3c87fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3c87f830, lpOverlapped=0x0 | out: lpBuffer=0x3c87fb34*, lpNumberOfBytesWritten=0x3c87f830*=0x428, lpOverlapped=0x0) returned 1 [0202.126] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.126] ReadFile (in: hFile=0x2194, lpBuffer=0x3650000, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesRead=0x3c87f61c*=0x8118, lpOverlapped=0x0) returned 1 [0202.128] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xffff7ee8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.128] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3650000, cbInput=0x8118, pPaddingInfo=0x0, pbIV=0x3c87f848, cbIV=0x10, pbOutput=0x3650000, cbOutput=0x100000, pcbResult=0x3c87f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3c87f848, pbOutput=0x3650000, pcbResult=0x3c87f618) returned 0x0 [0202.128] WriteFile (in: hFile=0x2194, lpBuffer=0x3650000*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3650000*, lpNumberOfBytesWritten=0x3c87f61c*=0x8120, lpOverlapped=0x0) returned 1 [0202.128] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3c87f60c | out: lpNewFilePointer=0x0) returned 1 [0202.128] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.128] WriteFile (in: hFile=0x2194, lpBuffer=0x3c87f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3c87f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c87f83c*, lpNumberOfBytesWritten=0x3c87f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.128] SetFilePointerEx (in: hFile=0x2194, liDistanceToMove=0x8120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.128] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.128] CloseHandle (hObject=0x2194) returned 1 [0202.129] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.play")) returned 1 [0202.134] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3572 os_tid = 0x35dc [0202.127] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.138] ReadFile (in: hFile=0x18f0, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.140] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.140] ReadFile (in: hFile=0x18f0, lpBuffer=0x3d9ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3d9ff85c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesRead=0x3d9ff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.141] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.144] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.144] BCryptSetProperty (in: hObject=0x72dbc0, pszProperty="ChainingMode", pbInput=0x3d9ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dbc0) returned 0x0 [0202.144] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dbc0, phKey=0x3d9ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dbc0, phKey=0x3d9ff828, pbKeyObject=0x0) returned 0x0 [0202.144] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3d9ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3d9ff500) returned 0x0 [0202.144] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.144] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3d9ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3d9ff500) returned 0x0 [0202.149] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.154] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.154] WriteFile (in: hFile=0x18f0, lpBuffer=0x3d9ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3d9ff830, lpOverlapped=0x0 | out: lpBuffer=0x3d9ffb34*, lpNumberOfBytesWritten=0x3d9ff830*=0x428, lpOverlapped=0x0) returned 1 [0202.154] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.154] ReadFile (in: hFile=0x18f0, lpBuffer=0x3750000, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesRead=0x3d9ff61c*=0x64c7, lpOverlapped=0x0) returned 1 [0202.156] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xffff9b39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.156] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3750000, cbInput=0x64c7, pPaddingInfo=0x0, pbIV=0x3d9ff848, cbIV=0x10, pbOutput=0x3750000, cbOutput=0x100000, pcbResult=0x3d9ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3d9ff848, pbOutput=0x3750000, pcbResult=0x3d9ff618) returned 0x0 [0202.156] WriteFile (in: hFile=0x18f0, lpBuffer=0x3750000*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3750000*, lpNumberOfBytesWritten=0x3d9ff61c*=0x64d0, lpOverlapped=0x0) returned 1 [0202.156] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d9ff60c | out: lpNewFilePointer=0x0) returned 1 [0202.157] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.157] WriteFile (in: hFile=0x18f0, lpBuffer=0x3d9ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3d9ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3d9ff83c*, lpNumberOfBytesWritten=0x3d9ff61c*=0x8, lpOverlapped=0x0) returned 1 [0202.157] SetFilePointerEx (in: hFile=0x18f0, liDistanceToMove=0x64d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.157] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.157] CloseHandle (hObject=0x18f0) returned 1 [0202.157] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.161] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.play")) returned 1 [0202.163] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3573 os_tid = 0x35e0 [0202.168] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.168] ReadFile (in: hFile=0x18d8, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.169] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.169] ReadFile (in: hFile=0x18d8, lpBuffer=0x3fcffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fcff85c, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesRead=0x3fcff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.169] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.173] BCryptSetProperty (in: hObject=0x72d9b0, pszProperty="ChainingMode", pbInput=0x3fcff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d9b0) returned 0x0 [0202.173] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d9b0, phKey=0x3fcff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d9b0, phKey=0x3fcff828, pbKeyObject=0x0) returned 0x0 [0202.173] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3fcff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3fcff500) returned 0x0 [0202.173] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.174] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3fcff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3fcff500) returned 0x0 [0202.179] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.184] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.184] WriteFile (in: hFile=0x18d8, lpBuffer=0x3fcffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fcff830, lpOverlapped=0x0 | out: lpBuffer=0x3fcffb34*, lpNumberOfBytesWritten=0x3fcff830*=0x428, lpOverlapped=0x0) returned 1 [0202.184] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.184] ReadFile (in: hFile=0x18d8, lpBuffer=0x3850000, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesRead=0x3fcff61c*=0x16f40, lpOverlapped=0x0) returned 1 [0202.186] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffe90c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.186] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3850000, cbInput=0x16f40, pPaddingInfo=0x0, pbIV=0x3fcff848, cbIV=0x10, pbOutput=0x3850000, cbOutput=0x100000, pcbResult=0x3fcff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fcff848, pbOutput=0x3850000, pcbResult=0x3fcff618) returned 0x0 [0202.186] WriteFile (in: hFile=0x18d8, lpBuffer=0x3850000*, nNumberOfBytesToWrite=0x16f50, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3850000*, lpNumberOfBytesWritten=0x3fcff61c*=0x16f50, lpOverlapped=0x0) returned 1 [0202.187] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fcff60c | out: lpNewFilePointer=0x0) returned 1 [0202.187] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.187] WriteFile (in: hFile=0x18d8, lpBuffer=0x3fcff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fcff61c, lpOverlapped=0x0 | out: lpBuffer=0x3fcff83c*, lpNumberOfBytesWritten=0x3fcff61c*=0x8, lpOverlapped=0x0) returned 1 [0202.187] SetFilePointerEx (in: hFile=0x18d8, liDistanceToMove=0x16f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.187] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.187] CloseHandle (hObject=0x18d8) returned 1 [0202.187] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.play")) returned 1 [0202.193] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3574 os_tid = 0x35e4 [0202.199] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.199] ReadFile (in: hFile=0x18b0, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.200] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.201] ReadFile (in: hFile=0x18b0, lpBuffer=0x3fe3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesRead=0x3fe3f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.201] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.204] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.204] BCryptSetProperty (in: hObject=0x72da60, pszProperty="ChainingMode", pbInput=0x3fe3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72da60) returned 0x0 [0202.204] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72da60, phKey=0x3fe3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72da60, phKey=0x3fe3f828, pbKeyObject=0x0) returned 0x0 [0202.204] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3fe3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3fe3f500) returned 0x0 [0202.205] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.205] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3fe3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3fe3f500) returned 0x0 [0202.211] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.214] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.215] WriteFile (in: hFile=0x18b0, lpBuffer=0x3fe3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3fe3f830, lpOverlapped=0x0 | out: lpBuffer=0x3fe3fb34*, lpNumberOfBytesWritten=0x3fe3f830*=0x428, lpOverlapped=0x0) returned 1 [0202.215] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.215] ReadFile (in: hFile=0x18b0, lpBuffer=0x3950000, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesRead=0x3fe3f61c*=0xc382, lpOverlapped=0x0) returned 1 [0202.216] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xffff3c7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.216] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3950000, cbInput=0xc382, pPaddingInfo=0x0, pbIV=0x3fe3f848, cbIV=0x10, pbOutput=0x3950000, cbOutput=0x100000, pcbResult=0x3fe3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3fe3f848, pbOutput=0x3950000, pcbResult=0x3fe3f618) returned 0x0 [0202.216] WriteFile (in: hFile=0x18b0, lpBuffer=0x3950000*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3950000*, lpNumberOfBytesWritten=0x3fe3f61c*=0xc390, lpOverlapped=0x0) returned 1 [0202.216] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fe3f60c | out: lpNewFilePointer=0x0) returned 1 [0202.216] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.217] WriteFile (in: hFile=0x18b0, lpBuffer=0x3fe3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3fe3f61c, lpOverlapped=0x0 | out: lpBuffer=0x3fe3f83c*, lpNumberOfBytesWritten=0x3fe3f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.217] SetFilePointerEx (in: hFile=0x18b0, liDistanceToMove=0xc390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.217] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.217] CloseHandle (hObject=0x18b0) returned 1 [0202.217] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.play")) returned 1 [0202.222] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3575 os_tid = 0x35e8 [0202.227] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.228] ReadFile (in: hFile=0x1898, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.232] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.232] ReadFile (in: hFile=0x1898, lpBuffer=0x3ff7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x3ff7f85c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesRead=0x3ff7f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.232] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.236] BCryptSetProperty (in: hObject=0x72dc70, pszProperty="ChainingMode", pbInput=0x3ff7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dc70) returned 0x0 [0202.236] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dc70, phKey=0x3ff7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dc70, phKey=0x3ff7f828, pbKeyObject=0x0) returned 0x0 [0202.236] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x3ff7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x3ff7f500) returned 0x0 [0202.236] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.236] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x3ff7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x3ff7f500) returned 0x0 [0202.241] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.246] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.246] WriteFile (in: hFile=0x1898, lpBuffer=0x3ff7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x3ff7f830, lpOverlapped=0x0 | out: lpBuffer=0x3ff7fb34*, lpNumberOfBytesWritten=0x3ff7f830*=0x428, lpOverlapped=0x0) returned 1 [0202.246] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.246] ReadFile (in: hFile=0x1898, lpBuffer=0x3a50000, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesRead=0x3ff7f61c*=0x7c08, lpOverlapped=0x0) returned 1 [0202.247] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.247] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3a50000, cbInput=0x7c08, pPaddingInfo=0x0, pbIV=0x3ff7f848, cbIV=0x10, pbOutput=0x3a50000, cbOutput=0x100000, pcbResult=0x3ff7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x3ff7f848, pbOutput=0x3a50000, pcbResult=0x3ff7f618) returned 0x0 [0202.247] WriteFile (in: hFile=0x1898, lpBuffer=0x3a50000*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3a50000*, lpNumberOfBytesWritten=0x3ff7f61c*=0x7c10, lpOverlapped=0x0) returned 1 [0202.248] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3ff7f60c | out: lpNewFilePointer=0x0) returned 1 [0202.248] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.248] WriteFile (in: hFile=0x1898, lpBuffer=0x3ff7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3ff7f61c, lpOverlapped=0x0 | out: lpBuffer=0x3ff7f83c*, lpNumberOfBytesWritten=0x3ff7f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.248] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x7c10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.248] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.248] CloseHandle (hObject=0x1898) returned 1 [0202.248] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.play")) returned 1 [0202.254] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3576 os_tid = 0x35ec [0202.261] GetLastError () returned 0x57 [0202.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a755d08 [0202.261] SetLastError (dwErrCode=0x57) [0202.261] IcmpCreateFile () returned 0x80ba70 [0202.261] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738f80 [0202.262] IcmpSendEcho2 (IcmpHandle=0x80ba70, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8100a8c0, RequestData=0x402fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738f80, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3577 os_tid = 0x35f0 [0202.265] GetLastError () returned 0x57 [0202.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a756090 [0202.265] SetLastError (dwErrCode=0x57) [0202.265] IcmpCreateFile () returned 0x80baa8 [0202.265] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a738fd0 [0202.265] IcmpSendEcho2 (IcmpHandle=0x80baa8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8200a8c0, RequestData=0x403fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a738fd0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3578 os_tid = 0x35f4 [0202.267] GetLastError () returned 0x57 [0202.267] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a756418 [0202.267] SetLastError (dwErrCode=0x57) [0202.267] IcmpCreateFile () returned 0x80bae0 [0202.267] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739020 [0202.267] IcmpSendEcho2 (IcmpHandle=0x80bae0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8300a8c0, RequestData=0x4053ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739020, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3579 os_tid = 0x35f8 [0202.268] GetLastError () returned 0x57 [0202.269] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7567a0 [0202.269] SetLastError (dwErrCode=0x57) [0202.269] IcmpCreateFile () returned 0x80bb18 [0202.269] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739070 [0202.269] IcmpSendEcho2 (IcmpHandle=0x80bb18, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8400a8c0, RequestData=0x4067ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739070, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3580 os_tid = 0x35fc [0202.270] GetLastError () returned 0x57 [0202.270] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73b548 [0202.271] SetLastError (dwErrCode=0x57) [0202.271] IcmpCreateFile () returned 0x80bb50 [0202.271] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7390c0 [0202.271] IcmpSendEcho2 (IcmpHandle=0x80bb50, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8500a8c0, RequestData=0x407bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7390c0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3581 os_tid = 0x3600 [0202.272] GetLastError () returned 0x57 [0202.273] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73b8d0 [0202.273] SetLastError (dwErrCode=0x57) [0202.273] IcmpCreateFile () returned 0x80bb88 [0202.273] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7397f0 [0202.273] IcmpSendEcho2 (IcmpHandle=0x80bb88, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8600a8c0, RequestData=0x408fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7397f0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3582 os_tid = 0x3604 [0202.274] GetLastError () returned 0x57 [0202.274] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73bc58 [0202.274] SetLastError (dwErrCode=0x57) [0202.274] IcmpCreateFile () returned 0x80bbc0 [0202.274] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739840 [0202.274] IcmpSendEcho2 (IcmpHandle=0x80bbc0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8700a8c0, RequestData=0x40a3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739840, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3583 os_tid = 0x3608 [0202.276] GetLastError () returned 0x57 [0202.276] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73bfe0 [0202.276] SetLastError (dwErrCode=0x57) [0202.276] IcmpCreateFile () returned 0x80bbf8 [0202.276] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739700 [0202.276] IcmpSendEcho2 (IcmpHandle=0x80bbf8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8800a8c0, RequestData=0x40cbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739700, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3584 os_tid = 0x360c [0202.277] GetLastError () returned 0x57 [0202.277] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73c368 [0202.278] SetLastError (dwErrCode=0x57) [0202.278] IcmpCreateFile () returned 0x80bc30 [0202.278] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a739750 [0202.278] IcmpSendEcho2 (IcmpHandle=0x80bc30, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8900a8c0, RequestData=0x40dfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a739750, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3585 os_tid = 0x3610 [0202.279] GetLastError () returned 0x57 [0202.279] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73c6f0 [0202.279] SetLastError (dwErrCode=0x57) [0202.279] IcmpCreateFile () returned 0x80bc68 [0202.279] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a7397a0 [0202.279] IcmpSendEcho2 (IcmpHandle=0x80bc68, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8a00a8c0, RequestData=0x40f3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7397a0, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3586 os_tid = 0x3614 [0202.280] GetLastError () returned 0x57 [0202.281] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73ca78 [0202.281] SetLastError (dwErrCode=0x57) [0202.281] IcmpCreateFile () returned 0x80bca0 [0202.281] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfd48 [0202.281] IcmpSendEcho2 (IcmpHandle=0x80bca0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8b00a8c0, RequestData=0x4107ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfd48, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3587 os_tid = 0x3618 [0202.282] GetLastError () returned 0x57 [0202.282] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73ce00 [0202.282] SetLastError (dwErrCode=0x57) [0202.282] IcmpCreateFile () returned 0x80bcd8 [0202.282] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfe38 [0202.282] IcmpSendEcho2 (IcmpHandle=0x80bcd8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8c00a8c0, RequestData=0x411bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfe38, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3588 os_tid = 0x361c [0202.284] GetLastError () returned 0x57 [0202.284] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73d188 [0202.284] SetLastError (dwErrCode=0x57) [0202.284] IcmpCreateFile () returned 0x80bd10 [0202.284] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cfe88 [0202.284] IcmpSendEcho2 (IcmpHandle=0x80bd10, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8d00a8c0, RequestData=0x412fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cfe88, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3589 os_tid = 0x3620 [0202.285] GetLastError () returned 0x57 [0202.285] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73d510 [0202.286] SetLastError (dwErrCode=0x57) [0202.286] IcmpCreateFile () returned 0x80bd48 [0202.286] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cff28 [0202.286] IcmpSendEcho2 (IcmpHandle=0x80bd48, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8e00a8c0, RequestData=0x4143ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cff28, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3590 os_tid = 0x3624 [0202.287] GetLastError () returned 0x57 [0202.287] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73d898 [0202.287] SetLastError (dwErrCode=0x57) [0202.287] IcmpCreateFile () returned 0x80bd80 [0202.287] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cff78 [0202.287] IcmpSendEcho2 (IcmpHandle=0x80bd80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x8f00a8c0, RequestData=0x4157ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cff78, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3591 os_tid = 0x3628 [0202.289] GetLastError () returned 0x57 [0202.289] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73dc20 [0202.289] SetLastError (dwErrCode=0x57) [0202.289] IcmpCreateFile () returned 0x80bdb8 [0202.289] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf5c8 [0202.289] IcmpSendEcho2 (IcmpHandle=0x80bdb8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9000a8c0, RequestData=0x416bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf5c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3592 os_tid = 0x362c [0202.290] GetLastError () returned 0x57 [0202.290] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73dfa8 [0202.290] SetLastError (dwErrCode=0x57) [0202.290] IcmpCreateFile () returned 0x80bdf0 [0202.290] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf6b8 [0202.291] IcmpSendEcho2 (IcmpHandle=0x80bdf0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9100a8c0, RequestData=0x417fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf6b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3593 os_tid = 0x3630 [0202.292] GetLastError () returned 0x57 [0202.292] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73e330 [0202.292] SetLastError (dwErrCode=0x57) [0202.292] IcmpCreateFile () returned 0x80be28 [0202.292] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf708 [0202.292] IcmpSendEcho2 (IcmpHandle=0x80be28, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9200a8c0, RequestData=0x4193ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf708, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3594 os_tid = 0x3634 [0202.293] GetLastError () returned 0x57 [0202.293] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73e6b8 [0202.294] SetLastError (dwErrCode=0x57) [0202.294] IcmpCreateFile () returned 0x80be60 [0202.294] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x7cf758 [0202.294] IcmpSendEcho2 (IcmpHandle=0x80be60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9300a8c0, RequestData=0x41a7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x7cf758, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3595 os_tid = 0x3638 [0202.298] GetLastError () returned 0x57 [0202.298] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73ea40 [0202.298] SetLastError (dwErrCode=0x57) [0202.298] IcmpCreateFile () returned 0x80be98 [0202.298] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b268 [0202.298] IcmpSendEcho2 (IcmpHandle=0x80be98, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9400a8c0, RequestData=0x41bbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b268, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3596 os_tid = 0x363c [0202.299] GetLastError () returned 0x57 [0202.300] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73edc8 [0202.300] SetLastError (dwErrCode=0x57) [0202.300] IcmpCreateFile () returned 0x80bed0 [0202.300] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76aea8 [0202.300] IcmpSendEcho2 (IcmpHandle=0x80bed0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9500a8c0, RequestData=0x41cfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76aea8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3597 os_tid = 0x3640 [0202.301] GetLastError () returned 0x57 [0202.301] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73f150 [0202.301] SetLastError (dwErrCode=0x57) [0202.301] IcmpCreateFile () returned 0x80bf08 [0202.302] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76aef8 [0202.302] IcmpSendEcho2 (IcmpHandle=0x80bf08, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9600a8c0, RequestData=0x41e3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76aef8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3598 os_tid = 0x3644 [0202.303] GetLastError () returned 0x57 [0202.303] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73f4d8 [0202.303] SetLastError (dwErrCode=0x57) [0202.304] IcmpCreateFile () returned 0x80b840 [0202.304] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76af48 [0202.304] IcmpSendEcho2 (IcmpHandle=0x80b840, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9700a8c0, RequestData=0x41f7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76af48, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3599 os_tid = 0x3648 [0202.305] GetLastError () returned 0x57 [0202.305] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73f860 [0202.305] SetLastError (dwErrCode=0x57) [0202.305] IcmpCreateFile () returned 0x80b878 [0202.305] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76af98 [0202.305] IcmpSendEcho2 (IcmpHandle=0x80b878, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9800a8c0, RequestData=0x420bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76af98, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3600 os_tid = 0x364c [0202.306] GetLastError () returned 0x57 [0202.306] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73fbe8 [0202.307] SetLastError (dwErrCode=0x57) [0202.307] IcmpCreateFile () returned 0x80b8b0 [0202.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76afe8 [0202.307] IcmpSendEcho2 (IcmpHandle=0x80b8b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9900a8c0, RequestData=0x421fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76afe8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3601 os_tid = 0x3650 [0202.308] GetLastError () returned 0x57 [0202.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73ff70 [0202.308] SetLastError (dwErrCode=0x57) [0202.308] IcmpCreateFile () returned 0x80b8e8 [0202.309] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b038 [0202.309] IcmpSendEcho2 (IcmpHandle=0x80b8e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9a00a8c0, RequestData=0x4233ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b038, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3602 os_tid = 0x3654 [0202.310] GetLastError () returned 0x57 [0202.310] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7402f8 [0202.310] SetLastError (dwErrCode=0x57) [0202.310] IcmpCreateFile () returned 0x80b920 [0202.310] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b088 [0202.310] IcmpSendEcho2 (IcmpHandle=0x80b920, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9b00a8c0, RequestData=0x4247ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b088, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3603 os_tid = 0x3658 [0202.311] GetLastError () returned 0x57 [0202.311] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a740680 [0202.312] SetLastError (dwErrCode=0x57) [0202.312] IcmpCreateFile () returned 0x80b958 [0202.312] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b0d8 [0202.312] IcmpSendEcho2 (IcmpHandle=0x80b958, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9c00a8c0, RequestData=0x425bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b0d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3604 os_tid = 0x365c [0202.313] GetLastError () returned 0x57 [0202.313] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a739908 [0202.313] SetLastError (dwErrCode=0x57) [0202.313] IcmpCreateFile () returned 0x80b990 [0202.313] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b128 [0202.313] IcmpSendEcho2 (IcmpHandle=0x80b990, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9d00a8c0, RequestData=0x426fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b128, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3605 os_tid = 0x3660 [0202.314] GetLastError () returned 0x57 [0202.315] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a739c90 [0202.315] SetLastError (dwErrCode=0x57) [0202.315] IcmpCreateFile () returned 0x80b9c8 [0202.315] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b178 [0202.315] IcmpSendEcho2 (IcmpHandle=0x80b9c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9e00a8c0, RequestData=0x4283ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b178, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3606 os_tid = 0x3664 [0202.316] GetLastError () returned 0x57 [0202.316] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73a018 [0202.316] SetLastError (dwErrCode=0x57) [0202.316] IcmpCreateFile () returned 0x80ba00 [0202.317] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b1c8 [0202.317] IcmpSendEcho2 (IcmpHandle=0x80ba00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x9f00a8c0, RequestData=0x4297ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b1c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3607 os_tid = 0x3668 [0202.318] GetLastError () returned 0x57 [0202.318] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73a3a0 [0202.318] SetLastError (dwErrCode=0x57) [0202.318] IcmpCreateFile () returned 0x80ba38 [0202.318] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b218 [0202.318] IcmpSendEcho2 (IcmpHandle=0x80ba38, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa000a8c0, RequestData=0x42abff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b218, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3608 os_tid = 0x366c [0202.320] GetLastError () returned 0x57 [0202.320] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73aab0 [0202.320] SetLastError (dwErrCode=0x57) [0202.320] IcmpCreateFile () returned 0x76a690 [0202.320] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b2b8 [0202.320] IcmpSendEcho2 (IcmpHandle=0x76a690, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa100a8c0, RequestData=0x42bfff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b2b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3609 os_tid = 0x3670 [0202.321] GetLastError () returned 0x57 [0202.321] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73a728 [0202.321] SetLastError (dwErrCode=0x57) [0202.321] IcmpCreateFile () returned 0x76a230 [0202.322] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b308 [0202.322] IcmpSendEcho2 (IcmpHandle=0x76a230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa200a8c0, RequestData=0x42d3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b308, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3610 os_tid = 0x3674 [0202.323] GetLastError () returned 0x57 [0202.323] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73ae38 [0202.323] SetLastError (dwErrCode=0x57) [0202.323] IcmpCreateFile () returned 0x76a268 [0202.323] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b358 [0202.323] IcmpSendEcho2 (IcmpHandle=0x76a268, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa300a8c0, RequestData=0x42e7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b358, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3611 os_tid = 0x3678 [0202.324] GetLastError () returned 0x57 [0202.325] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a73b1c0 [0202.325] SetLastError (dwErrCode=0x57) [0202.325] IcmpCreateFile () returned 0x76a2a0 [0202.325] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b3a8 [0202.325] IcmpSendEcho2 (IcmpHandle=0x76a2a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa400a8c0, RequestData=0x42fbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b3a8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3612 os_tid = 0x367c [0202.326] GetLastError () returned 0x57 [0202.326] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a745ec8 [0202.326] SetLastError (dwErrCode=0x57) [0202.326] IcmpCreateFile () returned 0x76a2d8 [0202.326] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b3f8 [0202.326] IcmpSendEcho2 (IcmpHandle=0x76a2d8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa500a8c0, RequestData=0x430fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b3f8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3613 os_tid = 0x3680 [0202.328] GetLastError () returned 0x57 [0202.328] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a746250 [0202.328] SetLastError (dwErrCode=0x57) [0202.328] IcmpCreateFile () returned 0x76a310 [0202.328] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b448 [0202.328] IcmpSendEcho2 (IcmpHandle=0x76a310, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa600a8c0, RequestData=0x4323ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b448, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3614 os_tid = 0x3684 [0202.329] GetLastError () returned 0x57 [0202.329] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7465d8 [0202.330] SetLastError (dwErrCode=0x57) [0202.330] IcmpCreateFile () returned 0x76a348 [0202.330] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b498 [0202.330] IcmpSendEcho2 (IcmpHandle=0x76a348, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa700a8c0, RequestData=0x4337ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b498, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3615 os_tid = 0x3688 [0202.331] GetLastError () returned 0x57 [0202.331] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a746960 [0202.331] SetLastError (dwErrCode=0x57) [0202.331] IcmpCreateFile () returned 0x76a380 [0202.331] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b4e8 [0202.331] IcmpSendEcho2 (IcmpHandle=0x76a380, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa800a8c0, RequestData=0x434bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b4e8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3616 os_tid = 0x368c [0202.332] GetLastError () returned 0x57 [0202.333] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a746ce8 [0202.333] SetLastError (dwErrCode=0x57) [0202.333] IcmpCreateFile () returned 0x76a3b8 [0202.333] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b538 [0202.333] IcmpSendEcho2 (IcmpHandle=0x76a3b8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xa900a8c0, RequestData=0x435fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b538, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3617 os_tid = 0x3690 [0202.334] GetLastError () returned 0x57 [0202.334] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a747070 [0202.335] SetLastError (dwErrCode=0x57) [0202.335] IcmpCreateFile () returned 0x76a4d0 [0202.335] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b588 [0202.335] IcmpSendEcho2 (IcmpHandle=0x76a4d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaa00a8c0, RequestData=0x4373ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b588, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3618 os_tid = 0x3694 [0202.336] GetLastError () returned 0x57 [0202.336] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7473f8 [0202.336] SetLastError (dwErrCode=0x57) [0202.336] IcmpCreateFile () returned 0x76a508 [0202.336] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b5d8 [0202.336] IcmpSendEcho2 (IcmpHandle=0x76a508, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xab00a8c0, RequestData=0x4387ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b5d8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3619 os_tid = 0x3698 [0202.338] GetLastError () returned 0x57 [0202.338] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a747780 [0202.338] SetLastError (dwErrCode=0x57) [0202.338] IcmpCreateFile () returned 0x1a76e6e8 [0202.342] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b628 [0202.342] IcmpSendEcho2 (IcmpHandle=0x1a76e6e8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xac00a8c0, RequestData=0x439bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b628, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3620 os_tid = 0x369c [0202.343] GetLastError () returned 0x57 [0202.344] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a740a08 [0202.344] SetLastError (dwErrCode=0x57) [0202.344] IcmpCreateFile () returned 0x1a76e720 [0202.344] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b678 [0202.344] IcmpSendEcho2 (IcmpHandle=0x1a76e720, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xad00a8c0, RequestData=0x43afff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b678, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3621 os_tid = 0x36a0 [0202.345] GetLastError () returned 0x57 [0202.345] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a740d90 [0202.345] SetLastError (dwErrCode=0x57) [0202.345] IcmpCreateFile () returned 0x1a76e758 [0202.345] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b6c8 [0202.345] IcmpSendEcho2 (IcmpHandle=0x1a76e758, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xae00a8c0, RequestData=0x43c3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b6c8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3622 os_tid = 0x36a4 [0202.347] GetLastError () returned 0x57 [0202.347] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a741118 [0202.347] SetLastError (dwErrCode=0x57) [0202.347] IcmpCreateFile () returned 0x1a76e790 [0202.347] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76ad18 [0202.347] IcmpSendEcho2 (IcmpHandle=0x1a76e790, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xaf00a8c0, RequestData=0x43d7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76ad18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3623 os_tid = 0x36a8 [0202.348] GetLastError () returned 0x57 [0202.348] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7414a0 [0202.349] SetLastError (dwErrCode=0x57) [0202.349] IcmpCreateFile () returned 0x1a76e7c8 [0202.349] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76ad68 [0202.349] IcmpSendEcho2 (IcmpHandle=0x1a76e7c8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb000a8c0, RequestData=0x43ebff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76ad68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3624 os_tid = 0x36ac [0202.350] GetLastError () returned 0x57 [0202.350] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a741828 [0202.350] SetLastError (dwErrCode=0x57) [0202.350] IcmpCreateFile () returned 0x1a76e800 [0202.350] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76adb8 [0202.350] IcmpSendEcho2 (IcmpHandle=0x1a76e800, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb100a8c0, RequestData=0x43ffff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76adb8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3625 os_tid = 0x36b0 [0202.351] GetLastError () returned 0x57 [0202.352] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a741bb0 [0202.352] SetLastError (dwErrCode=0x57) [0202.352] IcmpCreateFile () returned 0x1a76e838 [0202.352] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76ae08 [0202.352] IcmpSendEcho2 (IcmpHandle=0x1a76e838, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb200a8c0, RequestData=0x4413ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76ae08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3626 os_tid = 0x36b4 [0202.353] GetLastError () returned 0x57 [0202.353] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a744288 [0202.354] SetLastError (dwErrCode=0x57) [0202.354] IcmpCreateFile () returned 0x1a76e870 [0202.354] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76ae58 [0202.354] IcmpSendEcho2 (IcmpHandle=0x1a76e870, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb300a8c0, RequestData=0x4427ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76ae58, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3627 os_tid = 0x36b8 [0202.355] GetLastError () returned 0x57 [0202.355] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a741f38 [0202.355] SetLastError (dwErrCode=0x57) [0202.355] IcmpCreateFile () returned 0x1a76e8a8 [0202.355] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b7b8 [0202.355] IcmpSendEcho2 (IcmpHandle=0x1a76e8a8, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb500a8c0, RequestData=0x443bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b7b8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3628 os_tid = 0x36bc [0202.357] GetLastError () returned 0x57 [0202.357] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7422c0 [0202.357] SetLastError (dwErrCode=0x57) [0202.357] IcmpCreateFile () returned 0x1a76e528 [0202.357] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b808 [0202.357] IcmpSendEcho2 (IcmpHandle=0x1a76e528, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb600a8c0, RequestData=0x444fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b808, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3629 os_tid = 0x36c0 [0202.358] GetLastError () returned 0x57 [0202.358] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a742648 [0202.358] SetLastError (dwErrCode=0x57) [0202.358] IcmpCreateFile () returned 0x1a76e560 [0202.359] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b858 [0202.359] IcmpSendEcho2 (IcmpHandle=0x1a76e560, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb700a8c0, RequestData=0x4463ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b858, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3630 os_tid = 0x36c4 [0202.363] GetLastError () returned 0x57 [0202.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7429d0 [0202.363] SetLastError (dwErrCode=0x57) [0202.363] IcmpCreateFile () returned 0x1a76e598 [0202.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b718 [0202.363] IcmpSendEcho2 (IcmpHandle=0x1a76e598, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb800a8c0, RequestData=0x4477ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b718, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3631 os_tid = 0x36c8 [0202.365] GetLastError () returned 0x57 [0202.365] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a742d58 [0202.365] SetLastError (dwErrCode=0x57) [0202.365] IcmpCreateFile () returned 0x1a76e5d0 [0202.365] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a76b768 [0202.365] IcmpSendEcho2 (IcmpHandle=0x1a76e5d0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xb900a8c0, RequestData=0x448bff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a76b768, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3632 os_tid = 0x36cc [0202.366] GetLastError () returned 0x57 [0202.367] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7430e0 [0202.367] SetLastError (dwErrCode=0x57) [0202.367] IcmpCreateFile () returned 0x1a76e608 [0202.367] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a769e18 [0202.367] IcmpSendEcho2 (IcmpHandle=0x1a76e608, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xba00a8c0, RequestData=0x449fff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a769e18, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3633 os_tid = 0x36d0 [0202.368] GetLastError () returned 0x57 [0202.368] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a743468 [0202.368] SetLastError (dwErrCode=0x57) [0202.368] IcmpCreateFile () returned 0x1a76e640 [0202.368] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a769e68 [0202.368] IcmpSendEcho2 (IcmpHandle=0x1a76e640, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbb00a8c0, RequestData=0x44b3ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a769e68, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3634 os_tid = 0x36d4 [0202.370] GetLastError () returned 0x57 [0202.370] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a7437f0 [0202.370] SetLastError (dwErrCode=0x57) [0202.370] IcmpCreateFile () returned 0x1a76e678 [0202.370] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a769eb8 [0202.370] IcmpSendEcho2 (IcmpHandle=0x1a76e678, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbc00a8c0, RequestData=0x44c7ff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a769eb8, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3635 os_tid = 0x36d8 [0202.371] GetLastError () returned 0x57 [0202.371] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x364) returned 0x1a743b78 [0202.371] SetLastError (dwErrCode=0x57) [0202.371] IcmpCreateFile () returned 0x1a76e6b0 [0202.371] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x44) returned 0x1a769f08 [0202.372] IcmpSendEcho2 (IcmpHandle=0x1a76e6b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0xbd00a8c0, RequestData=0x44dbff5c, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a769f08, ReplySize=0x44, Timeout=0x2bc) Thread: id = 3636 os_tid = 0x36dc Thread: id = 3637 os_tid = 0x36e0 [0202.408] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.408] ReadFile (in: hFile=0x2174, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.410] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.410] ReadFile (in: hFile=0x2174, lpBuffer=0x1528fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1528f85c, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesRead=0x1528f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.411] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.415] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.415] BCryptSetProperty (in: hObject=0x72dd20, pszProperty="ChainingMode", pbInput=0x1528f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72dd20) returned 0x0 [0202.415] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72dd20, phKey=0x1528f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72dd20, phKey=0x1528f828, pbKeyObject=0x0) returned 0x0 [0202.415] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1528f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0202.416] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.416] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1528f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1528f500) returned 0x0 [0202.421] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.425] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.425] WriteFile (in: hFile=0x2174, lpBuffer=0x1528fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1528f830, lpOverlapped=0x0 | out: lpBuffer=0x1528fb34*, lpNumberOfBytesWritten=0x1528f830*=0x428, lpOverlapped=0x0) returned 1 [0202.425] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.425] ReadFile (in: hFile=0x2174, lpBuffer=0x3b50000, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesRead=0x1528f61c*=0x1a6b8, lpOverlapped=0x0) returned 1 [0202.507] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffe5948, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.507] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3b50000, cbInput=0x1a6b8, pPaddingInfo=0x0, pbIV=0x1528f848, cbIV=0x10, pbOutput=0x3b50000, cbOutput=0x100000, pcbResult=0x1528f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x1528f848, pbOutput=0x3b50000, pcbResult=0x1528f618) returned 0x0 [0202.507] WriteFile (in: hFile=0x2174, lpBuffer=0x3b50000*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x3b50000*, lpNumberOfBytesWritten=0x1528f61c*=0x1a6c0, lpOverlapped=0x0) returned 1 [0202.508] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1528f60c | out: lpNewFilePointer=0x0) returned 1 [0202.508] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.508] WriteFile (in: hFile=0x2174, lpBuffer=0x1528f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1528f61c, lpOverlapped=0x0 | out: lpBuffer=0x1528f83c*, lpNumberOfBytesWritten=0x1528f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.509] SetFilePointerEx (in: hFile=0x2174, liDistanceToMove=0x1a6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.509] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0202.509] CloseHandle (hObject=0x2174) returned 1 [0202.509] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.play")) returned 1 [0202.516] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3638 os_tid = 0x36e4 [0202.521] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.521] ReadFile (in: hFile=0x2ba4, lpBuffer=0x1674fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1674f85c, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesRead=0x1674f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.522] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.522] ReadFile (in: hFile=0x2ba4, lpBuffer=0x1674fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1674f85c, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesRead=0x1674f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.523] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.526] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.526] BCryptSetProperty (in: hObject=0x728550, pszProperty="ChainingMode", pbInput=0x1674f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x728550) returned 0x0 [0202.526] BCryptGenerateSymmetricKey (in: hAlgorithm=0x728550, phKey=0x1674f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x728550, phKey=0x1674f828, pbKeyObject=0x0) returned 0x0 [0202.526] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x1674f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x1674f500) returned 0x0 [0202.526] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.526] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x1674f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x1674f500) returned 0x0 [0202.529] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.533] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.533] WriteFile (in: hFile=0x2ba4, lpBuffer=0x1674fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1674f830, lpOverlapped=0x0 | out: lpBuffer=0x1674fb34*, lpNumberOfBytesWritten=0x1674f830*=0x428, lpOverlapped=0x0) returned 1 [0202.534] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.534] ReadFile (in: hFile=0x2ba4, lpBuffer=0x2750000, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesRead=0x1674f61c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0202.535] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0xfffe5828, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.535] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x2750000, cbInput=0x1a7d8, pPaddingInfo=0x0, pbIV=0x1674f848, cbIV=0x10, pbOutput=0x2750000, cbOutput=0x100000, pcbResult=0x1674f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x1674f848, pbOutput=0x2750000, pcbResult=0x1674f618) returned 0x0 [0202.535] WriteFile (in: hFile=0x2ba4, lpBuffer=0x2750000*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x2750000*, lpNumberOfBytesWritten=0x1674f61c*=0x1a7e0, lpOverlapped=0x0) returned 1 [0202.536] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1674f60c | out: lpNewFilePointer=0x0) returned 1 [0202.536] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.536] WriteFile (in: hFile=0x2ba4, lpBuffer=0x1674f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1674f61c, lpOverlapped=0x0 | out: lpBuffer=0x1674f83c*, lpNumberOfBytesWritten=0x1674f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.536] SetFilePointerEx (in: hFile=0x2ba4, liDistanceToMove=0x1a7e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.536] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0202.536] CloseHandle (hObject=0x2ba4) returned 1 [0202.536] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.play")) returned 1 [0202.541] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3639 os_tid = 0x36e8 [0202.547] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.547] ReadFile (in: hFile=0x2bac, lpBuffer=0x4503fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4503f85c, lpOverlapped=0x0 | out: lpBuffer=0x4503fb34*, lpNumberOfBytesRead=0x4503f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.566] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.566] ReadFile (in: hFile=0x2bac, lpBuffer=0x4503fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4503f85c, lpOverlapped=0x0 | out: lpBuffer=0x4503fb34*, lpNumberOfBytesRead=0x4503f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.567] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.572] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.572] BCryptSetProperty (in: hObject=0x72de80, pszProperty="ChainingMode", pbInput=0x4503f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72de80) returned 0x0 [0202.572] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72de80, phKey=0x4503f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72de80, phKey=0x4503f828, pbKeyObject=0x0) returned 0x0 [0202.572] BCryptExportKey (in: hKey=0x7f1770, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4503f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4503f500) returned 0x0 [0202.572] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.572] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4503f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4503f500) returned 0x0 [0202.577] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.582] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.582] WriteFile (in: hFile=0x2bac, lpBuffer=0x4503fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4503f830, lpOverlapped=0x0 | out: lpBuffer=0x4503fb34*, lpNumberOfBytesWritten=0x4503f830*=0x428, lpOverlapped=0x0) returned 1 [0202.582] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.582] ReadFile (in: hFile=0x2bac, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x4503f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x4503f61c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0202.584] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0xfffe5828, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.585] BCryptEncrypt (in: hKey=0x7f1770, pbInput=0x3c50000, cbInput=0x1a7d8, pPaddingInfo=0x0, pbIV=0x4503f848, cbIV=0x10, pbOutput=0x3c50000, cbOutput=0x100000, pcbResult=0x4503f618, dwFlags=0x1 | out: hKey=0x7f1770, pbIV=0x4503f848, pbOutput=0x3c50000, pcbResult=0x4503f618) returned 0x0 [0202.585] WriteFile (in: hFile=0x2bac, lpBuffer=0x3c50000*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x4503f61c, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesWritten=0x4503f61c*=0x1a7e0, lpOverlapped=0x0) returned 1 [0202.585] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4503f60c | out: lpNewFilePointer=0x0) returned 1 [0202.585] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.585] WriteFile (in: hFile=0x2bac, lpBuffer=0x4503f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4503f61c, lpOverlapped=0x0 | out: lpBuffer=0x4503f83c*, lpNumberOfBytesWritten=0x4503f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.586] SetFilePointerEx (in: hFile=0x2bac, liDistanceToMove=0x1a7e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.586] BCryptDestroyKey (in: hKey=0x7f1770 | out: hKey=0x7f1770) returned 0x0 [0202.586] CloseHandle (hObject=0x2bac) returned 1 [0202.586] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.play")) returned 1 [0202.592] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) Thread: id = 3640 os_tid = 0x36ec [0202.602] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.602] ReadFile (in: hFile=0x2bb4, lpBuffer=0x4517fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4517f85c, lpOverlapped=0x0 | out: lpBuffer=0x4517fb34*, lpNumberOfBytesRead=0x4517f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.604] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.604] ReadFile (in: hFile=0x2bb4, lpBuffer=0x4517fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4517f85c, lpOverlapped=0x0 | out: lpBuffer=0x4517fb34*, lpNumberOfBytesRead=0x4517f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.604] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.608] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.608] BCryptSetProperty (in: hObject=0x72d850, pszProperty="ChainingMode", pbInput=0x4517f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d850) returned 0x0 [0202.608] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d850, phKey=0x4517f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d850, phKey=0x4517f828, pbKeyObject=0x0) returned 0x0 [0202.608] BCryptExportKey (in: hKey=0x7f2e40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4517f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4517f500) returned 0x0 [0202.609] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.609] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4517f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4517f500) returned 0x0 [0202.614] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.619] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.619] WriteFile (in: hFile=0x2bb4, lpBuffer=0x4517fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4517f830, lpOverlapped=0x0 | out: lpBuffer=0x4517fb34*, lpNumberOfBytesWritten=0x4517f830*=0x428, lpOverlapped=0x0) returned 1 [0202.619] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.619] ReadFile (in: hFile=0x2bb4, lpBuffer=0x3d50000, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x4517f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesRead=0x4517f61c*=0x30408, lpOverlapped=0x0) returned 1 [0202.622] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0xfffcfbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.622] BCryptEncrypt (in: hKey=0x7f2e40, pbInput=0x3d50000, cbInput=0x30408, pPaddingInfo=0x0, pbIV=0x4517f848, cbIV=0x10, pbOutput=0x3d50000, cbOutput=0x100000, pcbResult=0x4517f618, dwFlags=0x1 | out: hKey=0x7f2e40, pbIV=0x4517f848, pbOutput=0x3d50000, pcbResult=0x4517f618) returned 0x0 [0202.623] WriteFile (in: hFile=0x2bb4, lpBuffer=0x3d50000*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x4517f61c, lpOverlapped=0x0 | out: lpBuffer=0x3d50000*, lpNumberOfBytesWritten=0x4517f61c*=0x30410, lpOverlapped=0x0) returned 1 [0202.623] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4517f60c | out: lpNewFilePointer=0x0) returned 1 [0202.624] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.624] WriteFile (in: hFile=0x2bb4, lpBuffer=0x4517f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4517f61c, lpOverlapped=0x0 | out: lpBuffer=0x4517f83c*, lpNumberOfBytesWritten=0x4517f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.624] SetFilePointerEx (in: hFile=0x2bb4, liDistanceToMove=0x30410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.624] BCryptDestroyKey (in: hKey=0x7f2e40 | out: hKey=0x7f2e40) returned 0x0 [0202.624] CloseHandle (hObject=0x2bb4) returned 1 [0202.624] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.629] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.play")) returned 1 [0202.631] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3641 os_tid = 0x36f0 [0202.636] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.636] ReadFile (in: hFile=0x2bbc, lpBuffer=0x452bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x452bf85c, lpOverlapped=0x0 | out: lpBuffer=0x452bfb34*, lpNumberOfBytesRead=0x452bf85c*=0x428, lpOverlapped=0x0) returned 1 [0202.638] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.638] ReadFile (in: hFile=0x2bbc, lpBuffer=0x452bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x452bf85c, lpOverlapped=0x0 | out: lpBuffer=0x452bfb34*, lpNumberOfBytesRead=0x452bf85c*=0x428, lpOverlapped=0x0) returned 1 [0202.638] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.642] BCryptSetProperty (in: hObject=0x72ddd0, pszProperty="ChainingMode", pbInput=0x452bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72ddd0) returned 0x0 [0202.642] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72ddd0, phKey=0x452bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72ddd0, phKey=0x452bf828, pbKeyObject=0x0) returned 0x0 [0202.642] BCryptExportKey (in: hKey=0x7f2e40, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x452bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x452bf500) returned 0x0 [0202.642] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.643] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x452bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x452bf500) returned 0x0 [0202.647] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.652] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.652] WriteFile (in: hFile=0x2bbc, lpBuffer=0x452bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x452bf830, lpOverlapped=0x0 | out: lpBuffer=0x452bfb34*, lpNumberOfBytesWritten=0x452bf830*=0x428, lpOverlapped=0x0) returned 1 [0202.652] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.653] ReadFile (in: hFile=0x2bbc, lpBuffer=0x3e50000, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x452bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesRead=0x452bf61c*=0x30408, lpOverlapped=0x0) returned 1 [0202.656] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0xfffcfbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.656] BCryptEncrypt (in: hKey=0x7f2e40, pbInput=0x3e50000, cbInput=0x30408, pPaddingInfo=0x0, pbIV=0x452bf848, cbIV=0x10, pbOutput=0x3e50000, cbOutput=0x100000, pcbResult=0x452bf618, dwFlags=0x1 | out: hKey=0x7f2e40, pbIV=0x452bf848, pbOutput=0x3e50000, pcbResult=0x452bf618) returned 0x0 [0202.656] WriteFile (in: hFile=0x2bbc, lpBuffer=0x3e50000*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x452bf61c, lpOverlapped=0x0 | out: lpBuffer=0x3e50000*, lpNumberOfBytesWritten=0x452bf61c*=0x30410, lpOverlapped=0x0) returned 1 [0202.657] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x452bf60c | out: lpNewFilePointer=0x0) returned 1 [0202.657] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.657] WriteFile (in: hFile=0x2bbc, lpBuffer=0x452bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x452bf61c, lpOverlapped=0x0 | out: lpBuffer=0x452bf83c*, lpNumberOfBytesWritten=0x452bf61c*=0x8, lpOverlapped=0x0) returned 1 [0202.657] SetFilePointerEx (in: hFile=0x2bbc, liDistanceToMove=0x30410, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.657] BCryptDestroyKey (in: hKey=0x7f2e40 | out: hKey=0x7f2e40) returned 0x0 [0202.657] CloseHandle (hObject=0x2bbc) returned 1 [0202.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.play")) returned 1 [0202.665] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3642 os_tid = 0x36f4 [0202.654] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.670] ReadFile (in: hFile=0x2bc4, lpBuffer=0x453ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x453ff85c, lpOverlapped=0x0 | out: lpBuffer=0x453ffb34*, lpNumberOfBytesRead=0x453ff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.672] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.672] ReadFile (in: hFile=0x2bc4, lpBuffer=0x453ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x453ff85c, lpOverlapped=0x0 | out: lpBuffer=0x453ffb34*, lpNumberOfBytesRead=0x453ff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.677] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.678] BCryptSetProperty (in: hObject=0x72df30, pszProperty="ChainingMode", pbInput=0x453ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72df30) returned 0x0 [0202.678] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72df30, phKey=0x453ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72df30, phKey=0x453ff828, pbKeyObject=0x0) returned 0x0 [0202.678] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x453ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x453ff500) returned 0x0 [0202.678] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.678] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x453ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x453ff500) returned 0x0 [0202.683] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.688] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.688] WriteFile (in: hFile=0x2bc4, lpBuffer=0x453ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x453ff830, lpOverlapped=0x0 | out: lpBuffer=0x453ffb34*, lpNumberOfBytesWritten=0x453ff830*=0x428, lpOverlapped=0x0) returned 1 [0202.688] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.688] ReadFile (in: hFile=0x2bc4, lpBuffer=0x3f50000, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x453ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesRead=0x453ff61c*=0x307f8, lpOverlapped=0x0) returned 1 [0202.692] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0xfffcf808, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.693] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x3f50000, cbInput=0x307f8, pPaddingInfo=0x0, pbIV=0x453ff848, cbIV=0x10, pbOutput=0x3f50000, cbOutput=0x100000, pcbResult=0x453ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x453ff848, pbOutput=0x3f50000, pcbResult=0x453ff618) returned 0x0 [0202.693] WriteFile (in: hFile=0x2bc4, lpBuffer=0x3f50000*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x453ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3f50000*, lpNumberOfBytesWritten=0x453ff61c*=0x30800, lpOverlapped=0x0) returned 1 [0202.694] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x453ff60c | out: lpNewFilePointer=0x0) returned 1 [0202.694] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.694] WriteFile (in: hFile=0x2bc4, lpBuffer=0x453ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x453ff61c, lpOverlapped=0x0 | out: lpBuffer=0x453ff83c*, lpNumberOfBytesWritten=0x453ff61c*=0x8, lpOverlapped=0x0) returned 1 [0202.694] SetFilePointerEx (in: hFile=0x2bc4, liDistanceToMove=0x30800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.694] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.694] CloseHandle (hObject=0x2bc4) returned 1 [0202.694] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.play")) returned 1 [0202.701] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) Thread: id = 3643 os_tid = 0x36f8 [0202.706] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.706] ReadFile (in: hFile=0x2bcc, lpBuffer=0x4553fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4553f85c, lpOverlapped=0x0 | out: lpBuffer=0x4553fb34*, lpNumberOfBytesRead=0x4553f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.708] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.708] ReadFile (in: hFile=0x2bcc, lpBuffer=0x4553fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4553f85c, lpOverlapped=0x0 | out: lpBuffer=0x4553fb34*, lpNumberOfBytesRead=0x4553f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.708] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.712] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.712] BCryptSetProperty (in: hObject=0x72d900, pszProperty="ChainingMode", pbInput=0x4553f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x72d900) returned 0x0 [0202.712] BCryptGenerateSymmetricKey (in: hAlgorithm=0x72d900, phKey=0x4553f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x72d900, phKey=0x4553f828, pbKeyObject=0x0) returned 0x0 [0202.712] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4553f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4553f500) returned 0x0 [0202.712] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.713] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4553f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4553f500) returned 0x0 [0202.717] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.722] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.722] WriteFile (in: hFile=0x2bcc, lpBuffer=0x4553fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4553f830, lpOverlapped=0x0 | out: lpBuffer=0x4553fb34*, lpNumberOfBytesWritten=0x4553f830*=0x428, lpOverlapped=0x0) returned 1 [0202.722] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.722] ReadFile (in: hFile=0x2bcc, lpBuffer=0x4050000, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x4553f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesRead=0x4553f61c*=0xa0d2, lpOverlapped=0x0) returned 1 [0202.723] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0xffff5f2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.723] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4050000, cbInput=0xa0d2, pPaddingInfo=0x0, pbIV=0x4553f848, cbIV=0x10, pbOutput=0x4050000, cbOutput=0x100000, pcbResult=0x4553f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4553f848, pbOutput=0x4050000, pcbResult=0x4553f618) returned 0x0 [0202.723] WriteFile (in: hFile=0x2bcc, lpBuffer=0x4050000*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x4553f61c, lpOverlapped=0x0 | out: lpBuffer=0x4050000*, lpNumberOfBytesWritten=0x4553f61c*=0xa0e0, lpOverlapped=0x0) returned 1 [0202.724] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4553f60c | out: lpNewFilePointer=0x0) returned 1 [0202.724] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.724] WriteFile (in: hFile=0x2bcc, lpBuffer=0x4553f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4553f61c, lpOverlapped=0x0 | out: lpBuffer=0x4553f83c*, lpNumberOfBytesWritten=0x4553f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.724] SetFilePointerEx (in: hFile=0x2bcc, liDistanceToMove=0xa0e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.724] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.724] CloseHandle (hObject=0x2bcc) returned 1 [0202.724] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.728] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.play")) returned 1 [0202.730] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3644 os_tid = 0x36fc [0202.738] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.738] ReadFile (in: hFile=0x2bd4, lpBuffer=0x4567fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4567f85c, lpOverlapped=0x0 | out: lpBuffer=0x4567fb34*, lpNumberOfBytesRead=0x4567f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.740] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.740] ReadFile (in: hFile=0x2bd4, lpBuffer=0x4567fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4567f85c, lpOverlapped=0x0 | out: lpBuffer=0x4567fb34*, lpNumberOfBytesRead=0x4567f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.741] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.745] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.745] BCryptSetProperty (in: hObject=0x733990, pszProperty="ChainingMode", pbInput=0x4567f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733990) returned 0x0 [0202.745] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733990, phKey=0x4567f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733990, phKey=0x4567f828, pbKeyObject=0x0) returned 0x0 [0202.745] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4567f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4567f500) returned 0x0 [0202.745] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.745] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4567f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4567f500) returned 0x0 [0202.750] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.754] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.755] WriteFile (in: hFile=0x2bd4, lpBuffer=0x4567fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4567f830, lpOverlapped=0x0 | out: lpBuffer=0x4567fb34*, lpNumberOfBytesWritten=0x4567f830*=0x428, lpOverlapped=0x0) returned 1 [0202.755] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.755] ReadFile (in: hFile=0x2bd4, lpBuffer=0x4150000, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x4567f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesRead=0x4567f61c*=0xc5d7, lpOverlapped=0x0) returned 1 [0202.756] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0xffff3a29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.756] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4150000, cbInput=0xc5d7, pPaddingInfo=0x0, pbIV=0x4567f848, cbIV=0x10, pbOutput=0x4150000, cbOutput=0x100000, pcbResult=0x4567f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4567f848, pbOutput=0x4150000, pcbResult=0x4567f618) returned 0x0 [0202.756] WriteFile (in: hFile=0x2bd4, lpBuffer=0x4150000*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x4567f61c, lpOverlapped=0x0 | out: lpBuffer=0x4150000*, lpNumberOfBytesWritten=0x4567f61c*=0xc5e0, lpOverlapped=0x0) returned 1 [0202.757] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4567f60c | out: lpNewFilePointer=0x0) returned 1 [0202.757] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.757] WriteFile (in: hFile=0x2bd4, lpBuffer=0x4567f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4567f61c, lpOverlapped=0x0 | out: lpBuffer=0x4567f83c*, lpNumberOfBytesWritten=0x4567f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.757] SetFilePointerEx (in: hFile=0x2bd4, liDistanceToMove=0xc5e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.757] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.757] CloseHandle (hObject=0x2bd4) returned 1 [0202.757] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.play")) returned 1 [0202.763] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3645 os_tid = 0x3700 [0202.770] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.770] ReadFile (in: hFile=0x2bdc, lpBuffer=0x457bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x457bf85c, lpOverlapped=0x0 | out: lpBuffer=0x457bfb34*, lpNumberOfBytesRead=0x457bf85c*=0x428, lpOverlapped=0x0) returned 1 [0202.772] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.772] ReadFile (in: hFile=0x2bdc, lpBuffer=0x457bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x457bf85c, lpOverlapped=0x0 | out: lpBuffer=0x457bfb34*, lpNumberOfBytesRead=0x457bf85c*=0x428, lpOverlapped=0x0) returned 1 [0202.773] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.776] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.777] BCryptSetProperty (in: hObject=0x7332b0, pszProperty="ChainingMode", pbInput=0x457bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7332b0) returned 0x0 [0202.777] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7332b0, phKey=0x457bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7332b0, phKey=0x457bf828, pbKeyObject=0x0) returned 0x0 [0202.777] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x457bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x457bf500) returned 0x0 [0202.777] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.777] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x457bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x457bf500) returned 0x0 [0202.782] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.786] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.786] WriteFile (in: hFile=0x2bdc, lpBuffer=0x457bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x457bf830, lpOverlapped=0x0 | out: lpBuffer=0x457bfb34*, lpNumberOfBytesWritten=0x457bf830*=0x428, lpOverlapped=0x0) returned 1 [0202.787] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.787] ReadFile (in: hFile=0x2bdc, lpBuffer=0x4250000, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x457bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesRead=0x457bf61c*=0xf438, lpOverlapped=0x0) returned 1 [0202.788] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0xffff0bc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.788] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4250000, cbInput=0xf438, pPaddingInfo=0x0, pbIV=0x457bf848, cbIV=0x10, pbOutput=0x4250000, cbOutput=0x100000, pcbResult=0x457bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x457bf848, pbOutput=0x4250000, pcbResult=0x457bf618) returned 0x0 [0202.788] WriteFile (in: hFile=0x2bdc, lpBuffer=0x4250000*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x457bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4250000*, lpNumberOfBytesWritten=0x457bf61c*=0xf440, lpOverlapped=0x0) returned 1 [0202.789] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x457bf60c | out: lpNewFilePointer=0x0) returned 1 [0202.789] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.789] WriteFile (in: hFile=0x2bdc, lpBuffer=0x457bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x457bf61c, lpOverlapped=0x0 | out: lpBuffer=0x457bf83c*, lpNumberOfBytesWritten=0x457bf61c*=0x8, lpOverlapped=0x0) returned 1 [0202.789] SetFilePointerEx (in: hFile=0x2bdc, liDistanceToMove=0xf440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.789] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.789] CloseHandle (hObject=0x2bdc) returned 1 [0202.789] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.play")) returned 1 [0202.795] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3646 os_tid = 0x3704 [0202.801] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.802] ReadFile (in: hFile=0x2be4, lpBuffer=0x458ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x458ff85c, lpOverlapped=0x0 | out: lpBuffer=0x458ffb34*, lpNumberOfBytesRead=0x458ff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.803] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.803] ReadFile (in: hFile=0x2be4, lpBuffer=0x458ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x458ff85c, lpOverlapped=0x0 | out: lpBuffer=0x458ffb34*, lpNumberOfBytesRead=0x458ff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.804] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.807] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.807] BCryptSetProperty (in: hObject=0x733830, pszProperty="ChainingMode", pbInput=0x458ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733830) returned 0x0 [0202.807] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733830, phKey=0x458ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733830, phKey=0x458ff828, pbKeyObject=0x0) returned 0x0 [0202.807] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x458ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x458ff500) returned 0x0 [0202.808] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.808] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x458ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x458ff500) returned 0x0 [0202.812] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.817] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.817] WriteFile (in: hFile=0x2be4, lpBuffer=0x458ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x458ff830, lpOverlapped=0x0 | out: lpBuffer=0x458ffb34*, lpNumberOfBytesWritten=0x458ff830*=0x428, lpOverlapped=0x0) returned 1 [0202.817] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.817] ReadFile (in: hFile=0x2be4, lpBuffer=0x4350000, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x458ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesRead=0x458ff61c*=0x30f2, lpOverlapped=0x0) returned 1 [0202.818] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0xffffcf0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.818] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4350000, cbInput=0x30f2, pPaddingInfo=0x0, pbIV=0x458ff848, cbIV=0x10, pbOutput=0x4350000, cbOutput=0x100000, pcbResult=0x458ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x458ff848, pbOutput=0x4350000, pcbResult=0x458ff618) returned 0x0 [0202.818] WriteFile (in: hFile=0x2be4, lpBuffer=0x4350000*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x458ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4350000*, lpNumberOfBytesWritten=0x458ff61c*=0x3100, lpOverlapped=0x0) returned 1 [0202.819] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x458ff60c | out: lpNewFilePointer=0x0) returned 1 [0202.819] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.819] WriteFile (in: hFile=0x2be4, lpBuffer=0x458ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x458ff61c, lpOverlapped=0x0 | out: lpBuffer=0x458ff83c*, lpNumberOfBytesWritten=0x458ff61c*=0x8, lpOverlapped=0x0) returned 1 [0202.819] SetFilePointerEx (in: hFile=0x2be4, liDistanceToMove=0x3100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.819] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.819] CloseHandle (hObject=0x2be4) returned 1 [0202.819] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.823] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.play")) returned 1 [0202.825] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3647 os_tid = 0x3708 [0202.832] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.832] ReadFile (in: hFile=0x2bec, lpBuffer=0x45a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x45a3fb34*, lpNumberOfBytesRead=0x45a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.834] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.835] ReadFile (in: hFile=0x2bec, lpBuffer=0x45a3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45a3f85c, lpOverlapped=0x0 | out: lpBuffer=0x45a3fb34*, lpNumberOfBytesRead=0x45a3f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.835] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.839] BCryptSetProperty (in: hObject=0x733780, pszProperty="ChainingMode", pbInput=0x45a3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733780) returned 0x0 [0202.839] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733780, phKey=0x45a3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733780, phKey=0x45a3f828, pbKeyObject=0x0) returned 0x0 [0202.839] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x45a3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x45a3f500) returned 0x0 [0202.839] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.839] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x45a3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x45a3f500) returned 0x0 [0202.844] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.849] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.849] WriteFile (in: hFile=0x2bec, lpBuffer=0x45a3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x45a3f830, lpOverlapped=0x0 | out: lpBuffer=0x45a3fb34*, lpNumberOfBytesWritten=0x45a3f830*=0x428, lpOverlapped=0x0) returned 1 [0202.849] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.849] ReadFile (in: hFile=0x2bec, lpBuffer=0x4450000, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x45a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesRead=0x45a3f61c*=0x3c45, lpOverlapped=0x0) returned 1 [0202.850] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0xffffc3bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.850] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4450000, cbInput=0x3c45, pPaddingInfo=0x0, pbIV=0x45a3f848, cbIV=0x10, pbOutput=0x4450000, cbOutput=0x100000, pcbResult=0x45a3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x45a3f848, pbOutput=0x4450000, pcbResult=0x45a3f618) returned 0x0 [0202.850] WriteFile (in: hFile=0x2bec, lpBuffer=0x4450000*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x45a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4450000*, lpNumberOfBytesWritten=0x45a3f61c*=0x3c50, lpOverlapped=0x0) returned 1 [0202.851] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x45a3f60c | out: lpNewFilePointer=0x0) returned 1 [0202.851] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.851] WriteFile (in: hFile=0x2bec, lpBuffer=0x45a3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45a3f61c, lpOverlapped=0x0 | out: lpBuffer=0x45a3f83c*, lpNumberOfBytesWritten=0x45a3f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.851] SetFilePointerEx (in: hFile=0x2bec, liDistanceToMove=0x3c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.851] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.851] CloseHandle (hObject=0x2bec) returned 1 [0202.851] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.play")) returned 1 [0202.857] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3648 os_tid = 0x370c [0202.863] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.863] ReadFile (in: hFile=0x2bf4, lpBuffer=0x45b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x45b7fb34*, lpNumberOfBytesRead=0x45b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.865] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.865] ReadFile (in: hFile=0x2bf4, lpBuffer=0x45b7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45b7f85c, lpOverlapped=0x0 | out: lpBuffer=0x45b7fb34*, lpNumberOfBytesRead=0x45b7f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.865] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.869] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.869] BCryptSetProperty (in: hObject=0x733360, pszProperty="ChainingMode", pbInput=0x45b7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733360) returned 0x0 [0202.870] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733360, phKey=0x45b7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733360, phKey=0x45b7f828, pbKeyObject=0x0) returned 0x0 [0202.870] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x45b7f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x45b7f500) returned 0x0 [0202.870] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.870] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x45b7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x45b7f500) returned 0x0 [0202.875] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.880] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.880] WriteFile (in: hFile=0x2bf4, lpBuffer=0x45b7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x45b7f830, lpOverlapped=0x0 | out: lpBuffer=0x45b7fb34*, lpNumberOfBytesWritten=0x45b7f830*=0x428, lpOverlapped=0x0) returned 1 [0202.880] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.880] ReadFile (in: hFile=0x2bf4, lpBuffer=0x4550000, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x45b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesRead=0x45b7f61c*=0x3c76, lpOverlapped=0x0) returned 1 [0202.881] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0xffffc38a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.881] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4550000, cbInput=0x3c76, pPaddingInfo=0x0, pbIV=0x45b7f848, cbIV=0x10, pbOutput=0x4550000, cbOutput=0x100000, pcbResult=0x45b7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x45b7f848, pbOutput=0x4550000, pcbResult=0x45b7f618) returned 0x0 [0202.881] WriteFile (in: hFile=0x2bf4, lpBuffer=0x4550000*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x45b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x4550000*, lpNumberOfBytesWritten=0x45b7f61c*=0x3c80, lpOverlapped=0x0) returned 1 [0202.882] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x45b7f60c | out: lpNewFilePointer=0x0) returned 1 [0202.882] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.882] WriteFile (in: hFile=0x2bf4, lpBuffer=0x45b7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45b7f61c, lpOverlapped=0x0 | out: lpBuffer=0x45b7f83c*, lpNumberOfBytesWritten=0x45b7f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.882] SetFilePointerEx (in: hFile=0x2bf4, liDistanceToMove=0x3c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.882] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.882] CloseHandle (hObject=0x2bf4) returned 1 [0202.882] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.play")) returned 1 [0202.888] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3649 os_tid = 0x3710 [0202.894] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.894] ReadFile (in: hFile=0x2bfc, lpBuffer=0x45cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x45cbfb34*, lpNumberOfBytesRead=0x45cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0202.896] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.896] ReadFile (in: hFile=0x2bfc, lpBuffer=0x45cbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45cbf85c, lpOverlapped=0x0 | out: lpBuffer=0x45cbfb34*, lpNumberOfBytesRead=0x45cbf85c*=0x428, lpOverlapped=0x0) returned 1 [0202.896] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.900] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.900] BCryptSetProperty (in: hObject=0x733a40, pszProperty="ChainingMode", pbInput=0x45cbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733a40) returned 0x0 [0202.901] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733a40, phKey=0x45cbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733a40, phKey=0x45cbf828, pbKeyObject=0x0) returned 0x0 [0202.901] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x45cbf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x45cbf500) returned 0x0 [0202.901] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.901] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x45cbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x45cbf500) returned 0x0 [0202.906] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.911] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.911] WriteFile (in: hFile=0x2bfc, lpBuffer=0x45cbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x45cbf830, lpOverlapped=0x0 | out: lpBuffer=0x45cbfb34*, lpNumberOfBytesWritten=0x45cbf830*=0x428, lpOverlapped=0x0) returned 1 [0202.911] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.911] ReadFile (in: hFile=0x2bfc, lpBuffer=0x4650000, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x45cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesRead=0x45cbf61c*=0x1016, lpOverlapped=0x0) returned 1 [0202.911] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0xffffefea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.911] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4650000, cbInput=0x1016, pPaddingInfo=0x0, pbIV=0x45cbf848, cbIV=0x10, pbOutput=0x4650000, cbOutput=0x100000, pcbResult=0x45cbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x45cbf848, pbOutput=0x4650000, pcbResult=0x45cbf618) returned 0x0 [0202.912] WriteFile (in: hFile=0x2bfc, lpBuffer=0x4650000*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x45cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x4650000*, lpNumberOfBytesWritten=0x45cbf61c*=0x1020, lpOverlapped=0x0) returned 1 [0202.912] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x45cbf60c | out: lpNewFilePointer=0x0) returned 1 [0202.912] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.912] WriteFile (in: hFile=0x2bfc, lpBuffer=0x45cbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45cbf61c, lpOverlapped=0x0 | out: lpBuffer=0x45cbf83c*, lpNumberOfBytesWritten=0x45cbf61c*=0x8, lpOverlapped=0x0) returned 1 [0202.912] SetFilePointerEx (in: hFile=0x2bfc, liDistanceToMove=0x1020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.912] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.912] CloseHandle (hObject=0x2bfc) returned 1 [0202.912] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.play")) returned 1 [0202.919] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3650 os_tid = 0x3714 [0202.940] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.940] ReadFile (in: hFile=0x2c08, lpBuffer=0x45dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45dff85c, lpOverlapped=0x0 | out: lpBuffer=0x45dffb34*, lpNumberOfBytesRead=0x45dff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.942] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.942] ReadFile (in: hFile=0x2c08, lpBuffer=0x45dffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45dff85c, lpOverlapped=0x0 | out: lpBuffer=0x45dffb34*, lpNumberOfBytesRead=0x45dff85c*=0x428, lpOverlapped=0x0) returned 1 [0202.942] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.946] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.947] BCryptSetProperty (in: hObject=0x7338e0, pszProperty="ChainingMode", pbInput=0x45dff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7338e0) returned 0x0 [0202.947] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7338e0, phKey=0x45dff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7338e0, phKey=0x45dff828, pbKeyObject=0x0) returned 0x0 [0202.947] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x45dff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x45dff500) returned 0x0 [0202.947] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.947] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x45dff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x45dff500) returned 0x0 [0202.952] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.957] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.958] WriteFile (in: hFile=0x2c08, lpBuffer=0x45dffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x45dff830, lpOverlapped=0x0 | out: lpBuffer=0x45dffb34*, lpNumberOfBytesWritten=0x45dff830*=0x428, lpOverlapped=0x0) returned 1 [0202.958] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.958] ReadFile (in: hFile=0x2c08, lpBuffer=0x4750000, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x45dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesRead=0x45dff61c*=0x49d2, lpOverlapped=0x0) returned 1 [0202.959] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0xffffb62e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.959] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4750000, cbInput=0x49d2, pPaddingInfo=0x0, pbIV=0x45dff848, cbIV=0x10, pbOutput=0x4750000, cbOutput=0x100000, pcbResult=0x45dff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x45dff848, pbOutput=0x4750000, pcbResult=0x45dff618) returned 0x0 [0202.959] WriteFile (in: hFile=0x2c08, lpBuffer=0x4750000*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x45dff61c, lpOverlapped=0x0 | out: lpBuffer=0x4750000*, lpNumberOfBytesWritten=0x45dff61c*=0x49e0, lpOverlapped=0x0) returned 1 [0202.959] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x45dff60c | out: lpNewFilePointer=0x0) returned 1 [0202.959] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.959] WriteFile (in: hFile=0x2c08, lpBuffer=0x45dff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45dff61c, lpOverlapped=0x0 | out: lpBuffer=0x45dff83c*, lpNumberOfBytesWritten=0x45dff61c*=0x8, lpOverlapped=0x0) returned 1 [0202.960] SetFilePointerEx (in: hFile=0x2c08, liDistanceToMove=0x49e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.960] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.960] CloseHandle (hObject=0x2c08) returned 1 [0202.960] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.play")) returned 1 [0202.966] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3651 os_tid = 0x3718 [0202.972] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.972] ReadFile (in: hFile=0x2c10, lpBuffer=0x45f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x45f3fb34*, lpNumberOfBytesRead=0x45f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.973] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.973] ReadFile (in: hFile=0x2c10, lpBuffer=0x45f3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x45f3f85c, lpOverlapped=0x0 | out: lpBuffer=0x45f3fb34*, lpNumberOfBytesRead=0x45f3f85c*=0x428, lpOverlapped=0x0) returned 1 [0202.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0202.978] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0202.978] BCryptSetProperty (in: hObject=0x733af0, pszProperty="ChainingMode", pbInput=0x45f3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733af0) returned 0x0 [0202.978] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733af0, phKey=0x45f3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733af0, phKey=0x45f3f828, pbKeyObject=0x0) returned 0x0 [0202.978] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x45f3f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x45f3f500) returned 0x0 [0202.978] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0202.979] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x45f3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x45f3f500) returned 0x0 [0202.984] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.990] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.991] WriteFile (in: hFile=0x2c10, lpBuffer=0x45f3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x45f3f830, lpOverlapped=0x0 | out: lpBuffer=0x45f3fb34*, lpNumberOfBytesWritten=0x45f3f830*=0x428, lpOverlapped=0x0) returned 1 [0202.991] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.991] ReadFile (in: hFile=0x2c10, lpBuffer=0x4850000, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x45f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesRead=0x45f3f61c*=0x78af, lpOverlapped=0x0) returned 1 [0202.992] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0xffff8751, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.992] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4850000, cbInput=0x78af, pPaddingInfo=0x0, pbIV=0x45f3f848, cbIV=0x10, pbOutput=0x4850000, cbOutput=0x100000, pcbResult=0x45f3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x45f3f848, pbOutput=0x4850000, pcbResult=0x45f3f618) returned 0x0 [0202.992] WriteFile (in: hFile=0x2c10, lpBuffer=0x4850000*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x45f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x4850000*, lpNumberOfBytesWritten=0x45f3f61c*=0x78b0, lpOverlapped=0x0) returned 1 [0202.992] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x45f3f60c | out: lpNewFilePointer=0x0) returned 1 [0202.992] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.992] WriteFile (in: hFile=0x2c10, lpBuffer=0x45f3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45f3f61c, lpOverlapped=0x0 | out: lpBuffer=0x45f3f83c*, lpNumberOfBytesWritten=0x45f3f61c*=0x8, lpOverlapped=0x0) returned 1 [0202.992] SetFilePointerEx (in: hFile=0x2c10, liDistanceToMove=0x78b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.992] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0202.992] CloseHandle (hObject=0x2c10) returned 1 [0202.993] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0202.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.play")) returned 1 [0202.998] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3652 os_tid = 0x371c [0203.002] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.003] ReadFile (in: hFile=0x2c18, lpBuffer=0x4607fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4607f85c, lpOverlapped=0x0 | out: lpBuffer=0x4607fb34*, lpNumberOfBytesRead=0x4607f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.004] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.004] ReadFile (in: hFile=0x2c18, lpBuffer=0x4607fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4607f85c, lpOverlapped=0x0 | out: lpBuffer=0x4607fb34*, lpNumberOfBytesRead=0x4607f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.005] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0203.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0203.008] BCryptSetProperty (in: hObject=0x733ba0, pszProperty="ChainingMode", pbInput=0x4607f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733ba0) returned 0x0 [0203.008] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733ba0, phKey=0x4607f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733ba0, phKey=0x4607f828, pbKeyObject=0x0) returned 0x0 [0203.008] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x4607f500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x4607f500) returned 0x0 [0203.008] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0203.008] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x4607f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x4607f500) returned 0x0 [0203.012] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.016] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.016] WriteFile (in: hFile=0x2c18, lpBuffer=0x4607fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4607f830, lpOverlapped=0x0 | out: lpBuffer=0x4607fb34*, lpNumberOfBytesWritten=0x4607f830*=0x428, lpOverlapped=0x0) returned 1 [0203.016] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.016] ReadFile (in: hFile=0x2c18, lpBuffer=0x4950000, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x4607f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesRead=0x4607f61c*=0x7450, lpOverlapped=0x0) returned 1 [0203.017] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0xffff8bb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.017] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4950000, cbInput=0x7450, pPaddingInfo=0x0, pbIV=0x4607f848, cbIV=0x10, pbOutput=0x4950000, cbOutput=0x100000, pcbResult=0x4607f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4607f848, pbOutput=0x4950000, pcbResult=0x4607f618) returned 0x0 [0203.017] WriteFile (in: hFile=0x2c18, lpBuffer=0x4950000*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x4607f61c, lpOverlapped=0x0 | out: lpBuffer=0x4950000*, lpNumberOfBytesWritten=0x4607f61c*=0x7460, lpOverlapped=0x0) returned 1 [0203.020] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4607f60c | out: lpNewFilePointer=0x0) returned 1 [0203.020] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.020] WriteFile (in: hFile=0x2c18, lpBuffer=0x4607f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4607f61c, lpOverlapped=0x0 | out: lpBuffer=0x4607f83c*, lpNumberOfBytesWritten=0x4607f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.020] SetFilePointerEx (in: hFile=0x2c18, liDistanceToMove=0x7460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.020] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.020] CloseHandle (hObject=0x2c18) returned 1 [0203.020] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0203.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.play")) returned 1 [0203.025] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3653 os_tid = 0x3720 [0203.030] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.031] ReadFile (in: hFile=0x2c20, lpBuffer=0x461bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x461bf85c, lpOverlapped=0x0 | out: lpBuffer=0x461bfb34*, lpNumberOfBytesRead=0x461bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.032] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.032] ReadFile (in: hFile=0x2c20, lpBuffer=0x461bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x461bf85c, lpOverlapped=0x0 | out: lpBuffer=0x461bfb34*, lpNumberOfBytesRead=0x461bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.032] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0203.035] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0203.035] BCryptSetProperty (in: hObject=0x733410, pszProperty="ChainingMode", pbInput=0x461bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733410) returned 0x0 [0203.036] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733410, phKey=0x461bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733410, phKey=0x461bf828, pbKeyObject=0x0) returned 0x0 [0203.036] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x461bf500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x461bf500) returned 0x0 [0203.036] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0203.036] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x461bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x461bf500) returned 0x0 [0203.039] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.043] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.043] WriteFile (in: hFile=0x2c20, lpBuffer=0x461bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x461bf830, lpOverlapped=0x0 | out: lpBuffer=0x461bfb34*, lpNumberOfBytesWritten=0x461bf830*=0x428, lpOverlapped=0x0) returned 1 [0203.043] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.043] ReadFile (in: hFile=0x2c20, lpBuffer=0x4a50000, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x461bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesRead=0x461bf61c*=0xa343, lpOverlapped=0x0) returned 1 [0203.044] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0xffff5cbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.045] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4a50000, cbInput=0xa343, pPaddingInfo=0x0, pbIV=0x461bf848, cbIV=0x10, pbOutput=0x4a50000, cbOutput=0x100000, pcbResult=0x461bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x461bf848, pbOutput=0x4a50000, pcbResult=0x461bf618) returned 0x0 [0203.045] WriteFile (in: hFile=0x2c20, lpBuffer=0x4a50000*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x461bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4a50000*, lpNumberOfBytesWritten=0x461bf61c*=0xa350, lpOverlapped=0x0) returned 1 [0203.045] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x461bf60c | out: lpNewFilePointer=0x0) returned 1 [0203.045] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.045] WriteFile (in: hFile=0x2c20, lpBuffer=0x461bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x461bf61c, lpOverlapped=0x0 | out: lpBuffer=0x461bf83c*, lpNumberOfBytesWritten=0x461bf61c*=0x8, lpOverlapped=0x0) returned 1 [0203.045] SetFilePointerEx (in: hFile=0x2c20, liDistanceToMove=0xa350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.045] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.045] CloseHandle (hObject=0x2c20) returned 1 [0203.045] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0203.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.play")) returned 1 [0203.050] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3654 os_tid = 0x3724 [0203.055] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.055] ReadFile (in: hFile=0x2c28, lpBuffer=0x462ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x462ff85c, lpOverlapped=0x0 | out: lpBuffer=0x462ffb34*, lpNumberOfBytesRead=0x462ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.056] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.056] ReadFile (in: hFile=0x2c28, lpBuffer=0x462ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x462ff85c, lpOverlapped=0x0 | out: lpBuffer=0x462ffb34*, lpNumberOfBytesRead=0x462ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.057] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x700000 [0203.060] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x700000) returned 0x0 [0203.060] BCryptSetProperty (in: hObject=0x7334c0, pszProperty="ChainingMode", pbInput=0x462ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7334c0) returned 0x0 [0203.060] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7334c0, phKey=0x462ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x700000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7334c0, phKey=0x462ff828, pbKeyObject=0x0) returned 0x0 [0203.060] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x700000, cbOutput=0x230, pcbResult=0x462ff500, dwFlags=0x0 | out: pbOutput=0x700000, pcbResult=0x462ff500) returned 0x0 [0203.061] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x700230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x700230) returned 0x0 [0203.061] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x700000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x700000, cbOutput=0x400, pcbResult=0x462ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x700000, pcbResult=0x462ff500) returned 0x0 [0203.064] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.069] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0xb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.069] WriteFile (in: hFile=0x2c28, lpBuffer=0x462ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x462ff830, lpOverlapped=0x0 | out: lpBuffer=0x462ffb34*, lpNumberOfBytesWritten=0x462ff830*=0x428, lpOverlapped=0x0) returned 1 [0203.069] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.069] ReadFile (in: hFile=0x2c28, lpBuffer=0x4b50000, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x462ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesRead=0x462ff61c*=0xa445, lpOverlapped=0x0) returned 1 [0203.086] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0xffff5bbb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.086] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4b50000, cbInput=0xa445, pPaddingInfo=0x0, pbIV=0x462ff848, cbIV=0x10, pbOutput=0x4b50000, cbOutput=0x100000, pcbResult=0x462ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x462ff848, pbOutput=0x4b50000, pcbResult=0x462ff618) returned 0x0 [0203.087] WriteFile (in: hFile=0x2c28, lpBuffer=0x4b50000*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x462ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4b50000*, lpNumberOfBytesWritten=0x462ff61c*=0xa450, lpOverlapped=0x0) returned 1 [0203.087] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x462ff60c | out: lpNewFilePointer=0x0) returned 1 [0203.087] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.087] WriteFile (in: hFile=0x2c28, lpBuffer=0x462ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x462ff61c, lpOverlapped=0x0 | out: lpBuffer=0x462ff83c*, lpNumberOfBytesWritten=0x462ff61c*=0x8, lpOverlapped=0x0) returned 1 [0203.087] SetFilePointerEx (in: hFile=0x2c28, liDistanceToMove=0xa450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.087] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.087] CloseHandle (hObject=0x2c28) returned 1 [0203.088] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x700000 [0203.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.play")) Thread: id = 3655 os_tid = 0x3728 [0203.096] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.096] ReadFile (in: hFile=0x2c30, lpBuffer=0x4643fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4643f85c, lpOverlapped=0x0 | out: lpBuffer=0x4643fb34*, lpNumberOfBytesRead=0x4643f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.098] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.098] ReadFile (in: hFile=0x2c30, lpBuffer=0x4643fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4643f85c, lpOverlapped=0x0 | out: lpBuffer=0x4643fb34*, lpNumberOfBytesRead=0x4643f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.098] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.102] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.102] BCryptSetProperty (in: hObject=0x733570, pszProperty="ChainingMode", pbInput=0x4643f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733570) returned 0x0 [0203.102] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733570, phKey=0x4643f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733570, phKey=0x4643f828, pbKeyObject=0x0) returned 0x0 [0203.102] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4643f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4643f500) returned 0x0 [0203.102] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.103] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4643f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4643f500) returned 0x0 [0203.106] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.110] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.110] WriteFile (in: hFile=0x2c30, lpBuffer=0x4643fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4643f830, lpOverlapped=0x0 | out: lpBuffer=0x4643fb34*, lpNumberOfBytesWritten=0x4643f830*=0x428, lpOverlapped=0x0) returned 1 [0203.110] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.110] ReadFile (in: hFile=0x2c30, lpBuffer=0x4c50000, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x4643f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesRead=0x4643f61c*=0x2ba2, lpOverlapped=0x0) returned 1 [0203.112] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0xffffd45e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.112] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4c50000, cbInput=0x2ba2, pPaddingInfo=0x0, pbIV=0x4643f848, cbIV=0x10, pbOutput=0x4c50000, cbOutput=0x100000, pcbResult=0x4643f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4643f848, pbOutput=0x4c50000, pcbResult=0x4643f618) returned 0x0 [0203.112] WriteFile (in: hFile=0x2c30, lpBuffer=0x4c50000*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x4643f61c, lpOverlapped=0x0 | out: lpBuffer=0x4c50000*, lpNumberOfBytesWritten=0x4643f61c*=0x2bb0, lpOverlapped=0x0) returned 1 [0203.112] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4643f60c | out: lpNewFilePointer=0x0) returned 1 [0203.112] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.113] WriteFile (in: hFile=0x2c30, lpBuffer=0x4643f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4643f61c, lpOverlapped=0x0 | out: lpBuffer=0x4643f83c*, lpNumberOfBytesWritten=0x4643f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.113] SetFilePointerEx (in: hFile=0x2c30, liDistanceToMove=0x2bb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.113] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.113] CloseHandle (hObject=0x2c30) returned 1 [0203.113] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.play")) returned 1 [0203.118] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3656 os_tid = 0x372c [0203.123] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.123] ReadFile (in: hFile=0x2c38, lpBuffer=0x4657fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4657f85c, lpOverlapped=0x0 | out: lpBuffer=0x4657fb34*, lpNumberOfBytesRead=0x4657f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.125] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.125] ReadFile (in: hFile=0x2c38, lpBuffer=0x4657fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4657f85c, lpOverlapped=0x0 | out: lpBuffer=0x4657fb34*, lpNumberOfBytesRead=0x4657f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.125] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.128] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.129] BCryptSetProperty (in: hObject=0x7336d0, pszProperty="ChainingMode", pbInput=0x4657f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7336d0) returned 0x0 [0203.129] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7336d0, phKey=0x4657f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7336d0, phKey=0x4657f828, pbKeyObject=0x0) returned 0x0 [0203.129] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4657f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4657f500) returned 0x0 [0203.129] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.129] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4657f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4657f500) returned 0x0 [0203.132] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.136] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.136] WriteFile (in: hFile=0x2c38, lpBuffer=0x4657fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4657f830, lpOverlapped=0x0 | out: lpBuffer=0x4657fb34*, lpNumberOfBytesWritten=0x4657f830*=0x428, lpOverlapped=0x0) returned 1 [0203.136] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.136] ReadFile (in: hFile=0x2c38, lpBuffer=0x4d50000, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x4657f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesRead=0x4657f61c*=0x321f, lpOverlapped=0x0) returned 1 [0203.138] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0xffffcde1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.138] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4d50000, cbInput=0x321f, pPaddingInfo=0x0, pbIV=0x4657f848, cbIV=0x10, pbOutput=0x4d50000, cbOutput=0x100000, pcbResult=0x4657f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4657f848, pbOutput=0x4d50000, pcbResult=0x4657f618) returned 0x0 [0203.138] WriteFile (in: hFile=0x2c38, lpBuffer=0x4d50000*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x4657f61c, lpOverlapped=0x0 | out: lpBuffer=0x4d50000*, lpNumberOfBytesWritten=0x4657f61c*=0x3220, lpOverlapped=0x0) returned 1 [0203.138] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4657f60c | out: lpNewFilePointer=0x0) returned 1 [0203.138] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.138] WriteFile (in: hFile=0x2c38, lpBuffer=0x4657f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4657f61c, lpOverlapped=0x0 | out: lpBuffer=0x4657f83c*, lpNumberOfBytesWritten=0x4657f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.138] SetFilePointerEx (in: hFile=0x2c38, liDistanceToMove=0x3220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.138] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.138] CloseHandle (hObject=0x2c38) returned 1 [0203.138] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.play")) returned 1 [0203.143] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3657 os_tid = 0x3730 [0203.148] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.148] ReadFile (in: hFile=0x2c40, lpBuffer=0x466bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x466bf85c, lpOverlapped=0x0 | out: lpBuffer=0x466bfb34*, lpNumberOfBytesRead=0x466bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.150] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.150] ReadFile (in: hFile=0x2c40, lpBuffer=0x466bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x466bf85c, lpOverlapped=0x0 | out: lpBuffer=0x466bfb34*, lpNumberOfBytesRead=0x466bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.150] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.153] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.153] BCryptSetProperty (in: hObject=0x733620, pszProperty="ChainingMode", pbInput=0x466bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733620) returned 0x0 [0203.153] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733620, phKey=0x466bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733620, phKey=0x466bf828, pbKeyObject=0x0) returned 0x0 [0203.154] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x466bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x466bf500) returned 0x0 [0203.154] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.154] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x466bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x466bf500) returned 0x0 [0203.157] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.162] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0x2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.162] WriteFile (in: hFile=0x2c40, lpBuffer=0x466bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x466bf830, lpOverlapped=0x0 | out: lpBuffer=0x466bfb34*, lpNumberOfBytesWritten=0x466bf830*=0x428, lpOverlapped=0x0) returned 1 [0203.163] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.163] ReadFile (in: hFile=0x2c40, lpBuffer=0x4e50000, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x466bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesRead=0x466bf61c*=0xbdae, lpOverlapped=0x0) returned 1 [0203.164] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0xffff4252, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.164] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4e50000, cbInput=0xbdae, pPaddingInfo=0x0, pbIV=0x466bf848, cbIV=0x10, pbOutput=0x4e50000, cbOutput=0x100000, pcbResult=0x466bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x466bf848, pbOutput=0x4e50000, pcbResult=0x466bf618) returned 0x0 [0203.164] WriteFile (in: hFile=0x2c40, lpBuffer=0x4e50000*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x466bf61c, lpOverlapped=0x0 | out: lpBuffer=0x4e50000*, lpNumberOfBytesWritten=0x466bf61c*=0xbdb0, lpOverlapped=0x0) returned 1 [0203.164] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x466bf60c | out: lpNewFilePointer=0x0) returned 1 [0203.164] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.165] WriteFile (in: hFile=0x2c40, lpBuffer=0x466bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x466bf61c, lpOverlapped=0x0 | out: lpBuffer=0x466bf83c*, lpNumberOfBytesWritten=0x466bf61c*=0x8, lpOverlapped=0x0) returned 1 [0203.165] SetFilePointerEx (in: hFile=0x2c40, liDistanceToMove=0xbdb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.165] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.165] CloseHandle (hObject=0x2c40) returned 1 [0203.165] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.play")) returned 1 [0203.171] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3658 os_tid = 0x3734 [0203.177] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.177] ReadFile (in: hFile=0x2c48, lpBuffer=0x467ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x467ff85c, lpOverlapped=0x0 | out: lpBuffer=0x467ffb34*, lpNumberOfBytesRead=0x467ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.178] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.179] ReadFile (in: hFile=0x2c48, lpBuffer=0x467ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x467ff85c, lpOverlapped=0x0 | out: lpBuffer=0x467ffb34*, lpNumberOfBytesRead=0x467ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.179] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.183] BCryptSetProperty (in: hObject=0x7327b0, pszProperty="ChainingMode", pbInput=0x467ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7327b0) returned 0x0 [0203.183] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7327b0, phKey=0x467ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7327b0, phKey=0x467ff828, pbKeyObject=0x0) returned 0x0 [0203.183] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x467ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x467ff500) returned 0x0 [0203.183] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.183] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x467ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x467ff500) returned 0x0 [0203.188] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.192] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.192] WriteFile (in: hFile=0x2c48, lpBuffer=0x467ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x467ff830, lpOverlapped=0x0 | out: lpBuffer=0x467ffb34*, lpNumberOfBytesWritten=0x467ff830*=0x428, lpOverlapped=0x0) returned 1 [0203.193] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.193] ReadFile (in: hFile=0x2c48, lpBuffer=0x4f50000, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x467ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesRead=0x467ff61c*=0xef6, lpOverlapped=0x0) returned 1 [0203.193] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0xfffff10a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.193] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x4f50000, cbInput=0xef6, pPaddingInfo=0x0, pbIV=0x467ff848, cbIV=0x10, pbOutput=0x4f50000, cbOutput=0x100000, pcbResult=0x467ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x467ff848, pbOutput=0x4f50000, pcbResult=0x467ff618) returned 0x0 [0203.193] WriteFile (in: hFile=0x2c48, lpBuffer=0x4f50000*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x467ff61c, lpOverlapped=0x0 | out: lpBuffer=0x4f50000*, lpNumberOfBytesWritten=0x467ff61c*=0xf00, lpOverlapped=0x0) returned 1 [0203.193] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x467ff60c | out: lpNewFilePointer=0x0) returned 1 [0203.193] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.193] WriteFile (in: hFile=0x2c48, lpBuffer=0x467ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x467ff61c, lpOverlapped=0x0 | out: lpBuffer=0x467ff83c*, lpNumberOfBytesWritten=0x467ff61c*=0x8, lpOverlapped=0x0) returned 1 [0203.194] SetFilePointerEx (in: hFile=0x2c48, liDistanceToMove=0xf00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.194] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.194] CloseHandle (hObject=0x2c48) returned 1 [0203.194] VirtualAlloc (lpAddress=0x0, dwSize=0x97, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrt.wmf.play")) returned 1 [0203.200] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3659 os_tid = 0x3738 [0203.205] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.205] ReadFile (in: hFile=0x1fec, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.207] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.207] ReadFile (in: hFile=0x1fec, lpBuffer=0x1590fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x1590f85c, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesRead=0x1590f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.207] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.211] BCryptSetProperty (in: hObject=0x731ec0, pszProperty="ChainingMode", pbInput=0x1590f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731ec0) returned 0x0 [0203.211] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731ec0, phKey=0x1590f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731ec0, phKey=0x1590f828, pbKeyObject=0x0) returned 0x0 [0203.211] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x1590f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x1590f500) returned 0x0 [0203.211] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.211] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x1590f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x1590f500) returned 0x0 [0203.216] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.221] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.221] WriteFile (in: hFile=0x1fec, lpBuffer=0x1590fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x1590f830, lpOverlapped=0x0 | out: lpBuffer=0x1590fb34*, lpNumberOfBytesWritten=0x1590f830*=0x428, lpOverlapped=0x0) returned 1 [0203.221] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.221] ReadFile (in: hFile=0x1fec, lpBuffer=0x5050000, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesRead=0x1590f61c*=0x7aac, lpOverlapped=0x0) returned 1 [0203.223] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xffff8554, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.224] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5050000, cbInput=0x7aac, pPaddingInfo=0x0, pbIV=0x1590f848, cbIV=0x10, pbOutput=0x5050000, cbOutput=0x100000, pcbResult=0x1590f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x1590f848, pbOutput=0x5050000, pcbResult=0x1590f618) returned 0x0 [0203.224] WriteFile (in: hFile=0x1fec, lpBuffer=0x5050000*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x5050000*, lpNumberOfBytesWritten=0x1590f61c*=0x7ab0, lpOverlapped=0x0) returned 1 [0203.224] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1590f60c | out: lpNewFilePointer=0x0) returned 1 [0203.224] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.224] WriteFile (in: hFile=0x1fec, lpBuffer=0x1590f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1590f61c, lpOverlapped=0x0 | out: lpBuffer=0x1590f83c*, lpNumberOfBytesWritten=0x1590f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.224] SetFilePointerEx (in: hFile=0x1fec, liDistanceToMove=0x7ab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.224] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.224] CloseHandle (hObject=0x1fec) returned 1 [0203.225] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.229] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.play")) returned 1 [0203.231] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3660 os_tid = 0x373c [0203.238] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.242] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.242] BCryptSetProperty (in: hObject=0x730ad8, pszProperty="ChainingMode", pbInput=0x4693f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x730ad8) returned 0x0 [0203.242] BCryptGenerateSymmetricKey (in: hAlgorithm=0x730ad8, phKey=0x4693f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x730ad8, phKey=0x4693f828, pbKeyObject=0x0) returned 0x0 [0203.242] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4693f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4693f500) returned 0x0 [0203.243] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.243] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4693f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4693f500) returned 0x0 [0203.247] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.252] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.252] WriteFile (in: hFile=0x2c54, lpBuffer=0x4693fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4693f830, lpOverlapped=0x0 | out: lpBuffer=0x4693fb34*, lpNumberOfBytesWritten=0x4693f830*=0x428, lpOverlapped=0x0) returned 1 [0203.254] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.254] ReadFile (in: hFile=0x2c54, lpBuffer=0x2850000, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x4693f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesRead=0x4693f61c*=0x3d6, lpOverlapped=0x0) returned 1 [0203.255] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0xfffffc2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.255] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x2850000, cbInput=0x3d6, pPaddingInfo=0x0, pbIV=0x4693f848, cbIV=0x10, pbOutput=0x2850000, cbOutput=0x100000, pcbResult=0x4693f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4693f848, pbOutput=0x2850000, pcbResult=0x4693f618) returned 0x0 [0203.255] WriteFile (in: hFile=0x2c54, lpBuffer=0x2850000*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x4693f61c, lpOverlapped=0x0 | out: lpBuffer=0x2850000*, lpNumberOfBytesWritten=0x4693f61c*=0x3e0, lpOverlapped=0x0) returned 1 [0203.255] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4693f60c | out: lpNewFilePointer=0x0) returned 1 [0203.255] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.255] WriteFile (in: hFile=0x2c54, lpBuffer=0x4693f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4693f61c, lpOverlapped=0x0 | out: lpBuffer=0x4693f83c*, lpNumberOfBytesWritten=0x4693f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.255] SetFilePointerEx (in: hFile=0x2c54, liDistanceToMove=0x3e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.255] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.255] CloseHandle (hObject=0x2c54) returned 1 [0203.255] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\psretro.wmf.play")) returned 1 [0203.261] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3661 os_tid = 0x3740 [0203.267] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.268] ReadFile (in: hFile=0x2c5c, lpBuffer=0x46a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x46a7fb34*, lpNumberOfBytesRead=0x46a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.270] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.270] ReadFile (in: hFile=0x2c5c, lpBuffer=0x46a7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46a7f85c, lpOverlapped=0x0 | out: lpBuffer=0x46a7fb34*, lpNumberOfBytesRead=0x46a7f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.270] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.274] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.274] BCryptSetProperty (in: hObject=0x732700, pszProperty="ChainingMode", pbInput=0x46a7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732700) returned 0x0 [0203.274] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732700, phKey=0x46a7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732700, phKey=0x46a7f828, pbKeyObject=0x0) returned 0x0 [0203.274] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x46a7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x46a7f500) returned 0x0 [0203.275] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.275] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x46a7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x46a7f500) returned 0x0 [0203.281] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.287] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.287] WriteFile (in: hFile=0x2c5c, lpBuffer=0x46a7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x46a7f830, lpOverlapped=0x0 | out: lpBuffer=0x46a7fb34*, lpNumberOfBytesWritten=0x46a7f830*=0x428, lpOverlapped=0x0) returned 1 [0203.287] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.287] ReadFile (in: hFile=0x2c5c, lpBuffer=0x5150000, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x46a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesRead=0x46a7f61c*=0xe0a, lpOverlapped=0x0) returned 1 [0203.287] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0xfffff1f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.288] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5150000, cbInput=0xe0a, pPaddingInfo=0x0, pbIV=0x46a7f848, cbIV=0x10, pbOutput=0x5150000, cbOutput=0x100000, pcbResult=0x46a7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x46a7f848, pbOutput=0x5150000, pcbResult=0x46a7f618) returned 0x0 [0203.288] WriteFile (in: hFile=0x2c5c, lpBuffer=0x5150000*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x46a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5150000*, lpNumberOfBytesWritten=0x46a7f61c*=0xe10, lpOverlapped=0x0) returned 1 [0203.288] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x46a7f60c | out: lpNewFilePointer=0x0) returned 1 [0203.288] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.288] WriteFile (in: hFile=0x2c5c, lpBuffer=0x46a7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46a7f61c, lpOverlapped=0x0 | out: lpBuffer=0x46a7f83c*, lpNumberOfBytesWritten=0x46a7f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.288] SetFilePointerEx (in: hFile=0x2c5c, liDistanceToMove=0xe10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.288] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.288] CloseHandle (hObject=0x2c5c) returned 1 [0203.288] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.play")) returned 1 [0203.294] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3662 os_tid = 0x3744 [0203.302] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.302] ReadFile (in: hFile=0x2c64, lpBuffer=0x46bbfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46bbf85c, lpOverlapped=0x0 | out: lpBuffer=0x46bbfb34*, lpNumberOfBytesRead=0x46bbf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.304] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.308] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.308] BCryptSetProperty (in: hObject=0x732860, pszProperty="ChainingMode", pbInput=0x46bbf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732860) returned 0x0 [0203.308] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732860, phKey=0x46bbf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732860, phKey=0x46bbf828, pbKeyObject=0x0) returned 0x0 [0203.308] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x46bbf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x46bbf500) returned 0x0 [0203.309] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.309] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x46bbf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x46bbf500) returned 0x0 [0203.315] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.320] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.320] WriteFile (in: hFile=0x2c64, lpBuffer=0x46bbfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x46bbf830, lpOverlapped=0x0 | out: lpBuffer=0x46bbfb34*, lpNumberOfBytesWritten=0x46bbf830*=0x428, lpOverlapped=0x0) returned 1 [0203.320] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.321] ReadFile (in: hFile=0x2c64, lpBuffer=0x5250000, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x46bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesRead=0x46bbf61c*=0x776, lpOverlapped=0x0) returned 1 [0203.321] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0xfffff88a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.321] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5250000, cbInput=0x776, pPaddingInfo=0x0, pbIV=0x46bbf848, cbIV=0x10, pbOutput=0x5250000, cbOutput=0x100000, pcbResult=0x46bbf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x46bbf848, pbOutput=0x5250000, pcbResult=0x46bbf618) returned 0x0 [0203.321] WriteFile (in: hFile=0x2c64, lpBuffer=0x5250000*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x46bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x5250000*, lpNumberOfBytesWritten=0x46bbf61c*=0x780, lpOverlapped=0x0) returned 1 [0203.321] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x46bbf60c | out: lpNewFilePointer=0x0) returned 1 [0203.321] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.321] WriteFile (in: hFile=0x2c64, lpBuffer=0x46bbf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46bbf61c, lpOverlapped=0x0 | out: lpBuffer=0x46bbf83c*, lpNumberOfBytesWritten=0x46bbf61c*=0x8, lpOverlapped=0x0) returned 1 [0203.321] SetFilePointerEx (in: hFile=0x2c64, liDistanceToMove=0x780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.321] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.321] CloseHandle (hObject=0x2c64) returned 1 [0203.322] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.325] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.play")) returned 1 [0203.327] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3663 os_tid = 0x3748 [0203.335] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.335] ReadFile (in: hFile=0x2c6c, lpBuffer=0x46cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46cff85c, lpOverlapped=0x0 | out: lpBuffer=0x46cffb34*, lpNumberOfBytesRead=0x46cff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.338] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.338] ReadFile (in: hFile=0x2c6c, lpBuffer=0x46cffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46cff85c, lpOverlapped=0x0 | out: lpBuffer=0x46cffb34*, lpNumberOfBytesRead=0x46cff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.339] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.343] BCryptSetProperty (in: hObject=0x732390, pszProperty="ChainingMode", pbInput=0x46cff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732390) returned 0x0 [0203.343] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732390, phKey=0x46cff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732390, phKey=0x46cff828, pbKeyObject=0x0) returned 0x0 [0203.343] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x46cff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x46cff500) returned 0x0 [0203.343] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.343] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x46cff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x46cff500) returned 0x0 [0203.350] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.354] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.355] WriteFile (in: hFile=0x2c6c, lpBuffer=0x46cffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x46cff830, lpOverlapped=0x0 | out: lpBuffer=0x46cffb34*, lpNumberOfBytesWritten=0x46cff830*=0x428, lpOverlapped=0x0) returned 1 [0203.355] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.355] ReadFile (in: hFile=0x2c6c, lpBuffer=0x5350000, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x46cff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x46cff61c*=0xb12, lpOverlapped=0x0) returned 1 [0203.355] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0xfffff4ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.355] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5350000, cbInput=0xb12, pPaddingInfo=0x0, pbIV=0x46cff848, cbIV=0x10, pbOutput=0x5350000, cbOutput=0x100000, pcbResult=0x46cff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x46cff848, pbOutput=0x5350000, pcbResult=0x46cff618) returned 0x0 [0203.355] WriteFile (in: hFile=0x2c6c, lpBuffer=0x5350000*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x46cff61c, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesWritten=0x46cff61c*=0xb20, lpOverlapped=0x0) returned 1 [0203.355] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x46cff60c | out: lpNewFilePointer=0x0) returned 1 [0203.355] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.355] WriteFile (in: hFile=0x2c6c, lpBuffer=0x46cff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46cff61c, lpOverlapped=0x0 | out: lpBuffer=0x46cff83c*, lpNumberOfBytesWritten=0x46cff61c*=0x8, lpOverlapped=0x0) returned 1 [0203.356] SetFilePointerEx (in: hFile=0x2c6c, liDistanceToMove=0xb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.356] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.356] CloseHandle (hObject=0x2c6c) returned 1 [0203.356] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.play")) returned 1 [0203.362] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3664 os_tid = 0x374c [0203.409] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.409] ReadFile (in: hFile=0x2c74, lpBuffer=0x46e3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46e3f85c, lpOverlapped=0x0 | out: lpBuffer=0x46e3fb34*, lpNumberOfBytesRead=0x46e3f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.411] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.418] BCryptSetProperty (in: hObject=0x732f40, pszProperty="ChainingMode", pbInput=0x46e3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732f40) returned 0x0 [0203.418] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732f40, phKey=0x46e3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732f40, phKey=0x46e3f828, pbKeyObject=0x0) returned 0x0 [0203.418] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x46e3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x46e3f500) returned 0x0 [0203.418] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.418] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x46e3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x46e3f500) returned 0x0 [0203.425] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.430] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.430] WriteFile (in: hFile=0x2c74, lpBuffer=0x46e3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x46e3f830, lpOverlapped=0x0 | out: lpBuffer=0x46e3fb34*, lpNumberOfBytesWritten=0x46e3f830*=0x428, lpOverlapped=0x0) returned 1 [0203.430] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.430] ReadFile (in: hFile=0x2c74, lpBuffer=0x5450000, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x46e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesRead=0x46e3f61c*=0x6ec, lpOverlapped=0x0) returned 1 [0203.430] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0xfffff914, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.431] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5450000, cbInput=0x6ec, pPaddingInfo=0x0, pbIV=0x46e3f848, cbIV=0x10, pbOutput=0x5450000, cbOutput=0x100000, pcbResult=0x46e3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x46e3f848, pbOutput=0x5450000, pcbResult=0x46e3f618) returned 0x0 [0203.431] WriteFile (in: hFile=0x2c74, lpBuffer=0x5450000*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x46e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x5450000*, lpNumberOfBytesWritten=0x46e3f61c*=0x6f0, lpOverlapped=0x0) returned 1 [0203.431] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x46e3f60c | out: lpNewFilePointer=0x0) returned 1 [0203.431] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.431] WriteFile (in: hFile=0x2c74, lpBuffer=0x46e3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46e3f61c, lpOverlapped=0x0 | out: lpBuffer=0x46e3f83c*, lpNumberOfBytesWritten=0x46e3f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.431] SetFilePointerEx (in: hFile=0x2c74, liDistanceToMove=0x6f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.431] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.431] CloseHandle (hObject=0x2c74) returned 1 [0203.431] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.play")) returned 1 [0203.438] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) Thread: id = 3665 os_tid = 0x3750 [0203.445] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.445] ReadFile (in: hFile=0x2c7c, lpBuffer=0x46f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x46f7fb34*, lpNumberOfBytesRead=0x46f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.448] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.448] ReadFile (in: hFile=0x2c7c, lpBuffer=0x46f7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x46f7f85c, lpOverlapped=0x0 | out: lpBuffer=0x46f7fb34*, lpNumberOfBytesRead=0x46f7f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.448] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.452] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.452] BCryptSetProperty (in: hObject=0x732650, pszProperty="ChainingMode", pbInput=0x46f7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732650) returned 0x0 [0203.453] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732650, phKey=0x46f7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732650, phKey=0x46f7f828, pbKeyObject=0x0) returned 0x0 [0203.453] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x46f7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x46f7f500) returned 0x0 [0203.453] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.453] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x46f7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x46f7f500) returned 0x0 [0203.459] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.464] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.465] WriteFile (in: hFile=0x2c7c, lpBuffer=0x46f7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x46f7f830, lpOverlapped=0x0 | out: lpBuffer=0x46f7fb34*, lpNumberOfBytesWritten=0x46f7f830*=0x428, lpOverlapped=0x0) returned 1 [0203.465] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.465] ReadFile (in: hFile=0x2c7c, lpBuffer=0x5550000, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x46f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesRead=0x46f7f61c*=0xd16, lpOverlapped=0x0) returned 1 [0203.465] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0xfffff2ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.466] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5550000, cbInput=0xd16, pPaddingInfo=0x0, pbIV=0x46f7f848, cbIV=0x10, pbOutput=0x5550000, cbOutput=0x100000, pcbResult=0x46f7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x46f7f848, pbOutput=0x5550000, pcbResult=0x46f7f618) returned 0x0 [0203.466] WriteFile (in: hFile=0x2c7c, lpBuffer=0x5550000*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x46f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x5550000*, lpNumberOfBytesWritten=0x46f7f61c*=0xd20, lpOverlapped=0x0) returned 1 [0203.466] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x46f7f60c | out: lpNewFilePointer=0x0) returned 1 [0203.466] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.466] WriteFile (in: hFile=0x2c7c, lpBuffer=0x46f7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46f7f61c, lpOverlapped=0x0 | out: lpBuffer=0x46f7f83c*, lpNumberOfBytesWritten=0x46f7f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.466] SetFilePointerEx (in: hFile=0x2c7c, liDistanceToMove=0xd20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.466] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.466] CloseHandle (hObject=0x2c7c) returned 1 [0203.466] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\recycle.wmf.play")) returned 1 [0203.473] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) Thread: id = 3666 os_tid = 0x3754 [0203.479] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.479] ReadFile (in: hFile=0x2c84, lpBuffer=0x470bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x470bf85c, lpOverlapped=0x0 | out: lpBuffer=0x470bfb34*, lpNumberOfBytesRead=0x470bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.481] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.481] ReadFile (in: hFile=0x2c84, lpBuffer=0x470bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x470bf85c, lpOverlapped=0x0 | out: lpBuffer=0x470bfb34*, lpNumberOfBytesRead=0x470bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.487] BCryptSetProperty (in: hObject=0x732910, pszProperty="ChainingMode", pbInput=0x470bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732910) returned 0x0 [0203.487] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732910, phKey=0x470bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732910, phKey=0x470bf828, pbKeyObject=0x0) returned 0x0 [0203.487] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x470bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x470bf500) returned 0x0 [0203.487] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.487] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x470bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x470bf500) returned 0x0 [0203.493] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.499] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0x1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.499] WriteFile (in: hFile=0x2c84, lpBuffer=0x470bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x470bf830, lpOverlapped=0x0 | out: lpBuffer=0x470bfb34*, lpNumberOfBytesWritten=0x470bf830*=0x428, lpOverlapped=0x0) returned 1 [0203.499] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.499] ReadFile (in: hFile=0x2c84, lpBuffer=0x5650000, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x470bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x470bf61c*=0x175f, lpOverlapped=0x0) returned 1 [0203.499] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0xffffe8a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.499] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5650000, cbInput=0x175f, pPaddingInfo=0x0, pbIV=0x470bf848, cbIV=0x10, pbOutput=0x5650000, cbOutput=0x100000, pcbResult=0x470bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x470bf848, pbOutput=0x5650000, pcbResult=0x470bf618) returned 0x0 [0203.499] WriteFile (in: hFile=0x2c84, lpBuffer=0x5650000*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x470bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesWritten=0x470bf61c*=0x1760, lpOverlapped=0x0) returned 1 [0203.500] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x470bf60c | out: lpNewFilePointer=0x0) returned 1 [0203.500] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.500] WriteFile (in: hFile=0x2c84, lpBuffer=0x470bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x470bf61c, lpOverlapped=0x0 | out: lpBuffer=0x470bf83c*, lpNumberOfBytesWritten=0x470bf61c*=0x8, lpOverlapped=0x0) returned 1 [0203.500] SetFilePointerEx (in: hFile=0x2c84, liDistanceToMove=0x1760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.500] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.500] CloseHandle (hObject=0x2c84) returned 1 [0203.500] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\road_01.mid.play")) returned 1 [0203.508] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3667 os_tid = 0x3758 [0203.514] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.514] ReadFile (in: hFile=0x2c8c, lpBuffer=0x471ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x471ff85c, lpOverlapped=0x0 | out: lpBuffer=0x471ffb34*, lpNumberOfBytesRead=0x471ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.518] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.518] ReadFile (in: hFile=0x2c8c, lpBuffer=0x471ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x471ff85c, lpOverlapped=0x0 | out: lpBuffer=0x471ffb34*, lpNumberOfBytesRead=0x471ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.519] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.523] BCryptSetProperty (in: hObject=0x7330a0, pszProperty="ChainingMode", pbInput=0x471ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7330a0) returned 0x0 [0203.523] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7330a0, phKey=0x471ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7330a0, phKey=0x471ff828, pbKeyObject=0x0) returned 0x0 [0203.523] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x471ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x471ff500) returned 0x0 [0203.523] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.523] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x471ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x471ff500) returned 0x0 [0203.527] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.531] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.531] WriteFile (in: hFile=0x2c8c, lpBuffer=0x471ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x471ff830, lpOverlapped=0x0 | out: lpBuffer=0x471ffb34*, lpNumberOfBytesWritten=0x471ff830*=0x428, lpOverlapped=0x0) returned 1 [0203.532] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.532] ReadFile (in: hFile=0x2c8c, lpBuffer=0x5750000, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x471ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesRead=0x471ff61c*=0x278a, lpOverlapped=0x0) returned 1 [0203.533] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0xffffd876, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.533] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5750000, cbInput=0x278a, pPaddingInfo=0x0, pbIV=0x471ff848, cbIV=0x10, pbOutput=0x5750000, cbOutput=0x100000, pcbResult=0x471ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x471ff848, pbOutput=0x5750000, pcbResult=0x471ff618) returned 0x0 [0203.533] WriteFile (in: hFile=0x2c8c, lpBuffer=0x5750000*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x471ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5750000*, lpNumberOfBytesWritten=0x471ff61c*=0x2790, lpOverlapped=0x0) returned 1 [0203.533] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x471ff60c | out: lpNewFilePointer=0x0) returned 1 [0203.533] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.534] WriteFile (in: hFile=0x2c8c, lpBuffer=0x471ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x471ff61c, lpOverlapped=0x0 | out: lpBuffer=0x471ff83c*, lpNumberOfBytesWritten=0x471ff61c*=0x8, lpOverlapped=0x0) returned 1 [0203.534] SetFilePointerEx (in: hFile=0x2c8c, liDistanceToMove=0x2790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.534] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.534] CloseHandle (hObject=0x2c8c) returned 1 [0203.534] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\safri_01.mid.play")) returned 1 [0203.541] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3668 os_tid = 0x375c [0203.547] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.547] ReadFile (in: hFile=0x2c94, lpBuffer=0x4733fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4733f85c, lpOverlapped=0x0 | out: lpBuffer=0x4733fb34*, lpNumberOfBytesRead=0x4733f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.569] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.569] ReadFile (in: hFile=0x2c94, lpBuffer=0x4733fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4733f85c, lpOverlapped=0x0 | out: lpBuffer=0x4733fb34*, lpNumberOfBytesRead=0x4733f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.569] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.573] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.573] BCryptSetProperty (in: hObject=0x731f70, pszProperty="ChainingMode", pbInput=0x4733f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731f70) returned 0x0 [0203.573] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731f70, phKey=0x4733f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731f70, phKey=0x4733f828, pbKeyObject=0x0) returned 0x0 [0203.573] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4733f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4733f500) returned 0x0 [0203.573] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.573] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4733f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4733f500) returned 0x0 [0203.576] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.580] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0xe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.581] WriteFile (in: hFile=0x2c94, lpBuffer=0x4733fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4733f830, lpOverlapped=0x0 | out: lpBuffer=0x4733fb34*, lpNumberOfBytesWritten=0x4733f830*=0x428, lpOverlapped=0x0) returned 1 [0203.581] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.581] ReadFile (in: hFile=0x2c94, lpBuffer=0x5850000, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x4733f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesRead=0x4733f61c*=0x13c2, lpOverlapped=0x0) returned 1 [0203.581] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0xffffec3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.581] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5850000, cbInput=0x13c2, pPaddingInfo=0x0, pbIV=0x4733f848, cbIV=0x10, pbOutput=0x5850000, cbOutput=0x100000, pcbResult=0x4733f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4733f848, pbOutput=0x5850000, pcbResult=0x4733f618) returned 0x0 [0203.581] WriteFile (in: hFile=0x2c94, lpBuffer=0x5850000*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x4733f61c, lpOverlapped=0x0 | out: lpBuffer=0x5850000*, lpNumberOfBytesWritten=0x4733f61c*=0x13d0, lpOverlapped=0x0) returned 1 [0203.581] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4733f60c | out: lpNewFilePointer=0x0) returned 1 [0203.581] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.581] WriteFile (in: hFile=0x2c94, lpBuffer=0x4733f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4733f61c, lpOverlapped=0x0 | out: lpBuffer=0x4733f83c*, lpNumberOfBytesWritten=0x4733f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.581] SetFilePointerEx (in: hFile=0x2c94, liDistanceToMove=0x13d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.581] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.581] CloseHandle (hObject=0x2c94) returned 1 [0203.582] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.585] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\schol_02.mid.play")) returned 1 [0203.587] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3669 os_tid = 0x3760 [0203.592] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.592] ReadFile (in: hFile=0x2c9c, lpBuffer=0x4747fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4747f85c, lpOverlapped=0x0 | out: lpBuffer=0x4747fb34*, lpNumberOfBytesRead=0x4747f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.594] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.594] ReadFile (in: hFile=0x2c9c, lpBuffer=0x4747fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4747f85c, lpOverlapped=0x0 | out: lpBuffer=0x4747fb34*, lpNumberOfBytesRead=0x4747f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.594] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.598] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.598] BCryptSetProperty (in: hObject=0x7320d0, pszProperty="ChainingMode", pbInput=0x4747f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7320d0) returned 0x0 [0203.598] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7320d0, phKey=0x4747f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7320d0, phKey=0x4747f828, pbKeyObject=0x0) returned 0x0 [0203.598] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4747f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4747f500) returned 0x0 [0203.598] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.598] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4747f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4747f500) returned 0x0 [0203.602] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.605] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.605] WriteFile (in: hFile=0x2c9c, lpBuffer=0x4747fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4747f830, lpOverlapped=0x0 | out: lpBuffer=0x4747fb34*, lpNumberOfBytesWritten=0x4747f830*=0x428, lpOverlapped=0x0) returned 1 [0203.605] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.605] ReadFile (in: hFile=0x2c9c, lpBuffer=0x5950000, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x4747f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesRead=0x4747f61c*=0x18f8, lpOverlapped=0x0) returned 1 [0203.606] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0xffffe708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.606] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5950000, cbInput=0x18f8, pPaddingInfo=0x0, pbIV=0x4747f848, cbIV=0x10, pbOutput=0x5950000, cbOutput=0x100000, pcbResult=0x4747f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4747f848, pbOutput=0x5950000, pcbResult=0x4747f618) returned 0x0 [0203.606] WriteFile (in: hFile=0x2c9c, lpBuffer=0x5950000*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x4747f61c, lpOverlapped=0x0 | out: lpBuffer=0x5950000*, lpNumberOfBytesWritten=0x4747f61c*=0x1900, lpOverlapped=0x0) returned 1 [0203.606] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4747f60c | out: lpNewFilePointer=0x0) returned 1 [0203.606] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.607] WriteFile (in: hFile=0x2c9c, lpBuffer=0x4747f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4747f61c, lpOverlapped=0x0 | out: lpBuffer=0x4747f83c*, lpNumberOfBytesWritten=0x4747f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.607] SetFilePointerEx (in: hFile=0x2c9c, liDistanceToMove=0x1900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.607] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.607] CloseHandle (hObject=0x2c9c) returned 1 [0203.607] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\show_01.mid.play")) returned 1 [0203.612] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3670 os_tid = 0x3764 [0203.594] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.606] ReadFile (in: hFile=0x2ca4, lpBuffer=0x475bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x475bf85c, lpOverlapped=0x0 | out: lpBuffer=0x475bfb34*, lpNumberOfBytesRead=0x475bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.667] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.668] ReadFile (in: hFile=0x2ca4, lpBuffer=0x475bfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x475bf85c, lpOverlapped=0x0 | out: lpBuffer=0x475bfb34*, lpNumberOfBytesRead=0x475bf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.668] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.672] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.672] BCryptSetProperty (in: hObject=0x731e10, pszProperty="ChainingMode", pbInput=0x475bf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x731e10) returned 0x0 [0203.672] BCryptGenerateSymmetricKey (in: hAlgorithm=0x731e10, phKey=0x475bf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x731e10, phKey=0x475bf828, pbKeyObject=0x0) returned 0x0 [0203.672] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x475bf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x475bf500) returned 0x0 [0203.672] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.672] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x475bf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x475bf500) returned 0x0 [0203.677] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.683] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0x6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.683] WriteFile (in: hFile=0x2ca4, lpBuffer=0x475bfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x475bf830, lpOverlapped=0x0 | out: lpBuffer=0x475bfb34*, lpNumberOfBytesWritten=0x475bf830*=0x428, lpOverlapped=0x0) returned 1 [0203.684] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.684] ReadFile (in: hFile=0x2ca4, lpBuffer=0x5a50000, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x475bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesRead=0x475bf61c*=0x2a0a, lpOverlapped=0x0) returned 1 [0203.686] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0xffffd5f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.686] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5a50000, cbInput=0x2a0a, pPaddingInfo=0x0, pbIV=0x475bf848, cbIV=0x10, pbOutput=0x5a50000, cbOutput=0x100000, pcbResult=0x475bf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x475bf848, pbOutput=0x5a50000, pcbResult=0x475bf618) returned 0x0 [0203.686] WriteFile (in: hFile=0x2ca4, lpBuffer=0x5a50000*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x475bf61c, lpOverlapped=0x0 | out: lpBuffer=0x5a50000*, lpNumberOfBytesWritten=0x475bf61c*=0x2a10, lpOverlapped=0x0) returned 1 [0203.686] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x475bf60c | out: lpNewFilePointer=0x0) returned 1 [0203.686] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.687] WriteFile (in: hFile=0x2ca4, lpBuffer=0x475bf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x475bf61c, lpOverlapped=0x0 | out: lpBuffer=0x475bf83c*, lpNumberOfBytesWritten=0x475bf61c*=0x8, lpOverlapped=0x0) returned 1 [0203.687] SetFilePointerEx (in: hFile=0x2ca4, liDistanceToMove=0x2a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.687] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.687] CloseHandle (hObject=0x2ca4) returned 1 [0203.687] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.play")) returned 1 [0203.695] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3671 os_tid = 0x3768 [0203.700] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.700] ReadFile (in: hFile=0x2cac, lpBuffer=0x476ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x476ff85c, lpOverlapped=0x0 | out: lpBuffer=0x476ffb34*, lpNumberOfBytesRead=0x476ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.702] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.702] ReadFile (in: hFile=0x2cac, lpBuffer=0x476ffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x476ff85c, lpOverlapped=0x0 | out: lpBuffer=0x476ffb34*, lpNumberOfBytesRead=0x476ff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.702] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.705] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.706] BCryptSetProperty (in: hObject=0x732e90, pszProperty="ChainingMode", pbInput=0x476ff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732e90) returned 0x0 [0203.706] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732e90, phKey=0x476ff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732e90, phKey=0x476ff828, pbKeyObject=0x0) returned 0x0 [0203.706] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x476ff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x476ff500) returned 0x0 [0203.706] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.706] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x476ff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x476ff500) returned 0x0 [0203.709] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.713] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.713] WriteFile (in: hFile=0x2cac, lpBuffer=0x476ffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x476ff830, lpOverlapped=0x0 | out: lpBuffer=0x476ffb34*, lpNumberOfBytesWritten=0x476ff830*=0x428, lpOverlapped=0x0) returned 1 [0203.713] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.713] ReadFile (in: hFile=0x2cac, lpBuffer=0x5b50000, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x476ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesRead=0x476ff61c*=0x7ca4, lpOverlapped=0x0) returned 1 [0203.715] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0xffff835c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.715] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5b50000, cbInput=0x7ca4, pPaddingInfo=0x0, pbIV=0x476ff848, cbIV=0x10, pbOutput=0x5b50000, cbOutput=0x100000, pcbResult=0x476ff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x476ff848, pbOutput=0x5b50000, pcbResult=0x476ff618) returned 0x0 [0203.715] WriteFile (in: hFile=0x2cac, lpBuffer=0x5b50000*, nNumberOfBytesToWrite=0x7cb0, lpNumberOfBytesWritten=0x476ff61c, lpOverlapped=0x0 | out: lpBuffer=0x5b50000*, lpNumberOfBytesWritten=0x476ff61c*=0x7cb0, lpOverlapped=0x0) returned 1 [0203.715] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x476ff60c | out: lpNewFilePointer=0x0) returned 1 [0203.715] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.715] WriteFile (in: hFile=0x2cac, lpBuffer=0x476ff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x476ff61c, lpOverlapped=0x0 | out: lpBuffer=0x476ff83c*, lpNumberOfBytesWritten=0x476ff61c*=0x8, lpOverlapped=0x0) returned 1 [0203.715] SetFilePointerEx (in: hFile=0x2cac, liDistanceToMove=0x7cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.715] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.715] CloseHandle (hObject=0x2cac) returned 1 [0203.715] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.play")) returned 1 [0203.720] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3672 os_tid = 0x376c [0203.725] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.725] ReadFile (in: hFile=0x2cb4, lpBuffer=0x4783fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4783f85c, lpOverlapped=0x0 | out: lpBuffer=0x4783fb34*, lpNumberOfBytesRead=0x4783f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.727] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.727] ReadFile (in: hFile=0x2cb4, lpBuffer=0x4783fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4783f85c, lpOverlapped=0x0 | out: lpBuffer=0x4783fb34*, lpNumberOfBytesRead=0x4783f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.727] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.730] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.730] BCryptSetProperty (in: hObject=0x732de0, pszProperty="ChainingMode", pbInput=0x4783f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732de0) returned 0x0 [0203.730] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732de0, phKey=0x4783f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732de0, phKey=0x4783f828, pbKeyObject=0x0) returned 0x0 [0203.730] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4783f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4783f500) returned 0x0 [0203.730] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.730] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4783f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4783f500) returned 0x0 [0203.733] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.736] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.737] WriteFile (in: hFile=0x2cb4, lpBuffer=0x4783fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4783f830, lpOverlapped=0x0 | out: lpBuffer=0x4783fb34*, lpNumberOfBytesWritten=0x4783f830*=0x428, lpOverlapped=0x0) returned 1 [0203.737] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.737] ReadFile (in: hFile=0x2cb4, lpBuffer=0x5c50000, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x4783f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesRead=0x4783f61c*=0xf5c, lpOverlapped=0x0) returned 1 [0203.737] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0xfffff0a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.737] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5c50000, cbInput=0xf5c, pPaddingInfo=0x0, pbIV=0x4783f848, cbIV=0x10, pbOutput=0x5c50000, cbOutput=0x100000, pcbResult=0x4783f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4783f848, pbOutput=0x5c50000, pcbResult=0x4783f618) returned 0x0 [0203.738] WriteFile (in: hFile=0x2cb4, lpBuffer=0x5c50000*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x4783f61c, lpOverlapped=0x0 | out: lpBuffer=0x5c50000*, lpNumberOfBytesWritten=0x4783f61c*=0xf60, lpOverlapped=0x0) returned 1 [0203.738] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4783f60c | out: lpNewFilePointer=0x0) returned 1 [0203.738] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.738] WriteFile (in: hFile=0x2cb4, lpBuffer=0x4783f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4783f61c, lpOverlapped=0x0 | out: lpBuffer=0x4783f83c*, lpNumberOfBytesWritten=0x4783f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.738] SetFilePointerEx (in: hFile=0x2cb4, liDistanceToMove=0xf60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.738] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.738] CloseHandle (hObject=0x2cb4) returned 1 [0203.738] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.741] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.play")) returned 1 [0203.742] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3673 os_tid = 0x3770 [0203.746] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.746] ReadFile (in: hFile=0x2cbc, lpBuffer=0x4797fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4797f85c, lpOverlapped=0x0 | out: lpBuffer=0x4797fb34*, lpNumberOfBytesRead=0x4797f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.748] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.748] ReadFile (in: hFile=0x2cbc, lpBuffer=0x4797fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x4797f85c, lpOverlapped=0x0 | out: lpBuffer=0x4797fb34*, lpNumberOfBytesRead=0x4797f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.748] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.751] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.751] BCryptSetProperty (in: hObject=0x733150, pszProperty="ChainingMode", pbInput=0x4797f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x733150) returned 0x0 [0203.751] BCryptGenerateSymmetricKey (in: hAlgorithm=0x733150, phKey=0x4797f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x733150, phKey=0x4797f828, pbKeyObject=0x0) returned 0x0 [0203.751] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x4797f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x4797f500) returned 0x0 [0203.751] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.751] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x4797f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x4797f500) returned 0x0 [0203.755] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.757] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.757] WriteFile (in: hFile=0x2cbc, lpBuffer=0x4797fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x4797f830, lpOverlapped=0x0 | out: lpBuffer=0x4797fb34*, lpNumberOfBytesWritten=0x4797f830*=0x428, lpOverlapped=0x0) returned 1 [0203.758] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.758] ReadFile (in: hFile=0x2cbc, lpBuffer=0x5d50000, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x4797f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesRead=0x4797f61c*=0x1dac, lpOverlapped=0x0) returned 1 [0203.758] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0xffffe254, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.759] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5d50000, cbInput=0x1dac, pPaddingInfo=0x0, pbIV=0x4797f848, cbIV=0x10, pbOutput=0x5d50000, cbOutput=0x100000, pcbResult=0x4797f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x4797f848, pbOutput=0x5d50000, pcbResult=0x4797f618) returned 0x0 [0203.759] WriteFile (in: hFile=0x2cbc, lpBuffer=0x5d50000*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x4797f61c, lpOverlapped=0x0 | out: lpBuffer=0x5d50000*, lpNumberOfBytesWritten=0x4797f61c*=0x1db0, lpOverlapped=0x0) returned 1 [0203.759] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4797f60c | out: lpNewFilePointer=0x0) returned 1 [0203.759] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.759] WriteFile (in: hFile=0x2cbc, lpBuffer=0x4797f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4797f61c, lpOverlapped=0x0 | out: lpBuffer=0x4797f83c*, lpNumberOfBytesWritten=0x4797f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.759] SetFilePointerEx (in: hFile=0x2cbc, liDistanceToMove=0x1db0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.759] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.759] CloseHandle (hObject=0x2cbc) returned 1 [0203.759] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.play")) returned 1 [0203.763] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3674 os_tid = 0x3774 [0203.769] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.769] ReadFile (in: hFile=0x2cc4, lpBuffer=0x47abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x47abf85c, lpOverlapped=0x0 | out: lpBuffer=0x47abfb34*, lpNumberOfBytesRead=0x47abf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.770] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.770] ReadFile (in: hFile=0x2cc4, lpBuffer=0x47abfb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x47abf85c, lpOverlapped=0x0 | out: lpBuffer=0x47abfb34*, lpNumberOfBytesRead=0x47abf85c*=0x428, lpOverlapped=0x0) returned 1 [0203.770] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.773] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.773] BCryptSetProperty (in: hObject=0x732c80, pszProperty="ChainingMode", pbInput=0x47abf57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732c80) returned 0x0 [0203.773] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732c80, phKey=0x47abf828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732c80, phKey=0x47abf828, pbKeyObject=0x0) returned 0x0 [0203.773] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x47abf500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x47abf500) returned 0x0 [0203.773] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.773] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x47abf500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x47abf500) returned 0x0 [0203.776] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.779] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.779] WriteFile (in: hFile=0x2cc4, lpBuffer=0x47abfb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x47abf830, lpOverlapped=0x0 | out: lpBuffer=0x47abfb34*, lpNumberOfBytesWritten=0x47abf830*=0x428, lpOverlapped=0x0) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.780] ReadFile (in: hFile=0x2cc4, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x47abf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x47abf61c*=0x1268, lpOverlapped=0x0) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0xffffed98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.780] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5e50000, cbInput=0x1268, pPaddingInfo=0x0, pbIV=0x47abf848, cbIV=0x10, pbOutput=0x5e50000, cbOutput=0x100000, pcbResult=0x47abf618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x47abf848, pbOutput=0x5e50000, pcbResult=0x47abf618) returned 0x0 [0203.780] WriteFile (in: hFile=0x2cc4, lpBuffer=0x5e50000*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x47abf61c, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesWritten=0x47abf61c*=0x1270, lpOverlapped=0x0) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x47abf60c | out: lpNewFilePointer=0x0) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.780] WriteFile (in: hFile=0x2cc4, lpBuffer=0x47abf83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x47abf61c, lpOverlapped=0x0 | out: lpBuffer=0x47abf83c*, lpNumberOfBytesWritten=0x47abf61c*=0x8, lpOverlapped=0x0) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x2cc4, liDistanceToMove=0x1270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.780] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.780] CloseHandle (hObject=0x2cc4) returned 1 [0203.780] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.play")) returned 1 [0203.785] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3675 os_tid = 0x3778 [0203.788] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.788] ReadFile (in: hFile=0x2ccc, lpBuffer=0x47bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x47bff85c, lpOverlapped=0x0 | out: lpBuffer=0x47bffb34*, lpNumberOfBytesRead=0x47bff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.790] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.790] ReadFile (in: hFile=0x2ccc, lpBuffer=0x47bffb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x47bff85c, lpOverlapped=0x0 | out: lpBuffer=0x47bffb34*, lpNumberOfBytesRead=0x47bff85c*=0x428, lpOverlapped=0x0) returned 1 [0203.790] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.792] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.792] BCryptSetProperty (in: hObject=0x732180, pszProperty="ChainingMode", pbInput=0x47bff57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732180) returned 0x0 [0203.792] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732180, phKey=0x47bff828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732180, phKey=0x47bff828, pbKeyObject=0x0) returned 0x0 [0203.792] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x47bff500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x47bff500) returned 0x0 [0203.793] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.793] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x47bff500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x47bff500) returned 0x0 [0203.796] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.799] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.799] WriteFile (in: hFile=0x2ccc, lpBuffer=0x47bffb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x47bff830, lpOverlapped=0x0 | out: lpBuffer=0x47bffb34*, lpNumberOfBytesWritten=0x47bff830*=0x428, lpOverlapped=0x0) returned 1 [0203.800] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.800] ReadFile (in: hFile=0x2ccc, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x47bff61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x47bff61c*=0x20e0, lpOverlapped=0x0) returned 1 [0203.800] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0xffffdf20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.800] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x5f50000, cbInput=0x20e0, pPaddingInfo=0x0, pbIV=0x47bff848, cbIV=0x10, pbOutput=0x5f50000, cbOutput=0x100000, pcbResult=0x47bff618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x47bff848, pbOutput=0x5f50000, pcbResult=0x47bff618) returned 0x0 [0203.800] WriteFile (in: hFile=0x2ccc, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x47bff61c, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x47bff61c*=0x20f0, lpOverlapped=0x0) returned 1 [0203.800] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x47bff60c | out: lpNewFilePointer=0x0) returned 1 [0203.801] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.801] WriteFile (in: hFile=0x2ccc, lpBuffer=0x47bff83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x47bff61c, lpOverlapped=0x0 | out: lpBuffer=0x47bff83c*, lpNumberOfBytesWritten=0x47bff61c*=0x8, lpOverlapped=0x0) returned 1 [0203.801] SetFilePointerEx (in: hFile=0x2ccc, liDistanceToMove=0x20f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.801] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.801] CloseHandle (hObject=0x2ccc) returned 1 [0203.801] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.play")) returned 1 [0203.805] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3676 os_tid = 0x377c [0203.809] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.809] ReadFile (in: hFile=0x2cd4, lpBuffer=0x47d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x47d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x47d3fb34*, lpNumberOfBytesRead=0x47d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.810] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.811] ReadFile (in: hFile=0x2cd4, lpBuffer=0x47d3fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x47d3f85c, lpOverlapped=0x0 | out: lpBuffer=0x47d3fb34*, lpNumberOfBytesRead=0x47d3f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.811] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.813] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.813] BCryptSetProperty (in: hObject=0x7322e0, pszProperty="ChainingMode", pbInput=0x47d3f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x7322e0) returned 0x0 [0203.813] BCryptGenerateSymmetricKey (in: hAlgorithm=0x7322e0, phKey=0x47d3f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x7322e0, phKey=0x47d3f828, pbKeyObject=0x0) returned 0x0 [0203.813] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x47d3f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x47d3f500) returned 0x0 [0203.814] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.814] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x47d3f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x47d3f500) returned 0x0 [0203.817] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.820] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0xc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.820] WriteFile (in: hFile=0x2cd4, lpBuffer=0x47d3fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x47d3f830, lpOverlapped=0x0 | out: lpBuffer=0x47d3fb34*, lpNumberOfBytesWritten=0x47d3f830*=0x428, lpOverlapped=0x0) returned 1 [0203.821] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.821] ReadFile (in: hFile=0x2cd4, lpBuffer=0x6050000, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x47d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesRead=0x47d3f61c*=0xae4, lpOverlapped=0x0) returned 1 [0203.821] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0xfffff51c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.821] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6050000, cbInput=0xae4, pPaddingInfo=0x0, pbIV=0x47d3f848, cbIV=0x10, pbOutput=0x6050000, cbOutput=0x100000, pcbResult=0x47d3f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x47d3f848, pbOutput=0x6050000, pcbResult=0x47d3f618) returned 0x0 [0203.821] WriteFile (in: hFile=0x2cd4, lpBuffer=0x6050000*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x47d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x6050000*, lpNumberOfBytesWritten=0x47d3f61c*=0xaf0, lpOverlapped=0x0) returned 1 [0203.821] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x47d3f60c | out: lpNewFilePointer=0x0) returned 1 [0203.821] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.821] WriteFile (in: hFile=0x2cd4, lpBuffer=0x47d3f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x47d3f61c, lpOverlapped=0x0 | out: lpBuffer=0x47d3f83c*, lpNumberOfBytesWritten=0x47d3f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.821] SetFilePointerEx (in: hFile=0x2cd4, liDistanceToMove=0xaf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.821] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.821] CloseHandle (hObject=0x2cd4) returned 1 [0203.821] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.play")) returned 1 [0203.826] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 Thread: id = 3677 os_tid = 0x3780 [0203.830] SetFilePointerEx (in: hFile=0x2cdc, liDistanceToMove=0xfffffbd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.832] ReadFile (in: hFile=0x2cdc, lpBuffer=0x47e7fb34, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x47e7f85c, lpOverlapped=0x0 | out: lpBuffer=0x47e7fb34*, lpNumberOfBytesRead=0x47e7f85c*=0x428, lpOverlapped=0x0) returned 1 [0203.834] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x204) returned 0x910000 [0203.837] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910000, cbBuffer=0x20, dwFlags=0x0 | out: pbBuffer=0x910000) returned 0x0 [0203.838] BCryptSetProperty (in: hObject=0x732ff0, pszProperty="ChainingMode", pbInput=0x47e7f57c, cbInput=0x40, dwFlags=0x0 | out: hObject=0x732ff0) returned 0x0 [0203.838] BCryptGenerateSymmetricKey (in: hAlgorithm=0x732ff0, phKey=0x47e7f828, pbKeyObject=0x0, cbKeyObject=0x0, pbSecret=0x910000, cbSecret=0x20, dwFlags=0x0 | out: hAlgorithm=0x732ff0, phKey=0x47e7f828, pbKeyObject=0x0) returned 0x0 [0203.838] BCryptExportKey (in: hKey=0x7f1f10, hExportKey=0x0, pszBlobType="OpaqueKeyBlob", pbOutput=0x910000, cbOutput=0x230, pcbResult=0x47e7f500, dwFlags=0x0 | out: pbOutput=0x910000, pcbResult=0x47e7f500) returned 0x0 [0203.838] BCryptGenRandom (in: hAlgorithm=0x727320, pbBuffer=0x910230, cbBuffer=0x10, dwFlags=0x0 | out: pbBuffer=0x910230) returned 0x0 [0203.838] BCryptEncrypt (in: hKey=0x7299a8, pbInput=0x910000, cbInput=0x240, pPaddingInfo=0x0, pbIV=0x0, cbIV=0x0, pbOutput=0x910000, cbOutput=0x400, pcbResult=0x47e7f500, dwFlags=0x2 | out: hKey=0x7299a8, pbIV=0x0, pbOutput=0x910000, pcbResult=0x47e7f500) returned 0x0 [0203.842] VirtualFree (lpAddress=0x910000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.847] SetFilePointerEx (in: hFile=0x2cdc, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.847] WriteFile (in: hFile=0x2cdc, lpBuffer=0x47e7fb34*, nNumberOfBytesToWrite=0x428, lpNumberOfBytesWritten=0x47e7f830, lpOverlapped=0x0 | out: lpBuffer=0x47e7fb34*, lpNumberOfBytesWritten=0x47e7f830*=0x428, lpOverlapped=0x0) returned 1 [0203.847] SetFilePointerEx (in: hFile=0x2cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.847] ReadFile (in: hFile=0x2cdc, lpBuffer=0x6150000, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x47e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesRead=0x47e7f61c*=0x540, lpOverlapped=0x0) returned 1 [0203.847] SetFilePointerEx (in: hFile=0x2cdc, liDistanceToMove=0xfffffac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.847] BCryptEncrypt (in: hKey=0x7f1f10, pbInput=0x6150000, cbInput=0x540, pPaddingInfo=0x0, pbIV=0x47e7f848, cbIV=0x10, pbOutput=0x6150000, cbOutput=0x100000, pcbResult=0x47e7f618, dwFlags=0x1 | out: hKey=0x7f1f10, pbIV=0x47e7f848, pbOutput=0x6150000, pcbResult=0x47e7f618) returned 0x0 [0203.847] WriteFile (in: hFile=0x2cdc, lpBuffer=0x6150000*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x47e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x6150000*, lpNumberOfBytesWritten=0x47e7f61c*=0x550, lpOverlapped=0x0) returned 1 [0203.847] SetFilePointerEx (in: hFile=0x2cdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x47e7f60c | out: lpNewFilePointer=0x0) returned 1 [0203.847] SetFilePointerEx (in: hFile=0x2cdc, liDistanceToMove=0xfffffbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.848] WriteFile (in: hFile=0x2cdc, lpBuffer=0x47e7f83c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x47e7f61c, lpOverlapped=0x0 | out: lpBuffer=0x47e7f83c*, lpNumberOfBytesWritten=0x47e7f61c*=0x8, lpOverlapped=0x0) returned 1 [0203.848] SetFilePointerEx (in: hFile=0x2cdc, liDistanceToMove=0x550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.848] BCryptDestroyKey (in: hKey=0x7f1f10 | out: hKey=0x7f1f10) returned 0x0 [0203.848] CloseHandle (hObject=0x2cdc) returned 1 [0203.848] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x4) returned 0x910000 [0203.851] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.PLAY" (normalized: "c:\\program files (x86)\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.play")) Thread: id = 3678 os_tid = 0x3784